CVEs published August 21, 2023
63 CVEs were published on August 21, 2023: 5 critical, 6 high. 1 is now in CISA KEV.
- Published
- 63
- Critical
- 5
- High
- 6
- Medium
- 22
- Low
- 1
- Unrated
- 29
- Now in CISA KEV
- 1
- Fix available
- 23
Most affected products
- Danfoss AK-SM800A
- 3
- Jenkins Project Jenkins Fortify Plugin · org.jenkins-ci.plu…
- 3
- OpenRapid RapidCMS
- 3
- SourceCodester Free Hospital Management System for Small Pr…
- 3
- Devolutions Remote Desktop Manager
- 2
- LuxSoft LuxCal Web Calendar
- 2
- Microsoft Edge
- 2
- MultiParcels Shipping For WooCommerce
- 2
- wallabag/wallabag
- 2
- Apache Software Foundation Apache Ivy · org.apache.ivy:ivy
- 1
Critical 5
- CVE-2023-25915Authenticated Remote Command Execution in Danfoss AK-SM800ADanfoss AK-SM800A
- CVE-2023-4373 Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 anDevolutions Remote Desktop Manager
- CVE-2023-32002The use of `Module._load()` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module.NodeJS Node
- CVE-2023-38035A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass aIvanti MobileIron Sentry
- CVE-2023-39809N.V.K.INTER CO., LTD.
High 6
- CVE-2023-25913Authentication Bypass in Danfoss AK-SM800ADanfoss AK-SM800A
- CVE-2023-25914Authneticated Path Traversal in Danfoss AK-SM800ADanfoss AK-SM800A
- CVE-2023-36787Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2023-3604Change WP Admin < 1.1.4 - Secret Login Page DisclosureChange WP Admin Login
- CVE-2023-40735Butterfly Button Project - Sensitive Information DisclosureCavo – Connecting for a Safer World BUTTERFLY BUTTON
- CVE-2022-46751Apache Ivy: XML External Entity vulnerability in Apache IvyApache Software Foundation Apache Ivy · org.apache.ivy:ivy
Medium, low and unrated 52
- CVE-2023-4301CSRF vulnerability in Fortify Plugin allow capturing credentialsJenkins Project Jenkins Fortify Plugin · org.jenkins-ci.plu…
- CVE-2023-4302Missing permission checks in Fortify Plugin allow capturing credentialsJenkins Project Jenkins Fortify Plugin · org.jenkins-ci.plu…
- CVE-2023-4303HTML injection vulnerability in Fortify PluginJenkins Project Jenkins Fortify Plugin · org.jenkins-ci.plu…
- CVE-2023-38158Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2023-4459Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()Red Hat Enterprise Linux 8.2 Advanced Update Support · R… +8
- CVE-2023-4417Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows Devolutions Remote Desktop Manager
- CVE-2023-4456Openshift-logging: lokistack authorisation is cached too broadlyRed Hat RHOL-5.5-RHEL-8 · Red Hat RHOL-5.6-RHEL-8 +1
- CVE-2023-3366MultiParcels Shipping For WooCommerce < 1.15.2 - Arbitrary Shipment Deletion via CSRFMultiParcels Shipping For WooCommerce
- CVE-2023-3936Blog2Social < 7.2.1 - Reflected XSSBlog2Social: Social Media Auto Post & Scheduler
- CVE-2023-3954MultiParcels Shipping For WooCommerce 1.15.2-1.15.3 - Reflected XSSMultiParcels Shipping For WooCommerce
- CVE-2023-3667Bit Assist < 1.1.9 - Admin+ Stored Cross-Site ScriptingChat Button: WhatsApp Chat, Facebook Messenger, Telegram Ch…
- CVE-2023-3481XSS in Chrome Lab CrittersGoogle Chrome Labs Critters · critters
- CVE-2023-4455Cross-Site Request Forgery (CSRF) in wallabag/wallabagwallabag/wallabag
- CVE-2023-4454Cross-Site Request Forgery (CSRF) in wallabag/wallabagwallabag/wallabag
- CVE-2023-4453Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore
- CVE-2023-39939SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) LuxSoft LuxCal Web Calendar
- CVE-2023-39543Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite veLuxSoft LuxCal Web Calendar
- CVE-2023-40068Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 WP Engine Advanced Custom Fields
- CVE-2023-4450jeecgboot JimuReport Template injectionjeecgboot JimuReport
- CVE-2023-4449SourceCodester Free and Open Source Inventory Management System sql injectionSourceCodester Free and Open Source Inventory Management Sy…
- CVE-2023-4448OpenRapid RapidCMS run-movepass.php password recoveryOpenRapid RapidCMS
- CVE-2023-4447OpenRapid RapidCMS article-chat.php sql injectionOpenRapid RapidCMS
- CVE-2023-4446OpenRapid RapidCMS category.php sql injectionOpenRapid RapidCMS
- CVE-2023-4445Mini-Tmall sql injectionMini-Tmall
- CVE-2023-4444SourceCodester Free Hospital Management System for Small Practices edit-user.php sql injectionSourceCodester Free Hospital Management System for Small Pr…
- CVE-2023-4443SourceCodester Free Hospital Management System for Small Practices edit-doc.php sql injectionSourceCodester Free Hospital Management System for Small Pr…
- CVE-2023-4442SourceCodester Free Hospital Management System for Small Practices booking-complete.php sql injectionSourceCodester Free Hospital Management System for Small Pr…
- CVE-2020-28715An issue was discovered in kdmserver service in LeEco LeTV X43 version V2401RCN02C080080B04121S, allows attackers to execute arbitrary code,
- CVE-2023-31447user_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted pay
- CVE-2023-38836File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type c
- CVE-2023-38899SQL injection vulnerability in berkaygediz O_Blog v.1.0 allows a local attacker to escalate privileges via the secure_file_priv component.
- CVE-2023-38906An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100 1.4.9, Smart Camera Tapo series C200 1.1.18, and Tapo Ap
- CVE-2023-38961Buffer Overflwo vulnerability in JerryScript Project jerryscript v.3.0.0 allows a remote attacker to execute arbitrary code via the scanner_
- CVE-2023-38976An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function.github.com/weaviate/weaviate
- CVE-2023-39061Cross Site Request Forgery (CSRF) vulnerability in Chamilo v.1.11 thru v.1.11.20 allows a remote authenticated privileged attacker to execut
- CVE-2023-39094Cross Site Scripting vulnerability in ZeroWdd studentmanager v.1.0 allows a remote attacker to execute arbitrary code via the username param
- CVE-2023-39106An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constrcom.alibaba.nacos:nacos-spring-context
- CVE-2023-39617TOTOLINK X5000R_V9.1.0cu.2089_B20211224 and X5000R_V9.1.0cu.2350_B20230313 were discovered to contain a remote code execution (RCE) vulnerab
- CVE-2023-39618TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface.
- CVE-2023-39660An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the prpandasai
- CVE-2023-39745TP-Link TL-WR940N V2, TP-Link TL-WR941ND V5 and TP-Link TL-WR841N V8 were discovered to contain a buffer overflow via the component /userRpm
- CVE-2023-39747TP-Link WR841N V8, TP-Link TL-WR940N V2, and TL-WR941ND V5 were discovered to contain a buffer overflow via the radiusSecret parameter at /u
- CVE-2023-39748An issue in the component /userRpm/NetworkCfgRpm of TP-Link TL-WR1041N V2 allows attackers to cause a Denial of Service (DoS) via a crafted
- CVE-2023-39749D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the component /adv_resource.
- CVE-2023-39750D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the f_ipv6_enable parameter at /bsc_ipv6.
- CVE-2023-39751TP-Link TL-WR941ND V6 were discovered to contain a buffer overflow via the pSize parameter at /userRpm/PingIframeRpm.
- CVE-2023-39784Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the save_virtualser_data function.
- CVE-2023-39785Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the set_qosMib_list function.
- CVE-2023-39786Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sscanf function.
- CVE-2023-39807N.V.K.INTER CO., LTD.
- CVE-2023-39808N.V.K.INTER CO., LTD.
- CVE-2023-40352McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLL