# CVEs published 2023-09-06

159 CVEs were published on September 6, 2023: 6 critical, 46 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-38605](https://cve.now/CVE-2023-38605.md): This issue was addressed with improved redaction of sensitive information. (no CVSS, Apple macOS)
- [CVE-2023-40392](https://cve.now/CVE-2023-40392.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS)
- [CVE-2023-38616](https://cve.now/CVE-2023-38616.md): A race condition was addressed with improved state handling. (no CVSS, Apple macOS)
- [CVE-2023-40397](https://cve.now/CVE-2023-40397.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-39967](https://cve.now/CVE-2023-39967.md): Full read and controlled SSRF through URL parameter when testing a request inside wiremock-studio (CVSS 10.0, wiremock)
- [CVE-2023-41327](https://cve.now/CVE-2023-41327.md): Controlled SSRF through URL in the WireMock (CVSS 4.6, wiremock · org.wiremock:wiremock-webhooks-extension)
- [CVE-2023-41329](https://cve.now/CVE-2023-41329.md): Domain restrictions bypass via DNS Rebinding in WireMock and WireMock Studio (CVSS 3.9, wiremock · org.wiremock:wiremock-standalone +3)
- [CVE-2023-41053](https://cve.now/CVE-2023-41053.md): Redis SORT\_RO may bypass ACL configuration (CVSS 3.3, redis)
- [CVE-2023-23623](https://cve.now/CVE-2023-23623.md): Content-Secrity-Policy disabling eval not applied consistently in renderers with sandbox disabled in Electron (CVSS 7.5, electron)
- [CVE-2023-29198](https://cve.now/CVE-2023-29198.md): Context isolation bypass via nested unserializable return value in Electron (CVSS 6.0, electron)
- [CVE-2023-39956](https://cve.now/CVE-2023-39956.md): Electron: Out-of-package code execution when launched with arbitrary cwd (CVSS 6.1, electron)
- [CVE-2023-4809](https://cve.now/CVE-2023-4809.md): pf incorrectly handles multiple IPv6 fragment headers (no CVSS, FreeBSD)
- [CVE-2020-10132](https://cve.now/CVE-2020-10132.md): CVE-2020-10132 (no CVSS, SearchBlox)
- [CVE-2020-10131](https://cve.now/CVE-2020-10131.md): CVE-2020-10131 (no CVSS, SearchBlox)
- [CVE-2020-10130](https://cve.now/CVE-2020-10130.md): CVE-2020-10130 (no CVSS, SearchBlox)
- [CVE-2020-10129](https://cve.now/CVE-2020-10129.md): CVE-2020-10129 (no CVSS, SearchBlox)
- [CVE-2023-40591](https://cve.now/CVE-2023-40591.md): Denial of service via malicious p2p message in go-ethereum (CVSS 7.5, go-ethereum · github.com/ethereum/go-ethereum)
- [CVE-2023-41050](https://cve.now/CVE-2023-41050.md): Information disclosure through Python's "format" functionality in Zope AccessControl (CVSS 6.8, zopefoundation AccessControl · accesscontrol +1)
- [CVE-2023-41319](https://cve.now/CVE-2023-41319.md): Remote Code Execution in Custom Integration Upload in Fides (CVSS 8.8, ethyca fides · ethyca-fides)
- [CVE-2023-38486](https://cve.now/CVE-2023-38486.md): Hardware Root of Trust Bypass in 9200 and 9000 Series Controllers and Gateways (CVSS 7.7, Hewlett Packard Enterprise (HPE) 9200 Series Mobility Contr…)
- [CVE-2023-38485](https://cve.now/CVE-2023-38485.md): Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways (CVSS 8.0, Hewlett Packard Enterprise (HPE) 9200 Series Mobility Contr…)
- [CVE-2023-38484](https://cve.now/CVE-2023-38484.md): Multiple Buffer Overflow Vulnerabilities in BIOS Implementation of 9200 and 9000 Series Controllers and Gateways (CVSS 8.0, Hewlett Packard Enterprise (HPE) 9200 Series Mobility Contr…)
- [CVE-2023-41328](https://cve.now/CVE-2023-41328.md): Possibility limited SQL injection due to insufficient validation in Frappe (CVSS 4.2, frappe)
- [CVE-2023-39511](https://cve.now/CVE-2023-39511.md): Stored Cross-Site-Scripting on reports\_admin.php device name in Cacti (CVSS 6.1, cacti)
- [CVE-2023-41330](https://cve.now/CVE-2023-41330.md): Unsafe deserialization in knplabs/knp-snappy (CVSS 9.8, KnpLabs snappy · knplabs/knp-snappy)
- [CVE-2023-0925](https://cve.now/CVE-2023-0925.md): Software AG webMethods OneData Deserialization Vulnerability (no CVSS, Software AG webMethods OneData)
- [CVE-2023-20263](https://cve.now/CVE-2023-20263.md): A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to (CVSS 4.7, Cisco HyperFlex HX Data Platform)
- [CVE-2023-20269](https://cve.now/CVE-2023-20269.md): A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD (CVSS 5.0, KEV, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2023-20238](https://cve.now/CVE-2023-20238.md): A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Se (CVSS 10.0, Cisco BroadWorks)
- [CVE-2023-20243](https://cve.now/CVE-2023-20243.md): A vulnerability in the RADIUS message processing feature of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote atta (CVSS 8.6, Cisco Identity Services Engine Software)
- [CVE-2023-20250](https://cve.now/CVE-2023-20250.md): A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an authe (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-4498](https://cve.now/CVE-2023-4498.md): Authentication Bypass in Tenda N300 Wireless N VDSL2 Modem Router (no CVSS, Tenda N300 Wireless N VDSL2 Modem Router)
- [CVE-2023-4623](https://cve.now/CVE-2023-4623.md): Use-after-free in Linux kernel's net/sched: sch\_hfsc (HFSC qdisc traffic control) component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4622](https://cve.now/CVE-2023-4622.md): Use-after-free in Linux kernel's af\_unix component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4244](https://cve.now/CVE-2023-4244.md): Use-after-free in Linux kernel's netfilter: nf\_tables component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4208](https://cve.now/CVE-2023-4208.md): Use-after-free in Linux kernel's net/sched: cls\_u32 component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4207](https://cve.now/CVE-2023-4207.md): Use-after-free in Linux kernel's net/sched: cls\_fw component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4206](https://cve.now/CVE-2023-4206.md): Use-after-free in Linux kernel's net/sched: cls\_route component (CVSS 7.8, Linux Kernel)
- [CVE-2023-4015](https://cve.now/CVE-2023-4015.md): Use-after-free in Linux kernel's netfilter: nf\_tables component (CVSS 7.8, Linux Kernel)
- [CVE-2023-3777](https://cve.now/CVE-2023-3777.md): Use-after-free in Linux kernel's netfilter: nf\_tables component (CVSS 7.8, Linux Kernel)
- [CVE-2023-32672](https://cve.now/CVE-2023-32672.md): Apache Superset: SQL parser edge case bypasses data access authorization (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2021-21088](https://cve.now/CVE-2021-21088.md): Adobe Acrobat Pro DC Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-36036](https://cve.now/CVE-2021-36036.md): Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution (CVSS 7.2, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2021-36021](https://cve.now/CVE-2021-36021.md): Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution (CVSS 7.2, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2021-39859](https://cve.now/CVE-2021-39859.md): Use After Free Adobe Acrobat Pro DC \[HB-21-0339\] (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-36023](https://cve.now/CVE-2021-36023.md): Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution (CVSS 9.1, Adobe Commerce · magento/project-community-edition +1)
- [CVE-2021-36060](https://cve.now/CVE-2021-36060.md): Adobe Media Encoder MPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Media Encoder)
- [CVE-2021-35980](https://cve.now/CVE-2021-35980.md): Adobe Acrobat Reader SpellDictionaryExport Path Traversal Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2021-28644](https://cve.now/CVE-2021-28644.md): Adobe Acrobat SpellDictionaryCreate Path Traversal Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-37941](https://cve.now/CVE-2023-37941.md): Apache Superset: Metadata db write access can lead to remote code execution (CVSS 6.6, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-39265](https://cve.now/CVE-2023-39265.md): Apache Superset: Possible Unauthorized Registration of SQLite Database Connections (CVSS 3.8, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-39264](https://cve.now/CVE-2023-39264.md): Apache Superset: Stack traces enabled by default (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-27523](https://cve.now/CVE-2023-27523.md): Apache Superset: Improper data permission validation on Jinja templated queries (CVSS 5.0, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-36388](https://cve.now/CVE-2023-36388.md): Apache Superset: Improper API permission for low privilege users allows for SSRF (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-27526](https://cve.now/CVE-2023-27526.md): Apache Superset: Improper Authorization check on import charts (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-41150](https://cve.now/CVE-2023-41150.md): F-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. (no CVSS, Thinkingreed F-RevoCRM)
- [CVE-2023-41149](https://cve.now/CVE-2023-41149.md): F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. (no CVSS, Thinkingreed F-RevoCRM)
- [CVE-2023-36387](https://cve.now/CVE-2023-36387.md): Apache Superset: Improper API permission for low privilege users (CVSS 5.4, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-41947](https://cve.now/CVE-2023-41947.md): A missing permission check in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers with Overall/Read permission to connect to Frug (no CVSS, Jenkins Project Jenkins Frugal Testing Plugin · io.jenkins.…)
- [CVE-2023-41946](https://cve.now/CVE-2023-41946.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Frugal Testing Plugin 1.1 and earlier allows attackers to connect to Frugal Tes (no CVSS, Jenkins Project Jenkins Frugal Testing Plugin · io.jenkins.…)
- [CVE-2023-41945](https://cve.now/CVE-2023-41945.md): Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permi (no CVSS, Jenkins Project Jenkins Assembla Auth Plugin · org.jenkins-…)
- [CVE-2023-41944](https://cve.now/CVE-2023-41944.md): Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not escape the queue name parameter passed to a form validation URL, when rend (no CVSS, Jenkins Project Jenkins AWS CodeCommit Trigger Plugin · org…)
- [CVE-2023-41943](https://cve.now/CVE-2023-41943.md): Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier does not perform a permission check in an HTTP endpoint, allowing attackers with Ov (no CVSS, Jenkins Project Jenkins AWS CodeCommit Trigger Plugin · org…)
- [CVE-2023-41942](https://cve.now/CVE-2023-41942.md): A cross-site request forgery (CSRF) vulnerability in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers to clear the (no CVSS, Jenkins Project Jenkins AWS CodeCommit Trigger Plugin · org…)
- [CVE-2023-41941](https://cve.now/CVE-2023-41941.md): A missing permission check in Jenkins AWS CodeCommit Trigger Plugin 3.0.12 and earlier allows attackers with Overall/Read permission to enum (no CVSS, Jenkins Project Jenkins AWS CodeCommit Trigger Plugin · org…)
- [CVE-2023-41940](https://cve.now/CVE-2023-41940.md): Jenkins TAP Plugin 2.3 and earlier does not escape TAP file contents, resulting in a stored cross-site scripting (XSS) vulnerability exploit (no CVSS, Jenkins Project Jenkins TAP Plugin · org.tap4j:tap)
- [CVE-2023-41939](https://cve.now/CVE-2023-41939.md): Jenkins SSH2 Easy Plugin 1.4 and earlier does not verify that permissions configured to be granted are enabled, potentially allowing users f (CVSS 8.8, Jenkins Project Jenkins SSH2 Easy Plugin · org.jenkins-ci.p…)
- [CVE-2023-41938](https://cve.now/CVE-2023-41938.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Ivy Plugin 2.5 and earlier allows attackers to delete disabled modules. (no CVSS, Jenkins Project Jenkins Ivy Plugin · org.jenkins-ci.plugins…)
- [CVE-2023-41937](https://cve.now/CVE-2023-41937.md): Jenkins Bitbucket Push and Pull Request Plugin 2.4.0 through 2.8.3 (both inclusive) trusts values provided in the webhook payload, including (no CVSS, Jenkins Project Jenkins Bitbucket Push and Pull Request Plu…)
- [CVE-2023-41936](https://cve.now/CVE-2023-41936.md): Jenkins Google Login Plugin 1.7 and earlier uses a non-constant time comparison function when checking whether the provided and expected tok (no CVSS, Jenkins Project Jenkins Google Login Plugin · org.jenkins-c…)
- [CVE-2023-41935](https://cve.now/CVE-2023-41935.md): Jenkins Azure AD Plugin 396.v86ce29279947 and earlier, except 378.380.v545b\_1154b\_3fb\_, uses a non-constant time comparison function when ch (no CVSS, Jenkins Project Jenkins Azure AD Plugin · org.jenkins-ci.pl…)
- [CVE-2023-41934](https://cve.now/CVE-2023-41934.md): Jenkins Pipeline Maven Integration Plugin 1330.v18e473854496 and earlier does not properly mask (i.e., replace with asterisks) usernames of (no CVSS, Jenkins Project Jenkins Pipeline Maven Integration Plugin ·…)
- [CVE-2023-41933](https://cve.now/CVE-2023-41933.md): Jenkins Job Configuration History Plugin 1227.v7a\_79fc4dc01f and earlier does not configure its XML parser to prevent XML external entity (X (no CVSS, Jenkins Project Jenkins Job Configuration History Plugin ·…)
- [CVE-2023-41932](https://cve.now/CVE-2023-41932.md): Jenkins Job Configuration History Plugin 1227.v7a\_79fc4dc01f and earlier does not restrict 'timestamp' query parameters in multiple endpoint (no CVSS, Jenkins Project Jenkins Job Configuration History Plugin ·…)
- [CVE-2023-41931](https://cve.now/CVE-2023-41931.md): Jenkins Job Configuration History Plugin 1227.v7a\_79fc4dc01f and earlier does not property sanitize or escape the timestamp value from histo (no CVSS, Jenkins Project Jenkins Job Configuration History Plugin ·…)
- [CVE-2023-41930](https://cve.now/CVE-2023-41930.md): Jenkins Job Configuration History Plugin 1227.v7a\_79fc4dc01f and earlier does not restrict the 'name' query parameter when rendering a histo (no CVSS, Jenkins Project Jenkins Job Configuration History Plugin ·…)
- [CVE-2023-4589](https://cve.now/CVE-2023-4589.md): Insufficient verification of data authenticity vulnerability in Delinea Secret Server (CVSS 9.1, Delinea Secret Server)
- [CVE-2023-4588](https://cve.now/CVE-2023-4588.md): File accessibility vulnerability in Delinea Secret Server (CVSS 6.8, Delinea Secret Server)
- [CVE-2023-36489](https://cve.now/CVE-2023-36489.md): Multiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary OS commands. (no CVSS, TP-LINK TL-WR802N · TP-LINK TL-WR841N +1)
- [CVE-2023-31188](https://cve.now/CVE-2023-31188.md): Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. (CVSS 8.0, TP-LINK Archer C50 · TP-LINK Archer C55 +1)
- [CVE-2023-32619](https://cve.now/CVE-2023-32619.md): Archer C50 firmware versions prior to 'Archer C50(JP)\_V3\_230505' and Archer C55 firmware versions prior to 'Archer C55(JP)\_V1\_230506' use ha (CVSS 8.8, TP-LINK Archer C50 · TP-LINK Archer C55)
- [CVE-2023-37284](https://cve.now/CVE-2023-37284.md): Improper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP)\_V1\_230616' allows a network-adjacent unauthen (no CVSS, TP-LINK Archer C20)
- [CVE-2023-38563](https://cve.now/CVE-2023-38563.md): Archer C1200 firmware versions prior to 'Archer C1200(JP)\_V2\_230508' and Archer C9 firmware versions prior to 'Archer C9(JP)\_V3\_230508' allo (no CVSS, TP-LINK Archer C1200 · TP-LINK Archer C9)
- [CVE-2023-38568](https://cve.now/CVE-2023-38568.md): Archer A10 firmware versions prior to 'Archer A10(JP)\_V2\_230504' allows a network-adjacent unauthenticated attacker to execute arbitrary OS (no CVSS, TP-LINK Archer A10)
- [CVE-2023-38588](https://cve.now/CVE-2023-38588.md): Archer C3150 firmware versions prior to 'Archer C3150(JP)\_V2\_230511' allows a network-adjacent authenticated attacker to execute arbitrary O (CVSS 8.0, TP-LINK Archer C3150)
- [CVE-2023-39224](https://cve.now/CVE-2023-39224.md): Archer C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)\_V2\_230602' allow a network-adjacent authenticated at (no CVSS, TP-LINK Archer C5 · TP-LINK Archer C7)
- [CVE-2023-39935](https://cve.now/CVE-2023-39935.md): Archer C5400 firmware versions prior to 'Archer C5400(JP)\_V2\_230506' allows a network-adjacent authenticated attacker to execute arbitrary O (no CVSS, TP-LINK Archer C5400)
- [CVE-2023-40193](https://cve.now/CVE-2023-40193.md): Deco M4 firmware versions prior to 'Deco M4(JP)\_V2\_1.5.8 Build 20230619' allows a network-adjacent authenticated attacker to execute arbitra (no CVSS, TP-LINK Deco M4)
- [CVE-2023-40357](https://cve.now/CVE-2023-40357.md): Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. (CVSS 8.0, TP-LINK Archer AX50 · TP-LINK Archer A10 +2)
- [CVE-2023-40531](https://cve.now/CVE-2023-40531.md): Archer AX6000 firmware versions prior to 'Archer AX6000(JP)\_V1\_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to exe (no CVSS, TP-LINK Archer AX6000)
- [CVE-2023-40601](https://cve.now/CVE-2023-40601.md): WordPress Mortgage Calculator Estatik Plugin \<= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Estatik Mortgage Calculator)
- [CVE-2023-40007](https://cve.now/CVE-2023-40007.md): WordPress CT Commerce Plugin \<= 2.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Ujwol Bastakoti CT Commerce)
- [CVE-2023-4634](https://cve.now/CVE-2023-4634.md): Media Library Assistant \<= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution (CVSS 9.8, dglingren Media Library Assistant)
- [CVE-2023-40328](https://cve.now/CVE-2023-40328.md): WordPress Carrot Plugin \<= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Carrrot)
- [CVE-2023-40329](https://cve.now/CVE-2023-40329.md): WordPress Custom Admin Login Page | WPZest Plugin \<= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Custom Admin Login Page | WPZest)
- [CVE-2023-40553](https://cve.now/CVE-2023-40553.md): WordPress Plausible Analytics Plugin \<= 1.3.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, Plausible.io Plausible Analytics)
- [CVE-2023-40554](https://cve.now/CVE-2023-40554.md): WordPress Blog2Social Plugin \<= 7.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Blog2Social, Adenion Blog2Social: Social Media Auto Post &…)
- [CVE-2023-40552](https://cve.now/CVE-2023-40552.md): WordPress Fitness calculators plugin Plugin \<= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Gurcharan Singh Fitness calculators plugin)
- [CVE-2023-40560](https://cve.now/CVE-2023-40560.md): WordPress Schedule Posts Calendar Plugin \<= 5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Greg Ross Schedule Posts Calendar)
- [CVE-2023-30497](https://cve.now/CVE-2023-30497.md): WordPress LINE Notify Plugin \<= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Simon Chuang WP LINE Notify)
- [CVE-2023-29441](https://cve.now/CVE-2023-29441.md): WordPress WebLibrarian Plugin \<= 3.5.8.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Robert Heller WebLibrarian)
- [CVE-2023-4779](https://cve.now/CVE-2023-4779.md): User Submitted Posts – Enable Users to Submit Posts from the Front End \<= 20230811 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, specialk User Submitted Posts – Enable Users to Submit Post…)
- [CVE-2023-3472](https://cve.now/CVE-2023-3472.md): Use after free vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code. (CVSS 8.6, Panasonic KW Watcher on Windows)
- [CVE-2023-3471](https://cve.now/CVE-2023-3471.md): Buffer overflow vulnerability in Panasonic KW Watcher versions 1.00 through 2.82 may allow attackers to execute arbitrary code. (CVSS 8.6, Panasonic KW Watcher)
- [CVE-2023-35719](https://cve.now/CVE-2023-35719.md): ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability (CVSS 6.8, ManageEngine ADSelfService Plus)
- [CVE-2023-32163](https://cve.now/CVE-2023-32163.md): Wacom Drivers for Windows Link Following Local Privilege Escalation Vulnerability (CVSS 7.8, Wacom Drivers for Windows)
- [CVE-2023-32162](https://cve.now/CVE-2023-32162.md): Wacom Drivers for Windows Incorrect Permission Assignment Local Privilege Escalation Vulnerability (CVSS 7.8, Wacom Drivers for Windows)
- [CVE-2023-4773](https://cve.now/CVE-2023-4773.md): WordPress Social Login \<= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, miled WordPress Social Login)
- [CVE-2023-30730](https://cve.now/CVE-2023-30730.md): Implicit intent hijacking vulnerability in Camera prior to versions 11.0.16.43 in Android 11, 12.1.00.30, 12.0.07.53, 12.1.03.10 in Android (CVSS 3.3, Samsung Mobile Camera)
- [CVE-2023-30729](https://cve.now/CVE-2023-30729.md): Improper Certificate Validation in Samsung Email prior to version 6.1.82.0 allows remote attacker to intercept the network traffic including (CVSS 8.1, Samsung Mobile Samsung Email)
- [CVE-2023-30728](https://cve.now/CVE-2023-30728.md): Intent redirection vulnerability in PackageInstallerCHN prior to version 13.1.03.00 allows local attacker to access arbitrary file. (CVSS 4.4, Samsung Mobile PackageInstallerCHN)
- [CVE-2023-30726](https://cve.now/CVE-2023-30726.md): PendingIntent hijacking vulnerability in GameLauncher prior to version 4.2.59.5 allows local attackers to access data. (CVSS 4.7, Samsung Mobile GameLauncher)
- [CVE-2023-30725](https://cve.now/CVE-2023-30725.md): Improper authentication in LocalProvier of Gallery prior to version 14.5.01.2 allows attacker to access the data in content provider. (CVSS 5.1, Samsung Mobile Gallery)
- [CVE-2023-30724](https://cve.now/CVE-2023-30724.md): Improper authentication in GallerySearchProvider of Gallery prior to version 14.5.01.2 allows attacker to access search history. (CVSS 4.0, Samsung Mobile Gallery)
- [CVE-2023-30723](https://cve.now/CVE-2023-30723.md): Improper input validation vulnerability in Samsung Health prior to version 6.24.2.011 allows attackers to write arbitrary file with Samsung (CVSS 5.5, Samsung Mobile Samsung Health)
- [CVE-2023-30722](https://cve.now/CVE-2023-30722.md): Protection Mechanism Failure in bc\_tui trustlet from Samsung Blockchain Keystore prior to version 1.3.13.5 allows local attacker to execute (CVSS 5.5, Samsung Mobile Samsung Blockchain Keystore)
- [CVE-2023-30721](https://cve.now/CVE-2023-30721.md): Insertion of sensitive information into log vulnerability in Locksettings prior to SMR Sep-2023 Release 1 allows a privileged local attacker (CVSS 4.4, Samsung Mobile Devices)
- [CVE-2023-30720](https://cve.now/CVE-2023-30720.md): PendingIntent hijacking in LmsAssemblyTrackerCTC prior to SMR Sep-2023 Release 1 allows local attacker to gain arbitrary file access. (CVSS 4.7, Samsung Mobile Devices)
- [CVE-2023-30719](https://cve.now/CVE-2023-30719.md): Exposure of Sensitive Information vulnerability in InboundSmsHandler prior to SMR Sep-2023 Release 1 allows local attackers to access certai (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30718](https://cve.now/CVE-2023-30718.md): Improper export of android application components vulnerability in WifiApAutoHotspotEnablingActivity prior to SMR Sep-2023 Release 1 allows (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30717](https://cve.now/CVE-2023-30717.md): Sensitive information exposure vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to get unresettable identifiers. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30716](https://cve.now/CVE-2023-30716.md): Improper access control vulnerability in SVCAgent prior to SMR Sep-2023 Release 1 allows attackers to trigger certain commands. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30715](https://cve.now/CVE-2023-30715.md): Improper access control vulnerability in Weather prior to SMR Sep-2023 Release 1 allows attackers to access location information set in Weat (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30714](https://cve.now/CVE-2023-30714.md): Improper authorization vulnerability in FolderContainerDragDelegate in One UI Home prior to SMR Sep-2023 Release 1 allows physical attackers (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2023-30713](https://cve.now/CVE-2023-30713.md): Improper privilege management vulnerability in FolderLockNotifier in One UI Home prior to SMR Sep-2023 Release 1 allows local attackers to c (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2023-30712](https://cve.now/CVE-2023-30712.md): Improper input validation in Settings Suggestions prior to SMR Sep-2023 Release 1 allows attackers to launch arbitrary activity. (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2023-30711](https://cve.now/CVE-2023-30711.md): Improper authentication in Phone and Messaging Storage SMR SEP-2023 Release 1 allows attacker to insert arbitrary data to the provider. (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30710](https://cve.now/CVE-2023-30710.md): Improper input validation vulnerability in Knox AI prior to SMR Sep-2023 Release 1 allows local attackers to launch privileged activities. (CVSS 8.5, Samsung Mobile Devices)
- [CVE-2023-30709](https://cve.now/CVE-2023-30709.md): Improper access control in Dual Messenger prior to SMR Sep-2023 Release 1 allows local attackers launch activity with system privilege. (CVSS 7.9, Samsung Mobile Devices)
- [CVE-2023-30708](https://cve.now/CVE-2023-30708.md): Improper authentication in SecSettings prior to SMR Sep-2023 Release 1 allows attacker to access Captive Portal Wi-Fi in Reactivation Lock s (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2023-30707](https://cve.now/CVE-2023-30707.md): Improper input validation vulnerability in FileProviderStatusReceiver in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows local attac (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-30706](https://cve.now/CVE-2023-30706.md): Improper authorization in Samsung Keyboard prior to SMR Sep-2023 Release 1 allows attacker to read arbitrary file with system privilege. (CVSS 7.5, Samsung Mobile Devices)
- [CVE-2023-4719](https://cve.now/CVE-2023-4719.md): Simple Membership \<= 4.3.5 - Reflected Cross-Site Scripting (CVSS 7.2, wpinsider-1 Simple Membership)
- [CVE-2023-34352](https://cve.now/CVE-2023-34352.md): A permissions issue was addressed with improved redaction of sensitive information. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-32438](https://cve.now/CVE-2023-32438.md): This issue was addressed with improved checks to prevent unauthorized actions. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-28214](https://cve.now/CVE-2023-28214.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-28215](https://cve.now/CVE-2023-28215.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-32356](https://cve.now/CVE-2023-32356.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-28188](https://cve.now/CVE-2023-28188.md): A denial-of-service issue was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-29166](https://cve.now/CVE-2023-29166.md): A logic issue was addressed with improved state management. (no CVSS, Apple Pro Video Formats)
- [CVE-2023-28212](https://cve.now/CVE-2023-28212.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-32432](https://cve.now/CVE-2023-32432.md): A privacy issue was addressed with improved handling of temporary files. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-28195](https://cve.now/CVE-2023-28195.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS)
- [CVE-2023-32428](https://cve.now/CVE-2023-32428.md): This issue was addressed with improved file handling. (no CVSS, Apple macOS · Apple watchOS +2)
- [CVE-2023-28208](https://cve.now/CVE-2023-28208.md): A logic issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-28209](https://cve.now/CVE-2023-28209.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-32425](https://cve.now/CVE-2023-32425.md): The issue was addressed with improved memory handling. (no CVSS, Apple watchOS · Apple iOS and iPadOS)
- [CVE-2023-28213](https://cve.now/CVE-2023-28213.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-32370](https://cve.now/CVE-2023-32370.md): A logic issue was addressed with improved validation. (no CVSS, Apple macOS)
- [CVE-2023-32426](https://cve.now/CVE-2023-32426.md): A logic issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-28210](https://cve.now/CVE-2023-28210.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-28211](https://cve.now/CVE-2023-28211.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-27950](https://cve.now/CVE-2023-27950.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-32379](https://cve.now/CVE-2023-32379.md): A buffer overflow issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2023-28187](https://cve.now/CVE-2023-28187.md): This issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-32362](https://cve.now/CVE-2023-32362.md): Error handling was changed to not reveal sensitive information. (no CVSS, Apple macOS)
- [CVE-2022-32920](https://cve.now/CVE-2022-32920.md): The issue was addressed with improved checks. (no CVSS, Apple Xcode)
- [CVE-2021-36646](https://cve.now/CVE-2021-36646.md): A Cross Site Scrtpting (XSS) vulnerability in KodExplorer 4.45 allows remote attackers to run arbitrary code via /index.php page. (no CVSS)
- [CVE-2023-41601](https://cve.now/CVE-2023-41601.md): Multiple cross-site scripting (XSS) vulnerabilities in install/index.php of CSZ CMS v1.3.0 allow attackers to execute arbitrary web scripts (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.