CVEs published August 16, 2023
97 CVEs were published on August 16, 2023: 1 critical, 21 high.
- Published
- 97
- Critical
- 1
- High
- 21
- Medium
- 34
- Low
- 2
- Unrated
- 39
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Dell PowerScale OneFS
- 10
- Cisco Prime Infrastructure · Cisco Evolved Programmable Net…
- 4
- Cisco Intersight Virtual Appliance
- 3
- Jenkins Project Jenkins Folders Plugin · org.jenkins-ci.plu…
- 3
- Tiempo.com
- 3
- Cisco ThousandEyes Recorder Application
- 2
- Cisco Unified Communications Manager
- 2
- Dell CPG BIOS
- 2
- frogerme WP Remote Users Sync
- 2
- IBM Cognos Analytics
- 2
Critical 1
High 21
- CVE-2023-20224A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local Cisco ThousandEyes Recorder Application
- CVE-2023-20229A vulnerability in the CryptoService function of Cisco Duo Device Health Application for Windows could allow an authenticated, local attackeCisco Duo Device Health Application
- CVE-2023-20211A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Cisco Unified Communications Manager
- CVE-2023-20197A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote attCisco Secure Endpoint
- CVE-2023-40034Repositoty takeover in woodpecker-ciwoodpecker-ci woodpecker · github.com/woodpecker-ci/woodpec…
- CVE-2023-40033Server-Side Request Forgery via Avatar upload in flarumflarum framework · flarum/core +1
- CVE-2023-4383MicroWorld eScan Anti-Virus runasroot incorrect execution-assigned permissionsMicroWorld eScan Anti-Virus
- CVE-2023-4389Kernel: btrfs: double free in btrfs_get_root_ref()Kernel · Red Hat Enterprise Linux +1
- CVE-2023-4387Kernel: vmxnet3: use-after-free in vmxnet3_rq_alloc_rx_buf()Red Hat Enterprise Linux
- CVE-2023-39250 Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay ManagDell Storage Integration Tools for VMware (DSITV), Dell Sto…
- CVE-2023-32493 Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability.Dell PowerScale OneFS
- CVE-2023-32487 Dell PowerScale OneFS, 8.2.x - 9.5.0.x, contains an elevation of privilege vulnerability.Dell PowerScale OneFS
- CVE-2023-32495 Dell PowerScale OneFS, 8.2.x-9.5.x, contains a exposure of sensitive information to an unauthorized Actor vulnerability.Dell PowerScale OneFS
- CVE-2023-4241lol-html panics on certain HTML inputsCloudflare lol-html · lol-html
- CVE-2023-30871WordPress Stock Exporter for WooCommerce Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)PT Woo Plugins (by Webdados) Stock Exporter for WooCommerce
- CVE-2023-30779WordPress Query Wrangler Plugin <= 1.5.51 is vulnerable to Cross Site Scripting (XSS)Jonathan Daggerhart Query Wrangler
- CVE-2023-30473WordPress YML for Yandex Market Plugin <= 3.10.7 is vulnerable to Cross Site Scripting (XSS)Maxim Glazunov YML for Yandex Market
- CVE-2023-30785WordPress Video Grid Plugin <= 1.21 is vulnerable to Cross Site Scripting (XSS)I Thirteen Web Solution Video Grid
- CVE-2023-30782WordPress Church Admin Plugin <= 3.7.5 is vulnerable to Cross Site Scripting (XSS)Andy Moyle Church Admin
- CVE-2023-3958WP Remote Users Sync <= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgeryfrogerme WP Remote Users Sync
- CVE-2023-39975kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an
Medium, low and unrated 75
- CVE-2023-35011IBM Cognos Analytics server-side request forgeyIBM Cognos Analytics
- CVE-2023-35009IBM Cognos Analytics information disclosureIBM Cognos Analytics
- CVE-2023-20232A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote aCisco Unified Contact Center Express
- CVE-2023-20217A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local Cisco ThousandEyes Recorder Application
- CVE-2023-20222A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) coCisco Prime Infrastructure · Cisco Evolved Programmable Net…
- CVE-2023-20201Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Cisco Prime Infrastructure · Cisco Evolved Programmable Net…
- CVE-2023-20203Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Cisco Prime Infrastructure · Cisco Evolved Programmable Net…
- CVE-2023-20205Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager Cisco Prime Infrastructure · Cisco Evolved Programmable Net…
- CVE-2023-20013Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary coCisco Intersight Virtual Appliance
- CVE-2023-20017Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary coCisco Intersight Virtual Appliance
- CVE-2023-20111A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker Cisco Identity Services Engine Software
- CVE-2023-20221A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow Cisco IP Phones with Multiplatform Firmware · Cisco PhoneOS
- CVE-2023-20237A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services thaCisco Intersight Virtual Appliance
- CVE-2023-20209A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) couCisco TelePresence Video Communication Server (VCS) Express…
- CVE-2023-20242A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session ManagemCisco Unified Communications Manager
- CVE-2023-20228A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remoteCisco Identity Services Engine Software · Cisco Unified Com…
- CVE-2023-40021Timing Attack Reveals CSRF Tokens in oppiaoppia
- CVE-2022-4894Certain HP and Samsung Printer software packages may potentially be vulnerable to elevation of privilege due to Uncontrolled Search Path EleHP and Samsung Printer software
- CVE-2023-4384MaximaTech Portal Executivo Cookie missing encryptionMaximaTech Portal Executivo
- CVE-2023-4382tdevs Hyip Rio Profile Settings settings cross site scriptingtdevs Hyip Rio
- CVE-2023-32453 Dell BIOS contains an improper authentication vulnerability.Dell CPG BIOS
- CVE-2023-28075 Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS.Dell CPG BIOS
- CVE-2023-38737IBM WebSphere Application Server Liberty denial of serviceIBM WebSphere Application Server Liberty
- CVE-2023-4385Kernel: jfs: null pointer dereference in dbfree()Red Hat Enterprise Linux
- CVE-2023-2737Improper securing of log directory may allow a denial of serviceThales SafeNet Authtentication Service Agent
- CVE-2023-4204NPort IAW5000A-I/O Series Hardcoded Credential VulnerabilityMoxa NPort IAW5000A-I/O Series
- CVE-2023-40351A cross-site request forgery (CSRF) vulnerability in Jenkins Favorite View Plugin 5.v77a_37f62782d and earlier allows attackers to add or reJenkins Project Jenkins Favorite View Plugin · org.jenkins-…
- CVE-2023-40350Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm DashboaJenkins Project Jenkins Docker Swarm Plugin · org.jenkins-c…
- CVE-2023-40349Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers tJenkins Project Jenkins Gogs Plugin · org.jenkins-ci.plugin…
- CVE-2023-40348The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs inJenkins Project Jenkins Gogs Plugin · org.jenkins-ci.plugin…
- CVE-2023-40347Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allowJenkins Project Jenkins Maven Artifact ChoiceListProvider (…
- CVE-2023-40346Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting (XSS) vJenkins Project Jenkins Shortcut Job Plugin · io.jenkins.pl…
- CVE-2023-40345Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read pJenkins Project Jenkins Delphix Plugin · org.jenkins-ci.plu…
- CVE-2023-40344A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentialJenkins Project Jenkins Delphix Plugin · org.jenkins-ci.plu…
- CVE-2023-40343Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication tokenJenkins Project Jenkins Tuleap Authentication Plugin · io.j…
- CVE-2023-40342Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a Jenkins Project Jenkins Flaky Test Handler Plugin · org.jen…
- CVE-2023-40341A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attackerJenkins Project Jenkins Blue Ocean Plugin · io.jenkins.blue…
- CVE-2023-40340Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file iJenkins Project Jenkins NodeJS Plugin · org.jenkins-ci.plug…
- CVE-2023-40339Jenkins Config File Provider Plugin 952.va_544a_6234b_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in cJenkins Project Jenkins Config File Provider Plugin · org.j…
- CVE-2023-40338Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attemptinJenkins Project Jenkins Folders Plugin · org.jenkins-ci.plu…
- CVE-2023-40337A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view Jenkins Project Jenkins Folders Plugin · org.jenkins-ci.plu…
- CVE-2023-40336A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy foldersJenkins Project Jenkins Folders Plugin · org.jenkins-ci.plu…
- CVE-2023-32492 Dell PowerScale OneFS 9.5.0.x contains an incorrect default permissions vulnerability.Dell PowerScale OneFS
- CVE-2023-32491 Dell PowerScale OneFS 9.5.0.x, contains an insertion of sensitive information into log file vulnerability in SNMPv3.Dell PowerScale OneFS
- CVE-2023-32490 Dell PowerScale OneFS 8.2x -9.5x contains an improper privilege management vulnerability.Dell PowerScale OneFS
- CVE-2023-32489 Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability.Dell PowerScale OneFS
- CVE-2023-32488 Dell PowerScale OneFS, 8.2.x-9.5.0.x, contains an information disclosure vulnerability in NFS.Dell PowerScale OneFS
- CVE-2023-32486 Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability.Dell PowerScale OneFS
- CVE-2023-32494 Dell PowerScale OneFS, 8.0.x-9.5.x, contains an improper handling of insufficient privileges vulnerability.Dell PowerScale OneFS
- CVE-2023-0551REST API TO MiniProgram <= 4.6.1 - Subscriber+ Attachment DeletionREST API TO MiniProgram
- CVE-2023-2254Ko-fi Button < 1.3.3 - Admin+ Stored XSSKo-fi Button
- CVE-2023-1977Booking Manager < 2.0.29 - Subscriber+ SSRFBooking Manager
- CVE-2023-1465WP EasyPay < 4.1 - Reflected Cross-Site ScriptingWP EasyPay
- CVE-2023-0274URL Params < 2.5 - Contributor+ Stored XSSURL Params
- CVE-2023-1110Yellow Yard < 2.8.12 - Contributor+ Stored XSSYellow Yard Searchbar
- CVE-2023-2225SEO ALert <= 1.59 - Admin+ Stored XSSSEO ALert
- CVE-2023-2272Tiempo.com <= 0.1.2 - Reflected XSSTiempo.com
- CVE-2023-0058Tiempo.com <= 0.1.2 - Stored XSS via CSRFTiempo.com
- CVE-2023-2271Tiempo.com <= 0.1.2 - Shortcode Deletion via CSRFTiempo.com
- CVE-2023-2123WP Inventory Manager < 2.1.0.13 - Reflected Cross-Site ScriptingWP Inventory Manager
- CVE-2023-0579YARPP - Yet Another Related Posts Plugin < 5.30.3 - Subscriber+ SQLiYARPP
- CVE-2023-2122Image Optimizer by 10web < 1.0.27 - Reflected Cross-Site ScriptingImage Optimizer by 10web
- CVE-2022-4782ClickFunnels <= 3.1.1 - Contributor+ Stored XSS via ShortcodeClickFunnels
- CVE-2023-4381Unverified Password Change in instantsoft/icms2instantsoft/icms2
- CVE-2023-30784WordPress Kaya QR Code Generator Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS)Kaya Studio Kaya QR Code Generator
- CVE-2023-30786WordPress Captcha Them All Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)Benjamin Guy Captcha Them All
- CVE-2023-39507Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver.Recruit Co. "Rikunabi NEXT" App for Android
- CVE-2023-26140Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard obje@excalidraw/excalidraw
- CVE-2023-4374WP Remote Users Sync <= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log Viewfrogerme WP Remote Users Sync
- CVE-2020-26037Directory Traversal vulnerability in Server functionalty in Even Balance Punkbuster version 1.902 before 1.905 allows remote attackers to ex
- CVE-2023-33663In the module “Customization fields fee for your store” (aicustomfee) from ai-dev module for PrestaShop, an attacker can perform SQL injecti
- CVE-2023-38894A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend functiotree-kit
- CVE-2023-38904A Cross Site Scripting (XSS) vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payloa
- CVE-2023-39115install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document.
- CVE-2023-39846An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token.