CVEs published July 25, 2023
97 CVEs were published on July 25, 2023: 8 critical, 22 high. 1 is now in CISA KEV.
- Published
- 97
- Critical
- 8
- High
- 22
- Medium
- 38
- Low
- 10
- Unrated
- 19
- Now in CISA KEV
- 1
- Fix available
- 36
Most affected products
- Campcodes Beauty Salon Management System
- 17
- envoyproxy envoy
- 4
- Apache Software Foundation Apache InLong · org.apache.inlon…
- 3
- Hewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- 3
- JetBrains TeamCity
- 3
- dataease
- 2
- Infodrom Software E-Invoice Approval System
- 2
- phpscriptpoint Lawyer
- 2
- 9001 copyparty · copyparty
- 1
- Apache Software Foundation Apache Felix Healthcheck Webcons…
- 1
Critical 8
- CVE-2023-35982Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-35981Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-35980Unauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI ProtocolHewlett Packard Enterprise (HPE) Aruba Access Points runnin…
- CVE-2023-37895Apache Jackrabbit RMI access can lead to RCEApache Software Foundation Apache Jackrabbit Webapp · Ap… +3
- CVE-2023-35088Apache InLong: SQL injection in audit endpointApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2023-35066SQLi in Infodrom Sofwares E-Invoice Approval SystemInfodrom Software E-Invoice Approval System
- CVE-2023-35078An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the appliIvanti Endpoint Manager Mobile
- CVE-2023-3046SQLi in Biltay Technlogys ScientaBiltay Technology Scienta
High 22
- CVE-2023-38493Paths contain matrix variables bypass decoratorsline armeria · com.linecorp.armeria:armeria
- CVE-2023-37920Certifi's removal of e-Tugra root certificatepython-certifi · certifi
- CVE-2023-37907Cryptomator's MSI installer allows local privilege escalationcryptomator
- CVE-2023-37460Plexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchivercodehaus-plexus plexus-archiver · org.codehaus.plexus:plexu…
- CVE-2023-37258DataEase has a SQL injection vulnerability that can bypass blacklistsdataease
- CVE-2023-36826Sentry vulnerable to improper authorization on debug and artifact file downloadsgetsentry sentry · sentry
- CVE-2023-35944Envoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemesenvoyproxy envoy
- CVE-2023-35941Envoy vulnerable to OAuth2 credentials exploit with permanent validityenvoyproxy envoy
- CVE-2023-34235Leaking sensitive user information still possible by filtering on private with prefix fieldsstrapi · @strapi/database +1
- CVE-2023-2626Authentication Bypass in OpenThread Boarder Router devicesGoogle Nest Hub Max · Google Nest Hub (2nd. gen) w/ Slee… +2
- CVE-2023-36385WordPress PostX – Gutenberg Blocks for Post Grid Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS)wpxpo PostX – Gutenberg Post Grid Blocks
- CVE-2023-34017WordPress Five Star Restaurant Reservations Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)FiveStarPlugins Five Star Restaurant Reservations
- CVE-2023-36502WordPress Balkon Theme <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)cththemes Balkon
- CVE-2023-36501WordPress teachPress Plugin <= 9.0.2 is vulnerable to Cross Site Scripting (XSS)Michael Winkler teachPress
- CVE-2023-3548IQ Wifi 6Johnson Controls IQ Wifi
- CVE-2023-35043WordPress Recent Posts Slider Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)Neha Goel Recent Posts Slider
- CVE-2023-3486PaperCut NG Unauthenticated File UploadPaperCut NG
- CVE-2023-33925WordPress WooCommerce Product Categories Selection Widget Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)PluginForage WooCommerce Product Categories Selection Widget
- CVE-2023-21406Heap-based buffer overflow in Axis A1001 Network Door Controller's OSDP communicationAxis Communications AB AXIS A1001 Network Door Controller
- CVE-2023-34434Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath paramApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2023-35067Plaintext Storage of a Password in Infodrom Sofwares E-Invoice Approval SystemInfodrom Software E-Invoice Approval System
- CVE-2023-3873Campcodes Beauty Salon Management System index.php sql injectionCampcodes Beauty Salon Management System
Medium, low and unrated 67
- CVE-2023-38503Directus has Incorrect Permission Checking for GraphQL Subscriptionsdirectus
- CVE-2023-3945phpscriptpoint Lawyer search.php cross site scriptingphpscriptpoint Lawyer
- CVE-2023-38502TDengine Database Denial-of-Servicetaosdata TDengine
- CVE-2023-38501copyparty vulnerable to reflected cross-site scripting via k304 parameter9001 copyparty · copyparty
- CVE-2023-38496Apptainer's ineffective privileges drop when requesting container networkapptainer · github.com/apptainer/apptainer
- CVE-2023-38500By-passing Cross-Site Scripting Protection in HTML SanitizerTYPO3 html-sanitizer · typo3/html-sanitizer
- CVE-2023-38499typo3/cms-core Information Disclosure due to Out-of-scope Site Resolutiontypo3 · typo3/cms-core
- CVE-2023-37919Cal.com not expiring old sessions after enabling 2FAcalcom cal.com
- CVE-2023-37902Vyper's ecrecover can return undefined data if signature does not verifyvyperlang vyper · vyper
- CVE-2023-3944phpscriptpoint Lawyer page.php cross site scriptingphpscriptpoint Lawyer
- CVE-2023-37257The DataEase panel and dataset have a stored XSS vulnerabilitydataease
- CVE-2023-36806Contao cross site scripting vulnerability via input unit widgetcontao · contao/core-bundle
- CVE-2023-35943Envoy vulnerable to CORS filter segfault when origin header is removed envoyproxy envoy
- CVE-2023-35942Envoy's gRPC access log crash caused by the listener drainingenvoyproxy envoy
- CVE-2023-35929Tuleap Cross-site Scripting vulnerability in the card field of the agile dashboard appsEnalean tuleap
- CVE-2023-3773Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattrRed Hat Enterprise Linux
- CVE-2023-3772Kernel: xfrm: null pointer dereference in xfrm_update_ae_params()Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…
- CVE-2023-38435Apache Felix Healthcheck Webconsole Plugin: XSS in healthcheck webconsole pluginApache Software Foundation Apache Felix Healthcheck Webcons…
- CVE-2023-34093Strapi allows actors to make all attributes on a content-type public without noticing itstrapi · @strapi/strapi +2
- CVE-2023-39175In JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possibleJetBrains TeamCity
- CVE-2023-39174In JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue trackersJetBrains TeamCity
- CVE-2023-39173In JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain full account accessJetBrains TeamCity
- CVE-2023-36503WordPress MaxButtons Plugin <= 9.5.3 is vulnerable to Cross Site Scripting (XSS)Max Foundry WordPress Button Plugin MaxButtons
- CVE-2023-34369WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)GrandSlambert Login Configurator
- CVE-2023-23833WordPress Drop Shadow Boxes Plugin <= 1.7.10 is vulnerable to Cross Site Scripting (XSS)Steven Henty Drop Shadow Boxes
- CVE-2023-3637Openstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)Red Hat OpenStack Platform · neutron
- CVE-2023-2850NodeBB is affected by a Cross-Site WebSocket Hijacking vulnerability due to missing validation of the request origin.NodeBB
- CVE-2023-3897Bypassing CAPTCHA & Enumerating Usernames via Password Reset PageOnpremise SureMDM Solution SureMDM Onpremise
- CVE-2023-3890Campcodes Beauty Salon Management System edit-accepted-appointment.php cross site scriptingCampcodes Beauty Salon Management System
- CVE-2023-3888Campcodes Beauty Salon Management System admin-profile.php cross site scriptingCampcodes Beauty Salon Management System
- CVE-2023-21405Denial-of-Service vulnerability in Axis Network Door Controller's and Axis Network Intercom's OSDP communicationAxis Communications AB AXIS A1001 Network Door Controlle… +4
- CVE-2023-3887Campcodes Beauty Salon Management System search-appointment.php cross site scriptingCampcodes Beauty Salon Management System
- CVE-2023-34189Apache InLong: General user can delete and update processApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2023-3886Campcodes Beauty Salon Management System invoice.php cross site scriptingCampcodes Beauty Salon Management System
- CVE-2023-3885Campcodes Beauty Salon Management System edit_category.php cross site scriptingCampcodes Beauty Salon Management System
- CVE-2023-3884Campcodes Beauty Salon Management System edit_product.php cross site scriptingCampcodes Beauty Salon Management System
- CVE-2023-3883Campcodes Beauty Salon Management System add-category.php cross site scriptingCampcodes Beauty Salon Management System
- CVE-2023-32637GBrowse accepts files with any formats uploaded and places them in the area accessible through unauthenticated web requests.Generic Model Organism Database Project GBrowse
- CVE-2023-3882Campcodes Beauty Salon Management System edit-accepted-appointment.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-3881Campcodes Beauty Salon Management System forgot-password.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-3880Campcodes Beauty Salon Management System del_service.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-32639Applicant Programme Ver.7.06 and earlier improperly restricts XML external entity references (XXE).The Ministry of Justice Applicant Programme
- CVE-2023-3879Campcodes Beauty Salon Management System del_category.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-3878Campcodes Beauty Salon Management System about-us.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-3877Campcodes Beauty Salon Management System add-services.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-3876Campcodes Beauty Salon Management System search-appointment.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-23568 Improper privilege validation in Command Centre Server allows authenticated unprivileged operators to modify and view Personal Data Fields.Gallagher Command Centre
- CVE-2023-3875Campcodes Beauty Salon Management System del_feedback.php sql injectionCampcodes Beauty Salon Management System
- CVE-2023-3874Campcodes Beauty Salon Management System admin-profile.php sql injectionCampcodes Beauty Salon Management System
- CVE-2020-35698Thinkific Thinkific Online Course Creation Platform 1.0 is affected by: Cross Site Scripting (XSS).
- CVE-2022-31457RTX TRAP v1.0 allows attackers to perform a directory traversal via a crafted request sent to the endpoint /data/.
- CVE-2022-31458RTX TRAP v1.0 was discovered to be vulnerable to host header poisoning.
- CVE-2022-46898An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.
- CVE-2022-46899An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.
- CVE-2022-46900An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.
- CVE-2022-46901An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.
- CVE-2022-46902An issue was discovered in Vocera Report Server and Voice Server 5.x through 5.8.
- CVE-2023-32231An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.818.
- CVE-2023-32232An issue was discovered in Vasion PrinterLogic Client for Windows before 25.0.0.836.
- CVE-2023-33777An issue in /functions/fbaorder.php of Prestashop amazon before v5.2.24 allows attackers to execute a directory traversal attack.
- CVE-2023-34798An arbitrary file upload vulnerability in eoffice before v9.5 allows attackers to execute arbitrary code via uploading a crafted file.
- CVE-2023-37361REDCap 12.0.26 LTS and 12.3.2 Standard allows SQL Injection via scheduling, repeatforms, purpose, app_title, or randomization.
- CVE-2023-37677Pligg CMS v2.0.2 (also known as Kliqqi) was discovered to contain a remote code execution (RCE) vulnerability in the component admin_editor.
- CVE-2023-38745Pandoc before 3.1.6 allows arbitrary file write: this can be triggered by providing a crafted image element in the input when generating fil
- CVE-2023-39128GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a stack overflow via the function ada_decode at /gdb/ada-lang.c.
- CVE-2023-39129GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap use after free via the function add_pe_exported_sym() at /gdb/coff-pe-re
- CVE-2023-39130GNU gdb (GDB) 13.0.50.20220805-git was discovered to contain a heap buffer overflow via the function pe_as16() at /gdb/coff-pe-read.c.