CVEs published July 31, 2023
63 CVEs were published on July 31, 2023: 1 critical, 12 high. 1 is now in CISA KEV.
- Published
- 63
- Critical
- 1
- High
- 12
- Medium
- 13
- Low
- 1
- Unrated
- 36
- Now in CISA KEV
- 1
- Fix available
- 13
Most affected products
- ASUS RT-AX88U
- 3
- IBM B2B Advanced Communications · IBM Multi-Enterprise Inte…
- 2
- IBM Security Verify Governance, Identity Manager
- 2
- thorsten/phpmyfaq
- 2
- WooCommerce Pre-Orders
- 2
- Advantech iView
- 1
- Checkout Fields Manager · Abandoned Cart Recovery +11
- 1
- Forminator
- 1
- fossbilling/fossbilling
- 1
- grid-kit-premium
- 1
Critical 1
High 12
- CVE-2023-3825 PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled resPTC KEPServerEX
- CVE-2023-4004Kernel: netfilter: use-after-free due to improper element removal in nft_pipapo_remove()Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…
- CVE-2023-3997Unauthenticated Log Injection In Splunk SOARSplunk SOAR
- CVE-2023-34360ASUS RT-AX88U - Stored XSSASUS RT-AX88U
- CVE-2023-34359ASUS RT-AX88U - Out-of-bounds Read - 2ASUS RT-AX88U
- CVE-2023-34358ASUS RT-AX88U - Out-of-bounds Read - 1ASUS RT-AX88U
- CVE-2023-24971IBM B2B Advanced Communication denial of serviceIBM B2B Advanced Communications · IBM Multi-Enterprise Inte…
- CVE-2022-43831IBM Spectrum Scale privilege escalationIBM Storage Scale Container Native Storage Access
- CVE-2023-35019IBM Security Verify Governance command executionIBM Security Verify Governance, Identity Manager
- CVE-2023-4007Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-4006Improper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-36092Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi_main.
Medium, low and unrated 50
- CVE-2023-3462Vault's LDAP Auth Method Allows for User EnumerationHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-3817Excessive time spent checking DH q parameter valueOpenSSL
- CVE-2023-3508WooCommerce Pre-Orders < 2.0.3 - Unauthorised Actions via CSRFWooCommerce Pre-Orders
- CVE-2023-3507WooCommerce Pre-Orders < 2.0.3 - Arbitrary Pre-Order Canceling via CSRFWooCommerce Pre-Orders
- CVE-2023-3345LMS by Masteriyo < 1.6.8 - Information ExposureLMS by Masteriyo
- CVE-2023-3292Grid Kit Premium < 2.2.0 - Multiple Reflected Cross-Site Scriptinggrid-kit-premium
- CVE-2023-3134Forminator < 1.24.4 - Reflected XSSForminator
- CVE-2023-3130Short URL < 1.6.5 - Admin+ Cross Site ScriptingShort URL
- CVE-2023-0602Twittee Text Tweet <= 1.0.8 - Reflected XSSTwittee Text Tweet
- CVE-2022-4888Multiple Plugins from Addify - Multiple CSRFCheckout Fields Manager · Abandoned Cart Recovery +11
- CVE-2020-4868IBM TRIRIGA information disclosureIBM TRIRIGA Application Platform
- CVE-2023-22595IBM B2B Advanced Communication cross-site scriptingIBM B2B Advanced Communications · IBM Multi-Enterprise Inte…
- CVE-2023-35016IBM Security Verify Governance path traversalIBM Security Verify Governance, Identity Manager
- CVE-2023-4005Insufficient Session Expiration in fossbilling/fossbillingfossbilling/fossbilling
- CVE-2020-21662SQL injection vulnerability in yunyecms 2.0.2 allows remote attackers to run arbitrary SQL commands via XFF.
- CVE-2020-21881Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify application data via article/a
- CVE-2020-36763Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom paramet
- CVE-2021-31651Cross Site Scripting (XSS) vulnerability in neofarg-cms 0.2.3 allows remoate attacker to run arbitrary code via the copyright field in copyr
- CVE-2021-31680Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml file.
- CVE-2021-31681Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file.
- CVE-2022-42182Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Directory Traversal.
- CVE-2022-42183Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF).
- CVE-2023-33534A Cross-Site Request Forgery (CSRF) in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G_3.11.6 allows attackers t
- CVE-2023-34635Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection.
- CVE-2023-34644Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW_3.0(1)B11P204, RG-NBS and RG-S193
- CVE-2023-34842Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /de
- CVE-2023-34872A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted
- CVE-2023-34916Fuge CMS v1.0 contains an Open Redirect vulnerability via /front/ProcessAct.java.
- CVE-2023-34917Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java.
- CVE-2023-35791Vound Intella Connect 2.6.0.3 has an Open Redirect vulnerability.
- CVE-2023-35792Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS).
- CVE-2023-35861A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers
- CVE-2023-36089Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via functio
- CVE-2023-36090Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi.
- CVE-2023-37580Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.
- CVE-2023-37647SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant_Suxin.php.
- CVE-2023-37771Art Gallery Management System v1.0 contains a SQL injection vulnerability via the cid parameter at /agms/product.php.
- CVE-2023-38303An issue was discovered in Webmin 2.021.
- CVE-2023-38304An issue was discovered in Webmin 2.021.
- CVE-2023-38305An issue was discovered in Webmin 2.021.
- CVE-2023-38306An issue was discovered in Webmin 2.021.
- CVE-2023-38307An issue was discovered in Webmin 2.021.
- CVE-2023-38308An issue was discovered in Webmin 2.021.
- CVE-2023-38309An issue was discovered in Webmin 2.021.
- CVE-2023-38310An issue was discovered in Webmin 2.021.
- CVE-2023-38311An issue was discovered in Webmin 2.021.
- CVE-2023-38750In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exp
- CVE-2023-38989An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Admin
- CVE-2023-39122BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter.
- CVE-2023-3983An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752.Advantech iView