Month: August 2023

Typora directory traversal | CVE-2023-2316

August 23, 2023

NAME__________Typora directory traversalPlatforms Affected:Typora Typora 1.6.0 Typora Typora 1.5.0Risk Level:6.3Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________Typora could allow a remote attacker to traverse directories...

TPLink Smart bulb Tapo series L530 and Tapo Application information disclosure | CVE-2023-38908

August 23, 2023

NAME__________TPLink Smart bulb Tapo series L530 and Tapo Application information disclosurePlatforms Affected:TPLink Smart bulb Tapo series L530 1.0.0 TPLink Tapo...

Veilid denial of service | CVE-2023-40711

August 23, 2023

NAME__________Veilid denial of servicePlatforms Affected:Veilid Veilid 0.1.8Risk Level:7.5Exploitability:UnprovenConsequences:Denial of Service DESCRIPTION__________Veilid is vulnerable to a denial of service, caused by...

Cockpit cross-site scripting | CVE-2023-4451

August 23, 2023

NAME__________Cockpit cross-site scriptingPlatforms Affected:Cockpit-HQ Cockpit 2.6.3Risk Level:6.1Exploitability:HighConsequences:Cross-Site Scripting DESCRIPTION__________Cockpit is vulnerable to cross-site scripting, caused by improper validation of user-supplied...

IBM Robotic Process Automation privilege escalation | CVE-2023-38734

August 23, 2023

NAME__________IBM Robotic Process Automation privilege escalationPlatforms Affected:IBM Robotic Process Automation 21.0.0 IBM Robotic Process Automation 23.0.0 IBM Robotic Process Automation...

3CX privilege escalation | CVE-2023-27362

August 23, 2023

NAME__________3CX privilege escalationPlatforms Affected:3CX Phone Management System 18Risk Level:7Exploitability:UnprovenConsequences:Gain Privileges DESCRIPTION__________3CX could allow a local authenticated attacker to gain elevated...

Sourceforge DoorGets CMS information disclosure |

August 23, 2023

NAME__________Sourceforge DoorGets CMS information disclosurePlatforms Affected:Sourceforge DoorGets CMS 7.0Risk Level:5.3Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________Sourceforge DoorGets CMS could allow a remote attacker to...

EnterpriseDB Postgres Advanced Server UTL_FILE security bypass |

August 23, 2023

NAME__________EnterpriseDB Postgres Advanced Server UTL_FILE security bypassPlatforms Affected:EnterpriseDB Postgres Advanced Server 11.21 EnterpriseDB Postgres Advanced Server 12.16 EnterpriseDB Postgres Advanced...

IBM Robotic Process Automation information disclosure | CVE-2023-38732

August 23, 2023

NAME__________IBM Robotic Process Automation information disclosurePlatforms Affected:IBM Robotic Process Automation 21.0.0 IBM Robotic Process Automation 21.0.7Risk Level:4.3Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________IBM Robotic...

EnterpriseDB Postgres Advanced Server DBMS_PROFILER security bypass |

August 23, 2023

NAME__________EnterpriseDB Postgres Advanced Server DBMS_PROFILER security bypassPlatforms Affected:EnterpriseDB Postgres Advanced Server 11.21 EnterpriseDB Postgres Advanced Server 12.16 EnterpriseDB Postgres Advanced...

EnterpriseDB Postgres Advanced Server DBMS_MVIEW security bypass |

August 23, 2023

NAME__________EnterpriseDB Postgres Advanced Server DBMS_MVIEW security bypassPlatforms Affected:EnterpriseDB Postgres Advanced Server 11.21 EnterpriseDB Postgres Advanced Server 12.16 EnterpriseDB Postgres Advanced...

20script Fara Melk Estate CMS information disclosure |

August 23, 2023

NAME__________20script Fara Melk Estate CMS information disclosurePlatforms Affected:20script Fara Melk Estate CMS 1.5.0Risk Level:5.3Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________20script Fara Melk Estate CMS...

Devolutions Remote Desktop Manager security bypass | CVE-2023-4373

August 23, 2023

NAME__________Devolutions Remote Desktop Manager security bypassPlatforms Affected:Devolutions Remote Desktop Manager 2023.2.19Risk Level:4.3Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION__________Devolutions Remote Desktop Manager could allow a...

EnterpriseDB Postgres Advanced Server get_url_as_text and get_url_as_bytea information disclosure |

August 23, 2023

NAME__________EnterpriseDB Postgres Advanced Server get_url_as_text and get_url_as_bytea information disclosurePlatforms Affected:EnterpriseDB Postgres Advanced Server 11.21 EnterpriseDB Postgres Advanced Server 12.16 EnterpriseDB...

IBM Robotic Process Automation information disclosure | CVE-2023-38733

August 23, 2023

NAME__________IBM Robotic Process Automation information disclosurePlatforms Affected:IBM Robotic Process Automation 21.0.0 IBM Robotic Process Automation 23.0.0 IBM Robotic Process Automation...

ASUSTOR Data Master security bypass | CVE-2023-4475

August 23, 2023

NAME__________ASUSTOR Data Master security bypassPlatforms Affected:ASUSTOR Data Master 4.0 ASUSTOR Data Master 4.1 ASUSTOR Data Master 4.2Risk Level:7.5Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION__________ASUSTOR...

Trane Thermostats command execution | CVE-2023-4212

August 23, 2023

NAME__________Trane Thermostats command executionPlatforms Affected:Trane Technologies XL824 Thermostat Firmware 5.9.8 Trane Technologies XL850 Thermostat Firmware 5.9.8 Trane Technologies XL1050 Thermostat...

EnterpriseDB Postgres Advanced Server accesshistory() information disclosure |

August 23, 2023

NAME__________EnterpriseDB Postgres Advanced Server accesshistory() information disclosurePlatforms Affected:EnterpriseDB Postgres Advanced Server 11.21 EnterpriseDB Postgres Advanced Server 12.16 EnterpriseDB Postgres Advanced...

Devolutions Remote Desktop Manager security bypass | CVE-2023-4417

August 23, 2023

NAME__________Devolutions Remote Desktop Manager security bypassPlatforms Affected:Devolutions Remote Desktop Manager 2023.2.19Risk Level:5.7Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION__________Devolutions Remote Desktop Manager could allow a...

Danfoss AK-SM800A information disclosure | CVE-2023-25913

August 23, 2023

NAME__________Danfoss AK-SM800A information disclosurePlatforms Affected:Danfoss AK-SM800A 3.3Risk Level:6.5Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________Danfoss AK-SM800A could allow a remote authetnicated attacker to obtain sensitive...

Red Hat Openshift Logging security bypass | CVE-2023-4456

August 23, 2023

NAME__________Red Hat Openshift Logging security bypassPlatforms Affected:Red Hat OpenShift LoggingRisk Level:7.7Exploitability:UnprovenConsequences:Bypass Security DESCRIPTION__________Red Hat Openshift Logging could allow a remote...

Apache Batik server-side request forgery | CVE-2022-44729

August 23, 2023

NAME__________Apache Batik server-side request forgeryPlatforms Affected:Apache Batik 1.0 Apache Batik 1.16Risk Level:7.1Exploitability:UnprovenConsequences:Gain Access DESCRIPTION__________Apache Batik is vulnerable to server-side request...

Apache Batik server-side request forgery | CVE-2022-44730

August 23, 2023

NAME__________Apache Batik server-side request forgeryPlatforms Affected:Apache Batik 1.0 Apache Batik 1.16Risk Level:5.5Exploitability:UnprovenConsequences:Obtain Information DESCRIPTION__________Apache Batik is vulnerable to server-side request...

openSUSE Welcome privilege escalation | CVE-2023-32184

August 23, 2023

NAME__________openSUSE Welcome privilege escalationPlatforms Affected:openSUSE WelcomeRisk Level:7.8Exploitability:UnprovenConsequences:Gain Privileges DESCRIPTION__________openSUSE Welcome could allow a local authenticated attacker to gain elevated privileges...

Month: August 2023

Typora directory traversal | CVE-2023-2316

TPLink Smart bulb Tapo series L530 and Tapo Application information disclosure | CVE-2023-38908

Veilid denial of service | CVE-2023-40711

Cockpit cross-site scripting | CVE-2023-4451

IBM Robotic Process Automation privilege escalation | CVE-2023-38734

3CX privilege escalation | CVE-2023-27362

Sourceforge DoorGets CMS information disclosure |

EnterpriseDB Postgres Advanced Server UTL_FILE security bypass |

IBM Robotic Process Automation information disclosure | CVE-2023-38732

EnterpriseDB Postgres Advanced Server DBMS_PROFILER security bypass |

EnterpriseDB Postgres Advanced Server DBMS_MVIEW security bypass |

20script Fara Melk Estate CMS information disclosure |

Devolutions Remote Desktop Manager security bypass | CVE-2023-4373

EnterpriseDB Postgres Advanced Server get_url_as_text and get_url_as_bytea information disclosure |

IBM Robotic Process Automation information disclosure | CVE-2023-38733

ASUSTOR Data Master security bypass | CVE-2023-4475

Trane Thermostats command execution | CVE-2023-4212

EnterpriseDB Postgres Advanced Server accesshistory() information disclosure |

Devolutions Remote Desktop Manager security bypass | CVE-2023-4417

Danfoss AK-SM800A information disclosure | CVE-2023-25913

Red Hat Openshift Logging security bypass | CVE-2023-4456

Apache Batik server-side request forgery | CVE-2022-44729

Apache Batik server-side request forgery | CVE-2022-44730

openSUSE Welcome privilege escalation | CVE-2023-32184

CISA: 2024 CWE Top 25 Most Dangerous Software Weaknesses

CISA: Apple Releases Security Updates for Multiple Products

CISA: CISA Releases Seven Industrial Control Systems Advisories

CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog

CISA: CISA Releases Insights from Red Team Assessment of a U.S. Critical Infrastructure Sector Organization

You may have missed