# CVEs published 2023-07-26

71 CVEs were published on July 26, 2023: 3 critical, 16 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-38410](https://cve.now/CVE-2023-38410.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-38606](https://cve.now/CVE-2023-38606.md): This issue was addressed with improved state management. (CVSS 5.5, KEV, Apple tvOS · Apple iOS and iPadOS +2)
- [CVE-2023-32437](https://cve.now/CVE-2023-32437.md): The issue was addressed with improvements to the file handling protocol. (no CVSS, Apple iOS and iPadOS)
- [CVE-2023-36862](https://cve.now/CVE-2023-36862.md): A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. (no CVSS, Apple macOS)
- [CVE-2023-38597](https://cve.now/CVE-2023-38597.md): The issue was addressed with improved checks. (no CVSS, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2023-32381](https://cve.now/CVE-2023-32381.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple tvOS · Apple iOS and iPadOS +2)
- [CVE-2023-36854](https://cve.now/CVE-2023-36854.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-35983](https://cve.now/CVE-2023-35983.md): This issue was addressed with improved data protection. (no CVSS, Apple macOS)
- [CVE-2023-32433](https://cve.now/CVE-2023-32433.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple tvOS · Apple iOS and iPadOS +2)
- [CVE-2023-38594](https://cve.now/CVE-2023-38594.md): The issue was addressed with improved checks. (no CVSS, Apple Safari · Apple tvOS +3)
- [CVE-2023-38133](https://cve.now/CVE-2023-38133.md): The issue was addressed with improved checks. (no CVSS, Apple Safari · Apple tvOS +3)
- [CVE-2023-28014](https://cve.now/CVE-2023-28014.md): HCL BigFix Mobile can be affected by a cross-site scripting (XSS) vulnerability (CVSS 6.6, HCL Software HCL BigFix Mobile)
- [CVE-2023-37450](https://cve.now/CVE-2023-37450.md): The issue was addressed with improved checks. (CVSS 8.8, KEV, Apple Safari · Apple tvOS +3)
- [CVE-2023-28012](https://cve.now/CVE-2023-28012.md): HCL BigFix Mobile can be affected by a command injection vulnerability (CVSS 5.4, HCL Software HCL BigFix Mobile)
- [CVE-2023-28013](https://cve.now/CVE-2023-28013.md): HCL Verse is susceptible to a Reflected Cross-Site Scripting (XSS) Vulnerability (CVSS 6.5, HCL Software HCL Verse)
- [CVE-2023-3442](https://cve.now/CVE-2023-3442.md): Missing Authorization in Jenkins plug-in for ServiceNow DevOps (CVSS 7.7, Jenkins plug-in for ServiceNow DevOps · io.jenkins.plugins:…)
- [CVE-2023-3414](https://cve.now/CVE-2023-3414.md): Cross-Site Request Forgery (CSRF) in Jenkins Plug-in for ServiceNow DevOps (CVSS 6.1, Jenkins plug-in for ServiceNow DevOps · io.jenkins.plugins:…)
- [CVE-2023-3242](https://cve.now/CVE-2023-3242.md): Improper initialization implementation in Portmapper used in B&R Industrial Automation Automation Runtime \<G4.93 allows unauthenticated netw (CVSS 8.6, B&R Industrial Automation B&R Automation Runtime)
- [CVE-2023-30949](https://cve.now/CVE-2023-30949.md): CVE-2023-30949 (CVSS 4.3, com.palantir.slate:slate)
- [CVE-2023-23842](https://cve.now/CVE-2023-23842.md): SolarWinds Network Configuration Manager Directory Traversal Vulnerability (CVSS 7.2, SolarWinds Network Configuration Manager)
- [CVE-2023-3622](https://cve.now/CVE-2023-3622.md): Access Control Bypass Vulnerability in the SolarWinds Platform (CVSS 4.3, SolarWinds Platform)
- [CVE-2023-33229](https://cve.now/CVE-2023-33229.md): SolarWinds Platform Incorrect Input Neutralization Vulnerability (CVSS 3.5, SolarWinds Platform)
- [CVE-2023-33308](https://cve.now/CVE-2023-33308.md): A stack-based overflow vulnerability \[CWE-124\] in Fortinet FortiOS version 7.0.0 through 7.0.10 and 7.2.0 through 7.2.3 and FortiProxy versi (CVSS 9.8, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2023-23843](https://cve.now/CVE-2023-23843.md): SolarWinds Platform Incorrect Comparison Vulnerability (CVSS 7.2, SolarWinds Platform)
- [CVE-2023-39156](https://cve.now/CVE-2023-39156.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Bazaar Plugin 1.22 and earlier allows attackers to delete previously created Ba (no CVSS, Jenkins Project Jenkins Bazaar Plugin · org.jenkins-ci.plug…)
- [CVE-2023-39155](https://cve.now/CVE-2023-39155.md): Jenkins Chef Identity Plugin 2.0.3 and earlier does not mask the user.pem key form field, increasing the potential for attackers to observe (no CVSS, Jenkins Project Jenkins Chef Identity Plugin · org.jenkins-…)
- [CVE-2023-39154](https://cve.now/CVE-2023-39154.md): Incorrect permission checks in Jenkins Qualys Web App Scanning Connector Plugin 2.0.10 and earlier allow attackers with global Item/Configur (no CVSS, Jenkins Project Jenkins Qualys Web App Scanning Connector P…)
- [CVE-2023-39153](https://cve.now/CVE-2023-39153.md): A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Authentication Plugin 1.17.1 and earlier allows attackers to trick users (no CVSS, Jenkins Project Jenkins GitLab Authentication Plugin · org.…)
- [CVE-2023-39152](https://cve.now/CVE-2023-39152.md): Always-incorrect control flow implementation in Jenkins Gradle Plugin 2.8 may result in credentials not being masked (i.e., replaced with as (no CVSS, Jenkins Project Jenkins Gradle Plugin · org.jenkins-ci.plug…)
- [CVE-2023-39151](https://cve.now/CVE-2023-39151.md): Jenkins 2.415 and earlier, LTS 2.401.2 and earlier does not sanitize or properly encode URLs in build logs when transforming them into hyper (no CVSS, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-33224](https://cve.now/CVE-2023-33224.md): SolarWinds Platform Incorrect Behavior Order Vulnerability (CVSS 7.2, SolarWinds Platform)
- [CVE-2023-33225](https://cve.now/CVE-2023-33225.md): SolarWinds Platform Deserialization of Untrusted Data Vulnerability (CVSS 7.2, SolarWinds Platform)
- [CVE-2023-23844](https://cve.now/CVE-2023-23844.md): SolarWinds Platform Incomplete List of Disallowed Inputs Vulnerability (CVSS 7.2, SolarWinds Platform)
- [CVE-2023-39261](https://cve.now/CVE-2023-39261.md): In JetBrains IntelliJ IDEA before 2023.2 plugin for Space was requesting excessive permissions (CVSS 5.2, JetBrains IntelliJ IDEA)
- [CVE-2023-38673](https://cve.now/CVE-2023-38673.md): Command injection in fs.py (CVSS 9.6, PaddlePaddle)
- [CVE-2023-38672](https://cve.now/CVE-2023-38672.md): FPE in paddle.linalg.matrix\_power (CVSS 4.7, PaddlePaddle)
- [CVE-2023-38671](https://cve.now/CVE-2023-38671.md): Heap buffer overflow in paddle.trace (CVSS 8.3, PaddlePaddle)
- [CVE-2023-28130](https://cve.now/CVE-2023-28130.md): Local user may lead to privilege escalation using Gaia Portal hostnames page. (CVSS 7.2, Quantum Appliances, Quantum Security Gateways)
- [CVE-2023-38670](https://cve.now/CVE-2023-38670.md): Null pointer dereference in paddle.flip (CVSS 4.7, PaddlePaddle)
- [CVE-2023-38669](https://cve.now/CVE-2023-38669.md): Use after free in paddle.diagonal in PaddlePaddle before 2.5.0. (CVSS 8.3, PaddlePaddle)
- [CVE-2023-38647](https://cve.now/CVE-2023-38647.md): Apache Helix: Deserialization vulnerability in Helix workflow and REST (CVSS 9.8, Apache Software Foundation Apache Helix · org.apache.hel… +1)
- [CVE-2023-38433](https://cve.now/CVE-2023-38433.md): Fujitsu Real-time Video Transmission Gear "IP series" use hard-coded credentials, which may allow a remote unauthenticated attacker to initi (no CVSS, Fujitsu Limited IP-HE950E · Fujitsu Limited IP-HE950D +6)
- [CVE-2023-38555](https://cve.now/CVE-2023-38555.md): Authentication bypass vulnerability in Fujitsu network devices Si-R series and SR-M series allows a network-adjacent unauthenticated attacke (no CVSS, Fujitsu Limited Si-R · Fujitsu Limited Si-R570B +3)
- [CVE-2023-32468](https://cve.now/CVE-2023-32468.md): Dell ECS Streamer, versions prior to 2.0.7.1, contain an insertion of sensitive information in log files vulnerability. (CVSS 5.8, Dell ECS Streamer)
- [CVE-2023-1401](https://cve.now/CVE-2023-1401.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 5.0, GitLab)
- [CVE-2023-20891](https://cve.now/CVE-2023-20891.md): VMware Tanzu Application Service for VMs and Isolation Segment information disclosure vulnerability (CVSS 6.5, VMware Tanzu Application Service for VMs · VMware Isolation…)
- [CVE-2022-4608](https://cve.now/CVE-2022-4608.md): A vulnerability exists in HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. (CVSS 7.5, Hitachi Energy RTU500 series)
- [CVE-2022-2502](https://cve.now/CVE-2022-2502.md): A vulnerability exists in the HCI IEC 60870-5-104 function included in certain versions of the RTU500 series product. (CVSS 7.5, Hitachi Energy RTU500 series)
- [CVE-2023-3946](https://cve.now/CVE-2023-3946.md): A reflected cross-site scripting (XSS) vulnerability in ePO prior to 5.10 SP1 Update 1allows a remote unauthenticated attacker to potential (CVSS 5.4, Trellix EPO)
- [CVE-2023-3947](https://cve.now/CVE-2023-3947.md): Video Conferencing with Zoom \<= 4.2.1 - Sensitive Information Exposure (CVSS 3.7, j\_3rk Video Conferencing with Zoom)
- [CVE-2023-32629](https://cve.now/CVE-2023-32629.md): Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl\_copy\_up\_meta\_inode\_data skip permission checks when calling ovl\_do\_ (CVSS 7.8, Canonical Ubuntu Kernel)
- [CVE-2023-2640](https://cve.now/CVE-2023-2640.md): On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.\* xattrs", an unp (CVSS 7.8, Canonical Ubuntu Kernel)
- [CVE-2022-31455](https://cve.now/CVE-2022-31455.md): \* A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payl (no CVSS)
- [CVE-2022-31456](https://cve.now/CVE-2022-31456.md): A cross-site scripting (XSS) vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa (CVSS 6.1)
- [CVE-2022-43710](https://cve.now/CVE-2022-43710.md): Interactive Forms (IAF) in GX Software XperienCentral versions 10.31.0 until 10.33.0 was vulnerable to cross site request forgery (CSRF) bec (no CVSS)
- [CVE-2022-43711](https://cve.now/CVE-2022-43711.md): Interactive Forms (IAF) in GX Software XperienCentral versions 10.29.1 until 10.33.0 was vulnerable to cross site scripting attacks (XSS) be (no CVSS)
- [CVE-2022-43712](https://cve.now/CVE-2022-43712.md): POST requests to /web/mvc in GX Software XperienCentral version 10.36.0 and earlier were not blocked for uses that are not logged in. (no CVSS)
- [CVE-2022-43713](https://cve.now/CVE-2022-43713.md): Interactive Forms (IAF) in GX Software XperienCentral versions 10.33.1 until 10.35.0 was vulnerable to invalid data input because form valid (no CVSS)
- [CVE-2023-26859](https://cve.now/CVE-2023-26859.md): SQL injection vulnerability found in PrestaShop sendinblue v.4.0.15 and before allow a remote attacker to gain privileges via the ajaxOrderT (no CVSS)
- [CVE-2023-26911](https://cve.now/CVE-2023-26911.md): ASUS SetupAsusServices v1.0.5.1 in Asus Armoury Crate v5.3.4.0 contains an unquoted service path vulnerability which allows local users to l (no CVSS)
- [CVE-2023-30367](https://cve.now/CVE-2023-30367.md): Multi-Remote Next Generation Connection Manager (mRemoteNG) is free software that enables users to store and manage multi-protocol connectio (no CVSS)
- [CVE-2023-30577](https://cve.now/CVE-2023-30577.md): AMANDA (Advanced Maryland Automatic Network Disk Archiver) before tag-community-3.5.4 mishandles argument checking for runtar.c, a different (CVSS 7.8)
- [CVE-2023-31465](https://cve.now/CVE-2023-31465.md): An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28. (no CVSS)
- [CVE-2023-31466](https://cve.now/CVE-2023-31466.md): An XSS issue was discovered in FSMLabs TimeKeeper 8.0.17. (no CVSS)
- [CVE-2023-33802](https://cve.now/CVE-2023-33802.md): A buffer overflow in SumatraPDF Reader v3.4.6 allows attackers to cause a Denial of Service (DoS) via a crafted text file. (no CVSS)
- [CVE-2023-37049](https://cve.now/CVE-2023-37049.md): emlog 2.1.9 is vulnerable to Arbitrary file deletion via admin\\template.php. (no CVSS)
- [CVE-2023-37623](https://cve.now/CVE-2023-37623.md): Netdisco before v2.063000 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /Web/TypeAhead.pm. (no CVSS)
- [CVE-2023-37624](https://cve.now/CVE-2023-37624.md): Netdisco before v2.063000 was discovered to contain an open redirect vulnerability. (no CVSS)
- [CVE-2023-37692](https://cve.now/CVE-2023-37692.md): An arbitrary file upload vulnerability in October CMS v3.4.4 allows attackers to execute arbitrary code via a crafted file. (no CVSS, october/october)
- [CVE-2023-37732](https://cve.now/CVE-2023-37732.md): Yasm v1.3.0.78 was found prone to NULL Pointer Dereference in /libyasm/intnum.c and /elf/elf.c, which allows the attacker to cause a denial (no CVSS)
- [CVE-2023-38285](https://cve.now/CVE-2023-38285.md): Trustwave ModSecurity 3.x before 3.0.10 has Inefficient Algorithmic Complexity. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.