# CVEs published 2023-07-19

64 CVEs were published on July 19, 2023: 5 critical, 19 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-3300](https://cve.now/CVE-2023-3300.md): Nomad Search API Leaks Information About CSI Plugins (CVSS 5.3, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2023-3299](https://cve.now/CVE-2023-3299.md): Nomad Caller ACL Token's Secret ID is Exposed to Sentinel (CVSS 3.4, HashiCorp Nomad Enterprise · github.com/hashicorp/nomad)
- [CVE-2023-3072](https://cve.now/CVE-2023-3072.md): Nomad ACL Policies without Label are Applied to Unexpected Resources (CVSS 4.1, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2023-36853](https://cve.now/CVE-2023-36853.md): Keysight Geolocation Server Exposed Dangerous Method or Function (CVSS 7.8, Keysight Technologies N6845A Geolocation Server)
- [CVE-2023-34394](https://cve.now/CVE-2023-34394.md): Keysight N6845A Relative Path Traversal (CVSS 7.8, Keysight Technologies N6845A Geolocation Server)
- [CVE-2023-37362](https://cve.now/CVE-2023-37362.md): Weintek Weincloud Improper Authentication (CVSS 7.2, Weintek Weincloud)
- [CVE-2023-32657](https://cve.now/CVE-2023-32657.md): Weintek Weincloud Improper Restriction of Excessive Authentication Attempts (CVSS 5.3, Weintek Weincloud)
- [CVE-2023-34429](https://cve.now/CVE-2023-34429.md): Weintek Weincloud Improper Handling of Structural Elements (CVSS 7.5, Weintek Weincloud)
- [CVE-2023-35134](https://cve.now/CVE-2023-35134.md): Weintek Weincloud Weak Password Recovery Mechanism for Forgotten Password (CVSS 7.4, Weintek Weincloud)
- [CVE-2023-3782](https://cve.now/CVE-2023-3782.md): DoS of the OkHttp client when using a BrotliInterceptor and surfing to a malicious web server, or when an attacker can perform MitM to inject a Brotli zip-bomb into an HTTP response (CVSS 5.9, com.squareup.okhttp3:okhttp-brotli)
- [CVE-2023-26217](https://cve.now/CVE-2023-26217.md): TIBCO EBX Add-ons SQL Injection Vulnerability (CVSS 8.8, TIBCO Software TIBCO EBX Add-ons)
- [CVE-2023-3722](https://cve.now/CVE-2023-3722.md): Avaya Aura Device Services Remote Code Execution (CVSS 8.6, Avaya Aura Device Services)
- [CVE-2023-37899](https://cve.now/CVE-2023-37899.md): feathersjs socket handler allows abusing implicit toString (CVSS 7.5, feathersjs feathers · @feathersjs/socketio +1)
- [CVE-2023-37276](https://cve.now/CVE-2023-37276.md): aiohttp vulnerable to HTTP request smuggling (CVSS 5.3, aio-libs aiohttp · aiohttp)
- [CVE-2023-3467](https://cve.now/CVE-2023-3467.md): Privilege Escalation to root administrator (nsroot) (CVSS 8.0, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2023-3674](https://cve.now/CVE-2023-3674.md): Keylime: attestation failure when the quote's signature does not validate (CVSS 2.3, Red Hat Enterprise Linux · keylime)
- [CVE-2023-3466](https://cve.now/CVE-2023-3466.md): Reflected Cross-Site Scripting (XSS) (CVSS 8.3, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2023-3519](https://cve.now/CVE-2023-3519.md): Unauthenticated remote code execution (CVSS 9.8, KEV, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2023-32263](https://cve.now/CVE-2023-32263.md): Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3 (CVSS 2.6, Micro Focus Dimensions CM · org.jenkins-ci.plugins:dimensio…)
- [CVE-2023-32262](https://cve.now/CVE-2023-32262.md): Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3 (CVSS 4.3, Micro Focus Dimensions CM · org.jenkins-ci.plugins:dimensio…)
- [CVE-2023-32261](https://cve.now/CVE-2023-32261.md): Dimensions CM Plugin for Jenkins 0.8.17 – 0.9.3 (CVSS 4.2, Micro Focus Dimensions CM · org.jenkins-ci.plugins:dimensio…)
- [CVE-2023-25839](https://cve.now/CVE-2023-25839.md): BUG-000157278 – ArcGIS Insights has a security vulnerability - desktop (CVSS 7.0, Esri ArcGIS Insights)
- [CVE-2023-25838](https://cve.now/CVE-2023-25838.md): BUG-000157278 – ArcGIS Insights has a security vulnerability. (CVSS 7.5, Esri ArcGIS Insights)
- [CVE-2023-30799](https://cve.now/CVE-2023-30799.md): MikroTik RouterOS Administrator Privilege Escalation (CVSS 9.1, MikroTik RouterOS)
- [CVE-2023-3638](https://cve.now/CVE-2023-3638.md): GeoVision GV-ADR2701 Improper Authentication (CVSS 9.8, GeoVision GV-ADR2701)
- [CVE-2023-34034](https://cve.now/CVE-2023-34034.md): Using "\*\*" as a pattern in Spring Security configuration for WebFlux creates a mismatch in pattern matching between Spring Security and Sp (CVSS 9.1, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2023-3463](https://cve.now/CVE-2023-3463.md): GE Digital CIMPLICITY Heap-based Buffer Overflow (CVSS 6.6, GE Digital CIMPLICITY)
- [CVE-2023-28744](https://cve.now/CVE-2023-28744.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software's PDF Reader, version 12.1.1.15289. (CVSS 8.8, Foxit Reader)
- [CVE-2023-27379](https://cve.now/CVE-2023-27379.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. (CVSS 8.8, Foxit Reader)
- [CVE-2023-33866](https://cve.now/CVE-2023-33866.md): A use-after-free vulnerability exists in the JavaScript engine of Foxit Software’s PDF Reader, version 12.1.2.15332. (CVSS 8.8, Foxit Reader)
- [CVE-2023-32664](https://cve.now/CVE-2023-32664.md): A type confusion vulnerability exists in the Javascript checkThisBox method as implemented in Foxit Reader 12.1.2.15332. (CVSS 8.8, Foxit Reader)
- [CVE-2023-33876](https://cve.now/CVE-2023-33876.md): A use-after-free vulnerability exists in the way Foxit Reader 12.1.2.15332 handles destroying annotations. (CVSS 8.8, Foxit Reader)
- [CVE-2023-3446](https://cve.now/CVE-2023-3446.md): Excessive time spent checking DH keys and parameters (CVSS 5.3, OpenSSL)
- [CVE-2023-28754](https://cve.now/CVE-2023-28754.md): ShardingSphere-Agent: Deserialization vulnerability in ShardingSphere Agent (CVSS 8.8, Apache Software Foundation ShardingSphere-Agent · org.apach…)
- [CVE-2023-3763](https://cve.now/CVE-2023-3763.md): Intergard SGS SQL Query cleartext transmission (CVSS 3.7, Intergard SGS)
- [CVE-2023-3762](https://cve.now/CVE-2023-3762.md): Intergard SGS sensitive information in memory (CVSS 4.3, Intergard SGS)
- [CVE-2023-3761](https://cve.now/CVE-2023-3761.md): Intergard SGS Password Change cleartext transmission (CVSS 3.7, Intergard SGS)
- [CVE-2023-32635](https://cve.now/CVE-2023-32635.md): XBRL data create application version 7.0 and earlier improperly restricts XML external entity references (XXE). (no CVSS, Financial Services Agency XBRL data create application)
- [CVE-2023-3760](https://cve.now/CVE-2023-3760.md): Intergard SGS Change Password denial of service (CVSS 4.3, Intergard SGS)
- [CVE-2023-3759](https://cve.now/CVE-2023-3759.md): Intergard SGS permission (CVSS 6.3, Intergard SGS)
- [CVE-2023-3757](https://cve.now/CVE-2023-3757.md): GZ Scripts Car Rental Script cross site scripting (CVSS 3.5, GZ Scripts Car Rental Script)
- [CVE-2023-3756](https://cve.now/CVE-2023-3756.md): Creativeitem Atlas Business Directory Listing search cross site scripting (CVSS 3.5, Creativeitem Atlas Business Directory Listing)
- [CVE-2023-3755](https://cve.now/CVE-2023-3755.md): Creativeitem Atlas Business Directory Listing filter\_listings cross site scripting (CVSS 3.5, Creativeitem Atlas Business Directory Listing)
- [CVE-2023-3754](https://cve.now/CVE-2023-3754.md): Creativeitem Ekushey Project Manager CRM xxxxxxxx\[random-msg-hash\] cross site scripting (CVSS 3.5, Creativeitem Ekushey Project Manager CRM)
- [CVE-2022-43910](https://cve.now/CVE-2022-43910.md): IBM Security Guardium privilege escalation (CVSS 8.4, IBM Security Guardium)
- [CVE-2023-3753](https://cve.now/CVE-2023-3753.md): Creativeitem Mastery LMS browse cross site scripting (CVSS 3.5, Creativeitem Mastery LMS)
- [CVE-2022-43908](https://cve.now/CVE-2022-43908.md): IBM Security Guardium denial of service (CVSS 4.3, IBM Security Guardium)
- [CVE-2023-28513](https://cve.now/CVE-2023-28513.md): IBM MQ denial of service (CVSS 5.9, IBM MQ)
- [CVE-2023-26026](https://cve.now/CVE-2023-26026.md): IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure (CVSS 5.3, IBM Planning Analytics Cartridge for Cloud Pak for Data)
- [CVE-2023-26023](https://cve.now/CVE-2023-26023.md): IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure (CVSS 6.5, IBM Sterling Connect:Express for UNIX)
- [CVE-2023-27877](https://cve.now/CVE-2023-27877.md): IBM Planning Analytics Cartridge for Cloud Pak for Data information disclosure (CVSS 5.3, IBM Planning Analytics Cartridge for Cloud Pak for Data)
- [CVE-2023-3752](https://cve.now/CVE-2023-3752.md): Creativeitem Academy LMS courses cross site scripting (CVSS 3.5, Creativeitem Academy LMS)
- [CVE-2021-38933](https://cve.now/CVE-2021-38933.md): IBM Sterling Connect:Express for UNIX information disclosure (CVSS 5.9, IBM Sterling Connect:Express for UNIX)
- [CVE-2023-29260](https://cve.now/CVE-2023-29260.md): IBM Sterling Connect:Express for UNIX server-side request forgery (CVSS 6.5, IBM Sterling Connect:Express for UNIX)
- [CVE-2023-29259](https://cve.now/CVE-2023-29259.md): IBM Sterling Connect:Express for UNIX information disclosure (CVSS 3.7, IBM Sterling Connect:Express for UNIX)
- [CVE-2023-35900](https://cve.now/CVE-2023-35900.md): IBM Robotic Process Automation information disclosure (CVSS 4.3, IBM Robotic Process Automation)
- [CVE-2023-3765](https://cve.now/CVE-2023-3765.md): Absolute Path Traversal in mlflow/mlflow (CVSS 10.0, mlflow/mlflow · mlflow)
- [CVE-2023-33832](https://cve.now/CVE-2023-33832.md): IBM Storage Protect denial of service (CVSS 6.2, IBM Storage Protect)
- [CVE-2023-35898](https://cve.now/CVE-2023-35898.md): IBM InfoSphere Information Server information disclosure (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2023-30433](https://cve.now/CVE-2023-30433.md): IBM Security Verify Access HTTP open redirect (CVSS 6.5, IBM Security Verify Access Docker)
- [CVE-2023-3751](https://cve.now/CVE-2023-3751.md): Super Store Finder POST Parameter index.php sql injection (CVSS 6.3, Super Store Finder)
- [CVE-2022-40896](https://cve.now/CVE-2022-40896.md): A ReDoS issue was discovered in pygments/lexers/smithy.py in pygments through 2.15.0 via SmithyLexer. (no CVSS, pygments)
- [CVE-2023-37733](https://cve.now/CVE-2023-37733.md): An arbitrary file upload vulnerability in tduck-platform v4.0 allows attackers to execute arbitrary code via a crafted HTML file. (no CVSS)
- [CVE-2023-37748](https://cve.now/CVE-2023-37748.md): ngiflib commit 5e7292 was discovered to contain an infinite loop via the function DecodeGifImg at ngiflib.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.