CVEs published July 28, 2023
90 CVEs were published on July 28, 2023: 1 critical, 8 high.
- Published
- 90
- Critical
- 1
- High
- 8
- Medium
- 14
- Low
- 5
- Unrated
- 62
- Now in CISA KEV
- 0
- Fix available
- 62
Most affected products
- Google Chrome
- 34
- discourse
- 6
- Apple macOS
- 5
- Apple tvOS · Apple iOS and iPadOS +2
- 5
- Apple Music for Android
- 2
- Apple Safari · Apple tvOS +3
- 2
- inisev Redirection · inisev Pop-up +9
- 2
- SourceCodester Simple Online Mens Salon Management System
- 2
- ABB AO-OPC
- 1
- Apple iOS and iPadOS · Apple macOS +1
- 1
Critical 1
High 8
- CVE-2021-4322Use after free in DevTools in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension Google Chrome
- CVE-2022-4921Use after free in Accessibility in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific Google Chrome
- CVE-2022-4919Use after free in Base Internals in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to perform arbitrary read/write via a craGoogle Chrome
- CVE-2022-4918Use after free in UI in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform arbitrary read/write via a crafted HTML paGoogle Chrome
- CVE-2022-4916Use after free in Media in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform arbitrary read/write via a crafted HTMLGoogle Chrome
- CVE-2023-2685Unquoted Service Path in ABB AO-OPCABB AO-OPC
- CVE-2023-3670Codesys: Vulnerability in CODESYS Development System and CODESYS ScriptingCODESYS Development System · CODESYS Scripting
- CVE-2023-3985SourceCodester Online Jewelry Store login.php sql injectionSourceCodester Online Jewelry Store
Medium, low and unrated 81
- CVE-2023-2314Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictionsGoogle Chrome
- CVE-2023-2313Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker who had compromised theGoogle Chrome
- CVE-2023-2311Insufficient policy enforcement in File System API in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass filesystem reGoogle Chrome
- CVE-2022-4926Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacker to bypass same origGoogle Chrome
- CVE-2021-4324Insufficient policy enforcement in Google Update in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to read arbitrary files viGoogle Chrome
- CVE-2021-4323Insufficient validation of untrusted input in Extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to Google Chrome
- CVE-2021-4321Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTMLGoogle Chrome
- CVE-2021-4320Use after free in Blink in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to perforGoogle Chrome
- CVE-2021-4319Use after free in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to perform arbitrary read/write via a crafted HTML Google Chrome
- CVE-2021-4318Object corruption in Blink in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit object corruption via a cGoogle Chrome
- CVE-2021-4317Use after free in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform arbitrary read/write via a crafted HTML Google Chrome
- CVE-2021-4316Inappropriate implementation in Cast UI in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to spoof browser UI via a crafted HGoogle Chrome
- CVE-2022-4925Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header splittGoogle Chrome
- CVE-2022-4924Use after free in WebRTC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who had compromised the renderer process to potentGoogle Chrome
- CVE-2022-4923Inappropriate implementation in Omnibox in Google Chrome prior to 99.0.4844.51 allowed an attacker in a privileged network position to perfoGoogle Chrome
- CVE-2022-4922Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform UI spoofing via a crafted Google Chrome
- CVE-2022-4917Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full screGoogle Chrome
- CVE-2022-4915Inappropriate implementation in URL Formatting in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to perform domain spoofingGoogle Chrome
- CVE-2022-4914Heap buffer overflow in PrintPreview in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a maliciousGoogle Chrome
- CVE-2022-4913Inappropriate implementation in Extensions in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the rendereGoogle Chrome
- CVE-2022-4912Type Confusion in MathML in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2022-4911Insufficient data validation in DevTools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass content security policyGoogle Chrome
- CVE-2022-4910Inappropriate implementation in Autofill in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass navigation restrictionsGoogle Chrome
- CVE-2022-4909Inappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially perform an ASLR bypass Google Chrome
- CVE-2022-4908Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to leak cross-origin data vGoogle Chrome
- CVE-2022-4907Uninitialized Use in FFmpeg in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to execute arbitrary code inside a sandbox viaGoogle Chrome
- CVE-2022-4906Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to perform arbitrary read/write via Google Chrome
- CVE-2023-3598Out of bounds read and write in ANGLE in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruptiGoogle Chrome
- CVE-2023-3488Uninitialized variable in Gecko Bootloader can leak secure stacksilabs.com Gecko Bootloader
- CVE-2023-38685Discourse's restricted tag information visible to unauthenticated usersdiscourse
- CVE-2023-38684Discourse vulnerable to ossible DDoS due to unbounded limits in various controller actionsdiscourse
- CVE-2023-38498Discourse vulnerable to DoS via defer queuediscourse
- CVE-2023-37906Discourse vulnerable to DoS via post edit reasondiscourse
- CVE-2023-37904Discourse Race Condition in Accept Invitediscourse
- CVE-2023-37467Discourse CSP nonce reuse vulnerability for anonymous usersdiscourse
- CVE-2023-3990Mingsoft MCMS HTTP POST Request search.do cross site scriptingMingsoft MCMS · net.mingsoft:ms-mcms
- CVE-2023-3989SourceCodester Jewelry Store System add_customer.php cross site scriptingSourceCodester Jewelry Store System
- CVE-2023-3988Cafe Billing System Order index.php sql injectionCafe Billing System
- CVE-2023-3987SourceCodester Simple Online Mens Salon Management System sql injectionSourceCodester Simple Online Mens Salon Management System
- CVE-2023-3986SourceCodester Simple Online Mens Salon Management System cross site scriptingSourceCodester Simple Online Mens Salon Management System
- CVE-2023-0958Inisev Plugins (Various Versions) - Missing Authorization on handle_installation functioninisev Redirection · inisev Pop-up +9
- CVE-2023-3977Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle_installation functioninisev Redirection · inisev Pop-up +9
- CVE-2023-37285An out-of-bounds read was addressed with improved bounds checking.Apple macOS · Apple iOS and iPadOS
- CVE-2023-32654A logic issue was addressed with improved state management.Apple macOS
- CVE-2023-38609An injection issue was addressed with improved input validation.Apple macOS
- CVE-2023-38598A use-after-free issue was addressed with improved memory management.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-28203The issue was addressed with improved checks.Apple Music for Android
- CVE-2023-38604An out-of-bounds write issue was addressed with improved input validation.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-38599A logic issue was addressed with improved state management.Apple Safari · Apple tvOS +3
- CVE-2023-36495An integer overflow was addressed with improved input validation.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-38592A logic issue was addressed with improved restrictions.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-32445This issue was addressed with improved checks.Apple Safari · Apple tvOS +3
- CVE-2023-38571This issue was addressed with improved validation of symlinks.Apple macOS
- CVE-2023-32444A logic issue was addressed with improved validation.Apple macOS
- CVE-2023-38590A buffer overflow issue was addressed with improved memory handling.Apple tvOS · Apple iOS and iPadOS +2
- CVE-2023-38601This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2023-32427This issue was addressed by using HTTPS when sending information over the network.Apple Music for Android
- CVE-2023-34425The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-3984phpscriptpoint RecipePoint recipe-result sql injectionphpscriptpoint RecipePoint
- CVE-2023-3774Vault Enterprise Namespace Creation May Lead to Denial of ServiceHashiCorp Vault Enterprise
- CVE-2022-31454Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books.
- CVE-2023-31932Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid par
- CVE-2023-31933Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid par
- CVE-2023-31934Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via t
- CVE-2023-31935Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via t
- CVE-2023-31936Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid par
- CVE-2023-31937Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid par
- CVE-2023-37754PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.tech.powerjob:powerjob-common
- CVE-2023-38331Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module.
- CVE-2023-38988An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notif
- CVE-2023-38992jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-39010BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load.org.boofcv:boofcv-core
- CVE-2023-39013Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.initno.priv.garshol.duke:duke
- CVE-2023-39015webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloaus.codecraft:webmagic-core
- CVE-2023-39016bboss-persistent v6.0.9 and below was discovered to contain a code injection vulnerability in the component com.frameworkset.common.poolman.
- CVE-2023-39017quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessag
- CVE-2023-39018FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.<constructor>.
- CVE-2023-39020stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2Pipededu.stanford.nlp:stanford-parser
- CVE-2023-39021wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Setcom.wix:wix-embedded-mysql
- CVE-2023-39022oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createStateopensymphony:oscore
- CVE-2023-39023university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.Defa