CVEs published September 5, 2023
123 CVEs were published on September 5, 2023: 15 critical, 42 high. 1 is now in CISA KEV.
- Published
- 123
- Critical
- 15
- High
- 42
- Medium
- 31
- Low
- 3
- Unrated
- 32
- Now in CISA KEV
- 1
- Fix available
- 38
Most affected products
- Qualcomm Snapdragon
- 35
- cacti
- 17
- Open Automation Software OAS Platform
- 8
- Google Chrome
- 4
- i-PRO Co. VI Web Client
- 4
- SHIRASAGI Project SHIRASAGI
- 3
- IBM Aspera Faspex
- 2
- PHPFusion
- 2
- Salt
- 2
- Unisign Bookreen
- 2
Critical 15
- CVE-2023-4485ARDEREG Sistemas SCADA SQL InjectionARDEREG Sistemas SCADA
- CVE-2023-39361Unauthenticated SQL Injection in graph_view.php in Cacticacti
- CVE-2023-4178Authentication Bypass in Neutron Smart VMSNeutron Smart VMS
- CVE-2023-4531SQLi in Mestavs E-commerce SoftwareMestav Software E-commerce Software
- CVE-2023-4034SQLi in Smartrise Document Management SystemDigita Information Technology Smartrise Document Management…
- CVE-2023-3616SQLi in Mava Softwares Hotel Management SystemMava Software Hotel Management System
- CVE-2023-35072SQLi in Coyav Travels ProagentCoyav Travel Proagent
- CVE-2023-35068SQLi in BMAs Personnel Tracking SystemBMA Personnel Tracking System
- CVE-2023-35065SQLi in Osofts Paint Production ManagementOsoft Paint Production Management
- CVE-2023-3374Privilege Escalation in BookreenUnisign Bookreen
- CVE-2023-40743Apache Axis 1.x (EOL) may allow RCE when untrusted input is passed to getServiceApache Software Foundation Apache Axis · org.apache.axis… +1
- CVE-2023-28581Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-28562Buffer Copy Without Checking Size of Input in QESLQualcomm Snapdragon
- CVE-2017-9453BMC Server Automation before 8.9.01 patch 1 allows Process Spawner command execution because of authentication bypass.
- CVE-2023-36361Audimexee v14.1.7 was discovered to contain a SQL injection vulnerability via the p_table_name parameter.
High 42
- CVE-2023-4487GE Digital CIMPLICITY Process ControlGE Digital CIMPLICITY
- CVE-2023-4763Use after free in Networks in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2023-4762Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page.Google Chrome
- CVE-2023-4761Out of bounds memory access in FedCM in Google Chrome prior to 116.0.5845.179 allowed a remote attacker who had compromised the renderer proGoogle Chrome
- CVE-2023-31132Cacti Privilege Escalationcacti
- CVE-2023-39362Authenticated command injection in SNMP options of a Devicecacti
- CVE-2023-39357A Defect in sql_save() Causes Multiple SQL Injection Vulnerabilities in Cacticacti
- CVE-2023-39358Authenticated SQL injection vulnerability in reports_user.php in Cacticacti
- CVE-2023-39359Authenticated SQL injection vulnerability in graphs.php in Cacticacti
- CVE-2023-4781Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2023-41317Unnamed "Subscription" operation results in Denial-of-Service in apollographql/routerapollographql router · apollo-router
- CVE-2023-3375Unrestricted File Upload in BookreenUnisign Bookreen
- CVE-2023-31242An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072.Open Automation Software OAS Platform
- CVE-2023-34998An authentication bypass vulnerability exists in the OAS Engine functionality of Open Automation Software OAS Platform v18.00.0072.Open Automation Software OAS Platform
- CVE-2023-34353An authentication bypass vulnerability exists in the OAS Engine authentication functionality of Open Automation Software OAS Platform v18.00Open Automation Software OAS Platform
- CVE-2023-2453Local file Inclusion (LFI) in Forum Infusion via Directory TraversalPHPFusion
- CVE-2023-4540DoS in lua-http libraryDaurnimator lua-http
- CVE-2023-28543Out of Bounds read in SNPE LibraryQualcomm Snapdragon
- CVE-2023-33021Use After Free in GraphicsQualcomm Snapdragon
- CVE-2023-33020Improper Authorization in WLAN HostQualcomm Snapdragon
- CVE-2023-33019Improper Authorization in WLAN HostQualcomm Snapdragon
- CVE-2023-33016Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33015Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-28584Improper Authorization in WLAN HostQualcomm Snapdragon
- CVE-2023-28573Improper Validation of Array Index in WLAN HALQualcomm Snapdragon
- CVE-2023-28567Improper Validation of Array Index in WLAN HALQualcomm Snapdragon
- CVE-2023-28565Improper Validation of Array Index in WLAN HALQualcomm Snapdragon
- CVE-2023-28564Use of Out-of-range Pointer Offset in WLAN HALQualcomm Snapdragon
- CVE-2023-28560Buffer Copy Without Checking Size of Input in WLAN HALQualcomm Snapdragon
- CVE-2023-28559Buffer Copy Without Checking Size of Input in WLAN HALQualcomm Snapdragon
- CVE-2023-28558Improper Validation of Array Index in WLAN HALQualcomm Snapdragon
- CVE-2023-28557Improper Validation of Array Index in WLAN HALQualcomm Snapdragon
- CVE-2023-28549Improper Restriction of Operations within the Bounds of a Memory Buffer in WLAN HALQualcomm Snapdragon
- CVE-2023-28548Improper Validation of Array Index in WLAN HALQualcomm Snapdragon
- CVE-2023-28544Buffer Copy without Checking the Size of Input in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-28538Stack-based Buffer Overflow in WIN ProductQualcomm Snapdragon
- CVE-2023-21664Buffer Copy without Checking the Size of Input(Classic Buffer Overflow) in Core PlatformQualcomm Snapdragon
- CVE-2023-21662Buffer Copy without Checking the Size of Input(Classic Buffer Overflow) in Core PlatformQualcomm Snapdragon
- CVE-2023-21653Reachable Assertion in ModemQualcomm Snapdragon
- CVE-2023-21646Reachable Assertion in ModemQualcomm Snapdragon
- CVE-2022-40534Improper Validation of Array Index in AudioQualcomm Snapdragon
- CVE-2022-33275Improper validation of array index in WLAN HALQualcomm Snapdragon
Medium, low and unrated 66
- CVE-2023-4764Incorrect security UI in BFCache in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to spoof the contents of the Omnibox (URGoogle Chrome
- CVE-2023-30534Insecure Deserialization in Cacticacti
- CVE-2023-39364Open redirect in change password functionality in Cacticacti
- CVE-2023-39516Stored Cross-Site-Scripting on data_sources.php debug html-block in Cacticacti
- CVE-2023-39365Unchecked regular expressions can lead to SQL Injection and data leakage in Cacticacti
- CVE-2023-39360Reflected Cross-site Scripting in graphs_new.php in Cacticacti
- CVE-2023-39366Stored Cross-site Scripting in data_sources.php through Device-Name in 'select' input in Cacticacti
- CVE-2023-39510Stored Cross-site Scripting in reports_admin.php through Device-Name in 'select' input in Cacticacti
- CVE-2023-39512Stored Cross-site Scripting on data_sources.php device name view in Cacticacti
- CVE-2023-4310BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability whicBeyondTrust Privileged Remote Access · BeyondTrust Remote S…
- CVE-2023-39513Stored Cross-site Scripting on host.php verbose data-query debug view in Cacticacti
- CVE-2023-39515Stored Cross-site Scripting on data_debug.php datasource path view in Cacticacti
- CVE-2023-39514Stored Cross-site Scripting on graphs.php data template formated name view in Cacticacti
- CVE-2020-10128SearchBlox product before V-9.2.1 is vulnerable to Stored-Cross Site ScriptingSearchBlox
- CVE-2023-32615A file write vulnerability exists in the OAS Engine configuration functionality of Open Automation Software OAS Platform v18.00.0072.Open Automation Software OAS Platform
- CVE-2023-34317An improper input validation vulnerability exists in the OAS Engine User Creation functionality of Open Automation Software OAS Platform v18Open Automation Software OAS Platform
- CVE-2023-34994An improper resource allocation vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAOpen Automation Software OAS Platform
- CVE-2023-32271An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS PlatOpen Automation Software OAS Platform
- CVE-2023-35124An information disclosure vulnerability exists in the OAS Engine configuration management functionality of Open Automation Software OAS PlatOpen Automation Software OAS Platform
- CVE-2023-4778Out-of-bounds Read in gpac/gpacgpac/gpac
- CVE-2023-4480Arbitrary File Read in Fusion File ManagerPHPFusion
- CVE-2023-20898Git Providers can read from the wrong environment because they get the same cache directory base name in Salt masters prior to 3005.2 or 300Salt
- CVE-2023-20897Salt masters prior to 3005.2 or 3006.2 contain a DOS in minion return.Salt
- CVE-2023-38569Stored cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to execute an arbitrary scripSHIRASAGI Project SHIRASAGI
- CVE-2023-36492Reflected cross-site scripting vulnerability in SHIRASAGI prior to v1.18.0 allows a remote unauthenticated attacker to execute an arbitrary SHIRASAGI Project SHIRASAGI
- CVE-2023-40705Stored cross-site scripting vulnerability in Map setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to injei-PRO Co. VI Web Client
- CVE-2023-40535Stored cross-site scripting vulnerability in View setting page of VI Web Client prior to 7.9.6 allows a remote authenticated attacker to inji-PRO Co. VI Web Client
- CVE-2023-39938Reflected cross-site scripting vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to inject an arbitraryi-PRO Co. VI Web Client
- CVE-2023-38574Open redirect vulnerability in VI Web Client prior to 7.9.6 allows a remote unauthenticated attacker to redirect users to arbitrary web sitei-PRO Co. VI Web Client
- CVE-2023-39448Path traversal vulnerability in SHIRASAGI prior to v1.18.0 allows a remote authenticated attacker to alter or create arbitrary files on theSHIRASAGI Project SHIRASAGI
- CVE-2023-21667Buffer Over-read in Bluetooth HOSTQualcomm Snapdragon
- CVE-2023-21663Improper Restrictions of Operations within the Bounds of a Memory Buffer in DisplayQualcomm Snapdragon
- CVE-2023-21655Integer Overflow or Wraparound in DisplayQualcomm Snapdragon
- CVE-2023-21654Improper Restriction of Operations within the Bounds of a Memory Buffer in AudioQualcomm Snapdragon
- CVE-2023-21644Integer Overflow to Buffer Overflow in RILQualcomm Snapdragon
- CVE-2023-21636Improper Validation of Array Index in LinuxQualcomm Snapdragon
- CVE-2022-40524Buffer over-read in ModemQualcomm Snapdragon
- CVE-2022-33220Buffer over-read in Automotive multimediaQualcomm Snapdragon
- CVE-2023-4748Yongyou UFIDA-NC PrintTemplateFileServlet.java path traversalYongyou UFIDA-NC
- CVE-2023-4636WordPress File Sharing Plugin <= 2.0.3 - Authenticated (Admin+) Stored Cross-Site Scriptingdeepakkite File Sharing & Download Manager – User Private F…
- CVE-2023-35906IBM Aspera Faspex security bypassIBM Aspera Faspex
- CVE-2023-22870IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2023-29261IBM Sterling Secure Proxy information disclosureIBM Sterling Secure Proxy
- CVE-2015-1390Aruba AirWave before 8.0.7 allows XSS attacks agsinat an administrator.
- CVE-2015-1391Aruba AirWave before 8.0.7 allows bypass of a CSRF protection mechanism.
- CVE-2015-2201Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows VisualRF remote OS command execution and file disclosure by administrative users.
- CVE-2015-2202Aruba AirWave before 7.7.14.2 and 8.x before 8.0.7 allows administrative users to escalate privileges to root on the underlying OS.
- CVE-2020-35593BMC PATROL Agent through 20.08.00 allows local privilege escalation via vectors involving pconfig +RESTART -host.
- CVE-2021-40546Tenda AC6 US_AC6V4.0RTL_V02.03.01.26_cn.bin allows attackers (who have the administrator password) to cause a denial of service (device cras
- CVE-2022-41763An issue was discovered in NOKIA AMS 9.7.05.
- CVE-2023-34637A stored cross-site scripting (XSS) vulnerability in IsarNet AG IsarFlow v5.23 allows authenticated attackers to execute arbitrary web scrip
- CVE-2023-36307ZPLGFA 1.1.1 allows attackers to cause a panic (because of an integer index out of range during a ConvertToGraphicField call) via an image osimonwaldherr.de/go/zplgfa
- CVE-2023-36308disintegration Imaging 1.6.2 allows attackers to cause a panic (because of an integer index out of range during a Grayscale call) via a crafgithub.com/disintegration/imaging
- CVE-2023-39598Cross Site Scripting vulnerability in IceWarp Corporation WebClient v.10.2.1 allows a remote attacker to execute arbitrary code via a crafte
- CVE-2023-39654abupy up to v0.4.0 was discovered to contain a SQL injection vulnerability via the component abupy.MarketBu.ABuSymbol.search_to_symbol_dict.
- CVE-2023-39681Cuppa CMS v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the email_outgoing parameter at /Configuration.php.
- CVE-2023-40918KnowStreaming 3.3.0 is vulnerable to Escalation of Privileges.
- CVE-2023-41009File Upload vulnerability in adlered bolo-solo v.2.6 allows a remote attacker to execute arbitrary code via a crafted script to the authoriz
- CVE-2023-41012An issue in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code
- CVE-2023-41107TEF portal 2023-07-17 is vulnerable to a persistent cross site scripting (XSS)attack.
- CVE-2023-41108TEF portal 2023-07-17 is vulnerable to authenticated remote code execution.
- CVE-2023-41507Super Store Finder v3.6 was discovered to contain multiple SQL injection vulnerabilities in the store locator component via the products, di
- CVE-2023-41508A hard coded password in Super Store Finder v3.6 allows attackers to access the administration panel.
- CVE-2023-41908Cerebrate before 1.15 lacks the Secure attribute for the session cookie.
- CVE-2023-41909An issue was discovered in FRRouting FRR through 9.0.
- CVE-2023-41910An issue was discovered in lldpd before 1.0.17.