CVEs published August 18, 2023
58 CVEs were published on August 18, 2023: 2 critical, 15 high.
- Published
- 58
- Critical
- 2
- High
- 15
- Medium
- 17
- Low
- 0
- Unrated
- 24
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- fobybus social-media-skeleton
- 3
- TOTOLINK EX1200L
- 3
- Ignazio Scimone Albo Pretorio On line
- 2
- LOGITEC LAN-WH300N/RE
- 2
- North Grid Proself Enterprise/Standard Edition · North G… +1
- 2
- All My Web Needs Logo Scheduler
- 1
- Apache Software Foundation Apache NiFi · org.apache.nifi… +3
- 1
- Byzoro Smart S85F Management Platform
- 1
- Cisco Secure Endpoint
- 1
- cockpit-hq/cockpit
- 1
Critical 2
- CVE-2023-40069OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS cELECOM CO. WRC-F1167ACF · ELECOM CO. WRC-1750GHBK +3
- CVE-2023-39667D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in the FUN_0000acb4 fun
High 15
- CVE-2023-40173Unsalted passwords in fobybus/social-media-skeletonfobybus social-media-skeleton
- CVE-2023-40175Inconsistent Interpretation of HTTP Requests in pumapuma
- CVE-2023-20212A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition Cisco Secure Endpoint
- CVE-2023-4415Ruijie RG-EW1200G login improper authenticationRuijie RG-EW1200G
- CVE-2023-32109WordPress Albo Pretorio Online Plugin <= 4.6.3 is vulnerable to Cross Site Scripting (XSS)Ignazio Scimone Albo Pretorio On line
- CVE-2023-30499WordPress FV Flowplayer Video Player Plugin <= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS)FolioVision FV Flowplayer Video Player
- CVE-2023-32108WordPress Albo Pretorio Online Plugin <= 4.6.3 is vulnerable to Cross Site Scripting (XSS)Ignazio Scimone Albo Pretorio On line
- CVE-2023-32107WordPress Photo Gallery by Ays Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)Photo Gallery Team Photo Gallery by Ays – Responsive Image…
- CVE-2023-32106WordPress WP Docs Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)Fahad Mahmood WP Docs
- CVE-2023-32105WordPress WPPizza Plugin <= 3.17.1 is vulnerable to Cross Site Scripting (XSS)ollybach WPPizza – A Restaurant Plugin
- CVE-2023-31218WordPress WOLF Plugin <= 1.0.6 is vulnerable to CSRF leading to Stored Cross Site Scripting (XSS) vulnerabilityrealmag777 WOLF – WordPress Posts Bulk Editor and Manager P…
- CVE-2023-31094WordPress Stock Sync for WooCommerce Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)Lauri Karisola / WP Trio Stock Sync for WooCommerce
- CVE-2023-40072OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS commaELECOM CO. WAB-S600-PS · ELECOM CO. WAB-S300 +6
- CVE-2023-39454Buffer overflow vulnerability exists in ELECOM wireless LAN routers, which may allow an unauthenticated attacker to execute arbitrary code.ELECOM CO. WRC-X1800GS-B · ELECOM CO. WRC-X1800GSA-B +11
- CVE-2023-35991Hidden functionality vulnerability in LOGITEC wireless LAN routers allows an unauthenticated attacker to log in to the product's certain manLOGITEC LAN-W300N/DR · LOGITEC LAN-WH300N/DR +5
Medium, low and unrated 41
- CVE-2023-40037Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLsApache Software Foundation Apache NiFi · org.apache.nifi… +3
- CVE-2023-40172Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeletonfobybus social-media-skeleton
- CVE-2023-40174Insufficient Session Expiration in fobybus/social-media-skeletonfobybus social-media-skeleton
- CVE-2023-4422Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpitcockpit-hq/cockpit
- CVE-2023-4414Byzoro Smart S85F Management Platform decodmail.php command injectionByzoro Smart S85F Management Platform
- CVE-2023-32122WordPress Spiffy Calendar Plugin <= 4.9.3 is vulnerable to Cross Site Scripting (XSS)Spiffy Plugins Spiffy Calendar
- CVE-2023-32130WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Scripting (XSS)Daniel Powney Multi Rating
- CVE-2023-29387WordPress Manager for Icomoon Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)Julien Crego Manager for Icomoon
- CVE-2023-4412TOTOLINK EX1200L setWanCfg os command injectionTOTOLINK EX1200L
- CVE-2023-4411TOTOLINK EX1200L setTracerouteCfg os command injectionTOTOLINK EX1200L
- CVE-2023-4410TOTOLINK EX1200L setDiagnosisCfg os command injectionTOTOLINK EX1200L
- CVE-2023-32103WordPress TP Education Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)Theme Palace TP Education
- CVE-2023-31232WordPress Plugins List Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)David Artiss Plugins List
- CVE-2023-4409NBS&HappySoftWeChat unrestricted uploadNBS&HappySoftWeChat
- CVE-2023-4407Codecanyon Credit Lite POST Request account_statement sql injectionCodecanyon Credit Lite
- CVE-2023-31228WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)CreativeMindsSolutions CM On Demand Search And Replace
- CVE-2023-39944OS command injection vulnerability in WRC-F1167ACF all versions, and WRC-1750GHBK all versions allows an attacker who can access the productELECOM CO. WRC-F1167ACF · ELECOM CO. WRC-1750GHBK
- CVE-2023-39455OS command injection vulnerability in ELECOM wireless LAN routers allows an authenticated user to execute an arbitrary OS command by sendingELECOM CO. WRC-600GHBK-A · ELECOM CO. WRC-1467GHBK-A +5
- CVE-2023-39445Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execuLOGITEC LAN-WH300N/RE
- CVE-2023-38576Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an authenticated user to execute arbLOGITEC LAN-WH300N/RE
- CVE-2023-38132LAN-W451NGR all versions provided by LOGITEC CORPORATION contains an improper access control vulnerability, which allows an unauthenticated LOGITEC LAN-W451NGR
- CVE-2023-32626Hidden functionality vulnerability in LAN-W300N/RS all versions, and LAN-W300N/PR5 all versions allows an unauthenticated attacker to log inLOGITEC LAN-W300N/RS · LOGITEC LAN-W300N/PR5
- CVE-2023-39416Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1North Grid Proself Enterprise/Standard Edition · North G… +1
- CVE-2023-39415Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlieNorth Grid Proself Enterprise/Standard Edition · North G… +1
- CVE-2023-30875WordPress Logo Scheduler Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)All My Web Needs Logo Scheduler
- CVE-2023-4040The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilitwebtoffee Stripe Payment Plugin for WooCommerce
- CVE-2023-27471An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2023-27576An issue was discovered in phpList before 3.6.14.
- CVE-2023-38839SQL injection vulnerability in Kidus Minimati v.1.0.0 allows a remote attacker to obtain sensitive information via theID parameter in the fu
- CVE-2023-38890Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthor
- CVE-2023-38910CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted pay
- CVE-2023-38911A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery
- CVE-2023-39665D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the acStack_50 parameter.
- CVE-2023-39666D-Link DIR-842 fw_revA_1-02_eu_multi_20151008 was discovered to contain multiple buffer overflows in the fgets function via the acStack_120
- CVE-2023-39668D-Link DIR-868L fw_revA_1-12_eu_multi_20170316 was discovered to contain a buffer overflow via the param_2 parameter in the inet_ntoa() func
- CVE-2023-39669D-Link DIR-880 A1_FW107WWb08 was discovered to contain a NULL pointer dereference in the function FUN_00010824.
- CVE-2023-39670Tenda AC6 _US_AC6V1.0BR_V15.03.05.16 was discovered to contain a buffer overflow via the function fgets.
- CVE-2023-39671D-Link DIR-880 A1_FW107WWb08 was discovered to contain a buffer overflow via the function FUN_0001be68.
- CVE-2023-39672Tenda WH450 v1.0.0.18 was discovered to contain a buffer overflow via the function fgets.
- CVE-2023-39673Tenda AC15 V1.0BR_V15.03.05.18_multi_TD01 was discovered to contain a buffer overflow via the function FUN_00010e34().
- CVE-2023-39674D-Link DIR-880 A1_FW107WWb08 was discovered to contain a buffer overflow via the function fgets.