# CVEs published 2023-07-31

63 CVEs were published on July 31, 2023: 1 critical, 12 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-3825](https://cve.now/CVE-2023-3825.md): PTC’s KEPServerEX Versions 6.0 to 6.14.263 are vulnerable to being made to read a recursively defined object that leads to uncontrolled res (CVSS 7.5, PTC KEPServerEX)
- [CVE-2023-3462](https://cve.now/CVE-2023-3462.md): Vault's LDAP Auth Method Allows for User Enumeration (CVSS 5.3, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2023-4004](https://cve.now/CVE-2023-4004.md): Kernel: netfilter: use-after-free due to improper element removal in nft\_pipapo\_remove() (CVSS 7.8, Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…)
- [CVE-2023-3997](https://cve.now/CVE-2023-3997.md): Unauthenticated Log Injection In Splunk SOAR (CVSS 8.6, Splunk SOAR)
- [CVE-2023-3817](https://cve.now/CVE-2023-3817.md): Excessive time spent checking DH q parameter value (CVSS 5.3, OpenSSL)
- [CVE-2023-3508](https://cve.now/CVE-2023-3508.md): WooCommerce Pre-Orders \< 2.0.3 - Unauthorised Actions via CSRF (CVSS 6.5, WooCommerce Pre-Orders)
- [CVE-2023-3507](https://cve.now/CVE-2023-3507.md): WooCommerce Pre-Orders \< 2.0.3 - Arbitrary Pre-Order Canceling via CSRF (CVSS 6.5, WooCommerce Pre-Orders)
- [CVE-2023-3345](https://cve.now/CVE-2023-3345.md): LMS by Masteriyo \< 1.6.8 - Information Exposure (no CVSS, LMS by Masteriyo)
- [CVE-2023-3292](https://cve.now/CVE-2023-3292.md): Grid Kit Premium \< 2.2.0 - Multiple Reflected Cross-Site Scripting (CVSS 6.1, grid-kit-premium)
- [CVE-2023-3134](https://cve.now/CVE-2023-3134.md): Forminator \< 1.24.4 - Reflected XSS (no CVSS, Forminator)
- [CVE-2023-3130](https://cve.now/CVE-2023-3130.md): Short URL \< 1.6.5 - Admin+ Cross Site Scripting (no CVSS, Short URL)
- [CVE-2023-0602](https://cve.now/CVE-2023-0602.md): Twittee Text Tweet \<= 1.0.8 - Reflected XSS (no CVSS, Twittee Text Tweet)
- [CVE-2022-4888](https://cve.now/CVE-2022-4888.md): Multiple Plugins from Addify - Multiple CSRF (CVSS 6.5, Checkout Fields Manager · Abandoned Cart Recovery +11)
- [CVE-2023-34360](https://cve.now/CVE-2023-34360.md): ASUS RT-AX88U - Stored XSS (CVSS 8.2, ASUS RT-AX88U)
- [CVE-2023-34359](https://cve.now/CVE-2023-34359.md): ASUS RT-AX88U - Out-of-bounds Read - 2 (CVSS 7.5, ASUS RT-AX88U)
- [CVE-2023-34358](https://cve.now/CVE-2023-34358.md): ASUS RT-AX88U - Out-of-bounds Read - 1 (CVSS 7.5, ASUS RT-AX88U)
- [CVE-2020-4868](https://cve.now/CVE-2020-4868.md): IBM TRIRIGA information disclosure (CVSS 4.3, IBM TRIRIGA Application Platform)
- [CVE-2023-24971](https://cve.now/CVE-2023-24971.md): IBM B2B Advanced Communication denial of service (CVSS 7.5, IBM B2B Advanced Communications · IBM Multi-Enterprise Inte…)
- [CVE-2023-22595](https://cve.now/CVE-2023-22595.md): IBM B2B Advanced Communication cross-site scripting (CVSS 5.4, IBM B2B Advanced Communications · IBM Multi-Enterprise Inte…)
- [CVE-2022-43831](https://cve.now/CVE-2022-43831.md): IBM Spectrum Scale privilege escalation (CVSS 7.4, IBM Storage Scale Container Native Storage Access)
- [CVE-2023-35016](https://cve.now/CVE-2023-35016.md): IBM Security Verify Governance path traversal (CVSS 6.5, IBM Security Verify Governance, Identity Manager)
- [CVE-2023-35019](https://cve.now/CVE-2023-35019.md): IBM Security Verify Governance command execution (CVSS 7.2, IBM Security Verify Governance, Identity Manager)
- [CVE-2023-4007](https://cve.now/CVE-2023-4007.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.8, thorsten/phpmyfaq)
- [CVE-2023-4006](https://cve.now/CVE-2023-4006.md): Improper Neutralization of Formula Elements in a CSV File in thorsten/phpmyfaq (CVSS 8.8, thorsten/phpmyfaq)
- [CVE-2023-4005](https://cve.now/CVE-2023-4005.md): Insufficient Session Expiration in fossbilling/fossbilling (CVSS 3.8, fossbilling/fossbilling)
- [CVE-2020-21662](https://cve.now/CVE-2020-21662.md): SQL injection vulnerability in yunyecms 2.0.2 allows remote attackers to run arbitrary SQL commands via XFF. (no CVSS)
- [CVE-2020-21881](https://cve.now/CVE-2020-21881.md): Cross Site Request Forgery (CSRF) vulnerability in admin.php in DuxCMS 2.1 allows remote attackers to modtify application data via article/a (no CVSS)
- [CVE-2020-36763](https://cve.now/CVE-2020-36763.md): Cross Site Scripting (XSS) vulnerability in DuxCMS 2.1 allows remote attackers to run arbitrary code via the content, time, copyfrom paramet (no CVSS)
- [CVE-2021-31651](https://cve.now/CVE-2021-31651.md): Cross Site Scripting (XSS) vulnerability in neofarg-cms 0.2.3 allows remoate attacker to run arbitrary code via the copyright field in copyr (no CVSS)
- [CVE-2021-31680](https://cve.now/CVE-2021-31680.md): Deserialization of Untrusted Data vulnerability in yolo 5 allows attackers to execute arbitrary code via crafted yaml file. (no CVSS)
- [CVE-2021-31681](https://cve.now/CVE-2021-31681.md): Deserialization of Untrusted Data vulnerability in yolo 3 allows attackers to execute arbitrary code via crafted yaml file. (no CVSS)
- [CVE-2022-42182](https://cve.now/CVE-2022-42182.md): Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Directory Traversal. (no CVSS)
- [CVE-2022-42183](https://cve.now/CVE-2022-42183.md): Precisely Spectrum Spatial Analyst 20.01 is vulnerable to Server-Side Request Forgery (SSRF). (no CVSS)
- [CVE-2023-33534](https://cve.now/CVE-2023-33534.md): A Cross-Site Request Forgery (CSRF) in Guanzhou Tozed Kangwei Intelligent Technology ZLTS10G software version S10G\_3.11.6 allows attackers t (no CVSS)
- [CVE-2023-34635](https://cve.now/CVE-2023-34635.md): Wifi Soft Unibox Administration 3.0 and 3.1 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2023-34644](https://cve.now/CVE-2023-34644.md): Remote code execution vulnerability in Ruijie Networks Product: RG-EW series home routers and repeaters EW\_3.0(1)B11P204, RG-NBS and RG-S193 (no CVSS)
- [CVE-2023-34842](https://cve.now/CVE-2023-34842.md): Remote Code Execution vulnerability in DedeCMS through 5.7.109 allows remote attackers to run arbitrary code via crafted POST request to /de (no CVSS)
- [CVE-2023-34872](https://cve.now/CVE-2023-34872.md): A vulnerability in Outline.cc for Poppler prior to 23.06.0 allows a remote attacker to cause a Denial of Service (DoS) (crash) via a crafted (CVSS 5.5)
- [CVE-2023-34916](https://cve.now/CVE-2023-34916.md): Fuge CMS v1.0 contains an Open Redirect vulnerability via /front/ProcessAct.java. (no CVSS)
- [CVE-2023-34917](https://cve.now/CVE-2023-34917.md): Fuge CMS v1.0 contains an Open Redirect vulnerability in member/RegisterAct.java. (no CVSS)
- [CVE-2023-35791](https://cve.now/CVE-2023-35791.md): Vound Intella Connect 2.6.0.3 has an Open Redirect vulnerability. (CVSS 6.1)
- [CVE-2023-35792](https://cve.now/CVE-2023-35792.md): Vound Intella Connect 2.6.0.3 is vulnerable to stored Cross-site Scripting (XSS). (CVSS 5.4)
- [CVE-2023-35861](https://cve.now/CVE-2023-35861.md): A shell-injection vulnerability in email notifications on Supermicro motherboards (such as H12DST-B before 03.10.35) allows remote attackers (no CVSS)
- [CVE-2023-36089](https://cve.now/CVE-2023-36089.md): Authentication Bypass vulnerability in D-Link DIR-645 firmware version 1.03 allows remote attackers to gain escalated privileges via functio (no CVSS)
- [CVE-2023-36090](https://cve.now/CVE-2023-36090.md): Authentication Bypass vulnerability in D-Link DIR-885L FW102b01 allows remote attackers to gain escalated privileges via phpcgi. (no CVSS)
- [CVE-2023-36091](https://cve.now/CVE-2023-36091.md): Authentication Bypass vulnerability in D-Link DIR-895 FW102b07 allows remote attackers to gain escalated privileges via via function phpcgi\_ (CVSS 9.8)
- [CVE-2023-36092](https://cve.now/CVE-2023-36092.md): Authentication Bypass vulnerability in D-Link DIR-859 FW105b03 allows remote attackers to gain escalated privileges via via phpcgi\_main. (CVSS 8.8)
- [CVE-2023-37580](https://cve.now/CVE-2023-37580.md): Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client. (CVSS 6.1, KEV)
- [CVE-2023-37647](https://cve.now/CVE-2023-37647.md): SEMCMS v1.5 was discovered to contain a SQL injection vulnerability via the id parameter at /Ant\_Suxin.php. (no CVSS)
- [CVE-2023-37771](https://cve.now/CVE-2023-37771.md): Art Gallery Management System v1.0 contains a SQL injection vulnerability via the cid parameter at /agms/product.php. (no CVSS)
- [CVE-2023-38303](https://cve.now/CVE-2023-38303.md): An issue was discovered in Webmin 2.021. (no CVSS)
- [CVE-2023-38304](https://cve.now/CVE-2023-38304.md): An issue was discovered in Webmin 2.021. (no CVSS)
- [CVE-2023-38305](https://cve.now/CVE-2023-38305.md): An issue was discovered in Webmin 2.021. (no CVSS)
- [CVE-2023-38306](https://cve.now/CVE-2023-38306.md): An issue was discovered in Webmin 2.021. (no CVSS)
- [CVE-2023-38307](https://cve.now/CVE-2023-38307.md): An issue was discovered in Webmin 2.021. (no CVSS)
- [CVE-2023-38308](https://cve.now/CVE-2023-38308.md): An issue was discovered in Webmin 2.021. (no CVSS)
- [CVE-2023-38309](https://cve.now/CVE-2023-38309.md): An issue was discovered in Webmin 2.021. (no CVSS)
- [CVE-2023-38310](https://cve.now/CVE-2023-38310.md): An issue was discovered in Webmin 2.021. (no CVSS)
- [CVE-2023-38311](https://cve.now/CVE-2023-38311.md): An issue was discovered in Webmin 2.021. (no CVSS)
- [CVE-2023-38750](https://cve.now/CVE-2023-38750.md): In Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41, 9 before 9.0.0 Patch 34, and 10 before 10.0.2, internal JSP and XML files can be exp (no CVSS)
- [CVE-2023-38989](https://cve.now/CVE-2023-38989.md): An issue in the delete function in the UserController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete the Admin (no CVSS)
- [CVE-2023-39122](https://cve.now/CVE-2023-39122.md): BMC Control-M through 9.0.20.200 allows SQL injection via the /RF-Server/report/deleteReport report-id parameter. (no CVSS)
- [CVE-2023-3983](https://cve.now/CVE-2023-3983.md): An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752. (no CVSS, Advantech iView)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-07-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.