# CVEs published 2023-09-19

56 CVEs were published on September 19, 2023: 4 critical, 18 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-2995](https://cve.now/CVE-2023-2995.md): Leyka \< 3.30.4 - Admin+ Stored XSS (CVSS 4.8, Leyka)
- [CVE-2023-4376](https://cve.now/CVE-2023-4376.md): Serial Codes Generator and Validator with WooCommerce Support \< 2.4.15 - Admin+ Stored XSS (CVSS 4.8, Serial Codes Generator and Validator with WooCommerce Suppo…)
- [CVE-2023-22513](https://cve.now/CVE-2023-22513.md): This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server. (CVSS 8.5, Atlassian Bitbucket Data Center · Atlassian Bitbucket Server)
- [CVE-2023-43566](https://cve.now/CVE-2023-43566.md): In JetBrains TeamCity before 2023.05.4 stored XSS was possible during nodes configuration (CVSS 3.5, JetBrains TeamCity)
- [CVE-2023-42793](https://cve.now/CVE-2023-42793.md): In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible (CVSS 9.8, KEV, JetBrains TeamCity)
- [CVE-2023-42452](https://cve.now/CVE-2023-42452.md): Mastodon vulnerable to Stored XSS through the translation feature (CVSS 6.1, mastodon)
- [CVE-2023-42451](https://cve.now/CVE-2023-42451.md): Mastodon Invalid Domain Name Normalization vulnerability (CVSS 7.4, mastodon)
- [CVE-2023-42450](https://cve.now/CVE-2023-42450.md): Mastodon Server-Side Request Forgery vulnerability (CVSS 5.4, mastodon)
- [CVE-2023-32182](https://cve.now/CVE-2023-32182.md): A Improper Link Resolution Before File Access ('Link Following') vulnerability in SUSE SUSE Linux Enterprise Desktop 15 SP5 postfix, SUSE SU (CVSS 5.9, SUSE Linux Enterprise Desktop 15 SP5 · SUSE Linux Enterp… +1)
- [CVE-2023-42447](https://cve.now/CVE-2023-42447.md): blurhash panics on parsing crafted inputs (CVSS 8.6, whisperfish blurhash-rs · blurhash)
- [CVE-2023-3892](https://cve.now/CVE-2023-3892.md): Unsafe XML parsing of 3rd party DICOM private tags may lead to XXE (CVSS 5.6, MIM Software MIM Assistant · MIM Software MIM Client)
- [CVE-2023-42444](https://cve.now/CVE-2023-42444.md): phonenumber panics on parsing crafted RF3966 inputs (CVSS 8.6, whisperfish rust-phonenumber · phonenumber)
- [CVE-2023-41890](https://cve.now/CVE-2023-41890.md): Sustainsys.Saml2 Insufficient Identity Provider Issuer Validation (CVSS 7.5, Sustainsys Saml2 · Sustainsys.Saml2 +1)
- [CVE-2023-41179](https://cve.now/CVE-2023-41179.md): A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security an (CVSS 7.2, KEV, Trend Micro Apex One · Trend Micro Worry-Free Business Secu…)
- [CVE-2023-4096](https://cve.now/CVE-2023-4096.md): Weak password recovery mechanism vulnerability in Fujitsu Arconte Áurea (CVSS 8.6, Fujitsu Arconte Áurea)
- [CVE-2023-4095](https://cve.now/CVE-2023-4095.md): User enumeration vulnerability in Fujitsu Arconte Áurea (CVSS 5.3, Fujitsu Arconte Áurea)
- [CVE-2023-4094](https://cve.now/CVE-2023-4094.md): Weak authentication vulnerability in Fujitsu Arconte Áurea (CVSS 6.5, Fujitsu Arconte Áurea)
- [CVE-2022-47559](https://cve.now/CVE-2022-47559.md): Cross-Site Request Forgery in Ormazabal products (CVSS 8.6, Ormazabal ekorCCP · Ormazabal ekorRCI)
- [CVE-2023-4093](https://cve.now/CVE-2023-4093.md): Reflected and persistent XSS vulnerability in Fujitsu Arconte Áurea (CVSS 5.5, Fujitsu Arconte Áurea)
- [CVE-2022-47558](https://cve.now/CVE-2022-47558.md): Improper Access Control in Ormazabal products (CVSS 9.4, Ormazabal ekorCCP · Ormazabal ekorRCI)
- [CVE-2023-4092](https://cve.now/CVE-2023-4092.md): SQL injection vulnerability in Fujitsu Arconte Áurea (CVSS 8.8, Fujitsu Arconte Áurea)
- [CVE-2022-47557](https://cve.now/CVE-2022-47557.md): Use of Password Hash With Insufficient Computational Effort in Ormazabal products (CVSS 6.1, Ormazabal ekorCCP · Ormazabal ekorRCI)
- [CVE-2022-47556](https://cve.now/CVE-2022-47556.md): Uncontrolled Resource Consumption in Ormazabal products (CVSS 6.5, Ormazabal ekorRCI)
- [CVE-2022-47555](https://cve.now/CVE-2022-47555.md): Improper Neutralization of Special Elements in Ormazabal products (CVSS 9.3, Ormazabal ekorCCP · Ormazabal ekorRCI)
- [CVE-2022-47554](https://cve.now/CVE-2022-47554.md): Exposure of Sensitive Information in Ormazabal products (CVSS 8.2, Ormazabal ekorCCP · Ormazabal ekorRCI)
- [CVE-2023-41834](https://cve.now/CVE-2023-41834.md): Apache Flink Stateful Functions allowed HTTP header injection due to Improper Neutralization of CRLF Sequences (no CVSS, Apache Software Foundation Apache Flink Stateful Functions)
- [CVE-2023-23957](https://cve.now/CVE-2023-23957.md): Open Redirection Vulnerability in Symantec Identity Portal 14.4 (no CVSS, Symantec - A Division of Broadcom Symantec Identity Governa…)
- [CVE-2022-47553](https://cve.now/CVE-2022-47553.md): Improper Authorization in Ormazabal products (CVSS 8.6, Ormazabal ekorCCP · Ormazabal ekorRCI)
- [CVE-2023-32649](https://cve.now/CVE-2023-32649.md): DoS on IDS parsing of malformed asset fields in Guardian/CMC \>= 22.6.0 before 22.6.3 and 23.1.0 (CVSS 7.5, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2023-29245](https://cve.now/CVE-2023-29245.md): SQL Injection on IDS parsing of malformed asset fields in Guardian/CMC \>= 22.6.0 before 22.6.3 and 23.1.0 (CVSS 8.1, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2023-2567](https://cve.now/CVE-2023-2567.md): Authenticated SQL Injection on Query functionality in Guardian/CMC before 22.6.3 and 23.1.0 (CVSS 8.8, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2023-32184](https://cve.now/CVE-2023-32184.md): A Insecure Storage of Sensitive Information vulnerability in openSUSE opensuse-welcome allows local attackers to execute code as the user th (CVSS 7.8, opensuse-welcome)
- [CVE-2023-0773](https://cve.now/CVE-2023-0773.md): Unauthorized Access Control Vulnerability in Uniview IP Camera (CVSS 9.1, Uniview IP Camera IPC322LB-SF28-A)
- [CVE-2023-32186](https://cve.now/CVE-2023-32186.md): A Allocation of Resources Without Limits or Throttling vulnerability in SUSE RKE2 allows attackers with access to K3s servers apiserver/sup (CVSS 7.5, SUSE RKE2 · github.com/rancher/rke2)
- [CVE-2023-5009](https://cve.now/CVE-2023-5009.md): Incorrect Authorization in GitLab (CVSS 8.2, GitLab)
- [CVE-2023-5054](https://cve.now/CVE-2023-5054.md): Super Store Finder \<= 6.9.3 - Unauthenticated Email Creation/Sending (CVSS 5.8, Super Store Finder)
- [CVE-2023-26143](https://cve.now/CVE-2023-26143.md): Versions of the package blamer before 1.0.4 are vulnerable to Arbitrary Argument Injection via the blameByFile() API. (CVSS 6.5, blamer)
- [CVE-2023-5060](https://cve.now/CVE-2023-5060.md): Cross-site Scripting (XSS) - DOM in librenms/librenms (CVSS 8.4, librenms/librenms)
- [CVE-2020-24089](https://cve.now/CVE-2020-24089.md): An issue was discovered in ImfHpRegFilter.sys in IOBit Malware Fighter version 8.0.2, allows local attackers to cause a denial of service (D (no CVSS)
- [CVE-2022-28357](https://cve.now/CVE-2022-28357.md): NATS nats-server 2.2.0 through 2.7.4 allows directory traversal because of an unintended path to a management action from a management accou (no CVSS, github.com/nats-io/nats-server · github.com/nats-io/nats-se…)
- [CVE-2023-31808](https://cve.now/CVE-2023-31808.md): Technicolor TG670 10.5.N.9 devices contain multiple accounts with hard-coded passwords. (no CVSS)
- [CVE-2023-36319](https://cve.now/CVE-2023-36319.md): File Upload vulnerability in Openupload Stable v.0.4.3 allows a remote attacker to execute arbitrary code via the action parameter of the co (no CVSS)
- [CVE-2023-38351](https://cve.now/CVE-2023-38351.md): MiniTool Partition Wizard 12.8 contains an insecure installation mechanism that allows attackers to achieve remote code execution through a (no CVSS)
- [CVE-2023-38352](https://cve.now/CVE-2023-38352.md): MiniTool Partition Wizard 12.8 contains an insecure update mechanism that allows attackers to achieve remote code execution through a man in (no CVSS)
- [CVE-2023-38353](https://cve.now/CVE-2023-38353.md): MiniTool Power Data Recovery version 11.6 and before contains an insecure in-app payment system that allows attackers to steal highly sensit (no CVSS)
- [CVE-2023-38354](https://cve.now/CVE-2023-38354.md): MiniTool Shadow Maker version 4.1 contains an insecure installation process that allows attackers to achieve remote code execution through a (no CVSS)
- [CVE-2023-38355](https://cve.now/CVE-2023-38355.md): MiniTool Movie Maker 7.0 contains an insecure installation process that allows attackers to achieve remote code execution through a man in t (no CVSS)
- [CVE-2023-38356](https://cve.now/CVE-2023-38356.md): MiniTool Power Data Recovery 11.6 contains an insecure installation process that allows attackers to achieve remote code execution through a (no CVSS)
- [CVE-2023-39575](https://cve.now/CVE-2023-39575.md): A reflected cross-site scripting (XSS) vulnerability in the url\_str URL parameter of ISL ARP Guard v4.0.2 allows attackers to execute arbitr (no CVSS)
- [CVE-2023-40931](https://cve.now/CVE-2023-40931.md): A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrar (no CVSS)
- [CVE-2023-40932](https://cve.now/CVE-2023-40932.md): A Cross-site scripting (XSS) vulnerability in Nagios XI version 5.11.1 and below allows authenticated attackers with access to the custom lo (no CVSS)
- [CVE-2023-40933](https://cve.now/CVE-2023-40933.md): A SQL injection vulnerability in Nagios XI v5.11.1 and below allows authenticated attackers with announcement banner configuration privilege (no CVSS)
- [CVE-2023-40934](https://cve.now/CVE-2023-40934.md): A SQL injection vulnerability in Nagios XI 5.11.1 and below allows authenticated attackers with privileges to manage host escalations in the (no CVSS)
- [CVE-2023-41387](https://cve.now/CVE-2023-41387.md): A SQL injection in the flutter\_downloader component through 1.11.1 for iOS allows remote attackers to steal session tokens and overwrite arb (no CVSS)
- [CVE-2023-41599](https://cve.now/CVE-2023-41599.md): An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal. (no CVSS)
- [CVE-2023-42399](https://cve.now/CVE-2023-42399.md): Cross Site Scripting vulnerability in xdsoft.net Jodit Editor v.4.0.0-beta.86 allows a remote attacker to obtain sensitive information via t (no CVSS, jodit)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.