# CVEs published 2023-08-21

63 CVEs were published on August 21, 2023: 5 critical, 6 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-4301](https://cve.now/CVE-2023-4301.md): CSRF vulnerability in Fortify Plugin allow capturing credentials (CVSS 4.2, Jenkins Project Jenkins Fortify Plugin · org.jenkins-ci.plu…)
- [CVE-2023-4302](https://cve.now/CVE-2023-4302.md): Missing permission checks in Fortify Plugin allow capturing credentials (CVSS 4.2, Jenkins Project Jenkins Fortify Plugin · org.jenkins-ci.plu…)
- [CVE-2023-4303](https://cve.now/CVE-2023-4303.md): HTML injection vulnerability in Fortify Plugin (CVSS 4.3, Jenkins Project Jenkins Fortify Plugin · org.jenkins-ci.plu…)
- [CVE-2023-25913](https://cve.now/CVE-2023-25913.md): Authentication Bypass in Danfoss AK-SM800A (CVSS 7.5, Danfoss AK-SM800A)
- [CVE-2023-25914](https://cve.now/CVE-2023-25914.md): Authneticated Path Traversal in Danfoss AK-SM800A (CVSS 8.8, Danfoss AK-SM800A)
- [CVE-2023-25915](https://cve.now/CVE-2023-25915.md): Authenticated Remote Command Execution in Danfoss AK-SM800A (CVSS 9.9, Danfoss AK-SM800A)
- [CVE-2023-36787](https://cve.now/CVE-2023-36787.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Edge)
- [CVE-2023-38158](https://cve.now/CVE-2023-38158.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 3.1, Microsoft Edge)
- [CVE-2023-4459](https://cve.now/CVE-2023-4459.md): Kernel: vmxnet3: null pointer dereference in vmxnet3\_rq\_cleanup() (CVSS 5.5, Red Hat Enterprise Linux 8.2 Advanced Update Support · R… +8)
- [CVE-2023-4417](https://cve.now/CVE-2023-4417.md): Improper access controls in the entry duplication component in Devolutions Remote Desktop Manager 2023.2.19 and earlier versions on Windows (no CVSS, Devolutions Remote Desktop Manager)
- [CVE-2023-4373](https://cve.now/CVE-2023-4373.md): Inadequate validation of permissions when employing remote tools and macros within Devolutions Remote Desktop Manager versions 2023.2.19 an (CVSS 9.8, Devolutions Remote Desktop Manager)
- [CVE-2023-32002](https://cve.now/CVE-2023-32002.md): The use of \`Module.\_load()\` can bypass the policy mechanism and require modules outside of the policy.json definition for a given module. (CVSS 9.8, NodeJS Node)
- [CVE-2023-38035](https://cve.now/CVE-2023-38035.md): A security vulnerability in MICS Admin Portal in Ivanti MobileIron Sentry versions 9.18.0 and below, which may allow an attacker to bypass a (CVSS 9.8, KEV, Ivanti MobileIron Sentry)
- [CVE-2023-4456](https://cve.now/CVE-2023-4456.md): Openshift-logging: lokistack authorisation is cached too broadly (CVSS 5.7, Red Hat RHOL-5.5-RHEL-8 · Red Hat RHOL-5.6-RHEL-8 +1)
- [CVE-2023-3604](https://cve.now/CVE-2023-3604.md): Change WP Admin \< 1.1.4 - Secret Login Page Disclosure (CVSS 7.5, Change WP Admin Login)
- [CVE-2023-3366](https://cve.now/CVE-2023-3366.md): MultiParcels Shipping For WooCommerce \< 1.15.2 - Arbitrary Shipment Deletion via CSRF (CVSS 4.3, MultiParcels Shipping For WooCommerce)
- [CVE-2023-3936](https://cve.now/CVE-2023-3936.md): Blog2Social \< 7.2.1 - Reflected XSS (CVSS 6.1, Blog2Social: Social Media Auto Post & Scheduler)
- [CVE-2023-3954](https://cve.now/CVE-2023-3954.md): MultiParcels Shipping For WooCommerce 1.15.2-1.15.3 - Reflected XSS (CVSS 6.1, MultiParcels Shipping For WooCommerce)
- [CVE-2023-3667](https://cve.now/CVE-2023-3667.md): Bit Assist \< 1.1.9 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Chat Button: WhatsApp Chat, Facebook Messenger, Telegram Ch…)
- [CVE-2023-40735](https://cve.now/CVE-2023-40735.md): Butterfly Button Project - Sensitive Information Disclosure (CVSS 7.5, Cavo – Connecting for a Safer World BUTTERFLY BUTTON)
- [CVE-2023-3481](https://cve.now/CVE-2023-3481.md): XSS in Chrome Lab Critters (CVSS 5.7, Google Chrome Labs Critters · critters)
- [CVE-2023-4455](https://cve.now/CVE-2023-4455.md): Cross-Site Request Forgery (CSRF) in wallabag/wallabag (CVSS 6.5, wallabag/wallabag)
- [CVE-2023-4454](https://cve.now/CVE-2023-4454.md): Cross-Site Request Forgery (CSRF) in wallabag/wallabag (CVSS 4.3, wallabag/wallabag)
- [CVE-2023-4453](https://cve.now/CVE-2023-4453.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 6.4, pimcore/pimcore)
- [CVE-2023-39939](https://cve.now/CVE-2023-39939.md): SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite version) (no CVSS, LuxSoft LuxCal Web Calendar)
- [CVE-2023-39543](https://cve.now/CVE-2023-39543.md): Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.3M (MySQL version) and LuxCal Web Calendar prior to 5.2.3L (SQLite ve (no CVSS, LuxSoft LuxCal Web Calendar)
- [CVE-2023-40068](https://cve.now/CVE-2023-40068.md): Cross-site scripting vulnerability in Advanced Custom Fields versions 6.1.0 to 6.1.7 and Advanced Custom Fields Pro versions 6.1.0 to 6.1.7 (no CVSS, WP Engine Advanced Custom Fields)
- [CVE-2022-46751](https://cve.now/CVE-2022-46751.md): Apache Ivy: XML External Entity vulnerability in Apache Ivy (CVSS 8.2, Apache Software Foundation Apache Ivy · org.apache.ivy:ivy)
- [CVE-2023-4450](https://cve.now/CVE-2023-4450.md): jeecgboot JimuReport Template injection (CVSS 6.3, jeecgboot JimuReport)
- [CVE-2023-4449](https://cve.now/CVE-2023-4449.md): SourceCodester Free and Open Source Inventory Management System sql injection (CVSS 6.3, SourceCodester Free and Open Source Inventory Management Sy…)
- [CVE-2023-4448](https://cve.now/CVE-2023-4448.md): OpenRapid RapidCMS run-movepass.php password recovery (CVSS 6.3, OpenRapid RapidCMS)
- [CVE-2023-4447](https://cve.now/CVE-2023-4447.md): OpenRapid RapidCMS article-chat.php sql injection (CVSS 6.3, OpenRapid RapidCMS)
- [CVE-2023-4446](https://cve.now/CVE-2023-4446.md): OpenRapid RapidCMS category.php sql injection (CVSS 5.5, OpenRapid RapidCMS)
- [CVE-2023-4445](https://cve.now/CVE-2023-4445.md): Mini-Tmall sql injection (CVSS 6.3, Mini-Tmall)
- [CVE-2023-4444](https://cve.now/CVE-2023-4444.md): SourceCodester Free Hospital Management System for Small Practices edit-user.php sql injection (CVSS 6.3, SourceCodester Free Hospital Management System for Small Pr…)
- [CVE-2023-4443](https://cve.now/CVE-2023-4443.md): SourceCodester Free Hospital Management System for Small Practices edit-doc.php sql injection (CVSS 6.3, SourceCodester Free Hospital Management System for Small Pr…)
- [CVE-2023-4442](https://cve.now/CVE-2023-4442.md): SourceCodester Free Hospital Management System for Small Practices booking-complete.php sql injection (CVSS 6.3, SourceCodester Free Hospital Management System for Small Pr…)
- [CVE-2020-28715](https://cve.now/CVE-2020-28715.md): An issue was discovered in kdmserver service in LeEco LeTV X43 version V2401RCN02C080080B04121S, allows attackers to execute arbitrary code, (no CVSS)
- [CVE-2023-31447](https://cve.now/CVE-2023-31447.md): user\_login.cgi on Draytek Vigor2620 devices before 3.9.8.4 (and on all versions of Vigor2925 devices) allows attackers to send a crafted pay (no CVSS)
- [CVE-2023-38836](https://cve.now/CVE-2023-38836.md): File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type c (no CVSS)
- [CVE-2023-38899](https://cve.now/CVE-2023-38899.md): SQL injection vulnerability in berkaygediz O\_Blog v.1.0 allows a local attacker to escalate privileges via the secure\_file\_priv component. (no CVSS)
- [CVE-2023-38906](https://cve.now/CVE-2023-38906.md): An issue in TPLink Smart Bulb Tapo series L530 1.1.9, L510E 1.0.8, L630 1.0.3, P100 1.4.9, Smart Camera Tapo series C200 1.1.18, and Tapo Ap (no CVSS)
- [CVE-2023-38961](https://cve.now/CVE-2023-38961.md): Buffer Overflwo vulnerability in JerryScript Project jerryscript v.3.0.0 allows a remote attacker to execute arbitrary code via the scanner\_ (no CVSS)
- [CVE-2023-38976](https://cve.now/CVE-2023-38976.md): An issue in weaviate v.1.20.0 allows a remote attacker to cause a denial of service via the handleUnbatchedGraphQLRequest function. (no CVSS, github.com/weaviate/weaviate)
- [CVE-2023-39061](https://cve.now/CVE-2023-39061.md): Cross Site Request Forgery (CSRF) vulnerability in Chamilo v.1.11 thru v.1.11.20 allows a remote authenticated privileged attacker to execut (no CVSS)
- [CVE-2023-39094](https://cve.now/CVE-2023-39094.md): Cross Site Scripting vulnerability in ZeroWdd studentmanager v.1.0 allows a remote attacker to execute arbitrary code via the username param (no CVSS)
- [CVE-2023-39106](https://cve.now/CVE-2023-39106.md): An issue in Nacos Group Nacos Spring Project v.1.1.1 and before allows a remote attacker to execute arbitrary code via the SnakeYamls Constr (no CVSS, com.alibaba.nacos:nacos-spring-context)
- [CVE-2023-39617](https://cve.now/CVE-2023-39617.md): TOTOLINK X5000R\_V9.1.0cu.2089\_B20211224 and X5000R\_V9.1.0cu.2350\_B20230313 were discovered to contain a remote code execution (RCE) vulnerab (no CVSS)
- [CVE-2023-39618](https://cve.now/CVE-2023-39618.md): TOTOLINK X5000R B20210419 was discovered to contain a remote code execution (RCE) vulnerability via the setTracerouteCfg interface. (no CVSS)
- [CVE-2023-39660](https://cve.now/CVE-2023-39660.md): An issue in Gaberiele Venturi pandasai v.0.8.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the pr (no CVSS, pandasai)
- [CVE-2023-39745](https://cve.now/CVE-2023-39745.md): TP-Link TL-WR940N V2, TP-Link TL-WR941ND V5 and TP-Link TL-WR841N V8 were discovered to contain a buffer overflow via the component /userRpm (no CVSS)
- [CVE-2023-39747](https://cve.now/CVE-2023-39747.md): TP-Link WR841N V8, TP-Link TL-WR940N V2, and TL-WR941ND V5 were discovered to contain a buffer overflow via the radiusSecret parameter at /u (no CVSS)
- [CVE-2023-39748](https://cve.now/CVE-2023-39748.md): An issue in the component /userRpm/NetworkCfgRpm of TP-Link TL-WR1041N V2 allows attackers to cause a Denial of Service (DoS) via a crafted (no CVSS)
- [CVE-2023-39749](https://cve.now/CVE-2023-39749.md): D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the component /adv\_resource. (no CVSS)
- [CVE-2023-39750](https://cve.now/CVE-2023-39750.md): D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the f\_ipv6\_enable parameter at /bsc\_ipv6. (no CVSS)
- [CVE-2023-39751](https://cve.now/CVE-2023-39751.md): TP-Link TL-WR941ND V6 were discovered to contain a buffer overflow via the pSize parameter at /userRpm/PingIframeRpm. (no CVSS)
- [CVE-2023-39784](https://cve.now/CVE-2023-39784.md): Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the save\_virtualser\_data function. (no CVSS)
- [CVE-2023-39785](https://cve.now/CVE-2023-39785.md): Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the list parameter in the set\_qosMib\_list function. (no CVSS)
- [CVE-2023-39786](https://cve.now/CVE-2023-39786.md): Tenda AC8V4 V16.03.34.06 was discovered to contain a stack overflow via the time parameter in the sscanf function. (no CVSS)
- [CVE-2023-39807](https://cve.now/CVE-2023-39807.md): N.V.K.INTER CO., LTD. (no CVSS)
- [CVE-2023-39808](https://cve.now/CVE-2023-39808.md): N.V.K.INTER CO., LTD. (no CVSS)
- [CVE-2023-39809](https://cve.now/CVE-2023-39809.md): N.V.K.INTER CO., LTD. (CVSS 9.8)
- [CVE-2023-40352](https://cve.now/CVE-2023-40352.md): McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLL (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.