CVEs published September 12, 2023
157 CVEs were published on September 12, 2023: 8 critical, 79 high. 3 are now in CISA KEV.
- Published
- 157
- Critical
- 8
- High
- 79
- Medium
- 41
- Low
- 5
- Unrated
- 24
- Now in CISA KEV
- 3
- Fix available
- 89
Most affected products
- Microsoft Windows
- 17
- Google Chrome
- 10
- Siemens QMS Automotive
- 9
- Siemens JT2Go · Siemens Teamcenter Visualization +1
- 7
- BlackBerry AtHoc
- 4
- Microsoft 3D Builder
- 4
- Wing FTP Server
- 4
- Control de Ciber
- 3
- Honeywell PM23/43 · Honeywell PC23/43, PD43 +7
- 3
- Microsoft 3D Viewer
- 3
Critical 8
- CVE-2023-41331SOFARPC Remote Command Execution (RCE) Vulnerabilitysofastack sofa-rpc
- CVE-2023-3710Printer web page invalid command executionHoneywell PM23/43 · Honeywell PC23/43, PD43 +7
- CVE-2023-4501Authentication bypass in OpenText (Micro Focus) Enterprise ServerOpenText Visual COBOL, COBOL Server, Enterprise Developer,…
- CVE-2023-2071FactoryTalk View Machine Edition Vulnerable to Remote Code ExecutionRockwell Automation Fa
- CVE-2022-24093Adobe Commerce post-auth improper input validation leads to remote code executionAdobe Commerce · magento/community-edition +1
- CVE-2023-40309Missing Authorization check in SAP CommonCryptoLibSAP_SE SAP CommonCryptoLib · SAP_SE SAP NetWeaver AS ABA… +6
- CVE-2023-40622Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)SAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2023-40784DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php.
High 79
- CVE-2023-39201Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local aZoom Video Communications CleanZoom
- CVE-2023-39215Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access.Zoom Video Communications Zoom Clients
- CVE-2023-41036Macvim's Insecure Usage of IPC Mechanismsmacvim-dev macvim
- CVE-2023-4921Use-after-free in Linux kernel's net/sched: sch_qfq componentLinux Kernel
- CVE-2023-4918Plaintext storage of user passwordkeycloak · Red Hat Single Sign-On +1
- CVE-2023-367393D Viewer Remote Code Execution VulnerabilityMicrosoft 3D Viewer
- CVE-2023-367403D Viewer Remote Code Execution VulnerabilityMicrosoft 3D Viewer
- CVE-2023-367603D Viewer Remote Code Execution VulnerabilityMicrosoft 3D Viewer
- CVE-2023-36762Microsoft Word Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Office +2
- CVE-2023-36763Microsoft Outlook Information Disclosure VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2023-36764Microsoft SharePoint Server Elevation of Privilege VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2023-367703D Builder Remote Code Execution VulnerabilityMicrosoft 3D Builder
- CVE-2023-367713D Builder Remote Code Execution VulnerabilityMicrosoft 3D Builder
- CVE-2023-367723D Builder Remote Code Execution VulnerabilityMicrosoft 3D Builder
- CVE-2023-367733D Builder Remote Code Execution VulnerabilityMicrosoft 3D Builder
- CVE-2023-36788.NET Framework Remote Code Execution VulnerabilityMicrosoft .NET Framework 3.5 AND · Microsoft .NET Framew… +2
- CVE-2023-36792Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio · Microsoft .NET +4
- CVE-2023-36793Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio · Microsoft .NET +4
- CVE-2023-36794Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio · Microsoft PowerShell +4
- CVE-2023-36796Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio · Microsoft .NET +4
- CVE-2023-36800Dynamics Finance and Operations Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 for Finance and Operations
- CVE-2023-38155Azure DevOps Server Remote Code Execution VulnerabilityMicrosoft Azure DevOps Server
- CVE-2023-38163Windows Defender Attack Surface Reduction Security Feature BypassMicrosoft Defender Security Intelligence Updates
- CVE-2023-38164Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-36886Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-33136Azure DevOps Server Remote Code Execution VulnerabilityMicrosoft Azure DevOps Server
- CVE-2023-29332Microsoft Azure Kubernetes Service Elevation of Privilege VulnerabilityMicrosoft Azure Kubernetes Service
- CVE-2023-36742Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2023-36744Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Microsof…
- CVE-2023-36745Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Microsof…
- CVE-2023-36756Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Microsof…
- CVE-2023-36757Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Microsof…
- CVE-2023-36758Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2023-36765Microsoft Office Elevation of Privilege VulnerabilityMicrosoft Office
- CVE-2023-36766Microsoft Excel Information Disclosure VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2023-36802Microsoft Streaming Service Proxy Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36804Windows GDI Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36805Windows MSHTML Platform Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-38139Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-38141Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-38142Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-38143Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-38144Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-38146Windows Themes Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-38147Windows Miracast Wireless Display Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-38148Internet Connection Sharing (ICS) Remote Code Execution VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2023-38149Windows TCP/IP Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-38150Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-38156Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege VulnerabilityMicrosoft Azure HDInsight
- CVE-2023-38161Windows GDI Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-38162DHCP Server Service Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2023-35355Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-29463Pavilion8 Security Misconfiguration VulnerabilityRockwell Automation Pavilion8
- CVE-2023-4863Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of boGoogle Chrome · Google libwebp +13
- CVE-2023-41846A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions < V2201.0008), Tecnomatix Plant Simulation V2302 (AllSiemens Tecnomatix Plant Simulation
- CVE-2023-41033A vulnerability has been identified in Parasolid V35.0 (All versions < V35.0.260), Parasolid V35.1 (All versions < V35.1.246), Parasolid V36Siemens Parasolid · Siemens Simcenter Femap
- CVE-2023-41032A vulnerability has been identified in Parasolid V34.1 (All versions < V34.1.258), Parasolid V35.0 (All versions < V35.0.253), Parasolid V35Siemens Parasolid · Siemens Simcenter Femap
- CVE-2023-40730A vulnerability has been identified in QMS Automotive (All versions < V12.39).Siemens QMS Automotive
- CVE-2023-40729A vulnerability has been identified in QMS Automotive (All versions < V12.39).Siemens QMS Automotive
- CVE-2023-40728A vulnerability has been identified in QMS Automotive (All versions < V12.39).Siemens QMS Automotive
- CVE-2023-40727A vulnerability has been identified in QMS Automotive (All versions < V12.39).Siemens QMS Automotive
- CVE-2023-40726A vulnerability has been identified in QMS Automotive (All versions < V12.39).Siemens QMS Automotive
- CVE-2023-40724A vulnerability has been identified in QMS Automotive (All versions < V12.39).Siemens QMS Automotive
- CVE-2023-38076A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization +1
- CVE-2023-38075A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization +1
- CVE-2023-38074A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization +1
- CVE-2023-38073A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization +1
- CVE-2023-38072A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization +1
- CVE-2023-38071A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization +1
- CVE-2023-38070A vulnerability has been identified in JT2Go (All versions < V14.3.0.1), Teamcenter Visualization V13.3 (All versions < V13.3.0.12), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization +1
- CVE-2023-28831The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application Siemens SIMATIC BRAUMAT · Siemens SIMATIC Cloud Connect… +70
- CVE-2023-4759Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file writeEclipse Foundation Eclipse JGit · org.eclipse.jgit:org.ecli…
- CVE-2022-48475Buffer Overflow vulnerability in Control de Ciber version 1.650, in the printing function.Control de Ciber
- CVE-2022-48474Control de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function.Control de Ciber
- CVE-2022-4896Cyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the server of pop-up windows with the messages "PNTControl de Ciber
- CVE-2023-3039 SD ROM Utility, versions prior to 1.0.2.0 contain an Improper Access Control vulnerability.Dell SD ROM Utility
- CVE-2023-42472Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)SAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2023-40308Memory Corruption vulnerability in SAP CommonCryptoLibSAP_SE SAP CommonCryptoLib · SAP_SE SAP NetWeaver AS ABA… +6
- CVE-2023-25519 NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrecNVIDIA BlueField
Medium, low and unrated 70
- CVE-2023-4813Glibc: potential use-after-free in gaih_inet()Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…
- CVE-2023-4909Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI viaGoogle Chrome
- CVE-2023-4908Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI viGoogle Chrome
- CVE-2023-4907Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UGoogle Chrome
- CVE-2023-4906Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Autofill restrictionGoogle Chrome
- CVE-2023-4905Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a craftedGoogle Chrome
- CVE-2023-4904Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Enterprise policy rGoogle Chrome
- CVE-2023-4903Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof secGoogle Chrome
- CVE-2023-4902Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted HGoogle Chrome
- CVE-2023-4901Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI vGoogle Chrome
- CVE-2023-4900Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a permGoogle Chrome
- CVE-2023-41885Piccolo's current `BaseUser.login` implementation is vulnerable to time based user enumerationpiccolo-orm piccolo · piccolo
- CVE-2023-3712Potential user privilege escalationHoneywell PM23/43 · Honeywell PC23/43, PD43 +7
- CVE-2023-3711Potential Predictable Session IDHoneywell PM23/43 · Honeywell PC23/43, PD43 +7
- CVE-2023-39208Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of sZoom Video Communications Zoom Desktop Client for Linux
- CVE-2023-21520 A PII Enumeration via Credential Recovery in the Self Service (Credential Recovery) of BlackBerry AtHoc version 7.15 BlackBerry AtHoc
- CVE-2023-21523 A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerrBlackBerry AtHoc
- CVE-2023-30962Stored XSS in cerberus attachmentscom.palantir.acme.cerberus:cerberus
- CVE-2023-21522 A Reflected Cross-site Scripting (XSS) vulnerability in the Management Console (Reports) of BlackBerry AtHoc version 7.15 could allow an atBlackBerry AtHoc
- CVE-2023-21521 An SQL Injection vulnerability in the Management Console (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker tBlackBerry AtHoc
- CVE-2023-36761Microsoft Word Information Disclosure VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2023-36777Microsoft Exchange Server Information Disclosure VulnerabilityMicrosoft Exchange Server 2019 Cumulative Update · Microsof…
- CVE-2023-36799.NET Core and Visual Studio Denial of Service VulnerabilityMicrosoft .NET · Microsoft Visual Studio +7
- CVE-2023-38160Windows TCP/IP Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-41764Microsoft Office Spoofing VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2023-36736Microsoft Identity Linux Broker Remote Code Execution VulnerabilityMicrosoft Identity Linux Broker
- CVE-2023-36759Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2023-36767Microsoft Office Security Feature Bypass VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2023-36801DHCP Server Service Information Disclosure VulnerabilityMicrosoft Windows Server
- CVE-2023-36803Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-38140Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-38152DHCP Server Service Information Disclosure VulnerabilityMicrosoft Windows Server
- CVE-2023-34470Improper access control AMI AptioV
- CVE-2023-34469Cold Rest VulnerabiltiyAMI AptioV
- CVE-2023-0119Foreman: stored cross-site scripting in host tabforeman · Red Hat Satellite 6.13 for RHEL +1
- CVE-2023-4914Relative Path Traversal in cecilapp/cecilcecilapp/cecil · cecil/cecil
- CVE-2023-4913Cross-site Scripting (XSS) - Reflected in cecilapp/cecilcecilapp/cecil · cecil/cecil
- CVE-2023-40712Apache Airflow: Secrets can be unmasked in the "Rendered Template" Apache Software Foundation Apache Airflow · apache-airflow
- CVE-2023-40611Apache Airflow Dag Runs Broken Access Control VulnerabilityApache Software Foundation Apache Airflow · apache-airflow
- CVE-2023-40732A vulnerability has been identified in QMS Automotive (All versions < V12.39).Siemens QMS Automotive
- CVE-2023-40731A vulnerability has been identified in QMS Automotive (All versions < V12.39).Siemens QMS Automotive
- CVE-2023-40725A vulnerability has been identified in QMS Automotive (All versions < V12.39).Siemens QMS Automotive
- CVE-2023-37875Cross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.0Wing FTP Server
- CVE-2023-37878Insecure Default Permissions in Wing FTP Server <= 7.2.0Wing FTP Server
- CVE-2023-37879Exposed Session Variable in Wing FTP Server <= 7.2.0Wing FTP Server
- CVE-2023-37881Weak Access Control between Domains in Wing FTP Server <= 7.2.0Wing FTP Server
- CVE-2023-26142All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values.Crow
- CVE-2023-40621Code Injection vulnerability in SAP PowerDesigner ClientSAP_SE SAP PowerDesigner Client
- CVE-2023-40623Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)SAP_SE SAP BusinessObjects Suite
- CVE-2023-40624Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering)SAP_SE SAP NetWeaver AS ABAP
- CVE-2023-40625Missing Authorization check in SAP Manage Purchase Contracts AppSAP_SE SAP Manage Purchase Contracts App
- CVE-2023-41367Missing Authentication check in SAP NetWeaver (Guided Procedures)SAP_SE SAP NetWeaver
- CVE-2023-41368Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps)SAP_SE S4 HANA ABAP
- CVE-2023-41369External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)SAP_SE SAP S/4HANA · hana-ml
- CVE-2023-4887Google Maps Plugin by Intergeo <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodethemeisle Google Maps Plugin by Intergeo
- CVE-2023-4840MapPress Maps for WordPress <= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodechrisvrichardson MapPress Maps for WordPress
- CVE-2023-4890JQuery Accordion Menu Widget <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcoderemix4 JQuery Accordion Menu Widget
- CVE-2023-4893Crayon Syntax Highlighter <= 2.8.4 - Authenticated (Contributor+) Server Side Request Forgeryakarmenia Crayon Syntax Highlighter
- CVE-2023-32558The use of the deprecated API `process.binding()` can bypass the permission model through path traversal.NodeJS Node
- CVE-2023-32005A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read flaNodeJS Node
- CVE-2023-37489Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System)SAP_SE SAP BusinessObjects Business Intelligence Platform
- CVE-2022-47637The installer in XAMPP through 8.1.12 allows local users to write to the C:\xampp directory.
- CVE-2023-27169Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of a hardcoded and pre
- CVE-2023-39073An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request.
- CVE-2023-39150ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execut
- CVE-2023-39637D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis.
- CVE-2023-40218An issue was discovered in the NPU kernel driver in Samsung Exynos Mobile Processor 9820, 980, 2100, 2200, 1280, and 1380.
- CVE-2023-40834OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthentic
- CVE-2023-41013Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4"
- CVE-2023-41423Cross Site Scripting vulnerability in WP Githuber MD plugin v.1.16.2 allows a remote attacker to execute arbitrary code via a crafted payloa