CVEs published August 31, 2023
104 CVEs were published on August 31, 2023: 3 critical, 21 high.
- Published
- 104
- Critical
- 3
- High
- 21
- Medium
- 68
- Low
- 5
- Unrated
- 7
- Now in CISA KEV
- 0
- Fix available
- 58
Most affected products
- FreeRDP
- 17
- instantsoft/icms2
- 7
- edgarrojas PDF Builder for WooCommerce. Create invoices,pac…
- 5
- Schweitzer Engineering Laboratories SEL-5030 acSELerator Qu…
- 5
- Acronis Agent · Acronis Cyber Protect
- 4
- gpac/gpac
- 4
- learningtimes BadgeOS
- 4
- Schweitzer Engineering Laboratories SEL-5037 SEL Grid Confi…
- 4
- Synology Router Manager
- 4
- Acronis Agent
- 3
Critical 3
- CVE-2023-4299Digi RealPort Protocol Use of Password Hash Instead of Password for AuthenticationDigi International Digi RealPort · Digi International D… +16
- CVE-2023-28801Improper SAML signature verificationZscaler ZIA Admin Portal
- CVE-2023-3162Stripe Payment Plugin for WooCommerce <= 3.7.7 - Authentication Bypassthemehigh Payment Gateway of Stripe for WooCommerce
High 21
- CVE-2023-4481Junos OS and Junos OS Evolved: A crafted BGP UPDATE message allows a remote attacker to de-peer (reset) BGP sessions (CVE-2023-4481)Juniper Networks Junos OS
- CVE-2023-40187Use-After-Free in FreeRDPFreeRDP
- CVE-2023-39355FreeRDP Use-After-Free in RDPGFX_CMDID_RESETGRAPHICSFreeRDP
- CVE-2022-46869Local privilege escalation during installation due to improper soft link handling.Acronis Cyber Protect Home Office · Acronis True Image OEM
- CVE-2023-41748Remote command execution due to improper input validation.Acronis Cloud Manager
- CVE-2023-41746Remote command execution due to improper input validation.Acronis Cloud Manager
- CVE-2023-34392Missing Authentication for Critical FunctionSchweitzer Engineering Laboratories SEL-5037 SEL Grid Confi…
- CVE-2023-34391Insecure Inherited PermissionsSchweitzer Engineering Laboratories SEL-5033 AcSELerator RT…
- CVE-2023-31175Execution with Unnecessary PrivilegesSchweitzer Engineering Laboratories SEL-5037 SEL Grid Confi…
- CVE-2023-31174Cross-Site Request Forgery (CSRF)Schweitzer Engineering Laboratories SEL-5037 SEL Grid Confi…
- CVE-2023-31173Use of Hard-coded CredentialsSchweitzer Engineering Laboratories SEL-5037 SEL Grid Confi…
- CVE-2023-41744Local privilege escalation due to unrestricted loading of unsigned libraries.Acronis Agent · Acronis Cyber Protect
- CVE-2023-41743Local privilege escalation due to insecure driver communication port permissions.Acronis Cyber Protect Home Office · Acronis Cyber Protec… +2
- CVE-2022-45451Local privilege escalation due to insecure driver communication port permissions.Acronis Cyber Protect Home Office · Acronis Agent +1
- CVE-2023-20900A malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A95VMware Tools
- CVE-2023-41738Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality iSynology Router Manager
- CVE-2023-2188Colibri Page Builder <= 1.0.227 - Authenticated (Administrator+) SQL Injection via post_idextendthemes Colibri Page Builder
- CVE-2023-3636WP Project Manager <= 2.6.4 - Arbitrary Usermeta Update to Authenticated (Subscriber+) Privilege Escalationwedevs Project Manager – AI Powered Project Management, Tas…
- CVE-2023-3677WooCommerce PDF Invoice Builder <= 1.2.89 - Authenticated (Subscriber+) SQL Injection via Exportedgarrojas PDF Builder for WooCommerce. Create invoices,pac…
- CVE-2023-2229Quick Post Duplicator <= 2.0 - Authenticated (Contributor+) SQL Injection via post_idrahulsingh74388 Quick Post Duplicator
- CVE-2023-31424Web authentication and authorization bypassBrocade SANnav
Medium, low and unrated 80
- CVE-2023-40567Out-Of-Bounds Write in FreeRDPFreeRDP
- CVE-2023-40569Out-Of-Bounds Write in FreeRDPFreeRDP
- CVE-2023-40574Out-Of-Bounds Write in FreeRDPFreeRDP
- CVE-2023-40576Out-Of-Bounds Read in FreeRDPFreeRDP
- CVE-2023-40575Out-Of-Bounds Read in FreeRDPFreeRDP
- CVE-2023-40188Out-Of-Bounds Read in FreeRDPFreeRDP
- CVE-2023-40186IntegerOverflow leading to Out-Of-Bound Write Vulnerability in FreeRDPFreeRDP
- CVE-2023-40181Integer-Underflow leading to Out-Of-Bound Read in FreeRDPFreeRDP
- CVE-2023-39356Missing offset validation leading to Out-of-Bounds Read in FreeRDPFreeRDP
- CVE-2023-39352Invalid offset validation leading to Out Of Bound Write in FreeRDPFreeRDP
- CVE-2023-4688Sensitive information leak through log files.Acronis Agent
- CVE-2023-41751Sensitive information disclosure due to improper token expiration validation.Acronis Agent
- CVE-2023-41750Sensitive information disclosure due to missing authorization.Acronis Agent
- CVE-2023-41749Sensitive information disclosure due to excessive collection of system information.Acronis Agent · Acronis Cyber Protect
- CVE-2023-39353Missing offset validation leading to Out Of Bound Read in FreeRDPFreeRDP
- CVE-2023-39351FreeRDP Null Pointer Dereference leading denial of serviceFreeRDP
- CVE-2023-39354FreeRDP Out-Of-Bounds Read in nsc_rle_decompress_dataFreeRDP
- CVE-2023-39350Incorrect offset calculation leading to denial of service in FreeRDPFreeRDP
- CVE-2023-40589FreeRDP Global-Buffer-Overflow in ncrush_decompressFreeRDP
- CVE-2023-41045Insecure source port usage for DNS queries in Grayloggraylog2-server · org.graylog2:graylog2-server
- CVE-2023-41747Sensitive information disclosure due to unauthenticated path traversal.Acronis Cloud Manager
- CVE-2023-41745Sensitive information disclosure due to excessive collection of system information.Acronis Agent · Acronis Cyber Protect
- CVE-2023-41044Partial path traversal vulnerability in Support Bundle feature of Grayloggraylog2-server · org.graylog2:graylog2-server
- CVE-2023-41034DDFFileParser in eclipse leshan is vulnerable to XXE Attackseclipse-leshan leshan · org.eclipse.leshan:leshan-core
- CVE-2023-4683NULL Pointer Dereference in gpac/gpacgpac/gpac
- CVE-2023-4682Heap-based Buffer Overflow in gpac/gpacgpac/gpac
- CVE-2023-4681NULL Pointer Dereference in gpac/gpacgpac/gpac
- CVE-2023-4678Divide By Zero in gpac/gpacgpac/gpac
- CVE-2023-31172Incomplete Filtering of Special ElementsSchweitzer Engineering Laboratories SEL-5030 acSELerator Qu…
- CVE-2023-31171Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Schweitzer Engineering Laboratories SEL-5030 acSELerator Qu…
- CVE-2023-31170 Inclusion of Functionality from Untrusted Control SphereSchweitzer Engineering Laboratories SEL-5030 acSELerator Qu…
- CVE-2023-31169Improper Handling of Unicode EncodingSchweitzer Engineering Laboratories SEL-5030 acSELerator Qu…
- CVE-2023-31168 Inclusion of Functionality from Untrusted Control SphereSchweitzer Engineering Laboratories SEL-5030 acSELerator Qu…
- CVE-2023-31167Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Schweitzer Engineering Laboratories SEL-5036 acSELerator Ba…
- CVE-2022-46868Local privilege escalation during recovery due to improper soft link handling.Acronis Cyber Protect Home Office
- CVE-2023-41742Excessive attack surface due to binding to an unrestricted IP address.Acronis Agent · Acronis Cyber Protect
- CVE-2023-33835IBM Security Verify Information Queue information disclosureIBM Security Verify Information Queue
- CVE-2023-33834IBM Security Verify Information Queue information disclosureIBM Security Verify Information Queue
- CVE-2023-33833IBM Security Verify Information Queue information disclosureIBM Security Verify Information Queue
- CVE-2023-41741Exposure of sensitive information to an unauthorized actor vulnerability in cgi component in Synology Router Manager (SRM) before 1.3.1-9346Synology Router Manager
- CVE-2023-41740Improper limitation of a pathname to a restricted directory ('Path Traversal') vulnerability in cgi component in Synology Router Manager (SRSynology Router Manager
- CVE-2023-41739Uncontrolled resource consumption vulnerability in File Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote autSynology Router Manager
- CVE-2023-4471Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scriptingrustaurius Order Tracking – WordPress Status Tracking Plugin
- CVE-2023-3764WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery via Saveedgarrojas PDF Builder for WooCommerce. Create invoices,pac…
- CVE-2023-2173BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Deletionlearningtimes BadgeOS
- CVE-2023-2352CHP Ads Block Detector <= 3.9.4 - Cross-Site Request Forgery via chp_abd_actionsureshchand12a CHP Ads Block Detector
- CVE-2023-2279WP Directory Kit <= 1.2.1 - Cross-Site Request Forgery to Plugin Settings Change/Delete, Demo Import, Directory Kit Modification/Deletion via admin_page_displaywpdirectorykit WP Directory Kit
- CVE-2023-4500Order Tracking Pro <= 3.3.6 - Authenticated (Administrator+) Stored Cross-Site Scriptingrustaurius Order Tracking – WordPress Status Tracking Plugin
- CVE-2023-4000Waiting: One-click countdowns <= 0.6.2 - Cross-Site Request Forgerypluginbuilders Waiting: One-click countdowns
- CVE-2023-2171BadgeOS <= 3.7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodelearningtimes BadgeOS
- CVE-2023-2354CHP Ads Block Detector <= 3.9.4 - Authenticated (Subscriber+) Stored Cross-Site Scriptingsureshchand12a CHP Ads Block Detector
- CVE-2023-3404ProfileGrid <= 5.5.0 - Hardcoded Encryption Keymetagauss ProfileGrid – User Profiles, Groups and Communiti…
- CVE-2023-4160WooCommerce PDF Invoice Builder <= 1.2.90 - Authenticated (Administrator+) Cross-Site Scriptingedgarrojas PDF Builder for WooCommerce. Create invoices,pac…
- CVE-2023-4315Woo Custom Emails <= 2.2 - Reflected Cross-Site Scripting via wcemails_editmehulkaklotar Woo Custom Emails
- CVE-2023-2174BadgeOS <= 3.7.1.6 - Missing Authorization in delete_badgeos_log_entrieslearningtimes BadgeOS
- CVE-2023-2172BadgeOS <= 3.7.1.6 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Post Title Overwritelearningtimes BadgeOS
- CVE-2023-2353CHP Ads Block Detector <= 3.9.4 - Missing Authorization to Plugin Settings Updatesureshchand12a CHP Ads Block Detector
- CVE-2023-4161WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creationedgarrojas PDF Builder for WooCommerce. Create invoices,pac…
- CVE-2023-0689Metform Elementor Contact Form Builder <= 3.3.1 - Authenticated (Subscriber+) Information Disclosure via 'mf_first_name' shortcoderoxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-3999Waiting: One-click countdowns <= 0.6.2 - Missing Authorizationpluginbuilders Waiting: One-click countdowns
- CVE-2023-4245WooCommerce PDF Invoice Builder <= 1.2.89 - Missing Authorization to Sensitive Information Exposureedgarrojas PDF Builder for WooCommerce. Create invoices,pac…
- CVE-2023-31423Possible information exposure through log file vulnerabilityBrocade SANnav
- CVE-2023-31925Storage of clear text password in Brocade SANnavBrocade SANnav
- CVE-2023-4162Segmentation fault in Brocade Fabric OS after Brocade Fabric OS v9.0Brocade Fabric OS
- CVE-2023-4163Possible buffer overflow in portcfgfportbuffers in Brocade Fabric OSBrocade Fabric OS
- CVE-2023-4654Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in instantsoft/icms2instantsoft/icms2
- CVE-2023-4655Cross-site Scripting (XSS) - Reflected in instantsoft/icms2instantsoft/icms2
- CVE-2023-4650Improper Access Control in instantsoft/icms2instantsoft/icms2
- CVE-2023-4649Session Fixation in instantsoft/icms2instantsoft/icms2
- CVE-2023-4651Server-Side Request Forgery (SSRF) in instantsoft/icms2instantsoft/icms2
- CVE-2023-4653Cross-site Scripting (XSS) - Stored in instantsoft/icms2instantsoft/icms2
- CVE-2023-4652Cross-site Scripting (XSS) - Stored in instantsoft/icms2instantsoft/icms2
- CVE-2023-39912Zoho ManageEngine ADManager Plus before 7203 allows Help Desk Technician users to read arbitrary files on the machine where this product is
- CVE-2023-41635A XML External Entity (XXE) vulnerability in the VerifichePeriodiche.aspx component of GruppoSCAI RealGimm v1.1.37p38 allows attackers to re
- CVE-2023-41636A SQL injection vulnerability in the Data Richiesta dal parameter of GruppoSCAI RealGimm v1.1.37p38 allows attackers to access the database
- CVE-2023-41637An arbitrary file upload vulnerability in the Carica immagine function of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbitrar
- CVE-2023-41638An arbitrary file upload vulnerability in the Gestione Documentale module of GruppoSCAI RealGimm 1.1.37p38 allows attackers to execute arbit
- CVE-2023-41640An improper error handling vulnerability in the component ErroreNonGestito.aspx of GruppoSCAI RealGimm 1.1.37p38 allows attackers to obtain
- CVE-2023-41642Multiple reflected cross-site scripting (XSS) vulnerabilities in the ErroreNonGestito.aspx component of GruppoSCAI RealGimm 1.1.37p38 allow
- CVE-2023-41717Inappropriate file type control in Zscaler Proxy versions 3.6.1.25 and prior allows local attackers to bypass file download/upload restricti