CVEs published August 29, 2023
52 CVEs were published on August 29, 2023: 5 critical, 12 high. 3 are now in CISA KEV.
- Published
- 52
- Critical
- 5
- High
- 12
- Medium
- 11
- Low
- 2
- Unrated
- 22
- Now in CISA KEV
- 3
- Fix available
- 10
Most affected products
- Hewlett Packard Enterprise ArubaOS-Switch
- 3
- Tenable Nessus
- 3
- Aria Operations for Networks
- 2
- Arista Networks EOS
- 2
- Cloudflare WARP Client
- 2
- Motorola EBTS/MBTS Base Radio
- 2
- Motorola MBTS Site Controller
- 2
- Dell PowerScale OneFS
- 1
- goauthentik authentik
- 1
- Google Chrome
- 1
Critical 5
- CVE-2023-34039Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation.Aria Operations for Networks
- CVE-2023-23770Motorola MBTS Site Controller accepts hard-coded backdoor password.Motorola MBTS Site Controller
- CVE-2023-40890A stack-based buffer overflow vulnerability exists in the lookup_sequence function of ZBar 0.23.90.
- CVE-2023-41265An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023
- CVE-2023-41360An issue was discovered in FRRouting FRR through 9.0.
High 12
- CVE-2023-4296PTC Codebeamer Cross site scriptingPTC Codebeamer
- CVE-2023-4611Use after free race between mbind() and vma-locked page faultKernel · Red Hat Enterprise Linux +1
- CVE-2023-32241WordPress Essential Addons for Elementor Pro Plugin <= 5.4.8 is vulnerable to Cross Site Scripting (XSS)WPDeveloper Essential Addons for Elementor Pro
- CVE-2023-4346 KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked andKNX Association KNX Protocol Connection Authorization Option
- CVE-2023-39266Unauthenticated Stored Cross-Site Scripting in ArubaOS-SwitchHewlett Packard Enterprise ArubaOS-Switch
- CVE-2023-20890Aria Operations for Networks contains an arbitrary file write vulnerability.Aria Operations for Networks
- CVE-2023-23774Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception.Motorola EBTS/MBTS Base Radio
- CVE-2023-23773Motorola EBTS/MBTS Base Radio fails to check firmware authenticity.Motorola EBTS/MBTS Base Radio
- CVE-2023-23772Motorola MBTS Site Controller fails to check firmware update authenticity.Motorola MBTS Site Controller
- CVE-2023-23771Motorola MBTS Base Radio accepts hard-coded backdoor password.Motorola MBTS Base Radio
- CVE-2023-32457 Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability.Dell PowerScale OneFS
- CVE-2023-41266A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 a
Medium, low and unrated 35
- CVE-2023-4572Use after free in MediaStream in Google Chrome prior to 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2023-39268Memory Corruption Vulnerability in ArubaOS-SwitchHewlett Packard Enterprise ArubaOS-Switch
- CVE-2023-39267Authenticated Denial of Service Vulnerability in ArubaOS-Switch Command Line InterfaceHewlett Packard Enterprise ArubaOS-Switch
- CVE-2023-3253Improper authorization in NessusTenable Nessus
- CVE-2023-3252Arbitrary File WriteTenable Nessus
- CVE-2023-3251Pass-back vulnerability in NessusTenable Nessus
- CVE-2023-39522Username enumeration attack in goauthentikgoauthentik authentik
- CVE-2023-41037Cleartext Signed Message Signature Spoofing in openpgpjsopenpgpjs · openpgp
- CVE-2023-3646On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload.Arista Networks EOS
- CVE-2023-24548On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward packetsArista Networks EOS
- CVE-2021-32050Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an applicationMongoDB C Driver · MongoDB C++ Driver +6
- CVE-2023-0654Spoofing User's Activity Loads in WARP Mobile Client (Android)Cloudflare WARP Client
- CVE-2023-0238Injecting Activity Loads in WARP Mobile ClientCloudflare WARP Client
- CVE-2023-1995Insufficient Logging Vulnerability in HiRDBHitachi HiRDB Server · Hitachi HiRDB Structured Data Access…
- CVE-2020-18912An issue found in Earcms Ear App v.20181124 allows a remote attacker to execute arbitrary code via the uload/index-uplog.php.
- CVE-2021-3262TripSpark VEO Transportation-2.2.x-XP_BB-20201123-184084 NovusEDU-2.2.x-XP_BB-20201123-184084 allows unsafe data inputs in POST body paramet
- CVE-2023-38283In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may caus
- CVE-2023-38802FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a
- CVE-2023-38971Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload t
- CVE-2023-38975* Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial of service via the chucnked_vectors.rs component.
- CVE-2023-39558AudimexEE v15.0 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the Show Kai Data component.
- CVE-2023-39559AudimexEE 15.0 was discovered to contain a full path disclosure vulnerability.
- CVE-2023-39615Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c.
- CVE-2023-39616AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign_frame_buffer_p in av1/common/av1_c
- CVE-2023-39663Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the componmathjax
- CVE-2023-39678A cross-site scripting (XSS) vulnerability in the device web interface (Log Query page) of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows a
- CVE-2023-40787In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL org.springblade:blade-core-tool
- CVE-2023-40889A heap-based buffer overflow exists in the qr_reader_match_centers function of ZBar 0.23.90.zbar
- CVE-2023-41153A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary
- CVE-2023-41358An issue was discovered in FRRouting FRR through 9.0.
- CVE-2023-41359An issue was discovered in FRRouting FRR through 9.0.
- CVE-2023-41361An issue was discovered in FRRouting FRR 9.0.
- CVE-2023-41362MyBB before 1.8.36 allows Code Injection by users with certain high privileges.
- CVE-2023-41363In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users.
- CVE-2023-41376Nokia Service Router Operating System (SR OS) 22.10 and SR Linux, when error-handling update-fault-tolerance is not enabled, mishandle BGP p