CVEs published August 1, 2023
82 CVEs were published on August 1, 2023: 1 critical, 10 high.
- Published
- 82
- Critical
- 1
- High
- 10
- Medium
- 14
- Low
- 1
- Unrated
- 56
- Now in CISA KEV
- 0
- Fix available
- 41
Most affected products
- Google Chrome
- 14
- Brocade Fabric OS
- 9
- Mozilla Firefox
- 9
- GitLab
- 5
- Mozilla Firefox · Mozilla Thunderbird
- 5
- billz/raspap-webgui
- 2
- FreeBSD
- 2
- Red Hat Enterprise Linux
- 2
- AMD Processors
- 1
- Checkmk
- 1
Critical 1
High 10
- CVE-2023-31432Privilege issues in multiple commandsBrocade Fabric OS
- CVE-2023-3364Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2023-31427Knowledge of full path nameBrocade Fabric OS
- CVE-2023-3107Remote denial of service in IPv6 fragment reassemblyFreeBSD
- CVE-2023-31425Privilege escalation via the fosexec commandBrocade Fabric OS
- CVE-2023-3718Authenticated Command Injection Vulnerability in AOS-CX Command Line InterfaceHewlett Packard Enterprise (HPE) Aruba CX Switches
- CVE-2023-37478pnpm incorrectly parses tar archives relative to specificationpnpm · @pnpm/exe +7
- CVE-2023-26139Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() funcunderscore-keypath
- CVE-2023-37496HCL Verse is susceptible to a Stored Cross-Site Scripting (XSS) VulnerabilityHCL Software HCL Verse
- CVE-2023-4033OS Command Injection in mlflow/mlflowmlflow/mlflow · mlflow
Medium, low and unrated 71
- CVE-2023-31928XSS vulnerability in Brocade WebtoolsBrocade Fabric OS
- CVE-2023-31428CLI allows upload or transfer files of dangerous typesBrocade Fabric OS
- CVE-2023-0632Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2023-1210Generation of Error Message Containing Sensitive Information in GitLabGitLab
- CVE-2023-2164Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2023-3385Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabGitLab
- CVE-2023-31430buffer overflow vulnerability in “secpolicydelete” commandBrocade Fabric OS
- CVE-2023-31431A buffer overflow vulnerability in “diagstatus” commandBrocade Fabric OS
- CVE-2023-3740Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve Google Chrome
- CVE-2023-3739Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker to execGoogle Chrome
- CVE-2023-3738Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a crGoogle Chrome
- CVE-2023-3737Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of medGoogle Chrome
- CVE-2023-3736Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 115.0.5790.98 allowed a remote attacker to leak cross-origiGoogle Chrome
- CVE-2023-3735Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate seGoogle Chrome
- CVE-2023-3734Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof thGoogle Chrome
- CVE-2023-3733Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the cGoogle Chrome
- CVE-2023-3732Out of bounds memory access in Mojo in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer proceGoogle Chrome
- CVE-2023-3731Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a malGoogle Chrome
- CVE-2023-3730Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UIGoogle Chrome
- CVE-2023-3729Use after free in Splitscreen in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker who convinced a user to engage Google Chrome
- CVE-2023-3728Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2023-3727Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2023-3494bhyve privileged guest escape via fwctlFreeBSD
- CVE-2023-31426scp, sftp, ftp servers passwords in supportsaveBrocade Fabric OS
- CVE-2023-31429Multiple commands print sensitive information in the terminalBrocade Fabric OS
- CVE-2023-20583Software based Power Side Channel on AMD CPUs AMD Processors
- CVE-2023-38560Ghostscript: integer overflow in pcl/pl/plfont.c:418 in pl_glyph_nameRed Hat Enterprise Linux
- CVE-2023-38559Ghostscript: out-of-bound read in base/gdevdevn.c:1973 in devn_pcx_write_rle could result in dosRed Hat Enterprise Linux
- CVE-2023-4058Memory safety bugs present in Firefox 115.Mozilla Firefox
- CVE-2023-4057Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-4056Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13.Mozilla Firefox
- CVE-2023-4055When the number of cookies per domain was exceeded in `document.cookie`, the actual cookie jar sent to the host was no longer consistent witMozilla Firefox
- CVE-2023-4054When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-4053Full screen notification obscured by external programMozilla Firefox · Mozilla Thunderbird
- CVE-2023-4052The Firefox updater created a directory writable by non-privileged users.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-4051Full screen notification obscured by file open dialogMozilla Firefox · Mozilla Thunderbird
- CVE-2023-4050In some cases, an untrusted input stream was copied to a stack buffer without checking its size.Mozilla Firefox
- CVE-2023-4049Race conditions in reference counting code were found through code inspection.Mozilla Firefox
- CVE-2023-4048An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations.Mozilla Firefox
- CVE-2023-4047A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.Mozilla Firefox
- CVE-2023-4046In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis.Mozilla Firefox
- CVE-2023-4045Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violatioMozilla Firefox
- CVE-2023-23548XSS in business intelligenceCheckmk
- CVE-2020-10962In PowerShell App Deployment Toolkit (aka PSAppDeployToolkit) through 3.8.0, an incorrect access control vulnerability in the default config
- CVE-2022-39986A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg_id pbillz/raspap-webgui
- CVE-2022-39987A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via tbillz/raspap-webgui
- CVE-2023-31710TP-Link Archer AX21(US)_V3_1.1.4 Build 20230219 and AX21(US)_V3.6_1.1.4 Build 20230219 are vulnerable to Buffer Overflow.
- CVE-2023-33560There is a Cross Site Scripting (XSS) vulnerability in "cid" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.
- CVE-2023-33561Improper input validation of password parameter in PHP Jabbers Time Slots Booking Calendar v 3.3 results in insecure passwords.
- CVE-2023-33562User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3.
- CVE-2023-33563In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) a
- CVE-2023-33564There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3.
- CVE-2023-34551In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authentic
- CVE-2023-34552In certain EZVIZ products, two stack based buffer overflows in mulicast_parse_sadp_packet and mulicast_get_pack_type functions of the SADP m
- CVE-2023-34634Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened.
- CVE-2023-34869PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php?controller
- CVE-2023-34960A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary comm
- CVE-2023-36118Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a cr
- CVE-2023-36121Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SE
- CVE-2023-36210MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keywor
- CVE-2023-36211The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on th
- CVE-2023-36351An issue in Viatom Health ViHealth for Android v.2.74.58 and before allows a remote attacker to execute arbitrary code via the com.viatom.ba
- CVE-2023-36983LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
- CVE-2023-36984LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure.
- CVE-2023-37772Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php.
- CVE-2023-38357Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessio
- CVE-2023-38990An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus cre
- CVE-2023-39108rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_b parameter in the doDiff Function of /classes/co
- CVE-2023-39109rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path_a parameter in the doDiff Function of /classes/co
- CVE-2023-39110rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php.
- CVE-2023-39147An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file.