# CVEs published 2023-07-24

56 CVEs were published on July 24, 2023: 2 critical, 14 high. Days are UTC.

- [CVE-2023-22363](https://cve.now/CVE-2023-22363.md): Access Zone stack overflow (CVSS 6.5, Gallagher Command Centre)
- [CVE-2023-25074](https://cve.now/CVE-2023-25074.md): Competency access levels not enforced in the server (CVSS 7.1, Gallagher Command Centre)
- [CVE-2023-22428](https://cve.now/CVE-2023-22428.md): Improper privilege validation in Command Centre Server allows authenticated operators to modify Division lineage. (CVSS 7.6, Gallagher Command Centre)
- [CVE-2023-3872](https://cve.now/CVE-2023-3872.md): Campcodes Beauty Salon Management System edit-services.php sql injection (CVSS 6.3, Campcodes Beauty Salon Management System)
- [CVE-2023-3871](https://cve.now/CVE-2023-3871.md): Campcodes Beauty Salon Management System edit\_category.php sql injection (CVSS 6.3, Campcodes Beauty Salon Management System)
- [CVE-2023-26045](https://cve.now/CVE-2023-26045.md): NodeBB vulnerable to path traversal and code execution via prototype vulnerability (CVSS 10.0, NodeBB)
- [CVE-2023-20593](https://cve.now/CVE-2023-20593.md): An issue in “Zen 2” CPUs, under specific microarchitectural circumstances, may allow an attacker to potentially access sensitive information (no CVSS, AMD Ryzen™ 3000 Series Desktop Processors “Matisse” AM4… +6)
- [CVE-2023-34478](https://cve.now/CVE-2023-34478.md): Apache Shiro before 1.12.0, or 2.0.0-alpha-3, may be susceptible to a path traversal attack when used together with APIs or other web frameworks that route requests based on non-normalized requests. (CVSS 9.8, Apache Software Foundation Apache Shiro · org.apache.shiro:…)
- [CVE-2023-3324](https://cve.now/CVE-2023-3324.md): Insecure deserialization in zenon internal DLLs (CVSS 6.3, ABB Ability™ zenon)
- [CVE-2023-3323](https://cve.now/CVE-2023-3323.md): Code Execution through overwriting project file on zenon engineering studio system (CVSS 5.9, ABB Ability™ zenon)
- [CVE-2023-3322](https://cve.now/CVE-2023-3322.md): Code Execution through overwriting service executable in utilities directory (CVSS 7.0, ABB Ability™ zenon)
- [CVE-2023-3321](https://cve.now/CVE-2023-3321.md): Code Execution through Writable Mosquitto Configuration File (CVSS 7.0, ABB Ability™ zenon)
- [CVE-2023-3640](https://cve.now/CVE-2023-3640.md): Kernel: x86/mm: a per-cpu entry area leak was identified through the init\_cea\_offsets function when prefetchnta and prefetcht2 instructions being used for the per-cpu entry area mapping to the user space (CVSS 7.0, Red Hat Enterprise Linux)
- [CVE-2023-32248](https://cve.now/CVE-2023-32248.md): Tree connection null pointer dereference denial-of-service vulnerability (CVSS 7.5, kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-32257](https://cve.now/CVE-2023-32257.md): Session race condition remote code execution vulnerability (CVSS 8.1, kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-32252](https://cve.now/CVE-2023-32252.md): Session null pointer dereference denial-of-service vulnerability (CVSS 7.5, kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-32258](https://cve.now/CVE-2023-32258.md): Session race condition remote code execution vulnerability (CVSS 8.1, kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-1386](https://cve.now/CVE-2023-1386.md): Qemu: 9pfs: suid/sgid bits not dropped on file write (CVSS 3.3, qemu · Red Hat Enterprise Linux +1)
- [CVE-2023-33951](https://cve.now/CVE-2023-33951.md): Kernel: vmwgfx: race condition leading to information disclosure vulnerability (CVSS 6.7, Red Hat Enterprise Linux)
- [CVE-2023-32247](https://cve.now/CVE-2023-32247.md): Session setup memory exhaustion denial-of-service vulnerability (CVSS 7.5, kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-3745](https://cve.now/CVE-2023-3745.md): Imagemagick: heap-buffer-overflow in pushcharpixel() in quantum-private.h (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2023-3750](https://cve.now/CVE-2023-3750.md): Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of service (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2023-3812](https://cve.now/CVE-2023-3812.md): Kernel: tun: bugs for oversize packet when napi frags enabled in tun\_napi\_alloc\_frags (CVSS 7.8, Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…)
- [CVE-2023-3384](https://cve.now/CVE-2023-3384.md): Quay: stored cross site scripting (CVSS 5.4, Red Hat Quay)
- [CVE-2023-3748](https://cve.now/CVE-2023-3748.md): Inifinite loop in babld message parsing may cause dos (CVSS 3.5, frr · Red Hat Enterprise Linux +1)
- [CVE-2023-3019](https://cve.now/CVE-2023-3019.md): Qemu: e1000e: heap use-after-free in e1000e\_write\_packet\_to\_guest() (CVSS 6.0, Red Hat Enterprise Linux)
- [CVE-2023-3567](https://cve.now/CVE-2023-3567.md): Kernel: use after free in vcs\_read in drivers/tty/vt/vc\_screen.c due to race (CVSS 7.1, Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…)
- [CVE-2023-38200](https://cve.now/CVE-2023-38200.md): Keylime: registrar is subject to a dos against ssl connections (CVSS 7.5, Red Hat Enterprise Linux · keylime)
- [CVE-2023-33952](https://cve.now/CVE-2023-33952.md): Kernel: vmwgfx: double free within the handling of vmw\_buffer\_object objects (CVSS 6.7, Red Hat Enterprise Linux)
- [CVE-2023-2860](https://cve.now/CVE-2023-2860.md): Out-of-bounds read when setting hmac data (CVSS 4.4, kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-3863](https://cve.now/CVE-2023-3863.md): Use-after-free in nfc\_llcp\_find\_loca in net/nfc/llcp\_core.c (CVSS 6.4, Kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-2761](https://cve.now/CVE-2023-2761.md): User Activity Log \< 1.6.3 - Admin+ SQL Injection (no CVSS, User Activity Log)
- [CVE-2023-3248](https://cve.now/CVE-2023-3248.md): All-in-one Floating Contact Form \< 2.1.2 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, All-in-one Floating Contact Form, Call, Chat, and 50+ Socia…)
- [CVE-2023-3344](https://cve.now/CVE-2023-3344.md): Auto Location for WP Job Manager via Google \< 1.1 - Admin+ Cross Site Scripting (CVSS 4.8, Auto Location for WP Job Manager via Google)
- [CVE-2023-2309](https://cve.now/CVE-2023-2309.md): wpForo Forum \< 2.1.9 - Reflected Cross-Site Scripting (no CVSS, wpForo Forum)
- [CVE-2023-3417](https://cve.now/CVE-2023-3417.md): File Extension Spoofing using the Text Direction Override Character (no CVSS, Mozilla Thunderbird)
- [CVE-2023-38060](https://cve.now/CVE-2023-38060.md): Host header injection by attachments in web service (CVSS 6.3, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2023-38058](https://cve.now/CVE-2023-38058.md): Tickets can be moved without permissions (CVSS 4.1, OTRS AG OTRS)
- [CVE-2023-38057](https://cve.now/CVE-2023-38057.md): XSS stored in survey answers (CVSS 4.1, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2023-38056](https://cve.now/CVE-2023-38056.md): Code execution via System Configuration (CVSS 7.2, OTRS AG OTRS · OTRS AG ((OTRS)) Community Edition)
- [CVE-2023-3862](https://cve.now/CVE-2023-3862.md): Travelmate Travelable Trek Management Solution Comment Box cross site scripting (CVSS 3.1, Travelmate Travelable Trek Management Solution)
- [CVE-2023-3861](https://cve.now/CVE-2023-3861.md): phpscriptpoint Insurance search.php cross site scripting (CVSS 3.5, phpscriptpoint Insurance)
- [CVE-2023-3860](https://cve.now/CVE-2023-3860.md): phpscriptpoint Insurance page.php cross site scripting (CVSS 3.5, phpscriptpoint Insurance)
- [CVE-2023-3859](https://cve.now/CVE-2023-3859.md): phpscriptpoint Car Listing GET Parameter search.php sql injection (CVSS 6.3, phpscriptpoint Car Listing)
- [CVE-2023-3858](https://cve.now/CVE-2023-3858.md): phpscriptpoint Car Listing search.php cross site scripting (CVSS 3.5, phpscriptpoint Car Listing)
- [CVE-2023-3857](https://cve.now/CVE-2023-3857.md): phpscriptpoint Ecommerce product.php cross site scripting (CVSS 3.5, phpscriptpoint Ecommerce)
- [CVE-2023-3856](https://cve.now/CVE-2023-3856.md): phpscriptpoint Ecommerce blog-single.php cross site scripting (CVSS 3.5, phpscriptpoint Ecommerce)
- [CVE-2021-39421](https://cve.now/CVE-2021-39421.md): A cross-site scripting (XSS) vulnerability in SeedDMS v6.0.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa (no CVSS)
- [CVE-2022-28863](https://cve.now/CVE-2022-28863.md): An issue was discovered in Nokia NetAct 22. (no CVSS)
- [CVE-2022-28864](https://cve.now/CVE-2022-28864.md): An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. (no CVSS)
- [CVE-2022-28865](https://cve.now/CVE-2022-28865.md): An issue was discovered in Nokia NetAct 22 through the Site Configuration Tool website section. (no CVSS)
- [CVE-2022-28867](https://cve.now/CVE-2022-28867.md): An issue was discovered in Nokia NetAct 22 through the Administration of Measurements website section. (no CVSS)
- [CVE-2022-30280](https://cve.now/CVE-2022-30280.md): /SecurityManagement/html/createuser.jsf in Nokia NetAct 22 allows CSRF. (no CVSS)
- [CVE-2023-26077](https://cve.now/CVE-2023-26077.md): Atera Agent through 1.8.3.6 on Windows Creates a Temporary File in a Directory with Insecure Permissions. (no CVSS)
- [CVE-2023-26078](https://cve.now/CVE-2023-26078.md): Privilege escalation vulnerability was discovered in Atera Agent 1.8.4.4 and prior on Windows due to mishandling of privileged APIs. (no CVSS)
- [CVE-2023-37613](https://cve.now/CVE-2023-37613.md): A cross-site scripting (XSS) vulnerability in Assembly Software Trialworks v11.4 allows attackers to execute arbitrary web scripts or HTML v (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.