CVEs published August 30, 2023
115 CVEs were published on August 30, 2023: 2 critical, 28 high.
- Published
- 115
- Critical
- 2
- High
- 28
- Medium
- 45
- Low
- 3
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- Splunk Enterprise · Splunk Cloud
- 6
- Miled WordPress Social Login
- 2
- Simple Blog Card
- 2
- WooCommerce Pre-Orders
- 2
- Abhay Yadav Breadcrumb simple
- 1
- AffiliateWP
- 1
- Alan Tien Call Now Icon Animate
- 1
- Alexander Semikashev Yandex Metrica Counter
- 1
- All Users Messenger
- 1
- BBS e-Theme BBS e-Popup
- 1
Critical 2
High 28
- CVE-2023-3489firmwaredownload command could log servers passwords in clear textBrocade Fabric OS
- CVE-2023-41039Sandbox escape via various forms of "format" in RestrictedPythonzopefoundation RestrictedPython · restrictedpython
- CVE-2023-40597Absolute Path Traversal in Splunk Enterprise Using runshellscript.pySplunk Enterprise · Splunk Cloud
- CVE-2023-40596Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLLSplunk Enterprise
- CVE-2023-4571Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI)Splunk ITSI
- CVE-2023-40592Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpointSplunk Enterprise · Splunk Cloud
- CVE-2023-40595Remote Code Execution via Serialized Session PayloadSplunk Enterprise · Splunk Cloud
- CVE-2023-40598Command Injection in Splunk Enterprise Using External LookupsSplunk Enterprise · Splunk Cloud
- CVE-2023-25471WordPress WCP OpenWeather Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)Webcodin WCP OpenWeather
- CVE-2023-25453WordPress WordPress Tables Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)Ian Sadovy WordPress Tables
- CVE-2023-34008WordPress WP ERP Plugin <= 1.12.3 is vulnerable to Cross Site Scripting (XSS)weDevs WP ERP
- CVE-2023-34022WordPress Dynamic QR Code Generator Plugin <= 0.0.5 is vulnerable to Cross Site Scripting (XSS)Rakib Hasan Dynamic QR Code Generator
- CVE-2023-34023WordPress WordPress Social Login Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS)Miled WordPress Social Login
- CVE-2023-34032WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Scripting (XSS)Pascal Casier bbPress Toolkit
- CVE-2023-34174WordPress BBS e-Popup Plugin <= 2.4.5 is vulnerable to Cross Site Scripting (XSS)BBS e-Theme BBS e-Popup
- CVE-2023-34180WordPress Google Fonts For WordPress Plugin <= 3.0.0 is vulnerable to Cross Site Scripting (XSS)KAPlugins Google Fonts For WordPress
- CVE-2023-34175WordPress Login Configurator Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)GrandSlambert Login Configurator
- CVE-2023-34176WordPress Chilexpress woo oficial Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)Chilexpress woo oficial
- CVE-2023-34184WordPress Woocommerce Order address Print Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)Bhavik Patel Woocommerce Order address Print
- CVE-2023-33320WordPress WP-Hijri Plugin <= 1.5.1 is vulnerable to Cross Site Scripting (XSS)Mohammad I. Okfie WP-Hijri
- CVE-2023-33325WordPress Leyka Plugin <= 3.30.1 is vulnerable to Cross Site Scripting (XSS)Teplitsa of social technologies Leyka
- CVE-2023-33317WordPress WooCommerce Warranty Requests Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)WooCommerce Returns and Warranty Requests
- CVE-2023-25019WordPress Chaty Plugin <= 3.0.9 is vulnerable to Cross Site Scripting (XSS)Premio Chaty
- CVE-2023-32597WordPress Video Gallery Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)I Thirteen Web Solution Video Gallery
- CVE-2023-32802WordPress WooCommerce Pre-Orders Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)WooCommerce Pre-Orders
- CVE-2023-32801WordPress WooCommerce Composite Products Plugin <= 8.7.5 is vulnerable to Cross Site Scripting (XSS)WooCommerce Composite Products
- CVE-2023-32742WordPress WP SMS Plugin <= 6.1.4 is vulnerable to Cross Site Scripting (XSS)VeronaLabs WP SMS
- CVE-2023-3136MailArchiver <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting via Email Subjectpierrelannoy MailArchiver
Medium, low and unrated 85
- CVE-2023-23765Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingGitHub Enterprise Server
- CVE-2023-41040GitPython blind local file inclusiongitpython-developers GitPython · gitpython
- CVE-2023-41041User session is still usable after logout in graylog2-server graylog2-server · org.graylog2:graylog2-server
- CVE-2023-40184Improper handling of session establishment errors in xrdpneutrinolabs xrdp
- CVE-2023-36811Archive spoofing vulnerability in borgbackupborgbackup borg · borgbackup
- CVE-2023-4640Set Logging Level Without AuthenticationYugabyteDB Anywhere
- CVE-2023-40593Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML RequestSplunk Enterprise · Splunk Cloud
- CVE-2023-40594Denial of Service (DoS) via the ‘printf’ Search FunctionSplunk Enterprise · Splunk Cloud
- CVE-2023-20266A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager SessioCisco Emergency Responder · Cisco Unity Connection +1
- CVE-2023-27621WordPress Livestream Notice Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)MrDemonWolf Livestream Notice
- CVE-2023-24401WordPress Mobile Call Now & Map Buttons Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)Davidsword Mobile Call Now & Map Buttons
- CVE-2023-24397WordPress Reservation.Studio widget Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS)Reservation.Studio widget
- CVE-2023-28415WordPress Side Cart Woocommerce (Ajax) Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)XootiX Side Cart Woocommerce
- CVE-2023-28692WordPress WP Abstracts Plugin <= 2.6.3 is vulnerable to Cross Site Scripting (XSS)Kevon Adonis WP Abstracts
- CVE-2023-25466WordPress Who Hit The Page – Hit Counter Plugin <= 1.4.14.3 is vulnerable to Cross Site Scripting (XSS)Mahlamusa Who Hit The Page – Hit Counter
- CVE-2023-35092WordPress breadcrumb simple Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)Abhay Yadav Breadcrumb simple
- CVE-2023-35094WordPress WP Matterport Shortcode Plugin <= 2.1.4 is vulnerable to Cross Site Scripting (XSS)Julien Berthelot / MPEmbed WP Matterport Shortcode
- CVE-2023-34372WordPress Download SpamReferrerBlock Plugin <= 2.22 is vulnerable to Cross Site Scripting (XSS)Didier Sampaolo SpamReferrerBlock
- CVE-2023-32294WordPress GDPR Cookie Consent Notice Box Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)Radical Web Design GDPR Cookie Consent Notice Box
- CVE-2023-34004WordPress WooCommerce Box Office Plugin <= 1.1.50 is vulnerable to Cross Site Scripting (XSS)WooCommerce Box Office
- CVE-2023-4209POEditor < 0.9.8 - Settings Reset via CSRFPOEditor
- CVE-2023-4150User Activity Tracking and Log < 4.0.9 - License Update/Deactivation via CSRFUser Activity Tracking and Log
- CVE-2022-1601User Access Manager < 2.2.18 - IP SpoofingUser Access Manager
- CVE-2023-4023All Users Messenger <= 1.24 - Subscriber+ Message Deletion via IDORAll Users Messenger
- CVE-2023-1982Front Editor <= 4.0.4 - Admin+ Stored XSSGuest posting / Frontend Posting wordpress plugin
- CVE-2023-3992PostX - Gutenberg Post Grid Blocks < 3.0.6 - Reflected Cross-Site ScriptingPostX
- CVE-2023-4109Ninja Forms < 3.6.26 - Admin+ Stored HTML InjectionNinja Forms Contact Form
- CVE-2023-4013GDPR Cookie Compliance < 4.12.5 - License Update/Deactivation via CSRFGDPR Cookie Compliance
- CVE-2023-4035Simple Blog Card < 1.31 - Contributor+ Stored XSS via ShortcodeSimple Blog Card
- CVE-2023-4036Simple Blog Card < 1.32 - Subscriber+ Arbitrary Post AccessSimple Blog Card
- CVE-2023-3501FormCraft < 1.2.7 - Admin+ Stored XSSFormCraft
- CVE-2023-3720Upload Media By URL < 1.0.8 - Stored XSS via CSRF Upload Media By URL
- CVE-2023-3356Subscribers Text Counter < 1.7.1 - Settings Update via CSRF to Stored XSSSubscribers Text Counter
- CVE-2023-34172WordPress WordPress Social Login Plugin <= 3.0.4 is vulnerable to Cross Site Scripting (XSS)Miled WordPress Social Login
- CVE-2023-34173WordPress Yandex Metrica Counter Plugin <= 1.4.3 is vulnerable to Cross Site Scripting (XSS)Alexander Semikashev Yandex Metrica Counter
- CVE-2023-34183WordPress Unite Gallery Lite Plugin <= 1.7.61 is vulnerable to Cross Site Scripting (XSS)Valiano Unite Gallery Lite
- CVE-2023-34187WordPress Call Now Icon Animate Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS)Alan Tien Call Now Icon Animate
- CVE-2023-27426WordPress NotifyVisitors Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)NotifyVisitors
- CVE-2023-33929WordPress Easy Admin Menu Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)Joaquín Ruiz Easy Admin Menu
- CVE-2023-33210WordPress nuajik CDN Plugin <= 0.1.0 is vulnerable to Cross Site Scripting (XSS)nuajik
- CVE-2023-25462WordPress WP htaccess Control Plugin <= 3.5.1 is vulnerable to Cross Site Scripting (XSS)WP htaccess Control
- CVE-2023-33208WordPress Cookie Monster Plugin <= 1.51 is vulnerable to Cross Site Scripting (XSS)gsmith Cookie Monster
- CVE-2023-4624Server-Side Request Forgery (SSRF) in bookstackapp/bookstackbookstackapp/bookstack
- CVE-2023-32962WordPress WishSuite Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)HasTheme WishSuite – Wishlist for WooCommerce
- CVE-2023-32746WordPress WooCommerce Brands Plugin <= 1.6.45 is vulnerable to Cross Site Scripting (XSS)WooCommerce Brands
- CVE-2023-32793WordPress WooCommerce Pre-Orders Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)WooCommerce Pre-Orders
- CVE-2023-4600The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp_activate_adAffiliateWP
- CVE-2023-32740WordPress Custom 404 Pro Plugin <= 3.8.1 is vulnerable to Cross Site Scripting (XSS)Kunal Nagar Custom 404 Pro
- CVE-2023-4522Improper Validation of Specified Type of Input in GitLabGitLab
- CVE-2023-4599Email Encoder <= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeonlineoptimisation Email Encoder – Protect Email Addresses…
- CVE-2023-4597Slimstat Analytics <= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeveronalabs SlimStat Analytics
- CVE-2023-31714Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities.
- CVE-2023-38970Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload tuasoft-indonesia/badaso
- CVE-2023-39135An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry.
- CVE-2023-39136An unhandled edge case in the component _sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafte
- CVE-2023-39137An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing.
- CVE-2023-39138An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file.
- CVE-2023-39139An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file.
- CVE-2023-40837Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADD50' contains a command execution vulnerability.
- CVE-2023-40838Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_3A1D0' contains a command execution vulnerability.
- CVE-2023-40839Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADF3C' contains a command execution vulnerability.
- CVE-2023-40840Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "fromGetWirelessRepeat."
- CVE-2023-40841Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "add_white_node,"
- CVE-2023-40842Tengda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "R7WebsSecurityHandler."
- CVE-2023-40843Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function "sub_73004."
- CVE-2023-40844Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'formWifiBasicSet.'
- CVE-2023-40845Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via function 'sub_34FD0.' In the function, it reads user
- CVE-2023-40847Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via the function "initIpAddrInfo." In the function, it r
- CVE-2023-40848Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin is vulnerable to Buffer Overflow via the function "sub_7D858."
- CVE-2023-41163A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary we
- CVE-2023-41537phpjabbers Business Directory Script 3.2 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.
- CVE-2023-41538phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter.
- CVE-2023-41539phpjabbers Business Directory Script 3.2 is vulnerable to SQL Injection via the column parameter.
- CVE-2023-41552Tenda AC7 V1.0 V15.03.06.44 and Tenda AC9 V3.0 V15.03.06.42_multi were discovered to contain a stack overflow via parameter ssid at url /gof
- CVE-2023-41553Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter list at
- CVE-2023-41554Tenda AC9 V3.0 V15.03.06.42_multi was discovered to contain a stack overflow via parameter wpapsk_crypto at url /goform/WifiExtraSet.
- CVE-2023-41555Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter security_5g at url /goform/WifiBasicSet.
- CVE-2023-41556Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overfl
- CVE-2023-41557Tenda AC7 V1.0 V15.03.06.44 and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter entrys and mitInter
- CVE-2023-41558Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter timeZone at url /goform/SetSysTimeCfg.
- CVE-2023-41559Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 V1.0RTL_V15.03.06.28 were discovered to contain a stack overfl
- CVE-2023-41560Tenda AC9 V3.0 V15.03.06.42_multi was discovered to contain a stack overflow via parameter firewallEn at url /goform/SetFirewallCfg.
- CVE-2023-41561Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter startIp
- CVE-2023-41562Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42_multi, and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack
- CVE-2023-41563Tenda AC9 V3.0 V15.03.06.42_multi and Tenda AC5 US_AC5V1.0RTL_V15.03.06.28 were discovered to contain a stack overflow via parameter mac at