CVEs published July 26, 2023
71 CVEs were published on July 26, 2023: 3 critical, 16 high. 2 are now in CISA KEV.
- Published
- 71
- Critical
- 3
- High
- 16
- Medium
- 15
- Low
- 2
- Unrated
- 35
- Now in CISA KEV
- 2
- Fix available
- 37
Most affected products
- SolarWinds Platform
- 6
- PaddlePaddle
- 5
- Apple macOS
- 3
- Apple Safari · Apple tvOS +3
- 3
- Apple tvOS · Apple iOS and iPadOS +2
- 3
- Canonical Ubuntu Kernel
- 2
- HCL Software HCL BigFix Mobile
- 2
- Hitachi Energy RTU500 series
- 2
- Jenkins plug-in for ServiceNow DevOps · io.jenkins.plugins:…
- 2
- Apache Software Foundation Apache Helix · org.apache.hel… +1
- 1
Critical 3
- CVE-2023-33308A stack-based overflow vulnerability [CWE-124] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy versiFortinet FortiProxy · Fortinet FortiOS
- CVE-2023-38673Command injection in fs.pyPaddlePaddle
- CVE-2023-38647Apache Helix: Deserialization vulnerability in Helix workflow and RESTApache Software Foundation Apache Helix · org.apache.hel… +1
High 16
- CVE-2023-37450The issue was addressed with improved checks.Apple Safari · Apple tvOS +3
- CVE-2023-3442Missing Authorization in Jenkins plug-in for ServiceNow DevOpsJenkins plug-in for ServiceNow DevOps · io.jenkins.plugins:…
- CVE-2023-3242Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime <G4.93 allows unauthenticated netwB&R Industrial Automation B&R Automation Runtime
- CVE-2023-23842SolarWinds Network Configuration Manager Directory Traversal VulnerabilitySolarWinds Network Configuration Manager
- CVE-2023-23843SolarWinds Platform Incorrect Comparison VulnerabilitySolarWinds Platform
- CVE-2023-33224SolarWinds Platform Incorrect Behavior Order VulnerabilitySolarWinds Platform
- CVE-2023-33225SolarWinds Platform Deserialization of Untrusted Data VulnerabilitySolarWinds Platform
- CVE-2023-23844SolarWinds Platform Incomplete List of Disallowed Inputs VulnerabilitySolarWinds Platform
- CVE-2023-38671Heap buffer overflow in paddle.tracePaddlePaddle
- CVE-2023-28130Local user may lead to privilege escalation using Gaia Portal hostnames page.Quantum Appliances, Quantum Security Gateways
- CVE-2023-38669Use after free in paddle.diagonal in PaddlePaddle before 2.5.0.PaddlePaddle
- CVE-2022-4608A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product.Hitachi Energy RTU500 series
- CVE-2022-2502A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product.Hitachi Energy RTU500 series
- CVE-2023-32629Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_Canonical Ubuntu Kernel
- CVE-2023-2640On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unpCanonical Ubuntu Kernel
- CVE-2023-30577AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different
Medium, low and unrated 52
- CVE-2023-38410The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2023-38606This issue was addressed with improved state management.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-32437The issue was addressed with improvements to the file handling protocol.Apple iOS and iPadOS
- CVE-2023-36862A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions.Apple macOS
- CVE-2023-38597The issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +1
- CVE-2023-32381A use-after-free issue was addressed with improved memory management.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-36854The issue was addressed with improved checks.Apple macOS
- CVE-2023-35983This issue was addressed with improved data protection.Apple macOS
- CVE-2023-32433A use-after-free issue was addressed with improved memory management.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-38594The issue was addressed with improved checks.Apple Safari · Apple tvOS +3
- CVE-2023-38133The issue was addressed with improved checks.Apple Safari · Apple tvOS +3
- CVE-2023-28014HCL BigFix Mobile can be affected by a cross-site scripting (XSS) vulnerability HCL Software HCL BigFix Mobile
- CVE-2023-28012HCL BigFix Mobile can be affected by a command injection vulnerability HCL Software HCL BigFix Mobile
- CVE-2023-28013HCL Verse is susceptible to a Reflected Cross-Site Scripting (XSS) VulnerabilityHCL Software HCL Verse
- CVE-2023-3414Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOpsJenkins plug-in for ServiceNow DevOps · io.jenkins.plugins:…
- CVE-2023-30949CVE-2023-30949com.palantir.slate:slate
- CVE-2023-3622Access Control Bypass Vulnerability in the SolarWinds Platform SolarWinds Platform
- CVE-2023-33229SolarWinds Platform Incorrect Input Neutralization VulnerabilitySolarWinds Platform
- CVE-2023-39156A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created BaJenkins Project Jenkins Bazaar Plugin · org.jenkins-ci.plug…
- CVE-2023-39155Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe Jenkins Project Jenkins Chef Identity Plugin · org.jenkins-…
- CVE-2023-39154Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/ConfigurJenkins Project Jenkins Qualys Web App Scanning Connector P…
- CVE-2023-39153A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick usersJenkins Project Jenkins GitLab Authentication Plugin · org.…
- CVE-2023-39152Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with asJenkins Project Jenkins Gradle Plugin · org.jenkins-ci.plug…
- CVE-2023-39151Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyperJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-39261In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissionsJetBrains IntelliJ IDEA
- CVE-2023-38672FPE in paddle.linalg.matrix_powerPaddlePaddle
- CVE-2023-38670Null pointer dereference in paddle.flipPaddlePaddle
- CVE-2023-38433Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initiFujitsu Limited IP-HE950E · Fujitsu Limited IP-HE950D +6
- CVE-2023-38555Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attackeFujitsu Limited Si-R · Fujitsu Limited Si-R570B +3
- CVE-2023-32468 Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability.Dell ECS Streamer
- CVE-2023-1401Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2023-20891VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerabilityVMware Tanzu Application Service for VMs · VMware Isolation…
- CVE-2023-3946 A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potentialTrellix EPO
- CVE-2023-3947Video Conferencing with Zoom <= 4.2.1 - Sensitive Information Exposurej_3rk Video Conferencing with Zoom
- CVE-2022-31455* A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payl
- CVE-2022-31456A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa
- CVE-2022-43710Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery (CSRF) bec
- CVE-2022-43711Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks (XSS) be
- CVE-2022-43712POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in.
- CVE-2022-43713Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form valid
- CVE-2023-26859SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileges via the ajaxOrderT
- CVE-2023-26911ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to l
- CVE-2023-30367Multi-Remote Next Generation Connection Manager (mRemoteNG) is free software that enables users to store and manage multi-protocol connectio
- CVE-2023-31465An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28.
- CVE-2023-31466An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17.
- CVE-2023-33802A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text file.
- CVE-2023-37049emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\template.php.
- CVE-2023-37623Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm.
- CVE-2023-37624Netdisco before v2.063000 was discovered to contain an open redirect vulnerability.
- CVE-2023-37692An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file.october/october
- CVE-2023-37732Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attacker to cause a denial
- CVE-2023-38285Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity.