CVEs published September 14, 2023
67 CVEs were published on September 14, 2023: 7 critical, 8 high. 1 is now in CISA KEV.
- Published
- 67
- Critical
- 7
- High
- 8
- Medium
- 17
- Low
- 3
- Unrated
- 32
- Now in CISA KEV
- 1
- Fix available
- 16
Most affected products
- Adobe ColdFusion
- 3
- binutils · Red Hat Enterprise Linux +1
- 3
- Digital Yepas
- 2
- glib
- 2
- glib2 · Red Hat Enterprise Linux +2
- 2
- Aceka Company Management
- 1
- Apache Software Foundation Apache Airflow HDFS Provider · a…
- 1
- Apache Software Foundation Apache Commons Compress · org.ap…
- 1
- binutils · Red Hat Enterprise Linux +2
- 1
- Exagate SYSGuard
- 1
Critical 7
- CVE-2023-4972Information Disclosure in Digital YepasDigital Yepas
- CVE-2023-4702Authentication Bypass in Digital YepasDigital Yepas
- CVE-2023-4669Authentication Bypass in Exagate SYSGuard 3001Exagate SYSGuard
- CVE-2023-4766SQLi in Movus Admin PanelMovus
- CVE-2023-4832SQLi in Aceka Holdings Company ManagementAceka Company Management
- CVE-2023-30909A remote authentication bypass issue exists in some OneView APIs.Hewlett Packard Enterprise (HPE) HPE OneView
- CVE-2023-38204Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8Adobe ColdFusion
High 8
- CVE-2023-1108Undertow: infinite loop in sslconduit during closeio.undertow:undertow-core · Red Hat EAP 7.4.10 release +14
- CVE-2023-2848Movim prior to version 0.22 is affected by a Cross-Site WebSocket Hijacking vulnerability.Movim
- CVE-2023-38557A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3).Siemens Spectrum Power
- CVE-2023-4516 A CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update Service that could allow a local attacker tSchneider Electric IGSS Update Service
- CVE-2023-38205ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298Adobe ColdFusion
- CVE-2023-4814 A Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which can be abused to delete any file/folder for wTrellix Data Loss Prevention Endpoint for Windows
- CVE-2023-26141Versions of the package sidekiq before 7.1.3 are vulnerable to Denial of Service (DoS) due to insufficient checks in the dashboard-charts.jssidekiq
- CVE-2023-36250CSV Injection vulnerability in GNOME time tracker version 3.0.2, allows local attackers to execute arbitrary code via crafted .tsv file when
Medium, low and unrated 52
- CVE-2023-4680Vault's Transit Secrets Engine Allowed Nonce Specified without Convergent EncryptionHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-25584Out of bounds read in parse_module function in bfd/vms-alpha.cbinutils · Red Hat Enterprise Linux +2
- CVE-2023-25585Field `file_table` of `struct module *module` is uninitializedbinutils · Red Hat Enterprise Linux +1
- CVE-2023-25586Local variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitializedbinutils · Red Hat Enterprise Linux +1
- CVE-2023-25588Field `the_bfd` of `asymbol` is uninitialized in function `bfd_mach_o_get_synthetic_symtab`binutils · Red Hat Enterprise Linux +1
- CVE-2023-4965phpipam Header redirectphpipam
- CVE-2023-4676XSS in Yordams MedasProYordam MedasPro
- CVE-2023-32636A flaw was found in glib, where the gvariant deserialization code is vulnerable to a denial of service introduced by additional input validaglib
- CVE-2023-32643A flaw was found in GLib.glib
- CVE-2023-32611G_variant_byteswap() can take a long time with some non-normal inputsglib2 · Red Hat Enterprise Linux +2
- CVE-2023-29499Gvariant offset table entry size is not checked in is_normal()glib2 · Red Hat Enterprise Linux +2
- CVE-2023-32665Gvariant deserialisation does not match spec for non-normal dataglib2 · Red Hat Enterprise Linux +1
- CVE-2023-4951Cross Site Scripting (XSS) Issue on "Client Based Authentication Policy Configuration" ScreenGreen Rocket Security GreenRADIUS
- CVE-2023-38558A vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All versions), SIMATIC PCS neo (Administration ConsoleSiemens SIMATIC PCS neo (Administration Console)
- CVE-2023-41267Apache HDFS Provider error message suggested installation of incorrect pip packageApache Software Foundation Apache Airflow HDFS Provider · a…
- CVE-2023-42503Apache Commons Compress: Denial of service via CPU consumption for malformed TAR fileApache Software Foundation Apache Commons Compress · org.ap…
- CVE-2023-38206ColdFusion | Improper Access Control (CWE-284)Adobe ColdFusion
- CVE-2023-4948WooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR UpdateYan&Co WooCommerce CVR Payment Gateway
- CVE-2023-4945Booster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodepluggabl Booster for WooCommerce – PDF Invoices, Abandoned…
- CVE-2023-4944Awesome Weather Widget <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcoderichardgabriel Awesome Weather Widget
- CVE-2023-4841Feeds for YouTube <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesmub Feeds for YouTube
- CVE-2021-28485In Ericsson Mobile Switching Center Server (MSC-S) before IS 3.1 CP22, the SIS web application allows relative path traversal via a specific
- CVE-2022-47631Razer Synapse through 3.7.1209.121307 allows privilege escalation due to an unsafe installation path and improper privilege management.
- CVE-2023-37739i-doit Pro v25 and below was discovered to be vulnerable to path traversal.
- CVE-2023-37755i-doit pro 25 and below and I-doit open 25 and below are configured with insecure default administrator credentials, and there is no warning
- CVE-2023-37756I-doit pro 25 and below and I-doit open 25 and below employ weak password requirements for Administrator account creation.
- CVE-2023-38891SQL injection vulnerability in Vtiger CRM v.7.5.0 allows a remote authenticated attacker to escalate privileges via the getQueryColumnsList
- CVE-2023-38912SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload
- CVE-2023-39285A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attack
- CVE-2023-39286A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attack
- CVE-2023-39638D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at
- CVE-2023-39639LeoTheme leoblog up to v3.1.2 was discovered to contain a SQL injection vulnerability via the component LeoBlogBlog::getListBlogs.
- CVE-2023-39641Active Design psaffiliate before v1.9.8 was discovered to contain a SQL injection vulnerability via the component PsaffiliateGetaffiliatesde
- CVE-2023-39642Carts Guru cartsguru up to v2.4.2 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontContr
- CVE-2023-40779An issue in IceWarp Mail Server Deep Castle 2 v.13.0.1.2 allows a remote attacker to execute arbitrary code via a crafted request to the URL
- CVE-2023-40868Cross Site Request Forgery vulnerability in mooSocial MooSocial Software v.Demo allows a remote attacker to execute arbitrary code via the D
- CVE-2023-40869Cross Site Scripting vulnerability in mooSocial mooSocial Software 3.1.6 and 3.1.7 allows a remote attacker to execute arbitrary code via a
- CVE-2023-40955A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0
- CVE-2023-40956A SQL injection vulnerability in Cloudroits Website Job Search v.15.0 allows a remote authenticated attacker to execute arbitrary code via t
- CVE-2023-40957A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0
- CVE-2023-40958A SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0, v.15.0 and v.16.0 fixed in pdm-14.0.1.0.0
- CVE-2023-41010Insecure Permissions vulnerability in Sichuan Tianyi Kanghe Communication Co., Ltd China Telecom Tianyi Home Gateway v.TEWA-700G allows a lo
- CVE-2023-41011Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker…
- CVE-2023-41156A Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2.001 allows remote attackers to inject arbi
- CVE-2023-41159A Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in Usermin 2.000 allows remote attackers to inject a
- CVE-2023-41160A Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001 allows remote attackers to inject arbitrary
- CVE-2023-41588A cross-site scripting (XSS) vulnerability in Time to SLA plugin v10.13.5 allows attackers to execute arbitrary web scripts or HTML via a cr
- CVE-2023-41592Froala Editor v4.0.1 to v4.1.1 was discovered to contain a cross-site scripting (XSS) vulnerability.froala/wysiwyg-editor · froala-editor
- CVE-2023-42178Lenosp 1.0.0-1.2.0 is vulnerable to SQL Injection via the log query module.
- CVE-2023-42180An arbitrary file upload vulnerability in the /user/upload component of lenosp 1.0-1.2.0 allows attackers to execute html code via a crafted
- CVE-2023-42362An arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to execute arbitrary commands and obtain sensitive
- CVE-2023-42405SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService