CVEs published August 4, 2023
57 CVEs were published on August 4, 2023: 9 critical, 8 high.
- Published
- 57
- Critical
- 9
- High
- 8
- Medium
- 20
- Low
- 1
- Unrated
- 19
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- smackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- 4
- omeka/omeka-s
- 3
- Cisco SD-WAN vManage
- 2
- matrix-org matrix-appservice-irc · matrix-appservice-irc
- 2
- VMware Horizon Server
- 2
- aerospike-client-java · com.aerospike:aerospike-client
- 1
- bjrjk LinuxASMCallGraph
- 1
- Cisco Secure Email
- 1
- CloudExplorer-Dev CloudExplorer-Lite
- 1
- ensdomains ens-contracts · @ensdomains/ens-contracts
- 1
Critical 9
- CVE-2023-39344social-media-skeleton vulnerable to Pre-Auth SQLi leading to RCEfobybus social-media-skeleton
- CVE-2023-38702Knowage Server vulnerable to path traversal via upload functionalityKnowageLabs Knowage-Server
- CVE-2023-38699MindsDB 'Call to requests with verify=False disabling SSL certificate checks, security issue.' issuemindsdb
- CVE-2023-38692Command injection vulnerability in module management function in CloudExplorer LiteCloudExplorer-Dev CloudExplorer-Lite
- CVE-2023-4159Unrestricted Upload of File with Dangerous Type in omeka/omeka-someka/omeka-s
- CVE-2023-38686Sydent does not verify email server certificatesmatrix-org sydent · matrix-sydent
- CVE-2023-37470Metabase vulnerable to remote code execution via POST /api/setup/validate API endpoint metabase
- CVE-2023-36480Aerospike Java Client vulnerable to unsafe deserialization of server responsesaerospike-client-java · com.aerospike:aerospike-client
- CVE-2023-39143PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files.
High 8
- CVE-2023-39346bjrjk/LinuxASMCallGraph before commit 20dba06 allows attackers to cause a RCE on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded filebjrjk LinuxASMCallGraph
- CVE-2023-38689Deserialization of Untrusted Data in network IORS485 LogisticsPipes
- CVE-2023-38688twitch-tui's connection is not encryptedXithrius twitch-tui · twitch-tui
- CVE-2023-38497Cargo not respecting umask when extracting crate archivesrust-lang cargo · cargo
- CVE-2023-37896Nuclei Path Traversal vulnerabilityprojectdiscovery nuclei · github.com/projectdiscovery/nu… +1
- CVE-2023-4142WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) Remote Code Executionsmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- CVE-2023-4141WP Ultimate CSV Importer <= 7.9.8 - Authenticated (Author+) PHP File Creation to Remote Code Executionsmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- CVE-2023-4139WP Ultimate CSV Importer <= 7.9.8 - Sensitive Information Exposure via Directory Listingsmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
Medium, low and unrated 40
- CVE-2020-26064A vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to gain read and write access tCisco SD-WAN vManage
- CVE-2020-26065A vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to condCisco SD-WAN vManage
- CVE-2020-26082A vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthentiCisco Secure Email
- CVE-2022-4955Inappropriate implementation in DevTools in Google Chrome prior to 108.0.5359.71 allowed an attacker who convinced a user to install a malicGoogle Chrome
- CVE-2023-38700matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged roomsmatrix-org matrix-appservice-irc · matrix-appservice-irc
- CVE-2023-38698.eth registrar controller can shorten the duration of registered namesensdomains ens-contracts · @ensdomains/ens-contracts
- CVE-2023-38697 protocol-http1 HTTP Request/Response Smuggling vulnerabilitysocketry protocol-http1 · protocol-http1
- CVE-2023-38695cypress-image-snapshot vulnerable to insecure snapshot file namessimonsmith cypress-image-snapshot · @simonsmith/cypress-ima…
- CVE-2023-4158Cross-site Scripting (XSS) - Stored in omeka/omeka-someka/omeka-s
- CVE-2023-4157Improper Neutralization of Special Elements in Output Used by a Downstream Component in omeka/omeka-someka/omeka-s
- CVE-2023-0264A flaw was found in Keycloaks OpenID Connect user authentication, which may incorrectly authenticate requests.redhat.com Keycloak · org.keycloak:keycloak-services
- CVE-2023-38691matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIsmatrix-org matrix-appservice-bridge · matrix-appservice-bri…
- CVE-2023-38690matrix-appservice-irc IRC command injection via admin commands containing newlines matrix-org matrix-appservice-irc · matrix-appservice-irc
- CVE-2023-38494The cloud version of the MeterSphere interface leaks some sensitive data without authenticationmetersphere
- CVE-2023-38487HedgeDoc API allows to hide existing noteshedgedoc
- CVE-2023-4135Out-of-bounds read information disclosure vulnerabilityqemu-kvm · Red Hat Enterprise Linux +1
- CVE-2023-34038VMware Horizon Server contains an information disclosure vulnerability.VMware Horizon Server
- CVE-2023-34037VMware Horizon Server contains a HTTP request smuggling vulnerability.VMware Horizon Server
- CVE-2023-39379Fujitsu Software Infrastructure Manager (ISM) stores sensitive information at the product's maintenance data (ismsnap) in cleartext form.Fujitsu Limited Fujitsu Software Infrastructure Manager Adv…
- CVE-2023-4140WP Ultimate CSV Importer <= 7.9.8 - Arbitrary Usermeta Update to Authenticated (Author+) Privilege Escalationsmackcoders WP Ultimate CSV Importer – Import CSV, XML & Ex…
- CVE-2023-4002Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2023-38708Pimcore Path Traversal Vulnerability in AssetController:importServerFilesActionpimcore · pimcore/pimcore
- CVE-2023-39343Sulu Observable Response Discrepancy on Admin Loginsulu · sulu/sulu
- CVE-2022-41401OpenRefine <= v3.5.2 contains a Server-Side Request Forgery (SSRF) vulnerability, which permits unauthorized users to exploit the system, poorg.openrefine:main
- CVE-2023-29505An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165.
- CVE-2023-29689PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw.pyrocms/pyrocms
- CVE-2023-30146Assmann Digitus Plug&View IP Camera HT-IP211HDP, version 2.000.022 allows unauthenticated attackers to download a copy of the camera's setti
- CVE-2023-33372Connected IO v2.1.0 and prior uses a hard-coded username/password pair embedded in their device's firmware used for device communication usi
- CVE-2023-33373Connected IO v2.1.0 and prior keeps passwords and credentials in clear-text format, allowing attackers to exfiltrate the credentials and use
- CVE-2023-33374Connected IO v2.1.0 and prior has a command as part of its communication protocol allowing the management platform to specify arbitrary OS c
- CVE-2023-33375Connected IO v2.1.0 and prior has a stack-based buffer overflow vulnerability in its communication protocol, enabling attackers to take cont
- CVE-2023-33376Connected IO v2.1.0 and prior has an argument injection vulnerability in its iptables command message in its communication protocol, enablin
- CVE-2023-33377Connected IO v2.1.0 and prior has an OS command injection vulnerability in the set firewall command in part of its communication protocol, e
- CVE-2023-33378Connected IO v2.1.0 and prior has an argument injection vulnerability in its AT command message in its communication protocol, enabling atta
- CVE-2023-33379Connected IO v2.1.0 and prior has a misconfiguration in their MQTT broker used for management and device communication, which allows devices
- CVE-2023-38332Zoho ManageEngine ADManager Plus through 7201 allow authenticated users to take over another user's account via sensitive information disclo
- CVE-2023-38964Creative Item Academy LMS 6.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
- CVE-2023-39107An arbitrary file overwrite vulnerability in NoMachine Free Edition and Enterprise Client for macOS before v8.8.1 allows attackers to overwr
- CVE-2023-39112ECShop v4.1.16 contains an arbitrary file deletion vulnerability in the Admin Panel.
- CVE-2023-39551PHPGurukul Online Security Guards Hiring System v.1.0 is vulnerable to SQL Injection via osghs/admin/search.php.