CVEs published in August 2023
2,620 vulnerabilities, 342 critical, 13 exploited.
- cdwanjiang flash flood disaster monitoring and warning systemChengdu Flash Flood Disaster Monitoring and Warning System FileHandler.ashx absolute path traversal4.3 Medium
- david lingren media library assistantWordPress Media Library Assistant Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)5.8 Medium
- joedolson my content managementWordPress My Content Management Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- wp-buy wp content copy protection & no right click, wp content copy protection \& no right click +1 moreWordPress WP Content Copy Protection & No Right Click Plugin <= 3.5.5 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- codebard codebard's patron button and widgets for patreon, codebard\'s patron button and widgets for patreon +1 moreWordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)7.1 High
- cartflows, cartflows pro +1 moreWordPress CartFlows Pro Plugin <= 1.11.11 is vulnerable to Cross Site Scripting (XSS)7.1 High
- algoritmika wpfactory helper, wpfactory helper +1 moreWordPress WPFactory Helper Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS)7.1 High
- woocommerce shipping multiple addressesWordPress WooCommerce Ship to Multiple Addresses Plugin <= 3.8.5 is vulnerable to Cross Site Scripting (XSS)7.1 High
- dimitar ivanov http headersWordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- cdwanjiang flash flood disaster monitoring and warning systemChengdu Flash Flood Disaster Monitoring and Warning System FileDownload.ashx path traversal4.3 Medium
- instantsoft instantsoft/icms2, instantcms +1 moreCross-site Scripting (XSS) - Reflected in instantsoft/icms24.8 Medium
- instantsoft instantsoft/icms2, instantcms +1 moreSQL Injection in instantsoft/icms29.8 Critical
- dedebizDedeBIZ Article cross site scripting3.5 Low
- ruijie rg-ew1200g, rg-ew1200g firmware +1 moreRuijie RG-EW1200G Administrator Password set_passwd access control6.3 Medium
- templatecookie adlistingTemplatecookie Adlisting Redirect ad-list information disclosure4.3 Medium
- instantsoft instantsoft/icms2, instantcms +1 moreCross-site Scripting (XSS) - Stored in instantsoft/icms23.5 Low
- media browser emby server, emby emby.releases +1 moreMedia Browser Emby Server cross site scripting3.5 Low
- jinher oa, tongda2000 tongda office anywhere +1 moreTongda OA delete_log.php sql injection5.5 Medium
- jinher oa, tongda2000 tongda office anywhere +1 moreTongda OA delete_seal.php sql injection5.5 Medium
- apache airflowApache Airflow: Airflow "Run task" feature allows execution with unnecessary priviledges8.8 High
- apple safariThis issue was addressed with improved iframe sandbox enforcement. This issue is fixed in Safari...8.8 High
- apple macos, webkitgtk, wpewebkit wpe webkit +2 moreThe issue was addressed with improved checks. This issue is fixed in macOS Ventura 13.5. A remote...9.8 Critical
- apple ipados, macos, watchos +2 more +4 moreA use-after-free issue was addressed with improved memory management. This issue is fixed in iOS...8.8 High
- shuize 0x727 project 0x727ShuiZe_0x727 v1.0 was discovered to contain a remote command execution (RCE) vulnerability via...8.8 High
- langchainlangchain Code Injection vulnerability9.8 Critical
- assaabloy control id idsecureA SQL injection vulnerability exists in Control ID IDSecure 4.7.26.0 and prior, allowing...9.8 Critical
- stormshield ssl vpn clientAn issue was discovered in Stormshield SSL VPN Client before 3.2.0. A logged-in user, able to...7.8 High
- sem-cms semcmsFile Upload vulnerability in SEMCMS 3.9 allows remote attackers to run arbitrary code via...7.2 High
- cisco sd-wan vmanage, catalyst sd-wan manager +1 moreA vulnerability in the web UI of Cisco SD-WAN vManage Software could allow an authenticated,...6.5 Medium
- cisco sd-wan vmanage, catalyst sd-wan manager +1 moreA vulnerability in the web-based management interface of Cisco SD-WAN vManage Software could...6.5 Medium
- cisco asyncos, secure email +1 moreA vulnerability in the zip decompression engine of Cisco AsyncOS Software for Cisco Email...5.8 Medium
- bjrjk linuxasmcallgraphbjrjk/LinuxASMCallGraph before commit 20dba06 allows attackers to cause a RCE on the server side via uploading a crafted ZIP file due to incorrect filtering rules of uploaded file8.8 High
- fobybus social-media-skeletonsocial-media-skeleton vulnerable to Pre-Auth SQLi leading to RCE10.0 Critical
- eng knowage, knowagelabs knowage-server +1 moreKnowage Server vulnerable to path traversal via upload functionality10.0 Critical
- matrix irc bridge, matrix-org matrix-appservice-irc +1 morematrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms3.5 Low
- fit2cloud cloudexplorer lite, cloudexplorer-dev cloudexplorer-lite +1 moreCommand injection vulnerability in module management function in CloudExplorer Lite9.8 Critical
- omeka omeka/omeka-s, s +1 moreUnrestricted Upload of File with Dangerous Type in omeka/omeka-s9.9 Critical
- omeka, omeka omeka/omeka-s, s +2 moreCross-site Scripting (XSS) - Stored in omeka/omeka-s6.4 Medium
- omeka, omeka omeka/omeka-s, s +2 moreImproper Neutralization of Special Elements in Output Used by a Downstream Component in omeka/omeka-s5.2 Medium
- matrix matrix-appservice-bridgematrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs5.0 Medium
- matrix irc bridge, matrix-org matrix-appservice-irc +1 morematrix-appservice-irc IRC command injection via admin commands containing newlines5.8 Medium
- rs485 logisticspipesDeserialization of Untrusted Data in network IO8.1 High
- metersphereThe cloud version of the MeterSphere interface leaks some sensitive data without authentication5.9 Medium
- hedgedocHedgeDoc API allows to hide existing notes6.5 Medium
- projectdiscovery nucleiNuclei Path Traversal vulnerability7.5 High
- metabaseMetabase vulnerable to remote code execution via POST /api/setup/validate API endpoint10.0 Critical
jqOSS-FuzzSegv on unknown address in decUnitCompareNo scoreclamavOSS-FuzzStack-buffer-overflow in initialize_encryption_keyNo score- qemu, fedora extra packages for enterprise linux, fedora +5 more +7 moreOut-of-bounds read information disclosure vulnerability6.0 Medium
- vmware horizon clientVMware Horizon Server contains an information disclosure vulnerability. A malicious actor with...5.3 Medium
- Show moreLoading…