# CVEs published 2023-07-27

73 CVEs were published on July 27, 2023: 3 critical, 15 high. Days are UTC.

- [CVE-2022-43703](https://cve.now/CVE-2022-43703.md): Incomplete verification of installation file signature (no CVSS, Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fa…)
- [CVE-2022-43702](https://cve.now/CVE-2022-43702.md): Incomplete verification of installation file signature (no CVSS, Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fa…)
- [CVE-2022-43701](https://cve.now/CVE-2022-43701.md): Insecure directory permissions on installer files (CVSS 7.8, Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fa…)
- [CVE-2023-23764](https://cve.now/CVE-2023-23764.md): Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling (CVSS 4.8, GitHub Enterprise Server)
- [CVE-2023-38510](https://cve.now/CVE-2023-38510.md): Tolgee Lacks Permission Check for API Key for some endpoints (CVSS 8.1, tolgee-platform)
- [CVE-2023-38509](https://cve.now/CVE-2023-38509.md): XWiki Platform's obfuscated email addresses should not be sorted (CVSS 4.3, xwiki-platform · org.xwiki.platform:xwiki-platform-livetabl…)
- [CVE-2023-38505](https://cve.now/CVE-2023-38505.md): DietPi-Dashboard Insufficient TLS Handshake Pool (CVSS 7.5, ravenclaw900 DietPi-Dashboard)
- [CVE-2023-3982](https://cve.now/CVE-2023-3982.md): Cross-site Scripting (XSS) - Stored in omeka/omeka-s (CVSS 5.4, omeka/omeka-s)
- [CVE-2023-3981](https://cve.now/CVE-2023-3981.md): Server-Side Request Forgery (SSRF) in omeka/omeka-s (CVSS 6.5, omeka/omeka-s)
- [CVE-2023-3980](https://cve.now/CVE-2023-3980.md): Cross-site Scripting (XSS) - Stored in omeka/omeka-s (CVSS 5.4, omeka/omeka-s)
- [CVE-2023-38504](https://cve.now/CVE-2023-38504.md): Sails DoS vulnerability for apps with sockets enabled (CVSS 7.5, balderdashy sails · sails)
- [CVE-2023-38495](https://cve.now/CVE-2023-38495.md): Crossplane vulnerable to possible image tampering from missing image validation for Packages (CVSS 8.4, crossplane · github.com/crossplane/crossplane)
- [CVE-2023-37900](https://cve.now/CVE-2023-37900.md): Crossplane vulnerable to denial of service from large image (CVSS 3.4, crossplane · github.com/crossplane/crossplane)
- [CVE-2023-38492](https://cve.now/CVE-2023-38492.md): Kirby vulnerable to denial of service from unlimited password lengths (CVSS 5.3, getkirby kirby · getkirby/cms)
- [CVE-2023-38491](https://cve.now/CVE-2023-38491.md): Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files (CVSS 5.7, getkirby kirby · getkirby/cms)
- [CVE-2023-38490](https://cve.now/CVE-2023-38490.md): Kirby XML External Entity (XXE) vulnerability in the XML data handler (CVSS 6.8, getkirby kirby · getkirby/cms)
- [CVE-2023-38489](https://cve.now/CVE-2023-38489.md): Kirby vulnerable to Insufficient Session Expiration after a password change (CVSS 7.3, getkirby kirby · getkirby/cms)
- [CVE-2023-37894](https://cve.now/CVE-2023-37894.md): WordPress Variation Images Gallery for WooCommerce Plugin \<= 2.3.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, RadiusTheme Variation Images Gallery for WooCommerce)
- [CVE-2023-3975](https://cve.now/CVE-2023-3975.md): OS Command Injection in jgraph/drawio (CVSS 8.3, jgraph/drawio)
- [CVE-2023-3974](https://cve.now/CVE-2023-3974.md): OS Command Injection in jgraph/drawio (CVSS 9.6, jgraph/drawio)
- [CVE-2023-3973](https://cve.now/CVE-2023-3973.md): Cross-site Scripting (XSS) - Reflected in jgraph/drawio (CVSS 9.6, jgraph/drawio)
- [CVE-2023-38488](https://cve.now/CVE-2023-38488.md): Kirby vulnerable to field injection in the KirbyData text storage handler (CVSS 7.1, getkirby kirby · getkirby/cms)
- [CVE-2023-37970](https://cve.now/CVE-2023-37970.md): WordPress MF Gig Calendar Plugin \<= 1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Matthew Fries MF Gig Calendar)
- [CVE-2023-37975](https://cve.now/CVE-2023-37975.md): WordPress Variation Swatches for WooCommerce Plugin \<= 2.3.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, RadiusTheme Variation Swatches for WooCommerce)
- [CVE-2023-37976](https://cve.now/CVE-2023-37976.md): WordPress Radio Forge Muses Player with Skins Plugin \<= 2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Radio Forge Muses Player with Skins)
- [CVE-2023-37977](https://cve.now/CVE-2023-37977.md): WordPress WPFunnels Plugin \<= 2.7.16 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WPFunnels Team Drag & Drop Sales Funnel Builder for WordPre…)
- [CVE-2023-37979](https://cve.now/CVE-2023-37979.md): WordPress Ninja Forms Plugin \<= 3.6.25 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Saturday Drive Ninja Forms Contact Form)
- [CVE-2023-37980](https://cve.now/CVE-2023-37980.md): WordPress Custom Field For WP Job Manager Plugin \<= 1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Gravity Master Custom Field For WP Job Manager)
- [CVE-2023-37981](https://cve.now/CVE-2023-37981.md): WordPress Authors List Plugin \<= 2.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WPKube Authors List)
- [CVE-2023-37993](https://cve.now/CVE-2023-37993.md): WordPress wpShopGermany IT-RECHT KANZLEI Plugin \<= 1.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, maennchen1.de wpShopGermany IT-RECHT KANZLEI)
- [CVE-2023-38512](https://cve.now/CVE-2023-38512.md): WordPress WpStream plugin \<= 4.5.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.4, WpStream)
- [CVE-2023-3970](https://cve.now/CVE-2023-3970.md): GZ Scripts Availability Booking Calendar PHP Image cross site scripting (CVSS 3.5, GZ Scripts Availability Booking Calendar PHP)
- [CVE-2023-3969](https://cve.now/CVE-2023-3969.md): GZ Scripts Availability Booking Calendar PHP HTTP POST Request index.php cross site scripting (CVSS 3.5, GZ Scripts Availability Booking Calendar PHP)
- [CVE-2023-3957](https://cve.now/CVE-2023-3957.md): ACF Photo Gallery Field \<= 1.9 - Authenticated (Subscriber+) Arbitrary Usermeta Update (CVSS 4.3, navzme ACF Photo Gallery Field)
- [CVE-2023-3956](https://cve.now/CVE-2023-3956.md): InstaWP Connect \<= 0.0.9.18 - Missing Authorization to Unauthenticated Post/Taxonomy/User Add/Change/Delete, Customizer Setting Change, Plugin Installation/Activation/Deactication via events\_receiver (CVSS 9.8, InstaWP Connect – 1-click WP Staging & Migration)
- [CVE-2023-32450](https://cve.now/CVE-2023-32450.md): Dell Power Manager, Versions 3.3 to 3.14 contains an Improper Access Control vulnerability. (CVSS 6.1, Dell Power Manager)
- [CVE-2023-32443](https://cve.now/CVE-2023-32443.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-38424](https://cve.now/CVE-2023-38424.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-38259](https://cve.now/CVE-2023-38259.md): A logic issue was addressed with improved restrictions. (no CVSS, Apple macOS)
- [CVE-2023-32418](https://cve.now/CVE-2023-32418.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-38595](https://cve.now/CVE-2023-38595.md): The issue was addressed with improved checks. (no CVSS, Apple Safari · Apple tvOS +3)
- [CVE-2023-38258](https://cve.now/CVE-2023-38258.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-38608](https://cve.now/CVE-2023-38608.md): The issue was addressed with additional permissions checks. (no CVSS, Apple macOS)
- [CVE-2023-38425](https://cve.now/CVE-2023-38425.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-32442](https://cve.now/CVE-2023-32442.md): An access issue was addressed with improved access restrictions. (no CVSS, Apple macOS)
- [CVE-2023-38603](https://cve.now/CVE-2023-38603.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-32429](https://cve.now/CVE-2023-32429.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-38136](https://cve.now/CVE-2023-38136.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2023-32393](https://cve.now/CVE-2023-32393.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-38593](https://cve.now/CVE-2023-38593.md): A logic issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-38602](https://cve.now/CVE-2023-38602.md): A permissions issue was addressed with additional restrictions. (no CVSS, Apple macOS)
- [CVE-2023-38565](https://cve.now/CVE-2023-38565.md): A path handling issue was addressed with improved validation. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-38421](https://cve.now/CVE-2023-38421.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-38564](https://cve.now/CVE-2023-38564.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-35993](https://cve.now/CVE-2023-35993.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple tvOS · Apple iOS and iPadOS +2)
- [CVE-2023-38572](https://cve.now/CVE-2023-38572.md): The issue was addressed with improved checks. (no CVSS, Apple Safari · Apple tvOS +3)
- [CVE-2023-32734](https://cve.now/CVE-2023-32734.md): The issue was addressed with improved memory handling. (no CVSS, Apple tvOS · Apple iOS and iPadOS +2)
- [CVE-2023-32364](https://cve.now/CVE-2023-32364.md): A logic issue was addressed with improved restrictions. (no CVSS, Apple macOS)
- [CVE-2023-38600](https://cve.now/CVE-2023-38600.md): The issue was addressed with improved checks. (CVSS 8.8, Apple Safari · Apple tvOS +3)
- [CVE-2023-38261](https://cve.now/CVE-2023-38261.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-32441](https://cve.now/CVE-2023-32441.md): The issue was addressed with improved memory handling. (no CVSS, Apple tvOS · Apple iOS and iPadOS +2)
- [CVE-2023-32416](https://cve.now/CVE-2023-32416.md): A logic issue was addressed with improved restrictions. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-38611](https://cve.now/CVE-2023-38611.md): The issue was addressed with improved memory handling. (no CVSS, Apple Safari · Apple tvOS +3)
- [CVE-2023-38580](https://cve.now/CVE-2023-38580.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2020-22623](https://cve.now/CVE-2020-22623.md): Directory traversal vulnerability in Jinfornet Jreport 15.6 allows unauthenticated attackers to gain sensitive information. (no CVSS)
- [CVE-2021-36580](https://cve.now/CVE-2021-36580.md): Open Redirect vulnerability exists in IceWarp MailServer IceWarp Server Deep Castle 2 Update 1 (13.0.1.2) via the referer parameter. (no CVSS)
- [CVE-2022-31200](https://cve.now/CVE-2022-31200.md): Atmail 5.62 allows XSS via the mail/parse.php?file=html/$this-%3ELanguage/help/filexp.html&FirstLoad=1&HelpFile=file.html Search Terms field (no CVSS)
- [CVE-2023-33742](https://cve.now/CVE-2023-33742.md): TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Cleartext Storage of Sensitive Information: RSA private key in Update.exe. (no CVSS)
- [CVE-2023-33743](https://cve.now/CVE-2023-33743.md): TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Access Control; specifically, Android Debug Bridge (adb) is available. (no CVSS)
- [CVE-2023-33744](https://cve.now/CVE-2023-33744.md): TeleAdapt RoomCast TA-2400 1.0 through 3.1 suffers from Use of a Hard-coded Password (PIN): 385521, 843646, and 592671. (no CVSS)
- [CVE-2023-33745](https://cve.now/CVE-2023-33745.md): TeleAdapt RoomCast TA-2400 1.0 through 3.1 is vulnerable to Improper Privilege Management: from the shell available after an adb connection, (no CVSS)
- [CVE-2023-36941](https://cve.now/CVE-2023-36941.md): A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute ar (no CVSS)
- [CVE-2023-36942](https://cve.now/CVE-2023-36942.md): A cross-site scripting (XSS) vulnerability in PHPGurukul Online Fire Reporting System Using PHP and MySQL 1.2 allows attackers to execute ar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.