# CVEs published 2023-09-18

55 CVEs were published on September 18, 2023: 2 critical, 12 high. Days are UTC.

- [CVE-2023-42454](https://cve.now/CVE-2023-42454.md): SQLpage vulnerable to public exposure of database credentials (CVSS 10.0, lovasoa SQLpage · sqlpage)
- [CVE-2023-42446](https://cve.now/CVE-2023-42446.md): Pow Mnesia cache doesn't invalidate all expired keys on startup (CVSS 6.5, pow-auth pow)
- [CVE-2023-42443](https://cve.now/CVE-2023-42443.md): Vyper vulnerable to memory corruption in certain builtins utilizing \`msize\` (CVSS 8.1, vyperlang vyper · vyper)
- [CVE-2023-42441](https://cve.now/CVE-2023-42441.md): Vyper has incorrect re-entrancy lock when key is empty string (CVSS 5.3, vyperlang vyper · vyper)
- [CVE-2023-38255](https://cve.now/CVE-2023-38255.md): Socomec MOD3GP-SY-120K Cross-site Scripting (CVSS 6.5, Socomec MODULYS GP)
- [CVE-2023-38582](https://cve.now/CVE-2023-38582.md): Socomec MOD3GP-SY-120K Cross-site Scripting (CVSS 6.3, Socomec MODULYS GP)
- [CVE-2023-39446](https://cve.now/CVE-2023-39446.md): Socomec MOD3GP-SY-120K Cross-Site Request Forgery (CVSS 8.9, Socomec MODULYS GP)
- [CVE-2023-39452](https://cve.now/CVE-2023-39452.md): Socomec MOD3GP-SY-120K Plaintext Storage of a Password (CVSS 7.5, Socomec MODULYS GP)
- [CVE-2023-40221](https://cve.now/CVE-2023-40221.md): Socomec MOD3GP-SY-120K Code Injection (CVSS 8.8, Socomec MODULYS GP)
- [CVE-2023-41084](https://cve.now/CVE-2023-41084.md): Socomec MOD3GP-SY-120K Reliance on Cookies without Validation and Integrity Checking (CVSS 10.0, Socomec MODULYS GP)
- [CVE-2023-41965](https://cve.now/CVE-2023-41965.md): Socomec MOD3GP-SY-120K Insecure Storage of Sensitive Information (CVSS 7.5, Socomec MODULYS GP)
- [CVE-2023-41030](https://cve.now/CVE-2023-41030.md): Juplink RX4-1500 Hard-coded Credential Vulnerability (CVSS 6.3, Juplink RX4-1500)
- [CVE-2023-4806](https://cve.now/CVE-2023-4806.md): Glibc: potential use-after-free in getaddrinfo() (CVSS 5.9, Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…)
- [CVE-2023-4527](https://cve.now/CVE-2023-4527.md): Glibc: stack read overflow in getaddrinfo in no-aaaa mode (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2023-32187](https://cve.now/CVE-2023-32187.md): An Allocation of Resources Without Limits or Throttling vulnerability in SUSE k3s allows attackers with access to K3s servers' apiserver/sup (CVSS 7.5, SUSE k3s · github.com/k3s-io/k3s)
- [CVE-2023-34999](https://cve.now/CVE-2023-34999.md): A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (\< 5.7.6) and v6 (\< 6.5.0) that allows an attacker (CVSS 8.4, RTS VLink Virtual Matrix Software)
- [CVE-2023-5036](https://cve.now/CVE-2023-5036.md): Cross-Site Request Forgery (CSRF) in usememos/memos (CVSS 7.3, usememos/memos · github.com/usememos/memos)
- [CVE-2023-5034](https://cve.now/CVE-2023-5034.md): SourceCodester My Food Recipe Image Upload index.php unrestricted upload (CVSS 6.3, SourceCodester My Food Recipe)
- [CVE-2023-5033](https://cve.now/CVE-2023-5033.md): OpenRapid RapidCMS cate-edit-run.php sql injection (CVSS 6.3, OpenRapid RapidCMS)
- [CVE-2023-5032](https://cve.now/CVE-2023-5032.md): OpenRapid RapidCMS article-edit-run.php sql injection (CVSS 6.3, OpenRapid RapidCMS)
- [CVE-2023-41349](https://cve.now/CVE-2023-41349.md): ASUS RT-AX88U - externally-controlled format string (CVSS 8.8, ASUS RT-AX88U)
- [CVE-2023-35851](https://cve.now/CVE-2023-35851.md): SUNNET WMPro - SQL Injection (CVSS 7.5, SUNNET WMPro)
- [CVE-2023-35850](https://cve.now/CVE-2023-35850.md): SUNNET WMPro - Command Injection (CVSS 7.2, SUNNET WMPro)
- [CVE-2023-5031](https://cve.now/CVE-2023-5031.md): OpenRapid RapidCMS article-add.php sql injection (CVSS 6.3, OpenRapid RapidCMS)
- [CVE-2020-36766](https://cve.now/CVE-2020-36766.md): An issue was discovered in the Linux kernel before 5.8.6. (no CVSS)
- [CVE-2021-26837](https://cve.now/CVE-2021-26837.md): SQL Injection vulnerability in SearchTextBox parameter in Fortra (Formerly HelpSystems) DeliverNow before version 1.2.18, allows attackers t (no CVSS)
- [CVE-2023-33831](https://cve.now/CVE-2023-33831.md): A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands (no CVSS, @frangoteam/fuxa)
- [CVE-2023-34195](https://cve.now/CVE-2023-34195.md): An issue was discovered in SystemFirmwareManagementRuntimeDxe in Insyde InsydeH2O with kernel 5.0 through 5.5. (no CVSS)
- [CVE-2023-37611](https://cve.now/CVE-2023-37611.md): Cross Site Scripting (XSS) vulnerability in Neos CMS 8.3.3 allows a remote authenticated attacker to execute arbitrary code via a crafted SV (no CVSS, neos/media-browser)
- [CVE-2023-39039](https://cve.now/CVE-2023-39039.md): An information leak in Camp Style Project Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39040](https://cve.now/CVE-2023-39040.md): An information leak in Cheese Cafe Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (CVSS 6.5)
- [CVE-2023-39043](https://cve.now/CVE-2023-39043.md): An information leak in YKC Tokushima\_awayokocho Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39046](https://cve.now/CVE-2023-39046.md): An information leak in TonTon-Tei\_waiting Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (CVSS 6.5)
- [CVE-2023-39049](https://cve.now/CVE-2023-39049.md): An information leak in youmart-tokunaga v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39056](https://cve.now/CVE-2023-39056.md): An information leak in Coffee-jumbo v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39058](https://cve.now/CVE-2023-39058.md): An information leak in THE\_B\_members card v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-40788](https://cve.now/CVE-2023-40788.md): SpringBlade \<=V3.6.0 is vulnerable to Incorrect Access Control due to incorrect configuration in the default gateway resulting in unauthoriz (no CVSS)
- [CVE-2023-41443](https://cve.now/CVE-2023-41443.md): SQL injection vulnerability in Novel-Plus v.4.1.0 allows a remote attacker to execute arbitrary code via a crafted script to the sort parame (no CVSS)
- [CVE-2023-41595](https://cve.now/CVE-2023-41595.md): An issue in xui-xray v1.8.3 allows attackers to obtain sensitive information via default password. (no CVSS)
- [CVE-2023-41929](https://cve.now/CVE-2023-41929.md): A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow a local attacker to e (CVSS 7.3)
- [CVE-2023-42253](https://cve.now/CVE-2023-42253.md): Code-Projects Vehicle Management 1.0 is vulnerable to Cross Site Scripting (XSS) in Add Accounts via Invoice No, To, and Mammul. (no CVSS)
- [CVE-2023-42320](https://cve.now/CVE-2023-42320.md): Buffer Overflow vulnerability in Tenda AC10V4 v.US\_AC10V4.0si\_V16.03.10.13\_cn\_TDC01 allows a remote attacker to cause a denial of service vi (no CVSS)
- [CVE-2023-42328](https://cve.now/CVE-2023-42328.md): An issue in PeppermintLabs Peppermint v.0.2.4 and before allows a remote attacker to obtain sensitive information and execute arbitrary code (no CVSS)
- [CVE-2023-42359](https://cve.now/CVE-2023-42359.md): SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the va (no CVSS)
- [CVE-2023-42371](https://cve.now/CVE-2023-42371.md): Cross Site Scripting vulnerability in Summernote Rich Text Editor v.0.8.18 and before allows a remote attacker to execute arbitrary code via (no CVSS)
- [CVE-2023-42387](https://cve.now/CVE-2023-42387.md): An issue in TDSQL Chitu management platform v.10.3.19.5.0 allows a remote attacker to obtain sensitive information via get\_db\_info function (no CVSS)
- [CVE-2023-42520](https://cve.now/CVE-2023-42520.md): Certain WithSecure products allow a remote crash of a scanning engine via unpacking of crafted data files. (no CVSS)
- [CVE-2023-42521](https://cve.now/CVE-2023-42521.md): Certain WithSecure products allow a remote crash of a scanning engine via processing of a compressed file. (no CVSS)
- [CVE-2023-42522](https://cve.now/CVE-2023-42522.md): Certain WithSecure products allow a remote crash of a scanning engine via processing of an import struct in a PE file. (no CVSS)
- [CVE-2023-42523](https://cve.now/CVE-2023-42523.md): Certain WithSecure products allow a remote crash of a scanning engine via unpacking of a PE file. (no CVSS)
- [CVE-2023-42524](https://cve.now/CVE-2023-42524.md): Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. (no CVSS)
- [CVE-2023-42525](https://cve.now/CVE-2023-42525.md): Certain WithSecure products allow an infinite loop in a scanning engine via unspecified file types. (no CVSS)
- [CVE-2023-42526](https://cve.now/CVE-2023-42526.md): Certain WithSecure products allow a remote crash of a scanning engine via decompression of crafted data files. (no CVSS)
- [CVE-2023-43114](https://cve.now/CVE-2023-43114.md): An issue was discovered in Qt before 5.15.16, 6.x before 6.2.10, and 6.3.x through 6.5.x before 6.5.3 on Windows. (no CVSS)
- [CVE-2023-43115](https://cve.now/CVE-2023-43115.md): In Artifex Ghostscript through 10.01.2, gdevijs.c in GhostPDL can lead to remote code execution via crafted PostScript documents because the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.