# CVEs published 2023-08-01

82 CVEs were published on August 1, 2023: 1 critical, 10 high. Days are UTC.

- [CVE-2023-31432](https://cve.now/CVE-2023-31432.md): Privilege issues in multiple commands (CVSS 7.8, Brocade Fabric OS)
- [CVE-2023-31928](https://cve.now/CVE-2023-31928.md): XSS vulnerability in Brocade Webtools (CVSS 6.3, Brocade Fabric OS)
- [CVE-2023-31428](https://cve.now/CVE-2023-31428.md): CLI allows upload or transfer files of dangerous types (CVSS 5.5, Brocade Fabric OS)
- [CVE-2023-0632](https://cve.now/CVE-2023-0632.md): Inefficient Regular Expression Complexity in GitLab (CVSS 6.5, GitLab)
- [CVE-2023-1210](https://cve.now/CVE-2023-1210.md): Generation of Error Message Containing Sensitive Information in GitLab (CVSS 3.1, GitLab)
- [CVE-2023-2164](https://cve.now/CVE-2023-2164.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 5.4, GitLab)
- [CVE-2023-3364](https://cve.now/CVE-2023-3364.md): Inefficient Regular Expression Complexity in GitLab (CVSS 7.5, GitLab)
- [CVE-2023-3385](https://cve.now/CVE-2023-3385.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (CVSS 6.3, GitLab)
- [CVE-2023-31430](https://cve.now/CVE-2023-31430.md): buffer overflow vulnerability in “secpolicydelete” command (CVSS 5.5, Brocade Fabric OS)
- [CVE-2023-31431](https://cve.now/CVE-2023-31431.md): A buffer overflow vulnerability in “diagstatus” command (CVSS 5.5, Brocade Fabric OS)
- [CVE-2023-31427](https://cve.now/CVE-2023-31427.md): Knowledge of full path name (CVSS 7.8, Brocade Fabric OS)
- [CVE-2023-3740](https://cve.now/CVE-2023-3740.md): Insufficient validation of untrusted input in Themes in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially serve (no CVSS, Google Chrome)
- [CVE-2023-3739](https://cve.now/CVE-2023-3739.md): Insufficient validation of untrusted input in Chromad in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker to exec (no CVSS, Google Chrome)
- [CVE-2023-3738](https://cve.now/CVE-2023-3738.md): Inappropriate implementation in Autofill in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate security UI via a cr (no CVSS, Google Chrome)
- [CVE-2023-3737](https://cve.now/CVE-2023-3737.md): Inappropriate implementation in Notifications in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to spoof the contents of med (no CVSS, Google Chrome)
- [CVE-2023-3736](https://cve.now/CVE-2023-3736.md): Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 115.0.5790.98 allowed a remote attacker to leak cross-origi (no CVSS, Google Chrome)
- [CVE-2023-3735](https://cve.now/CVE-2023-3735.md): Inappropriate implementation in Web API Permission Prompts in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to obfuscate se (CVSS 4.3, Google Chrome)
- [CVE-2023-3734](https://cve.now/CVE-2023-3734.md): Inappropriate implementation in Picture In Picture in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof th (no CVSS, Google Chrome)
- [CVE-2023-3733](https://cve.now/CVE-2023-3733.md): Inappropriate implementation in WebApp Installs in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially spoof the c (no CVSS, Google Chrome)
- [CVE-2023-3732](https://cve.now/CVE-2023-3732.md): Out of bounds memory access in Mojo in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who had compromised the renderer proce (no CVSS, Google Chrome)
- [CVE-2023-3731](https://cve.now/CVE-2023-3731.md): Use after free in Diagnostics in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed an attacker who convinced a user to install a mal (no CVSS, Google Chrome)
- [CVE-2023-3730](https://cve.now/CVE-2023-3730.md): Use after free in Tab Groups in Google Chrome prior to 115.0.5790.98 allowed a remote attacker who convinced a user to engage in specific UI (no CVSS, Google Chrome)
- [CVE-2023-3729](https://cve.now/CVE-2023-3729.md): Use after free in Splitscreen in Google Chrome on ChromeOS prior to 115.0.5790.131 allowed a remote attacker who convinced a user to engage (no CVSS, Google Chrome)
- [CVE-2023-3728](https://cve.now/CVE-2023-3728.md): Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2023-3727](https://cve.now/CVE-2023-3727.md): Use after free in WebRTC in Google Chrome prior to 115.0.5790.98 allowed a remote attacker to potentially exploit heap corruption via a craf (no CVSS, Google Chrome)
- [CVE-2023-3494](https://cve.now/CVE-2023-3494.md): bhyve privileged guest escape via fwctl (no CVSS, FreeBSD)
- [CVE-2023-3107](https://cve.now/CVE-2023-3107.md): Remote denial of service in IPv6 fragment reassembly (CVSS 7.5, FreeBSD)
- [CVE-2023-31426](https://cve.now/CVE-2023-31426.md): scp, sftp, ftp servers passwords in supportsave (CVSS 6.8, Brocade Fabric OS)
- [CVE-2023-31425](https://cve.now/CVE-2023-31425.md): Privilege escalation via the fosexec command (CVSS 7.8, Brocade Fabric OS)
- [CVE-2023-31429](https://cve.now/CVE-2023-31429.md): Multiple commands print sensitive information in the terminal (CVSS 5.5, Brocade Fabric OS)
- [CVE-2023-3718](https://cve.now/CVE-2023-3718.md): Authenticated Command Injection Vulnerability in AOS-CX Command Line Interface (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba CX Switches)
- [CVE-2023-20583](https://cve.now/CVE-2023-20583.md): Software based Power Side Channel on AMD CPUs (no CVSS, AMD Processors)
- [CVE-2023-38560](https://cve.now/CVE-2023-38560.md): Ghostscript: integer overflow in pcl/pl/plfont.c:418 in pl\_glyph\_name (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2023-38559](https://cve.now/CVE-2023-38559.md): Ghostscript: out-of-bound read in base/gdevdevn.c:1973 in devn\_pcx\_write\_rle could result in dos (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2023-4058](https://cve.now/CVE-2023-4058.md): Memory safety bugs present in Firefox 115. (no CVSS, Mozilla Firefox)
- [CVE-2023-4057](https://cve.now/CVE-2023-4057.md): Memory safety bugs present in Firefox 115, Firefox ESR 115.0, and Thunderbird 115.0. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-4056](https://cve.now/CVE-2023-4056.md): Memory safety bugs present in Firefox 115, Firefox ESR 115.0, Firefox ESR 102.13, Thunderbird 115.0, and Thunderbird 102.13. (no CVSS, Mozilla Firefox)
- [CVE-2023-4055](https://cve.now/CVE-2023-4055.md): When the number of cookies per domain was exceeded in \`document.cookie\`, the actual cookie jar sent to the host was no longer consistent wit (no CVSS, Mozilla Firefox)
- [CVE-2023-4054](https://cve.now/CVE-2023-4054.md): When opening appref-ms files, Firefox did not warn the user that these files may contain malicious code. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-4053](https://cve.now/CVE-2023-4053.md): Full screen notification obscured by external program (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-4052](https://cve.now/CVE-2023-4052.md): The Firefox updater created a directory writable by non-privileged users. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-4051](https://cve.now/CVE-2023-4051.md): Full screen notification obscured by file open dialog (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-4050](https://cve.now/CVE-2023-4050.md): In some cases, an untrusted input stream was copied to a stack buffer without checking its size. (no CVSS, Mozilla Firefox)
- [CVE-2023-4049](https://cve.now/CVE-2023-4049.md): Race conditions in reference counting code were found through code inspection. (no CVSS, Mozilla Firefox)
- [CVE-2023-4048](https://cve.now/CVE-2023-4048.md): An out-of-bounds read could have led to an exploitable crash when parsing HTML with DOMParser in low memory situations. (no CVSS, Mozilla Firefox)
- [CVE-2023-4047](https://cve.now/CVE-2023-4047.md): A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. (no CVSS, Mozilla Firefox)
- [CVE-2023-4046](https://cve.now/CVE-2023-4046.md): In some circumstances, a stale value could have been used for a global variable in WASM JIT analysis. (no CVSS, Mozilla Firefox)
- [CVE-2023-4045](https://cve.now/CVE-2023-4045.md): Offscreen Canvas did not properly track cross-origin tainting, which could have been used to access image data from another site in violatio (no CVSS, Mozilla Firefox)
- [CVE-2023-37478](https://cve.now/CVE-2023-37478.md): pnpm incorrectly parses tar archives relative to specification (CVSS 7.5, pnpm · @pnpm/exe +7)
- [CVE-2023-23548](https://cve.now/CVE-2023-23548.md): XSS in business intelligence (CVSS 5.4, Checkmk)
- [CVE-2023-26139](https://cve.now/CVE-2023-26139.md): Versions of the package underscore-keypath from 0.0.11 are vulnerable to Prototype Pollution via the name argument of the setProperty() func (CVSS 7.5, underscore-keypath)
- [CVE-2023-37496](https://cve.now/CVE-2023-37496.md): HCL Verse is susceptible to a Stored Cross-Site Scripting (XSS) Vulnerability (CVSS 8.3, HCL Software HCL Verse)
- [CVE-2023-4033](https://cve.now/CVE-2023-4033.md): OS Command Injection in mlflow/mlflow (CVSS 8.8, mlflow/mlflow · mlflow)
- [CVE-2020-10962](https://cve.now/CVE-2020-10962.md): In PowerShell App Deployment Toolkit (aka PSAppDeployToolkit) through 3.8.0, an incorrect access control vulnerability in the default config (no CVSS)
- [CVE-2022-39986](https://cve.now/CVE-2022-39986.md): A Command injection vulnerability in RaspAP 2.8.0 thru 2.8.7 allows unauthenticated attackers to execute arbitrary commands via the cfg\_id p (no CVSS, billz/raspap-webgui)
- [CVE-2022-39987](https://cve.now/CVE-2022-39987.md): A Command injection vulnerability in RaspAP 2.8.0 thru 2.9.2 allows an authenticated attacker to execute arbitrary OS commands as root via t (no CVSS, billz/raspap-webgui)
- [CVE-2023-31710](https://cve.now/CVE-2023-31710.md): TP-Link Archer AX21(US)\_V3\_1.1.4 Build 20230219 and AX21(US)\_V3.6\_1.1.4 Build 20230219 are vulnerable to Buffer Overflow. (no CVSS)
- [CVE-2023-33493](https://cve.now/CVE-2023-33493.md): An Unrestricted Upload of File with Dangerous Type vulnerability in the Ajaxmanager File and Database explorer (ajaxmanager) module for Pres (CVSS 9.8)
- [CVE-2023-33560](https://cve.now/CVE-2023-33560.md): There is a Cross Site Scripting (XSS) vulnerability in "cid" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3. (no CVSS)
- [CVE-2023-33561](https://cve.now/CVE-2023-33561.md): Improper input validation of password parameter in PHP Jabbers Time Slots Booking Calendar v 3.3 results in insecure passwords. (no CVSS)
- [CVE-2023-33562](https://cve.now/CVE-2023-33562.md): User enumeration is found in in PHP Jabbers Time Slots Booking Calendar v3.3. (no CVSS)
- [CVE-2023-33563](https://cve.now/CVE-2023-33563.md): In PHP Jabbers Time Slots Booking Calendar 3.3 , lack of verification when changing an email address and/or password (on the Profile Page) a (no CVSS)
- [CVE-2023-33564](https://cve.now/CVE-2023-33564.md): There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Time Slots Booking Calendar v3.3. (no CVSS)
- [CVE-2023-34551](https://cve.now/CVE-2023-34551.md): In certain EZVIZ products, two stack buffer overflows in netClientSetWlanCfg function of the EZVIZ SDK command server can allow an authentic (no CVSS)
- [CVE-2023-34552](https://cve.now/CVE-2023-34552.md): In certain EZVIZ products, two stack based buffer overflows in mulicast\_parse\_sadp\_packet and mulicast\_get\_pack\_type functions of the SADP m (CVSS 4.0)
- [CVE-2023-34634](https://cve.now/CVE-2023-34634.md): Greenshot 1.2.10 and below allows arbitrary code execution because .NET content is insecurely deserialized when a .greenshot file is opened. (no CVSS)
- [CVE-2023-34869](https://cve.now/CVE-2023-34869.md): PHPJabbers Catering System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php?controller (no CVSS)
- [CVE-2023-34960](https://cve.now/CVE-2023-34960.md): A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.\* up to v1.11.18 allows attackers to execute arbitrary comm (no CVSS)
- [CVE-2023-36118](https://cve.now/CVE-2023-36118.md): Cross Site Scripting vulnerability in Faculty Evaulation System using PHP/MySQLi v.1.0 allows an attacker to execute arbitrary code via a cr (no CVSS)
- [CVE-2023-36121](https://cve.now/CVE-2023-36121.md): Cross Site Scripting vulnerability in e107 v.2.3.2 allows a remote attacker to execute arbitrary code via the description function in the SE (no CVSS)
- [CVE-2023-36210](https://cve.now/CVE-2023-36210.md): MotoCMS Version 3.4.3 Store Category Template was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the keywor (no CVSS)
- [CVE-2023-36211](https://cve.now/CVE-2023-36211.md): The Barebones CMS v2.0.2 is vulnerable to Stored Cross-Site Scripting (XSS) when an authenticated user interacts with certain features on th (no CVSS)
- [CVE-2023-36351](https://cve.now/CVE-2023-36351.md): An issue in Viatom Health ViHealth for Android v.2.74.58 and before allows a remote attacker to execute arbitrary code via the com.viatom.ba (no CVSS)
- [CVE-2023-36983](https://cve.now/CVE-2023-36983.md): LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. (no CVSS)
- [CVE-2023-36984](https://cve.now/CVE-2023-36984.md): LavaLite CMS v 9.0.0 is vulnerable to Sensitive Data Exposure. (no CVSS)
- [CVE-2023-37772](https://cve.now/CVE-2023-37772.md): Online Shopping Portal Project v3.1 was discovered to contain a SQL injection vulnerability via the Email parameter at /shopping/login.php. (no CVSS)
- [CVE-2023-38357](https://cve.now/CVE-2023-38357.md): Session tokens in RWS WorldServer 11.7.3 and earlier have a low entropy and can be enumerated, leading to unauthorized access to user sessio (no CVSS)
- [CVE-2023-38990](https://cve.now/CVE-2023-38990.md): An issue in the delete function in the MenuController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete menus cre (no CVSS)
- [CVE-2023-39108](https://cve.now/CVE-2023-39108.md): rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path\_b parameter in the doDiff Function of /classes/co (no CVSS)
- [CVE-2023-39109](https://cve.now/CVE-2023-39109.md): rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path\_a parameter in the doDiff Function of /classes/co (no CVSS)
- [CVE-2023-39110](https://cve.now/CVE-2023-39110.md): rconfig v3.9.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the path parameter at /ajaxGetFileByPath.php. (no CVSS)
- [CVE-2023-39147](https://cve.now/CVE-2023-39147.md): An arbitrary file upload vulnerability in Uvdesk 1.1.3 allows attackers to execute arbitrary code via uploading a crafted image file. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.