CVEs published September 18, 2023
55 CVEs were published on September 18, 2023: 2 critical, 12 high.
- Published
- 55
- Critical
- 2
- High
- 12
- Medium
- 13
- Low
- 0
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- Socomec MODULYS GP
- 7
- OpenRapid RapidCMS
- 3
- SUNNET WMPro
- 2
- vyperlang vyper · vyper
- 2
- @frangoteam/fuxa
- 1
- ASUS RT-AX88U
- 1
- Juplink RX4-1500
- 1
- lovasoa SQLpage · sqlpage
- 1
- neos/media-browser
- 1
- pow-auth pow
- 1
Critical 2
High 12
- CVE-2023-42443Vyper vulnerable to memory corruption in certain builtins utilizing `msize`vyperlang vyper · vyper
- CVE-2023-39446Socomec MOD3GP-SY-120K Cross-Site Request ForgerySocomec MODULYS GP
- CVE-2023-39452Socomec MOD3GP-SY-120K Plaintext Storage of a PasswordSocomec MODULYS GP
- CVE-2023-40221Socomec MOD3GP-SY-120K Code InjectionSocomec MODULYS GP
- CVE-2023-41965Socomec MOD3GP-SY-120K Insecure Storage of Sensitive InformationSocomec MODULYS GP
- CVE-2023-32187An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/supSUSE k3s · github.com/k3s-io/k3s
- CVE-2023-34999A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attackerRTS VLink Virtual Matrix Software
- CVE-2023-5036Cross-Site Request Forgery (CSRF) in usememos/memosusememos/memos · github.com/usememos/memos
- CVE-2023-41349ASUS RT-AX88U - externally-controlled format stringASUS RT-AX88U
- CVE-2023-35851SUNNET WMPro - SQL InjectionSUNNET WMPro
- CVE-2023-35850SUNNET WMPro - Command InjectionSUNNET WMPro
- CVE-2023-41929A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow a local attacker to e
Medium, low and unrated 41
- CVE-2023-42446Pow Mnesia cache doesn't invalidate all expired keys on startuppow-auth pow
- CVE-2023-42441Vyper has incorrect re-entrancy lock when key is empty stringvyperlang vyper · vyper
- CVE-2023-38255Socomec MOD3GP-SY-120K Cross-site ScriptingSocomec MODULYS GP
- CVE-2023-38582Socomec MOD3GP-SY-120K Cross-site ScriptingSocomec MODULYS GP
- CVE-2023-41030Juplink RX4-1500 Hard-coded Credential VulnerabilityJuplink RX4-1500
- CVE-2023-4806Glibc: potential use-after-free in getaddrinfo()Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…
- CVE-2023-4527Glibc: stack read overflow in getaddrinfo in no-aaaa modeRed Hat Enterprise Linux
- CVE-2023-5034SourceCodester My Food Recipe Image Upload index.php unrestricted uploadSourceCodester My Food Recipe
- CVE-2023-5033OpenRapid RapidCMS cate-edit-run.php sql injectionOpenRapid RapidCMS
- CVE-2023-5032OpenRapid RapidCMS article-edit-run.php sql injectionOpenRapid RapidCMS
- CVE-2023-5031OpenRapid RapidCMS article-add.php sql injectionOpenRapid RapidCMS
- CVE-2020-36766An issue was discovered in the Linux kernel before 5.8.6.
- CVE-2021-26837SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers t
- CVE-2023-33831A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands @frangoteam/fuxa
- CVE-2023-34195An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2023-37611Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SVneos/media-browser
- CVE-2023-39039An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39040An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39043An information leak in YKC Tokushima_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39046An information leak in TonTon-Tei_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39049An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39056An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39058An information leak in THE_B_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-40788SpringBlade <=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthoriz
- CVE-2023-41443SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parame
- CVE-2023-41595An issue in xui-xray v1.8.3 allows attackers to obtain sensitive information via default password.
- CVE-2023-42253Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting (XSS) in Add Accounts via Invoice No, To, and Mammul.
- CVE-2023-42320Buffer Overflow vulnerability in Tenda AC10V4 v.US_AC10V4.0si_V16.03.10.13_cn_TDC01 allows a remote attacker to cause a denial of service vi
- CVE-2023-42328An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code
- CVE-2023-42359SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the va
- CVE-2023-42371Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via
- CVE-2023-42387An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get_db_info function
- CVE-2023-42520Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files.
- CVE-2023-42521Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file.
- CVE-2023-42522Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file.
- CVE-2023-42523Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file.
- CVE-2023-42524Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types.
- CVE-2023-42525Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types.
- CVE-2023-42526Certain WithSecure products allow a remote crash of a scanning engine via decompression of crafted data files.
- CVE-2023-43114An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows.
- CVE-2023-43115In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because the