CVEs published July 21, 2023
68 CVEs were published on July 21, 2023: 17 critical, 19 high.
- Published
- 68
- Critical
- 17
- High
- 19
- Medium
- 20
- Low
- 4
- Unrated
- 8
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Open Babel · openbabel
- 14
- Hospital Management System
- 4
- Linux Kernel
- 4
- pimcore/pimcore
- 4
- Chengdu Flash Flood Disaster Monitoring and Warning System
- 3
- Panasonic Control FPWIN Pro
- 3
- 1Panel-dev KubePi · github.com/KubeOperator/kubepi
- 2
- ASUS RT-AX56U · ASUS RT-AC86U
- 2
- Esri ArcGIS Enterprise Server
- 2
- Esri Portal for ArcGIS Sites
- 2
Critical 17
- CVE-2022-46290Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3.Open Babel · openbabel
- CVE-2022-46289Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3.Open Babel · openbabel
- CVE-2022-46295Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open BabOpen Babel · openbabel
- CVE-2022-46294Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open BabOpen Babel · openbabel
- CVE-2022-46293Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open BabOpen Babel · openbabel
- CVE-2022-46292Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open BabOpen Babel · openbabel
- CVE-2022-46291Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open BabOpen Babel · openbabel
- CVE-2022-41793An out-of-bounds write vulnerability exists in the CSR format title functionality of Open Babel 3.1.1 and master commit 530dbfa3.Open Babel · openbabel
- CVE-2022-42885A use of uninitialized pointer vulnerability exists in the GRO format res functionality of Open Babel 3.1.1 and master commit 530dbfa3.Open Babel · openbabel
- CVE-2022-44451A use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit 530dbfa3.Open Babel · openbabel
- CVE-2022-46280A use of uninitialized pointer vulnerability exists in the PQS format pFormat functionality of Open Babel 3.1.1 and master commit 530dbfa3.Open Babel · openbabel
- CVE-2022-43467An out-of-bounds write vulnerability exists in the PQS format coord_file functionality of Open Babel 3.1.1 and master commit 530dbfa3.Open Babel · openbabel
- CVE-2023-37917Privilege Escalation in kubepi1Panel-dev KubePi · github.com/KubeOperator/kubepi
- CVE-2023-37903Sandbox Escape in vm2patriksimek vm2 · vm2
- CVE-2023-35087ASUS RT-AX56U V2 & RT-AC86U - Format String - 2ASUS RT-AX56U · ASUS RT-AC86U
- CVE-2023-32478 Dell PowerStore versions prior to 3.5.0.1 contain an insertion of sensitive information into log file vulnerability.Dell PowerStore
- CVE-2023-37292HGiga iSherlock - Command InjectionHGiga iSherlock
High 19
- CVE-2023-35077An out-of-bounds write vulnerability on windows operating systems causes the Ivanti AntiVirus Product to crash.Ivanti Endpoint Manager
- CVE-2023-3776Use-after-free in Linux kernel's net/sched: cls_fw componentLinux Kernel
- CVE-2023-3611Out-of-bounds write in Linux kernel's net/sched: sch_qfq componentLinux Kernel
- CVE-2023-3610Use-after-free in Linux kernel's netfilter: nf_tables componentLinux Kernel
- CVE-2023-3609Use-after-free in Linux kernel's net/sched: cls_u32 componentLinux Kernel
- CVE-2022-43607An out-of-bounds write vulnerability exists in the MOL2 format attribute and value functionality of Open Babel 3.1.1 and master commit 530dbOpen Babel · openbabel
- CVE-2022-37331An out-of-bounds write vulnerability exists in the Gaussian format orientation functionality of Open Babel 3.1.1 and master commit 530dbfa3.Open Babel · openbabel
- CVE-2023-37915Malformed PID_PROPERTY_LIST parameter in DATA submessage remotely crashes OpenDDSOpenDDS
- CVE-2023-3820SQL Injection in pimcore/pimcorepimcore/pimcore
- CVE-2023-3819Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcorepimcore/pimcore
- CVE-2023-3484Incorrect Authorization in GitLabGitLab
- CVE-2023-35086ASUS RT-AX56U V2 & RT-AC86U - Format String -1ASUS RT-AX56U · ASUS RT-AC86U
- CVE-2023-28730A memory corruption vulnerability Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution Panasonic Control FPWIN Pro
- CVE-2023-28729A type confusion vulnerability in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution Panasonic Control FPWIN Pro
- CVE-2023-28728A stack-based buffer overflow in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution wPanasonic Control FPWIN Pro
- CVE-2023-25837BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS.Esri Portal for ArcGIS Sites
- CVE-2023-37291Galaxy Software Services Vitals ESP - Use of Hard-coded Cryptographic KeyGalaxy Software Services Vitals ESP
- CVE-2023-3813Jupiter X Core <= 4.6.6 - Unauthenticated Arbitrary File Downloadartbees Jupiter X Core
- CVE-2023-3805Xiamen Four Letter Video Surveillance Management System Login UserInfoAction.class improper authorizationXiamen Four Letter Video Surveillance Management System
Medium, low and unrated 32
- CVE-2023-37916Leak password hash of any user1Panel-dev KubePi · github.com/KubeOperator/kubepi
- CVE-2023-37918API token authentication bypass in HTTP endpoints in Daprdapr · github.com/dapr/dapr
- CVE-2023-37905Cross-site Scripting (XSS) in Source Mode of Editor in ckeditor-wordcount-pluginw8tcha CKEditor-WordCount-Plugin · typo3 cms-rte-ckeditor +1
- CVE-2023-3603Processing sftp server read may cause null dereferencelibssh · Red Hat Enterprise Linux +2
- CVE-2023-25841BUG-000158075 Stored XSS issue in ArcGIS ServerEsri ArcGIS Enterprise Server
- CVE-2023-25840BUG-000154070 Stored XSS issue in the ArcGIS REST Services directoryEsri ArcGIS Enterprise Server
- CVE-2023-37901Cross-Site-Scripting via confirmation promptsindico
- CVE-2023-38187Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2023-35392Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2023-38173Microsoft Edge for Android Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2023-26301Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a laHP LaserJet Pro
- CVE-2023-3102Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2023-3822Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore
- CVE-2023-3821Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-3815y_project RuoYi File Upload uploadFilesPath cross site scriptingy_project RuoYi · com.ruoyi:ruoyi
- CVE-2023-3811Hospital Management System patientprofile.php sql injectionHospital Management System
- CVE-2023-3810Hospital Management System patientappointment.php sql injectionHospital Management System
- CVE-2023-25836BUG-000135364 XSS in 10.8.1 sites builder iframe sourceEsri Portal for ArcGIS Sites
- CVE-2023-3809Hospital Management System patient.php sql injectionHospital Management System
- CVE-2023-3808Hospital Management System patientforgotpassword.php sql injectionHospital Management System
- CVE-2023-3807Campcodes Beauty Salon Management System edit_product.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-3806SourceCodester House Rental and Property Listing System btn_functions.php unrestricted uploadSourceCodester House Rental and Property Listing System
- CVE-2023-3804Chengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx unrestricted uploadChengdu Flash Flood Disaster Monitoring and Warning System
- CVE-2023-32625Cross-site request forgery (CSRF) vulnerability in TS Webfonts for SAKURA 3.1.2 and earlier allows a remote unauthenticated attacker to hijaSAKURA internet TS Webfonts for SAKURA
- CVE-2023-32624Cross-site scripting vulnerability in TS Webfonts for SAKURA 3.1.0 and earlier allows a remote unauthenticated attacker to inject an arbitraSAKURA internet TS Webfonts for SAKURA
- CVE-2023-3803Chengdu Flash Flood Disaster Monitoring and Warning System File Name ImageStationDataService.asmx random valuesChengdu Flash Flood Disaster Monitoring and Warning System
- CVE-2023-3802Chengdu Flash Flood Disaster Monitoring and Warning System Ajaxfileupload.ashx unrestricted uploadChengdu Flash Flood Disaster Monitoring and Warning System
- CVE-2021-35391Server Side Request Forgery vulnerability found in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted
- CVE-2023-36339An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request.
- CVE-2023-37742WebBoss.io CMS before v3.7.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.
- CVE-2023-38632async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in tcpsocket.hpp when processing malformed TCP packets.
- CVE-2023-38646Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at