CVEs published August 2, 2023
55 CVEs were published on August 2, 2023: 2 critical, 10 high.
- Published
- 55
- Critical
- 2
- High
- 10
- Medium
- 24
- Low
- 4
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- OX Software OX App Suite
- 14
- GitLab
- 7
- F5 BIG-IP
- 3
- Brocade Fabric OS
- 2
- F5 BIG-IP Edge Client
- 2
- golang.org/x/image/tiff · golang.org/x/image
- 2
- Octopus Deploy Octopus Server
- 2
- Advantech WebAccess/SCADA
- 1
- Emerson Electric DL8000 · Emerson Electric ROC827 +2
- 1
- F5 BIG-IP · F5 BIG-IQ
- 1
Critical 2
High 10
- CVE-2023-38418BIG-IP Edge Client for macOS vulnerabilityF5 BIG-IP Edge Client
- CVE-2023-38138BIG-IP Configuration utility vulnerabilityF5 BIG-IP
- CVE-2023-36858BIG-IP Edge Client for Windows and macOS vulnerabilityF5 BIG-IP Edge Client
- CVE-2022-40609IBM SDK, Java Technology Edition code executionIBM SDK, Java Technology Edition
- CVE-2023-26451Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service.OX Software OX App Suite
- CVE-2023-26440The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be eOX Software OX App Suite
- CVE-2023-26439The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL OX Software OX App Suite
- CVE-2023-31926Arbitrary File Overwrite using less commandBrocade Fabric OS
- CVE-2023-3994Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2023-26317Xiaomi router external request interface has command injectionXiaomi router
Medium, low and unrated 43
- CVE-2023-3329CVE-2023-3329iniNet SCADAWebServer
- CVE-2023-29407Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiffgolang.org/x/image/tiff · golang.org/x/image
- CVE-2023-29408Excessive resource consumption in golang.org/x/image/tiffgolang.org/x/image/tiff · golang.org/x/image
- CVE-2023-3978Improper rendering of text nodes in golang.org/x/net/htmlgolang.org/x/net/html · golang.org/x/net
- CVE-2023-29409Large RSA keys can cause high CPU usage in crypto/tlsGo standard library crypto/tls · stdlib
- CVE-2023-38423BIG-IP Configuration utility vulnerabilityF5 BIG-IP
- CVE-2023-38419BIG-IP and BIG-IQ iControl SOAP vulnerabilityF5 BIG-IP · F5 BIG-IQ
- CVE-2023-36494F5OS-A vulnerabilityF5OS - Appliance
- CVE-2023-3470BIG-IP FIPS HSM password vulnerability CVE-2023-3470F5 BIG-IP
- CVE-2023-23476IBM Robotic Process Automation information disclosureIBM Robotic Process Automation
- CVE-2023-26450The "OX Count" web service did not specify a media-type when processing responses by external resources.OX Software OX App Suite
- CVE-2023-26449The "OX Chat" web service did not specify a media-type when processing responses by external resources.OX Software OX App Suite
- CVE-2023-26448Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers.OX Software OX App Suite
- CVE-2023-26447The "upsell" widget for the portal allows to specify a product description.OX Software OX App Suite
- CVE-2023-26446The users clientID at "application passwords" was not sanitized or escaped before being added to DOM.OX Software OX App Suite
- CVE-2023-26445Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login.OX Software OX App Suite
- CVE-2023-26443Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements.OX Software OX App Suite
- CVE-2023-26442In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend.OX Software OX App Suite
- CVE-2023-26441Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources.OX Software OX App Suite
- CVE-2023-26438External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS cOX Software OX App Suite
- CVE-2023-26430Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules.OX Software OX App Suite
- CVE-2023-3426The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permissiLiferay DXP · Liferay Portal +2
- CVE-2023-4067Bus Ticket Booking with Seat Reservation <= 5.2.3 - Reflected Cross-Site Scriptingmagepeopleteam Bus Ticket Booking with Seat Reservation
- CVE-2023-2022Missing Authorization in GitLabGitLab
- CVE-2023-3401Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2023-38556Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the printer.SEIKO EPSON printer Web Config
- CVE-2023-4011Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2022-2416In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of anOctopus Deploy Octopus Server
- CVE-2023-4016Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlimLinux Kernal
- CVE-2022-2346In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints.Octopus Deploy Octopus Server
- CVE-2023-3500Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2023-3900Improper Validation of Specified Type of Input in GitLabGitLab
- CVE-2023-3993Insertion of Sensitive Information into Log File in GitLabGitLab
- CVE-2023-31927An information disclosure in the web interface of Brocade Fabric OSBrocade Fabric OS
- CVE-2022-46484Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers
- CVE-2022-46485Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Fi
- CVE-2023-26316A XSS vulnerability exists in the Xiaomi cloud service Application product.Xiaomi cloud service Application
- CVE-2023-33257Verint Engagement Management 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat.
- CVE-2023-33383Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a dev
- CVE-2023-36081Cross Site Scripting vulnerability in GatesAIr Flexiva FM Transmitter/Exciter v.FAX 150W allows a remote attacker to execute arbitrary code
- CVE-2023-38330OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area.
- CVE-2023-39113ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c.
- CVE-2023-39114ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL_LoadAnimatedGif at ngiflibSDL.c.