# CVEs published 2023-09-06

159 CVEs were published on September 6, 2023: 6 critical, 46 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-38605](https://cve.now/CVE-2023-38605.md): This issue was addressed with improved redaction of sensitive information. (no CVSS, Apple macOS)
- [CVE-2023-40392](https://cve.now/CVE-2023-40392.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS)
- [CVE-2023-38616](https://cve.now/CVE-2023-38616.md): A race condition was addressed with improved state handling. (no CVSS, Apple macOS)
- [CVE-2023-40397](https://cve.now/CVE-2023-40397.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-39967](https://cve.now/CVE-2023-39967.md): Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio (CVSS 10.0, wiremock)
- [CVE-2023-41327](https://cve.now/CVE-2023-41327.md): Controlled SSRF through URL in the WireMock (CVSS 4.6, wiremock · org.wiremock:wiremock-webhooks-extension)
- [CVE-2023-41329](https://cve.now/CVE-2023-41329.md): Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio (CVSS 3.9, wiremock · org.wiremock:wiremock-standalone +3)
- [CVE-2023-41053](https://cve.now/CVE-2023-41053.md): Redis SORT\_RO may bypass ACL configuration (CVSS 3.3, redis)
- [CVE-2023-23623](https://cve.now/CVE-2023-23623.md): Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron (CVSS 7.5, electron)
- [CVE-2023-29198](https://cve.now/CVE-2023-29198.md): Context isolation bypass via nested unserializable return value in Electron (CVSS 6.0, electron)
- [CVE-2023-39956](https://cve.now/CVE-2023-39956.md): Electron: Out-of-package code execution when launched with arbitrary cwd (CVSS 6.1, electron)
- [CVE-2023-4809](https://cve.now/CVE-2023-4809.md): pf incorrectly handles multiple IPv6 fragment headers (no CVSS, FreeBSD)
- [CVE-2020-10132](https://cve.now/CVE-2020-10132.md): CVE-2020-10132 (no CVSS, SearchBlox)
- [CVE-2020-10131](https://cve.now/CVE-2020-10131.md): CVE-2020-10131 (no CVSS, SearchBlox)
- [CVE-2020-10130](https://cve.now/CVE-2020-10130.md): CVE-2020-10130 (no CVSS, SearchBlox)
- [CVE-2020-10129](https://cve.now/CVE-2020-10129.md): CVE-2020-10129 (no CVSS, SearchBlox)
- [CVE-2023-40591](https://cve.now/CVE-2023-40591.md): Denial of service via malicious p2p message in go-ethereum (CVSS 7.5, go-ethereum · github.com/ethereum/go-ethereum)
- [CVE-2023-41050](https://cve.now/CVE-2023-41050.md): Information disclosure through Python's "format" functionality in Zope AccessControl (CVSS 6.8, zopefoundation AccessControl · accesscontrol +1)
- [CVE-2023-41319](https://cve.now/CVE-2023-41319.md): Remote Code Execution in Custom Integration Upload in Fides (CVSS 8.8, ethyca fides · ethyca-fides)
- [CVE-2023-38486](https://cve.now/CVE-2023-38486.md): Hardware Root of Trust Bypass in 9200 and 9000 Series Controllers and Gateways (CVSS 7.7, Hewlett Packard Enterprise (HPE) 9200 Series Mobility Contr…)
- [CVE-2023-38485](https://cve.now/CVE-2023-38485.md): Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways (CVSS 8.0, Hewlett Packard Enterprise (HPE) 9200 Series Mobility Contr…)
- [CVE-2023-38484](https://cve.now/CVE-2023-38484.md): Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways (CVSS 8.0, Hewlett Packard Enterprise (HPE) 9200 Series Mobility Contr…)
- [CVE-2023-41328](https://cve.now/CVE-2023-41328.md): Possibility limited SQL injection due to insufficient validation in Frappe (CVSS 4.2, frappe)
- [CVE-2023-39511](https://cve.now/CVE-2023-39511.md): Stored Cross-Site-Scripting on reports\_admin.php device name in Cacti (CVSS 6.1, cacti)
- [CVE-2023-41330](https://cve.now/CVE-2023-41330.md): Unsafe deserialization in knplabs/knp-snappy (CVSS 9.8, KnpLabs snappy · knplabs/knp-snappy)
- [CVE-2023-0925](https://cve.now/CVE-2023-0925.md): Software AG webMethods OneData Deserialization Vulnerability (no CVSS, Software AG webMethods OneData)
- [CVE-2023-20263](https://cve.now/CVE-2023-20263.md): A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker… (CVSS 4.7, Cisco HyperFlex HX Data Platform)
- [CVE-2023-20269](https://cve.now/CVE-2023-20269.md): A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD (CVSS 5.0, KEV, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2023-20238](https://cve.now/CVE-2023-20238.md): A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended… (CVSS 10.0, Cisco BroadWorks)
- [CVE-2023-20243](https://cve.now/CVE-2023-20243.md): A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote… (CVSS 8.6, Cisco Identity Services Engine Software)
- [CVE-2023-20250](https://cve.now/CVE-2023-20250.md): A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an… (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-4498](https://cve.now/CVE-2023-4498.md): Authentication Bypass in Tenda N300 Wireless N VDSL2 Modem Router (no CVSS, Tenda N300 Wireless N VDSL2 Modem Router)
- [CVE-2023-4623](https://cve.now/CVE-2023-4623.md): Use-after-free in Linux kernel's net/sched: sch\_hfsc (HFSC qdisc traffic control) component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4622](https://cve.now/CVE-2023-4622.md): Use-after-free in Linux kernel's af\_unix component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4244](https://cve.now/CVE-2023-4244.md): Use-after-free in Linux kernel's netfilter: nf\_tables component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4208](https://cve.now/CVE-2023-4208.md): Use-after-free in Linux kernel's net/sched: cls\_u32 component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4207](https://cve.now/CVE-2023-4207.md): Use-after-free in Linux kernel's net/sched: cls\_fw component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4206](https://cve.now/CVE-2023-4206.md): Use-after-free in Linux kernel's net/sched: cls\_route component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4015](https://cve.now/CVE-2023-4015.md): Use-after-free in Linux kernel's netfilter: nf\_tables component (CVSS 7.8, Linux Kernel)
- [CVE-2023-3777](https://cve.now/CVE-2023-3777.md): Use-after-free in Linux kernel's netfilter: nf\_tables component (CVSS 7.8, Linux Kernel)
- [CVE-2023-32672](https://cve.now/CVE-2023-32672.md): Apache Superset: SQL parser edge case bypasses data access authorization (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2021-21088](https://cve.now/CVE-2021-21088.md): Adobe Acrobat Pro DC Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-36036](https://cve.now/CVE-2021-36036.md): Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution (CVSS 7.2, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2021-36021](https://cve.now/CVE-2021-36021.md): Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution (CVSS 7.2, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2021-39859](https://cve.now/CVE-2021-39859.md): Use After Free Adobe Acrobat Pro DC \[HB-21-0339\] (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-36023](https://cve.now/CVE-2021-36023.md): Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution (CVSS 9.1, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2021-36060](https://cve.now/CVE-2021-36060.md): Adobe Media Encoder MPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Media Encoder)
- [CVE-2021-35980](https://cve.now/CVE-2021-35980.md): Adobe Acrobat Reader SpellDictionaryExport Path Traversal Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-28644](https://cve.now/CVE-2021-28644.md): Adobe Acrobat SpellDictionaryCreate Path Traversal Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-37941](https://cve.now/CVE-2023-37941.md): Apache Superset: Metadata db write access can lead to remote code execution (CVSS 6.6, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-39265](https://cve.now/CVE-2023-39265.md): Apache Superset: Possible Unauthorized Registration of SQLite Database Connections (CVSS 3.8, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-39264](https://cve.now/CVE-2023-39264.md): Apache Superset: Stack traces enabled by default (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-27523](https://cve.now/CVE-2023-27523.md): Apache Superset: Improper data permission validation on Jinja templated queries (CVSS 5.0, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-36388](https://cve.now/CVE-2023-36388.md): Apache Superset: Improper API permission for low privilege users allows for SSRF (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-27526](https://cve.now/CVE-2023-27526.md): Apache Superset: Improper Authorization check on import charts (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-41150](https://cve.now/CVE-2023-41150.md): F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. (no CVSS, Thinkingreed F-RevoCRM)
- [CVE-2023-41149](https://cve.now/CVE-2023-41149.md): F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. (no CVSS, Thinkingreed F-RevoCRM)
- [CVE-2023-36387](https://cve.now/CVE-2023-36387.md): Apache Superset: Improper API permission for low privilege users (CVSS 5.4, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-41947](https://cve.now/CVE-2023-41947.md): A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to… (no CVSS, Jenkins Project Jenkins Frugal Testing Plugin · io.jenkins.…)
- [CVE-2023-41946](https://cve.now/CVE-2023-41946.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal… (no CVSS, Jenkins Project Jenkins Frugal Testing Plugin · io.jenkins.…)
- [CVE-2023-41945](https://cve.now/CVE-2023-41945.md): Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT… (no CVSS, Jenkins Project Jenkins Assembla Auth Plugin · org.jenkins-…)
- [CVE-2023-41944](https://cve.now/CVE-2023-41944.md): Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when… (no CVSS, Jenkins Project Jenkins AWS CodeCommit Trigger Plugin · org…)
- [CVE-2023-41943](https://cve.now/CVE-2023-41943.md): Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with… (no CVSS, Jenkins Project Jenkins AWS CodeCommit Trigger Plugin · org…)
- [CVE-2023-41942](https://cve.now/CVE-2023-41942.md): A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear… (no CVSS, Jenkins Project Jenkins AWS CodeCommit Trigger Plugin · org…)
- [CVE-2023-41941](https://cve.now/CVE-2023-41941.md): A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to… (no CVSS, Jenkins Project Jenkins AWS CodeCommit Trigger Plugin · org…)
- [CVE-2023-41940](https://cve.now/CVE-2023-41940.md): Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability… (no CVSS, Jenkins Project Jenkins TAP Plugin · org.tap4j:tap)
- [CVE-2023-41939](https://cve.now/CVE-2023-41939.md): Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users… (CVSS 8.8, Jenkins Project Jenkins SSH2 Easy Plugin · org.jenkins-ci.p…)
- [CVE-2023-41938](https://cve.now/CVE-2023-41938.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules. (no CVSS, Jenkins Project Jenkins Ivy Plugin · org.jenkins-ci.plugins…)
- [CVE-2023-41937](https://cve.now/CVE-2023-41937.md): Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload… (no CVSS, Jenkins Project Jenkins Bitbucket Push and Pull Request Plu…)
- [CVE-2023-41936](https://cve.now/CVE-2023-41936.md): Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected… (no CVSS, Jenkins Project Jenkins Google Login Plugin · org.jenkins-c…)
- [CVE-2023-41935](https://cve.now/CVE-2023-41935.md): Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b\_1154b\_3fb\_, uses a non-constant time comparison function when… (no CVSS, Jenkins Project Jenkins Azure AD Plugin · org.jenkins-ci.pl…)
- [CVE-2023-41934](https://cve.now/CVE-2023-41934.md): Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames… (no CVSS, Jenkins Project Jenkins Pipeline Maven Integration Plugin ·…)
- [CVE-2023-41933](https://cve.now/CVE-2023-41933.md): Jenkins Job Configuration History Plugin 1227.v7a\_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity… (no CVSS, Jenkins Project Jenkins Job Configuration History Plugin ·…)
- [CVE-2023-41932](https://cve.now/CVE-2023-41932.md): Jenkins Job Configuration History Plugin 1227.v7a\_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple… (no CVSS, Jenkins Project Jenkins Job Configuration History Plugin ·…)
- [CVE-2023-41931](https://cve.now/CVE-2023-41931.md): Jenkins Job Configuration History Plugin 1227.v7a\_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from… (no CVSS, Jenkins Project Jenkins Job Configuration History Plugin ·…)
- [CVE-2023-41930](https://cve.now/CVE-2023-41930.md): Jenkins Job Configuration History Plugin 1227.v7a\_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a… (no CVSS, Jenkins Project Jenkins Job Configuration History Plugin ·…)
- [CVE-2023-4589](https://cve.now/CVE-2023-4589.md): Insufficient verification of data authenticity vulnerability in Delinea Secret Server (CVSS 9.1, Delinea Secret Server)
- [CVE-2023-4588](https://cve.now/CVE-2023-4588.md): File accessibility vulnerability in Delinea Secret Server (CVSS 6.8, Delinea Secret Server)
- [CVE-2023-36489](https://cve.now/CVE-2023-36489.md): Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. (no CVSS, TP-LINK TL-WR802N · TP-LINK TL-WR841N +1)
- [CVE-2023-31188](https://cve.now/CVE-2023-31188.md): Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. (CVSS 8.0, TP-LINK Archer C50 · TP-LINK Archer C55 +1)
- [CVE-2023-32619](https://cve.now/CVE-2023-32619.md): Archer C50 firmware versions prior to 'Archer C50(JP)\_V3\_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)\_V1\_230506' use… (CVSS 8.8, TP-LINK Archer C50 · TP-LINK Archer C55)
- [CVE-2023-37284](https://cve.now/CVE-2023-37284.md): Improper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP)\_V1\_230616' allows a network-adjacent… (no CVSS, TP-LINK Archer C20)
- [CVE-2023-38563](https://cve.now/CVE-2023-38563.md): Archer C1200 firmware versions prior to 'Archer C1200(JP)\_V2\_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)\_V3\_230508'… (no CVSS, TP-LINK Archer C1200 · TP-LINK Archer C9)
- [CVE-2023-38568](https://cve.now/CVE-2023-38568.md): Archer A10 firmware versions prior to 'Archer A10(JP)\_V2\_230504' allows a network-adjacent unauthenticated attacker to execute arbitrary… (no CVSS, TP-LINK Archer A10)
- [CVE-2023-38588](https://cve.now/CVE-2023-38588.md): Archer C3150 firmware versions prior to 'Archer C3150(JP)\_V2\_230511' allows a network-adjacent authenticated attacker to execute arbitrary… (CVSS 8.0, TP-LINK Archer C3150)
- [CVE-2023-39224](https://cve.now/CVE-2023-39224.md): Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)\_V2\_230602' allow a network-adjacent authenticated… (no CVSS, TP-LINK Archer C5 · TP-LINK Archer C7)
- [CVE-2023-39935](https://cve.now/CVE-2023-39935.md): Archer C5400 firmware versions prior to 'Archer C5400(JP)\_V2\_230506' allows a network-adjacent authenticated attacker to execute arbitrary… (no CVSS, TP-LINK Archer C5400)
- [CVE-2023-40193](https://cve.now/CVE-2023-40193.md): Deco M4 firmware versions prior to 'Deco M4(JP)\_V2\_1.5.8 Build 20230619' allows a network-adjacent authenticated attacker to execute… (no CVSS, TP-LINK Deco M4)
- [CVE-2023-40357](https://cve.now/CVE-2023-40357.md): Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. (CVSS 8.0, TP-LINK Archer AX50 · TP-LINK Archer A10 +2)
- [CVE-2023-40531](https://cve.now/CVE-2023-40531.md): Archer AX6000 firmware versions prior to 'Archer AX6000(JP)\_V1\_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to… (no CVSS, TP-LINK Archer AX6000)
- [CVE-2023-40601](https://cve.now/CVE-2023-40601.md): WordPress Mortgage Calculator Estatik Plugin \<= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Estatik Mortgage Calculator)
- [CVE-2023-40007](https://cve.now/CVE-2023-40007.md): WordPress CT Commerce Plugin \<= 2.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Ujwol Bastakoti CT Commerce)
- [CVE-2023-4634](https://cve.now/CVE-2023-4634.md): Media Library Assistant \<= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution (CVSS 9.8, dglingren Media Library Assistant)
- [CVE-2023-40328](https://cve.now/CVE-2023-40328.md): WordPress Carrot Plugin \<= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Carrrot)
- [CVE-2023-40329](https://cve.now/CVE-2023-40329.md): WordPress Custom Admin Login Page | WPZest Plugin \<= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Custom Admin Login Page | WPZest)
- [CVE-2023-40553](https://cve.now/CVE-2023-40553.md): WordPress Plausible Analytics Plugin \<= 1.3.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, Plausible.io Plausible Analytics)
- [CVE-2023-40554](https://cve.now/CVE-2023-40554.md): WordPress Blog2Social Plugin \<= 7.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Blog2Social, Adenion Blog2Social: Social Media Auto Post &…)
- [CVE-2023-40552](https://cve.now/CVE-2023-40552.md): WordPress Fitness calculators plugin Plugin \<= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Gurcharan Singh Fitness calculators plugin)
- [CVE-2023-40560](https://cve.now/CVE-2023-40560.md): WordPress Schedule Posts Calendar Plugin \<= 5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Greg Ross Schedule Posts Calendar)
- [CVE-2023-30497](https://cve.now/CVE-2023-30497.md): WordPress LINE Notify Plugin \<= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Simon Chuang WP LINE Notify)
- [CVE-2023-29441](https://cve.now/CVE-2023-29441.md): WordPress WebLibrarian Plugin \<= 3.5.8.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Robert Heller WebLibrarian)
- [CVE-2023-4779](https://cve.now/CVE-2023-4779.md): User Submitted Posts – Enable Users to Submit Posts from the Front End \<= 20230811 - Authenticated (Contributor+) Stored Cross-Site… (CVSS 6.4, specialk User Submitted Posts – Enable Users to Submit Post…)
- [CVE-2023-3472](https://cve.now/CVE-2023-3472.md): Use after free vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code. (CVSS 8.6, Panasonic KW Watcher on Windows)
- [CVE-2023-3471](https://cve.now/CVE-2023-3471.md): Buffer overflow vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code. (CVSS 8.6, Panasonic KW Watcher)
- [CVE-2023-35719](https://cve.now/CVE-2023-35719.md): ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability (CVSS 6.8, ManageEngine ADSelfService Plus)
- [CVE-2023-32163](https://cve.now/CVE-2023-32163.md): Wacom Drivers for Windows Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, Wacom Drivers for Windows)
- [CVE-2023-32162](https://cve.now/CVE-2023-32162.md): Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability (CVSS 7.8, Wacom Drivers for Windows)
- [CVE-2023-4773](https://cve.now/CVE-2023-4773.md): WordPress Social Login \<= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, miled WordPress Social Login)
- [CVE-2023-30730](https://cve.now/CVE-2023-30730.md): Implicit intent hijacking vulnerability in Camera prior to versions 11.0.16.43 in Android 11, 12.1.00.30, 12.0.07.53, 12.1.03.10 in… (CVSS 3.3, Samsung Mobile Camera)
- [CVE-2023-30729](https://cve.now/CVE-2023-30729.md): Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic… (CVSS 8.1, Samsung Mobile Samsung Email)
- [CVE-2023-30728](https://cve.now/CVE-2023-30728.md): Intent redirection vulnerability in PackageInstallerCHN prior to version 13.1.03.00 allows local attacker to access arbitrary file. (CVSS 4.4, Samsung Mobile PackageInstallerCHN)
- [CVE-2023-30726](https://cve.now/CVE-2023-30726.md): PendingIntent hijacking vulnerability in GameLauncher prior to version 4.2.59.5 allows local attackers to access data. (CVSS 4.7, Samsung Mobile GameLauncher)
- [CVE-2023-30725](https://cve.now/CVE-2023-30725.md): Improper authentication in LocalProvier of Gallery prior to version 14.5.01.2 allows attacker to access the data in content provider. (CVSS 5.1, Samsung Mobile Gallery)
- [CVE-2023-30724](https://cve.now/CVE-2023-30724.md): Improper authentication in GallerySearchProvider of Gallery prior to version 14.5.01.2 allows attacker to access search history. (CVSS 4.0, Samsung Mobile Gallery)
- [CVE-2023-30723](https://cve.now/CVE-2023-30723.md): Improper input validation vulnerability in Samsung Health prior to version 6.24.2.011 allows attackers to write arbitrary file with… (CVSS 5.5, Samsung Mobile Samsung Health)
- [CVE-2023-30722](https://cve.now/CVE-2023-30722.md): Protection Mechanism Failure in bc\_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.13.5 allows local attacker to… (CVSS 5.5, Samsung Mobile Samsung Blockchain Keystore)
- [CVE-2023-30721](https://cve.now/CVE-2023-30721.md): Insertion of sensitive information into log vulnerability in Locksettings prior to SMR Sep-2023 Release 1 allows a privileged local… (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2023-30720](https://cve.now/CVE-2023-30720.md): PendingIntent hijacking in LmsAssemblyTrackerCTC prior to SMR Sep-2023 Release 1 allows local attacker to gain arbitrary file access. (CVSS 4.7, Samsung Mobile Devices)
- [CVE-2023-30719](https://cve.now/CVE-2023-30719.md): Exposure of Sensitive Information vulnerability in InboundSmsHandler prior to SMR Sep-2023 Release 1 allows local attackers to access… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30718](https://cve.now/CVE-2023-30718.md): Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity prior to SMR Sep-2023 Release 1… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30717](https://cve.now/CVE-2023-30717.md): Sensitive information exposure vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to get unresettable identifiers. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30716](https://cve.now/CVE-2023-30716.md): Improper access control vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to trigger certain commands. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30715](https://cve.now/CVE-2023-30715.md): Improper access control vulnerability in Weather prior to SMR Sep-2023 Release 1 allows attackers to access location information set in… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30714](https://cve.now/CVE-2023-30714.md): Improper authorization vulnerability in FolderContainerDragDelegate in One UI Home prior to SMR Sep-2023 Release 1 allows physical… (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2023-30713](https://cve.now/CVE-2023-30713.md): Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to… (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2023-30712](https://cve.now/CVE-2023-30712.md): Improper input validation in Settings Suggestions prior to SMR Sep-2023 Release 1 allows attackers to launch arbitrary activity. (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2023-30711](https://cve.now/CVE-2023-30711.md): Improper authentication in Phone and Messaging Storage SMR SEP-2023 Release 1 allows attacker to insert arbitrary data to the provider. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30710](https://cve.now/CVE-2023-30710.md): Improper input validation vulnerability in Knox AI prior to SMR Sep-2023 Release 1 allows local attackers to launch privileged activities. (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2023-30709](https://cve.now/CVE-2023-30709.md): Improper access control in Dual Messenger prior to SMR Sep-2023 Release 1 allows local attackers launch activity with system privilege. (CVSS 7.9, Samsung Mobile Devices)
- [CVE-2023-30708](https://cve.now/CVE-2023-30708.md): Improper authentication in SecSettings prior to SMR Sep-2023 Release 1 allows attacker to access Captive Portal Wi-Fi in Reactivation Lock… (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2023-30707](https://cve.now/CVE-2023-30707.md): Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows local… (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30706](https://cve.now/CVE-2023-30706.md): Improper authorization in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows attacker to read arbitrary file with system privilege. (CVSS 7.5, Samsung Mobile Devices)
- [CVE-2023-4719](https://cve.now/CVE-2023-4719.md): Simple Membership \<= 4.3.5 - Reflected Cross-Site Scripting (CVSS 7.2, wpinsider-1 Simple Membership)
- [CVE-2023-34352](https://cve.now/CVE-2023-34352.md): A permissions issue was addressed with improved redaction of sensitive information. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32438](https://cve.now/CVE-2023-32438.md): This issue was addressed with improved checks to prevent unauthorized actions. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-28214](https://cve.now/CVE-2023-28214.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-28215](https://cve.now/CVE-2023-28215.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-32356](https://cve.now/CVE-2023-32356.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-28188](https://cve.now/CVE-2023-28188.md): A denial-of-service issue was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-29166](https://cve.now/CVE-2023-29166.md): A logic issue was addressed with improved state management. (no CVSS, Apple Pro Video Formats)
- [CVE-2023-28212](https://cve.now/CVE-2023-28212.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-32432](https://cve.now/CVE-2023-32432.md): A privacy issue was addressed with improved handling of temporary files. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-28195](https://cve.now/CVE-2023-28195.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS)
- [CVE-2023-32428](https://cve.now/CVE-2023-32428.md): This issue was addressed with improved file handling. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-28208](https://cve.now/CVE-2023-28208.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-28209](https://cve.now/CVE-2023-28209.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-32425](https://cve.now/CVE-2023-32425.md): The issue was addressed with improved memory handling. (no CVSS, Apple watchOS · Apple iOS and iPadOS)
- [CVE-2023-28213](https://cve.now/CVE-2023-28213.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-32370](https://cve.now/CVE-2023-32370.md): A logic issue was addressed with improved validation. (no CVSS, Apple macOS)
- [CVE-2023-32426](https://cve.now/CVE-2023-32426.md): A logic issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-28210](https://cve.now/CVE-2023-28210.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-28211](https://cve.now/CVE-2023-28211.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-27950](https://cve.now/CVE-2023-27950.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-32379](https://cve.now/CVE-2023-32379.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2023-28187](https://cve.now/CVE-2023-28187.md): This issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-32362](https://cve.now/CVE-2023-32362.md): Error handling was changed to not reveal sensitive information. (no CVSS, Apple macOS)
- [CVE-2022-32920](https://cve.now/CVE-2022-32920.md): The issue was addressed with improved checks. (no CVSS, Apple Xcode)
- [CVE-2021-36646](https://cve.now/CVE-2021-36646.md): A Cross Site Scrtpting (XSS) vulnerability in KodExplorer 4.45 allows remote attackers to run arbitrary code via /index.php page. (no CVSS)
- [CVE-2023-41601](https://cve.now/CVE-2023-41601.md): Multiple cross-site scripting (XSS) vulnerabilities in install/index.php of CSZ CMS v1.3.0 allow attackers to execute arbitrary web… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2023-09-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.