CVEs published September 8, 2023
54 CVEs were published on September 8, 2023: 0 critical, 4 high.
- Published
- 54
- Critical
- 0
- High
- 4
- Medium
- 18
- Low
- 3
- Unrated
- 29
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- IBM Aspera Faspex
- 6
- cn.hutool:hutool-core · cn.hutool:hutool-json
- 3
- Go standard library crypto/tls · stdlib
- 2
- Go standard library html/template · stdlib
- 2
- org.jeecgframework.boot:jeecg-boot-parent
- 2
- Cloud Foundry Routing · Cloud Foundry CF Deployment
- 1
- cockpit-hq/cockpit
- 1
- Dell Digital Delivery
- 1
- Go toolchain cmd/go · toolchain
- 1
- gofiber fiber · github.com/gofiber/fiber/v2 +1
- 1
High 4
- CVE-2023-30995IBM Aspera Faspex improper access controlIBM Aspera Faspex
- CVE-2022-33164IBM Security Directory Server path traversalIBM Security Directory Integrator
- CVE-2023-38736IBM QRadar WinCollect Agent privilege escalationIBM QRadar WinCollect Agent
- CVE-2023-4807POLY1305 MAC implementation corrupts XMM registers on WindowsOpenSSL
Medium, low and unrated 50
- CVE-2023-4844SourceCodester Simple Membership System club_edit_query.php sql injectionSourceCodester Simple Membership System
- CVE-2022-22402IBM Aspera Faspex cross-site scriptingIBM Aspera Faspex
- CVE-2022-22401IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2022-22409IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2023-40306URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search)SAP SE SAP S/4HANA
- CVE-2023-24965IBM Aspera Faspex improper access controlIBM Aspera Faspex
- CVE-2022-22405IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2023-32332IBM Maximo Application Suite and IBM Maximo Asset Management HTML injectionIBM Maximo Asset Management · IBM Maximo Application Suite
- CVE-2023-41318Unsafe media served inline on download endpoints in matrix-media-repoturt2live matrix-media-repo · github.com/turt2live/matrix-m…
- CVE-2023-41338Vulnerability in Ctx.IsFromLocal() in gofibergofiber fiber · github.com/gofiber/fiber/v2 +1
- CVE-2023-28010HCL Domino is susceptible to a sensitive information disclosure vulnerabilityHCL Software HCL Domino Server
- CVE-2023-4782Terraform Allows Arbitrary File Write During Init OperationHashiCorp Terraform · github.com/hashicorp/terraform
- CVE-2023-39322Memory exhaustion in QUIC connection handling in crypto/tlsGo standard library crypto/tls · stdlib
- CVE-2023-39321Panic when processing post-handshake message on QUIC connections in crypto/tlsGo standard library crypto/tls · stdlib
- CVE-2023-39319Improper handling of special tags within script contexts in html/templateGo standard library html/template · stdlib
- CVE-2023-39320Arbitrary code execution via go.mod toolchain directive in cmd/goGo toolchain cmd/go · toolchain
- CVE-2023-39318Improper handling of HTML-like comments in script contexts in html/templateGo standard library html/template · stdlib
- CVE-2023-4843Pega Platform versions 7.1 to 8.8.3 are affected by an HTML Injection issue with a name field utilized in Visual Business Director, however Pegasystems Pega Platform
- CVE-2023-4777Incorrect Permission Assignment on Qualys Container Scanning Connector Plugin 1.6.2.6 and earlier Qualys Container Scanning Connector Jenkins Plugin
- CVE-2023-34041CVE-2023-34041-Abuse of HTTP Hop-by-Hop Headers in Cloud Foundry GorouterCloud Foundry Routing · Cloud Foundry CF Deployment
- CVE-2023-41775Improper access control vulnerability in 'direct' Desktop App for macOS ver 2.6.0 and earlier allows a local attacker to bypass access restrL is B 'direct' Desktop App for macOS
- CVE-2023-32470 Dell Digital Delivery versions prior to 5.0.82.0 contain an Insecure Operation on Windows Junction / Mount Point vulnerability.Dell Digital Delivery
- CVE-2014-5329GIGAPOD file servers (Appliance model and Software model) provide two web interfaces, 80/tcp and 443/tcp for user operation, and 8001/tcp foTripodWorks CO. GIGAPOD OFFICEHARD Appliance model · Tri… +1
- CVE-2022-27599QVR Pro ClientQNAP Systems QVR Pro Client
- CVE-2021-27715An issue was discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass the authentication and execute arbitr
- CVE-2021-33834An issue was discovered in iscflashx64.sys 3.9.3.0 in Insyde H2OFFT 6.20.00.
- CVE-2021-45811A SQL injection vulnerability in the "Search" functionality of "tickets.php" page in osTicket 1.15.x allows authenticated attackers to execu
- CVE-2023-36184CMysten Labs Sui blockchain v1.2.0 was discovered to contain a stack overflow via the component /spec/openrpc.json.
- CVE-2023-37367An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos 9820, Exynos 980, Exynos 850, Exynos 108
- CVE-2023-37368An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor, and Modem (Exynos Mobile Processor, Automotive Processor,
- CVE-2023-37377An issue was discovered in Samsung Exynos Mobile Processor and Wearable Processor (Exynos 980, Exynos 850, Exynos 2100, and Exynos W920).
- CVE-2023-37759Incorrect access control in the User Registration page of Crypto Currency Tracker (CCT) before v9.5 allows unauthenticated attackers to regi
- CVE-2023-39076Injecting random data into the USB memory area on a General Motors (GM) Chevrolet Equinox 2021 Software.
- CVE-2023-39584Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.hexo
- CVE-2023-39620An Issue in Buffalo America, Inc.
- CVE-2023-39676FieldPopupNewsletter Prestashop Module v1.0.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the callbac
- CVE-2023-39712Multiple cross-site scripting (XSS) vulnerabilities in Free and Open Source Inventory Management System v1.0 allows attackers to execute arb
- CVE-2023-40271In Trusted Firmware-M through TF-Mv1.8.0, for platforms that integrate the CryptoCell accelerator, when the CryptoCell PSA Driver software I
- CVE-2023-40353An issue was discovered in Exynos Mobile Processor 980 and 2100.
- CVE-2023-40924SolarView Compact < 6.00 is vulnerable to Directory Traversal.
- CVE-2023-40953icms 7.0.16 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2023-41564An arbitrary file upload vulnerability in the Upload Asset function of Cockpit CMS v2.6.3 allows attackers to execute arbitrary code via uplcockpit-hq/cockpit
- CVE-2023-41575Multiple stored cross-site scripting (XSS) vulnerabilities in /bbdms/sign-up.php of Blood Bank & Donor Management v2.2 allow attackers to ex
- CVE-2023-41578Jeecg boot up to v3.5.3 was discovered to contain an arbitrary file read vulnerability via the interface /testConnection.org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-41594Dairy Farm Shop Management System Using PHP and MySQL v1.1 was discovered to contain multiple SQL injection vulnerabilities in the Login fun
- CVE-2023-41615Zoo Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities in the Admin sign-in page via the username and p
- CVE-2023-42268Jeecg boot up to v3.5.3 was discovered to contain a SQL injection vulnerability via the component /jeecg-boot/jmreport/show.org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-42276hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonArray.cn.hutool:hutool-core · cn.hutool:hutool-json
- CVE-2023-42277hutool v5.8.21 was discovered to contain a buffer overflow via the component jsonObject.putByPath.cn.hutool:hutool-core · cn.hutool:hutool-json
- CVE-2023-42278hutool v5.8.21 was discovered to contain a buffer overflow via the component JSONUtil.parse().cn.hutool:hutool-core · cn.hutool:hutool-json