# CVEs published 2023-08-23

54 CVEs were published on August 23, 2023: 5 critical, 19 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-41028](https://cve.now/CVE-2023-41028.md): Juplink RX4-1500 Stack-based Buffer Overflow Vulnerability (CVSS 9.0, Juplink RX4-1500)
- [CVE-2023-38422](https://cve.now/CVE-2023-38422.md): Walchem Intuition Missing Authentication for Critical Function (CVSS 7.5, Walchem Intuition)
- [CVE-2023-32202](https://cve.now/CVE-2023-32202.md): Walchem Intuition Improper Authentication (CVSS 6.5, Walchem Intuition)
- [CVE-2023-3453](https://cve.now/CVE-2023-3453.md): ETIC Telecom Insecure Default Initialization of Resource (CVSS 7.1, ETIC Telecom Remote Access Server)
- [CVE-2023-40185](https://cve.now/CVE-2023-40185.md): Shescape on Windows escaping may be bypassed in threaded context (CVSS 6.5, ericcornelissen shescape · shescape)
- [CVE-2023-40178](https://cve.now/CVE-2023-40178.md): @node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError (CVSS 5.3, node-saml · @node-saml/node-saml)
- [CVE-2023-40177](https://cve.now/CVE-2023-40177.md): XWiki Platform privilege escalation (PR) from account through AWM content fields (CVSS 9.9, xwiki-platform · org.xwiki.platform:xwiki-platform-appwithi…)
- [CVE-2023-40035](https://cve.now/CVE-2023-40035.md): Craft CMS vulnerable to Remote Code Execution via validatePath bypass (CVSS 7.2, craftcms cms · craftcms/cms)
- [CVE-2022-3746](https://cve.now/CVE-2022-3746.md): A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat (CVSS 6.7, Lenovo Notebook)
- [CVE-2022-3745](https://cve.now/CVE-2022-3745.md): A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat (CVSS 4.4, Lenovo Notebook)
- [CVE-2022-3744](https://cve.now/CVE-2022-3744.md): A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat (CVSS 6.7, Lenovo Notebook)
- [CVE-2022-3743](https://cve.now/CVE-2022-3743.md): A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat (CVSS 4.4, Lenovo Notebook)
- [CVE-2022-3742](https://cve.now/CVE-2022-3742.md): A potential vulnerability was discovered in LCFC BIOS for some Lenovo consumer notebook models that could allow a local attacker with elevat (CVSS 6.7, Lenovo Notebook)
- [CVE-2023-40176](https://cve.now/CVE-2023-40176.md): SXSS in the user profile via the timezone displayer (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2023-40025](https://cve.now/CVE-2023-40025.md): Argo CD web terminal session doesn't expire (CVSS 4.7, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2023-40612](https://cve.now/CVE-2023-40612.md): Authenticated XXE Injection Via The File Editor (CVSS 5.3, The OpenNMS Group Horizon · The OpenNMS Group Meridian)
- [CVE-2023-20230](https://cve.now/CVE-2023-20230.md): A vulnerability in the restricted security domain implementation of Cisco Application Policy Infrastructure Controller (APIC) could allow an (CVSS 5.4, Cisco Application Policy Infrastructure Controller)
- [CVE-2023-20234](https://cve.now/CVE-2023-20234.md): A vulnerability in the CLI of Cisco FXOS Software could allow an authenticated, local attacker to create a file or overwrite any file on the (CVSS 4.4, Cisco Adaptive Security Appliance (ASA) Software · Cisco… +1)
- [CVE-2023-20115](https://cve.now/CVE-2023-20115.md): A vulnerability in the SFTP server implementation for Cisco Nexus 3000 Series Switches and 9000 Series Switches in standalone NX-OS mode cou (CVSS 5.4, Cisco NX-OS Software)
- [CVE-2023-20200](https://cve.now/CVE-2023-20200.md): A vulnerability in the Simple Network Management Protocol (SNMP) service of Cisco FXOS Software for Firepower 4100 Series and Firepower 9300 (CVSS 7.7, Cisco Unified Computing System · Cisco Firepower Extensible…)
- [CVE-2023-20169](https://cve.now/CVE-2023-20169.md): A vulnerability in the Intermediate System-to-Intermediate System (IS-IS) protocol of Cisco NX-OS Software for the Cisco Nexus 3000 Series S (CVSS 7.4, Cisco NX-OS Software)
- [CVE-2023-20168](https://cve.now/CVE-2023-20168.md): A vulnerability in TACACS+ and RADIUS remote authentication for Cisco NX-OS Software could allow an unauthenticated, local attacker to cause (CVSS 7.1, Cisco NX-OS Software)
- [CVE-2023-39441](https://cve.now/CVE-2023-39441.md): Apache Airflow SMTP Provider, Apache Airflow IMAP Provider, Apache Airflow: SMTP/IMAP client components allowed MITM due to missing Certificate Validation (no CVSS, Apache Software Foundation Apache Airflow SMTP Provider… +4)
- [CVE-2023-37379](https://cve.now/CVE-2023-37379.md): Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" feature (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-40273](https://cve.now/CVE-2023-40273.md): Session fixation in Apache Airflow web interface (CVSS 8.0, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-1409](https://cve.now/CVE-2023-1409.md): Certificate validation issue in MongoDB Server running on Windows or macOS (CVSS 5.3, MongoDB Server)
- [CVE-2023-32509](https://cve.now/CVE-2023-32509.md): WordPress Order Your Posts Manually Plugin \<= 2.2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Rolf van Gelder Order Your Posts Manually)
- [CVE-2023-32505](https://cve.now/CVE-2023-32505.md): WordPress Easy Hide Login Plugin \<= 1.0.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Arshid Easy Hide Login)
- [CVE-2023-32300](https://cve.now/CVE-2023-32300.md): WordPress Yoast SEO: Local Plugin \<= 14.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Yoast SEO: Local)
- [CVE-2023-28994](https://cve.now/CVE-2023-28994.md): WordPress Flatsome Theme \<= 3.16.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, UX-themes Flatsome)
- [CVE-2023-32499](https://cve.now/CVE-2023-32499.md): WordPress Radio Station Plugin \<= 2.4.0.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Tony Zeoli, Tony Hayes Radio Station by netmix® – Manage an…)
- [CVE-2023-32498](https://cve.now/CVE-2023-32498.md): WordPress Easy Form by AYS Plugin \<= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Easy Form team Easy Form by AYS)
- [CVE-2023-32497](https://cve.now/CVE-2023-32497.md): WordPress Block Referer Spam Plugin \<= 1.1.9.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.1, Supersoju Block Referer Spam)
- [CVE-2023-32496](https://cve.now/CVE-2023-32496.md): WordPress StopBadBots Plugin \<= 7.31 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Bill Minozzi Block Bad Bots and Stop Bad Bots Crawlers and…)
- [CVE-2023-32236](https://cve.now/CVE-2023-32236.md): WordPress Booking Ultra Pro Plugin \<= 1.1.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Booking Ultra Pro Appointments Booking Calendar Plugin)
- [CVE-2023-32119](https://cve.now/CVE-2023-32119.md): WordPress WPO365 | Mail Integration for Office 365 / Outlook Plugin \<= 1.9.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, WPO365 | Mail Integration for Office 365 / Outlook)
- [CVE-2023-4042](https://cve.now/CVE-2023-4042.md): Ghostscript: incomplete fix for cve-2020-16305 (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2023-3899](https://cve.now/CVE-2023-3899.md): Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2023-4041](https://cve.now/CVE-2023-4041.md): Second Stage Gecko Bootloader GBL Parser Buffer Overrun Vulnerability (CVSS 9.8, Silicon Labs Gecko Bootloader)
- [CVE-2023-40282](https://cve.now/CVE-2023-40282.md): Improper authentication vulnerability in Rakuten WiFi Pocket all versions allows a network-adjacent attacker to log in to the product's Mana (CVSS 5.4, Rakuten Mobile Rakuten WiFi Pocket)
- [CVE-2023-40144](https://cve.now/CVE-2023-40144.md): OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the devi (no CVSS, CBC Co. NR4H, NR8H, NR16H series · CBC Co. DR-16F, DR-8F… +3)
- [CVE-2023-40158](https://cve.now/CVE-2023-40158.md): Hidden functionality vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the devi (CVSS 8.8, CBC Co. NR4H, NR8H, NR16H series · CBC Co. DR-16F, DR-8F… +3)
- [CVE-2023-38585](https://cve.now/CVE-2023-38585.md): Improper authentication vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the d (no CVSS, CBC Co. NR4H, NR8H, NR16H series · CBC Co. DR-16F, DR-8F… +3)
- [CVE-2023-4404](https://cve.now/CVE-2023-4404.md): Donation Forms by Charitable \<= 1.7.0.12 - Unauthenticated Privilege Escalation (CVSS 9.8, smub Charitable – Donation Plugin for WordPress – Fundraisi…)
- [CVE-2023-39986](https://cve.now/CVE-2023-39986.md): Out-of-bounds Read Vulnerability in Hitachi EH-VIEW (Designer) (CVSS 7.8, Hitachi EH-VIEW)
- [CVE-2023-39985](https://cve.now/CVE-2023-39985.md): Out-of-bounds Write Vulnerability in Hitachi EH-VIEW (Designer) (CVSS 7.8, Hitachi EH-VIEW)
- [CVE-2023-39984](https://cve.now/CVE-2023-39984.md): Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability in Hitachi EH-VIEW (KeypadDesigner) (CVSS 7.8, Hitachi EH-VIEW)
- [CVE-2023-3495](https://cve.now/CVE-2023-3495.md): Out-of-bounds Write Vulnerability in Hitachi EH-VIEW (KeypadDesigner) (CVSS 7.8, Hitachi EH-VIEW)
- [CVE-2023-36317](https://cve.now/CVE-2023-36317.md): Cross Site Scripting (XSS) vulnerability in sourcecodester Student Study Center Desk Management System 1.0 allows attackers to run arbitrary (no CVSS)
- [CVE-2023-38831](https://cve.now/CVE-2023-38831.md): RARLAB WinRAR before 6.23 allows attackers to execute arbitrary code when a user attempts to view a benign file within a ZIP archive. (CVSS 7.8, KEV)
- [CVE-2023-41098](https://cve.now/CVE-2023-41098.md): An issue was discovered in MISP 2.4.174. (no CVSS)
- [CVE-2023-41100](https://cve.now/CVE-2023-41100.md): An issue was discovered in the hcaptcha (aka hCaptcha for EXT:form) extension before 2.1.2 for TYPO3. (CVSS 5.3, waldhacker/hcaptcha)
- [CVE-2023-41104](https://cve.now/CVE-2023-41104.md): libvmod-digest before 1.0.3, as used in Varnish Enterprise 6.0.x before 6.0.11r5, has an out-of-bounds memory access during base64 decoding, (no CVSS)
- [CVE-2023-41105](https://cve.now/CVE-2023-41105.md): An issue was discovered in Python 3.11 through 3.11.4. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.