Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: July 2023

68 records · 15 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2023-26258
    51Plan

    Arcserve UDP through 9.0.6034 allows authentication bypass.

    CriticalCVSS 9.8Proof of conceptEPSS 39%

    arcserve · udpJul 3, 2023

  • CVE-2023-3460
    61This week

    Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation

    CriticalCVSS 9.8Proof of conceptEPSS 72%

    ultimatemember · ultimate memberJul 4, 2023

  • CVE-2023-36932
    56Plan

    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023

    HighCVSS 8.1No exploitEPSS 81%

    progress · moveit transferJul 5, 2023

  • CVE-2023-36933
    52Plan

    In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is

    HighCVSS 7.5No exploitEPSS 72%

    progress · moveit transferJul 5, 2023

  • CVE-2023-36934
    65This week

    In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023

    CriticalCVSS 9.1Proof of conceptEPSS 95%

    progress · moveit transferJul 5, 2023

  • CVE-2023-35924
    55Plan

    GLPI vulnerable to SQL injection via inventory agent request

    CriticalCVSS 9.8No exploitEPSS 52%

    glpi-project · glpiJul 5, 2023

  • CVE-2023-36808
    55Plan

    GLPI vulnerable to SQL injection through Computer Virtual Machine information

    CriticalCVSS 9.8Proof of conceptEPSS 51%

    glpi-project · glpiJul 5, 2023

  • CVE-2023-36969
    50Plan

    CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.

    HighCVSS 8.8WeaponizedEPSS 49%

    cmsmadesimple · cms made simpleJul 6, 2023

  • CVE-2023-34192
    89Now

    Cross Site Scripting vulnerability in Zimbra ZCS v.8.8.15 allows a remote authenticated attacker to execute arbitrary code via a crafted scr

    CriticalCVSS 9.0KEVWeaponizedEPSS 77%

    synacor · zimbra collaboration suiteJul 6, 2023

  • CVE-2023-34193
    35Monitor

    File Upload vulnerability in Zimbra ZCS 8.8.15 allows an authenticated privileged user to execute arbitrary code and obtain sensitive inform

    HighCVSS 8.8No exploitEPSS 1%

    zimbra · collaborationJul 6, 2023

  • CVE-2023-36460
    51Plan

    Mastodon vulnerable to arbitrary file creation through media attachments

    CriticalCVSS 9.9No exploitEPSS 40%

    joinmastodon · mastodonJul 6, 2023

  • CVE-2023-1183
    41Plan

    Arbitrary file write

    MediumCVSS 5.5No exploitEPSS 64%

    libreoffice · libreofficeJul 10, 2023

  • CVE-2023-2796
    34Monitor

    EventON < 2.1.2 - Unauthenticated Event Access

    MediumCVSS 5.3Proof of conceptEPSS 42%

    myeventon · eventonJul 10, 2023

  • CVE-2023-24488
    48Plan

    Cross site scripting

    MediumCVSS 6.1Proof of conceptEPSS 80%

    citrix · gatewayJul 10, 2023

  • CVE-2023-24489
    98Now

    A vulnerability has been discovered in the customer-managed ShareFile storage zones controller which, if exploited, could allow an unauthent

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    citrix · sharefile storage zones controllerJul 10, 2023

  • CVE-2023-3608
    39Monitor

    Ruijie BCR810W Tracert Page os command injection

    HighCVSS 8.8No exploitEPSS 12%

    ruijienetworks · bcr810w firmwareJul 10, 2023

  • CVE-2023-36824
    58Plan

    Heap overflow in COMMAND GETKEYS and ACL evaluation in Redis

    HighCVSS 8.8No exploitEPSS 77%

    redis · redisJul 11, 2023

  • CVE-2023-32046
    64This week

    Windows MSHTML Platform Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 10%

    microsoft · windows 10 1507Jul 11, 2023

  • CVE-2023-32049
    66This week

    Windows SmartScreen Security Feature Bypass Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 4%

    microsoft · windows 10 1607Jul 11, 2023

  • CVE-2023-33157
    46Plan

    Microsoft SharePoint Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 38%

    microsoft · sharepoint serverJul 11, 2023

  • CVE-2023-36874
    74This week

    Windows Error Reporting Service Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 42%

    microsoft · windows 10 1507Jul 11, 2023

  • CVE-2023-36884
    90Now

    Windows Search Remote Code Execution Vulnerability

    HighCVSS 7.5KEVWeaponizedEPSS 98%

    microsoft · windows 10 1507Jul 11, 2023

  • CVE-2023-35311
    70This week

    Microsoft Outlook Security Feature Bypass Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 15%

    microsoft · 365 appsJul 11, 2023

  • CVE-2023-37582
    66This week

    Apache RocketMQ: Possible remote code execution when using the update configuration function

    CriticalCVSS 9.8Proof of conceptEPSS 90%

    apache · rocketmqJul 12, 2023

  • CVE-2023-29298
    90Now

    Adobe ColdFusion Improper Access Control Security feature bypass

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    adobe · coldfusionJul 12, 2023

  • CVE-2023-29300
    99Now

    Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · coldfusionJul 12, 2023

  • CVE-2023-29301
    40Plan

    Adobe ColdFusion Improper Restriction of Excessive Authentication Attempts Security feature bypass

    HighCVSS 7.5No exploitEPSS 34%

    adobe · coldfusionJul 12, 2023

  • CVE-2023-37629
    46Plan

    Online Piggery Management System 1.0 is vulnerable to File Upload.

    CriticalCVSS 9.8Proof of conceptEPSS 23%

    simple online piggery management system project · simple online piggery management systemJul 12, 2023

  • CVE-2023-3643
    62This week

    Boss Mini document file inclusion

    CriticalCVSS 9.8Proof of conceptEPSS 75%

    carel · boss mini firmwareJul 12, 2023

  • CVE-2023-34124
    60This week

    The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass.

    CriticalCVSS 9.8WeaponizedEPSS 50%

    sonicwall · analyticsJul 12, 2023

  • CVE-2023-34125
    34Monitor

    Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem wi

    MediumCVSS 6.5No exploitEPSS 25%

    sonicwall · analyticsJul 12, 2023

  • CVE-2023-34127
    61This week

    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analyti

    HighCVSS 8.8WeaponizedEPSS 86%

    sonicwall · analyticsJul 12, 2023

  • CVE-2023-34129
    47Plan

    Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in SonicWall GMS and Analytics allows an authen

    HighCVSS 8.8No exploitEPSS 41%

    sonicwall · analyticsJul 12, 2023

  • CVE-2023-34132
    60This week

    Use of password hash instead of password for authentication vulnerability in SonicWall GMS and Analytics allows Pass-the-Hash attacks.

    CriticalCVSS 9.8WeaponizedEPSS 7%

    sonicwall · analyticsJul 12, 2023

  • CVE-2023-34133
    60This week

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an

    HighCVSS 7.5WeaponizedEPSS 72%

    sonicwall · analyticsJul 12, 2023

  • CVE-2023-29452
    40Plan

    Remove possibility to add html into Geomap attribution field

    MediumCVSS 5.4No exploitEPSS 64%

    zabbix · zabbixJul 13, 2023

  • CVE-2022-24834
    47Plan

    Heap overflow issue with the Lua cjson library used by Redis

    HighCVSS 8.8Proof of conceptEPSS 41%

    redis · redisJul 13, 2023

  • CVE-2023-37474
    43Plan

    Path traversal in copyparty

    HighCVSS 7.5Proof of conceptEPSS 44%

    9001 · copypartyJul 14, 2023

  • CVE-2023-37462
    62This week

    Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') in org.xwiki.platform:xwiki-platform-skin-ui

    HighCVSS 8.8Proof of conceptEPSS 91%

    xwiki · xwikiJul 14, 2023

  • CVE-2023-33012
    40Plan

    A command injection vulnerability in the configuration parser of the Zyxel ATP series firmware versions 5.10 through 5.36 Patch 2, USG FLEX

    HighCVSS 8.8WeaponizedEPSS 9%

    zyxel · usg 20w-vpn firmwareJul 17, 2023

  • CVE-2023-37791
    43Plan

    D-Link DIR-619L v2.04(TW) was discovered to contain a stack overflow via the curTime parameter at /goform/formLogin.

    CriticalCVSS 9.8No exploitEPSS 12%

    dlink · dir-619l firmwareJul 17, 2023

  • CVE-2021-4428
    35Monitor

    what3words Autosuggest Plugin Setting class-w3w-autosuggest-public.php enqueue_scripts information disclosure

    HighCVSS 7.5Proof of conceptEPSS 15%

    what3words · autosuggestJul 18, 2023

  • CVE-2023-22047
    53Plan

    Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Portal).

    HighCVSS 7.5Proof of conceptEPSS 76%

    oracle · peoplesoft enterpriseJul 18, 2023

  • CVE-2023-3765
    60This week

    Absolute Path Traversal in mlflow/mlflow

    CriticalCVSS 10.0Proof of conceptEPSS 67%

    lfprojects · mlflowJul 18, 2023

  • CVE-2023-3519
    99Now

    Unauthenticated remote code execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    citrix · netscaler application delivery controllerJul 19, 2023

  • CVE-2023-38408
    63This week

    The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if

    CriticalCVSS 9.8Proof of conceptEPSS 79%

    openbsd · opensshJul 20, 2023

  • CVE-2023-34966
    49Plan

    Samba: infinite loop in mdssvc rpc service for spotlight

    HighCVSS 7.5No exploitEPSS 62%

    samba · sambaJul 20, 2023

  • CVE-2023-34967
    39Monitor

    Samba: type confusion in mdssvc rpc service for spotlight

    MediumCVSS 5.3No exploitEPSS 61%

    samba · sambaJul 20, 2023

  • CVE-2023-38203
    98Now

    Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    adobe · coldfusionJul 20, 2023

  • CVE-2023-37645
    28Monitor

    eyoucms v1.6.3 was discovered to contain an information disclosure vulnerability via the component /custom_model_path/recruit.filelist.txt.

    MediumCVSS 5.3Proof of conceptEPSS 24%

    eyoucms · eyoucmsJul 20, 2023

  • CVE-2023-35086
    40Plan

    ASUS RT-AX56U V2 & RT-AC86U - Format String -1

    HighCVSS 7.2Proof of conceptEPSS 38%

    asus · rt-ac86u firmwareJul 21, 2023

  • CVE-2023-38646
    69This week

    Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at

    CriticalCVSS 9.8WeaponizedEPSS 98%

    metabase · metabaseJul 21, 2023

  • CVE-2023-3836
    61This week

    Dahua Smart Park Management unrestricted upload

    CriticalCVSS 9.8Proof of conceptEPSS 73%

    dahuasecurity · smart parking managementJul 22, 2023

  • CVE-2023-3852
    36Monitor

    OpenRapid RapidCMS upload.php unrestricted upload

    HighCVSS 7.2No exploitEPSS 25%

    openrapid · rapidcmsJul 23, 2023

  • CVE-2023-35078
    99Now

    An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the appli

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    ivanti · endpoint manager mobileJul 25, 2023

  • CVE-2023-3486
    54Plan

    PaperCut NG Unauthenticated File Upload

    HighCVSS 7.5No exploitEPSS 79%

    papercut · papercut mfJul 25, 2023

  • CVE-2023-2640
    40Plan

    On Ubuntu kernels carrying both c914c0e27eb0 and "UBUNTU: SAUCE: overlayfs: Skip permission checking for trusted.overlayfs.* xattrs", an unp

    HighCVSS 7.8WeaponizedEPSS 15%

    canonical · ubuntu linuxJul 25, 2023

  • CVE-2023-32629
    40Plan

    Local privilege escalation vulnerability in Ubuntu Kernels overlayfs ovl_copy_up_meta_inode_data skip permission checks when calling ovl_do_

    HighCVSS 7.8WeaponizedEPSS 9%

    canonical · ubuntu linuxJul 25, 2023

  • CVE-2023-28130
    34Monitor

    Local user may lead to privilege escalation using Gaia Portal hostnames page.

    HighCVSS 7.2No exploitEPSS 20%

    checkpoint · gaia portalJul 26, 2023

  • CVE-2023-31465
    53Plan

    An issue was discovered in FSMLabs TimeKeeper 8.0.17 through 8.0.28.

    CriticalCVSS 9.8Proof of conceptEPSS 46%

    fsmlabs · timekeeperJul 26, 2023

  • CVE-2023-37450
    71This week

    The issue was addressed with improved checks.

    HighCVSS 8.8KEVWeaponizedEPSS 18%

    apple · safariJul 26, 2023

  • CVE-2023-38606
    53Plan

    This issue was addressed with improved state management.

    MediumCVSS 5.5KEVWeaponizedEPSS 2%

    apple · ipadosJul 26, 2023

  • CVE-2023-37754
    48Plan

    PowerJob v4.3.3 was discovered to contain a remote command execution (RCE) vulnerability via the instanceId parameter at /instance/detail.

    CriticalCVSS 9.8No exploitEPSS 30%

    powerjob · powerjobJul 28, 2023

  • CVE-2023-38992
    61This week

    jeecg-boot v3.5.1 was discovered to contain a SQL injection vulnerability via the title parameter at /sys/dict/loadTreeData.

    CriticalCVSS 9.8Proof of conceptEPSS 73%

    jeecg · jeecg bootJul 28, 2023

  • CVE-2022-4906
    39Monitor

    Inappropriate implementation in Blink in Google Chrome prior to 108.0.5359.71 allowed a remote attacker to perform arbitrary read/write via

    HighCVSS 8.8No exploitEPSS 12%

    google · chromeJul 28, 2023

  • CVE-2023-37580
    69This week

    Zimbra Collaboration (ZCS) 8 before 8.8.15 Patch 41 allows XSS in the Zimbra Classic Web Client.

    MediumCVSS 6.1KEVWeaponizedEPSS 49%

    synacor · zimbra collaboration suiteJul 31, 2023

  • CVE-2023-3983
    40Plan

    An authenticated SQL injection vulnerability exists in Advantech iView versions prior to v5.7.4 build 6752.

    HighCVSS 8.8No exploitEPSS 16%

    advantech · iviewJul 31, 2023

  • CVE-2023-34960
    69This week

    A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary comm

    CriticalCVSS 9.8WeaponizedEPSS 99%

    chamilo · chamiloJul 31, 2023