CVEs published September 15, 2023
77 CVEs were published on September 15, 2023: 13 critical, 19 high.
- Published
- 77
- Critical
- 13
- High
- 19
- Medium
- 24
- Low
- 5
- Unrated
- 16
- Now in CISA KEV
- 0
- Fix available
- 37
Most affected products
- librenms/librenms
- 6
- Saphira Connect
- 5
- discourse
- 4
- Microsoft Edge
- 3
- Academy LMS
- 2
- contiki-ng
- 2
- OpenRefine · org.openrefine:database
- 2
- signalwire freeswitch
- 2
- Supcon InPlant SCADA
- 2
- app1pro Shopicial
- 1
Critical 13
- CVE-2023-36735Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2023-41887Remote Code exec in project import with mysql jdbc url attackOpenRefine · org.openrefine:database
- CVE-2023-4662RCE in Saphira ConnectSaphira Connect
- CVE-2023-4661SQLi in Saphira ConnectSaphira Connect
- CVE-2023-4833SQLi in Besttem's Network Marketing SoftwareBesttem Network Marketing Software
- CVE-2023-4835SQLi in CF's Oil Management SoftwareCF Software Oil Management Software
- CVE-2023-4231SQLi in Cevik Informatics' Online Payment SystemCevik Informatics Online Payment System
- CVE-2023-4670SQLi in Innosa's ProbbysInnosa Probbys
- CVE-2023-4831SQLi in nCepNcode Ncep
- CVE-2023-4830SQLi in Tura's SignalixTura Signalix
- CVE-2023-4673SQLi in Sanalogy's TurasistanSanalogy Turasistan
- CVE-2023-4982Cross-site Scripting (XSS) - Stored in librenms/librenmslibrenms/librenms
- CVE-2023-4978Cross-site Scripting (XSS) - DOM in librenms/librenmslibrenms/librenms
High 19
- CVE-2023-36562Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2023-42442JumpServer session replays download without authenticationjumpserver
- CVE-2023-42439GeoNode SSRF Bypass to return internal host datageonode
- CVE-2023-0813Network-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforcedgithub.com/netobserv/network-observability-console-plugin ·…
- CVE-2023-0923Odh-notebook-controller-container: missing authorization allows for file contents disclosureRed Hat RHODS-1.22-RHEL-8
- CVE-2023-41886OpenRefine vulnerable to arbitrary file read in project import with mysql jdbc url attackOpenRefine · org.openrefine:database
- CVE-2023-41325OP-TEE double free in shdr_verify_signatureOP-TEE optee_os
- CVE-2023-40019FreeSWITCH allows authorized users to cause a denial of service attack by sending re-INVITE with SDP containing duplicate codec namessignalwire freeswitch
- CVE-2023-40018FreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component IDsignalwire freeswitch
- CVE-2023-38507Strapi Improper Rate Limiting vulnerabilitystrapi · @strapi/admin +1
- CVE-2023-4991NextBX QWAlerter QWAlerter.exe unquoted search pathNextBX QWAlerter
- CVE-2023-4665Privilage Escalation in Saphira ConnectSaphira Connect
- CVE-2023-4664Privilage Escalation in Saphira ConnectSaphira Connect
- CVE-2023-38039When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.curl
- CVE-2023-3891Lapce v0.2.8 - Privilege escalation via Race ConditionLapce
- CVE-2023-4981Cross-site Scripting (XSS) - DOM in librenms/librenmslibrenms/librenms
- CVE-2023-4980Cross-site Scripting (XSS) - Generic in librenms/librenmslibrenms/librenms
- CVE-2023-4979Cross-site Scripting (XSS) - Reflected in librenms/librenmslibrenms/librenms
- CVE-2023-4977Code Injection in librenms/librenmslibrenms/librenms
Medium, low and unrated 45
- CVE-2023-36727Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2022-3261Plain-text passwords saved in /var/log/messagesopenstack · Red Hat OpenStack Platform
- CVE-2023-41900Jetty's OpenId Revoked authentication allows one requesteclipse jetty.project · org.eclipse.jetty:jetty-openid
- CVE-2023-41889Late-Unicode normalization vulnerability in SHIRASAGIshirasagi
- CVE-2023-41880Miscompilation of wasm `i64x2.shr_s` instruction with constant input on x86_64bytecodealliance wasmtime · wasmtime
- CVE-2023-40167Jetty accepts "+" prefixed value in Content-Lengtheclipse jetty.project · org.eclipse.jetty:jetty-http
- CVE-2023-41043Discourse DoS via SvgSprite cachediscourse
- CVE-2023-41042Discourse DoS via remote theme assetsdiscourse
- CVE-2023-40588Discourse DoS via 2FA and Security Key Namesdiscourse
- CVE-2023-38706Discourse vulnerable to DoS via draftsdiscourse
- CVE-2023-37459Out-of-bounds read when processing a received IPv6 packetcontiki-ng
- CVE-2023-37281Out-of-bounds read during IPHC address decompressioncontiki-ng
- CVE-2023-37263Strapi's field level permissions not being respected in relationship titlestrapi · @strapi/plugin-content-manager
- CVE-2023-36472Strapi may leak sensitive user information, user reset password, tokens via content-manager viewsstrapi · @strapi/plugin-content-manager +2
- CVE-2023-36479Jetty vulnerable to errant command quoting in CGI Servleteclipse jetty.project · org.eclipse.jetty:jetty-servlets +3
- CVE-2023-4988Bettershop LaikeTui unrestricted uploadBettershop LaikeTui
- CVE-2023-4987infinitietech taskhub GET Parameter get_tasks_list sql injectioninfinitietech taskhub
- CVE-2023-4986Supcon InPlant SCADA Project.xml unknown vulnerabilitySupcon InPlant SCADA
- CVE-2023-4985Supcon InPlant SCADA Project.xml improper authenticationSupcon InPlant SCADA
- CVE-2023-4984didi KnowSearch 1 credentials storagedidi KnowSearch
- CVE-2023-4983app1pro Shopicial search cross site scriptingapp1pro Shopicial
- CVE-2022-3466Cri-o: security regression of cve-2022-27652Red Hat OpenShift Container Platform
- CVE-2023-4959Quay: cross-site request forgery (csrf) on config-editor pageRed Hat Quay
- CVE-2023-4663XSS in Saphira ConnectSaphira Connect
- CVE-2023-32461 Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability.Dell PowerEdge Platform
- CVE-2023-4963WS Facebook Like Box Widget <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewebshouter WS Facebook Like Box Widget
- CVE-2022-20917A vulnerability in the Extensible Messaging and Presence Protocol (XMPP) message processing feature of Cisco Jabber could allow an authenticCisco Jabber
- CVE-2023-4974Academy LMS GET Parameter filter sql injectionAcademy LMS
- CVE-2023-4973Academy LMS GET Parameter filter cross site scriptingAcademy LMS
- CVE-2022-47848An issue was discovered in Bezeq Vtech NB403-IL version BZ_2.02.07.09.13.01 and Vtech IAD604-IL versions BZ_2.02.07.09.13.01, BZ_2.02.07.09.
- CVE-2023-28614Freewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters to a report page.
- CVE-2023-36160An issue was discovered in Qubo Smart Plug10A version HSP02_01_01_14_SYSTEM-10 A, allows local attackers to gain sensitive information and o
- CVE-2023-36657An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996.
- CVE-2023-36658An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996.
- CVE-2023-36659An issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996.
- CVE-2023-39643Bl Modules xmlfeeds before v3.9.8 was discovered to contain a SQL injection vulnerability via the component SearchApiXml::Xmlfeeds().
- CVE-2023-40982A stored cross-site scripting (XSS) vulnerability in Webmin v2.100 allows attackers to execute arbitrary web scripts or HTML via a crafted p
- CVE-2023-40983A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scr
- CVE-2023-40984A reflected cross-site scripting (XSS) vulnerability in the File Manager function of Webmin v2.100 allows attackers to execute malicious scr
- CVE-2023-40985An issue was discovered in Webmin 2.100.
- CVE-2023-40986A stored cross-site scripting (XSS) vulnerability in the Usermin Configuration function of Webmin v2.100 allows attackers to execute arbitra
- CVE-2023-41436Cross Site Scripting vulnerability in CSZCMS v.1.3.0 allows a local attacker to execute arbitrary code via a crafted script to the Additiona
- CVE-2023-41626Gradio v3.27.0 was discovered to contain an arbitrary file upload vulnerability via the /upload interface.gradio
- CVE-2023-42270Grocy <= 4.0.2 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2023-42398An issue in zzCMS v.2023 allows a remote attacker to execute arbitrary code and obtain sensitive information via the ueditor component in co