CVEs published August 15, 2023
95 CVEs were published on August 15, 2023: 4 critical, 17 high. 1 is now in CISA KEV.
- Published
- 95
- Critical
- 4
- High
- 17
- Medium
- 4
- Low
- 2
- Unrated
- 68
- Now in CISA KEV
- 1
- Fix available
- 55
Most affected products
- Google Chrome
- 22
- Broadcom LSI Storage Authority · Intel RAID Web Console
- 19
- Broadcom LSI Storage Authority
- 3
- langchain
- 3
- NodeJS Node
- 3
- AMD Ryzen™ Master
- 2
- Hewlett Packard Enterprise (HPE) HPE Aruba Networking Virtu…
- 2
- CodeFlavors Vimeotheque: Vimeo WordPress Plugin
- 1
- Intel Agilex(R) software included as part of Intel(R) Quart…
- 1
- Ivanti EPMM
- 1
Critical 4
- CVE-2023-4344Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connectionBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-35082An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resouIvanti EPMM
- CVE-2023-39851webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php.
- CVE-2023-39852Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php.
High 17
- CVE-2023-38402Arbitrary File Overwrite in HPE Aruba Networking Virtual Intranet Access (VIA) Microsoft Windows ClientHewlett Packard Enterprise (HPE) HPE Aruba Networking Virtu…
- CVE-2023-38401Local Privilege Escalation in HPE Aruba Networking Virtual Intranet Access (VIA) Microsoft Windows ClientHewlett Packard Enterprise (HPE) HPE Aruba Networking Virtu…
- CVE-2023-4369Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to 116.0.5845.120 allowed an attacker who convinced a Google Chrome
- CVE-2023-4358Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2023-4357Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access reGoogle Chrome
- CVE-2023-4355Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2023-4354Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2023-4353Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2023-4352Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted Google Chrome
- CVE-2023-39438Missing Authorization check allows certain operations on CLA Assistant dataSAP_SE CLA Assistant
- CVE-2023-32004A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model.NodeJS Node
- CVE-2023-32006The use of `module.constructor.createRequire()` can bypass the policy mechanism and require modules outside of the policy.json definition foNodeJS Node
- CVE-2023-30498WordPress Vimeotheque Plugin <= 2.2.1 is vulnerable to Cross Site Scripting (XSS)CodeFlavors Vimeotheque: Vimeo WordPress Plugin
- CVE-2023-30747WordPress WooCommerce Easy Duplicate Product Plugin <= 0.3.0.0 is vulnerable to Cross Site Scripting (XSS)WPGem WooCommerce Easy Duplicate Product
- CVE-2023-2916InfiniteWP Client <= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposurerevmakx InfiniteWP Client
- CVE-2023-4308User Submitted Posts <= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content'specialk User Submitted Posts – Enable Users to Submit Post…
- CVE-2023-4347Cross-site Scripting (XSS) - Reflected in librenms/librenmslibrenms/librenms
Medium, low and unrated 74
- CVE-2023-20560 AMD Ryzen™ Master
- CVE-2023-20564 AMD Ryzen™ Master
- CVE-2023-4324Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headersBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4325Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilitiesBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4326Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuitesBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4327Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on LinuxBroadcom LSI Storage Authority
- CVE-2023-4328Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on LinuxBroadcom LSI Storage Authority
- CVE-2023-4329Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attributeBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4331Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocolsBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4332Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log fileBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4333Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by serverBroadcom LSI Storage Authority
- CVE-2023-4334Broadcom RAID Controller Web server (nginx) is serving private files without any authenticationBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4335Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on LinuxBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4336Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attributeBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4337Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installationBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4338Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options HeadersBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4339Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissionsBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4340Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log fileBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4341Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUIBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4342Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policyBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4343Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameterBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4323Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setupBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-4345Broadcom RAID Controller web interface is vulnerable client-side control bypassBroadcom LSI Storage Authority · Intel RAID Web Console
- CVE-2023-40027Conditionally missing authorization in @keystone-6/corekeystonejs keystone · @keystone-6/core
- CVE-2023-40028Arbitrary file read via symlinks in GhostTryGhost Ghost · ghost
- CVE-2023-4368Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to instalGoogle Chrome
- CVE-2023-4367Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to instalGoogle Chrome
- CVE-2023-4366Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2023-4365Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a Google Chrome
- CVE-2023-4364Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UGoogle Chrome
- CVE-2023-4363Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents Google Chrome
- CVE-2023-4362Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer processGoogle Chrome
- CVE-2023-4361Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill resGoogle Chrome
- CVE-2023-4360Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a craftGoogle Chrome
- CVE-2023-4359Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof eGoogle Chrome
- CVE-2023-4356Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI Google Chrome
- CVE-2023-4351Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potentialGoogle Chrome
- CVE-2023-4350Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to potentially spoofGoogle Chrome
- CVE-2023-4349Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corrGoogle Chrome
- CVE-2023-2312Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer procGoogle Chrome
- CVE-2023-32003`fs.mkdtemp()` and `fs.mkdtempSync()` can be used to bypass the permission model check using a path traversal attack.NodeJS Node
- CVE-2023-4371phpRecDB index.php cross site scriptingphpRecDB
- CVE-2023-24478Use of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux beIntel Agilex(R) software included as part of Intel(R) Quart…
- CVE-2023-30778WordPress PowerPress Podcasting Plugin <= 10.0.1 is vulnerable to Cross Site Scripting (XSS)PowerPress Podcasting plugin by Blubrry
- CVE-2023-28479An issue was discovered in Tigergraph Enterprise 3.7.0.
- CVE-2023-38840Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process.
- CVE-2023-38850Buffer Overflow vulnerability in Michaelrsweet codedoc v.3.7 allows an attacker to cause a denial of service via the codedoc.c:1742 comppnen
- CVE-2023-38851Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte
- CVE-2023-38852Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte
- CVE-2023-38853Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte
- CVE-2023-38854Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte
- CVE-2023-38855Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte
- CVE-2023-38856Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte
- CVE-2023-38857Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the stco
- CVE-2023-38858Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4i
- CVE-2023-38860An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter.langchain
- CVE-2023-38861An issue in Wavlink WL_WNJ575A3 v.R75A3_V1410_220513 allows a remote attacker to execute arbitrary code via username parameter of the set_sy
- CVE-2023-38862An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub_431F64 function in bin
- CVE-2023-38863An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub_410074 functio
- CVE-2023-38864An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal_delete_picname parameter in the sub_41171C f
- CVE-2023-38865COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_4143F0.
- CVE-2023-38866COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub_415588.
- CVE-2023-38889An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxioorg.alluxio:alluxio-parent
- CVE-2023-38896An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from_math_prompt and frlangchain
- CVE-2023-38898An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the _asyncio._swap_current_task component.
- CVE-2023-38915File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbtirary code via the upload type function.
- CVE-2023-38916SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information v
- CVE-2023-39659An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the Pytholangchain
- CVE-2023-39661An issue in pandas-ai v.0.9.1 and before allows a remote attacker to execute arbitrary code via the _is_jailbreak function.pandasai
- CVE-2023-39662An issue in llama_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the `exec` parameter in PandasQueryEnginellama-index
- CVE-2023-39841Missing encryption in the RFID tag of Etekcity 3-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proxim
- CVE-2023-39842Missing encryption in the RFID tag of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to create a cloned tag via brief physic
- CVE-2023-39843Missing encryption in the RFID tag of Suleve 5-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximit
- CVE-2023-39850Schoolmate v1.3 was discovered to contain multiple SQL injection vulnerabilities via the $courseid and $teacherid parameters at DeleteFuncti