# CVEs published 2023-09-03

26 CVEs were published on September 3, 2023: 2 critical, 9 high. Days are UTC.

- [CVE-2023-4745](https://cve.now/CVE-2023-4745.md): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php sql injection (CVSS 6.3, Byzoro Smart S45F Multi-Service Secure Gateway Intelligent…)
- [CVE-2023-4744](https://cve.now/CVE-2023-4744.md): Tenda AC8 formSetDeviceName stack-based overflow (CVSS 9.8, Tenda AC8)
- [CVE-2023-4743](https://cve.now/CVE-2023-4743.md): Dreamer CMS file access (CVSS 3.1, Dreamer CMS)
- [CVE-2023-4742](https://cve.now/CVE-2023-4742.md): IBOS OA export&uid=X sql injection (CVSS 6.3, IBOS OA)
- [CVE-2023-4741](https://cve.now/CVE-2023-4741.md): IBOS OA Delete Logs del sql injection (CVSS 6.3, IBOS OA)
- [CVE-2023-4740](https://cve.now/CVE-2023-4740.md): IBOS OA Delete Draft delDraft&archiveId=0 sql injection (CVSS 6.3, IBOS OA)
- [CVE-2023-4739](https://cve.now/CVE-2023-4739.md): Byzoro Smart S85F Management Platform updateos.php unrestricted upload (CVSS 6.3, Byzoro Smart S85F Management Platform)
- [CVE-2023-4751](https://cve.now/CVE-2023-4751.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2023-41180](https://cve.now/CVE-2023-41180.md): Apache NiFi MiNiFi C++: Incorrect Certificate Validation in InvokeHTTP for MiNiFi C++ (no CVSS, Apache Software Foundation Apache NiFi MiNiFi C++)
- [CVE-2023-39374](https://cve.now/CVE-2023-39374.md): ForeScout NAC SecureConnector – CWE-427: Uncontrolled Search Path Element (CVSS 7.8, ForeScout NAC SecureConnector)
- [CVE-2023-39373](https://cve.now/CVE-2023-39373.md): Hyundai car CWE-294: Authentication Bypass by Capture-replay (CVSS 7.4, Hyundai model)
- [CVE-2023-39372](https://cve.now/CVE-2023-39372.md): StarTrinity Softswitch version 2023-02-16 - multiple CSRF (CWE-352) (CVSS 8.1, StarTrinity Softswitch)
- [CVE-2023-39371](https://cve.now/CVE-2023-39371.md): StarTrinity Softswitch version 2023-02-16 – Open Redirect (CWE-601) (CVSS 8.8, StarTrinity Softswitch)
- [CVE-2023-39370](https://cve.now/CVE-2023-39370.md): StarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79) (CVSS 8.8, StarTrinity Softswitch)
- [CVE-2023-39369](https://cve.now/CVE-2023-39369.md): StarTrinity Softswitch version 2023-02-16 - multiple Reflected XSS (CWE-79) (CVSS 8.8, StarTrinity Softswitch)
- [CVE-2023-3703](https://cve.now/CVE-2023-3703.md): Proscend Advice ICR Series routers fw version 1.76 (CVSS 10.0, Proscend Advice ICR Series routers FW)
- [CVE-2023-37222](https://cve.now/CVE-2023-37222.md): Farsight Tech Nordic AB ProVide (CVSS 4.8, Farsight Tech Nordic AB ProVide)
- [CVE-2023-37221](https://cve.now/CVE-2023-37221.md): 7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'). (CVSS 8.8, 7Twenty BOT)
- [CVE-2023-37220](https://cve.now/CVE-2023-37220.md): Synel Terminals - CWE-494: Download of Code Without Integrity Check (CVSS 7.2, Synel Terminals)
- [CVE-2023-38476](https://cve.now/CVE-2023-38476.md): WordPress Client Portal : SuiteDash Direct Login Plugin \<= 1.7.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, SuiteDash :: ONE Dashboard® Client Portal : SuiteDash Direc…)
- [CVE-2023-38482](https://cve.now/CVE-2023-38482.md): WordPress Post Affiliate Pro Plugin \<= 1.25.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, QualityUnit Post Affiliate Pro)
- [CVE-2023-38516](https://cve.now/CVE-2023-38516.md): WordPress Audio Player with Playlist Ultimate Plugin \<= 1.2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WP OnlineSupport, Essential Plugin Audio Player with Playli…)
- [CVE-2023-38517](https://cve.now/CVE-2023-38517.md): WordPress WRC Pricing Tables Plugin \<= 2.3.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Realwebcare WRC Pricing Tables)
- [CVE-2023-38518](https://cve.now/CVE-2023-38518.md): WordPress Borderless Plugin \<= 1.4.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Visualmodo Borderless)
- [CVE-2023-38387](https://cve.now/CVE-2023-38387.md): WordPress Elastic Email Sender Plugin \<= 1.2.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Elastic Email Sender)
- [CVE-2023-38521](https://cve.now/CVE-2023-38521.md): WordPress Exifography Plugin \<= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Exifography)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.