CVEs published August 3, 2023
149 CVEs were published on August 3, 2023: 3 critical, 27 high. 2 are now in CISA KEV.
- Published
- 149
- Critical
- 3
- High
- 27
- Medium
- 46
- Low
- 3
- Unrated
- 70
- Now in CISA KEV
- 2
- Fix available
- 51
Most affected products
- CODESYS Control for BeagleBone SL · CODESYS Control for… +14
- 15
- Google Chrome
- 11
- Axis Communications AB AXIS License Plate Verifier
- 6
- OMRON CX-Programmer
- 6
- answerdev/answer · github.com/answerdev/answer
- 4
- HCL Software HCL Unica Platform
- 4
- CODESYS Development System
- 3
- Byzoro Smart S85F Management Platform
- 2
- Cisco BroadWorks
- 2
- Cisco Small Business IP Phones
- 2
Critical 3
- CVE-2023-20214A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, rCisco SD-WAN vManage
- CVE-2023-3346Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC SeriesMitsubishi Electric MITSUBISHI CNC M800V Series M800VW… +18
- CVE-2023-38951ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the
High 27
- CVE-2023-0525Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 modMitsubishi Electric GOT2000 Series GT27 model · Mitsubis… +6
- CVE-2023-37501A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica CampaignHCL Software HCL Unica Campaign
- CVE-2023-37500A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica PlatformHCL Software HCL Unica Platform
- CVE-2023-37499A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica PlatformHCL Software HCL Unica Platform
- CVE-2023-37498HCL Unica Platform is vulnerable to a privilege escalation by unauthorized group assignationHCL Software HCL Unica Platform
- CVE-2023-37497An XML External Entity (XXE) Injection Vulnerability affects HCL Unica Platform HCL Software HCL Unica Platform
- CVE-2023-3749VideoEdge configSensormatic Electronics, a subsidiary of Johnson Controls V…
- CVE-2023-0956TEL-STER TelWin SCADA WebInterface Path TraversalTEL-STER TelWin SCADA WebInterface
- CVE-2023-35081A path traversal vulnerability in Ivanti EPMM versions (11.10.x < 11.10.0.3, 11.9.x < 11.9.1.2 and 11.8.x < 11.8.1.2) allows an authenticatIvanti EPMM
- CVE-2023-2754Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP clientCloudflare WARP
- CVE-2023-4136Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter EngineCrafterCMS · org.craftercms:crafter-engine
- CVE-2022-34453 Dell XtremIO X2 XMS versions prior to 6-4-1.11 contain an improper access control vulnerability.Dell XtremIO X2
- CVE-2022-4046CODESYS: Improper memory restrictions fro CODESYS ControlCODESYS Control for BeagleBone SL · CODESYS Control for… +12
- CVE-2023-3662CODESYS: Vulnerability in CODESYS Development System allows for execution of binariesCODESYS Development System
- CVE-2023-3663CODESYS: Missing integrity check in CODESYS Development SystemCODESYS Development System
- CVE-2023-21412Non-sanitized user input could lead to SQL injections in AXIS License Plate VerifierAxis Communications AB AXIS License Plate Verifier
- CVE-2023-21411Non-sanitized user input could lead to arbitrary code execution during Access Control configuration in AXIS License Plate VerifierAxis Communications AB AXIS License Plate Verifier
- CVE-2023-21410Non-sanitized user input could lead to arbitrary code execution in AXIS License Plate VerifierAxis Communications AB AXIS License Plate Verifier
- CVE-2023-21409Insufficient file permissions leak administrator-privileged credentials in AXIS License Verifier ACAPAxis Communications AB AXIS License Plate Verifier
- CVE-2023-21408Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAPAxis Communications AB AXIS License Plate Verifier
- CVE-2023-21407Privilege escalation in AXIS License Plate Verifier ACAPAxis Communications AB AXIS License Plate Verifier
- CVE-2023-3932Incorrect User Management in GitLabGitLab
- CVE-2023-4125Weak Password Requirements in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-4124Missing Authorization in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-38947An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code
- CVE-2023-38950A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via suppl
- CVE-2023-38952Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that ses
Medium, low and unrated 119
- CVE-2023-3373Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 aMitsubishi Electric GOT2000 Series GT21 model · Mitsubishi…
- CVE-2023-20181A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remoteCisco Small Business IP Phones
- CVE-2023-20218A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remoCisco Small Business IP Phones
- CVE-2023-20216A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker Cisco BroadWorks
- CVE-2023-20215A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote attaCisco Secure Web Appliance
- CVE-2023-20204A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remotCisco BroadWorks
- CVE-2023-30952Foundry Issues reporterPath phishing by parameter injectioncom.palantir.foundry:foundry-frontend
- CVE-2023-30950CVE-2023-30950 com.palantir.campaigns:campaigns
- CVE-2023-30958DOM XSS in Developer mode dashboard via redirect GET parametercom.palantir.foundry:foundry-frontend
- CVE-2023-30951CVE-2023-30951 com.palantir.magritte:magritte-rest-source-bundle
- CVE-2023-25524 NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where a user’s access tokeNVIDIA Omniverse Workstation Launcher
- CVE-2023-4145Cross-site Scripting (XSS) - Stored in pimcore/customer-data-frameworkpimcore/customer-data-framework · pimcore/customer-manageme…
- CVE-2023-4132Kernel: smsusb: use-after-free caused by do_submit_urb()Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…
- CVE-2023-4133Kernel: cxgb4: use-after-free in ch_flower_stats_cb()Red Hat Enterprise Linux
- CVE-2023-3180Heap buffer overflow in virtio_crypto_sym_op_helper()qemu · Red Hat Enterprise Linux +1
- CVE-2023-3766Invalid Slice Split Results in Server PanicCloudflare odoh-rs · odoh-rs
- CVE-2023-3348Directory traversal vulnerability in Cloudflare WranglerCloudflare Wrangler · wrangler
- CVE-2023-4138Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2022-26838Path traversal vulnerability in Importing Mobile Device Data of Cybozu Remote Service 3.1.2 allows a remote authenticated attacker to cause Cybozu Remote Service
- CVE-2023-22277Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier.OMRON CX-Programmer
- CVE-2023-22314Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier.OMRON CX-Programmer
- CVE-2023-22317Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier.OMRON CX-Programmer
- CVE-2023-3669CODESYS: Missing Brute-Force protection in CODESYS Development SystemCODESYS Development System
- CVE-2023-37559CODESYS Improper Validation of Consistency within Input in multiple productsCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37558CODESYS Improper Validation of Consistency within Input in multiple productsCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37557CODESYS Heap-based Buffer Overflow in multiple productsCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37556CODESYS Improper Input Validation in CmpAppBPCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37555CODESYS Improper Input Validation in CmpAppBPCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37554CODESYS Improper Input Validation in CmpAppBPCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37553CODESYS Improper Input Validation in CmpAppBPCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37552CODESYS Improper Input Validation in CmpAppBPCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37551CODESYS Files or Directories Accessible to External Parties in CmpAppCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37550CODESYS: Improper Input Validation in CmpApp componentCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37549CODESYS: Improper Input Validation in CmpApp componentCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37548CODESYS: Improper Input Validation in CmpApp componentCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37547CODESYS: Improper Input Validation in CmpApp componentCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37546CODESYS: Improper Input Validation in CmpApp componentCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-37545CODESYS: Improper Input Validation in CmpApp componentCODESYS Control for BeagleBone SL · CODESYS Control for… +14
- CVE-2023-4121Byzoro Smart S85F Management Platform unrestricted uploadByzoro Smart S85F Management Platform
- CVE-2023-4120Byzoro Smart S85F Management Platform importhtml.php command injectionByzoro Smart S85F Management Platform
- CVE-2023-4119Academy LMS courses cross site scriptingAcademy LMS
- CVE-2023-4118Cute Http File Server Search cross site scriptingCute Http File Server
- CVE-2023-4117PHP Jabbers Rental Property Booking index.php cross site scriptingPHP Jabbers Rental Property Booking
- CVE-2023-4116PHP Jabbers Taxi Booking index.php cross site scriptingPHP Jabbers Taxi Booking
- CVE-2023-4008Incorrect Ownership Assignment in GitLabGitLab
- CVE-2023-4115PHP Jabbers Cleaning Business index.php cross site scriptingPHP Jabbers Cleaning Business
- CVE-2023-4114PHP Jabbers Night Club Booking Software index.php cross site scriptingPHP Jabbers Night Club Booking Software
- CVE-2023-38748Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier.OMRON CX-Programmer
- CVE-2023-38747Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier.OMRON CX-Programmer
- CVE-2023-4113PHP Jabbers Service Booking Script index.php cross site scriptingPHP Jabbers Service Booking Script
- CVE-2023-38746Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL[][]D-V4 V9.80 and earlier.OMRON CX-Programmer
- CVE-2023-38744Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port ofOMRON CJ2M CPU Unit · OMRON CJ2H CPU Unit +1
- CVE-2023-4112PHP Jabbers Shuttle Booking Software index.php cross site scriptingPHP Jabbers Shuttle Booking Software
- CVE-2023-4111PHP Jabbers Bus Reservation System index.php cross site scriptingPHP Jabbers Bus Reservation System
- CVE-2023-4127Race Condition within a Thread in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-4126Insufficient Session Expiration in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-4110PHP Jabbers Availability Booking Calendar index.php cross site scriptingPHP Jabbers Availability Booking Calendar
- CVE-2023-4078Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a maGoogle Chrome
- CVE-2023-4077Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a maGoogle Chrome
- CVE-2023-4076Use after free in WebRTC in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2023-4075Use after free in Cast in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2023-4074Use after free in Blink Task Scheduling in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruGoogle Chrome
- CVE-2023-4073Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap cGoogle Chrome
- CVE-2023-4072Out of bounds read and write in WebGL in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2023-4071Heap buffer overflow in Visuals in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2023-4070Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pGoogle Chrome
- CVE-2023-4069Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2023-4068Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML pGoogle Chrome
- CVE-2020-20808Cross Site Scripting vulnerability in Qibosoft qibosoft v.7 and before allows a remote attacker to execute arbitrary code via the eindtijd a
- CVE-2023-25600An issue was discovered in InsydeH2O.
- CVE-2023-26979Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel.
- CVE-2023-28468An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2023-30297An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring fu
- CVE-2023-32764Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator.
- CVE-2023-33363An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to access some functiona
- CVE-2023-33364An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS co
- CVE-2023-33365A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch arbitrary files fro
- CVE-2023-33366A SQL injection vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows authenticated users to inject arbitrary SQL directives
- CVE-2023-33368Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these
- CVE-2023-33369A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure fi
- CVE-2023-33370An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDS
- CVE-2023-33371Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers
- CVE-2023-33665ai-dev aitable before v0.2.2 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php.
- CVE-2023-33666ai-dev aioptimizedcombinations before v0.1.3 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php.
- CVE-2023-34196In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an a
- CVE-2023-36082An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials.
- CVE-2023-36131PHPJabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control due to improper input validation of password paramete
- CVE-2023-36132PHP Jabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control.
- CVE-2023-36133PHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change.
- CVE-2023-36134In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows
- CVE-2023-36135User enumeration is found in in PHPJabbers Class Scheduling System v1.0.
- CVE-2023-36137There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0.
- CVE-2023-36138PHPJabbers Cleaning Business Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php.
- CVE-2023-36139In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allo
- CVE-2023-36141User enumeration is found in in PHPJabbers Cleaning Business Software 1.0.
- CVE-2023-36158Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via
- CVE-2023-36159Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary co
- CVE-2023-36212File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page fu
- CVE-2023-36213SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function.
- CVE-2023-36217Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 allows a remote attacker to execute arbitrary code via the category name field of t
- CVE-2023-36255An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path
- CVE-2023-36298DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE).
- CVE-2023-36299A File Upload vulnerability in typecho v.1.2.1 allows a remote attacker to execute arbitrary code via the upload and options-general paramet
- CVE-2023-37364In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution.
- CVE-2023-37679A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the…
- CVE-2023-38941django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspanel/admin_view.py ->
- CVE-2023-38942Dango-Translator v4.5.5 was discovered to contain a remote command execution (RCE) vulnerability via the component app/config/cloud_config.j
- CVE-2023-38948An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary
- CVE-2023-38949An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a cra
- CVE-2023-38954ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability.
- CVE-2023-38955ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP a
- CVE-2023-38956A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a craft
- CVE-2023-38958An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by t
- CVE-2023-38991An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete model
- CVE-2023-39075Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) allows attackers to c
- CVE-2023-39096WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and output encoding.
- CVE-2023-39097WebBoss.io CMS v3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability.
- CVE-2023-39121emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php.
- CVE-2023-39144Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext.