CVEs published September 20, 2023
124 CVEs were published on September 20, 2023: 12 critical, 32 high.
- Published
- 124
- Critical
- 12
- High
- 32
- Medium
- 24
- Low
- 4
- Unrated
- 52
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- NVIDIA DGX H100 BMC
- 14
- Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- 5
- github.com/schollz/croc/v9 · github.com/schollz/croc +2
- 4
- Jenkins Project Jenkins Build Failure Analyzer Plugin · com…
- 4
- dolibarr/dolibarr
- 3
- Ormazabal ekorCCP · Ormazabal ekorRCI
- 3
- Progress Software MOVEit Transfer
- 3
- github.com/schollz/croc · github.com/schollz/croc/v6 +2
- 2
- ISC BIND
- 2
- JTEKT ELECTRONICS Kostac PLC Programming Software
- 2
Critical 12
- CVE-2023-5074Authentication Bypass in D-Link D-View 8D-Link D-View
- CVE-2023-2262Rockwell Automation Select Logix Communication Modules Vulnerable to Email Object Buffer OverflowRockwell Automation 1756-EN2T Series A, B, C · Rockwell… +20
- CVE-2023-0118Foreman: arbitrary code execution through templatesforeman · Red Hat Satellite 6.11 for RHEL +3
- CVE-2023-22644JWT token compromise can allow malicious actions including Remote Code Execution (RCE)SUSE neuvector · github.com/neuvector/neuvector
- CVE-2023-2163Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege EscalationLinux Kernel
- CVE-2023-4088Malicious Code Execution Vulnerability in FA Engineering Software ProductsMitsubishi Electric GX Works3 · Mitsubishi Electric AL-… +22
- CVE-2023-34575SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCar
- CVE-2023-42322Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information.
- CVE-2023-43371Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php.
- CVE-2023-43373Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n_utente_agg parameter at /hoteldruid/interconnessioni.php
- CVE-2023-43374Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id_utente_log parameter at /hoteldruid/personalizza.php.
- CVE-2023-43375Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscadd
High 32
- CVE-2023-37279Faktory Web Dashboard can lead to denial of service(DOS) via malicious user inputcontribsys faktory · github.com/contribsys/faktory
- CVE-2023-37410IBM Personal Communications privilege escalationIBM Person Communications
- CVE-2022-3596Instack-undercloud: rsync leaks information to undercloudRed Hat OpenStack Platform 13.0 - ELS · Red Hat OpenStack P…
- CVE-2023-43496Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions fJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-40043MOVEit Transfer System Administrator SQL InjectionProgress Software MOVEit Transfer
- CVE-2023-42660MOVEit Transfer Machine Interface SQL InjectionProgress Software MOVEit Transfer
- CVE-2023-43635Vault Key Sealed With SHA1 PCRsLF-Edge, Zededa EVE OS · github.com/lf-edge/eve
- CVE-2023-43636Rootfs Not ProtectedLF-Edge, Zededa EVE OS · github.com/lf-edge/eve +1
- CVE-2023-43630Config Partition Not Measured From 2 FrontsLF-Edge, Zededa EVE OS · github.com/lf-edge/eve
- CVE-2023-0462Arbitrary code execution through yaml global parametersforeman · Red Hat Satellite
- CVE-2023-43478Unauthenticated configuration restore and firmware updateTelstra Smart Modem Gen
- CVE-2023-0829Cross-Site Scripting (XSS) vulnerability in PleskPlesk
- CVE-2023-4236named may terminate unexpectedly under high DNS-over-TLS query loadISC BIND
- CVE-2023-3341A stack exhaustion flaw in control channel code may cause named to terminate unexpectedlyISC BIND
- CVE-2023-4853Quarkus: http security policy bypassRed Hat Openshift Serverless 1 on RHEL · Red Hat build… +13
- CVE-2022-47562Allocation of Resources Without Limits or Throttling in Ormazabal productsOrmazabal ekorCCP · Ormazabal ekorRCI
- CVE-2022-47561Unprotected Storage of Credentials in Ormazabal productsOrmazabal ekorCCP · Ormazabal ekorRCI
- CVE-2023-31009NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation.NVIDIA DGX H100 BMC
- CVE-2023-31008NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation.NVIDIA DGX H100 BMC
- CVE-2023-25533NVIDIA DGX H100 BMC contains a vulnerability in the web UI, where an attacker may cause improper input validation.NVIDIA DGX H100 BMC
- CVE-2023-25531NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials.NVIDIA DGX H100 BMC
- CVE-2023-25530NVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation.NVIDIA DGX H100 BMC
- CVE-2023-25529NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of NVIDIA DGX H100 BMC · NVIDIA DGX A100 BMC
- CVE-2023-25528NVIDIA DGX H100 baseboard management controller (BMC) contains a vulnerability in a web server plugin, where an unauthenticated attacker mayNVIDIA DGX H100 BMC
- CVE-2023-25527NVIDIA DGX H100 BMC contains a vulnerability in the host KVM daemon, where an authenticated local attacker may cause corruption of kernel meNVIDIA DGX H100 BMC
- CVE-2023-25525NVIDIA Cumulus Linux contains a vulnerability in forwarding where a VxLAN-encapsulated IPv6 packet received on an SVI interface with DMAC/DINVIDIA Cumulus Linux
- CVE-2023-38887File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive indolibarr/dolibarr
- CVE-2023-43202D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler.
- CVE-2023-43203D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a stack overflow vulnerability in the function update_users.
- CVE-2023-43204D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50.
- CVE-2023-43206D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler.
- CVE-2023-43207D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler.
Medium, low and unrated 80
- CVE-2023-22024In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESET and RDS6_CONN_RESET, that arOracle Linux · Oracle VM
- CVE-2023-38718IBM Robotic Process Automation information disclosureIBM Robotic Process Automation
- CVE-2023-40368IBM Storage Protect information disclosureIBM Storage Protect Client · IBM Storage Protect for Spa… +1
- CVE-2023-20597Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.AMD Ryzen™ 3000 Series Desktop Processors “Matisse” · A… +10
- CVE-2023-20594Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access.AMD Ryzen™ 3000 Series Desktop Processors “Matisse” · A… +14
- CVE-2023-42656MOVEit Transfer Reflected XSSProgress Software MOVEit Transfer
- CVE-2023-43498In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-43502A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete FailJenkins Project Jenkins Build Failure Analyzer Plugin · com…
- CVE-2023-43501A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to conneJenkins Project Jenkins Build Failure Analyzer Plugin · com…
- CVE-2023-43500A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to Jenkins Project Jenkins Build Failure Analyzer Plugin · com…
- CVE-2023-43499Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site Jenkins Project Jenkins Build Failure Analyzer Plugin · com…
- CVE-2023-43497In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in thJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-43495Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNotJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-43494Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., pJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-2508CSRF in PaperCutNG Mobility Print leads to sophisticated phishingPaperCut MF/NG Mobility Print
- CVE-2022-3916Keycloak: session takeover with oidc offline refreshtokensRed Hat Single Sign-On · Red Hat RHEL-8 based Middleware… +1
- CVE-2022-1438Keycloak: xss on impersonation under specific circumstancesRed Hat Single Sign-On · Red Hat RHEL-8 based Middleware… +1
- CVE-2023-43477Post-Auth Command Injection in Telstra Smart Modem Gen 2 (Arcadyan LH1000)Telstra Smart Modem Gen
- CVE-2022-45448Cross-site Scripting in M4 PDF plugin for Prestashop sitesPrestashop M4 PDF plugin
- CVE-2023-5042Sensitive information disclosure due to insecure folder permissions.Acronis Cyber Protect Home Office · Acronis True Image OEM
- CVE-2023-5084Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacphestiacp/hestiacp
- CVE-2022-45447Path Traversal in M4 PDF plugin for Prestashop sitesPrestashop M4 PDF plugin
- CVE-2023-34047Exposure of data and identity to wrong session in Spring for GraphQLSpring for GraphQL · org.springframework.graphql:spring-gra…
- CVE-2023-41374Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier.JTEKT ELECTRONICS Kostac PLC Programming Software
- CVE-2023-41375Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0.JTEKT ELECTRONICS Kostac PLC Programming Software
- CVE-2022-47560Cleartext Transmission of Sensitive Information in Ormazabal productsOrmazabal ekorCCP · Ormazabal ekorRCI
- CVE-2023-26144Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the Ovgraphql
- CVE-2023-5063Widget Responsive for Youtube <= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodestefanoai Widget Responsive for Youtube
- CVE-2023-5062WordPress Charts <= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewebfactory WordPress Charts
- CVE-2023-31014NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device canNVIDIA GeForce NOW for Android mobile and TV app
- CVE-2023-31015NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue.NVIDIA DGX H100 BMC
- CVE-2023-31013NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation.NVIDIA DGX H100 BMC
- CVE-2023-31012NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation.NVIDIA DGX H100 BMC
- CVE-2023-31011NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation.NVIDIA DGX H100 BMC
- CVE-2023-31010NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation.NVIDIA DGX H100 BMC
- CVE-2023-25534NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation.NVIDIA DGX H100 BMC
- CVE-2023-25532NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials.NVIDIA DGX H100 BMC
- CVE-2023-25526NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exceNVIDIA Cumulus Linux
- CVE-2019-19450paraparser in ReportLab before 3.5.31 allows remote code execution because start_unichar in paraparser.py evaluates untrusted user input in reportlab
- CVE-2023-36109Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma_stringbuilder_append_ra
- CVE-2023-36234Cross Site Scripting (XSS) vulnerability in Netbox 3.5.1, allows attackers to execute arbitrary code via Name field in device-roles/add func
- CVE-2023-38875A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary Java
- CVE-2023-38876A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary Java
- CVE-2023-38886An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.dolibarr/dolibarr
- CVE-2023-38888Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and execdolibarr/dolibarr
- CVE-2023-39041An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39044An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39045An information leak in kokoroe_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39052An information leak in Earthgarden_waiting 13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39675SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php.
- CVE-2023-39677MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclo
- CVE-2023-40618A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 as well as Visual Project Explorer
- CVE-2023-40619phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-contro
- CVE-2023-40930An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mn
- CVE-2023-41484An issue in cimg.eu Cimg Library v2.9.3 allows an attacker to obtain sensitive information via a crafted JPEG file.
- CVE-2023-41902An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by
- CVE-2023-42147An issue in CloudExplorer Lite 1.3.1 allows an attacker to obtain sensitive information via the login key component.
- CVE-2023-42321Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admi
- CVE-2023-42331A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manage_uploads.php component.
- CVE-2023-42334An Indirect Object Reference (IDOR) in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to escalate privileges via the
- CVE-2023-42335Unrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to execute arbitrary code v
- CVE-2023-42464A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17.
- CVE-2023-43134There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the d
- CVE-2023-43135There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensiti
- CVE-2023-43137TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authenticat
- CVE-2023-43138TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentica
- CVE-2023-43196D-Link DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the zn_jb parameter in the arp_sys.asp function.
- CVE-2023-43197D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the fn parameter in the tgfile.asp function.
- CVE-2023-43198D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the popupId parameter in the H5/hi_block.asp function
- CVE-2023-43199D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the prev parameter in the H5/login.cgi function.
- CVE-2023-43200D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.data function.
- CVE-2023-43201D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi_up parameter in the qos_ext.asp function.
- CVE-2023-43376A cross-site scripting (XSS) vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts
- CVE-2023-43377A cross-site scripting (XSS) vulnerability in /hoteldruid/visualizza_contratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrar
- CVE-2023-43616An issue was discovered in Croc through 9.6.5.github.com/schollz/croc · github.com/schollz/croc/v6 +2
- CVE-2023-43617An issue was discovered in Croc through 9.6.5.github.com/schollz/croc/v9 · github.com/schollz/croc +2
- CVE-2023-43618An issue was discovered in Croc through 9.6.5.github.com/schollz/croc/v9 · github.com/schollz/croc +2
- CVE-2023-43619An issue was discovered in Croc through 9.6.5.github.com/schollz/croc · github.com/schollz/croc/v6 +2
- CVE-2023-43620An issue was discovered in Croc through 9.6.5.github.com/schollz/croc/v9 · github.com/schollz/croc +2
- CVE-2023-43621An issue was discovered in Croc through 9.6.5.github.com/schollz/croc/v9 · github.com/schollz/croc +2