CVEs published July 27, 2023
73 CVEs were published on July 27, 2023: 3 critical, 15 high.
- Published
- 73
- Critical
- 3
- High
- 15
- Medium
- 14
- Low
- 3
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 45
Most affected products
- Apple macOS
- 11
- getkirby kirby · getkirby/cms
- 5
- Apple iOS and iPadOS · Apple macOS
- 4
- Apple iOS and iPadOS · Apple macOS +1
- 4
- Apple Safari · Apple tvOS +3
- 4
- Apple tvOS · Apple iOS and iPadOS +2
- 3
- Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fa…
- 3
- jgraph/drawio
- 3
- omeka/omeka-s
- 3
- crossplane · github.com/crossplane/crossplane
- 2
Critical 3
- CVE-2023-3974OS Command Injection in jgraph/drawiojgraph/drawio
- CVE-2023-3973Cross-site Scripting (XSS) - Reflected in jgraph/drawiojgraph/drawio
- CVE-2023-3956InstaWP Connect <= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events_receiverInstaWP Connect – 1-click WP Staging & Migration
High 15
- CVE-2022-43701Insecure directory permissions on installer filesArm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fa…
- CVE-2023-38510Tolgee Lacks Permission Check for API Key for some endpointstolgee-platform
- CVE-2023-38505DietPi-Dashboard Insufficient TLS Handshake Poolravenclaw900 DietPi-Dashboard
- CVE-2023-38504Sails DoS vulnerability for apps with sockets enabledbalderdashy sails · sails
- CVE-2023-38495Crossplane vulnerable to possible image tampering from missing image validation for Packagescrossplane · github.com/crossplane/crossplane
- CVE-2023-38489Kirby vulnerable to Insufficient Session Expiration after a password changegetkirby kirby · getkirby/cms
- CVE-2023-37894WordPress Variation Images Gallery for WooCommerce Plugin <= 2.3.3 is vulnerable to Cross Site Scripting (XSS)RadiusTheme Variation Images Gallery for WooCommerce
- CVE-2023-3975OS Command Injection in jgraph/drawiojgraph/drawio
- CVE-2023-38488Kirby vulnerable to field injection in the KirbyData text storage handlergetkirby kirby · getkirby/cms
- CVE-2023-37975WordPress Variation Swatches for WooCommerce Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)RadiusTheme Variation Swatches for WooCommerce
- CVE-2023-37976WordPress Radio Forge Muses Player with Skins Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)Radio Forge Muses Player with Skins
- CVE-2023-37977WordPress WPFunnels Plugin <= 2.7.16 is vulnerable to Cross Site Scripting (XSS)WPFunnels Team Drag & Drop Sales Funnel Builder for WordPre…
- CVE-2023-37979WordPress Ninja Forms Plugin <= 3.6.25 is vulnerable to Cross Site Scripting (XSS)Saturday Drive Ninja Forms Contact Form
- CVE-2023-37981WordPress Authors List Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)WPKube Authors List
- CVE-2023-38600The issue was addressed with improved checks.Apple Safari · Apple tvOS +3
Medium, low and unrated 55
- CVE-2022-43703Incomplete verification of installation file signatureArm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fa…
- CVE-2022-43702Incomplete verification of installation file signatureArm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fa…
- CVE-2023-23764Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingGitHub Enterprise Server
- CVE-2023-38509XWiki Platform's obfuscated email addresses should not be sortedxwiki-platform · org.xwiki.platform:xwiki-platform-livetabl…
- CVE-2023-3982Cross-site Scripting (XSS) - Stored in omeka/omeka-someka/omeka-s
- CVE-2023-3981Server-Side Request Forgery (SSRF) in omeka/omeka-someka/omeka-s
- CVE-2023-3980Cross-site Scripting (XSS) - Stored in omeka/omeka-someka/omeka-s
- CVE-2023-37900Crossplane vulnerable to denial of service from large imagecrossplane · github.com/crossplane/crossplane
- CVE-2023-38492Kirby vulnerable to denial of service from unlimited password lengthsgetkirby kirby · getkirby/cms
- CVE-2023-38491Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded filesgetkirby kirby · getkirby/cms
- CVE-2023-38490Kirby XML External Entity (XXE) vulnerability in the XML data handlergetkirby kirby · getkirby/cms
- CVE-2023-37970WordPress MF Gig Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)Matthew Fries MF Gig Calendar
- CVE-2023-37980WordPress Custom Field For WP Job Manager Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)Gravity Master Custom Field For WP Job Manager
- CVE-2023-37993WordPress wpShopGermany IT-RECHT KANZLEI Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)maennchen1.de wpShopGermany IT-RECHT KANZLEI
- CVE-2023-38512WordPress WpStream plugin <= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerabilityWpStream
- CVE-2023-3970GZ Scripts Availability Booking Calendar PHP Image cross site scriptingGZ Scripts Availability Booking Calendar PHP
- CVE-2023-3969GZ Scripts Availability Booking Calendar PHP HTTP POST Request index.php cross site scriptingGZ Scripts Availability Booking Calendar PHP
- CVE-2023-3957ACF Photo Gallery Field <= 1.9 - Authenticated (Subscriber+) Arbitrary Usermeta Updatenavzme ACF Photo Gallery Field
- CVE-2023-32450 Dell Power Manager, Versions 3.3 to 3.14 contains an Improper Access Control vulnerability.Dell Power Manager
- CVE-2023-32443An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2023-38424The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-38259A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2023-32418The issue was addressed with improved checks.Apple macOS
- CVE-2023-38595The issue was addressed with improved checks.Apple Safari · Apple tvOS +3
- CVE-2023-38258The issue was addressed with improved checks.Apple macOS
- CVE-2023-38608The issue was addressed with additional permissions checks.Apple macOS
- CVE-2023-38425The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-32442An access issue was addressed with improved access restrictions.Apple macOS
- CVE-2023-38603The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2023-32429The issue was addressed with improved checks.Apple macOS
- CVE-2023-38136The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple watchOS
- CVE-2023-32393The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-38593A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-38602A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2023-38565A path handling issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-38421The issue was addressed with improved checks.Apple macOS
- CVE-2023-38564The issue was addressed with improved checks.Apple macOS
- CVE-2023-35993A use-after-free issue was addressed with improved memory management.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-38572The issue was addressed with improved checks.Apple Safari · Apple tvOS +3
- CVE-2023-32734The issue was addressed with improved memory handling.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-32364A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2023-38261The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-32441The issue was addressed with improved memory handling.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-32416A logic issue was addressed with improved restrictions.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-38611The issue was addressed with improved memory handling.Apple Safari · Apple tvOS +3
- CVE-2023-38580The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +1
- CVE-2020-22623Directory traversal vulnerability in Jinfornet Jreport 15.6 allows unauthenticated attackers to gain sensitive information.
- CVE-2021-36580Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter.
- CVE-2022-31200Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field
- CVE-2023-33742TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Cleartext Storage of Sensitive Information: RSA private key in Update.exe.
- CVE-2023-33743TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Access Control; specifically, Android Debug Bridge (adb) is available.
- CVE-2023-33744TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Use of a Hard-coded Password (PIN): 385521, 843646, and 592671.
- CVE-2023-33745TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Privilege Management: from the shell available after an adb connection,
- CVE-2023-36941A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute ar
- CVE-2023-36942A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute ar