CVEs published July 19, 2023
64 CVEs were published on July 19, 2023: 5 critical, 19 high. 1 is now in CISA KEV.
- Published
- 64
- Critical
- 5
- High
- 19
- Medium
- 24
- Low
- 12
- Unrated
- 4
- Now in CISA KEV
- 1
- Fix available
- 19
Most affected products
- Foxit Reader
- 5
- Intergard SGS
- 5
- IBM Sterling Connect:Express for UNIX
- 4
- Weintek Weincloud
- 4
- Citrix NetScaler ADC · Citrix NetScaler Gateway
- 3
- Micro Focus Dimensions CM · org.jenkins-ci.plugins:dimensio…
- 3
- Creativeitem Atlas Business Directory Listing
- 2
- Esri ArcGIS Insights
- 2
- HashiCorp Nomad · github.com/hashicorp/nomad
- 2
- IBM Planning Analytics Cartridge for Cloud Pak for Data
- 2
Critical 5
- CVE-2023-3519Unauthenticated remote code executionCitrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2023-30799MikroTik RouterOS Administrator Privilege EscalationMikroTik RouterOS
- CVE-2023-3638GeoVision GV-ADR2701 Improper AuthenticationGeoVision GV-ADR2701
- CVE-2023-34034Using "**" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and SpSpring Security · org.springframework.security:spring-secur…
- CVE-2023-3765Absolute Path Traversal in mlflow/mlflowmlflow/mlflow · mlflow
High 19
- CVE-2023-36853Keysight Geolocation Server Exposed Dangerous Method or FunctionKeysight Technologies N6845A Geolocation Server
- CVE-2023-34394Keysight N6845A Relative Path TraversalKeysight Technologies N6845A Geolocation Server
- CVE-2023-37362Weintek Weincloud Improper AuthenticationWeintek Weincloud
- CVE-2023-34429Weintek Weincloud Improper Handling of Structural ElementsWeintek Weincloud
- CVE-2023-35134Weintek Weincloud Weak Password Recovery Mechanism for Forgotten PasswordWeintek Weincloud
- CVE-2023-26217TIBCO EBX Add-ons SQL Injection VulnerabilityTIBCO Software TIBCO EBX Add-ons
- CVE-2023-3722Avaya Aura Device Services Remote Code ExecutionAvaya Aura Device Services
- CVE-2023-37899feathersjs socket handler allows abusing implicit toStringfeathersjs feathers · @feathersjs/socketio +1
- CVE-2023-3467Privilege Escalation to root administrator (nsroot) Citrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2023-3466Reflected Cross-Site Scripting (XSS) Citrix NetScaler ADC · Citrix NetScaler Gateway
- CVE-2023-25839BUG-000157278 – ArcGIS Insights has a security vulnerability - desktopEsri ArcGIS Insights
- CVE-2023-25838BUG-000157278 – ArcGIS Insights has a security vulnerability.Esri ArcGIS Insights
- CVE-2023-28744A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.1.1.15289.Foxit Reader
- CVE-2023-27379A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332.Foxit Reader
- CVE-2023-33866A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332.Foxit Reader
- CVE-2023-32664A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332.Foxit Reader
- CVE-2023-33876A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15332 handles destroying annotations.Foxit Reader
- CVE-2023-28754ShardingSphere-Agent: Deserialization vulnerability in ShardingSphere AgentApache Software Foundation ShardingSphere-Agent · org.apach…
- CVE-2022-43910IBM Security Guardium privilege escalationIBM Security Guardium
Medium, low and unrated 40
- CVE-2023-3300Nomad Search API Leaks Information About CSI PluginsHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2023-3299Nomad Caller ACL Token's Secret ID is Exposed to SentinelHashiCorp Nomad Enterprise · github.com/hashicorp/nomad
- CVE-2023-3072Nomad ACL Policies without Label are Applied to Unexpected ResourcesHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2023-32657Weintek Weincloud Improper Restriction of Excessive Authentication AttemptsWeintek Weincloud
- CVE-2023-3782DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP responsecom.squareup.okhttp3:okhttp-brotli
- CVE-2023-37276aiohttp vulnerable to HTTP request smugglingaio-libs aiohttp · aiohttp
- CVE-2023-3674Keylime: attestation failure when the quote's signature does not validateRed Hat Enterprise Linux · keylime
- CVE-2023-32263Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3Micro Focus Dimensions CM · org.jenkins-ci.plugins:dimensio…
- CVE-2023-32262Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3Micro Focus Dimensions CM · org.jenkins-ci.plugins:dimensio…
- CVE-2023-32261Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3Micro Focus Dimensions CM · org.jenkins-ci.plugins:dimensio…
- CVE-2023-3463GE Digital CIMPLICITY Heap-based Buffer OverflowGE Digital CIMPLICITY
- CVE-2023-3446Excessive time spent checking DH keys and parametersOpenSSL
- CVE-2023-3763Intergard SGS SQL Query cleartext transmissionIntergard SGS
- CVE-2023-3762Intergard SGS sensitive information in memoryIntergard SGS
- CVE-2023-3761Intergard SGS Password Change cleartext transmissionIntergard SGS
- CVE-2023-32635XBRL data create application version 7.0 and earlier improperly restricts XML external entity references (XXE).Financial Services Agency XBRL data create application
- CVE-2023-3760Intergard SGS Change Password denial of serviceIntergard SGS
- CVE-2023-3759Intergard SGS permissionIntergard SGS
- CVE-2023-3757GZ Scripts Car Rental Script cross site scriptingGZ Scripts Car Rental Script
- CVE-2023-3756Creativeitem Atlas Business Directory Listing search cross site scriptingCreativeitem Atlas Business Directory Listing
- CVE-2023-3755Creativeitem Atlas Business Directory Listing filter_listings cross site scriptingCreativeitem Atlas Business Directory Listing
- CVE-2023-3754Creativeitem Ekushey Project Manager CRM xxxxxxxx[random-msg-hash] cross site scriptingCreativeitem Ekushey Project Manager CRM
- CVE-2023-3753Creativeitem Mastery LMS browse cross site scriptingCreativeitem Mastery LMS
- CVE-2022-43908IBM Security Guardium denial of serviceIBM Security Guardium
- CVE-2023-28513IBM MQ denial of serviceIBM MQ
- CVE-2023-26026IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosureIBM Planning Analytics Cartridge for Cloud Pak for Data
- CVE-2023-26023IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosureIBM Sterling Connect:Express for UNIX
- CVE-2023-27877IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosureIBM Planning Analytics Cartridge for Cloud Pak for Data
- CVE-2023-3752Creativeitem Academy LMS courses cross site scriptingCreativeitem Academy LMS
- CVE-2021-38933IBM Sterling Connect:Express for UNIX information disclosureIBM Sterling Connect:Express for UNIX
- CVE-2023-29260IBM Sterling Connect:Express for UNIX server-side request forgeryIBM Sterling Connect:Express for UNIX
- CVE-2023-29259IBM Sterling Connect:Express for UNIX information disclosureIBM Sterling Connect:Express for UNIX
- CVE-2023-35900IBM Robotic Process Automation information disclosureIBM Robotic Process Automation
- CVE-2023-33832IBM Storage Protect denial of serviceIBM Storage Protect
- CVE-2023-35898IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2023-30433IBM Security Verify Access HTTP open redirectIBM Security Verify Access Docker
- CVE-2023-3751Super Store Finder POST Parameter index.php sql injectionSuper Store Finder
- CVE-2022-40896A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer.pygments
- CVE-2023-37733An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file.
- CVE-2023-37748ngiflib commit 5e7292 was discovered to contain an infinite loop via the function DecodeGifImg at ngiflib.c.