CVEs published August 9, 2023
99 CVEs were published on August 9, 2023: 6 critical, 43 high.
- Published
- 99
- Critical
- 6
- High
- 43
- Medium
- 16
- Low
- 1
- Unrated
- 33
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- ScienceLogic SL
- 25
- PHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4
- 10
- Nozomi Networks Guardian · Nozomi Networks CMC
- 7
- Adobe Dimension
- 3
- Adobe Magento Commerce · magento/community-edition +1
- 2
- Apache Software Foundation Apache Traffic Server
- 2
- fullservices FULL – Cliente
- 2
- Japan Computer Emergency Response Team Coordination Center…
- 2
- trailofbits uthenticode
- 2
- Adobe Commerce · magento/community-edition +1
- 1
Critical 6
- CVE-2023-33242Lindell17 TSS Abort MishandlingLindell TSS Implementations Wallet
- CVE-2023-33241GG18 / GG20 TSS Beta Parameter VulnerabilityGG TSS Implementations Wallet
- CVE-2023-39969uthenticode signature validation bypass vulnerabilitytrailofbits uthenticode
- CVE-2023-3632Hard-coded Cryptographic Key in Kunduz - Homework Helper AppSifir Bes Education and Informatics Kunduz - Homework Helpe…
- CVE-2023-38208Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78)Adobe Magento Commerce · magento/community-edition +1
- CVE-2023-33934Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepanciesApache Software Foundation Apache Traffic Server
High 43
- CVE-2022-48604A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input anScienceLogic SL
- CVE-2022-48603A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled iScienceLogic SL
- CVE-2022-48602A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled inScienceLogic SL
- CVE-2022-48601A SQL injection vulnerability exists in the “network print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled inScienceLogic SL
- CVE-2022-48600A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and paScienceLogic SL
- CVE-2022-48599A SQL injection vulnerability exists in the “reporter events type” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled inScienceLogic SL
- CVE-2022-48598A SQL injection vulnerability exists in the “reporter events type date” feature of the ScienceLogic SL1 that takes unsanitized user‐controllScienceLogic SL
- CVE-2022-48597A SQL injection vulnerability exists in the “ticket event report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled inpScienceLogic SL
- CVE-2022-48596A SQL injection vulnerability exists in the “ticket queue watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled iScienceLogic SL
- CVE-2022-48595A SQL injection vulnerability exists in the “ticket template watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlleScienceLogic SL
- CVE-2022-48594A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled iScienceLogic SL
- CVE-2022-48593A SQL injection vulnerability exists in the “topology data service” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled iScienceLogic SL
- CVE-2022-48592A SQL injection vulnerability exists in the vendor_country parameter of the “vendor print report” feature of the ScienceLogic SL1 that takesScienceLogic SL
- CVE-2022-48591A SQL injection vulnerability exists in the vendor_state parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes uScienceLogic SL
- CVE-2022-48590A SQL injection vulnerability exists in the “admin dynamic app mib errors” feature of the ScienceLogic SL1 that takes unsanitized user‐contrScienceLogic SL
- CVE-2022-48589A SQL injection vulnerability exists in the “reporting job editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled inScienceLogic SL
- CVE-2022-48588A SQL injection vulnerability exists in the “schedule editor decoupled” feature of the ScienceLogic SL1 that takes unsanitized user‐controllScienceLogic SL
- CVE-2022-48587A SQL injection vulnerability exists in the “schedule editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input aScienceLogic SL
- CVE-2022-48586A SQL injection vulnerability exists in the “json walker” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and pScienceLogic SL
- CVE-2022-48585A SQL injection vulnerability exists in the “admin brand portal” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled inpuScienceLogic SL
- CVE-2022-48584A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐contScienceLogic SL
- CVE-2022-48583A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled iScienceLogic SL
- CVE-2022-48582A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlleScienceLogic SL
- CVE-2022-48581A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input aScienceLogic SL
- CVE-2022-48580A command injection vulnerability exists in the ARP ping device tool feature of the ScienceLogic SL1 that takes unsanitized user controlled ScienceLogic SL
- CVE-2023-3518JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for AccessHashiCorp Consul · github.com/hashicorp/consul
- CVE-2023-33953Denial-of-Service in gRPCGoogle gRPC · grpcio +1
- CVE-2023-23574Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2023-38212ZDI-CAN-21093: Adobe Dimension GLB File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-38211ZDI-CAN-21078: Adobe Dimension GLB File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-22378Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2023-24477Session Fixation in Guardian/CMC before 22.6.2Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2023-38207Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system readAdobe Commerce · magento/community-edition +1
- CVE-2022-47185Apache Traffic Server: Invalid Range header causes a crashApache Software Foundation Apache Traffic Server
- CVE-2023-37863PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panelsPHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4
- CVE-2023-37859PHOENIX CONTACT: Improper Privilege Management in WP 6xxx Web panelsPHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4
- CVE-2023-37864PHOENIX CONTACT: WP 6xxx Web panels prone to download code without integrity checkPHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4
- CVE-2023-37862PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panelsPHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4
- CVE-2023-37860PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panelsPHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4
- CVE-2023-37861PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panelsPHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4
- CVE-2023-26310Command Injection In OPPO ServiceOPPO Find X3
- CVE-2023-4243FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installationfullservices FULL – Cliente
- CVE-2023-4239Real Estate Manager <= 7.2 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalationrameez_iqbal Real Estate Manager – Property Listing and Age…
Medium, low and unrated 50
- CVE-2023-23347Use of a broken cryptographic algorithm affects HCL DRYiCE iAutomateHCL Software HCL DRYiCE iAutomate
- CVE-2023-23346Use of a broken cryptographic algorithm affects HCL DRYiCE MyCloud HCL Software HCL DRYiCE MyCloud
- CVE-2023-39531Sentry vulnerable to incorrect credential validation on OAuth token requestsgetsentry sentry · sentry
- CVE-2023-40012uthenticode EKU validation bypasstrailofbits uthenticode
- CVE-2023-4273Kernel: exfat: stack overflow in exfat_get_uniname_from_ext_entryRed Hat Enterprise Linux
- CVE-2023-3953 A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause memory corruption Schneider Electric GP-Pro EX WinGP for iPC · Schneider Elec…
- CVE-2023-23903DoS via SAML configuration in Guardian/CMC before 22.6.2Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2023-24015Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2023-24471Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2023-22843Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2023-38213ZDI-CAN-21094: Adobe Dimension GLB File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-38209Adobe Commerce Incorrect Authorization Security feature bypassAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-37858PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panelsPHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4
- CVE-2023-37857PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panelsPHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4
- CVE-2023-37855PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panelsPHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4
- CVE-2023-37856PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panelsPHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4
- CVE-2023-2905Cesanta Mongoose MQTT Message Parsing Heap OverflowCesanta Mongoose
- CVE-2023-4242FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Checkfullservices FULL – Cliente
- CVE-2023-38752Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorizeJapan Computer Emergency Response Team Coordination Center…
- CVE-2023-38751Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorizeJapan Computer Emergency Response Team Coordination Center…
- CVE-2023-39341"FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to deniFFRI Security FFRI yarai · Soliton Systems K.K. InfoTrac… +4
- CVE-2023-31448A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with w
- CVE-2023-31449A path traversal vulnerability was identified in the WMI Custom sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user
- CVE-2023-31450A path traversal vulnerability was identified in the SQL v2 sensors in PRTG 23.2.84.1566 and earlier versions where an authenticated user wi
- CVE-2023-31452A cross-site request forgery (CSRF) token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to pe
- CVE-2023-32781A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user wit
- CVE-2023-32782A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with wri
- CVE-2023-33468KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation
- CVE-2023-33469In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) and VIA Go (2) devices with a vers
- CVE-2023-34545A SQL injection vulnerability in CSZCMS 1.3.0 allows remote attackers to run arbitrary SQL commands via p parameter or the search URL.
- CVE-2023-35838The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that useswireguard
- CVE-2023-36671An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS.
- CVE-2023-36672An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS.
- CVE-2023-36673An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS.
- CVE-2023-37068Code-Projects Gym Management System V1.0 allows remote attackers to execute arbitrary SQL commands via the login form, leading to unauthoriz
- CVE-2023-38347An issue was discovered in LWsystems Benno MailArchiv 2.10.1.
- CVE-2023-38348A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1.
- CVE-2023-38997A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23
- CVE-2023-38998An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect
- CVE-2023-38999A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition bef
- CVE-2023-39000A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 an
- CVE-2023-39001A command injection vulnerability in the component diag_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23.
- CVE-2023-39002A cross-site scripting (XSS) vulnerability in the act parameter of system_certmanager.php in OPNsense Community Edition before 23.7 and Busi
- CVE-2023-39003OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /t
- CVE-2023-39004Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 al
- CVE-2023-39005Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2.
- CVE-2023-39006The Crash Reporter (crash_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles in
- CVE-2023-39007/ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAct
- CVE-2023-39008A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition
- CVE-2023-39910The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue.