# CVEs published 2023-08-29

52 CVEs were published on August 29, 2023: 5 critical, 12 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2023-4296](https://cve.now/CVE-2023-4296.md): PTC Codebeamer Cross site scripting (CVSS 8.8, PTC Codebeamer)
- [CVE-2023-4611](https://cve.now/CVE-2023-4611.md): Use after free race between mbind() and vma-locked page fault (CVSS 7.0, Kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-32241](https://cve.now/CVE-2023-32241.md): WordPress Essential Addons for Elementor Pro Plugin \<= 5.4.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WPDeveloper Essential Addons for Elementor Pro)
- [CVE-2023-4572](https://cve.now/CVE-2023-4572.md): Use after free in MediaStream in Google Chrome prior to 116.0.5845.140 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2023-39268](https://cve.now/CVE-2023-39268.md): Memory Corruption Vulnerability in ArubaOS-Switch (CVSS 4.5, Hewlett Packard Enterprise ArubaOS-Switch)
- [CVE-2023-4346](https://cve.now/CVE-2023-4346.md): KNX devices that use KNX Connection Authorization and support Option 1 are, depending on the implementation, vulnerable to being locked and (CVSS 7.5, KEV, KNX Association KNX Protocol Connection Authorization Option)
- [CVE-2023-39267](https://cve.now/CVE-2023-39267.md): Authenticated Denial of Service Vulnerability in ArubaOS-Switch Command Line Interface (CVSS 6.6, Hewlett Packard Enterprise ArubaOS-Switch)
- [CVE-2023-39266](https://cve.now/CVE-2023-39266.md): Unauthenticated Stored Cross-Site Scripting in ArubaOS-Switch (CVSS 8.3, Hewlett Packard Enterprise ArubaOS-Switch)
- [CVE-2023-3253](https://cve.now/CVE-2023-3253.md): Improper authorization in Nessus (CVSS 4.3, Tenable Nessus)
- [CVE-2023-3252](https://cve.now/CVE-2023-3252.md): Arbitrary File Write (CVSS 6.8, Tenable Nessus)
- [CVE-2023-3251](https://cve.now/CVE-2023-3251.md): Pass-back vulnerability in Nessus (CVSS 4.1, Tenable Nessus)
- [CVE-2023-20890](https://cve.now/CVE-2023-20890.md): Aria Operations for Networks contains an arbitrary file write vulnerability. (CVSS 7.2, Aria Operations for Networks)
- [CVE-2023-34039](https://cve.now/CVE-2023-34039.md): Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. (CVSS 9.8, Aria Operations for Networks)
- [CVE-2023-39522](https://cve.now/CVE-2023-39522.md): Username enumeration attack in goauthentik (CVSS 5.3, goauthentik authentik)
- [CVE-2023-41037](https://cve.now/CVE-2023-41037.md): Cleartext Signed Message Signature Spoofing in openpgpjs (CVSS 4.3, openpgpjs · openpgp)
- [CVE-2023-3646](https://cve.now/CVE-2023-3646.md): On affected platforms running Arista EOS with mirroring to multiple destinations configured, an internal system error may trigger a kernel panic and cause system reload. (CVSS 5.9, Arista Networks EOS)
- [CVE-2023-24548](https://cve.now/CVE-2023-24548.md): On affected platforms running Arista EOS with VXLAN configured, malformed or truncated packets received over a VXLAN tunnel and forwarded in hardware can cause egress ports to be unable to forward packets (CVSS 5.3, Arista Networks EOS)
- [CVE-2021-32050](https://cve.now/CVE-2021-32050.md): Some MongoDB Drivers may publish events containing authentication-related data to a command listener configured by an application (CVSS 4.2, MongoDB C Driver · MongoDB C++ Driver +6)
- [CVE-2023-0654](https://cve.now/CVE-2023-0654.md): Spoofing User's Activity Loads in WARP Mobile Client (Android) (CVSS 3.9, Cloudflare WARP Client)
- [CVE-2023-0238](https://cve.now/CVE-2023-0238.md): Injecting Activity Loads in WARP Mobile Client (CVSS 3.9, Cloudflare WARP Client)
- [CVE-2023-23774](https://cve.now/CVE-2023-23774.md): Motorola EBTS/MBTS Site Controller drops to debug prompt on unhandled exception. (CVSS 8.4, Motorola EBTS/MBTS Base Radio)
- [CVE-2023-23773](https://cve.now/CVE-2023-23773.md): Motorola EBTS/MBTS Base Radio fails to check firmware authenticity. (CVSS 7.2, Motorola EBTS/MBTS Base Radio)
- [CVE-2023-23772](https://cve.now/CVE-2023-23772.md): Motorola MBTS Site Controller fails to check firmware update authenticity. (CVSS 7.2, Motorola MBTS Site Controller)
- [CVE-2023-23771](https://cve.now/CVE-2023-23771.md): Motorola MBTS Base Radio accepts hard-coded backdoor password. (CVSS 8.4, Motorola MBTS Base Radio)
- [CVE-2023-23770](https://cve.now/CVE-2023-23770.md): Motorola MBTS Site Controller accepts hard-coded backdoor password. (CVSS 9.4, Motorola MBTS Site Controller)
- [CVE-2023-32457](https://cve.now/CVE-2023-32457.md): Dell PowerScale OneFS, versions 8.2.2.x-9.5.0.x, contains an improper privilege management vulnerability. (CVSS 7.5, Dell PowerScale OneFS)
- [CVE-2023-1995](https://cve.now/CVE-2023-1995.md): Insufficient Logging Vulnerability in HiRDB (CVSS 5.3, Hitachi HiRDB Server · Hitachi HiRDB Structured Data Access…)
- [CVE-2020-18912](https://cve.now/CVE-2020-18912.md): An issue found in Earcms Ear App v.20181124 allows a remote attacker to execute arbitrary code via the uload/index-uplog.php. (no CVSS)
- [CVE-2021-3262](https://cve.now/CVE-2021-3262.md): TripSpark VEO Transportation-2.2.x-XP\_BB-20201123-184084 NovusEDU-2.2.x-XP\_BB-20201123-184084 allows unsafe data inputs in POST body paramet (no CVSS)
- [CVE-2023-38283](https://cve.now/CVE-2023-38283.md): In OpenBGPD before 8.1, incorrect handling of BGP update data (length of path attributes) set by a potentially distant remote actor may caus (no CVSS)
- [CVE-2023-38802](https://cve.now/CVE-2023-38802.md): FRRouting FRR 7.5.1 through 9.0 and Pica8 PICOS 4.3.3.2 allow a remote attacker to cause a denial of service via a crafted BGP update with a (no CVSS)
- [CVE-2023-38971](https://cve.now/CVE-2023-38971.md): Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload t (no CVSS)
- [CVE-2023-38975](https://cve.now/CVE-2023-38975.md): \* Buffer Overflow vulnerability in qdrant v.1.3.2 allows a remote attacker cause a denial of service via the chucnked\_vectors.rs component. (no CVSS)
- [CVE-2023-39558](https://cve.now/CVE-2023-39558.md): AudimexEE v15.0 was discovered to contain multiple reflected cross-site scripting (XSS) vulnerabilities via the Show Kai Data component. (no CVSS)
- [CVE-2023-39559](https://cve.now/CVE-2023-39559.md): AudimexEE 15.0 was discovered to contain a full path disclosure vulnerability. (no CVSS)
- [CVE-2023-39615](https://cve.now/CVE-2023-39615.md): Xmlsoft Libxml2 v2.11.0 was discovered to contain an out-of-bounds read via the xmlSAX2StartElement() function at /libxml2/SAX2.c. (no CVSS)
- [CVE-2023-39616](https://cve.now/CVE-2023-39616.md): AOMedia v3.0.0 to v3.5.0 was discovered to contain an invalid read memory access via the component assign\_frame\_buffer\_p in av1/common/av1\_c (no CVSS)
- [CVE-2023-39663](https://cve.now/CVE-2023-39663.md): Mathjax up to v2.7.9 was discovered to contain two Regular expression Denial of Service (ReDoS) vulnerabilities in MathJax.js via the compon (no CVSS, mathjax)
- [CVE-2023-39678](https://cve.now/CVE-2023-39678.md): A cross-site scripting (XSS) vulnerability in the device web interface (Log Query page) of BDCOM OLT P3310D-2AC 10.1.0F Build 69083 allows a (no CVSS)
- [CVE-2023-40787](https://cve.now/CVE-2023-40787.md): In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL (no CVSS, org.springblade:blade-core-tool)
- [CVE-2023-40889](https://cve.now/CVE-2023-40889.md): A heap-based buffer overflow exists in the qr\_reader\_match\_centers function of ZBar 0.23.90. (no CVSS, zbar)
- [CVE-2023-40890](https://cve.now/CVE-2023-40890.md): A stack-based buffer overflow vulnerability exists in the lookup\_sequence function of ZBar 0.23.90. (CVSS 9.8)
- [CVE-2023-41153](https://cve.now/CVE-2023-41153.md): A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2023-41265](https://cve.now/CVE-2023-41265.md): An HTTP Request Tunneling vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 (CVSS 9.6, KEV)
- [CVE-2023-41266](https://cve.now/CVE-2023-41266.md): A path traversal vulnerability found in Qlik Sense Enterprise for Windows for versions May 2023 Patch 3 and earlier, February 2023 Patch 7 a (CVSS 8.2, KEV)
- [CVE-2023-41358](https://cve.now/CVE-2023-41358.md): An issue was discovered in FRRouting FRR through 9.0. (no CVSS)
- [CVE-2023-41359](https://cve.now/CVE-2023-41359.md): An issue was discovered in FRRouting FRR through 9.0. (no CVSS)
- [CVE-2023-41360](https://cve.now/CVE-2023-41360.md): An issue was discovered in FRRouting FRR through 9.0. (CVSS 9.1)
- [CVE-2023-41361](https://cve.now/CVE-2023-41361.md): An issue was discovered in FRRouting FRR 9.0. (no CVSS)
- [CVE-2023-41362](https://cve.now/CVE-2023-41362.md): MyBB before 1.8.36 allows Code Injection by users with certain high privileges. (no CVSS)
- [CVE-2023-41363](https://cve.now/CVE-2023-41363.md): In Cerebrate 1.14, a vulnerability in UserSettingsController allows authenticated users to change user settings of other users. (no CVSS)
- [CVE-2023-41376](https://cve.now/CVE-2023-41376.md): Nokia Service Router Operating System (SR OS) 22.10 and SR Linux, when error-handling update-fault-tolerance is not enabled, mishandle BGP p (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.