CVEs published August 24, 2023
62 CVEs were published on August 24, 2023: 5 critical, 17 high.
- Published
- 62
- Critical
- 5
- High
- 17
- Medium
- 16
- Low
- 3
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- OPTO 22 SNAP PAC S1
- 5
- Moxa ioLogik 4000 Series
- 4
- SICK AG LMS5xx
- 4
- gravitl netmaker · github.com/gravitl/netmaker
- 3
- QNAP Systems QTS · QNAP Systems QuTS hero
- 3
- Wireshark Foundation Wireshark
- 3
- Enalean tuleap
- 2
- Aditya Infotech Limited CP-UVR-1601E1-HC, CP-UVR-1601E2-H,…
- 1
- Aditya Infotech Limited CP-VNR-3104, CP-VNR-3108, CP-VNR-32…
- 1
- Booking Ultra Pro Appointments Booking Calendar Plugin
- 1
Critical 5
- CVE-2023-4420A remote unprivileged attacker can intercept the communication via e.g.SICK AG LMS5xx
- CVE-2023-4419The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or diSICK AG LMS5xx
- CVE-2023-40573XWiki Platform's Groovy jobs check the wrong author, allowing remote code executionxwiki-platform · org.xwiki.platform:xwiki-platform-sched… +1
- CVE-2023-40572XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create actionxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-40904Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList
High 17
- CVE-2023-40022Rizin vulnerable to Integer Overflow in C++ demangler logicrizinorg rizin
- CVE-2023-40017Geonode Server Side Request Forgery vulnerabilitygeonode
- CVE-2023-39519CloudExplorer Lite sensitive information leakage vulnerabilityCloudExplorer-Dev CloudExplorer-Lite
- CVE-2023-37469CasaOS Command Injection vulnerabilityIceWhaleTech CasaOS · github.com/IceWhaleTech/CasaOS
- CVE-2023-32079Netmaker Privilige Escalation Vulnerabilitygravitl netmaker · github.com/gravitl/netmaker
- CVE-2023-32078Netmaker IDOR Vulnerability Allows User to Update Other User's Passwordgravitl netmaker · github.com/gravitl/netmaker
- CVE-2023-32077Netmaker has Hardcoded DNS Secret Keygravitl netmaker · github.com/gravitl/netmaker
- CVE-2023-31412The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs.SICK AG LMS5xx
- CVE-2023-4418A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-servicSICK AG LMS5xx
- CVE-2023-34971QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-40707Weak password requirements in OPTO 22 SNAP PAC S1 Built-in Web ServerOPTO 22 SNAP PAC S1
- CVE-2023-40706Improper Restriction of Excessive Authentication Attempts in OPTO 22 SNAP PAC S1 Built-in Web ServerOPTO 22 SNAP PAC S1
- CVE-2023-32516WordPress Restaurant Menu – Food Ordering System – Table Reservation Plugin <= 2.3.6 is vulnerable to Cross Site Scripting (XSS)GloriaFood Restaurant Menu – Food Ordering System – Table R…
- CVE-2023-32511WordPress Booking Ultra Pro Plugin <= 1.1.8 is vulnerable to Cross Site Scripting (XSS)Booking Ultra Pro Appointments Booking Calendar Plugin
- CVE-2023-32510WordPress Order Your Posts Manually Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)Rolf van Gelder Order Your Posts Manually
- CVE-2023-3705Information Disclosure Vulnerability in CP-Plus Network Video RecorderAditya Infotech Limited CP-VNR-3104, CP-VNR-3108, CP-VNR-32…
- CVE-2023-32559A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x.NodeJS Node
Medium, low and unrated 40
- CVE-2023-40030Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reportsrust-lang cargo · cargo
- CVE-2023-4508Denial of Service in Gerbvgerbv
- CVE-2023-39521Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletionEnalean tuleap
- CVE-2023-38508Tuleap allows preview of a linked artifact with a type does not respect permissionsEnalean tuleap
- CVE-2023-34973QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-34972QTS, QuTS hero and QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-40710An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller hOPTO 22 SNAP PAC S1
- CVE-2023-40709Uncontrolled Resource Consumption in OPTO 22 SNAP PAC S1 Built-In Web ServerOPTO 22 SNAP PAC S1
- CVE-2023-40708Improper Access Control in OPTO 22 SNAP PAC S1OPTO 22 SNAP PAC S1
- CVE-2022-46884A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune time.Mozilla Firefox
- CVE-2023-40371IBM AIX information disclosureIBM AIX
- CVE-2023-34040Java Deserialization vulnerability in Spring-Kafka When Improperly ConfiguredSpring For Apache Kafka · org.springframework.kafka:spring-…
- CVE-2023-4230ioLogik 4000 Series: Server Banner Information DisclosureMoxa ioLogik 4000 Series
- CVE-2023-3704Timestamp Modification Vulnerability in CP-Plus Digital Video RecorderAditya Infotech Limited CP-UVR-1601E1-HC, CP-UVR-1601E2-H,…
- CVE-2023-4229ioLogik 4000 Series: Session Headers Not ImplementedMoxa ioLogik 4000 Series
- CVE-2023-4513Missing Release of Memory after Effective Lifetime in WiresharkWireshark Foundation Wireshark
- CVE-2023-4512Uncontrolled Recursion in WiresharkWireshark Foundation Wireshark
- CVE-2023-4511Loop with Unreachable Exit Condition ('Infinite Loop') in WiresharkWireshark Foundation Wireshark
- CVE-2023-4228ioLogik 4000 Series: Session Cookies Attribute Not Set ProperlyMoxa ioLogik 4000 Series
- CVE-2023-4227ioLogik 4000 Series: Existence of an Unauthorized ServiceMoxa ioLogik 4000 Series
- CVE-2023-39699IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index
- CVE-2023-39700IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter.
- CVE-2023-39801A lack of exception handling in the Renault Easy Link Multimedia System Software Version 283C35519R allows attackers to cause a Denial of Se
- CVE-2023-39834PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create_function.
- CVE-2023-40874DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_add.php via
- CVE-2023-40875DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote_edit.php via
- CVE-2023-40876DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_add.php via the t
- CVE-2023-40877DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist_edit.php via the
- CVE-2023-40891Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter firewallEn at /goform/SetFirewallCfg.
- CVE-2023-40892Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter schedStartTime and schedEndTime at /gofor
- CVE-2023-40893Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet.
- CVE-2023-40894Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetStaticRouteCfg.
- CVE-2023-40895Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetVirtualServerCfg.
- CVE-2023-40896Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind.
- CVE-2023-40897Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter mac at /goform/GetParentControlInfo.
- CVE-2023-40898Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter timeZone at /goform/SetSysTimeCfg.
- CVE-2023-40899Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at
- CVE-2023-40900Tenda AC8 v4 US_AC8V4.0si_V16.03.34.06_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList.
- CVE-2023-40901Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList
- CVE-2023-40902Tenda AC10 v4 US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBin