CVEs published July 20, 2023
66 CVEs were published on July 20, 2023: 4 critical, 8 high. 1 is now in CISA KEV.
- Published
- 66
- Critical
- 4
- High
- 8
- Medium
- 25
- Low
- 9
- Unrated
- 20
- Now in CISA KEV
- 1
- Fix available
- 8
Most affected products
- GNU Project GNU GRUB
- 4
- Red Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- 4
- Dell Wyse Management Suite
- 3
- Dell Wyse Proprietary OS
- 3
- IBOS OA
- 3
- Bug Finder ChainCity Real Estate Investment Platform
- 2
- cockpit-hq/cockpit
- 2
- InfoDoc Document On-line Submission and Approval System
- 2
- PaulPrinting CMS
- 2
- ActiveITzone Active Super Shop CMS
- 1
Critical 4
- CVE-2023-37471User impersonation using SAMLv1.x SSO in Open Access Management OpenIdentityPlatform OpenAM · org.openidentityplatform.open…
- CVE-2023-38203Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCEAdobe ColdFusion
- CVE-2023-37289InfoDoc Document On-line Submission and Approval System - Arbitrary File UploadInfoDoc Document On-line Submission and Approval System
- CVE-2023-38408The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if
High 8
- CVE-2023-25835BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerabilityEsri Portal for ArcGIS Sites
- CVE-2023-34966Samba: infinite loop in mdssvc rpc service for spotlightRed Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- CVE-2023-32265Mitigations and availability of updates relating to security vulnerability in ESCWA component CVE-2023-32265.Micro Focus Enterprise Server · Micro Focus Enterprise T… +3
- CVE-2023-37290InfoDoc Document On-line Submission and Approval System - Server-Side Request Forgery (SSRF)InfoDoc Document On-line Submission and Approval System
- CVE-2021-39822Adobe InDesign BMP File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2022-28734Out-of-bounds write when handling split HTTP headersGNU Project GNU GRUB
- CVE-2022-28733Integer underflow in grub_net_recv_ip4_packetsGNU Project GNU GRUB
- CVE-2023-30200In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.1.02 from Advanced Plugins for Pr
Medium, low and unrated 54
- CVE-2023-3801IBOS OA Mobile Notification edit actionEdit sql injectionIBOS OA
- CVE-2023-3800EasyAdmin8 File Upload Module index.html unrestricted uploadEasyAdmin8
- CVE-2023-3799IBOS OA Delete Category del sql injectionIBOS OA
- CVE-2023-3798Chengdu Flash Flood Disaster Monitoring and Warning System upload.aspx unrestricted uploadChengdu Flash Flood Disaster Monitoring and Warning System
- CVE-2023-3797Gen Technology Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early Warning System UploadFloodPlanFileUpdate.ashx unrestricted uploadGen Technology Four Mountain Torrent Disaster Prevention an…
- CVE-2023-3796Bug Finder Foody Friend Profile Picture profile unrestricted uploadBug Finder Foody Friend
- CVE-2023-3795Bug Finder ChainCity Real Estate Investment Platform GET Parameter property sql injectionBug Finder ChainCity Real Estate Investment Platform
- CVE-2023-3794Bug Finder ChainCity Real Estate Investment Platform New Ticket create cross site scriptingBug Finder ChainCity Real Estate Investment Platform
- CVE-2023-3793Weaver e-cology HTTP POST Request filelFileDownloadForOutDoc.class sql injectionWeaver e-cology
- CVE-2023-3792Beijing Netcon NS-ASG test_status.php direct requestBeijing Netcon NS-ASG
- CVE-2023-3791IBOS OA Personal Office Address Book export actionExport sql injectionIBOS OA
- CVE-2023-3790Boom CMS assets-manager add cross site scriptingBoom CMS
- CVE-2023-3789PaulPrinting CMS Search delivery cross site scriptingPaulPrinting CMS
- CVE-2023-3788ActiveITzone Active Super Shop CMS Manage Details Page cross site scriptingActiveITzone Active Super Shop CMS
- CVE-2023-34968Samba: spotlight server-side share path disclosureRed Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- CVE-2023-34967Samba: type confusion in mdssvc rpc service for spotlightRed Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- CVE-2023-3347Samba: smb2 packet signing is not enforced when "server signing = required" is setRed Hat Enterprise Linux · Red Hat Storage
- CVE-2023-3787Codecanyon Tiva Events Calender cross site scriptingCodecanyon Tiva Events Calender
- CVE-2022-2127Samba: out-of-bounds read in winbind auth_crapRed Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- CVE-2023-32476 Dell Hybrid Client version 2.0 contains a Sensitive Data Exposure vulnerability.Dell Hybrid Client
- CVE-2023-3786Aures Komet Kiosk Mode access controlAures Komet
- CVE-2023-32447 Dell Wyse ThinOS versions prior to 2306 (9.4.2103) contain a sensitive information disclosure vulnerability.Dell Wyse Proprietary OS
- CVE-2023-32446 Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability.Dell Wyse Proprietary OS
- CVE-2023-32455 Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain a sensitive information disclosure vulnerability.Dell Wyse Proprietary OS
- CVE-2023-32483 Wyse Management Suite versions prior to 4.0 contain a sensitive information disclosure vulnerability.Dell Wyse Management Suite
- CVE-2023-32482 Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability.Dell Wyse Management Suite
- CVE-2023-32481 Wyse Management Suite versions prior to 4.0 contain a denial-of-service vulnerability.Dell Wyse Management Suite
- CVE-2023-3785PaulPrinting CMS cross site scriptingPaulPrinting CMS
- CVE-2023-3784Dooblou WiFi File Explorer cross site scriptingDooblou WiFi File Explorer
- CVE-2023-3783Webile HTTP POST Request cross site scriptingWebile
- CVE-2023-3779Essential Addons For Elementor <=5.8.1 - Unauthenticated MailChimp API Key Disclosurewpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2022-28737There's a possible overflow in handle_image() when shim tries to load and execute crafted EFI executablesRed Hat Bootloader Team shim
- CVE-2022-28736There's a use-after-free vulnerability in grub_cmd_chainloader() functionGNU Project GNU GRUB
- CVE-2022-28735The GRUB2's shim_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems.GNU Project GNU GRUB
- CVE-2020-24275A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying a crafted URL.
- CVE-2021-39425SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability.
- CVE-2021-45094Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS.
- CVE-2023-31461Attackers can exploit an open API listener on SteelSeries GG 36.0.0 to create a sub-application that will be executed automatically from a c
- CVE-2023-31462An issue was discovered in SteelSeries GG 36.0.0.
- CVE-2023-31753SQL injection vulnerability in diskusi.php in eNdonesia 8.7, allows an attacker to execute arbitrary SQL commands via the "rid=" parameter.
- CVE-2023-34625ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass.
- CVE-2023-37164Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the cat_id parameter at /shop/?module=shop&action=search.
- CVE-2023-37165Millhouse-Project v1.414 was discovered to contain a remote code execution (RCE) vulnerability via the component /add_post_sql.php.
- CVE-2023-37600Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id paramet
- CVE-2023-37601Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts.
- CVE-2023-37602An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary org.opencms:opencms-core
- CVE-2023-37645eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.
- CVE-2023-37649Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data.cockpit-hq/cockpit
- CVE-2023-37650A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands.cockpit-hq/cockpit
- CVE-2023-37728IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter.
- CVE-2023-38334Omnis Studio 10.22.00 has incorrect access control.
- CVE-2023-38335Omnis Studio 10.22.00 has incorrect access control.
- CVE-2023-38523The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication,
- CVE-2023-38617Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the filter par