# CVEs published 2023-10-25

212 CVEs were published on October 25, 2023: 25 critical, 99 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-46668](https://cve.now/CVE-2023-46668.md): Elastic Endpoint Insertion of Sensitive Information into Log File (CVSS 4.6, Elastic Endpoint)
- [CVE-2023-30967](https://cve.now/CVE-2023-30967.md): Gotham Orbital Simulator path traversal (CVSS 9.8, com.palantir.meta:orbital-simulator)
- [CVE-2023-30969](https://cve.now/CVE-2023-30969.md): Palantir Tiles missing authentication on API endpoints (CVSS 8.2, com.palantir.tiles:tiles)
- [CVE-2023-46232](https://cve.now/CVE-2023-46232.md): era-compiler-vyper First Immutable Variable Initialization vulnerability (CVSS 5.3, matter-labs era-compiler-vyper)
- [CVE-2023-46137](https://cve.now/CVE-2023-46137.md): twisted.web has disordered HTTP pipeline response (CVSS 5.3, twisted)
- [CVE-2023-46134](https://cve.now/CVE-2023-46134.md): D-Tale vulnerable to Remote Code Execution through the Custom Filter Input (CVSS 6.1, man-group dtale · dtale)
- [CVE-2023-46233](https://cve.now/CVE-2023-46233.md): crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard (CVSS 9.1, brix crypto-js · crypto-js)
- [CVE-2023-46133](https://cve.now/CVE-2023-46133.md): crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard (CVSS 9.1, entronad crypto-es · crypto-es)
- [CVE-2023-45137](https://cve.now/CVE-2023-45137.md): XWiki Platform XSS with edit right in the create document form for existing pages (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +1)
- [CVE-2023-5574](https://cve.now/CVE-2023-5574.md): Xorg-x11-server: use-after-free bug in damagedestroy (CVSS 7.0, Red Hat Enterprise Linux)
- [CVE-2023-5380](https://cve.now/CVE-2023-5380.md): Xorg-x11-server: use-after-free bug in destroywindow (CVSS 4.7, Red Hat Enterprise Linux)
- [CVE-2023-5367](https://cve.now/CVE-2023-5367.md): Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty (CVSS 7.8, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EX…)
- [CVE-2023-45136](https://cve.now/CVE-2023-45136.md): XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled (CVSS 9.7, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2023-45135](https://cve.now/CVE-2023-45135.md): XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +1)
- [CVE-2023-5044](https://cve.now/CVE-2023-5044.md): Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation (CVSS 7.6, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2023-5043](https://cve.now/CVE-2023-5043.md): Ingress nginx annotation injection causes arbitrary command execution (CVSS 7.6, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2022-4886](https://cve.now/CVE-2022-4886.md): Ingress-nginx \`path\` sanitization can be bypassed with \`log\_format\` directive (CVSS 8.8, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2023-45134](https://cve.now/CVE-2023-45134.md): XWiki Platform XSS vulnerability from account in the create page form via template provider (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +2)
- [CVE-2023-42844](https://cve.now/CVE-2023-42844.md): This issue was addressed with improved handling of symlinks. (no CVSS, Apple macOS)
- [CVE-2023-42852](https://cve.now/CVE-2023-42852.md): A logic issue was addressed with improved checks. (CVSS 8.8, Apple iOS and iPadOS · Apple Safari +3)
- [CVE-2023-41989](https://cve.now/CVE-2023-41989.md): The issue was addressed by restricting options offered on a locked device. (no CVSS, Apple macOS)
- [CVE-2023-40423](https://cve.now/CVE-2023-40423.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42849](https://cve.now/CVE-2023-42849.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-41988](https://cve.now/CVE-2023-41988.md): This issue was addressed by restricting options offered on a locked device. (no CVSS, Apple macOS · Apple watchOS +1)
- [CVE-2023-41072](https://cve.now/CVE-2023-41072.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-42845](https://cve.now/CVE-2023-42845.md): An authentication issue was addressed with improved state management. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-40408](https://cve.now/CVE-2023-40408.md): An inconsistent user interface issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-41976](https://cve.now/CVE-2023-41976.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple iOS and iPadOS · Apple Safari +3)
- [CVE-2023-40449](https://cve.now/CVE-2023-40449.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-40404](https://cve.now/CVE-2023-40404.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple macOS)
- [CVE-2023-40445](https://cve.now/CVE-2023-40445.md): The issue was addressed with improved UI handling. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2023-41254](https://cve.now/CVE-2023-41254.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-41983](https://cve.now/CVE-2023-41983.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple Safari +1)
- [CVE-2023-42842](https://cve.now/CVE-2023-42842.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-42854](https://cve.now/CVE-2023-42854.md): This issue was addressed by removing the vulnerable code. (no CVSS, Apple macOS)
- [CVE-2023-40413](https://cve.now/CVE-2023-40413.md): The issue was addressed with improved handling of caches. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-41982](https://cve.now/CVE-2023-41982.md): This issue was addressed by restricting options offered on a locked device. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-40444](https://cve.now/CVE-2023-40444.md): A permissions issue was addressed with additional restrictions. (no CVSS, Apple macOS)
- [CVE-2023-42438](https://cve.now/CVE-2023-42438.md): An inconsistent user interface issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-40405](https://cve.now/CVE-2023-40405.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS)
- [CVE-2023-40425](https://cve.now/CVE-2023-40425.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 4.4, Apple macOS)
- [CVE-2023-41977](https://cve.now/CVE-2023-41977.md): The issue was addressed with improved handling of caches. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-41077](https://cve.now/CVE-2023-41077.md): An app may be able to access protected user data. (CVSS 5.5, Apple macOS)
- [CVE-2023-42856](https://cve.now/CVE-2023-42856.md): The issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2023-40447](https://cve.now/CVE-2023-40447.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple Safari +3)
- [CVE-2023-41997](https://cve.now/CVE-2023-41997.md): This issue was addressed by restricting options offered on a locked device. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-42841](https://cve.now/CVE-2023-42841.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42857](https://cve.now/CVE-2023-42857.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-41975](https://cve.now/CVE-2023-41975.md): This issue was addressed by removing the vulnerable code. (no CVSS, Apple macOS)
- [CVE-2023-42861](https://cve.now/CVE-2023-42861.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-42850](https://cve.now/CVE-2023-42850.md): The issue was addressed with improved permissions logic. (no CVSS, Apple macOS)
- [CVE-2023-42846](https://cve.now/CVE-2023-42846.md): This issue was addressed by removing the vulnerable code. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2023-40416](https://cve.now/CVE-2023-40416.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-32359](https://cve.now/CVE-2023-32359.md): This issue was addressed with improved redaction of sensitive information. (no CVSS, Apple iOS and iPadOS)
- [CVE-2023-40421](https://cve.now/CVE-2023-40421.md): A permissions issue was addressed with additional restrictions. (no CVSS, Apple macOS)
- [CVE-2023-40401](https://cve.now/CVE-2023-40401.md): The issue was addressed with additional permissions checks. (no CVSS, Apple macOS)
- [CVE-2023-42847](https://cve.now/CVE-2023-42847.md): A logic issue was addressed with improved checks. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-37913](https://cve.now/CVE-2023-37913.md): org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-office-i…)
- [CVE-2023-37912](https://cve.now/CVE-2023-37912.md): XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro (CVSS 10.0, xwiki-rendering · org.xwiki.rendering:xwiki-rendering-ma… +1)
- [CVE-2023-37911](https://cve.now/CVE-2023-37911.md): org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents (CVSS 6.5, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-37910](https://cve.now/CVE-2023-37910.md): org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move (CVSS 8.1, xwiki-platform · org.xwiki.platform:xwiki-platform-attachme…)
- [CVE-2023-5671](https://cve.now/CVE-2023-5671.md): HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. (no CVSS, HP Print and Scan Doctor for Windows)
- [CVE-2023-37909](https://cve.now/CVE-2023-37909.md): Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-menu +1)
- [CVE-2023-37908](https://cve.now/CVE-2023-37908.md): org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability (CVSS 9.1, xwiki-rendering · org.xwiki.rendering:xwiki-rendering-xml)
- [CVE-2023-5472](https://cve.now/CVE-2023-5472.md): Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2023-34447](https://cve.now/CVE-2023-34447.md): iTop XSS vulnerability on pages/UI.php (CVSS 8.8, Combodo iTop)
- [CVE-2023-34446](https://cve.now/CVE-2023-34446.md): iTop XSS vulnerability on pages/preferences.php (CVSS 8.8, Combodo iTop)
- [CVE-2023-42494](https://cve.now/CVE-2023-42494.md): EisBaer Scada - CWE-749: Exposed Dangerous Method or Function (CVSS 7.5, EisBaer Scada)
- [CVE-2023-42493](https://cve.now/CVE-2023-42493.md): EisBaer Scada - CWE-256: Plaintext Storage of a Password (CVSS 7.1, EisBaer Scada)
- [CVE-2023-42492](https://cve.now/CVE-2023-42492.md): EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key (CVSS 7.1, EisBaer Scada)
- [CVE-2023-42490](https://cve.now/CVE-2023-42490.md): EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 7.5, EisBaer Scada)
- [CVE-2023-42489](https://cve.now/CVE-2023-42489.md): EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource (CVSS 7.5, EisBaer Scada)
- [CVE-2023-30912](https://cve.now/CVE-2023-30912.md): A remote code execution issue exists in HPE OneView. (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE OneView)
- [CVE-2023-42488](https://cve.now/CVE-2023-42488.md): EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 7.5, EisBaer Scada)
- [CVE-2023-42491](https://cve.now/CVE-2023-42491.md): EisBaer Scada - CWE-285: Improper Authorization (CVSS 8.8, EisBaer Scada)
- [CVE-2023-46102](https://cve.now/CVE-2023-46102.md): The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands… (CVSS 8.8, Bosch Rexroth AG ctrlX HMI Web Panel - WR21)
- [CVE-2023-45851](https://cve.now/CVE-2023-45851.md): The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. (CVSS 8.8, Bosch Rexroth AG ctrlX HMI Web Panel - WR21)
- [CVE-2023-45321](https://cve.now/CVE-2023-45321.md): The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP… (CVSS 8.3, Bosch Rexroth AG ctrlX HMI Web Panel - WR21)
- [CVE-2023-45220](https://cve.now/CVE-2023-45220.md): The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol… (CVSS 8.8, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-41372](https://cve.now/CVE-2023-41372.md): The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android… (CVSS 7.8, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-41960](https://cve.now/CVE-2023-41960.md): The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the… (CVSS 7.1, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-41255](https://cve.now/CVE-2023-41255.md): The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself… (CVSS 8.8, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-46660](https://cve.now/CVE-2023-46660.md): Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook… (no CVSS, Jenkins Project Jenkins Zanata Plugin · org.jenkins-ci.plug…)
- [CVE-2023-46659](https://cve.now/CVE-2023-46659.md): Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site… (no CVSS, Jenkins Project Jenkins Edgewall Trac Plugin · org.jenkins-…)
- [CVE-2023-46658](https://cve.now/CVE-2023-46658.md): Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided… (no CVSS, Jenkins Project Jenkins MSTeams Webhook Trigger Plugin · io…)
- [CVE-2023-46657](https://cve.now/CVE-2023-46657.md): Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected… (no CVSS, Jenkins Project Jenkins Gogs Plugin · org.jenkins-ci.plugin…)
- [CVE-2023-46656](https://cve.now/CVE-2023-46656.md): Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the… (no CVSS, Jenkins Project Jenkins Multibranch Scan Webhook Trigger Pl…)
- [CVE-2023-46655](https://cve.now/CVE-2023-46655.md): Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are… (no CVSS, Jenkins Project Jenkins CloudBees CD Plugin · org.jenkins-c…)
- [CVE-2023-46654](https://cve.now/CVE-2023-46654.md): Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup… (no CVSS, Jenkins Project Jenkins CloudBees CD Plugin · org.jenkins-c…)
- [CVE-2023-46653](https://cve.now/CVE-2023-46653.md): Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting… (no CVSS, Jenkins Project Jenkins lambdatest-automation Plugin · org.…)
- [CVE-2023-46652](https://cve.now/CVE-2023-46652.md): A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to… (no CVSS, Jenkins Project Jenkins lambdatest-automation Plugin · org.…)
- [CVE-2023-46651](https://cve.now/CVE-2023-46651.md): Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with… (no CVSS, Jenkins Project Jenkins Warnings Plugin · io.jenkins.plugin…)
- [CVE-2023-46650](https://cve.now/CVE-2023-46650.md): Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a… (no CVSS, Jenkins Project Jenkins GitHub Plugin · com.coravy.hudson.p…)
- [CVE-2023-43488](https://cve.now/CVE-2023-43488.md): The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to… (CVSS 7.9, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-45844](https://cve.now/CVE-2023-45844.md): The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android… (CVSS 7.3, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-5717](https://cve.now/CVE-2023-5717.md): Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component (CVSS 7.8, Linux Kernel)
- [CVE-2023-1356](https://cve.now/CVE-2023-1356.md): Reflected Cross-site Scripting In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-4692](https://cve.now/CVE-2023-4692.md): Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution (CVSS 7.5, grub · Red Hat Enterprise Linux)
- [CVE-2023-4693](https://cve.now/CVE-2023-4693.md): Grub2: out-of-bounds read at fs/ntfs.c (CVSS 5.3, Red Hat Enterprise Linux)
- [CVE-2023-27262](https://cve.now/CVE-2023-27262.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-27260](https://cve.now/CVE-2023-27260.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-27261](https://cve.now/CVE-2023-27261.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 5.3, IDAttend Pty IDWeb)
- [CVE-2023-27377](https://cve.now/CVE-2023-27377.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27376](https://cve.now/CVE-2023-27376.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27375](https://cve.now/CVE-2023-27375.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27259](https://cve.now/CVE-2023-27259.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27258](https://cve.now/CVE-2023-27258.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27257](https://cve.now/CVE-2023-27257.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27256](https://cve.now/CVE-2023-27256.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 5.8, IDAttend Pty IDWeb)
- [CVE-2023-27255](https://cve.now/CVE-2023-27255.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-27254](https://cve.now/CVE-2023-27254.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26584](https://cve.now/CVE-2023-26584.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26583](https://cve.now/CVE-2023-26583.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26582](https://cve.now/CVE-2023-26582.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26581](https://cve.now/CVE-2023-26581.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26580](https://cve.now/CVE-2023-26580.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26579](https://cve.now/CVE-2023-26579.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 5.3, IDAttend Pty IDWeb)
- [CVE-2023-26578](https://cve.now/CVE-2023-26578.md): Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application (CVSS 8.8, IDAttend Pty IDWeb)
- [CVE-2023-26577](https://cve.now/CVE-2023-26577.md): Stored Cross-site Scripting In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26576](https://cve.now/CVE-2023-26576.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26575](https://cve.now/CVE-2023-26575.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26574](https://cve.now/CVE-2023-26574.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26573](https://cve.now/CVE-2023-26573.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 8.2, IDAttend Pty IDWeb)
- [CVE-2023-26572](https://cve.now/CVE-2023-26572.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26571](https://cve.now/CVE-2023-26571.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26570](https://cve.now/CVE-2023-26570.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26569](https://cve.now/CVE-2023-26569.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26568](https://cve.now/CVE-2023-26568.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-3010](https://cve.now/CVE-2023-3010.md): Grafana is an open-source platform for monitoring and observability. (CVSS 7.3, Grafana worldmap-panel)
- [CVE-2023-5311](https://cve.now/CVE-2023-5311.md): WP EXtra \<= 6.2 - Missing Authorization to .htaccess File Modification (CVSS 8.8, wpvncom WP EXtra – One Click Optimize)
- [CVE-2023-34056](https://cve.now/CVE-2023-34056.md): VMware vCenter Server Partial Information Disclosure Vulnerability (CVSS 4.3, VMware vCenter Server · VMware Cloud Foundation)
- [CVE-2023-34048](https://cve.now/CVE-2023-34048.md): VMware vCenter Server Out-of-Bounds Write Vulnerability (CVSS 9.8, KEV, VMware vCenter Server · VMware Cloud Foundation)
- [CVE-2023-46158](https://cve.now/CVE-2023-46158.md): IBM WebSphere Application Server session fixation (CVSS 4.9, IBM WebSphere Application Server Liberty)
- [CVE-2023-34085](https://cve.now/CVE-2023-34085.md): User Attribute Disclosure via DynamoDB Data Stores (CVSS 2.6, Ping Identity PingFederate)
- [CVE-2023-39219](https://cve.now/CVE-2023-39219.md): Admin Console Denial of Service via Java class enumeration (CVSS 7.5, Ping Identity PingFederate)
- [CVE-2023-37283](https://cve.now/CVE-2023-37283.md): Authentication Bypass via HTML Form & Identifier First Adapter (CVSS 8.1, Ping Identity PingFederate)
- [CVE-2023-46135](https://cve.now/CVE-2023-46135.md): Panic in SignedPayload::from\_payload (CVSS 5.3, rs-stellar-strkey · stellar-strkey)
- [CVE-2023-38041](https://cve.now/CVE-2023-38041.md): A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. (CVSS 7.8, Ivanti Secure Access Client)
- [CVE-2023-41721](https://cve.now/CVE-2023-41721.md): Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. (CVSS 10.0, Ubiquiti UniFi Network Application)
- [CVE-2023-46123](https://cve.now/CVE-2023-46123.md): jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values (CVSS 5.3, jumpserver)
- [CVE-2023-46119](https://cve.now/CVE-2023-46119.md): Parse Server may crash when uploading file without extension (CVSS 7.5, parse-community parse-server · parse-server)
- [CVE-2023-38845](https://cve.now/CVE-2023-38845.md): An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. (no CVSS)
- [CVE-2023-38846](https://cve.now/CVE-2023-38846.md): An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. (no CVSS)
- [CVE-2023-38847](https://cve.now/CVE-2023-38847.md): An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. (no CVSS)
- [CVE-2023-38848](https://cve.now/CVE-2023-38848.md): An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. (no CVSS)
- [CVE-2023-38849](https://cve.now/CVE-2023-38849.md): An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. (CVSS 7.5)
- [CVE-2023-43905](https://cve.now/CVE-2023-43905.md): Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors. (CVSS 7.5)
- [CVE-2023-43906](https://cve.now/CVE-2023-43906.md): Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2023-43961](https://cve.now/CVE-2023-43961.md): An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an… (CVSS 8.8, cn.dev33:sa-token-core)
- [CVE-2023-44794](https://cve.now/CVE-2023-44794.md): An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. (no CVSS, cn.dev33:sa-token-core)
- [CVE-2023-46345](https://cve.now/CVE-2023-46345.md): Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c. (no CVSS)
- [CVE-2023-46346](https://cve.now/CVE-2023-46346.md): In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop… (CVSS 7.5)
- [CVE-2023-46347](https://cve.now/CVE-2023-46347.md): In the module "Step by Step products Pack" (ndk\_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform… (CVSS 9.8)
- [CVE-2023-46358](https://cve.now/CVE-2023-46358.md): In the module "Referral and Affiliation Program" (referralbyphone) version 3.5.1 and before from Snegurka for PrestaShop, a guest can… (no CVSS)
- [CVE-2023-46396](https://cve.now/CVE-2023-46396.md): Audimex 15.0.0 is vulnerable to Cross Site Scripting (XSS) in /audimex/cgi-bin/wal.fcgi via company parameter search filters. (no CVSS)
- [CVE-2023-46408](https://cve.now/CVE-2023-46408.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_ The 41DD80 function. (no CVSS)
- [CVE-2023-46409](https://cve.now/CVE-2023-46409.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_ 41CC04 function. (no CVSS)
- [CVE-2023-46410](https://cve.now/CVE-2023-46410.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_ The 416F60 function. (no CVSS)
- [CVE-2023-46411](https://cve.now/CVE-2023-46411.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_415258 function. (no CVSS)
- [CVE-2023-46412](https://cve.now/CVE-2023-46412.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_41D998 function. (no CVSS)
- [CVE-2023-46413](https://cve.now/CVE-2023-46413.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_4155DC function. (no CVSS)
- [CVE-2023-46414](https://cve.now/CVE-2023-46414.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_ 41D494… (CVSS 8.8)
- [CVE-2023-46415](https://cve.now/CVE-2023-46415.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_41E588 function. (CVSS 8.8)
- [CVE-2023-46416](https://cve.now/CVE-2023-46416.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_ The 41A414… (CVSS 8.8)
- [CVE-2023-46417](https://cve.now/CVE-2023-46417.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_415498 function. (CVSS 8.8)
- [CVE-2023-46418](https://cve.now/CVE-2023-46418.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_412688 function. (CVSS 8.8)
- [CVE-2023-46419](https://cve.now/CVE-2023-46419.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_415730 function. (CVSS 8.8)
- [CVE-2023-46420](https://cve.now/CVE-2023-46420.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_41590C function. (CVSS 8.8)
- [CVE-2023-46421](https://cve.now/CVE-2023-46421.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_411D00 function. (CVSS 8.8)
- [CVE-2023-46422](https://cve.now/CVE-2023-46422.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_411994 function. (CVSS 8.8)
- [CVE-2023-46423](https://cve.now/CVE-2023-46423.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_417094 function. (CVSS 8.8)
- [CVE-2023-46424](https://cve.now/CVE-2023-46424.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_422BD4 function. (CVSS 8.8)
- [CVE-2023-46518](https://cve.now/CVE-2023-46518.md): Mercury A15 V1.0 20230818\_1.0.3 was discovered to contain a command execution vulnerability via the component cloudDeviceTokenSuccCB. (no CVSS)
- [CVE-2023-46520](https://cve.now/CVE-2023-46520.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function… (CVSS 8.8)
- [CVE-2023-46521](https://cve.now/CVE-2023-46521.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function RegisterRegister. (CVSS 8.8)
- [CVE-2023-46522](https://cve.now/CVE-2023-46522.md): TP-LINK device TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin and TL-WDR7660 2.0.30 were discovered to contain a stack overflow via the… (CVSS 8.8)
- [CVE-2023-46523](https://cve.now/CVE-2023-46523.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function upgradeInfoRegister. (CVSS 8.8)
- [CVE-2023-46525](https://cve.now/CVE-2023-46525.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function loginRegister. (CVSS 8.8)
- [CVE-2023-46526](https://cve.now/CVE-2023-46526.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function resetCloudPwdRegister. (CVSS 8.8)
- [CVE-2023-46527](https://cve.now/CVE-2023-46527.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin and TL-WDR7660 2.0.30 was discovered to contain a stack overflow via the… (CVSS 8.8)
- [CVE-2023-46534](https://cve.now/CVE-2023-46534.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function modifyAccPwdRegister. (CVSS 8.8)
- [CVE-2023-46535](https://cve.now/CVE-2023-46535.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function getResetVeriRegister. (CVSS 8.8)
- [CVE-2023-46536](https://cve.now/CVE-2023-46536.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function chkRegVeriRegister. (CVSS 8.8)
- [CVE-2023-46537](https://cve.now/CVE-2023-46537.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function getRegVeriRegister. (CVSS 8.8)
- [CVE-2023-46538](https://cve.now/CVE-2023-46538.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function chkResetVeriRegister. (CVSS 8.8)
- [CVE-2023-46539](https://cve.now/CVE-2023-46539.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function registerRequestHandle. (CVSS 8.8)
- [CVE-2023-46540](https://cve.now/CVE-2023-46540.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formNtp. (CVSS 8.8)
- [CVE-2023-46541](https://cve.now/CVE-2023-46541.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpv6Setup. (CVSS 8.8)
- [CVE-2023-46542](https://cve.now/CVE-2023-46542.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMeshUploadConfig. (CVSS 8.8)
- [CVE-2023-46543](https://cve.now/CVE-2023-46543.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlSiteSurvey. (CVSS 8.8)
- [CVE-2023-46544](https://cve.now/CVE-2023-46544.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWirelessTbl. (CVSS 8.8)
- [CVE-2023-46545](https://cve.now/CVE-2023-46545.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWsc. (no CVSS)
- [CVE-2023-46546](https://cve.now/CVE-2023-46546.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formStats. (no CVSS)
- [CVE-2023-46547](https://cve.now/CVE-2023-46547.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSysLog. (no CVSS)
- [CVE-2023-46548](https://cve.now/CVE-2023-46548.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlanRedirect. (no CVSS)
- [CVE-2023-46549](https://cve.now/CVE-2023-46549.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSetLg. (no CVSS)
- [CVE-2023-46550](https://cve.now/CVE-2023-46550.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice. (no CVSS)
- [CVE-2023-46551](https://cve.now/CVE-2023-46551.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl. (no CVSS)
- [CVE-2023-46552](https://cve.now/CVE-2023-46552.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAP. (CVSS 8.0)
- [CVE-2023-46553](https://cve.now/CVE-2023-46553.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formParentControl. (CVSS 8.0)
- [CVE-2023-46554](https://cve.now/CVE-2023-46554.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDel. (CVSS 8.8)
- [CVE-2023-46555](https://cve.now/CVE-2023-46555.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPortFw. (CVSS 8.8)
- [CVE-2023-46556](https://cve.now/CVE-2023-46556.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formFilter. (CVSS 8.8)
- [CVE-2023-46557](https://cve.now/CVE-2023-46557.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAPVLAN. (CVSS 8.8)
- [CVE-2023-46558](https://cve.now/CVE-2023-46558.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice. (CVSS 8.8)
- [CVE-2023-46559](https://cve.now/CVE-2023-46559.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIPv6Addr. (CVSS 8.0)
- [CVE-2023-46560](https://cve.now/CVE-2023-46560.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup. (CVSS 8.0)
- [CVE-2023-46562](https://cve.now/CVE-2023-46562.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg. (CVSS 8.0)
- [CVE-2023-46563](https://cve.now/CVE-2023-46563.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS. (CVSS 8.0)
- [CVE-2023-46564](https://cve.now/CVE-2023-46564.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ. (CVSS 8.0)
- [CVE-2023-46583](https://cve.now/CVE-2023-46583.md): Cross-Site Scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows attackers to execute… (no CVSS)
- [CVE-2023-46584](https://cve.now/CVE-2023-46584.md): SQL Injection vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows a remote attacker to escalate… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2023-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.