# CVEs published 2023-07-28

90 CVEs were published on July 28, 2023: 1 critical, 8 high. Days are UTC.

- [CVE-2023-2314](https://cve.now/CVE-2023-2314.md): Insufficient data validation in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation restrictions (no CVSS, Google Chrome)
- [CVE-2023-2313](https://cve.now/CVE-2023-2313.md): Inappropriate implementation in Sandbox in Google Chrome on Windows prior to 112.0.5615.49 allowed a remote attacker who had compromised the (no CVSS, Google Chrome)
- [CVE-2023-2311](https://cve.now/CVE-2023-2311.md): Insufficient policy enforcement in File System API in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass filesystem re (no CVSS, Google Chrome)
- [CVE-2022-4926](https://cve.now/CVE-2022-4926.md): Insufficient policy enforcement in Intents in Google Chrome on Android prior to 109.0.5414.119 allowed a remote attacker to bypass same orig (CVSS 6.5, Google Chrome)
- [CVE-2021-4324](https://cve.now/CVE-2021-4324.md): Insufficient policy enforcement in Google Update in Google Chrome prior to 90.0.4430.93 allowed a remote attacker to read arbitrary files vi (no CVSS, Google Chrome)
- [CVE-2021-4323](https://cve.now/CVE-2021-4323.md): Insufficient validation of untrusted input in Extensions in Google Chrome prior to 90.0.4430.72 allowed an attacker who convinced a user to (no CVSS, Google Chrome)
- [CVE-2021-4322](https://cve.now/CVE-2021-4322.md): Use after free in DevTools in Google Chrome prior to 91.0.4472.77 allowed an attacker who convinced a user to install a malicious extension (CVSS 8.8, Google Chrome)
- [CVE-2021-4321](https://cve.now/CVE-2021-4321.md): Policy bypass in Blink in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass content security policy via a crafted HTML (no CVSS, Google Chrome)
- [CVE-2021-4320](https://cve.now/CVE-2021-4320.md): Use after free in Blink in Google Chrome prior to 92.0.4515.107 allowed a remote attacker who had compromised the renderer process to perfor (no CVSS, Google Chrome)
- [CVE-2021-4319](https://cve.now/CVE-2021-4319.md): Use after free in Blink in Google Chrome prior to 93.0.4577.82 allowed a remote attacker to perform arbitrary read/write via a crafted HTML (no CVSS, Google Chrome)
- [CVE-2021-4318](https://cve.now/CVE-2021-4318.md): Object corruption in Blink in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to potentially exploit object corruption via a c (no CVSS, Google Chrome)
- [CVE-2021-4317](https://cve.now/CVE-2021-4317.md): Use after free in ANGLE in Google Chrome prior to 96.0.4664.93 allowed a remote attacker to perform arbitrary read/write via a crafted HTML (no CVSS, Google Chrome)
- [CVE-2021-4316](https://cve.now/CVE-2021-4316.md): Inappropriate implementation in Cast UI in Google Chrome prior to 96.0.4664.45 allowed a remote attacker to spoof browser UI via a crafted H (no CVSS, Google Chrome)
- [CVE-2022-4925](https://cve.now/CVE-2022-4925.md): Insufficient validation of untrusted input in QUIC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to perform header splitt (no CVSS, Google Chrome)
- [CVE-2022-4924](https://cve.now/CVE-2022-4924.md): Use after free in WebRTC in Google Chrome prior to 97.0.4692.71 allowed a remote attacker who had compromised the renderer process to potent (no CVSS, Google Chrome)
- [CVE-2022-4923](https://cve.now/CVE-2022-4923.md): Inappropriate implementation in Omnibox in Google Chrome prior to 99.0.4844.51 allowed an attacker in a privileged network position to perfo (no CVSS, Google Chrome)
- [CVE-2022-4922](https://cve.now/CVE-2022-4922.md): Inappropriate implementation in Blink in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to perform UI spoofing via a crafted (no CVSS, Google Chrome)
- [CVE-2022-4921](https://cve.now/CVE-2022-4921.md): Use after free in Accessibility in Google Chrome prior to 99.0.4844.51 allowed a remote attacker who convinced a user to engage in specific (CVSS 8.8, Google Chrome)
- [CVE-2022-4920](https://cve.now/CVE-2022-4920.md): Heap buffer overflow in Blink in Google Chrome prior to 101.0.4951.41 allowed a remote attacker who convinced a user to engage in specific U (CVSS 9.6, Google Chrome)
- [CVE-2022-4919](https://cve.now/CVE-2022-4919.md): Use after free in Base Internals in Google Chrome prior to 101.0.4951.41 allowed a remote attacker to perform arbitrary read/write via a cra (CVSS 8.8, Google Chrome)
- [CVE-2022-4918](https://cve.now/CVE-2022-4918.md): Use after free in UI in Google Chrome prior to 102.0.5005.61 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pa (CVSS 8.8, Google Chrome)
- [CVE-2022-4917](https://cve.now/CVE-2022-4917.md): Incorrect security UI in Notifications in Google Chrome on Android prior to 103.0.5060.53 allowed a remote attacker to obscure the full scre (CVSS 4.3, Google Chrome)
- [CVE-2022-4916](https://cve.now/CVE-2022-4916.md): Use after free in Media in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to perform arbitrary read/write via a crafted HTML (CVSS 8.8, Google Chrome)
- [CVE-2022-4915](https://cve.now/CVE-2022-4915.md): Inappropriate implementation in URL Formatting in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to perform domain spoofing (no CVSS, Google Chrome)
- [CVE-2022-4914](https://cve.now/CVE-2022-4914.md): Heap buffer overflow in PrintPreview in Google Chrome prior to 104.0.5112.79 allowed an attacker who convinced a user to install a malicious (no CVSS, Google Chrome)
- [CVE-2022-4913](https://cve.now/CVE-2022-4913.md): Inappropriate implementation in Extensions in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the rendere (no CVSS, Google Chrome)
- [CVE-2022-4912](https://cve.now/CVE-2022-4912.md): Type Confusion in MathML in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2022-4911](https://cve.now/CVE-2022-4911.md): Insufficient data validation in DevTools in Google Chrome prior to 106.0.5249.62 allowed a remote attacker to bypass content security policy (no CVSS, Google Chrome)
- [CVE-2022-4910](https://cve.now/CVE-2022-4910.md): Inappropriate implementation in Autofill in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to bypass navigation restrictions (no CVSS, Google Chrome)
- [CVE-2022-4909](https://cve.now/CVE-2022-4909.md): Inappropriate implementation in XML in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially perform an ASLR bypass (no CVSS, Google Chrome)
- [CVE-2022-4908](https://cve.now/CVE-2022-4908.md): Inappropriate implementation in iFrame Sandbox in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to leak cross-origin data v (no CVSS, Google Chrome)
- [CVE-2022-4907](https://cve.now/CVE-2022-4907.md): Uninitialized Use in FFmpeg in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to execute arbitrary code inside a sandbox via (no CVSS, Google Chrome)
- [CVE-2022-4906](https://cve.now/CVE-2022-4906.md): Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to perform arbitrary read/write via (no CVSS, Google Chrome)
- [CVE-2023-3598](https://cve.now/CVE-2023-3598.md): Out of bounds read and write in ANGLE in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corrupti (no CVSS, Google Chrome)
- [CVE-2023-3488](https://cve.now/CVE-2023-3488.md): Uninitialized variable in Gecko Bootloader can leak secure stack (CVSS 3.8, silabs.com Gecko Bootloader)
- [CVE-2023-38685](https://cve.now/CVE-2023-38685.md): Discourse's restricted tag information visible to unauthenticated users (CVSS 4.3, discourse)
- [CVE-2023-38684](https://cve.now/CVE-2023-38684.md): Discourse vulnerable to ossible DDoS due to unbounded limits in various controller actions (CVSS 5.3, discourse)
- [CVE-2023-38498](https://cve.now/CVE-2023-38498.md): Discourse vulnerable to DoS via defer queue (CVSS 4.3, discourse)
- [CVE-2023-37906](https://cve.now/CVE-2023-37906.md): Discourse vulnerable to DoS via post edit reason (CVSS 4.3, discourse)
- [CVE-2023-37904](https://cve.now/CVE-2023-37904.md): Discourse Race Condition in Accept Invite (CVSS 2.6, discourse)
- [CVE-2023-37467](https://cve.now/CVE-2023-37467.md): Discourse CSP nonce reuse vulnerability for anonymous users (CVSS 6.8, discourse)
- [CVE-2023-2685](https://cve.now/CVE-2023-2685.md): Unquoted Service Path in ABB AO-OPC (CVSS 7.2, ABB AO-OPC)
- [CVE-2023-3670](https://cve.now/CVE-2023-3670.md): Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting (CVSS 7.3, CODESYS Development System · CODESYS Scripting)
- [CVE-2023-3990](https://cve.now/CVE-2023-3990.md): Mingsoft MCMS HTTP POST Request search.do cross site scripting (CVSS 3.5, Mingsoft MCMS · net.mingsoft:ms-mcms)
- [CVE-2023-3989](https://cve.now/CVE-2023-3989.md): SourceCodester Jewelry Store System add\_customer.php cross site scripting (CVSS 3.5, SourceCodester Jewelry Store System)
- [CVE-2023-3988](https://cve.now/CVE-2023-3988.md): Cafe Billing System Order index.php sql injection (CVSS 6.3, Cafe Billing System)
- [CVE-2023-3987](https://cve.now/CVE-2023-3987.md): SourceCodester Simple Online Mens Salon Management System sql injection (CVSS 6.3, SourceCodester Simple Online Mens Salon Management System)
- [CVE-2023-3986](https://cve.now/CVE-2023-3986.md): SourceCodester Simple Online Mens Salon Management System cross site scripting (CVSS 2.4, SourceCodester Simple Online Mens Salon Management System)
- [CVE-2023-0958](https://cve.now/CVE-2023-0958.md): Inisev Plugins (Various Versions) - Missing Authorization on handle\_installation function (CVSS 4.3, inisev Redirection · inisev Pop-up +9)
- [CVE-2023-3977](https://cve.now/CVE-2023-3977.md): Inisev Plugins (Various Versions) - Cross-Site Request Forgery on handle\_installation function (CVSS 4.3, inisev Redirection · inisev Pop-up +9)
- [CVE-2023-3985](https://cve.now/CVE-2023-3985.md): SourceCodester Online Jewelry Store login.php sql injection (CVSS 7.3, SourceCodester Online Jewelry Store)
- [CVE-2023-37285](https://cve.now/CVE-2023-37285.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-32654](https://cve.now/CVE-2023-32654.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-38609](https://cve.now/CVE-2023-38609.md): An injection issue was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-38598](https://cve.now/CVE-2023-38598.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple tvOS · Apple iOS and iPadOS +2)
- [CVE-2023-28203](https://cve.now/CVE-2023-28203.md): The issue was addressed with improved checks. (CVSS 5.5, Apple Music for Android)
- [CVE-2023-38604](https://cve.now/CVE-2023-38604.md): An out-of-bounds write issue was addressed with improved input validation. (no CVSS, Apple tvOS · Apple iOS and iPadOS +2)
- [CVE-2023-38599](https://cve.now/CVE-2023-38599.md): A logic issue was addressed with improved state management. (no CVSS, Apple Safari · Apple tvOS +3)
- [CVE-2023-36495](https://cve.now/CVE-2023-36495.md): An integer overflow was addressed with improved input validation. (no CVSS, Apple tvOS · Apple iOS and iPadOS +2)
- [CVE-2023-38592](https://cve.now/CVE-2023-38592.md): A logic issue was addressed with improved restrictions. (no CVSS, Apple tvOS · Apple iOS and iPadOS +2)
- [CVE-2023-32445](https://cve.now/CVE-2023-32445.md): This issue was addressed with improved checks. (no CVSS, Apple Safari · Apple tvOS +3)
- [CVE-2023-38571](https://cve.now/CVE-2023-38571.md): This issue was addressed with improved validation of symlinks. (no CVSS, Apple macOS)
- [CVE-2023-32444](https://cve.now/CVE-2023-32444.md): A logic issue was addressed with improved validation. (no CVSS, Apple macOS)
- [CVE-2023-38590](https://cve.now/CVE-2023-38590.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple tvOS · Apple iOS and iPadOS +2)
- [CVE-2023-38601](https://cve.now/CVE-2023-38601.md): This issue was addressed by removing the vulnerable code. (no CVSS, Apple macOS)
- [CVE-2023-32427](https://cve.now/CVE-2023-32427.md): This issue was addressed by using HTTPS when sending information over the network. (no CVSS, Apple Music for Android)
- [CVE-2023-34425](https://cve.now/CVE-2023-34425.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-3984](https://cve.now/CVE-2023-3984.md): phpscriptpoint RecipePoint recipe-result sql injection (CVSS 6.3, phpscriptpoint RecipePoint)
- [CVE-2023-3774](https://cve.now/CVE-2023-3774.md): Vault Enterprise Namespace Creation May Lead to Denial of Service (CVSS 4.9, HashiCorp Vault Enterprise)
- [CVE-2022-31454](https://cve.now/CVE-2022-31454.md): Yii 2 v2.0.45 was discovered to contain a cross-site scripting (XSS) vulnerability via the endpoint /books. (no CVSS)
- [CVE-2023-31932](https://cve.now/CVE-2023-31932.md): Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid par (no CVSS)
- [CVE-2023-31933](https://cve.now/CVE-2023-31933.md): Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid par (no CVSS)
- [CVE-2023-31934](https://cve.now/CVE-2023-31934.md): Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via t (no CVSS)
- [CVE-2023-31935](https://cve.now/CVE-2023-31935.md): Cross Site Scripting vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to obtain sensitive information via t (no CVSS)
- [CVE-2023-31936](https://cve.now/CVE-2023-31936.md): Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the viewid par (no CVSS)
- [CVE-2023-31937](https://cve.now/CVE-2023-31937.md): Sql injection vulnerability found in Rail Pass Management System v.1.0 allows a remote attacker to execute arbitrary code via the editid par (no CVSS)
- [CVE-2023-37754](https://cve.now/CVE-2023-37754.md): PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail. (no CVSS, tech.powerjob:powerjob-common)
- [CVE-2023-38331](https://cve.now/CVE-2023-38331.md): Zoho ManageEngine Support Center Plus 14001 and below is vulnerable to stored XSS in the products module. (no CVSS)
- [CVE-2023-38988](https://cve.now/CVE-2023-38988.md): An issue in the delete function in the OaNotifyController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete notif (no CVSS)
- [CVE-2023-38992](https://cve.now/CVE-2023-38992.md): jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData. (no CVSS, org.jeecgframework.boot:jeecg-boot-common)
- [CVE-2023-39010](https://cve.now/CVE-2023-39010.md): BoofCV 0.42 was discovered to contain a code injection vulnerability via the component boofcv.io.calibration.CalibrationIO.load. (no CVSS, org.boofcv:boofcv-core)
- [CVE-2023-39013](https://cve.now/CVE-2023-39013.md): Duke v1.2 and below was discovered to contain a code injection vulnerability via the component no.priv.garshol.duke.server.CommonJTimer.init (no CVSS, no.priv.garshol.duke:duke)
- [CVE-2023-39015](https://cve.now/CVE-2023-39015.md): webmagic-extension v0.9.0 and below was discovered to contain a code injection vulnerability via the component us.codecraft.webmagic.downloa (no CVSS, us.codecraft:webmagic-core)
- [CVE-2023-39016](https://cve.now/CVE-2023-39016.md): bboss-persistent v6.0.9 and below was discovered to contain a code injection vulnerability in the component com.frameworkset.common.poolman. (no CVSS)
- [CVE-2023-39017](https://cve.now/CVE-2023-39017.md): quartz-jobs 2.3.2 and below was discovered to contain a code injection vulnerability in the component org.quartz.jobs.ee.jms.SendQueueMessag (no CVSS)
- [CVE-2023-39018](https://cve.now/CVE-2023-39018.md): FFmpeg 0.7.0 and below was discovered to contain a code injection vulnerability in the component net.bramp.ffmpeg.FFmpeg.\<constructor\>. (no CVSS)
- [CVE-2023-39020](https://cve.now/CVE-2023-39020.md): stanford-parser v3.9.2 and below was discovered to contain a code injection vulnerability in the component edu.stanford.nlp.io.getBZip2Piped (no CVSS, edu.stanford.nlp:stanford-parser)
- [CVE-2023-39021](https://cve.now/CVE-2023-39021.md): wix-embedded-mysql v4.6.1 and below was discovered to contain a code injection vulnerability in the component com.wix.mysql.distribution.Set (no CVSS, com.wix:wix-embedded-mysql)
- [CVE-2023-39022](https://cve.now/CVE-2023-39022.md): oscore v2.2.6 and below was discovered to contain a code injection vulnerability in the component com.opensymphony.util.EJBUtils.createState (no CVSS, opensymphony:oscore)
- [CVE-2023-39023](https://cve.now/CVE-2023-39023.md): university compass v2.2.0 and below was discovered to contain a code injection vulnerability in the component org.compass.core.executor.Defa (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.