# CVEs published 2023-07-21

68 CVEs were published on July 21, 2023: 17 critical, 19 high. Days are UTC.

- [CVE-2023-35077](https://cve.now/CVE-2023-35077.md): An out-of-bounds write vulnerability on windows operating systems causes the Ivanti AntiVirus Product to crash. (CVSS 8.1, Ivanti Endpoint Manager)
- [CVE-2023-3776](https://cve.now/CVE-2023-3776.md): Use-after-free in Linux kernel's net/sched: cls\_fw component (CVSS 7.8, Linux Kernel)
- [CVE-2023-3611](https://cve.now/CVE-2023-3611.md): Out-of-bounds write in Linux kernel's net/sched: sch\_qfq component (CVSS 7.8, Linux Kernel)
- [CVE-2023-3610](https://cve.now/CVE-2023-3610.md): Use-after-free in Linux kernel's netfilter: nf\_tables component (CVSS 7.8, Linux Kernel)
- [CVE-2023-3609](https://cve.now/CVE-2023-3609.md): Use-after-free in Linux kernel's net/sched: cls\_u32 component (CVSS 7.8, Linux Kernel)
- [CVE-2022-43607](https://cve.now/CVE-2022-43607.md): An out-of-bounds write vulnerability exists in the MOL2 format attribute and value functionality of Open Babel 3.1.1 and master commit 530db (CVSS 8.1, Open Babel · openbabel)
- [CVE-2022-46290](https://cve.now/CVE-2022-46290.md): Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3. (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-46289](https://cve.now/CVE-2022-46289.md): Multiple out-of-bounds write vulnerabilities exist in the ORCA format nAtoms functionality of Open Babel 3.1.1 and master commit 530dbfa3. (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-46295](https://cve.now/CVE-2022-46295.md): Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-46294](https://cve.now/CVE-2022-46294.md): Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-46293](https://cve.now/CVE-2022-46293.md): Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-46292](https://cve.now/CVE-2022-46292.md): Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-46291](https://cve.now/CVE-2022-46291.md): Multiple out-of-bounds write vulnerabilities exist in the translationVectors parsing functionality in multiple supported formats of Open Bab (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-41793](https://cve.now/CVE-2022-41793.md): An out-of-bounds write vulnerability exists in the CSR format title functionality of Open Babel 3.1.1 and master commit 530dbfa3. (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-42885](https://cve.now/CVE-2022-42885.md): A use of uninitialized pointer vulnerability exists in the GRO format res functionality of Open Babel 3.1.1 and master commit 530dbfa3. (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-44451](https://cve.now/CVE-2022-44451.md): A use of uninitialized pointer vulnerability exists in the MSI format atom functionality of Open Babel 3.1.1 and master commit 530dbfa3. (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-46280](https://cve.now/CVE-2022-46280.md): A use of uninitialized pointer vulnerability exists in the PQS format pFormat functionality of Open Babel 3.1.1 and master commit 530dbfa3. (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-43467](https://cve.now/CVE-2022-43467.md): An out-of-bounds write vulnerability exists in the PQS format coord\_file functionality of Open Babel 3.1.1 and master commit 530dbfa3. (CVSS 9.8, Open Babel · openbabel)
- [CVE-2022-37331](https://cve.now/CVE-2022-37331.md): An out-of-bounds write vulnerability exists in the Gaussian format orientation functionality of Open Babel 3.1.1 and master commit 530dbfa3. (CVSS 7.3, Open Babel · openbabel)
- [CVE-2023-37916](https://cve.now/CVE-2023-37916.md): Leak password hash of any user (CVSS 6.5, 1Panel-dev KubePi · github.com/KubeOperator/kubepi)
- [CVE-2023-37917](https://cve.now/CVE-2023-37917.md): Privilege Escalation in kubepi (CVSS 9.1, 1Panel-dev KubePi · github.com/KubeOperator/kubepi)
- [CVE-2023-37918](https://cve.now/CVE-2023-37918.md): API token authentication bypass in HTTP endpoints in Dapr (CVSS 6.8, dapr · github.com/dapr/dapr)
- [CVE-2023-37915](https://cve.now/CVE-2023-37915.md): Malformed PID\_PROPERTY\_LIST parameter in DATA submessage remotely crashes OpenDDS (CVSS 7.5, OpenDDS)
- [CVE-2023-37903](https://cve.now/CVE-2023-37903.md): Sandbox Escape in vm2 (CVSS 9.8, patriksimek vm2 · vm2)
- [CVE-2023-37905](https://cve.now/CVE-2023-37905.md): Cross-site Scripting (XSS) in Source Mode of Editor in ckeditor-wordcount-plugin (CVSS 6.1, w8tcha CKEditor-WordCount-Plugin · typo3 cms-rte-ckeditor +1)
- [CVE-2023-3603](https://cve.now/CVE-2023-3603.md): Processing sftp server read may cause null dereference (CVSS 3.1, libssh · Red Hat Enterprise Linux +2)
- [CVE-2023-25841](https://cve.now/CVE-2023-25841.md): BUG-000158075 Stored XSS issue in ArcGIS Server (CVSS 6.1, Esri ArcGIS Enterprise Server)
- [CVE-2023-25840](https://cve.now/CVE-2023-25840.md): BUG-000154070 Stored XSS issue in the ArcGIS REST Services directory (CVSS 3.4, Esri ArcGIS Enterprise Server)
- [CVE-2023-37901](https://cve.now/CVE-2023-37901.md): Cross-Site-Scripting via confirmation prompts (CVSS 5.4, indico)
- [CVE-2023-38187](https://cve.now/CVE-2023-38187.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2023-35392](https://cve.now/CVE-2023-35392.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.7, Microsoft Edge)
- [CVE-2023-38173](https://cve.now/CVE-2023-38173.md): Microsoft Edge for Android Spoofing Vulnerability (CVSS 4.3, Microsoft Edge for Android)
- [CVE-2023-26301](https://cve.now/CVE-2023-26301.md): Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a la (no CVSS, HP LaserJet Pro)
- [CVE-2023-3102](https://cve.now/CVE-2023-3102.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 5.3, GitLab)
- [CVE-2023-3822](https://cve.now/CVE-2023-3822.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 6.0, pimcore/pimcore)
- [CVE-2023-3821](https://cve.now/CVE-2023-3821.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.1, pimcore/pimcore)
- [CVE-2023-3820](https://cve.now/CVE-2023-3820.md): SQL Injection in pimcore/pimcore (CVSS 7.2, pimcore/pimcore)
- [CVE-2023-3819](https://cve.now/CVE-2023-3819.md): Exposure of Sensitive Information to an Unauthorized Actor in pimcore/pimcore (CVSS 7.6, pimcore/pimcore)
- [CVE-2023-3484](https://cve.now/CVE-2023-3484.md): Incorrect Authorization in GitLab (CVSS 8.0, GitLab)
- [CVE-2023-35087](https://cve.now/CVE-2023-35087.md): ASUS RT-AX56U V2 & RT-AC86U - Format String - 2 (CVSS 9.8, ASUS RT-AX56U · ASUS RT-AC86U)
- [CVE-2023-35086](https://cve.now/CVE-2023-35086.md): ASUS RT-AX56U V2 & RT-AC86U - Format String -1 (CVSS 7.2, ASUS RT-AX56U · ASUS RT-AC86U)
- [CVE-2023-28730](https://cve.now/CVE-2023-28730.md): A memory corruption vulnerability Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution (CVSS 7.8, Panasonic Control FPWIN Pro)
- [CVE-2023-28729](https://cve.now/CVE-2023-28729.md): A type confusion vulnerability in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution (CVSS 7.8, Panasonic Control FPWIN Pro)
- [CVE-2023-28728](https://cve.now/CVE-2023-28728.md): A stack-based buffer overflow in Panasonic Control FPWIN Pro versions 7.6.0.3 and all previous versions may allow arbitrary code execution w (CVSS 7.8, Panasonic Control FPWIN Pro)
- [CVE-2023-32478](https://cve.now/CVE-2023-32478.md): Dell PowerStore versions prior to 3.5.0.1 contain an insertion of sensitive information into log file vulnerability. (CVSS 9.0, Dell PowerStore)
- [CVE-2023-3815](https://cve.now/CVE-2023-3815.md): y\_project RuoYi File Upload uploadFilesPath cross site scripting (CVSS 3.5, y\_project RuoYi · com.ruoyi:ruoyi)
- [CVE-2023-3811](https://cve.now/CVE-2023-3811.md): Hospital Management System patientprofile.php sql injection (CVSS 6.3, Hospital Management System)
- [CVE-2023-37292](https://cve.now/CVE-2023-37292.md): HGiga iSherlock - Command Injection (CVSS 9.8, HGiga iSherlock)
- [CVE-2023-3810](https://cve.now/CVE-2023-3810.md): Hospital Management System patientappointment.php sql injection (CVSS 6.3, Hospital Management System)
- [CVE-2023-25837](https://cve.now/CVE-2023-25837.md): BUG-000133088 - ArcGIS Enterprise site builder is subject to stored XSS. (CVSS 8.4, Esri Portal for ArcGIS Sites)
- [CVE-2023-25836](https://cve.now/CVE-2023-25836.md): BUG-000135364 XSS in 10.8.1 sites builder iframe source (CVSS 5.4, Esri Portal for ArcGIS Sites)
- [CVE-2023-3809](https://cve.now/CVE-2023-3809.md): Hospital Management System patient.php sql injection (CVSS 6.3, Hospital Management System)
- [CVE-2023-37291](https://cve.now/CVE-2023-37291.md): Galaxy Software Services Vitals ESP - Use of Hard-coded Cryptographic Key (CVSS 8.6, Galaxy Software Services Vitals ESP)
- [CVE-2023-3808](https://cve.now/CVE-2023-3808.md): Hospital Management System patientforgotpassword.php sql injection (CVSS 6.3, Hospital Management System)
- [CVE-2023-3807](https://cve.now/CVE-2023-3807.md): Campcodes Beauty Salon Management System edit\_product.php sql injection (CVSS 6.3, Campcodes Beauty Salon Management System)
- [CVE-2023-3813](https://cve.now/CVE-2023-3813.md): Jupiter X Core \<= 4.6.6 - Unauthenticated Arbitrary File Download (CVSS 7.5, artbees Jupiter X Core)
- [CVE-2023-3806](https://cve.now/CVE-2023-3806.md): SourceCodester House Rental and Property Listing System btn\_functions.php unrestricted upload (CVSS 6.3, SourceCodester House Rental and Property Listing System)
- [CVE-2023-3805](https://cve.now/CVE-2023-3805.md): Xiamen Four Letter Video Surveillance Management System Login UserInfoAction.class improper authorization (CVSS 7.3, Xiamen Four Letter Video Surveillance Management System)
- [CVE-2023-3804](https://cve.now/CVE-2023-3804.md): Chengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx unrestricted upload (CVSS 5.5, Chengdu Flash Flood Disaster Monitoring and Warning System)
- [CVE-2023-32625](https://cve.now/CVE-2023-32625.md): Cross-site request forgery (CSRF) vulnerability in TS Webfonts for SAKURA 3.1.2 and earlier allows a remote unauthenticated attacker to hija (no CVSS, SAKURA internet TS Webfonts for SAKURA)
- [CVE-2023-32624](https://cve.now/CVE-2023-32624.md): Cross-site scripting vulnerability in TS Webfonts for SAKURA 3.1.0 and earlier allows a remote unauthenticated attacker to inject an arbitra (no CVSS, SAKURA internet TS Webfonts for SAKURA)
- [CVE-2023-3803](https://cve.now/CVE-2023-3803.md): Chengdu Flash Flood Disaster Monitoring and Warning System File Name ImageStationDataService.asmx random values (CVSS 2.6, Chengdu Flash Flood Disaster Monitoring and Warning System)
- [CVE-2023-3802](https://cve.now/CVE-2023-3802.md): Chengdu Flash Flood Disaster Monitoring and Warning System Ajaxfileupload.ashx unrestricted upload (CVSS 5.5, Chengdu Flash Flood Disaster Monitoring and Warning System)
- [CVE-2021-35391](https://cve.now/CVE-2021-35391.md): Server Side Request Forgery vulnerability found in Deskpro Support Desk v2021.21.6 allows attackers to execute arbitrary code via a crafted (no CVSS)
- [CVE-2023-36339](https://cve.now/CVE-2023-36339.md): An access control issue in WebBoss.io CMS v3.7.0.1 allows attackers to access the Website Backup Tool via a crafted GET request. (no CVSS)
- [CVE-2023-37742](https://cve.now/CVE-2023-37742.md): WebBoss.io CMS before v3.7.0.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2023-38632](https://cve.now/CVE-2023-38632.md): async-sockets-cpp through 0.3.1 has a stack-based buffer overflow in tcpsocket.hpp when processing malformed TCP packets. (no CVSS)
- [CVE-2023-38646](https://cve.now/CVE-2023-38646.md): Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.