# CVEs published 2023-08-16

97 CVEs were published on August 16, 2023: 1 critical, 21 high. Days are UTC.

- [CVE-2023-35011](https://cve.now/CVE-2023-35011.md): IBM Cognos Analytics server-side request forgey (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2023-35009](https://cve.now/CVE-2023-35009.md): IBM Cognos Analytics information disclosure (CVSS 5.3, IBM Cognos Analytics)
- [CVE-2023-35893](https://cve.now/CVE-2023-35893.md): IBM Security Guardium command execution (CVSS 9.9, IBM Security Guardium)
- [CVE-2023-20224](https://cve.now/CVE-2023-20224.md): A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local (CVSS 7.8, Cisco ThousandEyes Recorder Application)
- [CVE-2023-20229](https://cve.now/CVE-2023-20229.md): A vulnerability in the CryptoService function of Cisco Duo Device Health Application for Windows could allow an authenticated, local attacke (CVSS 7.1, Cisco Duo Device Health Application)
- [CVE-2023-20211](https://cve.now/CVE-2023-20211.md): A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications (CVSS 8.1, Cisco Unified Communications Manager)
- [CVE-2023-20197](https://cve.now/CVE-2023-20197.md): A vulnerability in the filesystem image parser for Hierarchical File System Plus (HFS+) of ClamAV could allow an unauthenticated, remote att (CVSS 7.5, Cisco Secure Endpoint)
- [CVE-2023-20232](https://cve.now/CVE-2023-20232.md): A vulnerability in the Tomcat implementation for Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, remote a (CVSS 5.3, Cisco Unified Contact Center Express)
- [CVE-2023-20217](https://cve.now/CVE-2023-20217.md): A vulnerability in the CLI of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allow an authenticated, local (CVSS 5.5, Cisco ThousandEyes Recorder Application)
- [CVE-2023-20222](https://cve.now/CVE-2023-20222.md): A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) co (CVSS 4.8, Cisco Prime Infrastructure · Cisco Evolved Programmable Net…)
- [CVE-2023-20201](https://cve.now/CVE-2023-20201.md): Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (CVSS 4.8, Cisco Prime Infrastructure · Cisco Evolved Programmable Net…)
- [CVE-2023-20203](https://cve.now/CVE-2023-20203.md): Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (no CVSS, Cisco Prime Infrastructure · Cisco Evolved Programmable Net…)
- [CVE-2023-20205](https://cve.now/CVE-2023-20205.md): Multiple vulnerabilities in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (no CVSS, Cisco Prime Infrastructure · Cisco Evolved Programmable Net…)
- [CVE-2023-20013](https://cve.now/CVE-2023-20013.md): Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary co (CVSS 6.5, Cisco Intersight Virtual Appliance)
- [CVE-2023-20017](https://cve.now/CVE-2023-20017.md): Multiple vulnerabilities in Cisco Intersight Private Virtual Appliance could allow an authenticated, remote attacker to execute arbitrary co (CVSS 6.5, Cisco Intersight Virtual Appliance)
- [CVE-2023-20111](https://cve.now/CVE-2023-20111.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2023-20221](https://cve.now/CVE-2023-20221.md): A vulnerability in the web-based management interface of Cisco IP Phone 6800, 7800, and 8800 Series with Multiplatform Firmware could allow (CVSS 6.5, Cisco IP Phones with Multiplatform Firmware · Cisco PhoneOS)
- [CVE-2023-20237](https://cve.now/CVE-2023-20237.md): A vulnerability in Cisco Intersight Virtual Appliance could allow an unauthenticated, adjacent attacker to access internal HTTP services tha (CVSS 4.3, Cisco Intersight Virtual Appliance)
- [CVE-2023-20209](https://cve.now/CVE-2023-20209.md): A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) cou (CVSS 6.5, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2023-20242](https://cve.now/CVE-2023-20242.md): A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM), Cisco Unified CM Session Managem (CVSS 4.8, Cisco Unified Communications Manager)
- [CVE-2023-20228](https://cve.now/CVE-2023-20228.md): A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) could allow an unauthenticated, remote (CVSS 6.1, Cisco Identity Services Engine Software · Cisco Unified Com…)
- [CVE-2023-40034](https://cve.now/CVE-2023-40034.md): Repositoty takeover in woodpecker-ci (CVSS 8.1, woodpecker-ci woodpecker · github.com/woodpecker-ci/woodpec…)
- [CVE-2023-40033](https://cve.now/CVE-2023-40033.md): Server-Side Request Forgery via Avatar upload in flarum (CVSS 7.1, flarum framework · flarum/core +1)
- [CVE-2023-40021](https://cve.now/CVE-2023-40021.md): Timing Attack Reveals CSRF Tokens in oppia (CVSS 5.3, oppia)
- [CVE-2022-4894](https://cve.now/CVE-2022-4894.md): Certain HP and Samsung Printer software packages may potentially be vulnerable to elevation of privilege due to Uncontrolled Search Path Ele (no CVSS, HP and Samsung Printer software)
- [CVE-2023-4384](https://cve.now/CVE-2023-4384.md): MaximaTech Portal Executivo Cookie missing encryption (CVSS 3.7, MaximaTech Portal Executivo)
- [CVE-2023-4383](https://cve.now/CVE-2023-4383.md): MicroWorld eScan Anti-Virus runasroot incorrect execution-assigned permissions (CVSS 7.8, MicroWorld eScan Anti-Virus)
- [CVE-2023-4382](https://cve.now/CVE-2023-4382.md): tdevs Hyip Rio Profile Settings settings cross site scripting (CVSS 3.5, tdevs Hyip Rio)
- [CVE-2023-32453](https://cve.now/CVE-2023-32453.md): Dell BIOS contains an improper authentication vulnerability. (CVSS 4.6, Dell CPG BIOS)
- [CVE-2023-28075](https://cve.now/CVE-2023-28075.md): Dell BIOS contain a Time-of-check Time-of-use vulnerability in BIOS. (CVSS 6.9, Dell CPG BIOS)
- [CVE-2023-4389](https://cve.now/CVE-2023-4389.md): Kernel: btrfs: double free in btrfs\_get\_root\_ref() (CVSS 7.0, Kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-4387](https://cve.now/CVE-2023-4387.md): Kernel: vmxnet3: use-after-free in vmxnet3\_rq\_alloc\_rx\_buf() (CVSS 7.1, Red Hat Enterprise Linux)
- [CVE-2023-38737](https://cve.now/CVE-2023-38737.md): IBM WebSphere Application Server Liberty denial of service (CVSS 5.9, IBM WebSphere Application Server Liberty)
- [CVE-2023-4385](https://cve.now/CVE-2023-4385.md): Kernel: jfs: null pointer dereference in dbfree() (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2023-2737](https://cve.now/CVE-2023-2737.md): Improper securing of log directory may allow a denial of service (CVSS 5.7, Thales SafeNet Authtentication Service Agent)
- [CVE-2023-39250](https://cve.now/CVE-2023-39250.md): Dell Storage Integration Tools for VMware (DSITV) and Dell Storage vSphere Client Plugin (DSVCP) versions prior to 6.1.1 and Replay Manag (CVSS 7.8, Dell Storage Integration Tools for VMware (DSITV), Dell Sto…)
- [CVE-2023-4204](https://cve.now/CVE-2023-4204.md): NPort IAW5000A-I/O Series Hardcoded Credential Vulnerability (CVSS 5.4, Moxa NPort IAW5000A-I/O Series)
- [CVE-2023-40351](https://cve.now/CVE-2023-40351.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Favorite View Plugin 5.v77a\_37f62782d and earlier allows attackers to add or re (no CVSS, Jenkins Project Jenkins Favorite View Plugin · org.jenkins-…)
- [CVE-2023-40350](https://cve.now/CVE-2023-40350.md): Jenkins Docker Swarm Plugin 1.11 and earlier does not escape values returned from Docker before inserting them into the Docker Swarm Dashboa (no CVSS, Jenkins Project Jenkins Docker Swarm Plugin · org.jenkins-c…)
- [CVE-2023-40349](https://cve.now/CVE-2023-40349.md): Jenkins Gogs Plugin 1.0.15 and earlier improperly initializes an option to secure its webhook endpoint, allowing unauthenticated attackers t (no CVSS, Jenkins Project Jenkins Gogs Plugin · org.jenkins-ci.plugin…)
- [CVE-2023-40348](https://cve.now/CVE-2023-40348.md): The webhook endpoint in Jenkins Gogs Plugin 1.0.15 and earlier provides unauthenticated attackers information about the existence of jobs in (no CVSS, Jenkins Project Jenkins Gogs Plugin · org.jenkins-ci.plugin…)
- [CVE-2023-40347](https://cve.now/CVE-2023-40347.md): Jenkins Maven Artifact ChoiceListProvider (Nexus) Plugin 1.14 and earlier does not set the appropriate context for credentials lookup, allow (no CVSS, Jenkins Project Jenkins Maven Artifact ChoiceListProvider (…)
- [CVE-2023-40346](https://cve.now/CVE-2023-40346.md): Jenkins Shortcut Job Plugin 0.4 and earlier does not escape the shortcut redirection URL, resulting in a stored cross-site scripting (XSS) v (no CVSS, Jenkins Project Jenkins Shortcut Job Plugin · io.jenkins.pl…)
- [CVE-2023-40345](https://cve.now/CVE-2023-40345.md): Jenkins Delphix Plugin 3.0.2 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Overall/Read p (no CVSS, Jenkins Project Jenkins Delphix Plugin · org.jenkins-ci.plu…)
- [CVE-2023-40344](https://cve.now/CVE-2023-40344.md): A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credential (no CVSS, Jenkins Project Jenkins Delphix Plugin · org.jenkins-ci.plu…)
- [CVE-2023-40343](https://cve.now/CVE-2023-40343.md): Jenkins Tuleap Authentication Plugin 1.1.20 and earlier uses a non-constant time comparison function when validating an authentication token (no CVSS, Jenkins Project Jenkins Tuleap Authentication Plugin · io.j…)
- [CVE-2023-40342](https://cve.now/CVE-2023-40342.md): Jenkins Flaky Test Handler Plugin 1.2.2 and earlier does not escape JUnit test contents when showing them on the Jenkins UI, resulting in a (no CVSS, Jenkins Project Jenkins Flaky Test Handler Plugin · org.jen…)
- [CVE-2023-40341](https://cve.now/CVE-2023-40341.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Blue Ocean Plugin 1.27.5 and earlier allows attackers to connect to an attacker (no CVSS, Jenkins Project Jenkins Blue Ocean Plugin · io.jenkins.blue…)
- [CVE-2023-40340](https://cve.now/CVE-2023-40340.md): Jenkins NodeJS Plugin 1.6.0 and earlier does not properly mask (i.e., replace with asterisks) credentials specified in the Npm config file i (no CVSS, Jenkins Project Jenkins NodeJS Plugin · org.jenkins-ci.plug…)
- [CVE-2023-40339](https://cve.now/CVE-2023-40339.md): Jenkins Config File Provider Plugin 952.va\_544a\_6234b\_46 and earlier does not mask (i.e., replace with asterisks) credentials specified in c (no CVSS, Jenkins Project Jenkins Config File Provider Plugin · org.j…)
- [CVE-2023-40338](https://cve.now/CVE-2023-40338.md): Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier displays an error message that includes an absolute path of a log file when attemptin (no CVSS, Jenkins Project Jenkins Folders Plugin · org.jenkins-ci.plu…)
- [CVE-2023-40337](https://cve.now/CVE-2023-40337.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy a view (no CVSS, Jenkins Project Jenkins Folders Plugin · org.jenkins-ci.plu…)
- [CVE-2023-40336](https://cve.now/CVE-2023-40336.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Folders Plugin 6.846.v23698686f0f6 and earlier allows attackers to copy folders (no CVSS, Jenkins Project Jenkins Folders Plugin · org.jenkins-ci.plu…)
- [CVE-2023-32493](https://cve.now/CVE-2023-32493.md): Dell PowerScale OneFS, 9.5.0.x, contains a protection mechanism bypass vulnerability. (CVSS 7.3, Dell PowerScale OneFS)
- [CVE-2023-32492](https://cve.now/CVE-2023-32492.md): Dell PowerScale OneFS 9.5.0.x contains an incorrect default permissions vulnerability. (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2023-32491](https://cve.now/CVE-2023-32491.md): Dell PowerScale OneFS 9.5.0.x, contains an insertion of sensitive information into log file vulnerability in SNMPv3. (CVSS 6.3, Dell PowerScale OneFS)
- [CVE-2023-32490](https://cve.now/CVE-2023-32490.md): Dell PowerScale OneFS 8.2x -9.5x contains an improper privilege management vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2023-32489](https://cve.now/CVE-2023-32489.md): Dell PowerScale OneFS 8.2x -9.5x contains a privilege escalation vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2023-32488](https://cve.now/CVE-2023-32488.md): Dell PowerScale OneFS, 8.2.x-9.5.0.x, contains an information disclosure vulnerability in NFS. (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2023-32487](https://cve.now/CVE-2023-32487.md): Dell PowerScale OneFS, 8.2.x - 9.5.0.x, contains an elevation of privilege vulnerability. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2023-32486](https://cve.now/CVE-2023-32486.md): Dell PowerScale OneFS 9.5.x version contain a privilege escalation vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2023-32495](https://cve.now/CVE-2023-32495.md): Dell PowerScale OneFS, 8.2.x-9.5.x, contains a exposure of sensitive information to an unauthorized Actor vulnerability. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2023-32494](https://cve.now/CVE-2023-32494.md): Dell PowerScale OneFS, 8.0.x-9.5.x, contains an improper handling of insufficient privileges vulnerability. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2023-0551](https://cve.now/CVE-2023-0551.md): REST API TO MiniProgram \<= 4.6.1 - Subscriber+ Attachment Deletion (no CVSS, REST API TO MiniProgram)
- [CVE-2023-2254](https://cve.now/CVE-2023-2254.md): Ko-fi Button \< 1.3.3 - Admin+ Stored XSS (no CVSS, Ko-fi Button)
- [CVE-2023-1977](https://cve.now/CVE-2023-1977.md): Booking Manager \< 2.0.29 - Subscriber+ SSRF (no CVSS, Booking Manager)
- [CVE-2023-1465](https://cve.now/CVE-2023-1465.md): WP EasyPay \< 4.1 - Reflected Cross-Site Scripting (CVSS 6.1, WP EasyPay)
- [CVE-2023-0274](https://cve.now/CVE-2023-0274.md): URL Params \< 2.5 - Contributor+ Stored XSS (no CVSS, URL Params)
- [CVE-2023-1110](https://cve.now/CVE-2023-1110.md): Yellow Yard \< 2.8.12 - Contributor+ Stored XSS (no CVSS, Yellow Yard Searchbar)
- [CVE-2023-2225](https://cve.now/CVE-2023-2225.md): SEO ALert \<= 1.59 - Admin+ Stored XSS (no CVSS, SEO ALert)
- [CVE-2023-2272](https://cve.now/CVE-2023-2272.md): Tiempo.com \<= 0.1.2 - Reflected XSS (no CVSS, Tiempo.com)
- [CVE-2023-0058](https://cve.now/CVE-2023-0058.md): Tiempo.com \<= 0.1.2 - Stored XSS via CSRF (no CVSS, Tiempo.com)
- [CVE-2023-2271](https://cve.now/CVE-2023-2271.md): Tiempo.com \<= 0.1.2 - Shortcode Deletion via CSRF (no CVSS, Tiempo.com)
- [CVE-2023-2123](https://cve.now/CVE-2023-2123.md): WP Inventory Manager \< 2.1.0.13 - Reflected Cross-Site Scripting (no CVSS, WP Inventory Manager)
- [CVE-2023-0579](https://cve.now/CVE-2023-0579.md): YARPP - Yet Another Related Posts Plugin \< 5.30.3 - Subscriber+ SQLi (no CVSS, YARPP)
- [CVE-2023-2122](https://cve.now/CVE-2023-2122.md): Image Optimizer by 10web \< 1.0.27 - Reflected Cross-Site Scripting (no CVSS, Image Optimizer by 10web)
- [CVE-2022-4782](https://cve.now/CVE-2022-4782.md): ClickFunnels \<= 3.1.1 - Contributor+ Stored XSS via Shortcode (no CVSS, ClickFunnels)
- [CVE-2023-4381](https://cve.now/CVE-2023-4381.md): Unverified Password Change in instantsoft/icms2 (CVSS 4.3, instantsoft/icms2)
- [CVE-2023-4241](https://cve.now/CVE-2023-4241.md): lol-html panics on certain HTML inputs (CVSS 7.5, Cloudflare lol-html · lol-html)
- [CVE-2023-30871](https://cve.now/CVE-2023-30871.md): WordPress Stock Exporter for WooCommerce Plugin \<= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, PT Woo Plugins (by Webdados) Stock Exporter for WooCommerce)
- [CVE-2023-30779](https://cve.now/CVE-2023-30779.md): WordPress Query Wrangler Plugin \<= 1.5.51 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Jonathan Daggerhart Query Wrangler)
- [CVE-2023-30784](https://cve.now/CVE-2023-30784.md): WordPress Kaya QR Code Generator Plugin \<= 1.5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Kaya Studio Kaya QR Code Generator)
- [CVE-2023-30473](https://cve.now/CVE-2023-30473.md): WordPress YML for Yandex Market Plugin \<= 3.10.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Maxim Glazunov YML for Yandex Market)
- [CVE-2023-30785](https://cve.now/CVE-2023-30785.md): WordPress Video Grid Plugin \<= 1.21 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, I Thirteen Web Solution Video Grid)
- [CVE-2023-30782](https://cve.now/CVE-2023-30782.md): WordPress Church Admin Plugin \<= 3.7.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Andy Moyle Church Admin)
- [CVE-2023-30786](https://cve.now/CVE-2023-30786.md): WordPress Captcha Them All Plugin \<= 1.3.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Benjamin Guy Captcha Them All)
- [CVE-2023-39507](https://cve.now/CVE-2023-39507.md): Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. (no CVSS, Recruit Co. "Rikunabi NEXT" App for Android)
- [CVE-2023-26140](https://cve.now/CVE-2023-26140.md): Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting (XSS) via embedded links in whiteboard obje (CVSS 6.1, @excalidraw/excalidraw)
- [CVE-2023-4374](https://cve.now/CVE-2023-4374.md): WP Remote Users Sync \<= 1.2.11 - Missing Authorization to Authenticated (Subscriber+) Log View (CVSS 4.3, frogerme WP Remote Users Sync)
- [CVE-2023-3958](https://cve.now/CVE-2023-3958.md): WP Remote Users Sync \<= 1.2.12 - Authenticated (Subscriber+) Server Side Request Forgery (CVSS 8.5, frogerme WP Remote Users Sync)
- [CVE-2020-26037](https://cve.now/CVE-2020-26037.md): Directory Traversal vulnerability in Server functionalty in Even Balance Punkbuster version 1.902 before 1.905 allows remote attackers to ex (no CVSS)
- [CVE-2023-33663](https://cve.now/CVE-2023-33663.md): In the module “Customization fields fee for your store” (aicustomfee) from ai-dev module for PrestaShop, an attacker can perform SQL injecti (no CVSS)
- [CVE-2023-38894](https://cve.now/CVE-2023-38894.md): A Prototype Pollution issue in Cronvel Tree-kit v.0.7.4 and before allows a remote attacker to execute arbitrary code via the extend functio (no CVSS, tree-kit)
- [CVE-2023-38904](https://cve.now/CVE-2023-38904.md): A Cross Site Scripting (XSS) vulnerability in Netlify CMS v.2.10.192 allows a remote attacker to execute arbitrary code via a crafted payloa (no CVSS)
- [CVE-2023-39115](https://cve.now/CVE-2023-39115.md): install/aiz-uploader/upload in Campcodes Online Matrimonial Website System Script 3.3 allows XSS via a crafted SVG document. (no CVSS)
- [CVE-2023-39846](https://cve.now/CVE-2023-39846.md): An issue in Konga v0.14.9 allows attackers to bypass authentication via a crafted JWT token. (no CVSS)
- [CVE-2023-39975](https://cve.now/CVE-2023-39975.md): kdc/do\_tgs\_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.