CVEs published August 10, 2023
132 CVEs were published on August 10, 2023: 1 critical, 36 high.
- Published
- 132
- Critical
- 1
- High
- 36
- Medium
- 68
- Low
- 6
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Adobe Acrobat Reader
- 30
- Samsung Mobile Devices
- 21
- nextcloud security-advisories
- 10
- Ivanti Avalanche
- 7
- 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- 3
- Samsung Mobile Galaxy book Go, Galaxy book Go 5G, Galaxy bo…
- 2
- Ubiquiti UniFi Access Points · Ubiquiti UniFi Switches
- 2
- wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- 2
- Adobe XMP Toolkit
- 1
- Alexey Golubnichenko AGP Font Awesome Collection
- 1
Critical 1
High 36
- CVE-2023-351792FA/MFA Bypass Vulnerability in Serv-U 15.4 SolarWinds Serv-U
- CVE-2023-32560An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary coIvanti Avalanche
- CVE-2023-32561A previously generated artifact by an administrator could be accessed by an attacker.Ivanti Avalanche
- CVE-2023-32563An unauthenticated attacker could achieve the code execution through a RemoteControl server.Ivanti Avalanche
- CVE-2023-38034A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, couldUbiquiti UniFi Access Points · Ubiquiti UniFi Switches
- CVE-2023-399661Panel arbitrary file write vulnerability exists in the background1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- CVE-2023-399641Panel O&M management panel has a background arbitrary file reading vulnerability1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- CVE-2023-39963Missing password confirmation when creating app passwordsnextcloud security-advisories
- CVE-2023-39962Users can delete external storage mount pointsnextcloud security-advisories
- CVE-2023-39957Path traversal allows tricking the Talk Android app into writing files into it's root directorynextcloud security-advisories
- CVE-2023-38246Adobe Acrobat Reader DC ActiveX Control (AxAcroPDFLib.AxAcroPDF) stack-based stale pointer vulnerabilityAdobe Acrobat Reader
- CVE-2023-29320ZDI-CAN-20712: Adobe Acrobat Blacklist Bypass Design flawAdobe Acrobat Reader
- CVE-2023-38226ZDI-CAN-21240: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-38228ZDI-CAN-21317: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-38231ZDI-CAN-21334: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-38225ZDI-CAN-21118: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-38229ZDI-CAN-21310: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38233ZDI-CAN-21337: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-38222ZDI-CAN-21103: Adobe Acrobat Reader DC AcroForm spawnPageFromTemplate Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-38227ZDI-CAN-21241: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-38223ZDI-CAN-21063: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-38224ZDI-CAN-21122: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-38234ZDI-CAN-21359: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-28779WordPress Terms descriptions Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)Vladimir Statsenko Terms descriptions
- CVE-2023-39314WordPress Leyka Plugin <= 3.30.2 is vulnerable to Cross Site Scripting (XSS)Teplitsa of social technologies Leyka
- CVE-2023-30481WordPress AGP Font Awesome Collection Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)Alexey Golubnichenko AGP Font Awesome Collection
- CVE-2023-37988WordPress Contact Form Generator Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)Creative Solutions Contact Form Generator
- CVE-2023-26311 A remote code execution vulnerability in the webview component of OPPO Store app.OPPO Store
- CVE-2023-26309A remote code execution vulnerability in the webview componentOPPO OnePlus Store
- CVE-2023-31209Command injection via active checks and REST APICheckmk
- CVE-2023-4276Absolute Privacy <= 2.1 - Cross-Site Request Forgery to User Email/Password Changejohnkolbert Absolute Privacy
- CVE-2023-4277Realia <= 1.4.0 - Cross-Site Request Forgery to User Email Changepragmaticmates Realia
- CVE-2023-30699Out-of-bounds write vulnerability in parser_hvcC function of libsimba library prior to SMR Aug-2023 Release 1 allows code execution by remotSamsung Mobile Devices
- CVE-2023-30691Parcel mismatch in AuthenticationConfig prior to SMR Aug-2023 Release 1 allows local attacker to privilege escalation.Samsung Mobile Devices
- CVE-2023-30680Improper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows code execution with privilege.Samsung Mobile Devices
- CVE-2023-30679Improper access control in HDCP trustlet prior to SMR Aug-2023 Release 1 allows local attackers to execute arbitrary code.Samsung Mobile Devices
Medium, low and unrated 95
- CVE-2023-40014OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued _msgSenderopenzeppelin-contracts · @openzeppelin/contracts +1
- CVE-2023-28129DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installatioIvanti Desktop & Server Management
- CVE-2023-32562An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker tIvanti Avalanche
- CVE-2023-32564An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker tIvanti Avalanche
- CVE-2023-32565An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.Ivanti Avalanche
- CVE-2023-32566An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.Ivanti Avalanche
- CVE-2023-32567Ivanti Avalanche decodeToMap XML External Entity Processing.Ivanti Wavelink
- CVE-2023-23342HCL Nomad for web is affected by cryptographic validation of local data access that can be circumventedHCL Software HCL Nomad for web
- CVE-2023-399651Panel Unauthorized access in Backend1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- CVE-2023-39961Text does not respect "Allow download" permissionsnextcloud security-advisories
- CVE-2023-39959Existence of calendars and address books can be checked by unauthenticated usersnextcloud security-advisories
- CVE-2023-39958Missing brute force protection on password reset token OAuth2 API controllernextcloud security-advisories
- CVE-2023-39955Notes attachment render HTML in preview modenextcloud security-advisories
- CVE-2023-39954user_oidc app stores client secret unencrypted in databasenextcloud security-advisories
- CVE-2023-39953Issuer not verified from obtained token in user_oidcnextcloud security-advisories
- CVE-2023-39952Advanced permissions not respected when copying entire group foldersnextcloud security-advisories
- CVE-2023-38210Other | Uncontrolled Resource Consumption (CWE-400)Adobe XMP Toolkit
- CVE-2023-38397WordPress Gestion-Pymes Plugin <= 1.5.6 is vulnerable to Cross Site Scripting (XSS)Eggemplo Gestion-Pymes
- CVE-2023-29299Adobe Acrobat Reader Untrusted Search Path Application denial-of-serviceAdobe Acrobat Reader
- CVE-2023-29303ZDI-CAN-20970: Adobe Acrobat Reader DC AcroForm Annotation Use-After-Free Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38245Adobe Acrobat Reader DC ActiveX Control (AxAcroPDFLib.AxAcroPDF) src NTLMv2 SSO Hash Theft VulnerabilityAdobe Acrobat Reader
- CVE-2023-38238ZDI-CAN-21243: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38236ZDI-CAN-21247: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38235ZDI-CAN-21356: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38232ZDI-CAN-21357: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38248ZDI-CAN-21494: Adobe Acrobat Reader DC PDF Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38244ZDI-CAN-21371: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38247ZDI-CAN-21449: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38237ZDI-CAN-21244: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38242ZDI-CAN-21387: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38240ZDI-CAN-21245: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38239ZDI-CAN-21242: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38230ZDI-CAN-21318: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38241ZDI-CAN-21246: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-38243ZDI-CAN-21252: Adobe Acrobat Reader DC JBIG2 File Parsing Use-After-Free Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-37388WordPress Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)Sudipto Pratap Mahato Simple Light Weight Social Share
- CVE-2023-37983WordPress Art Direction Plugin <= 0.2.4 is vulnerable to Cross Site Scripting (XSS)Noël Jackson Art Direction
- CVE-2023-24393WordPress Animated Number Counters Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)Sk. Abul Hasan Animated Number Counters
- CVE-2023-24391WordPress ApplyOnline – Application Form Builder and Manager Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)Spider Teams ApplyOnline
- CVE-2023-23828WordPress WP Category Post List Widget Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)Swashata WP Category Post List Widget
- CVE-2023-36530WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to Cross Site Scripting (XSS)Smartypants SP Project & Document Manager
- CVE-2023-23900WordPress Easy Forms for Mailchimp Plugin <= 6.8.8 is vulnerable to Cross Site Scripting (XSS)YIKES Easy Forms for Mailchimp
- CVE-2023-34374WordPress AnsPress – Question and answer Plugin <= 4.3.0 is vulnerable to Cross Site Scripting (XSS)Rahul Aryan AnsPress
- CVE-2023-4283EmbedPress <= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2023-4282EmbedPress <= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin_post_remove and remove_private_datawpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2023-23871WordPress Button Plugin <= 1.1.23 is vulnerable to Cross Site Scripting (XSS)Webdzier Button
- CVE-2023-24009WordPress Upfrontwp Theme <= 1.1 is vulnerable to Cross Site Scripting (XSS)Wpazure Themes Upfrontwp
- CVE-2023-23798WordPress Layer Slider Plugin <= 1.1.9.7 is vulnerable to Cross Site Scripting (XSS)Muneeb Layer Slider
- CVE-2022-44629WordPress Catalyst Connect Zoho CRM Client Portal Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)Catalyst Connect Zoho CRM Client Portal
- CVE-2022-27861WordPress Ninja Popups Plugin <= 4.7.5 is vulnerable to Open RedirectionArscode Ninja Popups
- CVE-2023-23826WordPress Add Posts to Pages Plugin <= 1.4.1 is vulnerable to Cross Site Scripting (XSS)Arsham Mirshah Add Posts to Pages
- CVE-2023-24389WordPress Social Proof (Testimonial) Slider Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)brandiD Social Proof (Testimonial) Slider
- CVE-2023-30705Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.56.6?allows local attackers to access privileged content proviSamsung Mobile Galaxy Store
- CVE-2023-30704Improper Authorization vulnerability in Samsung Internet prior to version 22.0.0.35 allows physical attacker access downloaded files in SecrSamsung Mobile Samsung Internet
- CVE-2023-30703Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive information.Samsung Mobile Samsung Members
- CVE-2023-30702Stack overflow vulnerability in SSHDCPAPP TA prior to "SAMSUNG ELECTONICS, CO, LTD.Samsung Mobile Galaxy book Go, Galaxy book Go 5G, Galaxy bo…
- CVE-2023-30701PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access.Samsung Mobile Devices
- CVE-2023-30700PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local attackers to access Samsung Mobile Devices
- CVE-2023-30698Improper access control vulnerability in TelephonyUI prior to SMR Aug-2023 Release 1 allows local attacker to connect BLE without privilege.Samsung Mobile Devices
- CVE-2023-30697An improper input validation in IpcTxCfgSetSimlockPayload in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounSamsung Mobile Devices
- CVE-2023-30696An improper input validation in IpcTxGetVerifyAkey in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds writSamsung Mobile Devices
- CVE-2023-30695Out-of-bounds Write vulnerability in SSHDCPAPP TA prior to "SAMSUNG ELECTONICS, CO, LTD.Samsung Mobile Galaxy book Go, Galaxy book Go 5G, Galaxy bo…
- CVE-2023-30694Out-of-bounds Write in IpcTxPcscTransmitApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-30693Out-of-bounds Write in DoOemFactorySendFactoryBypassCommand of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute aSamsung Mobile Devices
- CVE-2023-30689Out-of-bounds Write in BuildOemEmbmsGetSigStrengthResponse of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arSamsung Mobile Devices
- CVE-2023-30688Out-of-bounds Write in MakeUiccAuthForOem of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-30687Out-of-bounds Write in RmtUimApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-30686Out-of-bounds Write in ReqDataRaw of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-30685Improper access control vulnerability in Telecom prior to SMR Aug-2023 Release 1 allows local attakcers to change TTY mode.Samsung Mobile Devices
- CVE-2023-30684Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call acceptRingingCall API without permSamsung Mobile Devices
- CVE-2023-30683Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call endCall API without permission.Samsung Mobile Devices
- CVE-2023-30682Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call silenceRinger API without permission.Samsung Mobile Devices
- CVE-2023-30681An improper input validation vulnerability within initialize function in HAL VaultKeeper prior to SMR Aug-2023 Release 1 allows attacker to Samsung Mobile Devices
- CVE-2023-30654Improper access control vulnerability in SLocationService prior to SMR Aug-2023 Release 1 allows local attacker to update fake location.Samsung Mobile Devices
- CVE-2022-47636A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739.
- CVE-2023-36309There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Document Creator v1.0.
- CVE-2023-36310There is a Cross Site Scripting (XSS) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0.
- CVE-2023-36311There is a SQL injection (SQLi) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0.
- CVE-2023-36312There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o_bf_include_timezone parameter of index.php in PHPJabbers Callback Wi
- CVE-2023-36313PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting (XSS) via all post parameters of "Export Requests" aside from "reques
- CVE-2023-36314There is a Cross Site Scripting (XSS) vulnerability in the value-text-o_sms_email_request_message parameters of index.php in PHPJabbers Call
- CVE-2023-36315There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Callback Widget v1.0.
- CVE-2023-37069Code-Projects Online Hospital Management System V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to manipulate th
- CVE-2023-37543Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local_graph_id parameter to graph_x
- CVE-2023-37625A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted p
- CVE-2023-37734EZ softmagic MP3 Audio Converter 2.7.3.700 was discovered to contain a buffer overflow.
- CVE-2023-38333Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in.
- CVE-2023-38830An information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients' credit card numbers from the Reservations mo
- CVE-2023-39776A File Upload vulnerability in PHPJabbers Ticket Support Script v3.2 allows attackers to execute arbitrary code via uploading a crafted file
- CVE-2023-39805iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php.
- CVE-2023-39806iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function.
- CVE-2023-40216OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation.
- CVE-2023-40224MISP 2.4.174 allows XSS in app/View/Events/index.ctp.
- CVE-2023-40225HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10,
- CVE-2023-40235An NTLM Hash Disclosure was discovered in ArchiMate Archi before 5.1.0.