# CVEs published 2023-08-10

132 CVEs were published on August 10, 2023: 1 critical, 36 high. Days are UTC.

- [CVE-2023-35179](https://cve.now/CVE-2023-35179.md): 2FA/MFA Bypass Vulnerability in Serv-U 15.4 (CVSS 7.2, SolarWinds Serv-U)
- [CVE-2023-40014](https://cve.now/CVE-2023-40014.md): OpenZeppelin Contracts's ERC2771Context with custom forwarder may lead to zero-valued \_msgSender (CVSS 5.3, openzeppelin-contracts · @openzeppelin/contracts +1)
- [CVE-2023-28129](https://cve.now/CVE-2023-28129.md): DSM 2022.2 SU2 and all prior versions allows a local low privileged account to execute arbitrary OS commands as the DSM software installatio (no CVSS, Ivanti Desktop & Server Management)
- [CVE-2023-32560](https://cve.now/CVE-2023-32560.md): An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary co (CVSS 8.8, Ivanti Avalanche)
- [CVE-2023-32561](https://cve.now/CVE-2023-32561.md): A previously generated artifact by an administrator could be accessed by an attacker. (CVSS 7.1, Ivanti Avalanche)
- [CVE-2023-32562](https://cve.now/CVE-2023-32562.md): An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker t (CVSS 6.8, Ivanti Avalanche)
- [CVE-2023-32563](https://cve.now/CVE-2023-32563.md): An unauthenticated attacker could achieve the code execution through a RemoteControl server. (CVSS 8.8, Ivanti Avalanche)
- [CVE-2023-32564](https://cve.now/CVE-2023-32564.md): An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t (CVSS 6.8, Ivanti Avalanche)
- [CVE-2023-32565](https://cve.now/CVE-2023-32565.md): An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. (CVSS 6.3, Ivanti Avalanche)
- [CVE-2023-32566](https://cve.now/CVE-2023-32566.md): An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. (CVSS 6.3, Ivanti Avalanche)
- [CVE-2023-32567](https://cve.now/CVE-2023-32567.md): Ivanti Avalanche decodeToMap XML External Entity Processing. (CVSS 6.5, Ivanti Wavelink)
- [CVE-2023-35085](https://cve.now/CVE-2023-35085.md): An integer overflow vulnerability in all UniFi Access Points and Switches, excluding the Switch Flex Mini, with SNMP Monitoring and default (CVSS 9.0, Ubiquiti UniFi Access Points · Ubiquiti UniFi Switches)
- [CVE-2023-38034](https://cve.now/CVE-2023-38034.md): A command injection vulnerability in the DHCP Client function of all UniFi Access Points and Switches, excluding the Switch Flex Mini, could (CVSS 8.3, Ubiquiti UniFi Access Points · Ubiquiti UniFi Switches)
- [CVE-2023-23342](https://cve.now/CVE-2023-23342.md): HCL Nomad for web is affected by cryptographic validation of local data access that can be circumvented (CVSS 6.6, HCL Software HCL Nomad for web)
- [CVE-2023-39966](https://cve.now/CVE-2023-39966.md): 1Panel arbitrary file write vulnerability exists in the background (CVSS 7.5, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2023-39965](https://cve.now/CVE-2023-39965.md): 1Panel Unauthorized access in Backend (CVSS 6.5, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2023-39964](https://cve.now/CVE-2023-39964.md): 1Panel O&M management panel has a background arbitrary file reading vulnerability (CVSS 7.5, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2023-39963](https://cve.now/CVE-2023-39963.md): Missing password confirmation when creating app passwords (CVSS 8.1, nextcloud security-advisories)
- [CVE-2023-39962](https://cve.now/CVE-2023-39962.md): Users can delete external storage mount points (CVSS 7.7, nextcloud security-advisories)
- [CVE-2023-39961](https://cve.now/CVE-2023-39961.md): Text does not respect "Allow download" permissions (CVSS 3.5, nextcloud security-advisories)
- [CVE-2023-39959](https://cve.now/CVE-2023-39959.md): Existence of calendars and address books can be checked by unauthenticated users (CVSS 3.5, nextcloud security-advisories)
- [CVE-2023-39958](https://cve.now/CVE-2023-39958.md): Missing brute force protection on password reset token OAuth2 API controller (CVSS 5.8, nextcloud security-advisories)
- [CVE-2023-39957](https://cve.now/CVE-2023-39957.md): Path traversal allows tricking the Talk Android app into writing files into it's root directory (CVSS 7.2, nextcloud security-advisories)
- [CVE-2023-39955](https://cve.now/CVE-2023-39955.md): Notes attachment render HTML in preview mode (CVSS 3.5, nextcloud security-advisories)
- [CVE-2023-39954](https://cve.now/CVE-2023-39954.md): user\_oidc app stores client secret unencrypted in database (CVSS 3.8, nextcloud security-advisories)
- [CVE-2023-39953](https://cve.now/CVE-2023-39953.md): Issuer not verified from obtained token in user\_oidc (CVSS 4.8, nextcloud security-advisories)
- [CVE-2023-39952](https://cve.now/CVE-2023-39952.md): Advanced permissions not respected when copying entire group folders (CVSS 6.5, nextcloud security-advisories)
- [CVE-2023-38210](https://cve.now/CVE-2023-38210.md): Other | Uncontrolled Resource Consumption (CWE-400) (CVSS 5.5, Adobe XMP Toolkit)
- [CVE-2023-38397](https://cve.now/CVE-2023-38397.md): WordPress Gestion-Pymes Plugin \<= 1.5.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Eggemplo Gestion-Pymes)
- [CVE-2023-38246](https://cve.now/CVE-2023-38246.md): Adobe Acrobat Reader DC ActiveX Control (AxAcroPDFLib.AxAcroPDF) stack-based stale pointer vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-29320](https://cve.now/CVE-2023-29320.md): ZDI-CAN-20712: Adobe Acrobat Blacklist Bypass Design flaw (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-29299](https://cve.now/CVE-2023-29299.md): Adobe Acrobat Reader Untrusted Search Path Application denial-of-service (CVSS 4.7, Adobe Acrobat Reader)
- [CVE-2023-38226](https://cve.now/CVE-2023-38226.md): ZDI-CAN-21240: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-38228](https://cve.now/CVE-2023-38228.md): ZDI-CAN-21317: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-38231](https://cve.now/CVE-2023-38231.md): ZDI-CAN-21334: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-29303](https://cve.now/CVE-2023-29303.md): ZDI-CAN-20970: Adobe Acrobat Reader DC AcroForm Annotation Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38225](https://cve.now/CVE-2023-38225.md): ZDI-CAN-21118: Adobe Acrobat Reader DC AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-38229](https://cve.now/CVE-2023-38229.md): ZDI-CAN-21310: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-38233](https://cve.now/CVE-2023-38233.md): ZDI-CAN-21337: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-38222](https://cve.now/CVE-2023-38222.md): ZDI-CAN-21103: Adobe Acrobat Reader DC AcroForm spawnPageFromTemplate Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-38227](https://cve.now/CVE-2023-38227.md): ZDI-CAN-21241: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-38223](https://cve.now/CVE-2023-38223.md): ZDI-CAN-21063: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-38245](https://cve.now/CVE-2023-38245.md): Adobe Acrobat Reader DC ActiveX Control (AxAcroPDFLib.AxAcroPDF) src NTLMv2 SSO Hash Theft Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38238](https://cve.now/CVE-2023-38238.md): ZDI-CAN-21243: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38236](https://cve.now/CVE-2023-38236.md): ZDI-CAN-21247: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38235](https://cve.now/CVE-2023-38235.md): ZDI-CAN-21356: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38232](https://cve.now/CVE-2023-38232.md): ZDI-CAN-21357: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38248](https://cve.now/CVE-2023-38248.md): ZDI-CAN-21494: Adobe Acrobat Reader DC PDF Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38244](https://cve.now/CVE-2023-38244.md): ZDI-CAN-21371: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38247](https://cve.now/CVE-2023-38247.md): ZDI-CAN-21449: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38237](https://cve.now/CVE-2023-38237.md): ZDI-CAN-21244: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38242](https://cve.now/CVE-2023-38242.md): ZDI-CAN-21387: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38240](https://cve.now/CVE-2023-38240.md): ZDI-CAN-21245: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38239](https://cve.now/CVE-2023-38239.md): ZDI-CAN-21242: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38230](https://cve.now/CVE-2023-38230.md): ZDI-CAN-21318: Adobe Acrobat Reader DC Font Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38241](https://cve.now/CVE-2023-38241.md): ZDI-CAN-21246: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-38224](https://cve.now/CVE-2023-38224.md): ZDI-CAN-21122: Adobe Acrobat Reader DC Annotation Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-38234](https://cve.now/CVE-2023-38234.md): ZDI-CAN-21359: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-38243](https://cve.now/CVE-2023-38243.md): ZDI-CAN-21252: Adobe Acrobat Reader DC JBIG2 File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-37388](https://cve.now/CVE-2023-37388.md): WordPress Simple Light Weight Social Share (Tweet, Like, Share and Linkedin) Plugin \<= 2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Sudipto Pratap Mahato Simple Light Weight Social Share)
- [CVE-2023-28779](https://cve.now/CVE-2023-28779.md): WordPress Terms descriptions Plugin \<= 3.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Vladimir Statsenko Terms descriptions)
- [CVE-2023-37983](https://cve.now/CVE-2023-37983.md): WordPress Art Direction Plugin \<= 0.2.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Noël Jackson Art Direction)
- [CVE-2023-39314](https://cve.now/CVE-2023-39314.md): WordPress Leyka Plugin \<= 3.30.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Teplitsa of social technologies Leyka)
- [CVE-2023-24393](https://cve.now/CVE-2023-24393.md): WordPress Animated Number Counters Plugin \<= 1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Sk. Abul Hasan Animated Number Counters)
- [CVE-2023-24391](https://cve.now/CVE-2023-24391.md): WordPress ApplyOnline – Application Form Builder and Manager Plugin \<= 2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Spider Teams ApplyOnline)
- [CVE-2023-23828](https://cve.now/CVE-2023-23828.md): WordPress WP Category Post List Widget Plugin \<= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Swashata WP Category Post List Widget)
- [CVE-2023-36530](https://cve.now/CVE-2023-36530.md): WordPress SP Project & Document Manager Plugin \<= 4.67 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Smartypants SP Project & Document Manager)
- [CVE-2023-30481](https://cve.now/CVE-2023-30481.md): WordPress AGP Font Awesome Collection Plugin \<= 3.2.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Alexey Golubnichenko AGP Font Awesome Collection)
- [CVE-2023-23900](https://cve.now/CVE-2023-23900.md): WordPress Easy Forms for Mailchimp Plugin \<= 6.8.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, YIKES Easy Forms for Mailchimp)
- [CVE-2023-34374](https://cve.now/CVE-2023-34374.md): WordPress AnsPress – Question and answer Plugin \<= 4.3.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Rahul Aryan AnsPress)
- [CVE-2023-4283](https://cve.now/CVE-2023-4283.md): EmbedPress \<= 3.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2023-4282](https://cve.now/CVE-2023-4282.md): EmbedPress \<= 3.8.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Delete via admin\_post\_remove and remove\_private\_data (CVSS 5.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2023-37988](https://cve.now/CVE-2023-37988.md): WordPress Contact Form Generator Plugin \<= 2.5.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Creative Solutions Contact Form Generator)
- [CVE-2023-23871](https://cve.now/CVE-2023-23871.md): WordPress Button Plugin \<= 1.1.23 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Webdzier Button)
- [CVE-2023-26311](https://cve.now/CVE-2023-26311.md): A remote code execution vulnerability in the webview component of OPPO Store app. (CVSS 7.4, OPPO Store)
- [CVE-2023-24009](https://cve.now/CVE-2023-24009.md): WordPress Upfrontwp Theme \<= 1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Wpazure Themes Upfrontwp)
- [CVE-2023-23798](https://cve.now/CVE-2023-23798.md): WordPress Layer Slider Plugin \<= 1.1.9.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Muneeb Layer Slider)
- [CVE-2022-44629](https://cve.now/CVE-2022-44629.md): WordPress Catalyst Connect Zoho CRM Client Portal Plugin \<= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Catalyst Connect Zoho CRM Client Portal)
- [CVE-2022-27861](https://cve.now/CVE-2022-27861.md): WordPress Ninja Popups Plugin \<= 4.7.5 is vulnerable to Open Redirection (CVSS 4.7, Arscode Ninja Popups)
- [CVE-2023-23826](https://cve.now/CVE-2023-23826.md): WordPress Add Posts to Pages Plugin \<= 1.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Arsham Mirshah Add Posts to Pages)
- [CVE-2023-24389](https://cve.now/CVE-2023-24389.md): WordPress Social Proof (Testimonial) Slider Plugin \<= 2.2.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, brandiD Social Proof (Testimonial) Slider)
- [CVE-2023-26309](https://cve.now/CVE-2023-26309.md): A remote code execution vulnerability in the webview component (CVSS 7.4, OPPO OnePlus Store)
- [CVE-2023-31209](https://cve.now/CVE-2023-31209.md): Command injection via active checks and REST API (CVSS 8.8, Checkmk)
- [CVE-2023-4276](https://cve.now/CVE-2023-4276.md): Absolute Privacy \<= 2.1 - Cross-Site Request Forgery to User Email/Password Change (CVSS 8.8, johnkolbert Absolute Privacy)
- [CVE-2023-4277](https://cve.now/CVE-2023-4277.md): Realia \<= 1.4.0 - Cross-Site Request Forgery to User Email Change (CVSS 8.8, pragmaticmates Realia)
- [CVE-2023-30705](https://cve.now/CVE-2023-30705.md): Improper sanitization of incoming intent in Galaxy Store prior to version 4.5.56.6?allows local attackers to access privileged content provi (CVSS 6.8, Samsung Mobile Galaxy Store)
- [CVE-2023-30704](https://cve.now/CVE-2023-30704.md): Improper Authorization vulnerability in Samsung Internet prior to version 22.0.0.35 allows physical attacker access downloaded files in Secr (CVSS 3.8, Samsung Mobile Samsung Internet)
- [CVE-2023-30703](https://cve.now/CVE-2023-30703.md): Improper URL validation vulnerability in Samsung Members prior to version 14.0.07.1 allows attackers to access sensitive information. (CVSS 3.3, Samsung Mobile Samsung Members)
- [CVE-2023-30702](https://cve.now/CVE-2023-30702.md): Stack overflow vulnerability in SSHDCPAPP TA prior to &quot;SAMSUNG ELECTONICS, CO, LTD. (CVSS 6.7, Samsung Mobile Galaxy book Go, Galaxy book Go 5G, Galaxy bo…)
- [CVE-2023-30701](https://cve.now/CVE-2023-30701.md): PendingIntent hijacking in WifiGeofenceManager prior to SMR Aug-2023 Release 1 allows local attacker to arbitrary file access. (CVSS 4.7, Samsung Mobile Devices)
- [CVE-2023-30700](https://cve.now/CVE-2023-30700.md): PendingIntent hijacking vulnerability in SemWifiApTimeOutImpl in framework prior to SMR Aug-2023 Release 1 allows local attackers to access (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2023-30699](https://cve.now/CVE-2023-30699.md): Out-of-bounds write vulnerability in parser\_hvcC function of libsimba library prior to SMR Aug-2023 Release 1 allows code execution by remot (CVSS 7.5, Samsung Mobile Devices)
- [CVE-2023-30698](https://cve.now/CVE-2023-30698.md): Improper access control vulnerability in TelephonyUI prior to SMR Aug-2023 Release 1 allows local attacker to connect BLE without privilege. (CVSS 5.5, Samsung Mobile Devices)
- [CVE-2023-30697](https://cve.now/CVE-2023-30697.md): An improper input validation in IpcTxCfgSetSimlockPayload in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-boun (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2023-30696](https://cve.now/CVE-2023-30696.md): An improper input validation in IpcTxGetVerifyAkey in libsec-ril prior to SMR Aug-2023 Release 1 allows attacker to cause out-of-bounds writ (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2023-30695](https://cve.now/CVE-2023-30695.md): Out-of-bounds Write vulnerability in SSHDCPAPP TA prior to &quot;SAMSUNG ELECTONICS, CO, LTD. (CVSS 6.7, Samsung Mobile Galaxy book Go, Galaxy book Go 5G, Galaxy bo…)
- [CVE-2023-30694](https://cve.now/CVE-2023-30694.md): Out-of-bounds Write in IpcTxPcscTransmitApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30693](https://cve.now/CVE-2023-30693.md): Out-of-bounds Write in DoOemFactorySendFactoryBypassCommand of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute a (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30691](https://cve.now/CVE-2023-30691.md): Parcel mismatch in AuthenticationConfig prior to SMR Aug-2023 Release 1 allows local attacker to privilege escalation. (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2023-30689](https://cve.now/CVE-2023-30689.md): Out-of-bounds Write in BuildOemEmbmsGetSigStrengthResponse of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute ar (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30688](https://cve.now/CVE-2023-30688.md): Out-of-bounds Write in MakeUiccAuthForOem of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30687](https://cve.now/CVE-2023-30687.md): Out-of-bounds Write in RmtUimApdu of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30686](https://cve.now/CVE-2023-30686.md): Out-of-bounds Write in ReqDataRaw of libsec-ril prior to SMR Aug-2023 Release 1 allows local attacker to execute arbitrary code. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-30685](https://cve.now/CVE-2023-30685.md): Improper access control vulnerability in Telecom prior to SMR Aug-2023 Release 1 allows local attakcers to change TTY mode. (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2023-30684](https://cve.now/CVE-2023-30684.md): Improper access control in Samsung Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call acceptRingingCall API without perm (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2023-30683](https://cve.now/CVE-2023-30683.md): Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call endCall API without permission. (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2023-30682](https://cve.now/CVE-2023-30682.md): Improper access control in Telecom prior to SMR Aug-2023 Release 1 allows local attackers to call silenceRinger API without permission. (CVSS 4.3, Samsung Mobile Devices)
- [CVE-2023-30681](https://cve.now/CVE-2023-30681.md): An improper input validation vulnerability within initialize function in HAL VaultKeeper prior to SMR Aug-2023 Release 1 allows attacker to (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2023-30680](https://cve.now/CVE-2023-30680.md): Improper privilege management vulnerability in MMIGroup prior to SMR Aug-2023 Release 1 allows code execution with privilege. (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2023-30679](https://cve.now/CVE-2023-30679.md): Improper access control in HDCP trustlet prior to SMR Aug-2023 Release 1 allows local attackers to execute arbitrary code. (CVSS 7.8, Samsung Mobile Devices)
- [CVE-2023-30654](https://cve.now/CVE-2023-30654.md): Improper access control vulnerability in SLocationService prior to SMR Aug-2023 Release 1 allows local attacker to update fake location. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2022-47636](https://cve.now/CVE-2022-47636.md): A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. (no CVSS)
- [CVE-2023-36309](https://cve.now/CVE-2023-36309.md): There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Document Creator v1.0. (no CVSS)
- [CVE-2023-36310](https://cve.now/CVE-2023-36310.md): There is a Cross Site Scripting (XSS) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0. (no CVSS)
- [CVE-2023-36311](https://cve.now/CVE-2023-36311.md): There is a SQL injection (SQLi) vulnerability in the "column" parameter of index.php in PHPJabbers Document Creator v1.0. (no CVSS)
- [CVE-2023-36312](https://cve.now/CVE-2023-36312.md): There is a Cross Site Scripting (XSS) vulnerability in the value-enum-o\_bf\_include\_timezone parameter of index.php in PHPJabbers Callback Wi (no CVSS)
- [CVE-2023-36313](https://cve.now/CVE-2023-36313.md): PHPJabbers Document Creator v1.0 is vulnerable to Cross Site Scripting (XSS) via all post parameters of "Export Requests" aside from "reques (no CVSS)
- [CVE-2023-36314](https://cve.now/CVE-2023-36314.md): There is a Cross Site Scripting (XSS) vulnerability in the value-text-o\_sms\_email\_request\_message parameters of index.php in PHPJabbers Call (no CVSS)
- [CVE-2023-36315](https://cve.now/CVE-2023-36315.md): There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Callback Widget v1.0. (no CVSS)
- [CVE-2023-37069](https://cve.now/CVE-2023-37069.md): Code-Projects Online Hospital Management System V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to manipulate th (no CVSS)
- [CVE-2023-37543](https://cve.now/CVE-2023-37543.md): Cacti before 1.2.6 allows IDOR (Insecure Direct Object Reference) for accessing any graph via a modified local\_graph\_id parameter to graph\_x (no CVSS)
- [CVE-2023-37625](https://cve.now/CVE-2023-37625.md): A stored cross-site scripting (XSS) vulnerability in Netbox v3.4.7 allows attackers to execute arbitrary web scripts or HTML via a crafted p (no CVSS)
- [CVE-2023-37734](https://cve.now/CVE-2023-37734.md): EZ softmagic MP3 Audio Converter 2.7.3.700 was discovered to contain a buffer overflow. (no CVSS)
- [CVE-2023-38333](https://cve.now/CVE-2023-38333.md): Zoho ManageEngine Applications Manager through 16530 allows reflected XSS while logged in. (CVSS 6.1)
- [CVE-2023-38830](https://cve.now/CVE-2023-38830.md): An information leak in PHPJabbers Yacht Listing Script v1.0 allows attackers to export clients' credit card numbers from the Reservations mo (no CVSS)
- [CVE-2023-39776](https://cve.now/CVE-2023-39776.md): A File Upload vulnerability in PHPJabbers Ticket Support Script v3.2 allows attackers to execute arbitrary code via uploading a crafted file (no CVSS)
- [CVE-2023-39805](https://cve.now/CVE-2023-39805.md): iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the where parameter at admincp.php. (no CVSS)
- [CVE-2023-39806](https://cve.now/CVE-2023-39806.md): iCMS v7.0.16 was discovered to contain a SQL injection vulnerability via the bakupdata function. (no CVSS)
- [CVE-2023-40216](https://cve.now/CVE-2023-40216.md): OpenBSD 7.3 before errata 014 is missing an argument-count bounds check in console terminal emulation. (no CVSS)
- [CVE-2023-40224](https://cve.now/CVE-2023-40224.md): MISP 2.4.174 allows XSS in app/View/Events/index.ctp. (no CVSS)
- [CVE-2023-40225](https://cve.now/CVE-2023-40225.md): HAProxy through 2.0.32, 2.1.x and 2.2.x through 2.2.30, 2.3.x and 2.4.x through 2.4.23, 2.5.x and 2.6.x before 2.6.15, 2.7.x before 2.7.10, (no CVSS)
- [CVE-2023-40235](https://cve.now/CVE-2023-40235.md): An NTLM Hash Disclosure was discovered in ArchiMate Archi before 5.1.0. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.