# CVEs published 2023-09-13

59 CVEs were published on September 13, 2023: 3 critical, 14 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-23845](https://cve.now/CVE-2023-23845.md): SolarWinds Platform Exposed Dangerous Method Vulnerability (CVSS 6.8, SolarWinds Platform)
- [CVE-2023-23840](https://cve.now/CVE-2023-23840.md): SolarWinds Platform Exposed Dangerous Method Vulnerability (CVSS 6.8, SolarWinds Platform)
- [CVE-2023-4568](https://cve.now/CVE-2023-4568.md): PaperCut NG Unauthenticated XMLRPC (CVSS 6.5, PaperCut NG)
- [CVE-2023-41892](https://cve.now/CVE-2023-41892.md): Craft CMS Remote Code Execution vulnerability (CVSS 10.0, craftcms cms · craftcms/cms)
- [CVE-2023-3588](https://cve.now/CVE-2023-3588.md): Stored Cross-site Scripting (XSS) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x (CVSS 5.4, Dassault Systèmes Teamwork Cloud - Business Edition · Da… +2)
- [CVE-2023-2680](https://cve.now/CVE-2023-2680.md): Dma reentrancy issue (incomplete fix for cve-2021-3750) (CVSS 7.5, qemu · Red Hat Enterprise Linux +2)
- [CVE-2023-20190](https://cve.now/CVE-2023-20190.md): A vulnerability in the classic access control list (ACL) compression feature of Cisco IOS XR Software could allow an unauthenticated, remote (CVSS 5.8, Cisco IOS XR Software)
- [CVE-2023-20191](https://cve.now/CVE-2023-20191.md): A vulnerability in the access control list (ACL) processing on MPLS interfaces in the ingress direction of Cisco IOS XR Software could allow (CVSS 5.8, Cisco IOS XR Software)
- [CVE-2023-20233](https://cve.now/CVE-2023-20233.md): A vulnerability in the Connectivity Fault Management (CFM) feature of Cisco IOS XR Software could allow an unauthenticated, remote attacker (CVSS 4.3, Cisco IOS XR Software)
- [CVE-2023-20236](https://cve.now/CVE-2023-20236.md): A vulnerability in the iPXE boot function of Cisco IOS XR software could allow an authenticated, local attacker to install an unverified sof (CVSS 6.7, Cisco IOS XR Software)
- [CVE-2023-20135](https://cve.now/CVE-2023-20135.md): A vulnerability in Cisco IOS XR Software image verification checks could allow an authenticated, local attacker to execute arbitrary code on (CVSS 5.7, Cisco IOS XR Software)
- [CVE-2023-4785](https://cve.now/CVE-2023-4785.md): Denial of Service in gRPC Core (CVSS 7.5, Google gRPC · grpcio +1)
- [CVE-2023-3280](https://cve.now/CVE-2023-3280.md): Cortex XDR Agent: Local Windows User Can Disable the Agent (CVSS 5.5, Palo Alto Networks Cortex XDR Agent)
- [CVE-2023-3255](https://cve.now/CVE-2023-3255.md): Qemu: vnc: infinite loop in inflate\_buffer() leads to denial of service (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2023-4155](https://cve.now/CVE-2023-4155.md): Sev-es / sev-snp vmgexit double fetch vulnerability (CVSS 5.3, kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-3301](https://cve.now/CVE-2023-3301.md): Triggerable assertion due to race condition in hot-unplug (CVSS 5.6, qemu · Red Hat Enterprise Linux +3)
- [CVE-2023-4828](https://cve.now/CVE-2023-4828.md): ITM Server Communications Hijack (CVSS 6.4, Proofpoint ITM Server)
- [CVE-2023-4803](https://cve.now/CVE-2023-4803.md): ITM Server Cross-site Scripting in WriteWindowTitle Endpoint (CVSS 4.8, Proofpoint ITM Server)
- [CVE-2023-4802](https://cve.now/CVE-2023-4802.md): ITM Server Cross-site Scripting in UpdateInstalledSoftware Endpoint (CVSS 4.8, Proofpoint ITM Server)
- [CVE-2023-4801](https://cve.now/CVE-2023-4801.md): ITM MacOS Agent Improper Certificate Validation (CVSS 7.5, Proofpoint Insider Threat Management)
- [CVE-2023-39916](https://cve.now/CVE-2023-39916.md): Possible path traversal when storing RRDP responses (CVSS 9.3, NLnet Labs Routinator · routinator)
- [CVE-2023-39915](https://cve.now/CVE-2023-39915.md): Crashes on parsing certain invalid RPKI objects (CVSS 7.5, NLnet Labs Routinator)
- [CVE-2023-39914](https://cve.now/CVE-2023-39914.md): BER/CER/DER decoder panics on invalid input (CVSS 7.5, NLnet Labs bcder · bcder)
- [CVE-2023-3935](https://cve.now/CVE-2023-3935.md): Wibu: Buffer Overflow in CodeMeter Runtime (CVSS 9.8, Wibu CodeMeter Runtime)
- [CVE-2023-38215](https://cve.now/CVE-2023-38215.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-38214](https://cve.now/CVE-2023-38214.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2021-44172](https://cve.now/CVE-2021-44172.md): An exposure of sensitive information to an unauthorized actor vulnerability \[CWE-200\] in FortiClientEMS versions 7.0.0 through 7.0.4, 7.0.6 (CVSS 3.6, Fortinet FortiClientEMS)
- [CVE-2022-35849](https://cve.now/CVE-2022-35849.md): An improper neutralization of special elements used in an OS command vulnerability \[CWE-78\] in the management interface of FortiADC 7.1.0 th (CVSS 7.4, Fortinet FortiADC)
- [CVE-2023-29183](https://cve.now/CVE-2023-29183.md): An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability \[CWE-79\] in FortiProxy 7.2.0 through 7 (CVSS 7.3, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2023-40715](https://cve.now/CVE-2023-40715.md): A cleartext storage of sensitive information vulnerability \[CWE-312\] in FortiTester 2.3.0 through 7.2.3 may allow an attacker with access to (CVSS 5.2, Fortinet FortiTester)
- [CVE-2023-40717](https://cve.now/CVE-2023-40717.md): A use of hard-coded credentials vulnerability \[CWE-798\] in FortiTester 2.3.0 through 7.2.3 may allow an attacker who managed to get a shell (CVSS 5.0, Fortinet FortiTester)
- [CVE-2023-36638](https://cve.now/CVE-2023-36638.md): An improper privilege management vulnerability \[CWE-269\] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 (CVSS 4.2, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2023-36634](https://cve.now/CVE-2023-36634.md): An incomplete filtering of one or more instances of special elements vulnerability \[CWE-792\] in the command line interpreter of FortiAP-U 7. (CVSS 6.5, Fortinet FortiAP-U)
- [CVE-2023-36642](https://cve.now/CVE-2023-36642.md): An improper neutralization of special elements used in an OS command vulnerability \[CWE-78\] in the management interface of FortiTester 3.0.0 (CVSS 6.5, Fortinet FortiTester)
- [CVE-2023-34984](https://cve.now/CVE-2023-34984.md): A protection mechanism failure in Fortinet FortiWeb 7.2.0 through 7.2.1, 7.0.0 through 7.0.6, 6.4.0 through 6.4.3, 6.3.6 through 6.3.23 allo (CVSS 7.1, Fortinet FortiWeb)
- [CVE-2023-27998](https://cve.now/CVE-2023-27998.md): A lack of custom error pages vulnerability \[CWE-756\] in FortiPresence versions 1.2.0 through 1.2.1 and all versions of 1.1 and 1.0 may allow (CVSS 5.3, Fortinet FortiPresence)
- [CVE-2023-36551](https://cve.now/CVE-2023-36551.md): A exposure of sensitive information to an unauthorized actor in Fortinet FortiSIEM version 6.7.0 through 6.7.5 allows attacker to informatio (CVSS 4.2, Fortinet FortiSIEM)
- [CVE-2023-25608](https://cve.now/CVE-2023-25608.md): An incomplete filtering of one or more instances of special elements vulnerability \[CWE-792\] in the command line interpreter of FortiAP-W2 7 (CVSS 5.2, Fortinet FortiAP-W2 · Fortinet FortiAP-C +3)
- [CVE-2023-41081](https://cve.now/CVE-2023-41081.md): Apache Tomcat Connectors: Unexpected use of first declared worker in mod\_jk for unmapped request (CVSS 7.5, Apache Software Foundation Apache Tomcat Connectors)
- [CVE-2023-29305](https://cve.now/CVE-2023-29305.md): Adobe Connect Reflected Cross-Site Scripting (XSS) Arbitrary code execution (CVSS 6.1, Adobe Connect)
- [CVE-2023-29306](https://cve.now/CVE-2023-29306.md): Adobe Connect Reflected Cross-Site Scripting (XSS) Arbitrary code execution (CVSS 6.1, Adobe Connect)
- [CVE-2023-26369](https://cve.now/CVE-2023-26369.md): \[Google Project Zero\] Adobe Acrobat DC OOBW 0-day actively exploited in the wild (CVSS 7.8, KEV, Adobe Acrobat Reader)
- [CVE-2023-4039](https://cve.now/CVE-2023-4039.md): GCC's-fstack-protector fails to guard dynamically-sized local variables on AArch64 (CVSS 4.8, Arm GNU Toolchain · GNU GCC)
- [CVE-2023-4400](https://cve.now/CVE-2023-4400.md): A password management vulnerability in Skyhigh Secure Web Gateway (SWG) in main releases 11.x prior to 11.2.14, 10.x prior to 10.2.25 and c (CVSS 6.2, Skyhigh Security Skyhigh Secure Web Gateway)
- [CVE-2023-4915](https://cve.now/CVE-2023-4915.md): WP User Control \<= 1.5.3 - Insecure Password Reset Mechanism (CVSS 5.3, wmsedgar WP User Control)
- [CVE-2023-4917](https://cve.now/CVE-2023-4917.md): Leyka \<= 3.30.7 - Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 5.3, vaultdweller Leyka)
- [CVE-2023-4153](https://cve.now/CVE-2023-4153.md): BAN Users \<= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Settings Update & Privilege Escalation (CVSS 8.8, webxmedia BAN Users)
- [CVE-2023-4916](https://cve.now/CVE-2023-4916.md): Login with phone number \<= 1.5.6 - Cross-Site Request Forgery to User Password Change (CVSS 8.8, glboy OTP Login With Phone Number, OTP Verification)
- [CVE-2023-4213](https://cve.now/CVE-2023-4213.md): Simplr Registration Form Plus+ \<= 2.4.5 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Password Change (CVSS 8.8, mpvanwinkle77 Simplr Registration Form Plus+)
- [CVE-2023-4928](https://cve.now/CVE-2023-4928.md): SQL Injection in instantsoft/icms2 (CVSS 7.2, instantsoft/icms2)
- [CVE-2023-40617](https://cve.now/CVE-2023-40617.md): A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start 7 allows remote attackers to execute arbitrary JavaScri (no CVSS)
- [CVE-2023-40850](https://cve.now/CVE-2023-40850.md): netentsec NS-ASG 6.3 is vulnerable to Incorrect Access Control. (no CVSS)
- [CVE-2023-41152](https://cve.now/CVE-2023-41152.md): A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2023-41154](https://cve.now/CVE-2023-41154.md): A Stored Cross-Site Scripting (XSS) vulnerability in the scheduled cron jobs tab in Usermin 2.000 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2023-41155](https://cve.now/CVE-2023-41155.md): A Stored Cross-Site Scripting (XSS) vulnerability in the mail forwarding and replies tab in Webmin and Usermin 2.000 allows remote attackers (no CVSS)
- [CVE-2023-41158](https://cve.now/CVE-2023-41158.md): A Stored Cross-Site Scripting (XSS) vulnerability in the MIME type programs tab in Usermin 2.000 allows remote attackers to inject arbitrary (no CVSS)
- [CVE-2023-41162](https://cve.now/CVE-2023-41162.md): A Reflected Cross-site scripting (XSS) vulnerability in the file manager tab in Usermin 2.000 allows remote attackers to inject arbitrary we (no CVSS)
- [CVE-2023-42468](https://cve.now/CVE-2023-42468.md): The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent (no CVSS)
- [CVE-2023-42469](https://cve.now/CVE-2023-42469.md): The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application (with no permissions) to pl (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.