# CVEs published 2023-08-09

99 CVEs were published on August 9, 2023: 6 critical, 43 high. Days are UTC.

- [CVE-2023-33242](https://cve.now/CVE-2023-33242.md): Lindell17 TSS Abort Mishandling (CVSS 9.6, Lindell TSS Implementations Wallet)
- [CVE-2023-33241](https://cve.now/CVE-2023-33241.md): GG18 / GG20 TSS Beta Parameter Vulnerability (CVSS 9.6, GG TSS Implementations Wallet)
- [CVE-2023-23347](https://cve.now/CVE-2023-23347.md): Use of a broken cryptographic algorithm affects HCL DRYiCE iAutomate (CVSS 6.4, HCL Software HCL DRYiCE iAutomate)
- [CVE-2023-23346](https://cve.now/CVE-2023-23346.md): Use of a broken cryptographic algorithm affects HCL DRYiCE MyCloud (CVSS 6.4, HCL Software HCL DRYiCE MyCloud)
- [CVE-2022-48604](https://cve.now/CVE-2022-48604.md): A SQL injection vulnerability exists in the “logging export” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input an (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48603](https://cve.now/CVE-2022-48603.md): A SQL injection vulnerability exists in the “message viewer iframe” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled i (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48602](https://cve.now/CVE-2022-48602.md): A SQL injection vulnerability exists in the “message viewer print” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled in (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48601](https://cve.now/CVE-2022-48601.md): A SQL injection vulnerability exists in the “network print report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled in (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48600](https://cve.now/CVE-2022-48600.md): A SQL injection vulnerability exists in the “notes view” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and pa (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48599](https://cve.now/CVE-2022-48599.md): A SQL injection vulnerability exists in the “reporter events type” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled in (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48598](https://cve.now/CVE-2022-48598.md): A SQL injection vulnerability exists in the “reporter events type date” feature of the ScienceLogic SL1 that takes unsanitized user‐controll (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48597](https://cve.now/CVE-2022-48597.md): A SQL injection vulnerability exists in the “ticket event report” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled inp (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48596](https://cve.now/CVE-2022-48596.md): A SQL injection vulnerability exists in the “ticket queue watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled i (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48595](https://cve.now/CVE-2022-48595.md): A SQL injection vulnerability exists in the “ticket template watchers” feature of the ScienceLogic SL1 that takes unsanitized user‐controlle (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48594](https://cve.now/CVE-2022-48594.md): A SQL injection vulnerability exists in the “ticket watchers email” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled i (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48593](https://cve.now/CVE-2022-48593.md): A SQL injection vulnerability exists in the “topology data service” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled i (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48592](https://cve.now/CVE-2022-48592.md): A SQL injection vulnerability exists in the vendor\_country parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48591](https://cve.now/CVE-2022-48591.md): A SQL injection vulnerability exists in the vendor\_state parameter of the “vendor print report” feature of the ScienceLogic SL1 that takes u (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48590](https://cve.now/CVE-2022-48590.md): A SQL injection vulnerability exists in the “admin dynamic app mib errors” feature of the ScienceLogic SL1 that takes unsanitized user‐contr (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48589](https://cve.now/CVE-2022-48589.md): A SQL injection vulnerability exists in the “reporting job editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled in (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48588](https://cve.now/CVE-2022-48588.md): A SQL injection vulnerability exists in the “schedule editor decoupled” feature of the ScienceLogic SL1 that takes unsanitized user‐controll (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48587](https://cve.now/CVE-2022-48587.md): A SQL injection vulnerability exists in the “schedule editor” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input a (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48586](https://cve.now/CVE-2022-48586.md): A SQL injection vulnerability exists in the “json walker” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and p (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48585](https://cve.now/CVE-2022-48585.md): A SQL injection vulnerability exists in the “admin brand portal” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled inpu (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48584](https://cve.now/CVE-2022-48584.md): A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐cont (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48583](https://cve.now/CVE-2022-48583.md): A command injection vulnerability exists in the dashboard scheduler feature of the ScienceLogic SL1 that takes unsanitized user‐controlled i (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48582](https://cve.now/CVE-2022-48582.md): A command injection vulnerability exists in the ticket report generate feature of the ScienceLogic SL1 that takes unsanitized user controlle (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48581](https://cve.now/CVE-2022-48581.md): A command injection vulnerability exists in the “dash export” feature of the ScienceLogic SL1 that takes unsanitized user controlled input a (CVSS 8.8, ScienceLogic SL)
- [CVE-2022-48580](https://cve.now/CVE-2022-48580.md): A command injection vulnerability exists in the ARP ping device tool feature of the ScienceLogic SL1 that takes unsanitized user controlled (CVSS 8.8, ScienceLogic SL)
- [CVE-2023-39531](https://cve.now/CVE-2023-39531.md): Sentry vulnerable to incorrect credential validation on OAuth token requests (CVSS 6.5, getsentry sentry · sentry)
- [CVE-2023-39969](https://cve.now/CVE-2023-39969.md): uthenticode signature validation bypass vulnerability (CVSS 9.1, trailofbits uthenticode)
- [CVE-2023-40012](https://cve.now/CVE-2023-40012.md): uthenticode EKU validation bypass (CVSS 5.9, trailofbits uthenticode)
- [CVE-2023-3518](https://cve.now/CVE-2023-3518.md): JWT Auth in L7 Intentions Allow For Mismatched Service Identity and JWT Providers for Access (CVSS 7.4, HashiCorp Consul · github.com/hashicorp/consul)
- [CVE-2023-4273](https://cve.now/CVE-2023-4273.md): Kernel: exfat: stack overflow in exfat\_get\_uniname\_from\_ext\_entry (CVSS 6.0, Red Hat Enterprise Linux)
- [CVE-2023-3953](https://cve.now/CVE-2023-3953.md): A CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability exists that could cause memory corruption (CVSS 5.3, Schneider Electric GP-Pro EX WinGP for iPC · Schneider Elec…)
- [CVE-2023-33953](https://cve.now/CVE-2023-33953.md): Denial-of-Service in gRPC (CVSS 7.5, Google gRPC · grpcio +1)
- [CVE-2023-23903](https://cve.now/CVE-2023-23903.md): DoS via SAML configuration in Guardian/CMC before 22.6.2 (CVSS 4.9, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2023-24015](https://cve.now/CVE-2023-24015.md): Partial DoS on Reports section due to null report name in Guardian/CMC before 22.6.2 (CVSS 4.3, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2023-24471](https://cve.now/CVE-2023-24471.md): Information disclosure via the debug function in assertions in Guardian/CMC before 22.6.2 (CVSS 6.5, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2023-22843](https://cve.now/CVE-2023-22843.md): Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2 (CVSS 6.4, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2023-23574](https://cve.now/CVE-2023-23574.md): Authenticated Blind SQL Injection on alerts count in Guardian/CMC before 22.6.2 (CVSS 8.8, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2023-38212](https://cve.now/CVE-2023-38212.md): ZDI-CAN-21093: Adobe Dimension GLB File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2023-38211](https://cve.now/CVE-2023-38211.md): ZDI-CAN-21078: Adobe Dimension GLB File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2023-38213](https://cve.now/CVE-2023-38213.md): ZDI-CAN-21094: Adobe Dimension GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-3632](https://cve.now/CVE-2023-3632.md): Hard-coded Cryptographic Key in Kunduz - Homework Helper App (CVSS 9.8, Sifir Bes Education and Informatics Kunduz - Homework Helpe…)
- [CVE-2023-22378](https://cve.now/CVE-2023-22378.md): Authenticated Blind SQL Injection on sorting in Guardian/CMC before 22.6.2 (CVSS 8.8, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2023-24477](https://cve.now/CVE-2023-24477.md): Session Fixation in Guardian/CMC before 22.6.2 (CVSS 7.0, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2023-38207](https://cve.now/CVE-2023-38207.md): Adobe Commerce XML Injection (aka Blind XPath Injection) Arbitrary file system read (CVSS 7.5, Adobe Commerce · magento/community-edition +1)
- [CVE-2023-38208](https://cve.now/CVE-2023-38208.md): Validate Your Inputs | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') (CWE-78) (CVSS 9.1, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2023-38209](https://cve.now/CVE-2023-38209.md): Adobe Commerce Incorrect Authorization Security feature bypass (CVSS 6.5, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2023-33934](https://cve.now/CVE-2023-33934.md): Apache Traffic Server: Differential fuzzing for HTTP request parsing discrepancies (CVSS 9.1, Apache Software Foundation Apache Traffic Server)
- [CVE-2022-47185](https://cve.now/CVE-2022-47185.md): Apache Traffic Server: Invalid Range header causes a crash (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2023-37858](https://cve.now/CVE-2023-37858.md): PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels (CVSS 4.9, PHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4)
- [CVE-2023-37857](https://cve.now/CVE-2023-37857.md): PHOENIX CONTACT: Use of Hard-coded Credentials in WP 6xxx Web panels (CVSS 3.8, PHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4)
- [CVE-2023-37855](https://cve.now/CVE-2023-37855.md): PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels (CVSS 4.3, PHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4)
- [CVE-2023-37856](https://cve.now/CVE-2023-37856.md): PHOENIX CONTACT: Unauthorized read-access of root filesystem in WP 6xxx Web panels (CVSS 4.3, PHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4)
- [CVE-2023-37863](https://cve.now/CVE-2023-37863.md): PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels (CVSS 7.2, PHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4)
- [CVE-2023-37859](https://cve.now/CVE-2023-37859.md): PHOENIX CONTACT: Improper Privilege Management in WP 6xxx Web panels (CVSS 7.2, PHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4)
- [CVE-2023-37864](https://cve.now/CVE-2023-37864.md): PHOENIX CONTACT: WP 6xxx Web panels prone to download code without integrity check (CVSS 7.2, PHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4)
- [CVE-2023-37862](https://cve.now/CVE-2023-37862.md): PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panels (CVSS 8.2, PHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4)
- [CVE-2023-37860](https://cve.now/CVE-2023-37860.md): PHOENIX CONTACT: Missing Authorization in WP 6xxx Web panels (CVSS 7.5, PHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4)
- [CVE-2023-37861](https://cve.now/CVE-2023-37861.md): PHOENIX CONTACT: OS Command Injection in WP 6xxx Web panels (CVSS 8.8, PHOENIX CONTACT WP 6070-WVPS · PHOENIX CONTACT WP 6101-W… +4)
- [CVE-2023-26310](https://cve.now/CVE-2023-26310.md): Command Injection In OPPO Service (CVSS 7.4, OPPO Find X3)
- [CVE-2023-2905](https://cve.now/CVE-2023-2905.md): Cesanta Mongoose MQTT Message Parsing Heap Overflow (no CVSS, Cesanta Mongoose)
- [CVE-2023-4242](https://cve.now/CVE-2023-4242.md): FULL - Customer \<= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check (CVSS 4.3, fullservices FULL – Cliente)
- [CVE-2023-4243](https://cve.now/CVE-2023-4243.md): FULL - Customer \<= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation (CVSS 8.8, fullservices FULL – Cliente)
- [CVE-2023-38752](https://cve.now/CVE-2023-38752.md): Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorize (no CVSS, Japan Computer Emergency Response Team Coordination Center…)
- [CVE-2023-38751](https://cve.now/CVE-2023-38751.md): Improper authorization vulnerability in Special Interest Group Network for Analysis and Liaison versions 4.4.0 to 4.7.7 allows the authorize (no CVSS, Japan Computer Emergency Response Team Coordination Center…)
- [CVE-2023-39341](https://cve.now/CVE-2023-39341.md): "FFRI yarai", "FFRI yarai Home and Business Edition" and their OEM products handle exceptional conditions improperly, which may lead to deni (no CVSS, FFRI Security FFRI yarai · Soliton Systems K.K. InfoTrac… +4)
- [CVE-2023-4239](https://cve.now/CVE-2023-4239.md): Real Estate Manager \<= 7.2 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, rameez\_iqbal Real Estate Manager – Property Listing and Age…)
- [CVE-2023-31448](https://cve.now/CVE-2023-31448.md): A path traversal vulnerability was identified in the HL7 sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user with w (no CVSS)
- [CVE-2023-31449](https://cve.now/CVE-2023-31449.md): A path traversal vulnerability was identified in the WMI Custom sensor in PRTG 23.2.84.1566 and earlier versions where an authenticated user (no CVSS)
- [CVE-2023-31450](https://cve.now/CVE-2023-31450.md): A path traversal vulnerability was identified in the SQL v2 sensors in PRTG 23.2.84.1566 and earlier versions where an authenticated user wi (no CVSS)
- [CVE-2023-31452](https://cve.now/CVE-2023-31452.md): A cross-site request forgery (CSRF) token bypass was identified in PRTG 23.2.84.1566 and earlier versions that allows remote attackers to pe (no CVSS)
- [CVE-2023-32781](https://cve.now/CVE-2023-32781.md): A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user wit (no CVSS)
- [CVE-2023-32782](https://cve.now/CVE-2023-32782.md): A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with wri (no CVSS)
- [CVE-2023-33468](https://cve.now/CVE-2023-33468.md): KramerAV VIA Connect (2) and VIA Go (2) devices with a version prior to 4.0.1.1326 exhibit a vulnerability that enables remote manipulation (no CVSS)
- [CVE-2023-33469](https://cve.now/CVE-2023-33469.md): In instances where the screen is visible and remote mouse connection is enabled, KramerAV VIA Connect (2) and VIA Go (2) devices with a vers (no CVSS)
- [CVE-2023-34545](https://cve.now/CVE-2023-34545.md): A SQL injection vulnerability in CSZCMS 1.3.0 allows remote attackers to run arbitrary SQL commands via p parameter or the search URL. (no CVSS)
- [CVE-2023-35838](https://cve.now/CVE-2023-35838.md): The WireGuard client 0.5.3 on Windows insecurely configures the operating system and firewall such that traffic to a local network that uses (no CVSS, wireguard)
- [CVE-2023-36671](https://cve.now/CVE-2023-36671.md): An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. (no CVSS)
- [CVE-2023-36672](https://cve.now/CVE-2023-36672.md): An issue was discovered in the Clario VPN client through 5.9.1.1662 for macOS. (no CVSS)
- [CVE-2023-36673](https://cve.now/CVE-2023-36673.md): An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. (no CVSS)
- [CVE-2023-37068](https://cve.now/CVE-2023-37068.md): Code-Projects Gym Management System V1.0 allows remote attackers to execute arbitrary SQL commands via the login form, leading to unauthoriz (no CVSS)
- [CVE-2023-38347](https://cve.now/CVE-2023-38347.md): An issue was discovered in LWsystems Benno MailArchiv 2.10.1. (no CVSS)
- [CVE-2023-38348](https://cve.now/CVE-2023-38348.md): A CSRF issue was discovered in LWsystems Benno MailArchiv 2.10.1. (no CVSS)
- [CVE-2023-38997](https://cve.now/CVE-2023-38997.md): A directory traversal vulnerability in the Captive Portal templates of OPNsense Community Edition before 23.7 and Business Edition before 23 (no CVSS)
- [CVE-2023-38998](https://cve.now/CVE-2023-38998.md): An open redirect in the Login page of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows attackers to redirect (no CVSS)
- [CVE-2023-38999](https://cve.now/CVE-2023-38999.md): A Cross-Site Request Forgery (CSRF) in the System Halt API (/system/halt) of OPNsense Community Edition before 23.7 and Business Edition bef (no CVSS)
- [CVE-2023-39000](https://cve.now/CVE-2023-39000.md): A reflected cross-site scripting (XSS) vulnerability in the component /ui/diagnostics/log/core/ of OPNsense Community Edition before 23.7 an (no CVSS)
- [CVE-2023-39001](https://cve.now/CVE-2023-39001.md): A command injection vulnerability in the component diag\_backup.php of OPNsense Community Edition before 23.7 and Business Edition before 23. (no CVSS)
- [CVE-2023-39002](https://cve.now/CVE-2023-39002.md): A cross-site scripting (XSS) vulnerability in the act parameter of system\_certmanager.php in OPNsense Community Edition before 23.7 and Busi (no CVSS)
- [CVE-2023-39003](https://cve.now/CVE-2023-39003.md): OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 was discovered to contain insecure permissions in the directory /t (no CVSS)
- [CVE-2023-39004](https://cve.now/CVE-2023-39004.md): Insecure permissions in the configuration directory (/conf/) of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 al (no CVSS)
- [CVE-2023-39005](https://cve.now/CVE-2023-39005.md): Insecure permissions exist for configd.socket in OPNsense Community Edition before 23.7 and Business Edition before 23.4.2. (no CVSS)
- [CVE-2023-39006](https://cve.now/CVE-2023-39006.md): The Crash Reporter (crash\_reporter.php) component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 mishandles in (no CVSS)
- [CVE-2023-39007](https://cve.now/CVE-2023-39007.md): /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAct (no CVSS)
- [CVE-2023-39008](https://cve.now/CVE-2023-39008.md): A command injection vulnerability in the component /api/cron/settings/setJob/ of OPNsense Community Edition before 23.7 and Business Edition (no CVSS)
- [CVE-2023-39910](https://cve.now/CVE-2023-39910.md): The cryptocurrency wallet entropy seeding mechanism used in Libbitcoin Explorer 3.0.0 through 3.6.0 is weak, aka the Milk Sad issue. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.