# CVEs published 2023-08-18

58 CVEs were published on August 18, 2023: 2 critical, 15 high. Days are UTC.

- [CVE-2023-40037](https://cve.now/CVE-2023-40037.md): Apache NiFi: Incomplete Validation of JDBC and JNDI Connection URLs (no CVSS, Apache Software Foundation Apache NiFi · org.apache.nifi… +3)
- [CVE-2023-40172](https://cve.now/CVE-2023-40172.md): Cross-Site Request Forgery (CSRF) in fobybus/social-media-skeleton (CVSS 6.5, fobybus social-media-skeleton)
- [CVE-2023-40173](https://cve.now/CVE-2023-40173.md): Unsalted passwords in fobybus/social-media-skeleton (CVSS 7.5, fobybus social-media-skeleton)
- [CVE-2023-40174](https://cve.now/CVE-2023-40174.md): Insufficient Session Expiration in fobybus/social-media-skeleton (CVSS 6.8, fobybus social-media-skeleton)
- [CVE-2023-40175](https://cve.now/CVE-2023-40175.md): Inconsistent Interpretation of HTTP Requests in puma (CVSS 7.3, puma)
- [CVE-2023-20212](https://cve.now/CVE-2023-20212.md): A vulnerability in the AutoIt module of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition (CVSS 7.5, Cisco Secure Endpoint)
- [CVE-2023-4422](https://cve.now/CVE-2023-4422.md): Cross-site Scripting (XSS) - Stored in cockpit-hq/cockpit (CVSS 6.8, cockpit-hq/cockpit)
- [CVE-2023-4415](https://cve.now/CVE-2023-4415.md): Ruijie RG-EW1200G login improper authentication (CVSS 7.3, Ruijie RG-EW1200G)
- [CVE-2023-4414](https://cve.now/CVE-2023-4414.md): Byzoro Smart S85F Management Platform decodmail.php command injection (CVSS 6.3, Byzoro Smart S85F Management Platform)
- [CVE-2023-32122](https://cve.now/CVE-2023-32122.md): WordPress Spiffy Calendar Plugin \<= 4.9.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, Spiffy Plugins Spiffy Calendar)
- [CVE-2023-32130](https://cve.now/CVE-2023-32130.md): WordPress Multi Rating Plugin \<= 5.0.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Daniel Powney Multi Rating)
- [CVE-2023-29387](https://cve.now/CVE-2023-29387.md): WordPress Manager for Icomoon Plugin \<= 2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Julien Crego Manager for Icomoon)
- [CVE-2023-32109](https://cve.now/CVE-2023-32109.md): WordPress Albo Pretorio Online Plugin \<= 4.6.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Ignazio Scimone Albo Pretorio On line)
- [CVE-2023-30499](https://cve.now/CVE-2023-30499.md): WordPress FV Flowplayer Video Player Plugin \<= 7.5.32.7212 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, FolioVision FV Flowplayer Video Player)
- [CVE-2023-4412](https://cve.now/CVE-2023-4412.md): TOTOLINK EX1200L setWanCfg os command injection (CVSS 6.3, TOTOLINK EX1200L)
- [CVE-2023-32108](https://cve.now/CVE-2023-32108.md): WordPress Albo Pretorio Online Plugin \<= 4.6.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Ignazio Scimone Albo Pretorio On line)
- [CVE-2023-4411](https://cve.now/CVE-2023-4411.md): TOTOLINK EX1200L setTracerouteCfg os command injection (CVSS 6.3, TOTOLINK EX1200L)
- [CVE-2023-4410](https://cve.now/CVE-2023-4410.md): TOTOLINK EX1200L setDiagnosisCfg os command injection (CVSS 6.3, TOTOLINK EX1200L)
- [CVE-2023-32107](https://cve.now/CVE-2023-32107.md): WordPress Photo Gallery by Ays Plugin \<= 5.1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Photo Gallery Team Photo Gallery by Ays – Responsive Image…)
- [CVE-2023-32106](https://cve.now/CVE-2023-32106.md): WordPress WP Docs Plugin \<= 1.9.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Fahad Mahmood WP Docs)
- [CVE-2023-32105](https://cve.now/CVE-2023-32105.md): WordPress WPPizza Plugin \<= 3.17.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, ollybach WPPizza – A Restaurant Plugin)
- [CVE-2023-32103](https://cve.now/CVE-2023-32103.md): WordPress TP Education Plugin \<= 4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Theme Palace TP Education)
- [CVE-2023-31218](https://cve.now/CVE-2023-31218.md): WordPress WOLF Plugin \<= 1.0.6 is vulnerable to CSRF leading to Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, realmag777 WOLF – WordPress Posts Bulk Editor and Manager P…)
- [CVE-2023-31232](https://cve.now/CVE-2023-31232.md): WordPress Plugins List Plugin \<= 2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, David Artiss Plugins List)
- [CVE-2023-4409](https://cve.now/CVE-2023-4409.md): NBS&HappySoftWeChat unrestricted upload (CVSS 6.3, NBS&HappySoftWeChat)
- [CVE-2023-4407](https://cve.now/CVE-2023-4407.md): Codecanyon Credit Lite POST Request account\_statement sql injection (CVSS 6.3, Codecanyon Credit Lite)
- [CVE-2023-31228](https://cve.now/CVE-2023-31228.md): WordPress CM On Demand Search And Replace Plugin \<= 1.3.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, CreativeMindsSolutions CM On Demand Search And Replace)
- [CVE-2023-31094](https://cve.now/CVE-2023-31094.md): WordPress Stock Sync for WooCommerce Plugin \<= 2.4.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Lauri Karisola / WP Trio Stock Sync for WooCommerce)
- [CVE-2023-40072](https://cve.now/CVE-2023-40072.md): OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS comma (CVSS 8.8, ELECOM CO. WAB-S600-PS · ELECOM CO. WAB-S300 +6)
- [CVE-2023-40069](https://cve.now/CVE-2023-40069.md): OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS c (CVSS 9.8, ELECOM CO. WRC-F1167ACF · ELECOM CO. WRC-1750GHBK +3)
- [CVE-2023-39944](https://cve.now/CVE-2023-39944.md): OS command injection vulnerability in WRC-F1167ACF all versions, and WRC-1750GHBK all versions allows an attacker who can access the product (no CVSS, ELECOM CO. WRC-F1167ACF · ELECOM CO. WRC-1750GHBK)
- [CVE-2023-39455](https://cve.now/CVE-2023-39455.md): OS command injection vulnerability in ELECOM wireless LAN routers allows an authenticated user to execute an arbitrary OS command by sending (no CVSS, ELECOM CO. WRC-600GHBK-A · ELECOM CO. WRC-1467GHBK-A +5)
- [CVE-2023-39454](https://cve.now/CVE-2023-39454.md): Buffer overflow vulnerability exists in ELECOM wireless LAN routers, which may allow an unauthenticated attacker to execute arbitrary code. (CVSS 8.8, ELECOM CO. WRC-X1800GS-B · ELECOM CO. WRC-X1800GSA-B +11)
- [CVE-2023-39445](https://cve.now/CVE-2023-39445.md): Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an unauthenticated attacker to execu (no CVSS, LOGITEC LAN-WH300N/RE)
- [CVE-2023-38576](https://cve.now/CVE-2023-38576.md): Hidden functionality vulnerability in LAN-WH300N/RE all versions provided by LOGITEC CORPORATION allows an authenticated user to execute arb (no CVSS, LOGITEC LAN-WH300N/RE)
- [CVE-2023-38132](https://cve.now/CVE-2023-38132.md): LAN-W451NGR all versions provided by LOGITEC CORPORATION contains an improper access control vulnerability, which allows an unauthenticated (no CVSS, LOGITEC LAN-W451NGR)
- [CVE-2023-35991](https://cve.now/CVE-2023-35991.md): Hidden functionality vulnerability in LOGITEC wireless LAN routers allows an unauthenticated attacker to log in to the product's certain man (CVSS 8.8, LOGITEC LAN-W300N/DR · LOGITEC LAN-WH300N/DR +5)
- [CVE-2023-32626](https://cve.now/CVE-2023-32626.md): Hidden functionality vulnerability in LAN-W300N/RS all versions, and LAN-W300N/PR5 all versions allows an unauthenticated attacker to log in (no CVSS, LOGITEC LAN-W300N/RS · LOGITEC LAN-W300N/PR5)
- [CVE-2023-39416](https://cve.now/CVE-2023-39416.md): Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlier, and Proself Mail Sanitize Edition Ver1 (no CVSS, North Grid Proself Enterprise/Standard Edition · North G… +1)
- [CVE-2023-39415](https://cve.now/CVE-2023-39415.md): Improper authentication vulnerability in Proself Enterprise/Standard Edition Ver5.61 and earlier, Proself Gateway Edition Ver1.62 and earlie (no CVSS, North Grid Proself Enterprise/Standard Edition · North G… +1)
- [CVE-2023-30875](https://cve.now/CVE-2023-30875.md): WordPress Logo Scheduler Plugin \<= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, All My Web Needs Logo Scheduler)
- [CVE-2023-4040](https://cve.now/CVE-2023-4040.md): The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabilit (CVSS 5.3, webtoffee Stripe Payment Plugin for WooCommerce)
- [CVE-2023-27471](https://cve.now/CVE-2023-27471.md): An issue was discovered in Insyde InsydeH2O with kernel 5.0 through 5.5. (no CVSS)
- [CVE-2023-27576](https://cve.now/CVE-2023-27576.md): An issue was discovered in phpList before 3.6.14. (no CVSS)
- [CVE-2023-38839](https://cve.now/CVE-2023-38839.md): SQL injection vulnerability in Kidus Minimati v.1.0.0 allows a remote attacker to obtain sensitive information via theID parameter in the fu (no CVSS)
- [CVE-2023-38890](https://cve.now/CVE-2023-38890.md): Online Shopping Portal Project 3.1 allows remote attackers to execute arbitrary SQL commands/queries via the login form, leading to unauthor (no CVSS)
- [CVE-2023-38910](https://cve.now/CVE-2023-38910.md): CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted pay (no CVSS)
- [CVE-2023-38911](https://cve.now/CVE-2023-38911.md): A Cross-Site Scripting (XSS) vulnerability in CSZ CMS 1.3.0 allows attackers to execute arbitrary code via a crafted payload to the Gallery (no CVSS)
- [CVE-2023-39665](https://cve.now/CVE-2023-39665.md): D-Link DIR-868L fw\_revA\_1-12\_eu\_multi\_20170316 was discovered to contain a buffer overflow via the acStack\_50 parameter. (no CVSS)
- [CVE-2023-39666](https://cve.now/CVE-2023-39666.md): D-Link DIR-842 fw\_revA\_1-02\_eu\_multi\_20151008 was discovered to contain multiple buffer overflows in the fgets function via the acStack\_120 (no CVSS)
- [CVE-2023-39667](https://cve.now/CVE-2023-39667.md): D-Link DIR-868L fw\_revA\_1-12\_eu\_multi\_20170316 was discovered to contain a buffer overflow via the param\_2 parameter in the FUN\_0000acb4 fun (CVSS 9.8)
- [CVE-2023-39668](https://cve.now/CVE-2023-39668.md): D-Link DIR-868L fw\_revA\_1-12\_eu\_multi\_20170316 was discovered to contain a buffer overflow via the param\_2 parameter in the inet\_ntoa() func (no CVSS)
- [CVE-2023-39669](https://cve.now/CVE-2023-39669.md): D-Link DIR-880 A1\_FW107WWb08 was discovered to contain a NULL pointer dereference in the function FUN\_00010824. (no CVSS)
- [CVE-2023-39670](https://cve.now/CVE-2023-39670.md): Tenda AC6 \_US\_AC6V1.0BR\_V15.03.05.16 was discovered to contain a buffer overflow via the function fgets. (no CVSS)
- [CVE-2023-39671](https://cve.now/CVE-2023-39671.md): D-Link DIR-880 A1\_FW107WWb08 was discovered to contain a buffer overflow via the function FUN\_0001be68. (no CVSS)
- [CVE-2023-39672](https://cve.now/CVE-2023-39672.md): Tenda WH450 v1.0.0.18 was discovered to contain a buffer overflow via the function fgets. (no CVSS)
- [CVE-2023-39673](https://cve.now/CVE-2023-39673.md): Tenda AC15 V1.0BR\_V15.03.05.18\_multi\_TD01 was discovered to contain a buffer overflow via the function FUN\_00010e34(). (no CVSS)
- [CVE-2023-39674](https://cve.now/CVE-2023-39674.md): D-Link DIR-880 A1\_FW107WWb08 was discovered to contain a buffer overflow via the function fgets. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.