CVEs published August 23, 2023
54 CVEs were published on August 23, 2023: 5 critical, 19 high. 1 is now in CISA KEV.
- Published
- 54
- Critical
- 5
- High
- 19
- Medium
- 22
- Low
- 0
- Unrated
- 8
- Now in CISA KEV
- 1
- Fix available
- 14
Most affected products
- Lenovo Notebook
- 5
- Hitachi EH-VIEW
- 4
- CBC Co. NR4H, NR8H, NR16H series · CBC Co. DR-16F, DR-8F… +3
- 3
- Cisco NX-OS Software
- 3
- Apache Software Foundation Apache Airflow · apache-airflow
- 2
- Red Hat Enterprise Linux
- 2
- Walchem Intuition
- 2
- Apache Software Foundation Apache Airflow SMTP Provider… +4
- 1
- argoproj argo-cd · github.com/argoproj/argo-cd +1
- 1
- Arshid Easy Hide Login
- 1
Critical 5
- CVE-2023-41028Juplink RX4-1500 Stack-based Buffer Overflow VulnerabilityJuplink RX4-1500
- CVE-2023-40177XWiki Platform privilege escalation (PR) from account through AWM content fieldsxwiki-platform · org.xwiki.platform:xwiki-platform-appwithi…
- CVE-2023-40176SXSS in the user profile via the timezone displayerxwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2023-4041Second Stage Gecko Bootloader GBL Parser Buffer Overrun VulnerabilitySilicon Labs Gecko Bootloader
- CVE-2023-4404Donation Forms by Charitable <= 1.7.0.12 - Unauthenticated Privilege Escalationsmub Charitable – Donation Plugin for WordPress – Fundraisi…
High 19
- CVE-2023-38422Walchem Intuition Missing Authentication for Critical Function Walchem Intuition
- CVE-2023-3453ETIC Telecom Insecure Default Initialization of ResourceETIC Telecom Remote Access Server
- CVE-2023-40035Craft CMS vulnerable to Remote Code Execution via validatePath bypasscraftcms cms · craftcms/cms
- CVE-2023-20200A vulnerability in the Simple Network Management Protocol (SNMP) service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300Cisco Unified Computing System · Cisco Firepower Extensible…
- CVE-2023-20169A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series SCisco NX-OS Software
- CVE-2023-20168A vulnerability in TACACS+ and RADIUS remote authentication for Cisco NX-OS Software could allow an unauthenticated, local attacker to causeCisco NX-OS Software
- CVE-2023-40273Session fixation in Apache Airflow web interfaceApache Software Foundation Apache Airflow · apache-airflow
- CVE-2023-32509WordPress Order Your Posts Manually Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)Rolf van Gelder Order Your Posts Manually
- CVE-2023-32300WordPress Yoast SEO: Local Plugin <= 14.8 is vulnerable to Cross Site Scripting (XSS)Yoast SEO: Local
- CVE-2023-28994WordPress Flatsome Theme <= 3.16.8 is vulnerable to Cross Site Scripting (XSS)UX-themes Flatsome
- CVE-2023-32499WordPress Radio Station Plugin <= 2.4.0.9 is vulnerable to Cross Site Scripting (XSS)Tony Zeoli, Tony Hayes Radio Station by netmix® – Manage an…
- CVE-2023-32236WordPress Booking Ultra Pro Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)Booking Ultra Pro Appointments Booking Calendar Plugin
- CVE-2023-3899Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configurationRed Hat Enterprise Linux
- CVE-2023-40158Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the deviCBC Co. NR4H, NR8H, NR16H series · CBC Co. DR-16F, DR-8F… +3
- CVE-2023-39986Out-of-bounds Read Vulnerability in Hitachi EH-VIEW (Designer)Hitachi EH-VIEW
- CVE-2023-39985Out-of-bounds Write Vulnerability in Hitachi EH-VIEW (Designer)Hitachi EH-VIEW
- CVE-2023-39984Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability in Hitachi EH-VIEW (KeypadDesigner)Hitachi EH-VIEW
- CVE-2023-3495Out-of-bounds Write Vulnerability in Hitachi EH-VIEW (KeypadDesigner)Hitachi EH-VIEW
- CVE-2023-38831RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive.
Medium, low and unrated 30
- CVE-2023-32202Walchem Intuition Improper AuthenticationWalchem Intuition
- CVE-2023-40185Shescape on Windows escaping may be bypassed in threaded contextericcornelissen shescape · shescape
- CVE-2023-40178@node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityErrornode-saml · @node-saml/node-saml
- CVE-2022-3746A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevatLenovo Notebook
- CVE-2022-3745A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevatLenovo Notebook
- CVE-2022-3744A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevatLenovo Notebook
- CVE-2022-3743A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevatLenovo Notebook
- CVE-2022-3742A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevatLenovo Notebook
- CVE-2023-40025Argo CD web terminal session doesn't expireargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2023-40612Authenticated XXE Injection Via The File EditorThe OpenNMS Group Horizon · The OpenNMS Group Meridian
- CVE-2023-20230A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow anCisco Application Policy Infrastructure Controller
- CVE-2023-20234A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or overwrite any file on theCisco Adaptive Security Appliance (ASA) Software · Cisco… +1
- CVE-2023-20115A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in standalone NX-OS mode couCisco NX-OS Software
- CVE-2023-39441Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate ValidationApache Software Foundation Apache Airflow SMTP Provider… +4
- CVE-2023-37379Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" featureApache Software Foundation Apache Airflow · apache-airflow
- CVE-2023-1409Certificate validation issue in MongoDB Server running on Windows or macOSMongoDB Server
- CVE-2023-32505WordPress Easy Hide Login Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)Arshid Easy Hide Login
- CVE-2023-32498WordPress Easy Form by AYS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)Easy Form team Easy Form by AYS
- CVE-2023-32497WordPress Block Referer Spam Plugin <= 1.1.9.4 is vulnerable to Cross Site Scripting (XSS)Supersoju Block Referer Spam
- CVE-2023-32496WordPress StopBadBots Plugin <= 7.31 is vulnerable to Cross Site Scripting (XSS)Bill Minozzi Block Bad Bots and Stop Bad Bots Crawlers and…
- CVE-2023-32119WordPress WPO365 | Mail Integration for Office 365 / Outlook Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)WPO365 | Mail Integration for Office 365 / Outlook
- CVE-2023-4042Ghostscript: incomplete fix for cve-2020-16305Red Hat Enterprise Linux
- CVE-2023-40282Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in to the product's ManaRakuten Mobile Rakuten WiFi Pocket
- CVE-2023-40144OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the deviCBC Co. NR4H, NR8H, NR16H series · CBC Co. DR-16F, DR-8F… +3
- CVE-2023-38585Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the dCBC Co. NR4H, NR8H, NR16H series · CBC Co. DR-16F, DR-8F… +3
- CVE-2023-36317Cross Site Scripting (XSS) vulnerability in sourcecodester Student Study Center Desk Management System 1.0 allows attackers to run arbitrary
- CVE-2023-41098An issue was discovered in MISP 2.4.174.
- CVE-2023-41100An issue was discovered in the hcaptcha (aka hCaptcha for EXT:form) extension before 2.1.2 for TYPO3.waldhacker/hcaptcha
- CVE-2023-41104libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding,
- CVE-2023-41105An issue was discovered in Python 3.11 through 3.11.4.