# CVEs published 2023-09-07

66 CVEs were published on September 7, 2023: 4 critical, 35 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-40584](https://cve.now/CVE-2023-40584.md): Denial of Service to Argo CD repo-server (CVSS 6.5, argoproj argo-cd · github.com/argoproj/argo-cd/v2 +1)
- [CVE-2023-40029](https://cve.now/CVE-2023-40029.md): Cluster secret might leak in cluster details page in Argo CD (CVSS 9.9, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2023-30908](https://cve.now/CVE-2023-30908.md): A remote authentication bypass issue exists in a OneView API. (CVSS 9.8, Hewlett Packard Enterprise (HPE) HPE OneView)
- [CVE-2023-41316](https://cve.now/CVE-2023-41316.md): HTML Injection with email in Tolgee (CVSS 5.5, tolgee-platform)
- [CVE-2023-20194](https://cve.now/CVE-2023-20194.md): A vulnerability in the ERS API of Cisco ISE could allow an authenticated, remote attacker to read arbitrary files on the underlying operatin (CVSS 4.9, Cisco Identity Services Engine Software)
- [CVE-2023-20193](https://cve.now/CVE-2023-20193.md): A vulnerability in the Embedded Service Router (ESR) of Cisco ISE could allow an authenticated, local attacker to read, write, or delete arb (CVSS 6.0, Cisco Identity Services Engine Software)
- [CVE-2023-4685](https://cve.now/CVE-2023-4685.md): CVE-2023-4685 (CVSS 7.8, Delta Industrial Automation CNCSoft-B DOPSoft)
- [CVE-2023-4528](https://cve.now/CVE-2023-4528.md): JSCAPE MFT Server Unsafe Deserialization on Management Port (CVSS 7.2, Redwood Software JSCAPE MFT Server)
- [CVE-2023-41064](https://cve.now/CVE-2023-41064.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, KEV, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-41061](https://cve.now/CVE-2023-41061.md): A validation issue was addressed with improved logic. (CVSS 7.8, KEV, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2023-40060](https://cve.now/CVE-2023-40060.md): 2FA/MFA Bypass Vulnerability in Serv-U 15.4 and 15.4 Hotfix 1 (CVSS 7.2, SolarWinds Serv-U)
- [CVE-2023-30800](https://cve.now/CVE-2023-30800.md): MikroTik RouterOS Web Interface Heap Corruption (CVSS 7.5, MikroTik RouterOS)
- [CVE-2022-30642](https://cve.now/CVE-2022-30642.md): Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-30639](https://cve.now/CVE-2022-30639.md): Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-30644](https://cve.now/CVE-2022-30644.md): Adobe Illustrator Font Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-30640](https://cve.now/CVE-2022-30640.md): Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-30645](https://cve.now/CVE-2022-30645.md): Adobe Illustrator SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-30643](https://cve.now/CVE-2022-30643.md): Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-30637](https://cve.now/CVE-2022-30637.md): Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-30646](https://cve.now/CVE-2022-30646.md): Adobe Illustrator Font Parsing Out-of-bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-30641](https://cve.now/CVE-2022-30641.md): Adobe Illustrator SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2022-30638](https://cve.now/CVE-2022-30638.md): Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2021-44193](https://cve.now/CVE-2021-44193.md): Adobe After Effects MOV File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe After Effects)
- [CVE-2021-44189](https://cve.now/CVE-2021-44189.md): Adobe After Effects JPEG2000 Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Adobe After Effects)
- [CVE-2021-44195](https://cve.now/CVE-2021-44195.md): Adobe After Effects JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe After Effects)
- [CVE-2021-44194](https://cve.now/CVE-2021-44194.md): Adobe After Effects 3GP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe After Effects)
- [CVE-2021-44192](https://cve.now/CVE-2021-44192.md): Adobe After Effects MOV File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe After Effects)
- [CVE-2021-44190](https://cve.now/CVE-2021-44190.md): Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe After Effects)
- [CVE-2021-44191](https://cve.now/CVE-2021-44191.md): Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe After Effects)
- [CVE-2021-40790](https://cve.now/CVE-2021-40790.md): Adobe Premiere Pro MOV File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Premiere Pro)
- [CVE-2021-40699](https://cve.now/CVE-2021-40699.md): ColdFusion CFIDE Improper Access Control Leads To Privilege Escalation (CVSS 7.4, Adobe ColdFusion)
- [CVE-2021-42734](https://cve.now/CVE-2021-42734.md): Adobe Photoshop TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Photoshop Desktop)
- [CVE-2021-40791](https://cve.now/CVE-2021-40791.md): Adobe Premiere Pro JPEG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Premiere Pro)
- [CVE-2021-42265](https://cve.now/CVE-2021-42265.md): Adobe Premiere Pro MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Premiere Pro)
- [CVE-2021-44188](https://cve.now/CVE-2021-44188.md): Adobe After Effects 3GP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2021-40795](https://cve.now/CVE-2021-40795.md): Adobe Premiere Pro 3GP File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Premiere Pro)
- [CVE-2021-43018](https://cve.now/CVE-2021-43018.md): Adobe Photoshop JPEG2000 Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Photoshop Desktop)
- [CVE-2021-40698](https://cve.now/CVE-2021-40698.md): ColdFusion Use of Inherently Dangerous Function Leads To Security feature bypass (CVSS 7.4, Adobe ColdFusion)
- [CVE-2021-40723](https://cve.now/CVE-2021-40723.md): Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2021-43753](https://cve.now/CVE-2021-43753.md): Adobe Lightroom TIF File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 7.8, Adobe Lightroom Desktop)
- [CVE-2021-43027](https://cve.now/CVE-2021-43027.md): Adobe After Effects TIF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2021-43751](https://cve.now/CVE-2021-43751.md): Adobe Premiere Pro MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Adobe Premiere Pro)
- [CVE-2023-36635](https://cve.now/CVE-2023-36635.md): An improper access control in Fortinet FortiSwitchManager version 7.2.0 through 7.2.2 7.0.0 through 7.0.1 may allow a remote authenticated (CVSS 6.9, Fortinet FortiSwitchManager)
- [CVE-2023-39424](https://cve.now/CVE-2023-39424.md): Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in RDPngFileUpload.dll (CVSS 9.9, Resort Data Processing IRM Next Generation)
- [CVE-2023-39423](https://cve.now/CVE-2023-39423.md): Improper Neutralization of Special Elements used in an SQL Command in RDPData.dll (CVSS 8.6, Resort Data Processing IRM Next Generation)
- [CVE-2023-39422](https://cve.now/CVE-2023-39422.md): Use of Hard-coded Credentials in multiple /irmdata/api/ endpoints (CVSS 6.5, Resort Data Processing IRM Next Generation)
- [CVE-2023-39421](https://cve.now/CVE-2023-39421.md): Use of Hard-coded Credentials in RDPWin.dll (CVSS 7.7, Resort Data Processing IRM Next Generation)
- [CVE-2023-39420](https://cve.now/CVE-2023-39420.md): Use of Hard-coded Credentials in RDPCore.dll (CVSS 9.9, Resort Data Processing IRM Next Generation)
- [CVE-2023-3747](https://cve.now/CVE-2023-3747.md): Insufficient Validation on Override Codes for Always-Enabled WARP Mode (CVSS 5.5, Cloudflare WARP Client)
- [CVE-2023-39240](https://cve.now/CVE-2023-39240.md): ASUS RT-AX55、RT-AX56U\_V2 - Format String - 3 (CVSS 7.2, ASUS RT-AX55 · ASUS RT-AX56U\_V2)
- [CVE-2023-39239](https://cve.now/CVE-2023-39239.md): ASUS RT-AX55、RT-AX56U\_V2、RT-AC86U - Format String - 2 (CVSS 7.2, ASUS RT-AX55 · ASUS RT-AX56U\_V2 +1)
- [CVE-2023-39238](https://cve.now/CVE-2023-39238.md): ASUS RT-AX55、RT-AX56U\_V2 - Format String - 1 (CVSS 7.2, ASUS RT-AX55 · ASUS RT-AX56U\_V2)
- [CVE-2023-39237](https://cve.now/CVE-2023-39237.md): ASUS RT-AC86U - Command injection vulnerability - 5 (CVSS 8.8, ASUS RT-AC86U)
- [CVE-2023-39236](https://cve.now/CVE-2023-39236.md): ASUS RT-AC86U - Command injection vulnerability - 4 (CVSS 8.8, ASUS RT-AC86U)
- [CVE-2023-38033](https://cve.now/CVE-2023-38033.md): ASUS RT-AC86U - Command injection vulnerability - 3 (CVSS 8.8, ASUS RT-AC86U)
- [CVE-2023-38032](https://cve.now/CVE-2023-38032.md): ASUS RT-AC86U - Command injection vulnerability - 2 (CVSS 8.8, ASUS RT-AC86U)
- [CVE-2023-4815](https://cve.now/CVE-2023-4815.md): Missing Authentication for Critical Function in answerdev/answer (CVSS 8.3, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-38031](https://cve.now/CVE-2023-38031.md): ASUS RT-AC86U - Command injection vulnerability - 1 (CVSS 8.8, ASUS RT-AC86U)
- [CVE-2023-34357](https://cve.now/CVE-2023-34357.md): Soar Cloud Ltd. HR Portal - Weak Password Recovery Mechanism for Forgotten Password (CVSS 7.8, Soar Cloud HR Portal)
- [CVE-2023-4792](https://cve.now/CVE-2023-4792.md): Duplicate Post Page Menu & Custom Post Type \<= 2.3.1 - Missing Authorization to Post Duplication (CVSS 4.3, inqsys Duplicate Post Page Menu & Custom Post Type)
- [CVE-2023-4772](https://cve.now/CVE-2023-4772.md): Newsletter \<= 7.8.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, satollo Newsletter – Send awesome emails from WordPress)
- [CVE-2023-37798](https://cve.now/CVE-2023-37798.md): A stored cross-site scripting (XSS) vulnerability in the new REDCap project creation function of Vanderbilt REDCap 13.1.35 allows attackers (no CVSS)
- [CVE-2023-39711](https://cve.now/CVE-2023-39711.md): Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arb (no CVSS)
- [CVE-2023-40942](https://cve.now/CVE-2023-40942.md): Tenda AC9 V3.0BR\_V15.03.06.42\_multi\_TD01 was discovered stack overflow via parameter 'firewall\_value' at url /goform/SetFirewallCfg. (no CVSS)
- [CVE-2023-41161](https://cve.now/CVE-2023-41161.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote attackers to inject arbitrary web script or HTML vi (no CVSS)
- [CVE-2023-41646](https://cve.now/CVE-2023-41646.md): Buttercup v2.20.3 allows attackers to obtain the hash of the master password for the password manager via accessing the file /vaults.json/ (no CVSS, buttercup)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.