CVEs published August 17, 2023
79 CVEs were published on August 17, 2023: 4 critical, 30 high. 4 are now in CISA KEV.
- Published
- 79
- Critical
- 4
- High
- 30
- Medium
- 22
- Low
- 1
- Unrated
- 22
- Now in CISA KEV
- 4
- Fix available
- 16
Most affected products
- acymailing.com AcyMailing Enterprise component for Joomla
- 4
- Juniper Networks Junos OS
- 4
- ASUSTOR ADM
- 3
- Moxa TN-5900 Series
- 3
- Rockwell Automation ThinManager ThinServer
- 3
- Genians Genian NAC · Genians Genian ZTNA
- 2
- Lenovo Notebook
- 2
- Lenovo ThinkPad
- 2
- Moxa TN-5900 Series · Moxa TN-4900 Series +4
- 2
- Moxa TN-5900 Series · Moxa TN-4900 Series +5
- 2
Critical 4
- CVE-2023-40171Dispatch writes JWT tokens in error messageNetflix dispatch
- CVE-2023-36845Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variableJuniper Networks Junos OS
- CVE-2023-37914Privilege escalation (PR)/RCE from account through Invitation subject/messagexwiki-platform · org.xwiki.platform:xwiki-platform-invitati…
- CVE-2023-2917Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityRockwell Automation ThinManager ThinServer
High 30
- CVE-2023-40168Malicious projects can read and upload arbitrary files from disk in TurboWarp DesktopTurboWarp desktop
- CVE-2023-40313Disable BeanShell Interpreter Remote Server ModeThe OpenNMS Group Horizon · The OpenNMS Group Meridian +1
- CVE-2023-40165Unauthorized gem replacement for full names ending in numbers on rubygems.orgrubygems.org
- CVE-2023-4030A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover toLenovo ThinkPad
- CVE-2023-3078An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local aLenovo Universal Device Client
- CVE-2023-2915Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilityRockwell Automation ThinManager ThinServer
- CVE-2023-2914Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation VulnerabilitiyRockwell Automation ThinManager ThinServer
- CVE-2023-28693WordPress Advanced Youtube Channel Pagination Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)Balasaheb Bhise Advanced Youtube Channel Pagination
- CVE-2023-31072WordPress Advanced Category Template Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)Praveen Goswami Advanced Category Template
- CVE-2023-40272Apache Airflow Spark Provider Arbitrary File Read via JDBCApache Software Foundation Apache Airflow Spark Provider ·…
- CVE-2023-26530WordPress Updraft Plugin <= 0.6.1 is vulnerable to Cross Site Scripting (XSS)Paul Kehrer Updraft
- CVE-2023-31074WordPress Extensions for Leaflet Map Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS)hupe13 Extensions for Leaflet Map
- CVE-2023-3698A Command injection vulnerability was found on Printer service of ADMASUSTOR ADM
- CVE-2023-3697A Command injection vulnerability was found on Printer service of ADMASUSTOR ADM
- CVE-2023-2910A Command injection vulnerability was found on Printer service of ADMASUSTOR ADM
- CVE-2023-31076WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS)Really Simple Plugins Recipe Maker For Your Food Blog from…
- CVE-2023-31071WordPress Modal Dialog Plugin <= 3.5.14 is vulnerable to Cross Site Scripting (XSS)Yannick Lefebvre Modal Dialog
- CVE-2023-30877WordPress XML for Google Merchant Center Plugin <= 3.0.1 is vulnerable to Cross Site Scripting (XSS)Maxim Glazunov XML for Google Merchant Center
- CVE-2023-34217Second Order Command-injection Vulnerability in the Certificate-delete FunctionMoxa TN-5900 Series · Moxa TN-4900 Series +4
- CVE-2023-34216Second Order Command-injection Vulnerability in the Key-delete FunctionMoxa TN-5900 Series · Moxa TN-4900 Series +4
- CVE-2023-34215Second Order Command-injection Vulnerability in the Certificate-generation FunctionMoxa TN-5900 Series
- CVE-2023-4395Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpitcockpit-hq/cockpit
- CVE-2023-34214Second Order Command-injection Vulnerability in the Certificate-generation FunctionMoxa TN-5900 Series · Moxa TN-4900 Series +3
- CVE-2023-34213Second Order Command-injection Vulnerability in the Key-generation FunctionMoxa TN-5900 Series
- CVE-2023-33239Second Order Command-injection Vulnerability in the Key-generation FunctionMoxa TN-5900 Series · Moxa TN-4900 Series +5
- CVE-2023-33238Command-injection Vulnerability in Certificate ManagementMoxa TN-5900 Series · Moxa TN-4900 Series +5
- CVE-2023-33237Authentication Bypass Without Administrator PrivilegeMoxa TN-5900 Series
- CVE-2023-31938SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp_id par
- CVE-2023-31939SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the costomer_i
- CVE-2023-31940SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the page_id pa
Medium, low and unrated 45
- CVE-2023-28690WordPress WP BrowserUpdate Plugin <= 4.5 is vulnerable to Cross Site Scripting (XSS)Marco Steinbrecher WP BrowserUpdate
- CVE-2023-39971Extension - acymailing.com - XSS in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3acymailing.com AcyMailing Enterprise component for Joomla
- CVE-2023-39974Extension - acymailing.com - Exposure of Sensitive Information in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3acymailing.com AcyMailing Enterprise component for Joomla
- CVE-2023-39972Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3acymailing.com AcyMailing Enterprise component for Joomla
- CVE-2023-39973Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3acymailing.com AcyMailing Enterprise component for Joomla
- CVE-2023-39970Extension - acymailing.com - RCE in AcyMailing component for Joomla 6.7.0-8.5.0acymailing.com AcyMailing component for Joomla
- CVE-2023-36846Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary filesJuniper Networks Junos OS
- CVE-2023-36844Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variablesJuniper Networks Junos OS
- CVE-2023-36847Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary filesJuniper Networks Junos OS
- CVE-2023-40315ROLE_FILESYSTEM_EDITOR Can Be Used To Escalate To ROLE_ADMINThe OpenNMS Group Horizon · The OpenNMS Group Meridian +1
- CVE-2023-34419A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local accLenovo Notebook
- CVE-2023-4029A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with locLenovo ThinkPad
- CVE-2023-4028A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker wLenovo Notebook
- CVE-2023-28783WordPress Woocommerce Tip/Donation Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)PHPRADAR Woocommerce Tip/Donation
- CVE-2023-31079WordPress Tippy Plugin <= 6.2.1 is vulnerable to Cross Site Scripting (XSS)Chris Roberts Tippy
- CVE-2023-34412Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250Red Lion Europe mbNET · Red Lion Europe mbNET.rokey +1
- CVE-2023-4394Memory leak in btrfs_get_dev_args_from_path()Kernel · Red Hat Enterprise Linux +1
- CVE-2023-31091WordPress Dynamically Register Sidebars Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)Pradeep Singh Dynamically Register Sidebars
- CVE-2023-29182A stack-based buffer overflow vulnerability [CWE-121] in Fortinet FortiOS before 7.0.3 allows a privileged attacker to execute arbitrary codFortinet FortiOS
- CVE-2023-30874WordPress GPS Plotter Plugin <= 5.1.4 is vulnerable to Cross Site Scripting (XSS)Steve Curtis, St. Pete Design Gps Plotter
- CVE-2023-30876WordPress Dave's WordPress Live Search Plugin <= 4.8.1 is vulnerable to Cross Site Scripting (XSS)Dave Ross Dave's WordPress Live Search
- CVE-2023-28533WordPress Cab Grid Plugin <= 1.5.15 is vulnerable to Cross Site Scripting (XSS)M Williams Cab Grid
- CVE-2023-28622WordPress Easy Slider Revolution Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)Trident Technolabs Easy Slider Revolution
- CVE-2023-40251Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, GeniaGenians Genian NAC · Genians Genian ZTNA
- CVE-2023-3244Comments Like Dislike <= 1.2.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting Resethappy-coders Comments Like Dislike
- CVE-2023-40252Improper Control of Generation of Code ('Code Injection') vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian Genians Genian NAC · Genians Genian ZTNA
- CVE-2023-40281EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page.EC-CUBE CO. EC-CUBE 2 series
- CVE-2023-4392Control iD Gerencia Web Cookie cleartext storageControl iD Gerencia Web
- CVE-2023-25647Permission and Access Control Vulnerability in Some ZTE Mobile PhonesSome ZTE Mobile Phones
- CVE-2023-26469In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.
- CVE-2023-31492Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains
- CVE-2023-31941File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP fi
- CVE-2023-31942Cross Site Scripting vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the des
- CVE-2023-31943SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the ticket_id
- CVE-2023-31944SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp_id par
- CVE-2023-31945SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the id paramet
- CVE-2023-31946File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP fi
- CVE-2023-36106An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the intetech.powerjob:powerjob
- CVE-2023-38838SQL injection vulnerability in Kidus Minimati v.1.0.0 allows a remote attacker to obtain sensitive information via the edit.php component.
- CVE-2023-38843An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the description field in the i
- CVE-2023-38902A command injection vulnerability in RG-EW series home routers and repeaters v.EW_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITC
- CVE-2023-38905SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG_Sleeorg.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-39125NTSC-CRT 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp_rw.c because a file's width, height, and BPP are not valida
- CVE-2023-39741lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp.
- CVE-2023-39743lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3_decode_block src/libbz3.c.