CVEs published August 28, 2023
77 CVEs were published on August 28, 2023: 6 critical, 7 high.
- Published
- 77
- Critical
- 6
- High
- 7
- Medium
- 10
- Low
- 3
- Unrated
- 51
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- IBM Guardium Cloud Key Manager
- 3
- IBM InfoSphere Information Server
- 3
- org.pf4j:pf4j
- 3
- Saho ADM100 · Saho ADM-100FP
- 3
- SPOTCAM CO. SpotCam FHD
- 3
- jupyter-server jupyter_server · jupyter-server
- 2
- omeka/omeka-s
- 2
- Apache Software Foundation Apache Airflow Spark Provider ·…
- 1
- Apache Software Foundation Apache Airflow Sqoop Provider ·…
- 1
- Dassault Systèmes SIMULIA 3DOrchestrate
- 1
Critical 6
- CVE-2023-38029Saho ADM100&ADM-100FP - Arbitrary File UploadSaho ADM100 · Saho ADM-100FP
- CVE-2023-38028Saho ADM100&ADM-100FP - Broken Access ControlSaho ADM100 · Saho ADM-100FP
- CVE-2023-38027SpotCam Co., Ltd. SpotCam Sense - Command InjectionSPOTCAM CO. SpotCam Sense
- CVE-2023-38026SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -2SPOTCAM CO. SpotCam FHD
- CVE-2023-38025SpotCam Co., Ltd. SpotCamFHD - Command Injection -1SPOTCAM CO. SpotCam FHD
- CVE-2023-38024SpotCam Co., Ltd. SpotCamFHD - Use of Hard-coded Cryptographic Key -1SPOTCAM CO. SpotCam FHD
High 7
- CVE-2023-40590Untrusted search path on Windows systems leading to arbitrary code executiongitpython-developers GitPython · gitpython
- CVE-2023-1997OS Command Injection vulnerability affecting SIMULIA 3DOrchestrate from Release 3DEXPERIENCE R2021x through Release 3DEXPERIENCE R2023xDassault Systèmes SIMULIA 3DOrchestrate
- CVE-2023-40195Apache Airflow Spark Provider Deserialization Vulnerability RCEApache Software Foundation Apache Airflow Spark Provider ·…
- CVE-2023-27604Apache Airflow Sqoop Provider: Airflow Sqoop Provider RCE VulnerabilityApache Software Foundation Apache Airflow Sqoop Provider ·…
- CVE-2023-38030Saho ADM100&ADM-100FP - Execute CodeSaho ADM100 · Saho ADM-100FP
- CVE-2023-22877IBM InfoSphere Information Server CSV injectionIBM InfoSphere Information Server
- CVE-2023-4561Cross-site Scripting (XSS) - Stored in omeka/omeka-someka/omeka-s
Medium, low and unrated 64
- CVE-2023-4569Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.cKernel · Red Hat Enterprise Linux +1
- CVE-2023-39968Open Redirect Vulnerability in jupyter-serverjupyter-server jupyter_server · jupyter-server
- CVE-2023-40170cross-site inclusion (XSSI) of files in jupyter-serverjupyter-server jupyter_server · jupyter-server
- CVE-2023-39348Improper log output when using GitHub Status Notifications in spinnakerspinnaker · github.com/spinnaker/spinnaker
- CVE-2018-25089glb Meetup Tag Extension Link Attribute reverse tabnabbingglb Meetup Tag Extension
- CVE-2017-20186nikooo777 ckSurf Spectator List Name misc.sp SpecListMenuDead denial of servicenikooo777 ckSurf
- CVE-2016-15035Doc2k RE-Chat re_chat.js cross site scriptingDoc2k RE-Chat
- CVE-2023-24959IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2023-23473IBM InfoSphere Information Server cross-site request forgeryIBM InfoSphere Information Server
- CVE-2023-26270IBM Security Guardium Data Encryption code executionIBM Guardium Cloud Key Manager
- CVE-2023-26271IBM Security Guardium Data Encryption information disclosureIBM Guardium Cloud Key Manager
- CVE-2023-26272IBM Security Guardium Data Encryption information disclosureIBM Guardium Cloud Key Manager
- CVE-2023-4560Improper Authorization of Index Containing Sensitive Information in omeka/omeka-someka/omeka-s
- CVE-2020-24165An issue was discovered in TCG Accelerator in QEMU 4.2.0, allows local attackers to execute arbitrary code, escalate privileges, and cause a
- CVE-2020-27366Cross Site Scripting (XSS) vulnerability in wlscanresults.html in Humax HGB10R-02 BRGCAB version 1.0.03, allows local attackers to execute a
- CVE-2022-46783An issue was discovered in Stormshield SSL VPN Client before 3.2.0.
- CVE-2023-26095ASQ in Stormshield Network Security (SNS) 4.3.15 before 4.3.16 and 4.6.x before 4.6.3 allows a crash when analysing a crafted SIP packet.
- CVE-2023-34724An issue was discovered in TECHView LA5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via the UART
- CVE-2023-34725An issue was discovered in TechView LA-5570 Wireless Gateway 1.0.19_T53, allows physical attackers to gain escalated privileges via a telnet
- CVE-2023-34758Sliver from v1.5.x to v1.5.39 has an improper cryptographic implementation, which allows attackers to execute a man-in-the-middle attack viagithub.com/bishopfox/sliver
- CVE-2023-35785Zoho ManageEngine Active Directory 360 versions 4315 and below, ADAudit Plus 7202 and below, ADManager Plus 7200 and below, Asset Explorer 6
- CVE-2023-36481An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor 9810, 9610, 9820, 980, 850, 1080, 2100, 2200, 1280, 1380,
- CVE-2023-38969Cross Site Scripting vulnerabiltiy in Badaso v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload to the title p
- CVE-2023-39059An issue in ansible semaphore v.2.8.90 allows a remote attacker to execute arbitrary code via a crafted payload to the extra variables paramgithub.com/ansible-semaphore/semaphore
- CVE-2023-39062Cross Site Scripting vulnerability in Spipu HTML2PDF before v.5.2.8 allows a remote attacker to execute arbitrary code via a crafted script spipu/html2pdf
- CVE-2023-39560ECTouch v2 was discovered to contain a SQL injection vulnerability via the $arr['id'] parameter at \default\helpers\insert.php.
- CVE-2023-39562GPAC v2.3-DEV-rev449-g5948e4f70-master was discovered to contain a heap-use-after-free via the gf_bs_align function at bitstream.c.
- CVE-2023-39578A stored cross-site scripting (XSS) vulnerability in the Create function of Zenario CMS v9.4 allows attackers to execute arbitrary web scrip
- CVE-2023-39650Theme Volty CMS Blog up to version v4.0.1 was discovered to contain a SQL injection vulnerability via the id parameter at /tvcmsblog/single.
- CVE-2023-39652theme volty tvcmsvideotab up to v4.0.0 was discovered to contain a SQL injection vulnerability via the component TvcmsVideoTabConfirmDeleteM
- CVE-2023-39708A stored cross-site scripting (XSS) vulnerability in Free and Open Source Inventory Management System v1.0 allows attackers to execute arbit
- CVE-2023-39709Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arb
- CVE-2023-39810An issue in the CPIO command of Busybox v1.33.2 allows attackers to execute a directory traversal.
- CVE-2023-40748PHPJabbers Food Delivery Script 3.0 has a SQL injection (SQLi) vulnerability in the "q" parameter of index.php.
- CVE-2023-40749PHPJabbers Food Delivery Script v3.0 is vulnerable to SQL Injection in the "column" parameter of index.php.
- CVE-2023-40750There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Yacht Listing Script v1.0.
- CVE-2023-40751PHPJabbers Fundraising Script v1.0 is vulnerable to Cross Site Scripting (XSS) via the "action" parameter of index.php.
- CVE-2023-40752There is a Cross Site Scripting (XSS) vulnerability in the "action" parameter of index.php in PHPJabbers Make an Offer Widget v1.0.
- CVE-2023-40753There is a Cross Site Scripting (XSS) vulnerability in the message parameter of index.php in PHPJabbers Ticket Support Script v3.2.
- CVE-2023-40754In PHPJabbers Car Rental Script 3.0, lack of verification when changing an email address and/or password (on the Profile Page) allows remote
- CVE-2023-40755There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0.
- CVE-2023-40756User enumeration is found in PHPJabbers Callback Widget v1.0.
- CVE-2023-40757User enumeration is found in PHPJabbers Food Delivery Script v3.1.
- CVE-2023-40758User enumeration is found in PHPJabbers Document Creator v1.0.
- CVE-2023-40759User enumeration is found in PHP Jabbers Restaurant Booking Script v3.0.
- CVE-2023-40760User enumeration is found in PHP Jabbers Hotel Booking System v4.0.
- CVE-2023-40761User enumeration is found in PHPJabbers Yacht Listing Script v2.0.
- CVE-2023-40762User enumeration is found in PHPJabbers Fundraising Script v1.0.
- CVE-2023-40763User enumeration is found in PHPJabbers Taxi Booking Script v2.0.
- CVE-2023-40764User enumeration is found in PHP Jabbers Car Rental Script v3.0.
- CVE-2023-40765User enumeration is found in PHPJabbers Event Booking Calendar v4.0.
- CVE-2023-40766User enumeration is found in in PHPJabbers Ticket Support Script v3.2.
- CVE-2023-40767User enumeration is found in in PHPJabbers Make an Offer Widget v1.0.
- CVE-2023-40781Buffer Overflow vulnerability in Libming Libming v.0.4.8 allows a remote attacker to cause a denial of service via a crafted .swf file to th
- CVE-2023-40825An issue in Perfree PerfreeBlog v.3.1.2 allows a remote attacker to execute arbitrary code via crafted plugin listed in admin/plugin/access/
- CVE-2023-40826An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the zipplugorg.pf4j:pf4j
- CVE-2023-40827An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the loadpluorg.pf4j:pf4j
- CVE-2023-40828An issue in pf4j pf4j v.3.9.0 and before allows a remote attacker to obtain sensitive information and execute arbitrary code via the expandIorg.pf4j:pf4j
- CVE-2023-40846Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function sub_90998.
- CVE-2023-40857Buffer Overflow vulnerability in VirusTotal yara v.4.3.2 allows a remote attacker to execute arbtirary code via the yr_execute_cod function
- CVE-2023-40997Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via
- CVE-2023-40998Buffer Overflow vulnerability in O-RAN Software Community ric-plt-lib-rmr v.4.9.0 allows a remote attacker to cause a denial of service via
- CVE-2023-41005An issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in Upagekit/pagekit
- CVE-2023-41109SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection.