# CVEs published 2023-08-24

62 CVEs were published on August 24, 2023: 5 critical, 17 high. Days are UTC.

- [CVE-2023-40030](https://cve.now/CVE-2023-40030.md): Malicious dependencies can inject arbitrary JavaScript into cargo-generated timing reports (CVSS 6.1, rust-lang cargo · cargo)
- [CVE-2023-4508](https://cve.now/CVE-2023-4508.md): Denial of Service in Gerbv (CVSS 5.5, gerbv)
- [CVE-2023-40022](https://cve.now/CVE-2023-40022.md): Rizin vulnerable to Integer Overflow in C++ demangler logic (CVSS 7.8, rizinorg rizin)
- [CVE-2023-40017](https://cve.now/CVE-2023-40017.md): Geonode Server Side Request Forgery vulnerability (CVSS 7.5, geonode)
- [CVE-2023-39519](https://cve.now/CVE-2023-39519.md): CloudExplorer Lite sensitive information leakage vulnerability (CVSS 7.5, CloudExplorer-Dev CloudExplorer-Lite)
- [CVE-2023-39521](https://cve.now/CVE-2023-39521.md): Tuleap vulnerable to Cross-site Scripting on the success message of a kanban deletion (CVSS 4.8, Enalean tuleap)
- [CVE-2023-38508](https://cve.now/CVE-2023-38508.md): Tuleap allows preview of a linked artifact with a type does not respect permissions (CVSS 6.5, Enalean tuleap)
- [CVE-2023-37469](https://cve.now/CVE-2023-37469.md): CasaOS Command Injection vulnerability (CVSS 8.8, IceWhaleTech CasaOS · github.com/IceWhaleTech/CasaOS)
- [CVE-2023-32079](https://cve.now/CVE-2023-32079.md): Netmaker Privilige Escalation Vulnerability (CVSS 8.8, gravitl netmaker · github.com/gravitl/netmaker)
- [CVE-2023-32078](https://cve.now/CVE-2023-32078.md): Netmaker IDOR Vulnerability Allows User to Update Other User's Password (CVSS 7.5, gravitl netmaker · github.com/gravitl/netmaker)
- [CVE-2023-32077](https://cve.now/CVE-2023-32077.md): Netmaker has Hardcoded DNS Secret Key (CVSS 7.5, gravitl netmaker · github.com/gravitl/netmaker)
- [CVE-2023-31412](https://cve.now/CVE-2023-31412.md): The LMS5xx uses weak hash generation methods, resulting in the creation of insecure hashs. (CVSS 7.5, SICK AG LMS5xx)
- [CVE-2023-4420](https://cve.now/CVE-2023-4420.md): A remote unprivileged attacker can intercept the communication via e.g. (CVSS 9.8, SICK AG LMS5xx)
- [CVE-2023-4419](https://cve.now/CVE-2023-4419.md): The LMS5xx uses hard-coded credentials, which potentially allow low-skilled unauthorized remote attackers to reconfigure settings and /or di (CVSS 9.8, SICK AG LMS5xx)
- [CVE-2023-4418](https://cve.now/CVE-2023-4418.md): A remote unprivileged attacker can sent multiple packages to the LMS5xx to disrupt its availability through a TCP SYN-based denial-of-servic (CVSS 7.5, SICK AG LMS5xx)
- [CVE-2023-34973](https://cve.now/CVE-2023-34973.md): QTS, QuTS hero (CVSS 3.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-34972](https://cve.now/CVE-2023-34972.md): QTS, QuTS hero and QuTScloud (CVSS 3.5, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-34971](https://cve.now/CVE-2023-34971.md): QTS, QuTS hero (CVSS 7.1, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-40710](https://cve.now/CVE-2023-40710.md): An adversary could cause a continuous restart loop to the entire device by sending a large quantity of HTTP GET requests if the controller h (CVSS 6.8, OPTO 22 SNAP PAC S1)
- [CVE-2023-40709](https://cve.now/CVE-2023-40709.md): Uncontrolled Resource Consumption in OPTO 22 SNAP PAC S1 Built-In Web Server (CVSS 6.8, OPTO 22 SNAP PAC S1)
- [CVE-2023-40708](https://cve.now/CVE-2023-40708.md): Improper Access Control in OPTO 22 SNAP PAC S1 (CVSS 5.8, OPTO 22 SNAP PAC S1)
- [CVE-2023-40707](https://cve.now/CVE-2023-40707.md): Weak password requirements in OPTO 22 SNAP PAC S1 Built-in Web Server (CVSS 8.6, OPTO 22 SNAP PAC S1)
- [CVE-2023-40706](https://cve.now/CVE-2023-40706.md): Improper Restriction of Excessive Authentication Attempts in OPTO 22 SNAP PAC S1 Built-in Web Server (CVSS 8.6, OPTO 22 SNAP PAC S1)
- [CVE-2022-46884](https://cve.now/CVE-2022-46884.md): A potential use-after-free vulnerability existed in SVG Images if the Refresh Driver was destroyed at an inopportune time. (no CVSS, Mozilla Firefox)
- [CVE-2023-40371](https://cve.now/CVE-2023-40371.md): IBM AIX information disclosure (CVSS 6.2, IBM AIX)
- [CVE-2023-34040](https://cve.now/CVE-2023-34040.md): Java Deserialization vulnerability in Spring-Kafka When Improperly Configured (CVSS 5.3, Spring For Apache Kafka · org.springframework.kafka:spring-…)
- [CVE-2023-32516](https://cve.now/CVE-2023-32516.md): WordPress Restaurant Menu – Food Ordering System – Table Reservation Plugin \<= 2.3.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, GloriaFood Restaurant Menu – Food Ordering System – Table R…)
- [CVE-2023-32511](https://cve.now/CVE-2023-32511.md): WordPress Booking Ultra Pro Plugin \<= 1.1.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Booking Ultra Pro Appointments Booking Calendar Plugin)
- [CVE-2023-32510](https://cve.now/CVE-2023-32510.md): WordPress Order Your Posts Manually Plugin \<= 2.2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Rolf van Gelder Order Your Posts Manually)
- [CVE-2023-3705](https://cve.now/CVE-2023-3705.md): Information Disclosure Vulnerability in CP-Plus Network Video Recorder (CVSS 7.5, Aditya Infotech Limited CP-VNR-3104, CP-VNR-3108, CP-VNR-32…)
- [CVE-2023-4230](https://cve.now/CVE-2023-4230.md): ioLogik 4000 Series: Server Banner Information Disclosure (CVSS 5.3, Moxa ioLogik 4000 Series)
- [CVE-2023-3704](https://cve.now/CVE-2023-3704.md): Timestamp Modification Vulnerability in CP-Plus Digital Video Recorder (CVSS 5.3, Aditya Infotech Limited CP-UVR-1601E1-HC, CP-UVR-1601E2-H,…)
- [CVE-2023-4229](https://cve.now/CVE-2023-4229.md): ioLogik 4000 Series: Session Headers Not Implemented (CVSS 4.3, Moxa ioLogik 4000 Series)
- [CVE-2023-4513](https://cve.now/CVE-2023-4513.md): Missing Release of Memory after Effective Lifetime in Wireshark (CVSS 5.3, Wireshark Foundation Wireshark)
- [CVE-2023-4512](https://cve.now/CVE-2023-4512.md): Uncontrolled Recursion in Wireshark (CVSS 5.3, Wireshark Foundation Wireshark)
- [CVE-2023-4511](https://cve.now/CVE-2023-4511.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 5.3, Wireshark Foundation Wireshark)
- [CVE-2023-4228](https://cve.now/CVE-2023-4228.md): ioLogik 4000 Series: Session Cookies Attribute Not Set Properly (CVSS 3.1, Moxa ioLogik 4000 Series)
- [CVE-2023-4227](https://cve.now/CVE-2023-4227.md): ioLogik 4000 Series: Existence of an Unauthorized Service (CVSS 5.3, Moxa ioLogik 4000 Series)
- [CVE-2023-40573](https://cve.now/CVE-2023-40573.md): XWiki Platform's Groovy jobs check the wrong author, allowing remote code execution (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-sched… +1)
- [CVE-2023-32559](https://cve.now/CVE-2023-32559.md): A privilege escalation vulnerability exists in the experimental policy mechanism in all active release lines: 16.x, 18.x and, 20.x. (CVSS 7.5, NodeJS Node)
- [CVE-2023-40572](https://cve.now/CVE-2023-40572.md): XWiki Platform vulnerable to CSRF privilege escalation/RCE via the create action (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-39699](https://cve.now/CVE-2023-39699.md): IceWarp Mail Server v10.4.5 was discovered to contain a local file inclusion (LFI) vulnerability via the component /calendar/minimizer/index (no CVSS)
- [CVE-2023-39700](https://cve.now/CVE-2023-39700.md): IceWarp Mail Server v10.4.5 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the color parameter. (no CVSS)
- [CVE-2023-39801](https://cve.now/CVE-2023-39801.md): A lack of exception handling in the Renault Easy Link Multimedia System Software Version 283C35519R allows attackers to cause a Denial of Se (no CVSS)
- [CVE-2023-39834](https://cve.now/CVE-2023-39834.md): PbootCMS below v3.2.0 was discovered to contain a command injection vulnerability via create\_function. (no CVSS)
- [CVE-2023-40874](https://cve.now/CVE-2023-40874.md): DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote\_add.php via (no CVSS)
- [CVE-2023-40875](https://cve.now/CVE-2023-40875.md): DedeCMS up to and including 5.7.110 was discovered to contain multiple cross-site scripting (XSS) vulnerabilities at /dede/vote\_edit.php via (no CVSS)
- [CVE-2023-40876](https://cve.now/CVE-2023-40876.md): DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist\_add.php via the t (no CVSS)
- [CVE-2023-40877](https://cve.now/CVE-2023-40877.md): DedeCMS up to and including 5.7.110 was discovered to contain a cross-site scripting (XSS) vulnerability at /dede/freelist\_edit.php via the (no CVSS)
- [CVE-2023-40891](https://cve.now/CVE-2023-40891.md): Tenda AC8 v4 US\_AC8V4.0si\_V16.03.34.06\_cn was discovered to contain a stack overflow via parameter firewallEn at /goform/SetFirewallCfg. (no CVSS)
- [CVE-2023-40892](https://cve.now/CVE-2023-40892.md): Tenda AC8 v4 US\_AC8V4.0si\_V16.03.34.06\_cn was discovered to contain a stack overflow via parameter schedStartTime and schedEndTime at /gofor (no CVSS)
- [CVE-2023-40893](https://cve.now/CVE-2023-40893.md): Tenda AC8 v4 US\_AC8V4.0si\_V16.03.34.06\_cn was discovered to contain a stack overflow via parameter time at /goform/PowerSaveSet. (no CVSS)
- [CVE-2023-40894](https://cve.now/CVE-2023-40894.md): Tenda AC8 v4 US\_AC8V4.0si\_V16.03.34.06\_cn was discovered to contain a stack overflow via parameter list at /goform/SetStaticRouteCfg. (no CVSS)
- [CVE-2023-40895](https://cve.now/CVE-2023-40895.md): Tenda AC8 v4 US\_AC8V4.0si\_V16.03.34.06\_cn was discovered to contain a stack overflow via parameter list at /goform/SetVirtualServerCfg. (no CVSS)
- [CVE-2023-40896](https://cve.now/CVE-2023-40896.md): Tenda AC8 v4 US\_AC8V4.0si\_V16.03.34.06\_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBind. (no CVSS)
- [CVE-2023-40897](https://cve.now/CVE-2023-40897.md): Tenda AC8 v4 US\_AC8V4.0si\_V16.03.34.06\_cn was discovered to contain a stack overflow via parameter mac at /goform/GetParentControlInfo. (no CVSS)
- [CVE-2023-40898](https://cve.now/CVE-2023-40898.md): Tenda AC8 v4 US\_AC8V4.0si\_V16.03.34.06\_cn was discovered to contain a stack overflow via parameter timeZone at /goform/SetSysTimeCfg. (no CVSS)
- [CVE-2023-40899](https://cve.now/CVE-2023-40899.md): Tenda AC8 v4 US\_AC8V4.0si\_V16.03.34.06\_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList at (no CVSS)
- [CVE-2023-40900](https://cve.now/CVE-2023-40900.md): Tenda AC8 v4 US\_AC8V4.0si\_V16.03.34.06\_cn was discovered to contain a stack overflow via parameter list at /goform/SetNetControlList. (no CVSS)
- [CVE-2023-40901](https://cve.now/CVE-2023-40901.md): Tenda AC10 v4 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList (no CVSS)
- [CVE-2023-40902](https://cve.now/CVE-2023-40902.md): Tenda AC10 v4 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via parameter list and bindnum at /goform/SetIpMacBin (no CVSS)
- [CVE-2023-40904](https://cve.now/CVE-2023-40904.md): Tenda AC10 v4 US\_AC10V4.0si\_V16.03.10.13\_cn was discovered to contain a stack overflow via parameter macFilterType and parameter deviceList (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.