# CVEs published 2023-08-02

55 CVEs were published on August 2, 2023: 2 critical, 10 high. Days are UTC.

- [CVE-2023-1935](https://cve.now/CVE-2023-1935.md): CVE-2023-1935 (CVSS 9.4, Emerson Electric DL8000 · Emerson Electric ROC827 +2)
- [CVE-2023-1437](https://cve.now/CVE-2023-1437.md): CVE-2023-1437 (CVSS 9.8, Advantech WebAccess/SCADA)
- [CVE-2023-3329](https://cve.now/CVE-2023-3329.md): CVE-2023-3329 (no CVSS, iniNet SCADAWebServer)
- [CVE-2023-29407](https://cve.now/CVE-2023-29407.md): Excessive CPU consumption when decoding 0-height images in golang.org/x/image/tiff (no CVSS, golang.org/x/image/tiff · golang.org/x/image)
- [CVE-2023-29408](https://cve.now/CVE-2023-29408.md): Excessive resource consumption in golang.org/x/image/tiff (no CVSS, golang.org/x/image/tiff · golang.org/x/image)
- [CVE-2023-3978](https://cve.now/CVE-2023-3978.md): Improper rendering of text nodes in golang.org/x/net/html (no CVSS, golang.org/x/net/html · golang.org/x/net)
- [CVE-2023-29409](https://cve.now/CVE-2023-29409.md): Large RSA keys can cause high CPU usage in crypto/tls (no CVSS, Go standard library crypto/tls · stdlib)
- [CVE-2023-38423](https://cve.now/CVE-2023-38423.md): BIG-IP Configuration utility vulnerability (CVSS 5.4, F5 BIG-IP)
- [CVE-2023-38419](https://cve.now/CVE-2023-38419.md): BIG-IP and BIG-IQ iControl SOAP vulnerability (CVSS 4.3, F5 BIG-IP · F5 BIG-IQ)
- [CVE-2023-38418](https://cve.now/CVE-2023-38418.md): BIG-IP Edge Client for macOS vulnerability (CVSS 7.8, F5 BIG-IP Edge Client)
- [CVE-2023-38138](https://cve.now/CVE-2023-38138.md): BIG-IP Configuration utility vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-36858](https://cve.now/CVE-2023-36858.md): BIG-IP Edge Client for Windows and macOS vulnerability (CVSS 7.1, F5 BIG-IP Edge Client)
- [CVE-2023-36494](https://cve.now/CVE-2023-36494.md): F5OS-A vulnerability (CVSS 4.4, F5OS - Appliance)
- [CVE-2023-3470](https://cve.now/CVE-2023-3470.md): BIG-IP FIPS HSM password vulnerability CVE-2023-3470 (CVSS 6.0, F5 BIG-IP)
- [CVE-2023-23476](https://cve.now/CVE-2023-23476.md): IBM Robotic Process Automation information disclosure (CVSS 3.1, IBM Robotic Process Automation)
- [CVE-2022-40609](https://cve.now/CVE-2022-40609.md): IBM SDK, Java Technology Edition code execution (CVSS 8.1, IBM SDK, Java Technology Edition)
- [CVE-2023-26451](https://cve.now/CVE-2023-26451.md): Functions with insufficient randomness were used to generate authorization tokens of the integrated oAuth Authorization Service. (CVSS 7.5, OX Software OX App Suite)
- [CVE-2023-26450](https://cve.now/CVE-2023-26450.md): The "OX Count" web service did not specify a media-type when processing responses by external resources. (CVSS 5.4, OX Software OX App Suite)
- [CVE-2023-26449](https://cve.now/CVE-2023-26449.md): The "OX Chat" web service did not specify a media-type when processing responses by external resources. (CVSS 5.4, OX Software OX App Suite)
- [CVE-2023-26448](https://cve.now/CVE-2023-26448.md): Custom log-in and log-out locations are used-defined as jslob but were not checked to contain malicious protocol handlers. (CVSS 5.4, OX Software OX App Suite)
- [CVE-2023-26447](https://cve.now/CVE-2023-26447.md): The "upsell" widget for the portal allows to specify a product description. (CVSS 5.4, OX Software OX App Suite)
- [CVE-2023-26446](https://cve.now/CVE-2023-26446.md): The users clientID at "application passwords" was not sanitized or escaped before being added to DOM. (CVSS 5.4, OX Software OX App Suite)
- [CVE-2023-26445](https://cve.now/CVE-2023-26445.md): Frontend themes are defined by user-controllable jslob settings and could point to a malicious resource which gets processed during login. (CVSS 5.4, OX Software OX App Suite)
- [CVE-2023-26443](https://cve.now/CVE-2023-26443.md): Full-text autocomplete search allows user-provided SQL syntax to be injected to SQL statements. (CVSS 5.5, OX Software OX App Suite)
- [CVE-2023-26442](https://cve.now/CVE-2023-26442.md): In case Cacheservice was configured to use a sproxyd object-storage backend, it would follow HTTP redirects issued by that backend. (CVSS 3.2, OX Software OX App Suite)
- [CVE-2023-26441](https://cve.now/CVE-2023-26441.md): Cacheservice did not correctly check if relative cache object were pointing to the defined absolute location when accessing resources. (CVSS 5.7, OX Software OX App Suite)
- [CVE-2023-26440](https://cve.now/CVE-2023-26440.md): The cacheservice API could be abused to indirectly inject parameters with SQL syntax which was insufficiently sanitized and would later be e (CVSS 7.1, OX Software OX App Suite)
- [CVE-2023-26439](https://cve.now/CVE-2023-26439.md): The cacheservice API could be abused to inject parameters with SQL syntax which was insufficiently sanitized before getting executed as SQL (CVSS 7.6, OX Software OX App Suite)
- [CVE-2023-26438](https://cve.now/CVE-2023-26438.md): External service lookups for a number of protocols were vulnerable to a time-of-check/time-of-use (TOCTOU) weakness, involving the JDK DNS c (CVSS 4.3, OX Software OX App Suite)
- [CVE-2023-26430](https://cve.now/CVE-2023-26430.md): Attackers with access to user accounts can inject arbitrary control characters to SIEVE mail-filter rules. (CVSS 3.5, OX Software OX App Suite)
- [CVE-2023-3426](https://cve.now/CVE-2023-3426.md): The organization selector in Liferay Portal 7.4.3.81 through 7.4.3.85, and Liferay DXP 7.4 update 81 through 85 does not check user permissi (CVSS 4.3, Liferay DXP · Liferay Portal +2)
- [CVE-2023-4067](https://cve.now/CVE-2023-4067.md): Bus Ticket Booking with Seat Reservation \<= 5.2.3 - Reflected Cross-Site Scripting (CVSS 6.1, magepeopleteam Bus Ticket Booking with Seat Reservation)
- [CVE-2023-2022](https://cve.now/CVE-2023-2022.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2023-3401](https://cve.now/CVE-2023-3401.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 4.8, GitLab)
- [CVE-2023-38556](https://cve.now/CVE-2023-38556.md): Improper input validation vulnerability in SEIKO EPSON printer Web Config allows a remote attacker to turned off the printer. (no CVSS, SEIKO EPSON printer Web Config)
- [CVE-2023-4011](https://cve.now/CVE-2023-4011.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 4.3, GitLab)
- [CVE-2022-2416](https://cve.now/CVE-2022-2416.md): In affected versions of Octopus Deploy it is possible for a low privileged guest user to craft a request that allows enumeration/recon of an (CVSS 5.5, Octopus Deploy Octopus Server)
- [CVE-2023-4016](https://cve.now/CVE-2023-4016.md): Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability to write almost unlim (CVSS 2.5, Linux Kernal)
- [CVE-2022-2346](https://cve.now/CVE-2022-2346.md): In affected versions of Octopus Deploy it is possible for a low privileged guest user to interact with extension endpoints. (CVSS 5.5, Octopus Deploy Octopus Server)
- [CVE-2023-31926](https://cve.now/CVE-2023-31926.md): Arbitrary File Overwrite using less command (CVSS 7.1, Brocade Fabric OS)
- [CVE-2023-3500](https://cve.now/CVE-2023-3500.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 4.8, GitLab)
- [CVE-2023-3900](https://cve.now/CVE-2023-3900.md): Improper Validation of Specified Type of Input in GitLab (CVSS 4.3, GitLab)
- [CVE-2023-3993](https://cve.now/CVE-2023-3993.md): Insertion of Sensitive Information into Log File in GitLab (CVSS 4.9, GitLab)
- [CVE-2023-3994](https://cve.now/CVE-2023-3994.md): Inefficient Regular Expression Complexity in GitLab (CVSS 7.5, GitLab)
- [CVE-2023-31927](https://cve.now/CVE-2023-31927.md): An information disclosure in the web interface of Brocade Fabric OS (CVSS 5.3, Brocade Fabric OS)
- [CVE-2022-46484](https://cve.now/CVE-2022-46484.md): Information disclosure in password protected surveys in Data Illusion Survey Software Solutions NGSurvey v2.4.28 and below allows attackers (no CVSS)
- [CVE-2022-46485](https://cve.now/CVE-2022-46485.md): Data Illusion Survey Software Solutions ngSurvey version 2.4.28 and below is vulnerable to Denial of Service if a survey contains a "Text Fi (no CVSS)
- [CVE-2023-26316](https://cve.now/CVE-2023-26316.md): A XSS vulnerability exists in the Xiaomi cloud service Application product. (no CVSS, Xiaomi cloud service Application)
- [CVE-2023-26317](https://cve.now/CVE-2023-26317.md): Xiaomi router external request interface has command injection (CVSS 7.0, Xiaomi router)
- [CVE-2023-33257](https://cve.now/CVE-2023-33257.md): Verint Engagement Management 15.3 Update 2023R2 is vulnerable to HTML injection via the user data form in the live chat. (no CVSS)
- [CVE-2023-33383](https://cve.now/CVE-2023-33383.md): Shelly 4PM Pro four-channel smart switch 0.11.0 allows an attacker to trigger a BLE out of bounds read fault condition that results in a dev (no CVSS)
- [CVE-2023-36081](https://cve.now/CVE-2023-36081.md): Cross Site Scripting vulnerability in GatesAIr Flexiva FM Transmitter/Exciter v.FAX 150W allows a remote attacker to execute arbitrary code (no CVSS)
- [CVE-2023-38330](https://cve.now/CVE-2023-38330.md): OXID eShop Enterprise Edition 6.5.0 – 6.5.2 before 6.5.3 allows uploading files with modified headers in the administration area. (no CVSS)
- [CVE-2023-39113](https://cve.now/CVE-2023-39113.md): ngiflib commit fb271 was discovered to contain a segmentation violation via the function "main" at gif2tag.c. (no CVSS)
- [CVE-2023-39114](https://cve.now/CVE-2023-39114.md): ngiflib commit 84a75 was discovered to contain a segmentation violation via the function SDL\_LoadAnimatedGif at ngiflibSDL.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.