CVEs published August 25, 2023
85 CVEs were published on August 25, 2023: 3 critical, 13 high.
- Published
- 85
- Critical
- 3
- High
- 13
- Medium
- 28
- Low
- 3
- Unrated
- 38
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- notepad-plus-plus
- 4
- e-Excellence U-Office Force
- 3
- Google Chrome
- 3
- JetBrains TeamCity
- 3
- com.esotericsoftware.yamlbeans:yamlbeans
- 2
- mesosoi silverwaregames-io-issue-tracker
- 2
- @webiny/react-rich-text-renderer
- 1
- A. R. Jones Featured Image Pro Post Grid
- 1
- Apache Software Foundation Apache Tomcat · org.apache.to… +2
- 1
- Cloud Primero B.V DBargain
- 1
Critical 3
- CVE-2023-40571weblogic-framework Deserialization of Untrusted Data vulnerabilitydream0x01 weblogic-framework
- CVE-2019-13690Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform OS-level privilegGoogle Chrome
- CVE-2023-32757e-Excellence U-Office Force - Arbitrary File Uploade-Excellence U-Office Force
High 13
- CVE-2023-40586go package github.com/corazawaf/coraza is vulnerable to denial of servicecorazawaf coraza · github.com/corazawaf/coraza/v2 +1
- CVE-2023-40585Unauthenticated access to Ironic APImetal3-io ironic-image
- CVE-2023-40583libp2p nodes vulnerable to OOM attackgo-libp2p · github.com/libp2p/go-libp2p
- CVE-2023-40580Freighter mnemonic phrase may be accessed by Javascript through a private APIstellar freighter
- CVE-2023-40031Notepad++ vulnerable to heap buffer write overflow in Utf8_16_Read::convertnotepad-plus-plus
- CVE-2019-13689Inappropriate implementation in OS in Google Chrome on ChromeOS prior to 75.0.3770.80 allowed a remote attacker to perform arbitrary read/wrGoogle Chrome
- CVE-2023-32797WordPress video carousel slider with lightbox Plugin <= 1.0.22 is vulnerable to Cross Site Scripting (XSS)I Thirteen Web Solution video carousel slider with lightbox
- CVE-2023-32603WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS)RedNao Donations Made Easy – Smart Donations
- CVE-2023-32598WordPress Featured Image Pro Post Grid Plugin <= 5.14 is vulnerable to Cross Site Scripting (XSS)A. R. Jones Featured Image Pro Post Grid
- CVE-2023-32518WordPress WP Chinese Conversion Plugin <= 1.1.16 is vulnerable to Cross Site Scripting (XSS)Ono Oogami WP Chinese Conversion
- CVE-2023-3406Path traversal issue in M-Files Classic WebM-Files Web
- CVE-2023-32756e-Excellence U-Office Force - Path Traversale-Excellence U-Office Force
- CVE-2023-40577Alertmanager UI is vulnerable to stored XSS via the /api/v1/alerts endpointprometheus alertmanager · github.com/prometheus/alertmanager
Medium, low and unrated 69
- CVE-2023-4543IBOS OA export&contactids=x sql injectionIBOS OA
- CVE-2023-4542D-Link DAR-8000-10 sys1.php os command injectionD-Link DAR-8000-10
- CVE-2023-40587Pyramid static view path traversal up one directoryPylons pyramid · pyramid
- CVE-2023-2906Wireshark CP2179 divide by zeroWireshark Foundation Wireshark
- CVE-2023-41080Apache Tomcat: Open redirect with FORM authenticationApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2023-40166Notepad++ heap buffer read overflow in FileManager::detectLanguageFromTextBegining notepad-plus-plus
- CVE-2023-40164Notepad++ global buffer read overflow in nsCodingStateMachine::NextStatenotepad-plus-plus
- CVE-2023-32678Zulip vulnerable to insufficient authorization check for edition/deletion of messages and topics in private streams by former subscriberszulip
- CVE-2023-40036Notepad++ global buffer read overflow in CharDistributionAnalysis::HandleOneCharnotepad-plus-plus
- CVE-2023-40579OpenFGA Authorization Bypassopenfga · github.com/openfga/openfga
- CVE-2023-25848BUG-000158039 - There is an information disclosure issue in ArcGIS Server.Esri ArcGIS Enterprise Server
- CVE-2023-38201Keylime: challenge-response protocol bypass during agent registrationRed Hat Enterprise Linux · keylime
- CVE-2022-4452Insufficient data validation in crosvm in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit object corruGoogle Chrome
- CVE-2023-4534NeoMind Fusion Platform Link cross site scriptingNeoMind Fusion Platform
- CVE-2023-41250In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during user registrationJetBrains TeamCity
- CVE-2023-41249In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build StepJetBrains TeamCity
- CVE-2023-41248In JetBrains TeamCity before 2023.05.3 stored XSS was possible during Cloud Profiles configurationJetBrains TeamCity
- CVE-2023-32575WordPress Product page shipping calculator for WooCommerce Plugin <= 1.3.25 is vulnerable to Cross Site Scripting (XSS)PI Websolution Product page shipping calculator for WooComm…
- CVE-2023-24394WordPress iframe popup Plugin <= 3.3 is vulnerable to Cross Site Scripting (XSS)Gopi Ramasamy iframe popup
- CVE-2023-32596WordPress weebotLite Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)Wolfgang Ertl weebotLite
- CVE-2023-32595WordPress Sunny Search Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)Palasthotel by Edward Bock, Katharina Rompf Sunny Search
- CVE-2023-25981WordPress BuddyForms Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)ThemeKraft Post Form
- CVE-2023-25649OS Command Injection Vulnerability in a Mobile Internet Product of ZTEZTE MF286R
- CVE-2023-4478Parameter tampering in the registration resulting in blocked accounts to be createdMattermost
- CVE-2023-32591WordPress DBargain Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS)Cloud Primero B.V DBargain
- CVE-2023-32584WordPress eBecas Plugin <= 3.1.3 is vulnerable to Cross Site Scripting (XSS)John Newcombe eBecas
- CVE-2023-32577WordPress DevBuddy Twitter Feed Plugin <= 4.0.0 is vulnerable to Cross Site Scripting (XSS)Eji Osigwe DevBuddy Twitter Feed
- CVE-2023-32576WordPress Locatoraid Store Locator Plugin <= 3.9.18 is vulnerable to Cross Site Scripting (XSS)Plainware Locatoraid Store Locator
- CVE-2023-3425CVE-2023-3425: Out-of-Bounds memory readM-Files Server
- CVE-2023-32755e-Excellence U-Office Force - Error Message Leakagee-Excellence U-Office Force
- CVE-2023-40530Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2SKYLARK HOLDINGS CO. 'Skylark' App for Android · SKYLARK HO…
- CVE-2023-4520FV Flowplayer Video Player <= 7.5.37.7212 - Insufficient Input Validation to Unauthenticated Stored Cross-Site Scripting and Arbitrary Usermeta Updatefoliovision FV Flowplayer Video Player
- CVE-2023-40599Regular expression Denial-of-Service (ReDoS) exists in multiple add-ons for Mailform Pro CGI 4.3.1.3 and earlier, which allows a remote unauSYNCK GRAPHICA Mailform Pro CGI
- CVE-2023-40179Silverware Games vulnerable to account enumeration via inconsistent responsesmesosoi silverwaregames-io-issue-tracker
- CVE-2023-40182silverware-io-issue-tracker server responds in a noticeably different amount of time depending if a given email address exists or notmesosoi silverwaregames-io-issue-tracker
- CVE-2023-40570Datasette 1.0 alpha series leaks names of databases and tables to unauthenticated userssimonw datasette · datasette
- CVE-2020-11711An issue was discovered in Stormshield SNS 3.8.0.
- CVE-2021-27932Stormshield Network Security (SNS) VPN SSL Client 2.1.0 through 2.8.0 has Insecure Permissions.
- CVE-2023-24620An issue was discovered in Esoteric YamlBeans through 1.15.com.esotericsoftware.yamlbeans:yamlbeans
- CVE-2023-24621An issue was discovered in Esoteric YamlBeans through 1.15.com.esotericsoftware.yamlbeans:yamlbeans
- CVE-2023-34723An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows attackers to gain sensitive information via /config/system.c
- CVE-2023-36198Buffer Overflow vulnerability in skalenetwork sgxwallet v.1.9.0 allows an attacker to cause a denial of service via the trustedBlsSignMessag
- CVE-2023-36199An issue in skalenetwork sgxwallet v.1.9.0 and below allows an attacker to cause a denial of service via the trustedGenerateEcdsaKey compone
- CVE-2023-37249Infoblox NIOS through 8.5.1 has a faulty component that accepts malicious input without sanitization, resulting in shell access.
- CVE-2023-38710An issue was discovered in Libreswan before 4.12.
- CVE-2023-38711An issue was discovered in Libreswan before 4.12.
- CVE-2023-38712An issue was discovered in Libreswan 3.x and 4.x before 4.12.
- CVE-2023-38973A stored cross-site scripting (XSS) vulnerability in the Add Tag function of Badaso v2.9.7 allows attackers to execute arbitrary web scripts
- CVE-2023-38974A stored cross-site scripting (XSS) vulnerability in the Edit Category function of Badaso v2.9.7 allows attackers to execute arbitrary web s
- CVE-2023-39287A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an authenticated attacker
- CVE-2023-39288A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker
- CVE-2023-39289A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attack
- CVE-2023-39290A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 (22.24.5800.0) could allow an authenticated attacke
- CVE-2023-39291A vulnerability in the Connect Mobility Router component of MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with
- CVE-2023-39600IceWarp 11.4.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the color parameter.
- CVE-2023-39707A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbit
- CVE-2023-39742giflib v5.2.1 was discovered to contain a segmentation fault via the component getarg.c.
- CVE-2023-40217An issue was discovered in Python before 3.8.18, 3.9.x before 3.9.18, 3.10.x before 3.10.13, and 3.11.x before 3.11.5.
- CVE-2023-40796Phicomm k2 v22.6.529.216 was discovered to contain a command injection vulnerability via the function luci.sys.call.
- CVE-2023-40797In Tenda AC23 v16.03.07.45_cn, the sub_4781A4 function does not validate the parameters entered by the user, resulting in a post-authenticat
- CVE-2023-40798In Tenda AC23 v16.03.07.45_cn, the formSetIPv6status and formGetWanParameter functions do not authenticate user input parameters, resulting
- CVE-2023-40799Tenda AC23 Vv16.03.07.45_cn is vulnerable to Buffer Overflow via sub_450A4C function.
- CVE-2023-40800The compare_parentcontrol_time function does not authenticate user input parameters, resulting in a post-authentication stack overflow vulne
- CVE-2023-40801The sub_451784 function does not validate the parameters entered by the user, resulting in a stack overflow vulnerability in Tenda AC23 v16.
- CVE-2023-40802The get_parentControl_list_Info function does not verify the parameters entered by the user, causing a post-authentication heap overflow vul
- CVE-2023-40915Tenda AX3 v16.03.12.11 has a stack buffer overflow vulnerability detected at function form_fast_setting_wifi_set.
- CVE-2023-41121Array AG OS before 9.4.0.499 allows denial of service: remote attackers can cause system service processes to crash through abnormal HTTP op
- CVE-2023-41167@webiny/react-rich-text-renderer before 5.37.2 allows XSS attacks by content managers.@webiny/react-rich-text-renderer
- CVE-2023-41173AdGuard DNS before 2.2 allows remote attackers to cause a denial of service via malformed UDP packets.