CVEs published July 24, 2023
56 CVEs were published on July 24, 2023: 2 critical, 14 high.
- Published
- 56
- Critical
- 2
- High
- 14
- Medium
- 19
- Low
- 8
- Unrated
- 13
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- kernel · Red Hat Enterprise Linux +1
- 6
- Red Hat Enterprise Linux
- 6
- ABB Ability™ zenon
- 4
- Gallagher Command Centre
- 3
- OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- 3
- Campcodes Beauty Salon Management System
- 2
- phpscriptpoint Car Listing
- 2
- phpscriptpoint Ecommerce
- 2
- phpscriptpoint Insurance
- 2
- Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…
- 2
Critical 2
- CVE-2023-26045NodeBB vulnerable to path traversal and code execution via prototype vulnerabilityNodeBB
- CVE-2023-34478Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests.Apache Software Foundation Apache Shiro · org.apache.shiro:…
High 14
- CVE-2023-25074Competency access levels not enforced in the serverGallagher Command Centre
- CVE-2023-22428 Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage.Gallagher Command Centre
- CVE-2023-3322 Code Execution through overwriting service executable in utilities directoryABB Ability™ zenon
- CVE-2023-3321Code Execution through Writable Mosquitto Configuration FileABB Ability™ zenon
- CVE-2023-3640Kernel: x86/mm: a per-cpu entry area leak was identified through the init_cea_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user spaceRed Hat Enterprise Linux
- CVE-2023-32248Tree connection null pointer dereference denial-of-service vulnerabilitykernel · Red Hat Enterprise Linux +1
- CVE-2023-32257Session race condition remote code execution vulnerabilitykernel · Red Hat Enterprise Linux +1
- CVE-2023-32252Session null pointer dereference denial-of-service vulnerabilitykernel · Red Hat Enterprise Linux +1
- CVE-2023-32258Session race condition remote code execution vulnerabilitykernel · Red Hat Enterprise Linux +1
- CVE-2023-32247Session setup memory exhaustion denial-of-service vulnerabilitykernel · Red Hat Enterprise Linux +1
- CVE-2023-3812Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_fragsRed Hat Enterprise Linux · Red Hat Virtualization 4 for Red…
- CVE-2023-3567Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to raceRed Hat Enterprise Linux · Red Hat Virtualization 4 for Red…
- CVE-2023-38200Keylime: registrar is subject to a dos against ssl connectionsRed Hat Enterprise Linux · keylime
- CVE-2023-38056Code execution via System Configuration OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
Medium, low and unrated 40
- CVE-2023-22363Access Zone stack overflowGallagher Command Centre
- CVE-2023-3872Campcodes Beauty Salon Management System edit-services.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-3871Campcodes Beauty Salon Management System edit_category.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-20593An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive informationAMD Ryzen™ 3000 Series Desktop Processors “Matisse” AM4… +6
- CVE-2023-3324 Insecure deserialization in zenon internal DLLsABB Ability™ zenon
- CVE-2023-3323 Code Execution through overwriting project file on zenon engineering studio systemABB Ability™ zenon
- CVE-2023-1386Qemu: 9pfs: suid/sgid bits not dropped on file writeqemu · Red Hat Enterprise Linux +1
- CVE-2023-33951Kernel: vmwgfx: race condition leading to information disclosure vulnerabilityRed Hat Enterprise Linux
- CVE-2023-3745Imagemagick: heap-buffer-overflow in pushcharpixel() in quantum-private.hRed Hat Enterprise Linux
- CVE-2023-3750Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of serviceRed Hat Enterprise Linux
- CVE-2023-3384Quay: stored cross site scriptingRed Hat Quay
- CVE-2023-3748Inifinite loop in babld message parsing may cause dosfrr · Red Hat Enterprise Linux +1
- CVE-2023-3019Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()Red Hat Enterprise Linux
- CVE-2023-33952Kernel: vmwgfx: double free within the handling of vmw_buffer_object objectsRed Hat Enterprise Linux
- CVE-2023-2860Out-of-bounds read when setting hmac datakernel · Red Hat Enterprise Linux +1
- CVE-2023-3863Use-after-free in nfc_llcp_find_loca in net/nfc/llcp_core.cKernel · Red Hat Enterprise Linux +1
- CVE-2023-2761User Activity Log < 1.6.3 - Admin+ SQL InjectionUser Activity Log
- CVE-2023-3248All-in-one Floating Contact Form < 2.1.2 - Admin+ Stored Cross-Site ScriptingAll-in-one Floating Contact Form, Call, Chat, and 50+ Socia…
- CVE-2023-3344Auto Location for WP Job Manager via Google < 1.1 - Admin+ Cross Site ScriptingAuto Location for WP Job Manager via Google
- CVE-2023-2309wpForo Forum < 2.1.9 - Reflected Cross-Site ScriptingwpForo Forum
- CVE-2023-3417File Extension Spoofing using the Text Direction Override CharacterMozilla Thunderbird
- CVE-2023-38060Host header injection by attachments in web serviceOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2023-38058Tickets can be moved without permissionsOTRS AG OTRS
- CVE-2023-38057XSS stored in survey answersOTRS AG OTRS · OTRS AG ((OTRS)) Community Edition
- CVE-2023-3862Travelmate Travelable Trek Management Solution Comment Box cross site scriptingTravelmate Travelable Trek Management Solution
- CVE-2023-3861phpscriptpoint Insurance search.php cross site scriptingphpscriptpoint Insurance
- CVE-2023-3860phpscriptpoint Insurance page.php cross site scriptingphpscriptpoint Insurance
- CVE-2023-3859phpscriptpoint Car Listing GET Parameter search.php sql injectionphpscriptpoint Car Listing
- CVE-2023-3858phpscriptpoint Car Listing search.php cross site scriptingphpscriptpoint Car Listing
- CVE-2023-3857phpscriptpoint Ecommerce product.php cross site scriptingphpscriptpoint Ecommerce
- CVE-2023-3856phpscriptpoint Ecommerce blog-single.php cross site scriptingphpscriptpoint Ecommerce
- CVE-2021-39421A cross-site scripting (XSS) vulnerability in SeedDMS v6.0.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa
- CVE-2022-28863An issue was discovered in Nokia NetAct 22.
- CVE-2022-28864An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section.
- CVE-2022-28865An issue was discovered in Nokia NetAct 22 through the Site Configuration Tool website section.
- CVE-2022-28867An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section.
- CVE-2022-30280/SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF.
- CVE-2023-26077Atera Agent through 1.8.3.6 on Windows Creates a Temporary File in a Directory with Insecure Permissions.
- CVE-2023-26078Privilege escalation vulnerability was discovered in Atera Agent 1.8.4.4 and prior on Windows due to mishandling of privileged APIs.
- CVE-2023-37613A cross-site scripting (XSS) vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML v