CVEs published September 1, 2023
79 CVEs were published on September 1, 2023: 4 critical, 9 high.
- Published
- 79
- Critical
- 4
- High
- 9
- Medium
- 29
- Low
- 6
- Unrated
- 31
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- GitLab
- 11
- gpac/gpac
- 3
- usememos/memos · github.com/usememos/memos
- 3
- Infosoftbd Clcknshop
- 2
- TOTVS RM
- 2
- Artem Abramovich Art Decoration Shortcode
- 1
- Canonical AccountService
- 1
- Canonical snapd
- 1
- Chop-Chop Coming Soon Chop Chop
- 1
- D-Link DAR-8000-10
- 1
Critical 4
- CVE-2023-1523Using the TIOCLINUX ioctl request, a malicious snap could inject contents into the input of the controlling terminal which could allow it toCanonical snapd
- CVE-2023-4696Improper Access Control in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2023-4695Use of Predictable Algorithm in Random Number Generator in pkp/pkp-libpkp/pkp-lib
- CVE-2023-36328Integer Overflow vulnerability in mp_grow in libtom libtommath before commit beba892bc0d4e4ded4d667ab1d2a94f4d75109a9, allows attackers to e
High 9
- CVE-2023-3297In Ubuntu's accountsservice an unprivileged local attacker can trigger a use-after-free vulnerability in accountsservice by sending a D-Bus Canonical AccountService
- CVE-2023-41049Improper Neutralization of Script in Attributes in @dcl/single-sign-on-clientdecentraland single-sign-on-client · @dcl/single-sign-on-cl…
- CVE-2023-37997WordPress Post List With Featured Image Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)Dharmesh Patel Post List With Featured Image
- CVE-2023-34011WordPress ShopConstruct Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)ShopConstruct
- CVE-2023-37893WordPress Coming Soon Chop Chop Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)Chop-Chop Coming Soon Chop Chop
- CVE-2023-4704External Control of System or Configuration Setting in instantsoft/icms2instantsoft/icms2
- CVE-2023-4697Improper Privilege Management in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2023-4698Improper Input Validation in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2023-28366The broker in Eclipse Mosquitto 1.3.2 through 2.x before 2.0.16 has a memory leak that can be abused remotely when a client sends many QoS 2
Medium, low and unrated 66
- CVE-2023-4714PlayTube Redirect information disclosurePlayTube
- CVE-2023-4713IBOS OA addcomment addComment sql injectionIBOS OA
- CVE-2023-41046Velocity execution without script rights in Xwiki platformxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-4712Xintian Smart Table Integrated Management System AddUpdateRole.aspx sql injectionXintian Smart Table Integrated Management System
- CVE-2023-4711D-Link DAR-8000-10 decodmail.php os command injectionD-Link DAR-8000-10
- CVE-2023-4710TOTVS RM Portal cross site scriptingTOTVS RM
- CVE-2023-4709TOTVS RM Portal Login.aspx cross site scriptingTOTVS RM
- CVE-2023-41051Default functions in VolatileMemory trait lack bounds checks in vm-memoryrust-vmm vm-memory · vm-memory
- CVE-2023-4708Infosoftbd Clcknshop GET Parameter all sql injectionInfosoftbd Clcknshop
- CVE-2023-4707Infosoftbd Clcknshop all cross site scriptingInfosoftbd Clcknshop
- CVE-2022-3407I some cases, when the device is USB-tethered to a host PC, and the device is sharing its mobile network connection with the host PC, if theMotorola Mobility Motorola smartphones
- CVE-2023-4722Integer Overflow or Wraparound in gpac/gpacgpac/gpac
- CVE-2023-4721Out-of-bounds Read in gpac/gpacgpac/gpac
- CVE-2023-4720Floating Point Comparison with Incorrect Operator in gpac/gpacgpac/gpac
- CVE-2023-23763Information disclosure in GitHub Enterprise Server leading to private repository leakageGitHub Enterprise Server
- CVE-2022-22305An improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6 and below; FortiAnalyzer 7.0.2 and below, Fortinet FortiAnalyzer · Fortinet FortiSandbox +1
- CVE-2023-37994WordPress Art Decoration Shortcode Plugin <= 1.5.6 is vulnerable to Cross Site Scripting (XSS)Artem Abramovich Art Decoration Shortcode
- CVE-2023-37986WordPress YourMembership Single Sign On Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)miniOrange YourMembership Single Sign On – YM SSO Login
- CVE-2023-25488WordPress WP Default Feature Image Plugin <= 1.0.1.1 is vulnerable to Cross Site Scripting (XSS)Duc Bui Quang WP Default Feature Image
- CVE-2023-25044WordPress Social Share Boost Plugin <= 4.4 is vulnerable to Cross Site Scripting (XSS)Sumo Social Share Boost
- CVE-2023-25042WordPress oAuth Twitter Feed for Developers Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)Liam Gladdy (Storm Consultancy) oAuth Twitter Feed for Deve…
- CVE-2023-24412WordPress Image Social Feed Plugin Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)Web-Settler Image Social Feed
- CVE-2023-25477WordPress Video Gallery Plugin <= 1.3.12 is vulnerable to Cross Site Scripting (XSS)Yotuwp Video Gallery
- CVE-2023-3210Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2023-3950Cleartext Storage of Sensitive Information in GitLabGitLab
- CVE-2023-4018Direct Request ('Forced Browsing') in GitLabGitLab
- CVE-2023-4378Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2023-4647Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2022-4343Exposure of Sensitive Information to an Unauthorized Actor in GitLabGitLab
- CVE-2023-0120Incorrect Authorization in GitLabGitLab
- CVE-2023-1279URL Redirection to Untrusted Site in GitLabGitLab
- CVE-2023-1555Missing Authorization in GitLabGitLab
- CVE-2023-3205Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2023-3915Incorrect Execution-Assigned Permissions in GitLabGitLab
- CVE-2020-22612Installer RCE on settings file write in MyBB before 1.8.22.
- CVE-2022-44349NAVBLUE S.A.S N-Ops & Crew 22.5-rc.50 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-46527ELSYS ERS 1.5 Sound v2.3.8 was discovered to contain a buffer overflow via the NFC data parser.
- CVE-2023-24674Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter.
- CVE-2023-24675Cross Site Scripting Vulnerability in BluditCMS v.3.14.1 allows attackers to execute arbitrary code via the Categories Friendly URL.
- CVE-2023-36076SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive inform
- CVE-2023-36088Server Side Request Forgery (SSRF) vulnerability in NebulaGraph Studio version 3.7.0, allows remote attackers to gain sensitive information.
- CVE-2023-36100An issue was discovered in IceCMS version 2.0.1, allows attackers to escalate privileges and gain sensitive information via UserID parameter
- CVE-2023-36187Buffer Overflow vulnerability in NETGEAR R6400v2 before version 1.0.4.118, allows remote unauthenticated attackers to execute arbitrary code
- CVE-2023-36326Integer Overflow vulnerability in RELIC before commit 34580d840469361ba9b5f001361cad659687b9ab, allows attackers to execute arbitrary code,
- CVE-2023-36327Integer Overflow vulnerability in RELIC before commit 421f2e91cf2ba42473d4d54daf24e295679e290e, allows attackers to execute arbitrary code a
- CVE-2023-37826A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitra
- CVE-2023-37827A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitra
- CVE-2023-37828A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitra
- CVE-2023-37829A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitra
- CVE-2023-37830A cross-site scripting (XSS) vulnerability in General Solutions Steiner GmbH CASE 3 Taskmanagement V 3.3 allows attackers to execute arbitra
- CVE-2023-39582SQL Injection vulnerability in Chamilo LMS v.1.11 thru v.1.11.20 allows a remote privileged attacker to obtain sensitive information via the
- CVE-2023-39631An issue in LanChain-ai Langchain v.0.0.245 allows a remote attacker to execute arbitrary code via the evaluate function in the numexpr librlangchain · numexpr
- CVE-2023-39685An issue in hjson-java up to v3.0.0 allows attackers to cause a Denial of Service (DoS) via supplying a crafted JSON string.org.hjson:hjson
- CVE-2023-39703A cross site scripting (XSS) vulnerability in the Markdown Editor component of Typora v1.6.7 allows attackers to execute arbitrary code via
- CVE-2023-39710Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arb
- CVE-2023-39714Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arb
- CVE-2023-40239Certain Lexmark devices (such as CS310) before 2023-08-25 allow XXE attacks, leading to information disclosure.
- CVE-2023-40771SQL injection vulnerability in DataEase v.1.18.9 allows a remote attacker to obtain sensitive information via a crafted string outside of thio.dataease:dataease-plugin-common
- CVE-2023-40968Buffer Overflow vulnerability in hzeller timg v.1.5.1 and before allows a remote attacker to cause a denial of service via the 0x61200000045
- CVE-2023-40969Senayan Library Management Systems SLIMS 9 Bulian v9.6.1 is vulnerable to Server Side Request Forgery (SSRF) via admin/modules/bibliography/
- CVE-2023-40970Senayan Library Management Systems SLIMS 9 Bulian v 9.6.1 is vulnerable to SQL Injection via admin/modules/circulation/loan_rules.php.
- CVE-2023-40980File Upload vulnerability in DWSurvey DWSurvey-OSS v.3.2.0 and before allows a remote attacker to execute arbitrary code via the saveimage m
- CVE-2023-41364In tine through 2023.01.14.325, the sort parameter of the /index.php endpoint allows SQL Injection.
- CVE-2023-41627O-RAN Software Community ric-plt-lib-rmr v4.9.0 does not validate the source of the routing tables it receives, potentially allowing attacke
- CVE-2023-41628An issue in O-RAN Software Community E2 G-Release allows attackers to cause a Denial of Service (DoS) by incorrectly initiating the messagin
- CVE-2023-41633Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/fileutil.c.