# CVEs published 2023-08-30

115 CVEs were published on August 30, 2023: 2 critical, 28 high. Days are UTC.

- [CVE-2023-3489](https://cve.now/CVE-2023-3489.md): firmwaredownload command could log servers passwords in clear text (CVSS 8.6, Brocade Fabric OS)
- [CVE-2023-23765](https://cve.now/CVE-2023-23765.md): Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling (CVSS 4.8, GitHub Enterprise Server)
- [CVE-2023-41040](https://cve.now/CVE-2023-41040.md): GitPython blind local file inclusion (CVSS 4.0, gitpython-developers GitPython · gitpython)
- [CVE-2023-41041](https://cve.now/CVE-2023-41041.md): User session is still usable after logout in graylog2-server (CVSS 2.6, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2023-40184](https://cve.now/CVE-2023-40184.md): Improper handling of session establishment errors in xrdp (CVSS 2.6, neutrinolabs xrdp)
- [CVE-2023-40582](https://cve.now/CVE-2023-40582.md): Command Injection Vulnerability in find-exec (CVSS 9.8, shime find-exec · find-exec)
- [CVE-2023-36811](https://cve.now/CVE-2023-36811.md): Archive spoofing vulnerability in borgbackup (CVSS 4.7, borgbackup borg · borgbackup)
- [CVE-2023-41039](https://cve.now/CVE-2023-41039.md): Sandbox escape via various forms of "format" in RestrictedPython (CVSS 8.3, zopefoundation RestrictedPython · restrictedpython)
- [CVE-2023-4640](https://cve.now/CVE-2023-4640.md): Set Logging Level Without Authentication (CVSS 6.5, YugabyteDB Anywhere)
- [CVE-2023-40597](https://cve.now/CVE-2023-40597.md): Absolute Path Traversal in Splunk Enterprise Using runshellscript.py (CVSS 7.8, Splunk Enterprise · Splunk Cloud)
- [CVE-2023-40596](https://cve.now/CVE-2023-40596.md): Splunk Enterprise on Windows Privilege Escalation due to Insecure OPENSSLDIR Build Definition Reference in DLL (CVSS 7.0, Splunk Enterprise)
- [CVE-2023-40593](https://cve.now/CVE-2023-40593.md): Denial of Service (DoS) in Splunk Enterprise Using a Malformed SAML Request (CVSS 6.3, Splunk Enterprise · Splunk Cloud)
- [CVE-2023-40594](https://cve.now/CVE-2023-40594.md): Denial of Service (DoS) via the ‘printf’ Search Function (CVSS 6.5, Splunk Enterprise · Splunk Cloud)
- [CVE-2023-4571](https://cve.now/CVE-2023-4571.md): Unauthenticated Log Injection in Splunk IT Service Intelligence (ITSI) (CVSS 8.6, Splunk ITSI)
- [CVE-2023-40592](https://cve.now/CVE-2023-40592.md): Reflected Cross-site Scripting (XSS) on "/app/search/table" web endpoint (CVSS 8.4, Splunk Enterprise · Splunk Cloud)
- [CVE-2023-40595](https://cve.now/CVE-2023-40595.md): Remote Code Execution via Serialized Session Payload (CVSS 8.8, Splunk Enterprise · Splunk Cloud)
- [CVE-2023-40598](https://cve.now/CVE-2023-40598.md): Command Injection in Splunk Enterprise Using External Lookups (CVSS 8.5, Splunk Enterprise · Splunk Cloud)
- [CVE-2023-20266](https://cve.now/CVE-2023-20266.md): A vulnerability in Cisco Emergency Responder, Cisco Unified Communications Manager (Unified CM), Cisco Unified Communications Manager Sessio (CVSS 6.5, Cisco Emergency Responder · Cisco Unity Connection +1)
- [CVE-2023-27621](https://cve.now/CVE-2023-27621.md): WordPress Livestream Notice Plugin \<= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, MrDemonWolf Livestream Notice)
- [CVE-2023-24401](https://cve.now/CVE-2023-24401.md): WordPress Mobile Call Now & Map Buttons Plugin \<= 1.5.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Davidsword Mobile Call Now & Map Buttons)
- [CVE-2023-24397](https://cve.now/CVE-2023-24397.md): WordPress Reservation.Studio widget Plugin \<= 1.0.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Reservation.Studio widget)
- [CVE-2023-25471](https://cve.now/CVE-2023-25471.md): WordPress WCP OpenWeather Plugin \<= 2.5.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Webcodin WCP OpenWeather)
- [CVE-2023-28415](https://cve.now/CVE-2023-28415.md): WordPress Side Cart Woocommerce (Ajax) Plugin \<= 2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, XootiX Side Cart Woocommerce)
- [CVE-2023-28692](https://cve.now/CVE-2023-28692.md): WordPress WP Abstracts Plugin \<= 2.6.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Kevon Adonis WP Abstracts)
- [CVE-2023-25466](https://cve.now/CVE-2023-25466.md): WordPress Who Hit The Page – Hit Counter Plugin \<= 1.4.14.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, Mahlamusa Who Hit The Page – Hit Counter)
- [CVE-2023-35092](https://cve.now/CVE-2023-35092.md): WordPress breadcrumb simple Plugin \<= 1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Abhay Yadav Breadcrumb simple)
- [CVE-2023-35094](https://cve.now/CVE-2023-35094.md): WordPress WP Matterport Shortcode Plugin \<= 2.1.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Julien Berthelot / MPEmbed WP Matterport Shortcode)
- [CVE-2023-25453](https://cve.now/CVE-2023-25453.md): WordPress WordPress Tables Plugin \<= 1.3.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Ian Sadovy WordPress Tables)
- [CVE-2023-34372](https://cve.now/CVE-2023-34372.md): WordPress Download SpamReferrerBlock Plugin \<= 2.22 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Didier Sampaolo SpamReferrerBlock)
- [CVE-2023-32294](https://cve.now/CVE-2023-32294.md): WordPress GDPR Cookie Consent Notice Box Plugin \<= 1.1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Radical Web Design GDPR Cookie Consent Notice Box)
- [CVE-2023-34004](https://cve.now/CVE-2023-34004.md): WordPress WooCommerce Box Office Plugin \<= 1.1.50 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WooCommerce Box Office)
- [CVE-2023-34008](https://cve.now/CVE-2023-34008.md): WordPress WP ERP Plugin \<= 1.12.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, weDevs WP ERP)
- [CVE-2023-34022](https://cve.now/CVE-2023-34022.md): WordPress Dynamic QR Code Generator Plugin \<= 0.0.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Rakib Hasan Dynamic QR Code Generator)
- [CVE-2023-34023](https://cve.now/CVE-2023-34023.md): WordPress WordPress Social Login Plugin \<= 3.0.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Miled WordPress Social Login)
- [CVE-2023-4209](https://cve.now/CVE-2023-4209.md): POEditor \< 0.9.8 - Settings Reset via CSRF (CVSS 4.3, POEditor)
- [CVE-2023-4150](https://cve.now/CVE-2023-4150.md): User Activity Tracking and Log \< 4.0.9 - License Update/Deactivation via CSRF (CVSS 4.3, User Activity Tracking and Log)
- [CVE-2022-1601](https://cve.now/CVE-2022-1601.md): User Access Manager \< 2.2.18 - IP Spoofing (no CVSS, User Access Manager)
- [CVE-2023-4023](https://cve.now/CVE-2023-4023.md): All Users Messenger \<= 1.24 - Subscriber+ Message Deletion via IDOR (CVSS 4.3, All Users Messenger)
- [CVE-2023-1982](https://cve.now/CVE-2023-1982.md): Front Editor \<= 4.0.4 - Admin+ Stored XSS (no CVSS, Guest posting / Frontend Posting wordpress plugin)
- [CVE-2023-3992](https://cve.now/CVE-2023-3992.md): PostX - Gutenberg Post Grid Blocks \< 3.0.6 - Reflected Cross-Site Scripting (CVSS 6.1, PostX)
- [CVE-2023-4109](https://cve.now/CVE-2023-4109.md): Ninja Forms \< 3.6.26 - Admin+ Stored HTML Injection (CVSS 4.8, Ninja Forms Contact Form)
- [CVE-2023-4013](https://cve.now/CVE-2023-4013.md): GDPR Cookie Compliance \< 4.12.5 - License Update/Deactivation via CSRF (CVSS 6.5, GDPR Cookie Compliance)
- [CVE-2023-4035](https://cve.now/CVE-2023-4035.md): Simple Blog Card \< 1.31 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Simple Blog Card)
- [CVE-2023-4036](https://cve.now/CVE-2023-4036.md): Simple Blog Card \< 1.32 - Subscriber+ Arbitrary Post Access (CVSS 4.3, Simple Blog Card)
- [CVE-2023-3501](https://cve.now/CVE-2023-3501.md): FormCraft \< 1.2.7 - Admin+ Stored XSS (CVSS 4.8, FormCraft)
- [CVE-2023-3720](https://cve.now/CVE-2023-3720.md): Upload Media By URL \< 1.0.8 - Stored XSS via CSRF (CVSS 6.5, Upload Media By URL)
- [CVE-2023-3356](https://cve.now/CVE-2023-3356.md): Subscribers Text Counter \< 1.7.1 - Settings Update via CSRF to Stored XSS (no CVSS, Subscribers Text Counter)
- [CVE-2023-34032](https://cve.now/CVE-2023-34032.md): WordPress bbPress Toolkit Plugin \<= 1.0.12 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Pascal Casier bbPress Toolkit)
- [CVE-2023-34172](https://cve.now/CVE-2023-34172.md): WordPress WordPress Social Login Plugin \<= 3.0.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Miled WordPress Social Login)
- [CVE-2023-34173](https://cve.now/CVE-2023-34173.md): WordPress Yandex Metrica Counter Plugin \<= 1.4.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Alexander Semikashev Yandex Metrica Counter)
- [CVE-2023-34174](https://cve.now/CVE-2023-34174.md): WordPress BBS e-Popup Plugin \<= 2.4.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, BBS e-Theme BBS e-Popup)
- [CVE-2023-34180](https://cve.now/CVE-2023-34180.md): WordPress Google Fonts For WordPress Plugin \<= 3.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, KAPlugins Google Fonts For WordPress)
- [CVE-2023-34175](https://cve.now/CVE-2023-34175.md): WordPress Login Configurator Plugin \<= 2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, GrandSlambert Login Configurator)
- [CVE-2023-34176](https://cve.now/CVE-2023-34176.md): WordPress Chilexpress woo oficial Plugin \<= 1.2.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Chilexpress woo oficial)
- [CVE-2023-34184](https://cve.now/CVE-2023-34184.md): WordPress Woocommerce Order address Print Plugin \<= 3.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Bhavik Patel Woocommerce Order address Print)
- [CVE-2023-34183](https://cve.now/CVE-2023-34183.md): WordPress Unite Gallery Lite Plugin \<= 1.7.61 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Valiano Unite Gallery Lite)
- [CVE-2023-34187](https://cve.now/CVE-2023-34187.md): WordPress Call Now Icon Animate Plugin \<= 0.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Alan Tien Call Now Icon Animate)
- [CVE-2023-27426](https://cve.now/CVE-2023-27426.md): WordPress NotifyVisitors Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, NotifyVisitors)
- [CVE-2023-33929](https://cve.now/CVE-2023-33929.md): WordPress Easy Admin Menu Plugin \<= 1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Joaquín Ruiz Easy Admin Menu)
- [CVE-2023-33320](https://cve.now/CVE-2023-33320.md): WordPress WP-Hijri Plugin \<= 1.5.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Mohammad I. Okfie WP-Hijri)
- [CVE-2023-33325](https://cve.now/CVE-2023-33325.md): WordPress Leyka Plugin \<= 3.30.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Teplitsa of social technologies Leyka)
- [CVE-2023-33317](https://cve.now/CVE-2023-33317.md): WordPress WooCommerce Warranty Requests Plugin \<= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WooCommerce Returns and Warranty Requests)
- [CVE-2023-33210](https://cve.now/CVE-2023-33210.md): WordPress nuajik CDN Plugin \<= 0.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, nuajik)
- [CVE-2023-25462](https://cve.now/CVE-2023-25462.md): WordPress WP htaccess Control Plugin \<= 3.5.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WP htaccess Control)
- [CVE-2023-33208](https://cve.now/CVE-2023-33208.md): WordPress Cookie Monster Plugin \<= 1.51 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, gsmith Cookie Monster)
- [CVE-2023-4624](https://cve.now/CVE-2023-4624.md): Server-Side Request Forgery (SSRF) in bookstackapp/bookstack (CVSS 2.4, bookstackapp/bookstack)
- [CVE-2023-32962](https://cve.now/CVE-2023-32962.md): WordPress WishSuite Plugin \<= 1.3.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, HasTheme WishSuite – Wishlist for WooCommerce)
- [CVE-2023-25019](https://cve.now/CVE-2023-25019.md): WordPress Chaty Plugin \<= 3.0.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Premio Chaty)
- [CVE-2023-32597](https://cve.now/CVE-2023-32597.md): WordPress Video Gallery Plugin \<= 1.0.10 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, I Thirteen Web Solution Video Gallery)
- [CVE-2023-32746](https://cve.now/CVE-2023-32746.md): WordPress WooCommerce Brands Plugin \<= 1.6.45 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WooCommerce Brands)
- [CVE-2023-32793](https://cve.now/CVE-2023-32793.md): WordPress WooCommerce Pre-Orders Plugin \<= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WooCommerce Pre-Orders)
- [CVE-2023-32802](https://cve.now/CVE-2023-32802.md): WordPress WooCommerce Pre-Orders Plugin \<= 1.9.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WooCommerce Pre-Orders)
- [CVE-2023-4600](https://cve.now/CVE-2023-4600.md): The AffiliateWP for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'affwp\_activate\_ad (CVSS 4.3, AffiliateWP)
- [CVE-2023-32801](https://cve.now/CVE-2023-32801.md): WordPress WooCommerce Composite Products Plugin \<= 8.7.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WooCommerce Composite Products)
- [CVE-2023-32742](https://cve.now/CVE-2023-32742.md): WordPress WP SMS Plugin \<= 6.1.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, VeronaLabs WP SMS)
- [CVE-2023-32740](https://cve.now/CVE-2023-32740.md): WordPress Custom 404 Pro Plugin \<= 3.8.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, Kunal Nagar Custom 404 Pro)
- [CVE-2023-3136](https://cve.now/CVE-2023-3136.md): MailArchiver \<= 2.10.1 - Unauthenticated Stored Cross-Site Scripting via Email Subject (CVSS 7.2, pierrelannoy MailArchiver)
- [CVE-2023-4522](https://cve.now/CVE-2023-4522.md): Improper Validation of Specified Type of Input in GitLab (CVSS 4.3, GitLab)
- [CVE-2023-4599](https://cve.now/CVE-2023-4599.md): Email Encoder \<= 2.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, onlineoptimisation Email Encoder – Protect Email Addresses…)
- [CVE-2023-4596](https://cve.now/CVE-2023-4596.md): Forminator \<= 1.24.6 - Unauthenticated Arbitrary File Upload (CVSS 9.8, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2023-4597](https://cve.now/CVE-2023-4597.md): Slimstat Analytics \<= 5.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, veronalabs SlimStat Analytics)
- [CVE-2023-31714](https://cve.now/CVE-2023-31714.md): Chitor-CMS before v1.1.2 was discovered to contain multiple SQL injection vulnerabilities. (no CVSS)
- [CVE-2023-38970](https://cve.now/CVE-2023-38970.md): Cross Site Scripting vulnerabiltiy in Badaso v.0.0.1 thru v.2.9.7 allows a remote attacker to execute arbitrary code via a crafted payload t (no CVSS, uasoft-indonesia/badaso)
- [CVE-2023-39135](https://cve.now/CVE-2023-39135.md): An issue in Zip Swift v2.1.2 allows attackers to execute a path traversal attack via a crafted zip entry. (no CVSS)
- [CVE-2023-39136](https://cve.now/CVE-2023-39136.md): An unhandled edge case in the component \_sanitizedPath of ZipArchive v2.5.4 allows attackers to cause a Denial of Service (DoS) via a crafte (no CVSS)
- [CVE-2023-39137](https://cve.now/CVE-2023-39137.md): An issue in Archive v3.3.7 allows attackers to spoof zip filenames which can lead to inconsistent filename parsing. (no CVSS)
- [CVE-2023-39138](https://cve.now/CVE-2023-39138.md): An issue in ZIPFoundation v0.9.16 allows attackers to execute a path traversal via extracting a crafted zip file. (no CVSS)
- [CVE-2023-39139](https://cve.now/CVE-2023-39139.md): An issue in Archive v3.3.7 allows attackers to execute a path traversal via extracting a crafted zip file. (no CVSS)
- [CVE-2023-40837](https://cve.now/CVE-2023-40837.md): Tenda AC6 US\_AC6V1.0BR\_V15.03.05.16\_multi\_TD01.bin function 'sub\_ADD50' contains a command execution vulnerability. (no CVSS)
- [CVE-2023-40838](https://cve.now/CVE-2023-40838.md): Tenda AC6 US\_AC6V1.0BR\_V15.03.05.16\_multi\_TD01.bin function 'sub\_3A1D0' contains a command execution vulnerability. (no CVSS)
- [CVE-2023-40839](https://cve.now/CVE-2023-40839.md): Tenda AC6 US\_AC6V1.0BR\_V15.03.05.16\_multi\_TD01.bin function 'sub\_ADF3C' contains a command execution vulnerability. (no CVSS)
- [CVE-2023-40840](https://cve.now/CVE-2023-40840.md): Tenda AC6 US\_AC6V1.0BR\_V15.03.05.16\_multi\_TD01.bin is vulnerable to Buffer Overflow via function "fromGetWirelessRepeat." (no CVSS)
- [CVE-2023-40841](https://cve.now/CVE-2023-40841.md): Tenda AC6 US\_AC6V1.0BR\_V15.03.05.16\_multi\_TD01.bin is vulnerable to Buffer Overflow via function "add\_white\_node," (no CVSS)
- [CVE-2023-40842](https://cve.now/CVE-2023-40842.md): Tengda AC6 US\_AC6V1.0BR\_V15.03.05.16\_multi\_TD01.bin is vulnerable to Buffer Overflow via function "R7WebsSecurityHandler." (no CVSS)
- [CVE-2023-40843](https://cve.now/CVE-2023-40843.md): Tenda AC6 US\_AC6V1.0BR\_V15.03.05.16\_multi\_TD01.bin is vulnerable to Buffer Overflow via function "sub\_73004." (no CVSS)
- [CVE-2023-40844](https://cve.now/CVE-2023-40844.md): Tenda AC6 US\_AC6V1.0BR\_V15.03.05.16\_multi\_TD01.bin is vulnerable to Buffer Overflow via function 'formWifiBasicSet.' (no CVSS)
- [CVE-2023-40845](https://cve.now/CVE-2023-40845.md): Tenda AC6 US\_AC6V1.0BR\_V15.03.05.16\_multi\_TD01.bin is vulnerable to Buffer Overflow via function 'sub\_34FD0.' In the function, it reads user (no CVSS)
- [CVE-2023-40847](https://cve.now/CVE-2023-40847.md): Tenda AC6 US\_AC6V1.0BR\_V15.03.05.16\_multi\_TD01.bin is vulnerable to Buffer Overflow via the function "initIpAddrInfo." In the function, it r (no CVSS)
- [CVE-2023-40848](https://cve.now/CVE-2023-40848.md): Tenda AC6 US\_AC6V1.0BR\_V15.03.05.16\_multi\_TD01.bin is vulnerable to Buffer Overflow via the function "sub\_7D858." (no CVSS)
- [CVE-2023-41163](https://cve.now/CVE-2023-41163.md): A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2023-41537](https://cve.now/CVE-2023-41537.md): phpjabbers Business Directory Script 3.2 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter. (no CVSS)
- [CVE-2023-41538](https://cve.now/CVE-2023-41538.md): phpjabbers PHP Forum Script 3.0 is vulnerable to Cross Site Scripting (XSS) via the keyword parameter. (no CVSS)
- [CVE-2023-41539](https://cve.now/CVE-2023-41539.md): phpjabbers Business Directory Script 3.2 is vulnerable to SQL Injection via the column parameter. (no CVSS)
- [CVE-2023-41552](https://cve.now/CVE-2023-41552.md): Tenda AC7 V1.0 V15.03.06.44 and Tenda AC9 V3.0 V15.03.06.42\_multi were discovered to contain a stack overflow via parameter ssid at url /gof (no CVSS)
- [CVE-2023-41553](https://cve.now/CVE-2023-41553.md): Tenda AC9 V3.0 V15.03.06.42\_multi and Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 were discovered to contain a stack overflow via parameter list at (no CVSS)
- [CVE-2023-41554](https://cve.now/CVE-2023-41554.md): Tenda AC9 V3.0 V15.03.06.42\_multi was discovered to contain a stack overflow via parameter wpapsk\_crypto at url /goform/WifiExtraSet. (no CVSS)
- [CVE-2023-41555](https://cve.now/CVE-2023-41555.md): Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter security\_5g at url /goform/WifiBasicSet. (no CVSS)
- [CVE-2023-41556](https://cve.now/CVE-2023-41556.md): Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42\_multi, and Tenda AC5 V1.0RTL\_V15.03.06.28 were discovered to contain a stack overfl (no CVSS)
- [CVE-2023-41557](https://cve.now/CVE-2023-41557.md): Tenda AC7 V1.0 V15.03.06.44 and Tenda AC5 V1.0RTL\_V15.03.06.28 were discovered to contain a stack overflow via parameter entrys and mitInter (no CVSS)
- [CVE-2023-41558](https://cve.now/CVE-2023-41558.md): Tenda AC7 V1.0 V15.03.06.44 was discovered to contain a stack overflow via parameter timeZone at url /goform/SetSysTimeCfg. (no CVSS)
- [CVE-2023-41559](https://cve.now/CVE-2023-41559.md): Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42\_multi, and Tenda AC5 V1.0RTL\_V15.03.06.28 were discovered to contain a stack overfl (no CVSS)
- [CVE-2023-41560](https://cve.now/CVE-2023-41560.md): Tenda AC9 V3.0 V15.03.06.42\_multi was discovered to contain a stack overflow via parameter firewallEn at url /goform/SetFirewallCfg. (no CVSS)
- [CVE-2023-41561](https://cve.now/CVE-2023-41561.md): Tenda AC9 V3.0 V15.03.06.42\_multi and Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 were discovered to contain a stack overflow via parameter startIp (no CVSS)
- [CVE-2023-41562](https://cve.now/CVE-2023-41562.md): Tenda AC7 V1.0 V15.03.06.44, Tenda AC9 V3.0 V15.03.06.42\_multi, and Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 were discovered to contain a stack (no CVSS)
- [CVE-2023-41563](https://cve.now/CVE-2023-41563.md): Tenda AC9 V3.0 V15.03.06.42\_multi and Tenda AC5 US\_AC5V1.0RTL\_V15.03.06.28 were discovered to contain a stack overflow via parameter mac at (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-08-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.