CVEs published in June 2023
2,445 vulnerabilities, 292 critical, 16 exploited.
- xwiki, xwiki xwiki-platform +1 moreXPlatform Wiki vulnerable to cross-site scripting via xcontinue parameter in preview actions template9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to cross-site scripting in target parameter via share page by email8.8 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to stored cross-site scripting in ClassEditSheet page via name parameters9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to privilege escalation (PR) from account through like LiveTableResults10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform may show email addresses in clear in REST results7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform may retrieve email addresses of all users7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform's tags on non-viewable pages can be revealed to users4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform's Mail.MailConfig can be edited by any user with edit rights10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki vulnerable to stored cross-site scripting via any wiki document and the displaycontent/rendercontent template9.1 Critical
- gobalsky vega, vega-functions project vega-functions +1 moreVega's validators able to submit duplicate transactions6.0 Medium
- nettynetty-handler SniHandler 16MB allocation6.5 Medium
- devolutions serverImproper deletion of resource in the user management feature in Devolutions Server 2023.1.8 and...2.7 Low
- online school fees system project school fees system, sourcecodester online school fees system +1 moreSourceCodester Online School Fees System GET Parameter ajx.php sql injection6.3 Medium
- papercut ng/mf, mf, ng +2 morePaperCut MF/NG 22.0.10 (Build 65996 2023-03-27) - Remote code execution via CSRF8.4 High
libdwarfOSS-FuzzUNKNOWN READ in _dwarf_exec_frame_instrNo scoreogreOSS-FuzzHeap-buffer-overflow in stbiw__encode_png_lineNo scoremrubyOSS-FuzzHeap-use-after-free in obj_freeNo score- flothemes flo forms – easy drag & drop form builder, flo forms +1 moreWordPress Flo Forms Plugin <= 1.0.40 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- online shopping system advanced project shopping system advanced, puneeth reddy online shopping system advanced +1 morePuneethReddyHC Online Shopping System Advanced Admin Registration reg.php improper authentication7.3 High
- openssl`openssl` `X509VerifyParamRef::set_host` buffer over-read4.5 Medium
- dojo wp affiliate linksWordPress WP Affiliate Links Plugin <= 0.1.1 is vulnerable to Cross Site Scripting (XSS)7.1 High
- john brien wordpress nextgen galleryview, wordpress nextgen galleryview project nextgen galleryview +1 moreWordPress NextGen GalleryView Plugin <= 0.5.5 is vulnerable to Cross Site Scripting (XSS)7.1 High
- cloudflare warp, warp client +1 moreRemote access to warp-svc.exe in Cloudflare WARP7.3 High
- extra user details project user details, vadym k. extra user details +1 moreWordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- heateor super socializerWordPress Super Socializer Plugin <= 7.13.52 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreAttackers with access to the "documentconverterws" API were able to inject serialized Java...7.1 High
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIt was possible to call filesystem and network references using the local LibreOffice instance...5.0 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of POP3 "capabilities" responses are not limited...4.3 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of IMAP "capabilities" responses are not limited...4.3 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreWhen adding an external mail account, processing of SMTP "capabilities" responses are not limited...4.3 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreIPv4-mapped IPv6 addresses did not get recognized as "local" by the code and a connection attempt...5.0 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreControl characters were not removed when exporting user feedback content. This allowed attackers...3.5 Low
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreAttackers can successfully request arbitrary snippet IDs, including E-Mail signatures of other...6.5 Medium
- open-xchange appsuite backend, open-xchange gmbh ox app suite, ox software gmbh app suite +2 moreDefault permissions for a properties file were too permissive. Local system users could read...3.2 Low
- eventprimeWordPress EventPrime Plugin <= 3.0.5 is vulnerable to Cross Site Scripting (XSS)7.1 High
- cmscommander cms commander, thoefter cms commander – manage multiple sites +1 moreCMS Commander <= 2.287 - Authorization Bypass through Use of Insufficiently Unique Cryptographic Signature8.1 High
- musilda wp sticky social, wp sticky social project sticky social +1 moreThe WP Sticky Social plugin for WordPress is vulnerable to Cross-Site Request Forgery in...6.1 Medium
- mgt-commerce cloudpanelCloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.9.8 Critical
- zohocorp manageengine adselfservice plusZoho ManageEngine ADSelfService Plus through 6113 has an authentication bypass that can be...9.8 Critical
- adiscon loganalyzerAdiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL Injection.9.8 Critical
- fibaro fgms-001 firmwareA vulnerability in Fibaro Motion Sensor firmware v3.4 allows attackers to cause a Denial of...6.5 Medium
- aeotech zw130-a firmwareA vulnerability in Aeotec WallMote Switch firmware v2.3 allows attackers to cause a Denial of...6.5 Medium
- netgear r6250 firmwarenetgear R6250 Firmware Version 1.0.4.48 is vulnerable to Buffer Overflow after authentication.9.8 Critical
- langchainLangchain vulnerable to arbitrary code execution9.8 Critical
- craftcms craft cmsCraft CMS vulnerable to HTML injection6.1 Medium
- linux kernelAn issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu...5.5 Medium
- feehi feehicmsLiufee CMS File Upload vulnerability9.8 Critical
- phpokSQL injection vulnerability in PHPOK v.5.4. allows a remote attacker to obtain sensitive...7.5 High
- alluxioAlluxio Cross Site Scripting vulnerability6.1 Medium
- Show moreLoading…