# CVEs published 2023-08-15

95 CVEs were published on August 15, 2023: 4 critical, 17 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-20560](https://cve.now/CVE-2023-20560.md):  (no CVSS, AMD Ryzen™ Master)
- [CVE-2023-20564](https://cve.now/CVE-2023-20564.md):  (no CVSS, AMD Ryzen™ Master)
- [CVE-2023-38402](https://cve.now/CVE-2023-38402.md): Arbitrary File Overwrite in HPE Aruba Networking Virtual Intranet Access (VIA) Microsoft Windows Client (CVSS 7.1, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Virtu…)
- [CVE-2023-4324](https://cve.now/CVE-2023-4324.md): Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP Content-Security-Policy headers (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4325](https://cve.now/CVE-2023-4325.md): Broadcom RAID Controller web interface is vulnerable due to usage of Libcurl with LSA has known vulnerabilities (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4326](https://cve.now/CVE-2023-4326.md): Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that supports obsolete SHA1-based ciphersuites (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4327](https://cve.now/CVE-2023-4327.md): Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux (no CVSS, Broadcom LSI Storage Authority)
- [CVE-2023-4328](https://cve.now/CVE-2023-4328.md): Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data and the keys used for encryption are accessible to any local user on Linux (no CVSS, Broadcom LSI Storage Authority)
- [CVE-2023-4329](https://cve.now/CVE-2023-4329.md): Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard SESSIONID cookie with SameSite attribute (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4331](https://cve.now/CVE-2023-4331.md): Broadcom RAID Controller web interface is vulnerable has an insecure default TLS configuration that support obsolete and vulnerable TLS protocols (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4332](https://cve.now/CVE-2023-4332.md): Broadcom RAID Controller web interface is vulnerable due to Improper permissions on the log file (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4333](https://cve.now/CVE-2023-4333.md): Broadcom RAID Controller web interface doesn’t enforce SSL cipher ordering by server (no CVSS, Broadcom LSI Storage Authority)
- [CVE-2023-4334](https://cve.now/CVE-2023-4334.md): Broadcom RAID Controller Web server (nginx) is serving private files without any authentication (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4335](https://cve.now/CVE-2023-4335.md): Broadcom RAID Controller Web server (nginx) is serving private server-side files without any authentication on Linux (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4336](https://cve.now/CVE-2023-4336.md): Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not safeguard cookies with Secure attribute (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4337](https://cve.now/CVE-2023-4337.md): Broadcom RAID Controller web interface is vulnerable to improper session handling of managed servers on Gateway installation (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4338](https://cve.now/CVE-2023-4338.md): Broadcom RAID Controller web interface is vulnerable due to insecure default of HTTP configuration that does not provide X-Content-Type-Options Headers (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4339](https://cve.now/CVE-2023-4339.md): Broadcom RAID Controller web interface is vulnerable to exposure of private keys used for CIM stored with insecure file permissions (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4340](https://cve.now/CVE-2023-4340.md): Broadcom RAID Controller is vulnerable to Privilege escalation by taking advantage of the Session prints in the log file (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4341](https://cve.now/CVE-2023-4341.md): Broadcom RAID Controller is vulnerable to Privilege escalation to root due to creation of insecure folders by Web GUI (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4342](https://cve.now/CVE-2023-4342.md): Broadcom RAID Controller web interface is vulnerable due to insecure defaults of lacking HTTP strict-transport-security policy (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4343](https://cve.now/CVE-2023-4343.md): Broadcom RAID Controller web interface is vulnerable due to exposure of sensitive password information in the URL as a URL search parameter (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4344](https://cve.now/CVE-2023-4344.md): Broadcom RAID Controller web interface is vulnerable to insufficient randomness due to improper use of ssl.rnd to setup CIM connection (CVSS 9.8, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-4323](https://cve.now/CVE-2023-4323.md): Broadcom RAID Controller web interface is vulnerable to improper session management of active sessions on Gateway setup (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-38401](https://cve.now/CVE-2023-38401.md): Local Privilege Escalation in HPE Aruba Networking Virtual Intranet Access (VIA) Microsoft Windows Client (CVSS 7.8, Hewlett Packard Enterprise (HPE) HPE Aruba Networking Virtu…)
- [CVE-2023-4345](https://cve.now/CVE-2023-4345.md): Broadcom RAID Controller web interface is vulnerable client-side control bypass (no CVSS, Broadcom LSI Storage Authority · Intel RAID Web Console)
- [CVE-2023-40027](https://cve.now/CVE-2023-40027.md): Conditionally missing authorization in @keystone-6/core (CVSS 3.7, keystonejs keystone · @keystone-6/core)
- [CVE-2023-40028](https://cve.now/CVE-2023-40028.md): Arbitrary file read via symlinks in Ghost (CVSS 4.9, TryGhost Ghost · ghost)
- [CVE-2023-4369](https://cve.now/CVE-2023-4369.md): Insufficient data validation in Systems Extensions in Google Chrome on ChromeOS prior to 116.0.5845.120 allowed an attacker who convinced a (CVSS 8.8, Google Chrome)
- [CVE-2023-4368](https://cve.now/CVE-2023-4368.md): Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to instal (no CVSS, Google Chrome)
- [CVE-2023-4367](https://cve.now/CVE-2023-4367.md): Insufficient policy enforcement in Extensions API in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to instal (no CVSS, Google Chrome)
- [CVE-2023-4366](https://cve.now/CVE-2023-4366.md): Use after free in Extensions in Google Chrome prior to 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extensi (no CVSS, Google Chrome)
- [CVE-2023-4365](https://cve.now/CVE-2023-4365.md): Inappropriate implementation in Fullscreen in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a (no CVSS, Google Chrome)
- [CVE-2023-4364](https://cve.now/CVE-2023-4364.md): Inappropriate implementation in Permission Prompts in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security U (no CVSS, Google Chrome)
- [CVE-2023-4363](https://cve.now/CVE-2023-4363.md): Inappropriate implementation in WebShare in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to spoof the contents (no CVSS, Google Chrome)
- [CVE-2023-4362](https://cve.now/CVE-2023-4362.md): Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process (no CVSS, Google Chrome)
- [CVE-2023-4361](https://cve.now/CVE-2023-4361.md): Inappropriate implementation in Autofill in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to bypass Autofill res (no CVSS, Google Chrome)
- [CVE-2023-4360](https://cve.now/CVE-2023-4360.md): Inappropriate implementation in Color in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to obfuscate security UI via a craft (no CVSS, Google Chrome)
- [CVE-2023-4359](https://cve.now/CVE-2023-4359.md): Inappropriate implementation in App Launcher in Google Chrome on iOS prior to 116.0.5845.96 allowed a remote attacker to potentially spoof e (no CVSS, Google Chrome)
- [CVE-2023-4358](https://cve.now/CVE-2023-4358.md): Use after free in DNS in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-4357](https://cve.now/CVE-2023-4357.md): Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access re (CVSS 8.8, Google Chrome)
- [CVE-2023-4356](https://cve.now/CVE-2023-4356.md): Use after free in Audio in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has convinced a user to engage in specific UI (no CVSS, Google Chrome)
- [CVE-2023-4355](https://cve.now/CVE-2023-4355.md): Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption v (CVSS 8.8, Google Chrome)
- [CVE-2023-4354](https://cve.now/CVE-2023-4354.md): Heap buffer overflow in Skia in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.8, Google Chrome)
- [CVE-2023-4353](https://cve.now/CVE-2023-4353.md): Heap buffer overflow in ANGLE in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2023-4352](https://cve.now/CVE-2023-4352.md): Type confusion in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-4351](https://cve.now/CVE-2023-4351.md): Use after free in Network in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who has elicited a browser shutdown to potential (no CVSS, Google Chrome)
- [CVE-2023-4350](https://cve.now/CVE-2023-4350.md): Inappropriate implementation in Fullscreen in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker to potentially spoof (no CVSS, Google Chrome)
- [CVE-2023-4349](https://cve.now/CVE-2023-4349.md): Use after free in Device Trust Connectors in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corr (no CVSS, Google Chrome)
- [CVE-2023-2312](https://cve.now/CVE-2023-2312.md): Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer proc (no CVSS, Google Chrome)
- [CVE-2023-39438](https://cve.now/CVE-2023-39438.md): Missing Authorization check allows certain operations on CLA Assistant data (CVSS 8.1, SAP\_SE CLA Assistant)
- [CVE-2023-35082](https://cve.now/CVE-2023-35082.md): An authentication bypass vulnerability in Ivanti EPMM 11.10 and older, allows unauthorized users to access restricted functionality or resou (CVSS 10.0, KEV, Ivanti EPMM)
- [CVE-2023-32003](https://cve.now/CVE-2023-32003.md): \`fs.mkdtemp()\` and \`fs.mkdtempSync()\` can be used to bypass the permission model check using a path traversal attack. (CVSS 5.3, NodeJS Node)
- [CVE-2023-32004](https://cve.now/CVE-2023-32004.md): A vulnerability has been discovered in Node.js version 20, specifically within the experimental permission model. (CVSS 8.8, NodeJS Node)
- [CVE-2023-32006](https://cve.now/CVE-2023-32006.md): The use of \`module.constructor.createRequire()\` can bypass the policy mechanism and require modules outside of the policy.json definition fo (CVSS 8.8, NodeJS Node)
- [CVE-2023-4371](https://cve.now/CVE-2023-4371.md): phpRecDB index.php cross site scripting (CVSS 3.5, phpRecDB)
- [CVE-2023-30498](https://cve.now/CVE-2023-30498.md): WordPress Vimeotheque Plugin \<= 2.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, CodeFlavors Vimeotheque: Vimeo WordPress Plugin)
- [CVE-2023-24478](https://cve.now/CVE-2023-24478.md): Use of insufficiently random values for some Intel Agilex(R) software included as part of Intel(R) Quartus(R) Prime Pro Edition for linux be (CVSS 5.5, Intel Agilex(R) software included as part of Intel(R) Quart…)
- [CVE-2023-30778](https://cve.now/CVE-2023-30778.md): WordPress PowerPress Podcasting Plugin \<= 10.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.5, PowerPress Podcasting plugin by Blubrry)
- [CVE-2023-30747](https://cve.now/CVE-2023-30747.md): WordPress WooCommerce Easy Duplicate Product Plugin \<= 0.3.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WPGem WooCommerce Easy Duplicate Product)
- [CVE-2023-2916](https://cve.now/CVE-2023-2916.md): InfiniteWP Client \<= 1.11.1 - Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 7.5, revmakx InfiniteWP Client)
- [CVE-2023-4308](https://cve.now/CVE-2023-4308.md): User Submitted Posts \<= 20230809 - Unauthenticated Stored Cross-Site Scripting via 'user-submitted-content' (CVSS 7.2, specialk User Submitted Posts – Enable Users to Submit Post…)
- [CVE-2023-4347](https://cve.now/CVE-2023-4347.md): Cross-site Scripting (XSS) - Reflected in librenms/librenms (CVSS 7.6, librenms/librenms)
- [CVE-2023-28479](https://cve.now/CVE-2023-28479.md): An issue was discovered in Tigergraph Enterprise 3.7.0. (no CVSS)
- [CVE-2023-38840](https://cve.now/CVE-2023-38840.md): Bitwarden Desktop 2023.7.0 and below allows an attacker with local access to obtain sensitive information via the Bitwarden.exe process. (no CVSS)
- [CVE-2023-38850](https://cve.now/CVE-2023-38850.md): Buffer Overflow vulnerability in Michaelrsweet codedoc v.3.7 allows an attacker to cause a denial of service via the codedoc.c:1742 comppnen (no CVSS)
- [CVE-2023-38851](https://cve.now/CVE-2023-38851.md): Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte (no CVSS)
- [CVE-2023-38852](https://cve.now/CVE-2023-38852.md): Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte (no CVSS)
- [CVE-2023-38853](https://cve.now/CVE-2023-38853.md): Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte (no CVSS)
- [CVE-2023-38854](https://cve.now/CVE-2023-38854.md): Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte (no CVSS)
- [CVE-2023-38855](https://cve.now/CVE-2023-38855.md): Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte (no CVSS)
- [CVE-2023-38856](https://cve.now/CVE-2023-38856.md): Buffer Overflow vulnerability in libxlsv.1.6.2 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafte (no CVSS)
- [CVE-2023-38857](https://cve.now/CVE-2023-38857.md): Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the stco (no CVSS)
- [CVE-2023-38858](https://cve.now/CVE-2023-38858.md): Buffer Overflow vulnerability infaad2 v.2.10.1 allows a remote attacker to execute arbitrary code and cause a denial of service via the mp4i (no CVSS)
- [CVE-2023-38860](https://cve.now/CVE-2023-38860.md): An issue in LangChain v.0.0.231 allows a remote attacker to execute arbitrary code via the prompt parameter. (no CVSS, langchain)
- [CVE-2023-38861](https://cve.now/CVE-2023-38861.md): An issue in Wavlink WL\_WNJ575A3 v.R75A3\_V1410\_220513 allows a remote attacker to execute arbitrary code via username parameter of the set\_sy (no CVSS)
- [CVE-2023-38862](https://cve.now/CVE-2023-38862.md): An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the destination parameter of sub\_431F64 function in bin (no CVSS)
- [CVE-2023-38863](https://cve.now/CVE-2023-38863.md): An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the ifname and mac parameters in the sub\_410074 functio (no CVSS)
- [CVE-2023-38864](https://cve.now/CVE-2023-38864.md): An issue in COMFAST CF-XR11 v.2.7.2 allows an attacker to execute arbitrary code via the protal\_delete\_picname parameter in the sub\_41171C f (no CVSS)
- [CVE-2023-38865](https://cve.now/CVE-2023-38865.md): COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub\_4143F0. (no CVSS)
- [CVE-2023-38866](https://cve.now/CVE-2023-38866.md): COMFAST CF-XR11 V2.7.2 has a command injection vulnerability detected at function sub\_415588. (no CVSS)
- [CVE-2023-38889](https://cve.now/CVE-2023-38889.md): An issue in Alluxio v.2.9.3 and before allows an attacker to execute arbitrary code via a crafted script to the username parameter of lluxio (no CVSS, org.alluxio:alluxio-parent)
- [CVE-2023-38896](https://cve.now/CVE-2023-38896.md): An issue in Harrison Chase langchain v.0.0.194 and before allows a remote attacker to execute arbitrary code via the from\_math\_prompt and fr (no CVSS, langchain)
- [CVE-2023-38898](https://cve.now/CVE-2023-38898.md): An issue in Python cpython v.3.7 allows an attacker to obtain sensitive information via the \_asyncio.\_swap\_current\_task component. (no CVSS)
- [CVE-2023-38915](https://cve.now/CVE-2023-38915.md): File Upload vulnerability in Wolf-leo EasyAdmin8 v.1.0 allows a remote attacker to execute arbtirary code via the upload type function. (no CVSS)
- [CVE-2023-38916](https://cve.now/CVE-2023-38916.md): SQL Injection vulnerability in eVotingSystem-PHP v.1.0 allows a remote attacker to execute arbitrary code and obtain sensitive information v (no CVSS)
- [CVE-2023-39659](https://cve.now/CVE-2023-39659.md): An issue in langchain langchain-ai v.0.0.232 and before allows a remote attacker to execute arbitrary code via a crafted script to the Pytho (no CVSS, langchain)
- [CVE-2023-39661](https://cve.now/CVE-2023-39661.md): An issue in pandas-ai v.0.9.1 and before allows a remote attacker to execute arbitrary code via the \_is\_jailbreak function. (no CVSS, pandasai)
- [CVE-2023-39662](https://cve.now/CVE-2023-39662.md): An issue in llama\_index v.0.7.13 and before allows a remote attacker to execute arbitrary code via the \`exec\` parameter in PandasQueryEngine (no CVSS, llama-index)
- [CVE-2023-39841](https://cve.now/CVE-2023-39841.md): Missing encryption in the RFID tag of Etekcity 3-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proxim (no CVSS)
- [CVE-2023-39842](https://cve.now/CVE-2023-39842.md): Missing encryption in the RFID tag of Digoo DG-HAMB Smart Home Security System v1.0 allows attackers to create a cloned tag via brief physic (no CVSS)
- [CVE-2023-39843](https://cve.now/CVE-2023-39843.md): Missing encryption in the RFID tag of Suleve 5-in-1 Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximit (no CVSS)
- [CVE-2023-39850](https://cve.now/CVE-2023-39850.md): Schoolmate v1.3 was discovered to contain multiple SQL injection vulnerabilities via the $courseid and $teacherid parameters at DeleteFuncti (no CVSS)
- [CVE-2023-39851](https://cve.now/CVE-2023-39851.md): webchess v1.0 was discovered to contain a SQL injection vulnerability via the $playerID parameter at mainmenu.php. (CVSS 9.8)
- [CVE-2023-39852](https://cve.now/CVE-2023-39852.md): Doctormms v1.0 was discovered to contain a SQL injection vulnerability via the $userid parameter at myAppoinment.php. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.