# CVEs published 2023-08-03

149 CVEs were published on August 3, 2023: 3 critical, 27 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-3373](https://cve.now/CVE-2023-3373.md): Predictable Exact Value from Previous Values vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT21 model versions 01.49.000 a (CVSS 5.9, Mitsubishi Electric GOT2000 Series GT21 model · Mitsubishi…)
- [CVE-2023-0525](https://cve.now/CVE-2023-0525.md): Weak Encoding for Password vulnerability in Mitsubishi Electric Corporation GOT2000 Series GT27 model versions 01.49.000 and prior, GT25 mod (CVSS 7.5, Mitsubishi Electric GOT2000 Series GT27 model · Mitsubis… +6)
- [CVE-2023-37501](https://cve.now/CVE-2023-37501.md): A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Campaign (CVSS 8.1, HCL Software HCL Unica Campaign)
- [CVE-2023-37500](https://cve.now/CVE-2023-37500.md): A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform (CVSS 8.1, HCL Software HCL Unica Platform)
- [CVE-2023-37499](https://cve.now/CVE-2023-37499.md): A Persistent Cross-site Scripting (XSS) vulnerability affects HCL Unica Platform (CVSS 8.1, HCL Software HCL Unica Platform)
- [CVE-2023-37498](https://cve.now/CVE-2023-37498.md): HCL Unica Platform is vulnerable to a privilege escalation by unauthorized group assignation (CVSS 8.1, HCL Software HCL Unica Platform)
- [CVE-2023-20214](https://cve.now/CVE-2023-20214.md): A vulnerability in the request authentication validation for the REST API of Cisco SD-WAN vManage software could allow an unauthenticated, r (CVSS 9.1, Cisco SD-WAN vManage)
- [CVE-2023-20181](https://cve.now/CVE-2023-20181.md): A vulnerability in the web-based management interface of Cisco Small Business SPA500 Series IP Phones could allow an unauthenticated, remote (CVSS 6.1, Cisco Small Business IP Phones)
- [CVE-2023-20218](https://cve.now/CVE-2023-20218.md): A vulnerability in web-based management interface of Cisco SPA500 Series Analog Telephone Adapters (ATAs) could allow an authenticated, remo (CVSS 5.8, Cisco Small Business IP Phones)
- [CVE-2023-20216](https://cve.now/CVE-2023-20216.md): A vulnerability in the privilege management functionality of all Cisco BroadWorks server types could allow an authenticated, local attacker (CVSS 4.4, Cisco BroadWorks)
- [CVE-2023-20215](https://cve.now/CVE-2023-20215.md): A vulnerability in the scanning engines of Cisco AsyncOS Software for Cisco Secure Web Appliance could allow an unauthenticated, remote atta (CVSS 5.8, Cisco Secure Web Appliance)
- [CVE-2023-20204](https://cve.now/CVE-2023-20204.md): A vulnerability in the web-based management interface of Cisco BroadWorks CommPilot Application Software could allow an authenticated, remot (CVSS 5.4, Cisco BroadWorks)
- [CVE-2023-37497](https://cve.now/CVE-2023-37497.md): An XML External Entity (XXE) Injection Vulnerability affects HCL Unica Platform (CVSS 8.1, HCL Software HCL Unica Platform)
- [CVE-2023-30952](https://cve.now/CVE-2023-30952.md): Foundry Issues reporterPath phishing by parameter injection (CVSS 5.0, com.palantir.foundry:foundry-frontend)
- [CVE-2023-30950](https://cve.now/CVE-2023-30950.md): CVE-2023-30950 (CVSS 6.5, com.palantir.campaigns:campaigns)
- [CVE-2023-30958](https://cve.now/CVE-2023-30958.md): DOM XSS in Developer mode dashboard via redirect GET parameter (CVSS 4.7, com.palantir.foundry:foundry-frontend)
- [CVE-2023-30951](https://cve.now/CVE-2023-30951.md): CVE-2023-30951 (CVSS 6.3, com.palantir.magritte:magritte-rest-source-bundle)
- [CVE-2023-3749](https://cve.now/CVE-2023-3749.md): VideoEdge config (CVSS 7.1, Sensormatic Electronics, a subsidiary of Johnson Controls V…)
- [CVE-2023-0956](https://cve.now/CVE-2023-0956.md): TEL-STER TelWin SCADA WebInterface Path Traversal (CVSS 7.5, TEL-STER TelWin SCADA WebInterface)
- [CVE-2023-35081](https://cve.now/CVE-2023-35081.md): A path traversal vulnerability in Ivanti EPMM versions (11.10.x \< 11.10.0.3, 11.9.x \< 11.9.1.2 and 11.8.x \< 11.8.1.2) allows an authenticat (CVSS 7.2, KEV, Ivanti EPMM)
- [CVE-2023-25524](https://cve.now/CVE-2023-25524.md): NVIDIA Omniverse Workstation Launcher for Windows and Linux contains a vulnerability in the authentication flow, where a user’s access toke (CVSS 4.0, NVIDIA Omniverse Workstation Launcher)
- [CVE-2023-4145](https://cve.now/CVE-2023-4145.md): Cross-site Scripting (XSS) - Stored in pimcore/customer-data-framework (CVSS 6.5, pimcore/customer-data-framework · pimcore/customer-manageme…)
- [CVE-2023-4132](https://cve.now/CVE-2023-4132.md): Kernel: smsusb: use-after-free caused by do\_submit\_urb() (CVSS 5.5, Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…)
- [CVE-2023-4133](https://cve.now/CVE-2023-4133.md): Kernel: cxgb4: use-after-free in ch\_flower\_stats\_cb() (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2023-3180](https://cve.now/CVE-2023-3180.md): Heap buffer overflow in virtio\_crypto\_sym\_op\_helper() (CVSS 6.0, qemu · Red Hat Enterprise Linux +1)
- [CVE-2023-2754](https://cve.now/CVE-2023-2754.md): Plaintext transmission of DNS requests in Windows 1.1.1.1 WARP client (CVSS 7.4, Cloudflare WARP)
- [CVE-2023-3766](https://cve.now/CVE-2023-3766.md): Invalid Slice Split Results in Server Panic (CVSS 5.9, Cloudflare odoh-rs · odoh-rs)
- [CVE-2023-3348](https://cve.now/CVE-2023-3348.md): Directory traversal vulnerability in Cloudflare Wrangler (CVSS 5.7, Cloudflare Wrangler · wrangler)
- [CVE-2023-4138](https://cve.now/CVE-2023-4138.md): Allocation of Resources Without Limits or Throttling in ikus060/rdiffweb (CVSS 4.2, ikus060/rdiffweb · rdiffweb)
- [CVE-2023-4136](https://cve.now/CVE-2023-4136.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Crafter Engine (CVSS 7.4, CrafterCMS · org.craftercms:crafter-engine)
- [CVE-2022-26838](https://cve.now/CVE-2022-26838.md): Path traversal vulnerability in Importing Mobile Device Data of Cybozu Remote Service 3.1.2 allows a remote authenticated attacker to cause (no CVSS, Cybozu Remote Service)
- [CVE-2023-22277](https://cve.now/CVE-2023-22277.md): Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. (no CVSS, OMRON CX-Programmer)
- [CVE-2023-22314](https://cve.now/CVE-2023-22314.md): Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. (no CVSS, OMRON CX-Programmer)
- [CVE-2023-22317](https://cve.now/CVE-2023-22317.md): Use after free vulnerability exists in CX-Programmer Ver.9.79 and earlier. (no CVSS, OMRON CX-Programmer)
- [CVE-2022-34453](https://cve.now/CVE-2022-34453.md): Dell XtremIO X2 XMS versions prior to 6-4-1.11 contain an improper access control vulnerability. (CVSS 7.6, Dell XtremIO X2)
- [CVE-2022-4046](https://cve.now/CVE-2022-4046.md): CODESYS: Improper memory restrictions fro CODESYS Control (CVSS 8.8, CODESYS Control for BeagleBone SL · CODESYS Control for… +12)
- [CVE-2023-3669](https://cve.now/CVE-2023-3669.md): CODESYS: Missing Brute-Force protection in CODESYS Development System (CVSS 3.3, CODESYS Development System)
- [CVE-2023-37559](https://cve.now/CVE-2023-37559.md): CODESYS Improper Validation of Consistency within Input in multiple products (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37558](https://cve.now/CVE-2023-37558.md): CODESYS Improper Validation of Consistency within Input in multiple products (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37557](https://cve.now/CVE-2023-37557.md): CODESYS Heap-based Buffer Overflow in multiple products (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37556](https://cve.now/CVE-2023-37556.md): CODESYS Improper Input Validation in CmpAppBP (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37555](https://cve.now/CVE-2023-37555.md): CODESYS Improper Input Validation in CmpAppBP (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37554](https://cve.now/CVE-2023-37554.md): CODESYS Improper Input Validation in CmpAppBP (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37553](https://cve.now/CVE-2023-37553.md): CODESYS Improper Input Validation in CmpAppBP (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37552](https://cve.now/CVE-2023-37552.md): CODESYS Improper Input Validation in CmpAppBP (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37551](https://cve.now/CVE-2023-37551.md): CODESYS Files or Directories Accessible to External Parties in CmpApp (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37550](https://cve.now/CVE-2023-37550.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37549](https://cve.now/CVE-2023-37549.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37548](https://cve.now/CVE-2023-37548.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37547](https://cve.now/CVE-2023-37547.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37546](https://cve.now/CVE-2023-37546.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-37545](https://cve.now/CVE-2023-37545.md): CODESYS: Improper Input Validation in CmpApp component (CVSS 6.5, CODESYS Control for BeagleBone SL · CODESYS Control for… +14)
- [CVE-2023-3662](https://cve.now/CVE-2023-3662.md): CODESYS: Vulnerability in CODESYS Development System allows for execution of binaries (CVSS 7.3, CODESYS Development System)
- [CVE-2023-3663](https://cve.now/CVE-2023-3663.md): CODESYS: Missing integrity check in CODESYS Development System (CVSS 8.8, CODESYS Development System)
- [CVE-2023-4121](https://cve.now/CVE-2023-4121.md): Byzoro Smart S85F Management Platform unrestricted upload (CVSS 6.3, Byzoro Smart S85F Management Platform)
- [CVE-2023-4120](https://cve.now/CVE-2023-4120.md): Byzoro Smart S85F Management Platform importhtml.php command injection (CVSS 6.3, Byzoro Smart S85F Management Platform)
- [CVE-2023-4119](https://cve.now/CVE-2023-4119.md): Academy LMS courses cross site scripting (CVSS 4.3, Academy LMS)
- [CVE-2023-4118](https://cve.now/CVE-2023-4118.md): Cute Http File Server Search cross site scripting (CVSS 3.5, Cute Http File Server)
- [CVE-2023-4117](https://cve.now/CVE-2023-4117.md): PHP Jabbers Rental Property Booking index.php cross site scripting (CVSS 4.3, PHP Jabbers Rental Property Booking)
- [CVE-2023-4116](https://cve.now/CVE-2023-4116.md): PHP Jabbers Taxi Booking index.php cross site scripting (CVSS 4.3, PHP Jabbers Taxi Booking)
- [CVE-2023-21412](https://cve.now/CVE-2023-21412.md): Non-sanitized user input could lead to SQL injections in AXIS License Plate Verifier (CVSS 7.2, Axis Communications AB AXIS License Plate Verifier)
- [CVE-2023-21411](https://cve.now/CVE-2023-21411.md): Non-sanitized user input could lead to arbitrary code execution during Access Control configuration in AXIS License Plate Verifier (CVSS 7.2, Axis Communications AB AXIS License Plate Verifier)
- [CVE-2023-21410](https://cve.now/CVE-2023-21410.md): Non-sanitized user input could lead to arbitrary code execution in AXIS License Plate Verifier (CVSS 7.2, Axis Communications AB AXIS License Plate Verifier)
- [CVE-2023-21409](https://cve.now/CVE-2023-21409.md): Insufficient file permissions leak administrator-privileged credentials in AXIS License Verifier ACAP (CVSS 8.4, Axis Communications AB AXIS License Plate Verifier)
- [CVE-2023-21408](https://cve.now/CVE-2023-21408.md): Insufficient file permissions leak user credentials of 3rd party integration interfaces in AXIS License Verifier ACAP (CVSS 8.4, Axis Communications AB AXIS License Plate Verifier)
- [CVE-2023-21407](https://cve.now/CVE-2023-21407.md): Privilege escalation in AXIS License Plate Verifier ACAP (CVSS 8.8, Axis Communications AB AXIS License Plate Verifier)
- [CVE-2023-4008](https://cve.now/CVE-2023-4008.md): Incorrect Ownership Assignment in GitLab (CVSS 5.3, GitLab)
- [CVE-2023-4115](https://cve.now/CVE-2023-4115.md): PHP Jabbers Cleaning Business index.php cross site scripting (CVSS 4.3, PHP Jabbers Cleaning Business)
- [CVE-2023-4114](https://cve.now/CVE-2023-4114.md): PHP Jabbers Night Club Booking Software index.php cross site scripting (CVSS 4.3, PHP Jabbers Night Club Booking Software)
- [CVE-2023-38748](https://cve.now/CVE-2023-38748.md): Use after free vulnerability exists in CX-Programmer Included in CX-One CXONE-AL\[\]\[\]D-V4 V9.80 and earlier. (no CVSS, OMRON CX-Programmer)
- [CVE-2023-38747](https://cve.now/CVE-2023-38747.md): Heap-based buffer overflow vulnerability exists in CX-Programmer Included in CX-One CXONE-AL\[\]\[\]D-V4 V9.80 and earlier. (no CVSS, OMRON CX-Programmer)
- [CVE-2023-4113](https://cve.now/CVE-2023-4113.md): PHP Jabbers Service Booking Script index.php cross site scripting (CVSS 4.3, PHP Jabbers Service Booking Script)
- [CVE-2023-38746](https://cve.now/CVE-2023-38746.md): Out-of-bounds read vulnerability/issue exists in CX-Programmer Included in CX-One CXONE-AL\[\]\[\]D-V4 V9.80 and earlier. (no CVSS, OMRON CX-Programmer)
- [CVE-2023-38744](https://cve.now/CVE-2023-38744.md): Denial-of-service (DoS) vulnerability due to improper validation of specified type of input issue exists in the built-in EtherNet/IP port of (no CVSS, OMRON CJ2M CPU Unit · OMRON CJ2H CPU Unit +1)
- [CVE-2023-4112](https://cve.now/CVE-2023-4112.md): PHP Jabbers Shuttle Booking Software index.php cross site scripting (CVSS 4.3, PHP Jabbers Shuttle Booking Software)
- [CVE-2023-3932](https://cve.now/CVE-2023-3932.md): Incorrect User Management in GitLab (CVSS 8.2, GitLab)
- [CVE-2023-3346](https://cve.now/CVE-2023-3346.md): Denial of Service (DoS) and Remote Code Execution Vulnerability in MITSUBISHI CNC Series (CVSS 9.8, Mitsubishi Electric MITSUBISHI CNC M800V Series M800VW… +18)
- [CVE-2023-4111](https://cve.now/CVE-2023-4111.md): PHP Jabbers Bus Reservation System index.php cross site scripting (CVSS 4.3, PHP Jabbers Bus Reservation System)
- [CVE-2023-4127](https://cve.now/CVE-2023-4127.md): Race Condition within a Thread in answerdev/answer (CVSS 6.5, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-4126](https://cve.now/CVE-2023-4126.md): Insufficient Session Expiration in answerdev/answer (CVSS 4.1, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-4125](https://cve.now/CVE-2023-4125.md): Weak Password Requirements in answerdev/answer (CVSS 8.8, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-4124](https://cve.now/CVE-2023-4124.md): Missing Authorization in answerdev/answer (CVSS 8.1, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-4110](https://cve.now/CVE-2023-4110.md): PHP Jabbers Availability Booking Calendar index.php cross site scripting (CVSS 3.5, PHP Jabbers Availability Booking Calendar)
- [CVE-2023-4078](https://cve.now/CVE-2023-4078.md): Inappropriate implementation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a ma (no CVSS, Google Chrome)
- [CVE-2023-4077](https://cve.now/CVE-2023-4077.md): Insufficient data validation in Extensions in Google Chrome prior to 115.0.5790.170 allowed an attacker who convinced a user to install a ma (no CVSS, Google Chrome)
- [CVE-2023-4076](https://cve.now/CVE-2023-4076.md): Use after free in WebRTC in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a cra (no CVSS, Google Chrome)
- [CVE-2023-4075](https://cve.now/CVE-2023-4075.md): Use after free in Cast in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a craft (no CVSS, Google Chrome)
- [CVE-2023-4074](https://cve.now/CVE-2023-4074.md): Use after free in Blink Task Scheduling in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corru (no CVSS, Google Chrome)
- [CVE-2023-4073](https://cve.now/CVE-2023-4073.md): Out of bounds memory access in ANGLE in Google Chrome on Mac prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap c (no CVSS, Google Chrome)
- [CVE-2023-4072](https://cve.now/CVE-2023-4072.md): Out of bounds read and write in WebGL in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corrupt (no CVSS, Google Chrome)
- [CVE-2023-4071](https://cve.now/CVE-2023-4071.md): Heap buffer overflow in Visuals in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption vi (no CVSS, Google Chrome)
- [CVE-2023-4070](https://cve.now/CVE-2023-4070.md): Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML p (no CVSS, Google Chrome)
- [CVE-2023-4069](https://cve.now/CVE-2023-4069.md): Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to potentially exploit heap corruption via a crafted (no CVSS, Google Chrome)
- [CVE-2023-4068](https://cve.now/CVE-2023-4068.md): Type Confusion in V8 in Google Chrome prior to 115.0.5790.170 allowed a remote attacker to perform arbitrary read/write via a crafted HTML p (no CVSS, Google Chrome)
- [CVE-2020-20808](https://cve.now/CVE-2020-20808.md): Cross Site Scripting vulnerability in Qibosoft qibosoft v.7 and before allows a remote attacker to execute arbitrary code via the eindtijd a (no CVSS)
- [CVE-2023-25600](https://cve.now/CVE-2023-25600.md): An issue was discovered in InsydeH2O. (no CVSS)
- [CVE-2023-26979](https://cve.now/CVE-2023-26979.md): Bluetens Electrostimulation Device BluetensQ device app version 4.3.15 is vulnerable to Man-in-the-middle attacks in the BLE channel. (no CVSS)
- [CVE-2023-28468](https://cve.now/CVE-2023-28468.md): An issue was discovered in FvbServicesRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. (no CVSS)
- [CVE-2023-30297](https://cve.now/CVE-2023-30297.md): An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring fu (no CVSS)
- [CVE-2023-32764](https://cve.now/CVE-2023-32764.md): Fabasoft Cloud Enterprise Client 23.3.0.130 allows a user to escalate their privileges to local administrator. (no CVSS)
- [CVE-2023-33363](https://cve.now/CVE-2023-33363.md): An authentication bypass vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated users to access some functiona (no CVSS)
- [CVE-2023-33364](https://cve.now/CVE-2023-33364.md): An OS Command injection vulnerability exists in Suprema BioStar 2 before V2.9.1, which allows authenticated users to execute arbitrary OS co (no CVSS)
- [CVE-2023-33365](https://cve.now/CVE-2023-33365.md): A path traversal vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows unauthenticated attackers to fetch arbitrary files fro (no CVSS)
- [CVE-2023-33366](https://cve.now/CVE-2023-33366.md): A SQL injection vulnerability exists in Suprema BioStar 2 before 2.9.1, which allows authenticated users to inject arbitrary SQL directives (no CVSS)
- [CVE-2023-33368](https://cve.now/CVE-2023-33368.md): Some API routes exists in Control ID IDSecure 4.7.26.0 and prior, exfiltrating sensitive information and passwords to users accessing these (no CVSS)
- [CVE-2023-33369](https://cve.now/CVE-2023-33369.md): A path traversal vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to delete arbitrary files on IDSecure fi (no CVSS)
- [CVE-2023-33370](https://cve.now/CVE-2023-33370.md): An uncaught exception vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing attackers to cause the main web server of IDS (no CVSS)
- [CVE-2023-33371](https://cve.now/CVE-2023-33371.md): Control ID IDSecure 4.7.26.0 and prior uses a hardcoded cryptographic key in order to sign and verify JWT session tokens, allowing attackers (no CVSS)
- [CVE-2023-33665](https://cve.now/CVE-2023-33665.md): ai-dev aitable before v0.2.2 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php. (no CVSS)
- [CVE-2023-33666](https://cve.now/CVE-2023-33666.md): ai-dev aioptimizedcombinations before v0.1.3 was discovered to contain a SQL injection vulnerability via the component /includes/ajax.php. (no CVSS)
- [CVE-2023-34196](https://cve.now/CVE-2023-34196.md): In the Keyfactor EJBCA before 8.0.0, the RA web certificate distribution servlet /ejbca/ra/cert allows partial denial of service due to an a (no CVSS)
- [CVE-2023-36082](https://cve.now/CVE-2023-36082.md): An isssue in GatesAIr Flexiva FM Transmitter/Exiter Fax 150W allows a remote attacker to gain privileges via the LDAP and SMTP credentials. (no CVSS)
- [CVE-2023-36131](https://cve.now/CVE-2023-36131.md): PHPJabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control due to improper input validation of password paramete (no CVSS)
- [CVE-2023-36132](https://cve.now/CVE-2023-36132.md): PHP Jabbers Availability Booking Calendar 5.0 is vulnerable to Incorrect Access Control. (no CVSS)
- [CVE-2023-36133](https://cve.now/CVE-2023-36133.md): PHPJabbers Availability Booking Calendar 5.0 is vulnerable to User Account Takeover through username/password change. (no CVSS)
- [CVE-2023-36134](https://cve.now/CVE-2023-36134.md): In PHP Jabbers Class Scheduling System 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allows (no CVSS)
- [CVE-2023-36135](https://cve.now/CVE-2023-36135.md): User enumeration is found in in PHPJabbers Class Scheduling System v1.0. (no CVSS)
- [CVE-2023-36137](https://cve.now/CVE-2023-36137.md): There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Class Scheduling System 1.0. (no CVSS)
- [CVE-2023-36138](https://cve.now/CVE-2023-36138.md): PHPJabbers Cleaning Business Software 1.0 is vulnerable to Cross Site Scripting (XSS) via the theme parameter of preview.php. (no CVSS)
- [CVE-2023-36139](https://cve.now/CVE-2023-36139.md): In PHPJabbers Cleaning Business Software 1.0, lack of verification when changing an email address and/or password (on the Profile Page) allo (no CVSS)
- [CVE-2023-36141](https://cve.now/CVE-2023-36141.md): User enumeration is found in in PHPJabbers Cleaning Business Software 1.0. (no CVSS)
- [CVE-2023-36158](https://cve.now/CVE-2023-36158.md): Cross Site Scripting (XSS) vulnerability in sourcecodester Toll Tax Management System 1.0 allows remote attackers to run arbitrary code via (no CVSS)
- [CVE-2023-36159](https://cve.now/CVE-2023-36159.md): Cross Site Scripting (XSS) vulnerability in sourcecodester Lost and Found Information System 1.0 allows remote attackers to run arbitrary co (no CVSS)
- [CVE-2023-36212](https://cve.now/CVE-2023-36212.md): File Upload vulnerability in Total CMS v.1.7.4 allows a remote attacker to execute arbitrary code via a crafted PHP file to the edit page fu (no CVSS)
- [CVE-2023-36213](https://cve.now/CVE-2023-36213.md): SQL injection vulnerability in MotoCMS v.3.4.3 allows a remote attacker to gain privileges via the keyword parameter of the search function. (no CVSS)
- [CVE-2023-36217](https://cve.now/CVE-2023-36217.md): Cross Site Scripting vulnerability in Xoops CMS v.2.5.10 allows a remote attacker to execute arbitrary code via the category name field of t (no CVSS)
- [CVE-2023-36255](https://cve.now/CVE-2023-36255.md): An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path (no CVSS)
- [CVE-2023-36298](https://cve.now/CVE-2023-36298.md): DedeCMS v5.7.109 has a File Upload vulnerability, leading to remote code execution (RCE). (no CVSS)
- [CVE-2023-36299](https://cve.now/CVE-2023-36299.md): A File Upload vulnerability in typecho v.1.2.1 allows a remote attacker to execute arbitrary code via the upload and options-general paramet (no CVSS)
- [CVE-2023-37364](https://cve.now/CVE-2023-37364.md): In WS-Inc J WBEM Server 4.7.4 before 4.7.5, the CIM-XML protocol adapter does not disable entity resolution. (no CVSS)
- [CVE-2023-37679](https://cve.now/CVE-2023-37679.md): A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the… (no CVSS)
- [CVE-2023-38941](https://cve.now/CVE-2023-38941.md): django-sspanel v2022.2.2 was discovered to contain a remote command execution (RCE) vulnerability via the component sspanel/admin\_view.py -\> (no CVSS)
- [CVE-2023-38942](https://cve.now/CVE-2023-38942.md): Dango-Translator v4.5.5 was discovered to contain a remote command execution (RCE) vulnerability via the component app/config/cloud\_config.j (no CVSS)
- [CVE-2023-38947](https://cve.now/CVE-2023-38947.md): An arbitrary file upload vulnerability in the /languages/install.php component of WBCE CMS v1.6.1 allows attackers to execute arbitrary code (CVSS 7.2)
- [CVE-2023-38948](https://cve.now/CVE-2023-38948.md): An arbitrary file download vulnerability in the /c/PluginsController.php component of jizhi CMS 1.9.5 allows attackers to execute arbitrary (no CVSS)
- [CVE-2023-38949](https://cve.now/CVE-2023-38949.md): An issue in a hidden API in ZKTeco BioTime v8.5.5 allows unauthenticated attackers to arbitrarily reset the Administrator password via a cra (no CVSS)
- [CVE-2023-38950](https://cve.now/CVE-2023-38950.md): A path traversal vulnerability in the iclock API of ZKTeco BioTime v8.5.5 allows unauthenticated attackers to read arbitrary files via suppl (CVSS 7.5, KEV)
- [CVE-2023-38951](https://cve.now/CVE-2023-38951.md): ZKTeco BioTime 8.5.5 through 9.x before 9.0.1 (20240617.19506) allows authenticated attackers to create or overwrite arbitrary files on the (CVSS 9.8)
- [CVE-2023-38952](https://cve.now/CVE-2023-38952.md): Insecure access control in ZKTeco BioTime through 9.0.1 allows authenticated attackers to escalate their privileges due to the fact that ses (CVSS 7.5)
- [CVE-2023-38954](https://cve.now/CVE-2023-38954.md): ZKTeco BioAccess IVS v3.3.1 was discovered to contain a SQL injection vulnerability. (no CVSS)
- [CVE-2023-38955](https://cve.now/CVE-2023-38955.md): ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to obtain sensitive information about all managed devices, including their IP a (no CVSS)
- [CVE-2023-38956](https://cve.now/CVE-2023-38956.md): A path traversal vulnerability in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to read arbitrary files via supplying a craft (no CVSS)
- [CVE-2023-38958](https://cve.now/CVE-2023-38958.md): An access control issue in ZKTeco BioAccess IVS v3.3.1 allows unauthenticated attackers to arbitrarily close and open the doors managed by t (no CVSS)
- [CVE-2023-38991](https://cve.now/CVE-2023-38991.md): An issue in the delete function in the ActModelController class of jeesite v1.2.6 allows authenticated attackers to arbitrarily delete model (no CVSS)
- [CVE-2023-39075](https://cve.now/CVE-2023-39075.md): Renault Zoe EV 2021 automotive infotainment system versions 283C35202R to 283C35519R (builds 11.10.2021 to 16.01.2023) allows attackers to c (no CVSS)
- [CVE-2023-39096](https://cve.now/CVE-2023-39096.md): WebBoss.io CMS v3.7.0.1 contains a stored Cross-Site Scripting (XSS) vulnerability due to lack of input validation and output encoding. (no CVSS)
- [CVE-2023-39097](https://cve.now/CVE-2023-39097.md): WebBoss.io CMS v3.7.0.1 contains a stored cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2023-39121](https://cve.now/CVE-2023-39121.md): emlog v2.1.9 was discovered to contain a SQL injection vulnerability via the component /admin/user.php. (no CVSS)
- [CVE-2023-39144](https://cve.now/CVE-2023-39144.md): Element55 KnowMore appliances version 21 and older was discovered to store passwords in plaintext. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.