CVEs published in August 2023
70 tracked CVEs from 8 vendors had their first vendor advisory published in August 2023: 5 critical, 40 high. Newest first.
14 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2023-20900High
VMware Tools: malicious actor that has been granted Guest Operation Privileges https://docs.vmware.com/en/VMware-vSphere/8.0/vsphere-security/GUID-6A952214-0E5E-4CCF-9D2A-90948FF643EC.html in a target virtual machine may be able to elevate their privileges if that target virtual machine has been assigned a more privileged Guest Alias https://vdc-download.vmware.com/vmwb-repository/dcr-public/d1902b0e-d479-46bf-8ac9-cee0e31e8ec0/07ce8dbd-db48-4261-9b8f-c6d3ad8ba472/vim.vm.guest.AliasManager.html
VMware · 1 advisory - Added
CVE-2023-4571High
In Splunk IT Service Intelligence (ITSI) versions below below 4.13.3, 4.15.3, or 4.17.1, a malicious actor
Splunk · 1 advisory - Added
CVE-2023-40598High
In Splunk Enterprise versions below 8.2.12, 9.0.6, and 9.1.1, an attacker
Splunk · 1 advisory - Added
CVE-2023-40597High
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker
Splunk · 1 advisory - Added
CVE-2023-40596High
In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk…
Splunk · 1 advisory - Added
CVE-2023-40595High
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker can execute a specially crafted query that they
Splunk · 1 advisory - Added
CVE-2023-40594Medium
In Splunk Enterprise versions lower than 8.2.12, 9.0.6, and 9.1.1, an attacker
Splunk · 1 advisory - Added
CVE-2023-40593Medium
In Splunk Enterprise versions lower than 9.0.6 and 8.2.12, a malicious actor
Splunk · 1 advisory - Added
CVE-2023-40592High
In Splunk Enterprise versions below 9.1.1, 9.0.6, and 8.2.12, an attacker can craft a special web request that can
Splunk · 1 advisory - Added
QTS: insufficient entropy vulnerability has been reported to affect QNAP operating systems.
QNAP · 1 advisory - Added
QTS: cleartext transmission of sensitive information vulnerability has been reported to affect QNAP operating systems.
QNAP · 1 advisory - Added
CVE-2023-34971High
QTS: inadequate encryption strength vulnerability has been reported to affect QNAP operating systems.
QNAP · 1 advisory - Added
CVE-2022-44729Unrated
Apache XML Graphics Batik: Information disclosure vulnerability
Apache · 1 advisory - Added
CVE-2022-24834High
Redis Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2023-38154High
Windows Kernel Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-38181High
Microsoft Exchange Server Spoofing Vulnerability
MS Server · 1 advisory - Added
CVE-2023-38182High
Microsoft Exchange Server Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35388High
Microsoft Exchange Server Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36894Medium
Microsoft SharePoint Server Information Disclosure Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36892High
Microsoft SharePoint Server Spoofing Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36891High
Microsoft SharePoint Server Spoofing Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36890Medium
Microsoft SharePoint Server Information Disclosure Vulnerability
MS Server · 1 advisory - Added
CVE-2023-21709Critical
Microsoft Exchange Server Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-38169High
Microsoft SQL OLE DB Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2023-38172High
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
MS Server · 1 advisory - Added
CVE-2023-38184High
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2023-38185High
Microsoft Exchange Server Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2023-38186High
Windows Mobile Device Management Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35387High
Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35386High
Windows Kernel Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35385Critical
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35384Medium
Windows HTML Platforms Security Feature Bypass Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35383High
Microsoft Message Queuing Information Disclosure Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35382High
Windows Kernel Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35381High
Windows Fax Service Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35380High
Windows Kernel Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35379High
Reliability Analysis Metrics Calculation Engine (RACEng) Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35378High
Windows Projected File System Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35377Medium
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
MS Server · 1 advisory - Added
CVE-2023-38254Medium
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35376Medium
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36914Medium
Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36913Medium
Microsoft Message Queuing Information Disclosure Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36912High
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36911Critical
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36910Critical
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36909Medium
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36908Medium
Windows Hyper-V Information Disclosure Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36907Medium
Windows Cryptographic Services Information Disclosure Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36906Medium
Windows Cryptographic Services Information Disclosure Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36905Medium
Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36904High
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36903High
Windows System Assessment Tool Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36900High
Windows Common Log File System Driver Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36889Medium
Windows Group Policy Security Feature Bypass Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36882High
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2023-36876High
Reliability Analysis Metrics Calculation (RacTask) Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35368High
Microsoft Exchange Remote Code Execution Vulnerability
MS Server · 1 advisory - Added
CVE-2023-35359High
Windows Kernel Elevation of Privilege Vulnerability
MS Server · 1 advisory - Added
CVE-2023-3932High
Incorrect User Management in GitLab
GitLab · 2 advisories - Added
CVE-2023-38408Critical
OpenSSH Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2023-3470Medium
Specific F5 BIG-IP platforms with Cavium Nitrox FIPS HSM cards generate a deterministic password for the Crypto User account
F5 · 1 advisory - Added
CVE-2023-38423Medium
cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility
F5 · 1 advisory - Added
CVE-2023-38419Medium
authenticated attacker with guest privileges or higher
F5 · 1 advisory - Added
CVE-2023-38418High
The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process
F5 · 2 advisories - Added
CVE-2023-38138High
reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of the BIG-IP Configuration utility which
F5 · 1 advisory - Added
CVE-2023-36858High
insufficient verification of data vulnerability exists in BIG-IP Edge Client for Windows and macOS that may
F5 · 1 advisory - Added
CVE-2023-36494Medium
F5OS: Audit logs on F5OS-A may contain undisclosed sensitive information.
F5 · 1 advisory - Added
CVE-2023-3401Medium
Improper Control of Generation of Code ('Code Injection') in GitLab
GitLab · 1 advisory - Added
CVE-2023-2164Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab
GitLab · 1 advisory