CVEs published in July 2023
2,375 vulnerabilities, 275 critical, 16 exploited.
- phpscriptpoint lawyerphpscriptpoint Lawyer page.php cross site scripting3.5 Low
typo3/cms-rte-ckeditorPackagistCross-Site Scripting in CKEditor4 WordCount Plugin4.7 Medium- dataeaseThe DataEase panel and dataset have a stored XSS vulnerability5.4 Medium
- envoyproxy envoyEnvoy vulnerable to incorrect handling of HTTP requests and responses with mixed case schemes8.2 High
- arubanetworks arubaos, hewlett packard enterprise (hpe) aruba access points running instantos and arubaos 10, hp instantos +1 more +3 moreUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol9.8 Critical
- arubanetworks arubaos, hewlett packard enterprise (hpe) aruba access points running instantos and arubaos 10, hp instantos +1 more +3 moreUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol9.8 Critical
- arubanetworks arubaos, hewlett packard enterprise (hpe) aruba access points running instantos and arubaos 10, hp instantos +1 more +3 moreUnauthenticated Buffer Overflow Vulnerabilities in Services Accessed by the PAPI Protocol9.8 Critical
- typo3 html sanitizer, html-sanitizer +1 moreBy-passing Cross-Site Scripting Protection in HTML Sanitizer4.7 Medium
- envoyproxy envoyEnvoy vulnerable to CORS filter segfault when origin header is removed6.3 Medium
- typo3typo3/cms-core Information Disclosure due to Out-of-scope Site Resolution3.7 Low
- line armeriaPaths contain matrix variables bypass decorators7.5 High
- envoyproxy envoyEnvoy's gRPC access log crash caused by the listener draining6.5 Medium
- 9001 copypartycopyparty vulnerable to reflected cross-site scripting via k304 parameter6.3 Medium
- vyperlang vyperVyper's ecrecover can return undefined data if signature does not verify5.3 Medium
- envoyproxy envoyEnvoy vulnerable to OAuth2 credentials exploit with permanent validity8.6 High
- enalean tuleapTuleap Cross-site Scripting vulnerability in the card field of the agile dashboard apps5.4 Medium
- codehaus-plexus plexus-archiverPlexus Archiver vulnerable to Arbitrary File Creation in AbstractUnArchiver8.1 High
- getsentry sentrySentry vulnerable to improper authorization on debug and artifact file downloads7.7 High
- contaoContao cross site scripting vulnerability via input unit widget6.5 Medium
- strapiLeaking sensitive user information still possible by filtering on private with prefix fields8.6 High
- google wifi (next gen), nest hub (2nd. gen) w/ sleep tracking, nest hub max +9 more +11 moreAuthentication Bypass in OpenThread Boarder Router devices7.5 High
- debian linux, linux kernel, fedoraproject fedora +6 more +8 moreKernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr5.5 Medium
- debian linux, linux kernel, fedoraproject fedora +14 more +16 moreKernel: xfrm: null pointer dereference in xfrm_update_ae_params()5.5 Medium
- apache software foundation felix healthcheck webconsole plugin, apache felix health check webconsole plugin +1 moreApache Felix Healthcheck Webconsole Plugin: XSS in healthcheck webconsole plugin6.1 Medium
openstack-troveUbuntuopenstack-trove vulnerabilitiesNo score- strapiStrapi allows actors to make all attributes on a content-type public without noticing it4.8 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.05.2 reflected XSS via GitHub integration was possible4.6 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.05.2 a ReDoS attack was possible via integration with issue...4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2023.05.2 a token with limited permissions could be used to gain...5.4 Medium
- openlibraryfoundation mod-remote-storageFOLIO mod-remote-storage Hard Coded Credentials5.3 Medium
- certifi, certifi python-certifi, fedoraproject fedora +6 more +8 moreCertifi's removal of e-Tugra root certificate7.5 High
- apache jackrabbit, apache software foundation jackrabbit standalone (jackrabbit-standalone and jackrabbit-standalone-components), jackrabbit webapp (jackrabbit-webapp) +2 moreApache Jackrabbit RMI access can lead to RCE9.8 Critical
- openlibraryfoundation mod-data-export-springFOLIO mod-data-export-spring Hard-Coded Credentials9.1 Critical
- apptainerApptainer's ineffective privileges drop when requesting container network6.1 Medium
- max foundry wordpress button plugin maxbuttons, maxfoundry maxbuttons +1 moreWordPress MaxButtons Plugin <= 9.5.3 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- wpxpo postx, postx – gutenberg post grid blocks +1 moreWordPress PostX – Gutenberg Blocks for Post Grid Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS)7.1 High
- fivestarplugins five star restaurant reservations, five star restaurant menu +1 moreWordPress Five Star Restaurant Reservations Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)7.1 High
- cththemes balkonWordPress Balkon Theme <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)7.1 High
- michael winkler teachpressWordPress teachPress Plugin <= 9.0.2 is vulnerable to Cross Site Scripting (XSS)7.1 High
- grandslambert login configurator, login configurator project configurator +1 moreWordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- johnson controls iq wifi 6, johnsoncontrols iq wifi 6 firmware +1 moreIQ Wifi 68.3 High
- neha goel recent posts slider, recent posts slider project posts slider +1 moreWordPress Recent Posts Slider Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)7.1 High
- drop shadow boxes project shadow boxes, stevehenty drop shadow boxes +1 moreWordPress Drop Shadow Boxes Plugin <= 1.7.10 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- papercut ng, mf +1 morePaperCut NG Unauthenticated File Upload8.2 High
- red hat openstack platform 13 (queens) operational tools, openstack platform 16.1, openstack platform 16.2 +4 more +6 moreOpenstack-neutron: unrestricted creation of security groups (fix for cve-2022-3277)4.3 Medium
- pluginforage woocommerce product categories selection widgetWordPress WooCommerce Product Categories Selection Widget Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)7.1 High
- nodebbUnintentional leakage of private information via cross-origin websocket session hijacking4.7 Medium
- 42gears suremdm, onpremise suremdm solution suremdm onpremise +1 moreBypassing CAPTCHA & Enumerating Usernames via Password Reset Page4.8 Medium
- campcodes beauty salon management systemCampcodes Beauty Salon Management System edit-accepted-appointment.php cross site scripting3.5 Low
- campcodes beauty salon management systemCampcodes Beauty Salon Management System admin-profile.php cross site scripting3.5 Low
- Show moreLoading…