CVEs published September 13, 2023
59 CVEs were published on September 13, 2023: 3 critical, 14 high. 1 is now in CISA KEV.
- Published
- 59
- Critical
- 3
- High
- 14
- Medium
- 32
- Low
- 1
- Unrated
- 9
- Now in CISA KEV
- 1
- Fix available
- 10
Most affected products
- Cisco IOS XR Software
- 5
- Fortinet FortiTester
- 3
- Proofpoint ITM Server
- 3
- Adobe Connect
- 2
- Adobe Experience Manager
- 2
- SolarWinds Platform
- 2
- Adobe Acrobat Reader
- 1
- Apache Software Foundation Apache Tomcat Connectors
- 1
- Arm GNU Toolchain · GNU GCC
- 1
- craftcms cms · craftcms/cms
- 1
Critical 3
High 14
- CVE-2023-2680Dma reentrancy issue (incomplete fix for cve-2021-3750)qemu · Red Hat Enterprise Linux +2
- CVE-2023-4785Denial of Service in gRPC CoreGoogle gRPC · grpcio +1
- CVE-2023-4801ITM MacOS Agent Improper Certificate ValidationProofpoint Insider Threat Management
- CVE-2023-39915Crashes on parsing certain invalid RPKI objectsNLnet Labs Routinator
- CVE-2023-39914BER/CER/DER decoder panics on invalid inputNLnet Labs bcder · bcder
- CVE-2022-35849An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiADC 7.1.0 thFortinet FortiADC
- CVE-2023-29183An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiProxy 7.2.0 through 7Fortinet FortiProxy · Fortinet FortiOS
- CVE-2023-34984A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 alloFortinet FortiWeb
- CVE-2023-41081Apache Tomcat Connectors: Unexpected use of first declared worker in mod_jk for unmapped requestApache Software Foundation Apache Tomcat Connectors
- CVE-2023-26369[Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wildAdobe Acrobat Reader
- CVE-2023-4153BAN Users <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalationwebxmedia BAN Users
- CVE-2023-4916Login with phone number <= 1.5.6 - Cross-Site Request Forgery to User Password Changeglboy OTP Login With Phone Number, OTP Verification
- CVE-2023-4213Simplr Registration Form Plus+ <= 2.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Changempvanwinkle77 Simplr Registration Form Plus+
- CVE-2023-4928SQL Injection in instantsoft/icms2instantsoft/icms2
Medium, low and unrated 42
- CVE-2023-23845SolarWinds Platform Exposed Dangerous Method VulnerabilitySolarWinds Platform
- CVE-2023-23840SolarWinds Platform Exposed Dangerous Method VulnerabilitySolarWinds Platform
- CVE-2023-4568PaperCut NG Unauthenticated XMLRPCPaperCut NG
- CVE-2023-3588Stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022xDassault Systèmes Teamwork Cloud - Business Edition · Da… +2
- CVE-2023-20190A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an unauthenticated, remoteCisco IOS XR Software
- CVE-2023-20191A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allowCisco IOS XR Software
- CVE-2023-20233A vulnerability in the Connectivity Fault Management (CFM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker Cisco IOS XR Software
- CVE-2023-20236A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified sofCisco IOS XR Software
- CVE-2023-20135A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code onCisco IOS XR Software
- CVE-2023-3280Cortex XDR Agent: Local Windows User Can Disable the AgentPalo Alto Networks Cortex XDR Agent
- CVE-2023-3255Qemu: vnc: infinite loop in inflate_buffer() leads to denial of serviceRed Hat Enterprise Linux
- CVE-2023-4155Sev-es / sev-snp vmgexit double fetch vulnerabilitykernel · Red Hat Enterprise Linux +1
- CVE-2023-3301Triggerable assertion due to race condition in hot-unplugqemu · Red Hat Enterprise Linux +3
- CVE-2023-4828ITM Server Communications HijackProofpoint ITM Server
- CVE-2023-4803ITM Server Cross-site Scripting in WriteWindowTitle EndpointProofpoint ITM Server
- CVE-2023-4802ITM Server Cross-site Scripting in UpdateInstalledSoftware EndpointProofpoint ITM Server
- CVE-2023-38215Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-38214Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2021-44172An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 Fortinet FortiClientEMS
- CVE-2023-40715A cleartext storage of sensitive information vulnerability [CWE-312] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access toFortinet FortiTester
- CVE-2023-40717A use of hard-coded credentials vulnerability [CWE-798] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell Fortinet FortiTester
- CVE-2023-36638An improper privilege management vulnerability [CWE-269] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2Fortinet FortiManager · Fortinet FortiAnalyzer
- CVE-2023-36634An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-U 7.Fortinet FortiAP-U
- CVE-2023-36642An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0Fortinet FortiTester
- CVE-2023-27998A lack of custom error pages vulnerability [CWE-756] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allowFortinet FortiPresence
- CVE-2023-36551A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to informatioFortinet FortiSIEM
- CVE-2023-25608An incomplete filtering of one or more instances of special elements vulnerability [CWE-792] in the command line interpreter of FortiAP-W2 7Fortinet FortiAP-W2 · Fortinet FortiAP-C +3
- CVE-2023-29305Adobe Connect Reflected Cross-Site Scripting (XSS) Arbitrary code executionAdobe Connect
- CVE-2023-29306Adobe Connect Reflected Cross-Site Scripting (XSS) Arbitrary code executionAdobe Connect
- CVE-2023-4039GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64Arm GNU Toolchain · GNU GCC
- CVE-2023-4400 A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and cSkyhigh Security Skyhigh Secure Web Gateway
- CVE-2023-4915WP User Control <= 1.5.3 - Insecure Password Reset Mechanismwmsedgar WP User Control
- CVE-2023-4917Leyka <= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposurevaultdweller Leyka
- CVE-2023-40617A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start 7 allows remote attackers to execute arbitrary JavaScri
- CVE-2023-40850netentsec NS-ASG 6.3 is vulnerable to Incorrect Access Control.
- CVE-2023-41152A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary
- CVE-2023-41154A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrar
- CVE-2023-41155A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers
- CVE-2023-41158A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary
- CVE-2023-41162A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary we
- CVE-2023-42468The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent
- CVE-2023-42469The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application (with no permissions) to pl