# CVEs published 2023-08-17

79 CVEs were published on August 17, 2023: 4 critical, 30 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2023-28690](https://cve.now/CVE-2023-28690.md): WordPress WP BrowserUpdate Plugin \<= 4.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Marco Steinbrecher WP BrowserUpdate)
- [CVE-2023-40171](https://cve.now/CVE-2023-40171.md): Dispatch writes JWT tokens in error message (CVSS 9.1, Netflix dispatch)
- [CVE-2023-39971](https://cve.now/CVE-2023-39971.md): Extension - acymailing.com - XSS in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3 (no CVSS, acymailing.com AcyMailing Enterprise component for Joomla)
- [CVE-2023-39974](https://cve.now/CVE-2023-39974.md): Extension - acymailing.com - Exposure of Sensitive Information in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3 (no CVSS, acymailing.com AcyMailing Enterprise component for Joomla)
- [CVE-2023-39972](https://cve.now/CVE-2023-39972.md): Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3 (no CVSS, acymailing.com AcyMailing Enterprise component for Joomla)
- [CVE-2023-39973](https://cve.now/CVE-2023-39973.md): Extension - acymailing.com - Improper Access Control in AcyMailing Enterprise component for Joomla 6.7.0-8.6.3 (no CVSS, acymailing.com AcyMailing Enterprise component for Joomla)
- [CVE-2023-39970](https://cve.now/CVE-2023-39970.md): Extension - acymailing.com - RCE in AcyMailing component for Joomla 6.7.0-8.5.0 (no CVSS, acymailing.com AcyMailing component for Joomla)
- [CVE-2023-36846](https://cve.now/CVE-2023-36846.md): Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files (CVSS 5.3, KEV, Juniper Networks Junos OS)
- [CVE-2023-36845](https://cve.now/CVE-2023-36845.md): Junos OS: EX and SRX Series: A PHP vulnerability in J-Web allows an unauthenticated to control an important environment variable (CVSS 9.8, KEV, Juniper Networks Junos OS)
- [CVE-2023-36844](https://cve.now/CVE-2023-36844.md): Junos OS: EX Series: A PHP vulnerability in J-Web allows an unauthenticated attacker to control important environment variables (CVSS 5.3, KEV, Juniper Networks Junos OS)
- [CVE-2023-36847](https://cve.now/CVE-2023-36847.md): Junos OS: EX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload arbitrary files (CVSS 5.3, KEV, Juniper Networks Junos OS)
- [CVE-2023-40168](https://cve.now/CVE-2023-40168.md): Malicious projects can read and upload arbitrary files from disk in TurboWarp Desktop (CVSS 7.4, TurboWarp desktop)
- [CVE-2023-40315](https://cve.now/CVE-2023-40315.md): ROLE\_FILESYSTEM\_EDITOR Can Be Used To Escalate To ROLE\_ADMIN (CVSS 5.3, The OpenNMS Group Horizon · The OpenNMS Group Meridian +1)
- [CVE-2023-40313](https://cve.now/CVE-2023-40313.md): Disable BeanShell Interpreter Remote Server Mode (CVSS 7.1, The OpenNMS Group Horizon · The OpenNMS Group Meridian +1)
- [CVE-2023-37914](https://cve.now/CVE-2023-37914.md): Privilege escalation (PR)/RCE from account through Invitation subject/message (CVSS 9.9, xwiki-platform · org.xwiki.platform:xwiki-platform-invitati…)
- [CVE-2023-40165](https://cve.now/CVE-2023-40165.md): Unauthorized gem replacement for full names ending in numbers on rubygems.org (CVSS 7.4, rubygems.org)
- [CVE-2023-34419](https://cve.now/CVE-2023-34419.md): A buffer overflow has been identified in the SetupUtility driver in some Lenovo Notebook products which may allow an attacker with local acc (CVSS 6.7, Lenovo Notebook)
- [CVE-2023-4030](https://cve.now/CVE-2023-4030.md): A vulnerability was reported in BIOS for ThinkPad P14s Gen 2, P15s Gen 2, T14 Gen 2, and T15 Gen 2 that could cause the system to recover to (CVSS 8.4, Lenovo ThinkPad)
- [CVE-2023-4029](https://cve.now/CVE-2023-4029.md): A buffer overflow has been identified in the BoardUpdateAcpiDxe driver in some Lenovo ThinkPad products which may allow an attacker with loc (CVSS 6.7, Lenovo ThinkPad)
- [CVE-2023-4028](https://cve.now/CVE-2023-4028.md): A buffer overflow has been identified in the SystemUserMasterHddPwdDxe driver in some Lenovo Notebook products which may allow an attacker w (CVSS 6.7, Lenovo Notebook)
- [CVE-2023-3078](https://cve.now/CVE-2023-3078.md): An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local a (CVSS 7.8, Lenovo Universal Device Client)
- [CVE-2023-2917](https://cve.now/CVE-2023-2917.md): Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability (CVSS 9.8, Rockwell Automation ThinManager ThinServer)
- [CVE-2023-2915](https://cve.now/CVE-2023-2915.md): Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerability (CVSS 7.5, Rockwell Automation ThinManager ThinServer)
- [CVE-2023-2914](https://cve.now/CVE-2023-2914.md): Rockwell Automation ThinManager Thinserver Software Vulnerable to Input Validation Vulnerabilitiy (CVSS 7.5, Rockwell Automation ThinManager ThinServer)
- [CVE-2023-28783](https://cve.now/CVE-2023-28783.md): WordPress Woocommerce Tip/Donation Plugin \<= 1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, PHPRADAR Woocommerce Tip/Donation)
- [CVE-2023-28693](https://cve.now/CVE-2023-28693.md): WordPress Advanced Youtube Channel Pagination Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Balasaheb Bhise Advanced Youtube Channel Pagination)
- [CVE-2023-31072](https://cve.now/CVE-2023-31072.md): WordPress Advanced Category Template Plugin \<= 0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Praveen Goswami Advanced Category Template)
- [CVE-2023-31079](https://cve.now/CVE-2023-31079.md): WordPress Tippy Plugin \<= 6.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Chris Roberts Tippy)
- [CVE-2023-40272](https://cve.now/CVE-2023-40272.md): Apache Airflow Spark Provider Arbitrary File Read via JDBC (CVSS 7.5, Apache Software Foundation Apache Airflow Spark Provider ·…)
- [CVE-2023-34412](https://cve.now/CVE-2023-34412.md): Stored XXS vulnerability in mbnet, mbnet.rokey, REX 200 and REX 250 (CVSS 4.8, Red Lion Europe mbNET · Red Lion Europe mbNET.rokey +1)
- [CVE-2023-4394](https://cve.now/CVE-2023-4394.md): Memory leak in btrfs\_get\_dev\_args\_from\_path() (CVSS 6.7, Kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-31091](https://cve.now/CVE-2023-31091.md): WordPress Dynamically Register Sidebars Plugin \<= 1.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Pradeep Singh Dynamically Register Sidebars)
- [CVE-2023-26530](https://cve.now/CVE-2023-26530.md): WordPress Updraft Plugin \<= 0.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Paul Kehrer Updraft)
- [CVE-2023-31074](https://cve.now/CVE-2023-31074.md): WordPress Extensions for Leaflet Map Plugin \<= 3.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, hupe13 Extensions for Leaflet Map)
- [CVE-2023-29182](https://cve.now/CVE-2023-29182.md): A stack-based buffer overflow vulnerability \[CWE-121\] in Fortinet FortiOS before 7.0.3 allows a privileged attacker to execute arbitrary cod (CVSS 6.4, Fortinet FortiOS)
- [CVE-2023-3698](https://cve.now/CVE-2023-3698.md): A Command injection vulnerability was found on Printer service of ADM (CVSS 8.5, ASUSTOR ADM)
- [CVE-2023-3697](https://cve.now/CVE-2023-3697.md): A Command injection vulnerability was found on Printer service of ADM (CVSS 8.5, ASUSTOR ADM)
- [CVE-2023-2910](https://cve.now/CVE-2023-2910.md): A Command injection vulnerability was found on Printer service of ADM (CVSS 8.8, ASUSTOR ADM)
- [CVE-2023-31076](https://cve.now/CVE-2023-31076.md): WordPress Recipe Maker For Your Food Blog from Zip Recipes Plugin \<= 8.0.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Really Simple Plugins Recipe Maker For Your Food Blog from…)
- [CVE-2023-31071](https://cve.now/CVE-2023-31071.md): WordPress Modal Dialog Plugin \<= 3.5.14 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Yannick Lefebvre Modal Dialog)
- [CVE-2023-30877](https://cve.now/CVE-2023-30877.md): WordPress XML for Google Merchant Center Plugin \<= 3.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Maxim Glazunov XML for Google Merchant Center)
- [CVE-2023-30874](https://cve.now/CVE-2023-30874.md): WordPress GPS Plotter Plugin \<= 5.1.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Steve Curtis, St. Pete Design Gps Plotter)
- [CVE-2023-30876](https://cve.now/CVE-2023-30876.md): WordPress Dave's WordPress Live Search Plugin \<= 4.8.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Dave Ross Dave's WordPress Live Search)
- [CVE-2023-28533](https://cve.now/CVE-2023-28533.md): WordPress Cab Grid Plugin \<= 1.5.15 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, M Williams Cab Grid)
- [CVE-2023-28622](https://cve.now/CVE-2023-28622.md): WordPress Easy Slider Revolution Plugin \<= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Trident Technolabs Easy Slider Revolution)
- [CVE-2023-40251](https://cve.now/CVE-2023-40251.md): Missing Encryption of Sensitive Data vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genia (CVSS 5.2, Genians Genian NAC · Genians Genian ZTNA)
- [CVE-2023-34217](https://cve.now/CVE-2023-34217.md): Second Order Command-injection Vulnerability in the Certificate-delete Function (CVSS 8.1, Moxa TN-5900 Series · Moxa TN-4900 Series +4)
- [CVE-2023-3244](https://cve.now/CVE-2023-3244.md): Comments Like Dislike \<= 1.2.0 - Missing Authorization to Authenticated (Subscriber+) Plugin Setting Reset (CVSS 4.3, happy-coders Comments Like Dislike)
- [CVE-2023-40252](https://cve.now/CVE-2023-40252.md): Improper Control of Generation of Code ('Code Injection') vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian (CVSS 6.0, Genians Genian NAC · Genians Genian ZTNA)
- [CVE-2023-34216](https://cve.now/CVE-2023-34216.md): Second Order Command-injection Vulnerability in the Key-delete Function (CVSS 8.1, Moxa TN-5900 Series · Moxa TN-4900 Series +4)
- [CVE-2023-40281](https://cve.now/CVE-2023-40281.md): EC-CUBE 2.11.0 to 2.17.2-p1 contain a cross-site scripting vulnerability in "mail/template" and "products/product" of Management page. (no CVSS, EC-CUBE CO. EC-CUBE 2 series)
- [CVE-2023-34215](https://cve.now/CVE-2023-34215.md): Second Order Command-injection Vulnerability in the Certificate-generation Function (CVSS 7.2, Moxa TN-5900 Series)
- [CVE-2023-4395](https://cve.now/CVE-2023-4395.md): Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit (CVSS 8.1, cockpit-hq/cockpit)
- [CVE-2023-4392](https://cve.now/CVE-2023-4392.md): Control iD Gerencia Web Cookie cleartext storage (CVSS 3.7, Control iD Gerencia Web)
- [CVE-2023-34214](https://cve.now/CVE-2023-34214.md): Second Order Command-injection Vulnerability in the Certificate-generation Function (CVSS 7.2, Moxa TN-5900 Series · Moxa TN-4900 Series +3)
- [CVE-2023-34213](https://cve.now/CVE-2023-34213.md): Second Order Command-injection Vulnerability in the Key-generation Function (CVSS 8.8, Moxa TN-5900 Series)
- [CVE-2023-33239](https://cve.now/CVE-2023-33239.md): Second Order Command-injection Vulnerability in the Key-generation Function (CVSS 8.8, Moxa TN-5900 Series · Moxa TN-4900 Series +5)
- [CVE-2023-25647](https://cve.now/CVE-2023-25647.md): Permission and Access Control Vulnerability in Some ZTE Mobile Phones (CVSS 4.7, Some ZTE Mobile Phones)
- [CVE-2023-33238](https://cve.now/CVE-2023-33238.md): Command-injection Vulnerability in Certificate Management (CVSS 7.2, Moxa TN-5900 Series · Moxa TN-4900 Series +5)
- [CVE-2023-33237](https://cve.now/CVE-2023-33237.md): Authentication Bypass Without Administrator Privilege (CVSS 8.8, Moxa TN-5900 Series)
- [CVE-2023-26469](https://cve.now/CVE-2023-26469.md): In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. (no CVSS)
- [CVE-2023-31492](https://cve.now/CVE-2023-31492.md): Zoho ManageEngine ADManager Plus version 7182 and prior disclosed the default passwords for the account restoration of unauthorized domains (no CVSS)
- [CVE-2023-31938](https://cve.now/CVE-2023-31938.md): SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp\_id par (CVSS 7.2)
- [CVE-2023-31939](https://cve.now/CVE-2023-31939.md): SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the costomer\_i (CVSS 7.2)
- [CVE-2023-31940](https://cve.now/CVE-2023-31940.md): SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the page\_id pa (CVSS 7.2)
- [CVE-2023-31941](https://cve.now/CVE-2023-31941.md): File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP fi (no CVSS)
- [CVE-2023-31942](https://cve.now/CVE-2023-31942.md): Cross Site Scripting vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the des (no CVSS)
- [CVE-2023-31943](https://cve.now/CVE-2023-31943.md): SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the ticket\_id (no CVSS)
- [CVE-2023-31944](https://cve.now/CVE-2023-31944.md): SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the emp\_id par (no CVSS)
- [CVE-2023-31945](https://cve.now/CVE-2023-31945.md): SQL injection vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via the id paramet (no CVSS)
- [CVE-2023-31946](https://cve.now/CVE-2023-31946.md): File Upload vulnerability found in Online Travel Agency System v.1.0 allows a remote attacker to execute arbitrary code via a crafted PHP fi (no CVSS)
- [CVE-2023-36106](https://cve.now/CVE-2023-36106.md): An incorrect access control vulnerability in powerjob 4.3.2 and earlier allows remote attackers to obtain sensitive information via the inte (no CVSS, tech.powerjob:powerjob)
- [CVE-2023-38838](https://cve.now/CVE-2023-38838.md): SQL injection vulnerability in Kidus Minimati v.1.0.0 allows a remote attacker to obtain sensitive information via the edit.php component. (no CVSS)
- [CVE-2023-38843](https://cve.now/CVE-2023-38843.md): An issue in Atlos v.1.0 allows an authenticated attacker to execute arbitrary code via a crafted payload into the description field in the i (no CVSS)
- [CVE-2023-38902](https://cve.now/CVE-2023-38902.md): A command injection vulnerability in RG-EW series home routers and repeaters v.EW\_3.0(1)B11P219, RG-NBS and RG-S1930 series switches v.SWITC (no CVSS)
- [CVE-2023-38905](https://cve.now/CVE-2023-38905.md): SQL injection vulnerability in Jeecg-boot v.3.5.0 and before allows a local attacker to cause a denial of service via the Benchmark, PG\_Slee (no CVSS, org.jeecgframework.boot:jeecg-boot-parent)
- [CVE-2023-39125](https://cve.now/CVE-2023-39125.md): NTSC-CRT 2.2.1 has an integer overflow and out-of-bounds write in loadBMP in bmp\_rw.c because a file's width, height, and BPP are not valida (no CVSS)
- [CVE-2023-39741](https://cve.now/CVE-2023-39741.md): lrzip v0.651 was discovered to contain a heap overflow via the libzpaq::PostProcessor::write(int) function at /libzpaq/libzpaq.cpp. (no CVSS)
- [CVE-2023-39743](https://cve.now/CVE-2023-39743.md): lrzip-next LZMA v23.01 was discovered to contain an access violation via the component /bz3\_decode\_block src/libbz3.c. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.