# CVEs published 2023-07-20

66 CVEs were published on July 20, 2023: 4 critical, 8 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-3801](https://cve.now/CVE-2023-3801.md): IBOS OA Mobile Notification edit actionEdit sql injection (CVSS 5.5, IBOS OA)
- [CVE-2023-25835](https://cve.now/CVE-2023-25835.md): BUG-000153659 ArcGIS Enterprise Sites has a stored XSS vulnerability (CVSS 8.4, Esri Portal for ArcGIS Sites)
- [CVE-2023-3800](https://cve.now/CVE-2023-3800.md): EasyAdmin8 File Upload Module index.html unrestricted upload (CVSS 3.9, EasyAdmin8)
- [CVE-2023-3799](https://cve.now/CVE-2023-3799.md): IBOS OA Delete Category del sql injection (CVSS 6.3, IBOS OA)
- [CVE-2023-3798](https://cve.now/CVE-2023-3798.md): Chengdu Flash Flood Disaster Monitoring and Warning System upload.aspx unrestricted upload (CVSS 5.5, Chengdu Flash Flood Disaster Monitoring and Warning System)
- [CVE-2023-3797](https://cve.now/CVE-2023-3797.md): Gen Technology Four Mountain Torrent Disaster Prevention and Control of Monitoring and Early Warning System UploadFloodPlanFileUpdate.ashx unrestricted upload (CVSS 5.5, Gen Technology Four Mountain Torrent Disaster Prevention an…)
- [CVE-2023-3796](https://cve.now/CVE-2023-3796.md): Bug Finder Foody Friend Profile Picture profile unrestricted upload (CVSS 4.3, Bug Finder Foody Friend)
- [CVE-2023-3795](https://cve.now/CVE-2023-3795.md): Bug Finder ChainCity Real Estate Investment Platform GET Parameter property sql injection (CVSS 5.5, Bug Finder ChainCity Real Estate Investment Platform)
- [CVE-2023-3794](https://cve.now/CVE-2023-3794.md): Bug Finder ChainCity Real Estate Investment Platform New Ticket create cross site scripting (CVSS 3.5, Bug Finder ChainCity Real Estate Investment Platform)
- [CVE-2023-3793](https://cve.now/CVE-2023-3793.md): Weaver e-cology HTTP POST Request filelFileDownloadForOutDoc.class sql injection (CVSS 5.5, Weaver e-cology)
- [CVE-2023-3792](https://cve.now/CVE-2023-3792.md): Beijing Netcon NS-ASG test\_status.php direct request (CVSS 4.3, Beijing Netcon NS-ASG)
- [CVE-2023-3791](https://cve.now/CVE-2023-3791.md): IBOS OA Personal Office Address Book export actionExport sql injection (CVSS 6.3, IBOS OA)
- [CVE-2023-37471](https://cve.now/CVE-2023-37471.md): User impersonation using SAMLv1.x SSO in Open Access Management (CVSS 9.1, OpenIdentityPlatform OpenAM · org.openidentityplatform.open…)
- [CVE-2023-3790](https://cve.now/CVE-2023-3790.md): Boom CMS assets-manager add cross site scripting (CVSS 3.5, Boom CMS)
- [CVE-2023-3789](https://cve.now/CVE-2023-3789.md): PaulPrinting CMS Search delivery cross site scripting (CVSS 3.5, PaulPrinting CMS)
- [CVE-2023-38203](https://cve.now/CVE-2023-38203.md): Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE (CVSS 9.8, KEV, Adobe ColdFusion)
- [CVE-2023-3788](https://cve.now/CVE-2023-3788.md): ActiveITzone Active Super Shop CMS Manage Details Page cross site scripting (CVSS 3.5, ActiveITzone Active Super Shop CMS)
- [CVE-2023-34968](https://cve.now/CVE-2023-34968.md): Samba: spotlight server-side share path disclosure (CVSS 5.3, Red Hat Enterprise Linux · Red Hat Virtualization 4 for… +1)
- [CVE-2023-34967](https://cve.now/CVE-2023-34967.md): Samba: type confusion in mdssvc rpc service for spotlight (CVSS 5.3, Red Hat Enterprise Linux · Red Hat Virtualization 4 for… +1)
- [CVE-2023-34966](https://cve.now/CVE-2023-34966.md): Samba: infinite loop in mdssvc rpc service for spotlight (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Virtualization 4 for… +1)
- [CVE-2023-3347](https://cve.now/CVE-2023-3347.md): Samba: smb2 packet signing is not enforced when "server signing = required" is set (CVSS 5.9, Red Hat Enterprise Linux · Red Hat Storage)
- [CVE-2023-3787](https://cve.now/CVE-2023-3787.md): Codecanyon Tiva Events Calender cross site scripting (CVSS 3.5, Codecanyon Tiva Events Calender)
- [CVE-2022-2127](https://cve.now/CVE-2022-2127.md): Samba: out-of-bounds read in winbind auth\_crap (CVSS 5.9, Red Hat Enterprise Linux · Red Hat Virtualization 4 for… +1)
- [CVE-2023-32265](https://cve.now/CVE-2023-32265.md): Mitigations and availability of updates relating to security vulnerability in ESCWA component CVE-2023-32265. (CVSS 7.1, Micro Focus Enterprise Server · Micro Focus Enterprise T… +3)
- [CVE-2023-32476](https://cve.now/CVE-2023-32476.md): Dell Hybrid Client version 2.0 contains a Sensitive Data Exposure vulnerability. (CVSS 6.4, Dell Hybrid Client)
- [CVE-2023-3786](https://cve.now/CVE-2023-3786.md): Aures Komet Kiosk Mode access control (CVSS 4.3, Aures Komet)
- [CVE-2023-32447](https://cve.now/CVE-2023-32447.md): Dell Wyse ThinOS versions prior to 2306 (9.4.2103) contain a sensitive information disclosure vulnerability. (CVSS 5.5, Dell Wyse Proprietary OS)
- [CVE-2023-32446](https://cve.now/CVE-2023-32446.md): Dell Wyse ThinOS versions prior to 2303 (9.4.1141) contain a sensitive information disclosure vulnerability. (CVSS 5.5, Dell Wyse Proprietary OS)
- [CVE-2023-32455](https://cve.now/CVE-2023-32455.md): Dell Wyse ThinOS versions prior to 2208 (9.3.2102) contain a sensitive information disclosure vulnerability. (CVSS 5.5, Dell Wyse Proprietary OS)
- [CVE-2023-32483](https://cve.now/CVE-2023-32483.md): Wyse Management Suite versions prior to 4.0 contain a sensitive information disclosure vulnerability. (CVSS 4.4, Dell Wyse Management Suite)
- [CVE-2023-32482](https://cve.now/CVE-2023-32482.md): Wyse Management Suite versions prior to 4.0 contain an improper authorization vulnerability. (CVSS 4.9, Dell Wyse Management Suite)
- [CVE-2023-32481](https://cve.now/CVE-2023-32481.md): Wyse Management Suite versions prior to 4.0 contain a denial-of-service vulnerability. (CVSS 4.9, Dell Wyse Management Suite)
- [CVE-2023-37290](https://cve.now/CVE-2023-37290.md): InfoDoc Document On-line Submission and Approval System - Server-Side Request Forgery (SSRF) (CVSS 7.5, InfoDoc Document On-line Submission and Approval System)
- [CVE-2023-3785](https://cve.now/CVE-2023-3785.md): PaulPrinting CMS cross site scripting (CVSS 3.5, PaulPrinting CMS)
- [CVE-2023-3784](https://cve.now/CVE-2023-3784.md): Dooblou WiFi File Explorer cross site scripting (CVSS 3.5, Dooblou WiFi File Explorer)
- [CVE-2023-3783](https://cve.now/CVE-2023-3783.md): Webile HTTP POST Request cross site scripting (CVSS 3.5, Webile)
- [CVE-2021-39822](https://cve.now/CVE-2021-39822.md): Adobe InDesign BMP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe InDesign)
- [CVE-2023-3779](https://cve.now/CVE-2023-3779.md): Essential Addons For Elementor \<=5.8.1 - Unauthenticated MailChimp API Key Disclosure (CVSS 5.3, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2023-37289](https://cve.now/CVE-2023-37289.md): InfoDoc Document On-line Submission and Approval System - Arbitrary File Upload (CVSS 9.8, InfoDoc Document On-line Submission and Approval System)
- [CVE-2022-28737](https://cve.now/CVE-2022-28737.md): There's a possible overflow in handle\_image() when shim tries to load and execute crafted EFI executables (CVSS 6.5, Red Hat Bootloader Team shim)
- [CVE-2022-28736](https://cve.now/CVE-2022-28736.md): There's a use-after-free vulnerability in grub\_cmd\_chainloader() function (CVSS 6.4, GNU Project GNU GRUB)
- [CVE-2022-28735](https://cve.now/CVE-2022-28735.md): The GRUB2's shim\_lock verifier allows non-kernel files to be loaded on shim-powered secure boot systems. (CVSS 6.7, GNU Project GNU GRUB)
- [CVE-2022-28734](https://cve.now/CVE-2022-28734.md): Out-of-bounds write when handling split HTTP headers (CVSS 8.1, GNU Project GNU GRUB)
- [CVE-2022-28733](https://cve.now/CVE-2022-28733.md): Integer underflow in grub\_net\_recv\_ip4\_packets (CVSS 8.1, GNU Project GNU GRUB)
- [CVE-2020-24275](https://cve.now/CVE-2020-24275.md): A HTTP response header injection vulnerability in Swoole v4.5.2 allows attackers to execute arbitrary code via supplying a crafted URL. (no CVSS)
- [CVE-2021-39425](https://cve.now/CVE-2021-39425.md): SeedDMS v6.0.15 was discovered to contain an open redirect vulnerability. (no CVSS)
- [CVE-2021-45094](https://cve.now/CVE-2021-45094.md): Imprivata Privileged Access Management (formally Xton Privileged Access Management) 2.3.202112051108 allows XSS. (no CVSS)
- [CVE-2023-30200](https://cve.now/CVE-2023-30200.md): In the module “Image: WebP, Compress, Zoom, Lazy load, Alt & More” (ultimateimagetool) in versions up to 2.1.02 from Advanced Plugins for Pr (CVSS 7.5)
- [CVE-2023-31461](https://cve.now/CVE-2023-31461.md): Attackers can exploit an open API listener on SteelSeries GG 36.0.0 to create a sub-application that will be executed automatically from a c (no CVSS)
- [CVE-2023-31462](https://cve.now/CVE-2023-31462.md): An issue was discovered in SteelSeries GG 36.0.0. (no CVSS)
- [CVE-2023-31753](https://cve.now/CVE-2023-31753.md): SQL injection vulnerability in diskusi.php in eNdonesia 8.7, allows an attacker to execute arbitrary SQL commands via the "rid=" parameter. (no CVSS)
- [CVE-2023-34625](https://cve.now/CVE-2023-34625.md): ShowMojo MojoBox Digital Lockbox 1.4 is vulnerable to Authentication Bypass. (no CVSS)
- [CVE-2023-37164](https://cve.now/CVE-2023-37164.md): Diafan CMS v6.0 was discovered to contain a reflected cross-site scripting via the cat\_id parameter at /shop/?module=shop&action=search. (no CVSS)
- [CVE-2023-37165](https://cve.now/CVE-2023-37165.md): Millhouse-Project v1.414 was discovered to contain a remote code execution (RCE) vulnerability via the component /add\_post\_sql.php. (no CVSS)
- [CVE-2023-37600](https://cve.now/CVE-2023-37600.md): Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the id paramet (no CVSS)
- [CVE-2023-37601](https://cve.now/CVE-2023-37601.md): Office Suite Premium v10.9.1.42602 was discovered to contain a local file inclusion (LFI) vulnerability via the component /etc/hosts. (no CVSS)
- [CVE-2023-37602](https://cve.now/CVE-2023-37602.md): An arbitrary file upload vulnerability in the component /workplace#!explorer of Alkacon OpenCMS v15.0 allows attackers to execute arbitrary (no CVSS, org.opencms:opencms-core)
- [CVE-2023-37645](https://cve.now/CVE-2023-37645.md): eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom\_model\_path/recruit.filelist.txt. (no CVSS)
- [CVE-2023-37649](https://cve.now/CVE-2023-37649.md): Incorrect access control in the component /models/Content of Cockpit CMS v2.5.2 allows unauthorized attackers to access sensitive data. (no CVSS, cockpit-hq/cockpit)
- [CVE-2023-37650](https://cve.now/CVE-2023-37650.md): A Cross-Site Request Forgery (CSRF) in the Admin portal of Cockpit CMS v2.5.2 allows attackers to execute arbitrary Administrator commands. (no CVSS, cockpit-hq/cockpit)
- [CVE-2023-37728](https://cve.now/CVE-2023-37728.md): IceWarp v10.2.1 was discovered to contain cross-site scripting (XSS) vulnerability via the color parameter. (no CVSS)
- [CVE-2023-38334](https://cve.now/CVE-2023-38334.md): Omnis Studio 10.22.00 has incorrect access control. (no CVSS)
- [CVE-2023-38335](https://cve.now/CVE-2023-38335.md): Omnis Studio 10.22.00 has incorrect access control. (no CVSS)
- [CVE-2023-38408](https://cve.now/CVE-2023-38408.md): The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if (CVSS 9.8)
- [CVE-2023-38523](https://cve.now/CVE-2023-38523.md): The web interface on multiple Samsung Harman AMX N-Series devices allows directory listing for the /tmp/ directory, without authentication, (no CVSS)
- [CVE-2023-38617](https://cve.now/CVE-2023-38617.md): Office Suite Premium Version v10.9.1.42602 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the filter par (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.