# CVEs published 2023-09-12

157 CVEs were published on September 12, 2023: 8 critical, 79 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2023-4813](https://cve.now/CVE-2023-4813.md): Glibc: potential use-after-free in gaih\_inet() (CVSS 5.9, Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…)
- [CVE-2023-4909](https://cve.now/CVE-2023-4909.md): Inappropriate implementation in Interstitials in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to obfuscate security UI via (no CVSS, Google Chrome)
- [CVE-2023-4908](https://cve.now/CVE-2023-4908.md): Inappropriate implementation in Picture in Picture in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI vi (no CVSS, Google Chrome)
- [CVE-2023-4907](https://cve.now/CVE-2023-4907.md): Inappropriate implementation in Intents in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate security U (no CVSS, Google Chrome)
- [CVE-2023-4906](https://cve.now/CVE-2023-4906.md): Insufficient policy enforcement in Autofill in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Autofill restriction (no CVSS, Google Chrome)
- [CVE-2023-4905](https://cve.now/CVE-2023-4905.md): Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted (no CVSS, Google Chrome)
- [CVE-2023-4904](https://cve.now/CVE-2023-4904.md): Insufficient policy enforcement in Downloads in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to bypass Enterprise policy r (no CVSS, Google Chrome)
- [CVE-2023-4903](https://cve.now/CVE-2023-4903.md): Inappropriate implementation in Custom Mobile Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to spoof sec (no CVSS, Google Chrome)
- [CVE-2023-4902](https://cve.now/CVE-2023-4902.md): Inappropriate implementation in Input in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to spoof security UI via a crafted H (no CVSS, Google Chrome)
- [CVE-2023-4901](https://cve.now/CVE-2023-4901.md): Inappropriate implementation in Prompts in Google Chrome prior to 117.0.5938.62 allowed a remote attacker to potentially spoof security UI v (no CVSS, Google Chrome)
- [CVE-2023-4900](https://cve.now/CVE-2023-4900.md): Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 117.0.5938.62 allowed a remote attacker to obfuscate a perm (no CVSS, Google Chrome)
- [CVE-2023-41885](https://cve.now/CVE-2023-41885.md): Piccolo's current \`BaseUser.login\` implementation is vulnerable to time based user enumeration (CVSS 5.3, piccolo-orm piccolo · piccolo)
- [CVE-2023-3712](https://cve.now/CVE-2023-3712.md): Potential user privilege escalation (CVSS 6.6, Honeywell PM23/43 · Honeywell PC23/43, PD43 +7)
- [CVE-2023-41331](https://cve.now/CVE-2023-41331.md): SOFARPC Remote Command Execution (RCE) Vulnerability (CVSS 9.8, sofastack sofa-rpc)
- [CVE-2023-3711](https://cve.now/CVE-2023-3711.md): Potential Predictable Session ID (CVSS 6.4, Honeywell PM23/43 · Honeywell PC23/43, PD43 +7)
- [CVE-2023-39201](https://cve.now/CVE-2023-39201.md): Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local a (CVSS 7.2, Zoom Video Communications CleanZoom)
- [CVE-2023-3710](https://cve.now/CVE-2023-3710.md): Printer web page invalid command execution (CVSS 9.9, Honeywell PM23/43 · Honeywell PC23/43, PD43 +7)
- [CVE-2023-39208](https://cve.now/CVE-2023-39208.md): Improper input validation in Zoom Desktop Client for Linux before version 5.15.10 may allow an unauthenticated user to conduct a denial of s (CVSS 6.5, Zoom Video Communications Zoom Desktop Client for Linux)
- [CVE-2023-39215](https://cve.now/CVE-2023-39215.md): Improper authentication in Zoom clients may allow an authenticated user to conduct a denial of service via network access. (CVSS 7.1, Zoom Video Communications Zoom Clients)
- [CVE-2023-41036](https://cve.now/CVE-2023-41036.md): Macvim's Insecure Usage of IPC Mechanisms (CVSS 7.8, macvim-dev macvim)
- [CVE-2023-21520](https://cve.now/CVE-2023-21520.md): A PII Enumeration via Credential Recovery in the Self Service (Credential Recovery) of BlackBerry AtHoc version 7.15 (no CVSS, BlackBerry AtHoc)
- [CVE-2023-4921](https://cve.now/CVE-2023-4921.md): Use-after-free in Linux kernel's net/sched: sch\_qfq component (CVSS 7.8, Linux Kernel)
- [CVE-2023-21523](https://cve.now/CVE-2023-21523.md): A Stored Cross-site Scripting (XSS) vulnerability in the Management Console (User Management and Alerts) of BlackBerr (no CVSS, BlackBerry AtHoc)
- [CVE-2023-4918](https://cve.now/CVE-2023-4918.md): Plaintext storage of user password (CVSS 8.8, keycloak · Red Hat Single Sign-On +1)
- [CVE-2023-30962](https://cve.now/CVE-2023-30962.md): Stored XSS in cerberus attachments (CVSS 6.8, com.palantir.acme.cerberus:cerberus)
- [CVE-2023-21522](https://cve.now/CVE-2023-21522.md): A Reflected Cross-site Scripting (XSS) vulnerability in the Management Console (Reports) of BlackBerry AtHoc version 7.15 could allow an at (no CVSS, BlackBerry AtHoc)
- [CVE-2023-21521](https://cve.now/CVE-2023-21521.md): An SQL Injection vulnerability in the Management Console (Operator Audit Trail) of BlackBerry AtHoc version 7.15 could allow an attacker t (no CVSS, BlackBerry AtHoc)
- [CVE-2023-4501](https://cve.now/CVE-2023-4501.md): Authentication bypass in OpenText (Micro Focus) Enterprise Server (CVSS 9.8, OpenText Visual COBOL, COBOL Server, Enterprise Developer,…)
- [CVE-2023-36739](https://cve.now/CVE-2023-36739.md): 3D Viewer Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Viewer)
- [CVE-2023-36740](https://cve.now/CVE-2023-36740.md): 3D Viewer Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Viewer)
- [CVE-2023-36760](https://cve.now/CVE-2023-36760.md): 3D Viewer Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Viewer)
- [CVE-2023-36761](https://cve.now/CVE-2023-36761.md): Microsoft Word Information Disclosure Vulnerability (CVSS 6.5, KEV, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2023-36762](https://cve.now/CVE-2023-36762.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.3, Microsoft SharePoint Enterprise Server · Microsoft Office +2)
- [CVE-2023-36763](https://cve.now/CVE-2023-36763.md): Microsoft Outlook Information Disclosure Vulnerability (CVSS 7.5, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2023-36764](https://cve.now/CVE-2023-36764.md): Microsoft SharePoint Server Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2023-36770](https://cve.now/CVE-2023-36770.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-36771](https://cve.now/CVE-2023-36771.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-36772](https://cve.now/CVE-2023-36772.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-36773](https://cve.now/CVE-2023-36773.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-36777](https://cve.now/CVE-2023-36777.md): Microsoft Exchange Server Information Disclosure Vulnerability (CVSS 5.7, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2023-36788](https://cve.now/CVE-2023-36788.md): .NET Framework Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framew… +2)
- [CVE-2023-36792](https://cve.now/CVE-2023-36792.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio · Microsoft .NET +4)
- [CVE-2023-36793](https://cve.now/CVE-2023-36793.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio · Microsoft .NET +4)
- [CVE-2023-36794](https://cve.now/CVE-2023-36794.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio · Microsoft PowerShell +4)
- [CVE-2023-36796](https://cve.now/CVE-2023-36796.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio · Microsoft .NET +4)
- [CVE-2023-36799](https://cve.now/CVE-2023-36799.md): .NET Core and Visual Studio Denial of Service Vulnerability (CVSS 6.5, Microsoft .NET · Microsoft Visual Studio +7)
- [CVE-2023-36800](https://cve.now/CVE-2023-36800.md): Dynamics Finance and Operations Cross-site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 for Finance and Operations)
- [CVE-2023-38155](https://cve.now/CVE-2023-38155.md): Azure DevOps Server Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Azure DevOps Server)
- [CVE-2023-38160](https://cve.now/CVE-2023-38160.md): Windows TCP/IP Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-38163](https://cve.now/CVE-2023-38163.md): Windows Defender Attack Surface Reduction Security Feature Bypass (CVSS 7.8, Microsoft Defender Security Intelligence Updates)
- [CVE-2023-38164](https://cve.now/CVE-2023-38164.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2023-36886](https://cve.now/CVE-2023-36886.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2023-33136](https://cve.now/CVE-2023-33136.md): Azure DevOps Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Azure DevOps Server)
- [CVE-2023-29332](https://cve.now/CVE-2023-29332.md): Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Azure Kubernetes Service)
- [CVE-2023-41764](https://cve.now/CVE-2023-41764.md): Microsoft Office Spoofing Vulnerability (CVSS 5.5, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2023-36736](https://cve.now/CVE-2023-36736.md): Microsoft Identity Linux Broker Remote Code Execution Vulnerability (CVSS 4.4, Microsoft Identity Linux Broker)
- [CVE-2023-36742](https://cve.now/CVE-2023-36742.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2023-36744](https://cve.now/CVE-2023-36744.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2023-36745](https://cve.now/CVE-2023-36745.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2023-36756](https://cve.now/CVE-2023-36756.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2023-36757](https://cve.now/CVE-2023-36757.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2023-36758](https://cve.now/CVE-2023-36758.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2023-36759](https://cve.now/CVE-2023-36759.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Visual Studio)
- [CVE-2023-36765](https://cve.now/CVE-2023-36765.md): Microsoft Office Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Office)
- [CVE-2023-36766](https://cve.now/CVE-2023-36766.md): Microsoft Excel Information Disclosure Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2023-36767](https://cve.now/CVE-2023-36767.md): Microsoft Office Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2023-36801](https://cve.now/CVE-2023-36801.md): DHCP Server Service Information Disclosure Vulnerability (CVSS 5.3, Microsoft Windows Server)
- [CVE-2023-36802](https://cve.now/CVE-2023-36802.md): Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2023-36803](https://cve.now/CVE-2023-36803.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-36804](https://cve.now/CVE-2023-36804.md): Windows GDI Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36805](https://cve.now/CVE-2023-36805.md): Windows MSHTML Platform Security Feature Bypass Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-38139](https://cve.now/CVE-2023-38139.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-38140](https://cve.now/CVE-2023-38140.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-38141](https://cve.now/CVE-2023-38141.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-38142](https://cve.now/CVE-2023-38142.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-38143](https://cve.now/CVE-2023-38143.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-38144](https://cve.now/CVE-2023-38144.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-38146](https://cve.now/CVE-2023-38146.md): Windows Themes Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-38147](https://cve.now/CVE-2023-38147.md): Windows Miracast Wireless Display Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-38148](https://cve.now/CVE-2023-38148.md): Internet Connection Sharing (ICS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-38149](https://cve.now/CVE-2023-38149.md): Windows TCP/IP Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-38150](https://cve.now/CVE-2023-38150.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-38152](https://cve.now/CVE-2023-38152.md): DHCP Server Service Information Disclosure Vulnerability (CVSS 5.3, Microsoft Windows Server)
- [CVE-2023-38156](https://cve.now/CVE-2023-38156.md): Azure HDInsight Apache Ambari JDBC Injection Elevation of Privilege Vulnerability (CVSS 7.2, Microsoft Azure HDInsight)
- [CVE-2023-38161](https://cve.now/CVE-2023-38161.md): Windows GDI Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-38162](https://cve.now/CVE-2023-38162.md): DHCP Server Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2023-35355](https://cve.now/CVE-2023-35355.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-29463](https://cve.now/CVE-2023-29463.md): Pavilion8 Security Misconfiguration Vulnerability (CVSS 8.8, Rockwell Automation Pavilion8)
- [CVE-2023-34470](https://cve.now/CVE-2023-34470.md): Improper access control (CVSS 6.8, AMI AptioV)
- [CVE-2023-34469](https://cve.now/CVE-2023-34469.md): Cold Rest Vulnerabiltiy (CVSS 4.9, AMI AptioV)
- [CVE-2023-0119](https://cve.now/CVE-2023-0119.md): Foreman: stored cross-site scripting in host tab (CVSS 5.4, foreman · Red Hat Satellite 6.13 for RHEL +1)
- [CVE-2023-4863](https://cve.now/CVE-2023-4863.md): Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bo (CVSS 8.8, KEV, Google Chrome · Google libwebp +13)
- [CVE-2023-4914](https://cve.now/CVE-2023-4914.md): Relative Path Traversal in cecilapp/cecil (CVSS 5.8, cecilapp/cecil · cecil/cecil)
- [CVE-2023-4913](https://cve.now/CVE-2023-4913.md): Cross-site Scripting (XSS) - Reflected in cecilapp/cecil (CVSS 6.1, cecilapp/cecil · cecil/cecil)
- [CVE-2023-2071](https://cve.now/CVE-2023-2071.md): FactoryTalk View Machine Edition Vulnerable to Remote Code Execution (CVSS 9.8, Rockwell Automation Fa)
- [CVE-2023-40712](https://cve.now/CVE-2023-40712.md): Apache Airflow: Secrets can be unmasked in the "Rendered Template" (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-40611](https://cve.now/CVE-2023-40611.md): Apache Airflow Dag Runs Broken Access Control Vulnerability (CVSS 4.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2023-41846](https://cve.now/CVE-2023-41846.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0008), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2023-41033](https://cve.now/CVE-2023-41033.md): A vulnerability has been identified in Parasolid V35.0 (All versions \< V35.0.260), Parasolid V35.1 (All versions \< V35.1.246), Parasolid V36 (CVSS 7.8, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2023-41032](https://cve.now/CVE-2023-41032.md): A vulnerability has been identified in Parasolid V34.1 (All versions \< V34.1.258), Parasolid V35.0 (All versions \< V35.0.253), Parasolid V35 (CVSS 7.8, Siemens Parasolid · Siemens Simcenter Femap)
- [CVE-2023-40732](https://cve.now/CVE-2023-40732.md): A vulnerability has been identified in QMS Automotive (All versions \< V12.39). (CVSS 3.9, Siemens QMS Automotive)
- [CVE-2023-40731](https://cve.now/CVE-2023-40731.md): A vulnerability has been identified in QMS Automotive (All versions \< V12.39). (CVSS 5.7, Siemens QMS Automotive)
- [CVE-2023-40730](https://cve.now/CVE-2023-40730.md): A vulnerability has been identified in QMS Automotive (All versions \< V12.39). (CVSS 7.1, Siemens QMS Automotive)
- [CVE-2023-40729](https://cve.now/CVE-2023-40729.md): A vulnerability has been identified in QMS Automotive (All versions \< V12.39). (CVSS 7.3, Siemens QMS Automotive)
- [CVE-2023-40728](https://cve.now/CVE-2023-40728.md): A vulnerability has been identified in QMS Automotive (All versions \< V12.39). (CVSS 7.3, Siemens QMS Automotive)
- [CVE-2023-40727](https://cve.now/CVE-2023-40727.md): A vulnerability has been identified in QMS Automotive (All versions \< V12.39). (CVSS 7.8, Siemens QMS Automotive)
- [CVE-2023-40726](https://cve.now/CVE-2023-40726.md): A vulnerability has been identified in QMS Automotive (All versions \< V12.39). (CVSS 8.8, Siemens QMS Automotive)
- [CVE-2023-40725](https://cve.now/CVE-2023-40725.md): A vulnerability has been identified in QMS Automotive (All versions \< V12.39). (CVSS 4.0, Siemens QMS Automotive)
- [CVE-2023-40724](https://cve.now/CVE-2023-40724.md): A vulnerability has been identified in QMS Automotive (All versions \< V12.39). (CVSS 7.3, Siemens QMS Automotive)
- [CVE-2023-38076](https://cve.now/CVE-2023-38076.md): A vulnerability has been identified in JT2Go (All versions \< V14.3.0.1), Teamcenter Visualization V13.3 (All versions \< V13.3.0.12), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization +1)
- [CVE-2023-38075](https://cve.now/CVE-2023-38075.md): A vulnerability has been identified in JT2Go (All versions \< V14.3.0.1), Teamcenter Visualization V13.3 (All versions \< V13.3.0.12), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization +1)
- [CVE-2023-38074](https://cve.now/CVE-2023-38074.md): A vulnerability has been identified in JT2Go (All versions \< V14.3.0.1), Teamcenter Visualization V13.3 (All versions \< V13.3.0.12), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization +1)
- [CVE-2023-38073](https://cve.now/CVE-2023-38073.md): A vulnerability has been identified in JT2Go (All versions \< V14.3.0.1), Teamcenter Visualization V13.3 (All versions \< V13.3.0.12), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization +1)
- [CVE-2023-38072](https://cve.now/CVE-2023-38072.md): A vulnerability has been identified in JT2Go (All versions \< V14.3.0.1), Teamcenter Visualization V13.3 (All versions \< V13.3.0.12), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization +1)
- [CVE-2023-38071](https://cve.now/CVE-2023-38071.md): A vulnerability has been identified in JT2Go (All versions \< V14.3.0.1), Teamcenter Visualization V13.3 (All versions \< V13.3.0.12), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization +1)
- [CVE-2023-38070](https://cve.now/CVE-2023-38070.md): A vulnerability has been identified in JT2Go (All versions \< V14.3.0.1), Teamcenter Visualization V13.3 (All versions \< V13.3.0.12), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization +1)
- [CVE-2023-28831](https://cve.now/CVE-2023-28831.md): The OPC UA implementations (ANSI C and C++) in affected products contain an integer overflow vulnerability that could cause the application (CVSS 7.5, Siemens SIMATIC BRAUMAT · Siemens SIMATIC Cloud Connect… +70)
- [CVE-2023-4759](https://cve.now/CVE-2023-4759.md): Improper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write (CVSS 8.8, Eclipse Foundation Eclipse JGit · org.eclipse.jgit:org.ecli…)
- [CVE-2023-37875](https://cve.now/CVE-2023-37875.md): Cross-Site Scripting Vulnerability in Wing FTP Server \<= 7.2.0 (CVSS 3.0, Wing FTP Server)
- [CVE-2023-37878](https://cve.now/CVE-2023-37878.md): Insecure Default Permissions in Wing FTP Server \<= 7.2.0 (CVSS 6.1, Wing FTP Server)
- [CVE-2023-37879](https://cve.now/CVE-2023-37879.md): Exposed Session Variable in Wing FTP Server \<= 7.2.0 (CVSS 6.5, Wing FTP Server)
- [CVE-2023-37881](https://cve.now/CVE-2023-37881.md): Weak Access Control between Domains in Wing FTP Server \<= 7.2.0 (CVSS 4.9, Wing FTP Server)
- [CVE-2022-24093](https://cve.now/CVE-2022-24093.md): Adobe Commerce post-auth improper input validation leads to remote code execution (CVSS 9.1, Adobe Commerce · magento/community-edition +1)
- [CVE-2022-48475](https://cve.now/CVE-2022-48475.md): Buffer Overflow vulnerability in Control de Ciber version 1.650, in the printing function. (CVSS 8.2, Control de Ciber)
- [CVE-2022-48474](https://cve.now/CVE-2022-48474.md): Control de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the version function. (CVSS 8.2, Control de Ciber)
- [CVE-2022-4896](https://cve.now/CVE-2022-4896.md): Cyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the server of pop-up windows with the messages "PNT (CVSS 8.2, Control de Ciber)
- [CVE-2023-3039](https://cve.now/CVE-2023-3039.md): SD ROM Utility, versions prior to 1.0.2.0 contain an Improper Access Control vulnerability. (CVSS 7.3, Dell SD ROM Utility)
- [CVE-2023-26142](https://cve.now/CVE-2023-26142.md): All versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user input is used to build header values. (CVSS 6.5, Crow)
- [CVE-2023-40309](https://cve.now/CVE-2023-40309.md): Missing Authorization check in SAP CommonCryptoLib (CVSS 9.8, SAP\_SE SAP CommonCryptoLib · SAP\_SE SAP NetWeaver AS ABA… +6)
- [CVE-2023-40621](https://cve.now/CVE-2023-40621.md): Code Injection vulnerability in SAP PowerDesigner Client (CVSS 6.3, SAP\_SE SAP PowerDesigner Client)
- [CVE-2023-40622](https://cve.now/CVE-2023-40622.md): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management) (CVSS 9.9, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2023-40623](https://cve.now/CVE-2023-40623.md): Arbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer) (CVSS 6.2, SAP\_SE SAP BusinessObjects Suite)
- [CVE-2023-40624](https://cve.now/CVE-2023-40624.md): Code Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering) (CVSS 5.5, SAP\_SE SAP NetWeaver AS ABAP)
- [CVE-2023-40625](https://cve.now/CVE-2023-40625.md): Missing Authorization check in SAP Manage Purchase Contracts App (CVSS 5.4, SAP\_SE SAP Manage Purchase Contracts App)
- [CVE-2023-41367](https://cve.now/CVE-2023-41367.md): Missing Authentication check in SAP NetWeaver (Guided Procedures) (CVSS 5.3, SAP\_SE SAP NetWeaver)
- [CVE-2023-41368](https://cve.now/CVE-2023-41368.md): Insecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps) (CVSS 2.7, SAP\_SE S4 HANA ABAP)
- [CVE-2023-41369](https://cve.now/CVE-2023-41369.md): External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application) (CVSS 3.5, SAP\_SE SAP S/4HANA · hana-ml)
- [CVE-2023-42472](https://cve.now/CVE-2023-42472.md): Insufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) (CVSS 8.7, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2023-4887](https://cve.now/CVE-2023-4887.md): Google Maps Plugin by Intergeo \<= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, themeisle Google Maps Plugin by Intergeo)
- [CVE-2023-4840](https://cve.now/CVE-2023-4840.md): MapPress Maps for WordPress \<= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, chrisvrichardson MapPress Maps for WordPress)
- [CVE-2023-4890](https://cve.now/CVE-2023-4890.md): JQuery Accordion Menu Widget \<= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, remix4 JQuery Accordion Menu Widget)
- [CVE-2023-4893](https://cve.now/CVE-2023-4893.md): Crayon Syntax Highlighter \<= 2.8.4 - Authenticated (Contributor+) Server Side Request Forgery (CVSS 6.4, akarmenia Crayon Syntax Highlighter)
- [CVE-2023-32558](https://cve.now/CVE-2023-32558.md): The use of the deprecated API \`process.binding()\` can bypass the permission model through path traversal. (no CVSS, NodeJS Node)
- [CVE-2023-32005](https://cve.now/CVE-2023-32005.md): A vulnerability has been identified in Node.js version 20, affecting users of the experimental permission model when the --allow-fs-read fla (CVSS 5.3, NodeJS Node)
- [CVE-2023-40308](https://cve.now/CVE-2023-40308.md): Memory Corruption vulnerability in SAP CommonCryptoLib (CVSS 7.5, SAP\_SE SAP CommonCryptoLib · SAP\_SE SAP NetWeaver AS ABA… +6)
- [CVE-2023-37489](https://cve.now/CVE-2023-37489.md): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System) (CVSS 5.3, SAP\_SE SAP BusinessObjects Business Intelligence Platform)
- [CVE-2023-25519](https://cve.now/CVE-2023-25519.md): NVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability where a restricted host may cause an incorrec (CVSS 7.8, NVIDIA BlueField)
- [CVE-2022-47637](https://cve.now/CVE-2022-47637.md): The installer in XAMPP through 8.1.12 allows local users to write to the C:\\xampp directory. (no CVSS)
- [CVE-2023-27169](https://cve.now/CVE-2023-27169.md): Xpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which leads to the generation of a hardcoded and pre (no CVSS)
- [CVE-2023-39073](https://cve.now/CVE-2023-39073.md): An issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain senstive information via a crafted request. (no CVSS)
- [CVE-2023-39150](https://cve.now/CVE-2023-39150.md): ConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execut (no CVSS)
- [CVE-2023-39637](https://cve.now/CVE-2023-39637.md): D-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the component /goform/Diagnosis. (no CVSS)
- [CVE-2023-40218](https://cve.now/CVE-2023-40218.md): An issue was discovered in the NPU kernel driver in Samsung Exynos Mobile Processor 9820, 980, 2100, 2200, 1280, and 1380. (CVSS 2.0)
- [CVE-2023-40784](https://cve.now/CVE-2023-40784.md): DedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module\_make.php. (CVSS 9.8)
- [CVE-2023-40834](https://cve.now/CVE-2023-40834.md): OpenCart CMS v4.0.2.2 was discovered to lack a protective mechanism on its login page against excessive login attempts, allowing unauthentic (no CVSS)
- [CVE-2023-41013](https://cve.now/CVE-2023-41013.md): Cross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to inject arbitrary web script or HTML via the "p4" (no CVSS)
- [CVE-2023-41423](https://cve.now/CVE-2023-41423.md): Cross Site Scripting vulnerability in WP Githuber MD plugin v.1.16.2 allows a remote attacker to execute arbitrary code via a crafted payloa (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.