# CVEs published 2023-09-20

124 CVEs were published on September 20, 2023: 12 critical, 32 high. Days are UTC.

- [CVE-2023-37279](https://cve.now/CVE-2023-37279.md): Faktory Web Dashboard can lead to denial of service(DOS) via malicious user input (CVSS 7.5, contribsys faktory · github.com/contribsys/faktory)
- [CVE-2023-22024](https://cve.now/CVE-2023-22024.md): In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS\_CONN\_RESET and RDS6\_CONN\_RESET, that ar (CVSS 5.5, Oracle Linux · Oracle VM)
- [CVE-2023-38718](https://cve.now/CVE-2023-38718.md): IBM Robotic Process Automation information disclosure (CVSS 3.7, IBM Robotic Process Automation)
- [CVE-2023-37410](https://cve.now/CVE-2023-37410.md): IBM Personal Communications privilege escalation (CVSS 8.4, IBM Person Communications)
- [CVE-2022-3596](https://cve.now/CVE-2022-3596.md): Instack-undercloud: rsync leaks information to undercloud (CVSS 7.5, Red Hat OpenStack Platform 13.0 - ELS · Red Hat OpenStack P…)
- [CVE-2023-40368](https://cve.now/CVE-2023-40368.md): IBM Storage Protect information disclosure (CVSS 4.4, IBM Storage Protect Client · IBM Storage Protect for Spa… +1)
- [CVE-2023-20597](https://cve.now/CVE-2023-20597.md): Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access. (no CVSS, AMD Ryzen™ 3000 Series Desktop Processors “Matisse” · A… +10)
- [CVE-2023-20594](https://cve.now/CVE-2023-20594.md): Improper initialization of variables in the DXE driver may allow a privileged user to leak sensitive information via local access. (no CVSS, AMD Ryzen™ 3000 Series Desktop Processors “Matisse” · A… +14)
- [CVE-2023-42656](https://cve.now/CVE-2023-42656.md): MOVEit Transfer Reflected XSS (CVSS 6.1, Progress Software MOVEit Transfer)
- [CVE-2023-43498](https://cve.now/CVE-2023-43498.md): In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using MultipartFormDataParser creates temporary files in the (no CVSS, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-43502](https://cve.now/CVE-2023-43502.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to delete Fail (no CVSS, Jenkins Project Jenkins Build Failure Analyzer Plugin · com…)
- [CVE-2023-43501](https://cve.now/CVE-2023-43501.md): A missing permission check in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers with Overall/Read permission to conne (no CVSS, Jenkins Project Jenkins Build Failure Analyzer Plugin · com…)
- [CVE-2023-43500](https://cve.now/CVE-2023-43500.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier allows attackers to connect to (no CVSS, Jenkins Project Jenkins Build Failure Analyzer Plugin · com…)
- [CVE-2023-43499](https://cve.now/CVE-2023-43499.md): Jenkins Build Failure Analyzer Plugin 2.4.1 and earlier does not escape Failure Cause names in build logs, resulting in a stored cross-site (no CVSS, Jenkins Project Jenkins Build Failure Analyzer Plugin · com…)
- [CVE-2023-43497](https://cve.now/CVE-2023-43497.md): In Jenkins 2.423 and earlier, LTS 2.414.1 and earlier, processing file uploads using the Stapler web framework creates temporary files in th (no CVSS, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-43496](https://cve.now/CVE-2023-43496.md): Jenkins 2.423 and earlier, LTS 2.414.1 and earlier creates a temporary file in the system temporary directory with the default permissions f (CVSS 8.8, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-43495](https://cve.now/CVE-2023-43495.md): Jenkins 2.423 and earlier, LTS 2.414.1 and earlier does not escape the value of the 'caption' constructor parameter of 'ExpandableDetailsNot (no CVSS, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-43494](https://cve.now/CVE-2023-43494.md): Jenkins 2.50 through 2.423 (both inclusive), LTS 2.60.1 through 2.414.1 (both inclusive) does not exclude sensitive build variables (e.g., p (no CVSS, Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core)
- [CVE-2023-40043](https://cve.now/CVE-2023-40043.md): MOVEit Transfer System Administrator SQL Injection (CVSS 7.2, Progress Software MOVEit Transfer)
- [CVE-2023-42660](https://cve.now/CVE-2023-42660.md): MOVEit Transfer Machine Interface SQL Injection (CVSS 8.8, Progress Software MOVEit Transfer)
- [CVE-2023-5074](https://cve.now/CVE-2023-5074.md): Authentication Bypass in D-Link D-View 8 (CVSS 9.8, D-Link D-View)
- [CVE-2023-2262](https://cve.now/CVE-2023-2262.md): Rockwell Automation Select Logix Communication Modules Vulnerable to Email Object Buffer Overflow (CVSS 9.8, Rockwell Automation 1756-EN2T Series A, B, C · Rockwell… +20)
- [CVE-2023-2508](https://cve.now/CVE-2023-2508.md): CSRF in PaperCutNG Mobility Print leads to sophisticated phishing (CVSS 5.3, PaperCut MF/NG Mobility Print)
- [CVE-2023-43635](https://cve.now/CVE-2023-43635.md): Vault Key Sealed With SHA1 PCRs (CVSS 8.8, LF-Edge, Zededa EVE OS · github.com/lf-edge/eve)
- [CVE-2023-43636](https://cve.now/CVE-2023-43636.md): Rootfs Not Protected (CVSS 8.8, LF-Edge, Zededa EVE OS · github.com/lf-edge/eve +1)
- [CVE-2023-43630](https://cve.now/CVE-2023-43630.md): Config Partition Not Measured From 2 Fronts (CVSS 8.8, LF-Edge, Zededa EVE OS · github.com/lf-edge/eve)
- [CVE-2022-3916](https://cve.now/CVE-2022-3916.md): Keycloak: session takeover with oidc offline refreshtokens (CVSS 6.8, Red Hat Single Sign-On · Red Hat RHEL-8 based Middleware… +1)
- [CVE-2023-0462](https://cve.now/CVE-2023-0462.md): Arbitrary code execution through yaml global parameters (CVSS 8.0, foreman · Red Hat Satellite)
- [CVE-2023-0118](https://cve.now/CVE-2023-0118.md): Foreman: arbitrary code execution through templates (CVSS 9.1, foreman · Red Hat Satellite 6.11 for RHEL +3)
- [CVE-2022-1438](https://cve.now/CVE-2022-1438.md): Keycloak: xss on impersonation under specific circumstances (CVSS 6.4, Red Hat Single Sign-On · Red Hat RHEL-8 based Middleware… +1)
- [CVE-2023-43478](https://cve.now/CVE-2023-43478.md): Unauthenticated configuration restore and firmware update (CVSS 8.8, Telstra Smart Modem Gen)
- [CVE-2023-43477](https://cve.now/CVE-2023-43477.md): Post-Auth Command Injection in Telstra Smart Modem Gen 2 (Arcadyan LH1000) (CVSS 6.8, Telstra Smart Modem Gen)
- [CVE-2023-0829](https://cve.now/CVE-2023-0829.md): Cross-Site Scripting (XSS) vulnerability in Plesk (CVSS 8.8, Plesk)
- [CVE-2023-4236](https://cve.now/CVE-2023-4236.md): named may terminate unexpectedly under high DNS-over-TLS query load (CVSS 7.5, ISC BIND)
- [CVE-2023-3341](https://cve.now/CVE-2023-3341.md): A stack exhaustion flaw in control channel code may cause named to terminate unexpectedly (CVSS 7.5, ISC BIND)
- [CVE-2022-45448](https://cve.now/CVE-2022-45448.md): Cross-site Scripting in M4 PDF plugin for Prestashop sites (CVSS 3.5, Prestashop M4 PDF plugin)
- [CVE-2023-5042](https://cve.now/CVE-2023-5042.md): Sensitive information disclosure due to insecure folder permissions. (CVSS 5.5, Acronis Cyber Protect Home Office · Acronis True Image OEM)
- [CVE-2023-5084](https://cve.now/CVE-2023-5084.md): Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp (CVSS 3.9, hestiacp/hestiacp)
- [CVE-2023-4853](https://cve.now/CVE-2023-4853.md): Quarkus: http security policy bypass (CVSS 8.1, Red Hat Openshift Serverless 1 on RHEL · Red Hat build… +13)
- [CVE-2022-45447](https://cve.now/CVE-2022-45447.md): Path Traversal in M4 PDF plugin for Prestashop sites (CVSS 6.5, Prestashop M4 PDF plugin)
- [CVE-2023-34047](https://cve.now/CVE-2023-34047.md): Exposure of data and identity to wrong session in Spring for GraphQL (CVSS 3.1, Spring for GraphQL · org.springframework.graphql:spring-gra…)
- [CVE-2023-41374](https://cve.now/CVE-2023-41374.md): Double free issue exists in Kostac PLC Programming Software Version 1.6.11.0 and earlier. (no CVSS, JTEKT ELECTRONICS Kostac PLC Programming Software)
- [CVE-2023-41375](https://cve.now/CVE-2023-41375.md): Use after free vulnerability exists in Kostac PLC Programming Software Version 1.6.11.0. (no CVSS, JTEKT ELECTRONICS Kostac PLC Programming Software)
- [CVE-2023-22644](https://cve.now/CVE-2023-22644.md): JWT token compromise can allow malicious actions including Remote Code Execution (RCE) (CVSS 9.4, SUSE neuvector · github.com/neuvector/neuvector)
- [CVE-2022-47562](https://cve.now/CVE-2022-47562.md): Allocation of Resources Without Limits or Throttling in Ormazabal products (CVSS 7.5, Ormazabal ekorCCP · Ormazabal ekorRCI)
- [CVE-2022-47561](https://cve.now/CVE-2022-47561.md): Unprotected Storage of Credentials in Ormazabal products (CVSS 7.3, Ormazabal ekorCCP · Ormazabal ekorRCI)
- [CVE-2022-47560](https://cve.now/CVE-2022-47560.md): Cleartext Transmission of Sensitive Information in Ormazabal products (CVSS 5.7, Ormazabal ekorCCP · Ormazabal ekorRCI)
- [CVE-2023-2163](https://cve.now/CVE-2023-2163.md): Incorrect Verifier Branch Pruning Logic Leads To Arbitrary Read/Write In Linux Kernel and Lateral Privilege Escalation (CVSS 10.0, Linux Kernel)
- [CVE-2023-26144](https://cve.now/CVE-2023-26144.md): Versions of the package graphql from 16.3.0 and before 16.8.1 are vulnerable to Denial of Service (DoS) due to insufficient checks in the Ov (CVSS 5.3, graphql)
- [CVE-2023-5063](https://cve.now/CVE-2023-5063.md): Widget Responsive for Youtube \<= 1.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, stefanoai Widget Responsive for Youtube)
- [CVE-2023-5062](https://cve.now/CVE-2023-5062.md): WordPress Charts \<= 0.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, webfactory WordPress Charts)
- [CVE-2023-4088](https://cve.now/CVE-2023-4088.md): Malicious Code Execution Vulnerability in FA Engineering Software Products (CVSS 9.3, Mitsubishi Electric GX Works3 · Mitsubishi Electric AL-… +22)
- [CVE-2023-31014](https://cve.now/CVE-2023-31014.md): NVIDIA GeForce Now for Android contains a vulnerability in the game launcher component, where a malicious application on the same device can (CVSS 4.2, NVIDIA GeForce NOW for Android mobile and TV app)
- [CVE-2023-31015](https://cve.now/CVE-2023-31015.md): NVIDIA DGX H100 BMC contains a vulnerability in the REST service where a host user may cause as improper authentication issue. (CVSS 6.6, NVIDIA DGX H100 BMC)
- [CVE-2023-31013](https://cve.now/CVE-2023-31013.md): NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. (CVSS 6.1, NVIDIA DGX H100 BMC)
- [CVE-2023-31012](https://cve.now/CVE-2023-31012.md): NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. (CVSS 6.1, NVIDIA DGX H100 BMC)
- [CVE-2023-31011](https://cve.now/CVE-2023-31011.md): NVIDIA DGX H100 BMC contains a vulnerability in the REST service where an attacker may cause improper input validation. (CVSS 5.2, NVIDIA DGX H100 BMC)
- [CVE-2023-31010](https://cve.now/CVE-2023-31010.md): NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. (CVSS 6.8, NVIDIA DGX H100 BMC)
- [CVE-2023-31009](https://cve.now/CVE-2023-31009.md): NVIDIA DGX H100 BMC contains a vulnerability in the REST service, where an attacker may cause improper input validation. (CVSS 8.3, NVIDIA DGX H100 BMC)
- [CVE-2023-31008](https://cve.now/CVE-2023-31008.md): NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. (CVSS 7.3, NVIDIA DGX H100 BMC)
- [CVE-2023-25534](https://cve.now/CVE-2023-25534.md): NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause improper input validation. (CVSS 5.7, NVIDIA DGX H100 BMC)
- [CVE-2023-25533](https://cve.now/CVE-2023-25533.md): NVIDIA DGX H100 BMC contains a vulnerability in the web UI, where an attacker may cause improper input validation. (CVSS 8.3, NVIDIA DGX H100 BMC)
- [CVE-2023-25532](https://cve.now/CVE-2023-25532.md): NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. (CVSS 6.5, NVIDIA DGX H100 BMC)
- [CVE-2023-25531](https://cve.now/CVE-2023-25531.md): NVIDIA DGX H100 BMC contains a vulnerability in IPMI, where an attacker may cause insufficient protection of credentials. (CVSS 7.6, NVIDIA DGX H100 BMC)
- [CVE-2023-25530](https://cve.now/CVE-2023-25530.md): NVIDIA DGX H100 BMC contains a vulnerability in the KVM service, where an attacker may cause improper input validation. (CVSS 8.0, NVIDIA DGX H100 BMC)
- [CVE-2023-25529](https://cve.now/CVE-2023-25529.md): NVIDIA DGX H100 BMC and DGX A100 BMC contains a vulnerability in the host KVM daemon, where an unauthenticated attacker may cause a leak of (CVSS 8.0, NVIDIA DGX H100 BMC · NVIDIA DGX A100 BMC)
- [CVE-2023-25528](https://cve.now/CVE-2023-25528.md): NVIDIA DGX H100 baseboard management controller (BMC) contains a vulnerability in a web server plugin, where an unauthenticated attacker may (CVSS 8.8, NVIDIA DGX H100 BMC)
- [CVE-2023-25527](https://cve.now/CVE-2023-25527.md): NVIDIA DGX H100 BMC contains a vulnerability in the host KVM daemon, where an authenticated local attacker may cause corruption of kernel me (CVSS 7.8, NVIDIA DGX H100 BMC)
- [CVE-2023-25526](https://cve.now/CVE-2023-25526.md): NVIDIA Cumulus Linux contains a vulnerability in neighmgrd and nlmanager where an attacker on an adjacent network may cause an uncaught exce (CVSS 6.5, NVIDIA Cumulus Linux)
- [CVE-2023-25525](https://cve.now/CVE-2023-25525.md): NVIDIA Cumulus Linux contains a vulnerability in forwarding where a VxLAN-encapsulated IPv6 packet received on an SVI interface with DMAC/DI (CVSS 7.5, NVIDIA Cumulus Linux)
- [CVE-2019-19450](https://cve.now/CVE-2019-19450.md): paraparser in ReportLab before 3.5.31 allows remote code execution because start\_unichar in paraparser.py evaluates untrusted user input in (no CVSS, reportlab)
- [CVE-2023-34575](https://cve.now/CVE-2023-34575.md): SQL injection vulnerability in PrestaShop opartsavecart through 2.0.7 allows remote attackers to run arbitrary SQL commands via OpartSaveCar (CVSS 9.8)
- [CVE-2023-36109](https://cve.now/CVE-2023-36109.md): Buffer Overflow vulnerability in JerryScript version 3.0, allows remote attackers to execute arbitrary code via ecma\_stringbuilder\_append\_ra (no CVSS)
- [CVE-2023-36234](https://cve.now/CVE-2023-36234.md): Cross Site Scripting (XSS) vulnerability in Netbox 3.5.1, allows attackers to execute arbitrary code via Name field in device-roles/add func (no CVSS)
- [CVE-2023-38875](https://cve.now/CVE-2023-38875.md): A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary Java (no CVSS)
- [CVE-2023-38876](https://cve.now/CVE-2023-38876.md): A reflected cross-site scripting (XSS) vulnerability in msaad1999's PHP-Login-System 2.0.1 allows remote attackers to execute arbitrary Java (no CVSS)
- [CVE-2023-38886](https://cve.now/CVE-2023-38886.md): An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script. (no CVSS, dolibarr/dolibarr)
- [CVE-2023-38887](https://cve.now/CVE-2023-38887.md): File Upload vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to execute arbitrary code and obtain sensitive in (CVSS 8.8, dolibarr/dolibarr)
- [CVE-2023-38888](https://cve.now/CVE-2023-38888.md): Cross Site Scripting vulnerability in Dolibarr ERP CRM v.17.0.1 and before allows a remote attacker to obtain sensitive information and exec (no CVSS, dolibarr/dolibarr)
- [CVE-2023-39041](https://cve.now/CVE-2023-39041.md): An information leak in KUKURUDELI Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39044](https://cve.now/CVE-2023-39044.md): An information leak in ajino-Shiretoko Line v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39045](https://cve.now/CVE-2023-39045.md): An information leak in kokoroe\_members card Line 13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39052](https://cve.now/CVE-2023-39052.md): An information leak in Earthgarden\_waiting 13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39675](https://cve.now/CVE-2023-39675.md): SimpleImportProduct Prestashop Module v6.2.9 was discovered to contain a SQL injection vulnerability via the key parameter at send.php. (no CVSS)
- [CVE-2023-39677](https://cve.now/CVE-2023-39677.md): MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclo (no CVSS)
- [CVE-2023-40618](https://cve.now/CVE-2023-40618.md): A reflected cross-site scripting (XSS) vulnerability in OpenKnowledgeMaps Head Start versions 4, 5, 6, 7 as well as Visual Project Explorer (no CVSS)
- [CVE-2023-40619](https://cve.now/CVE-2023-40619.md): phpPgAdmin 7.14.4 and earlier is vulnerable to deserialization of untrusted data which may lead to remote code execution because user-contro (no CVSS)
- [CVE-2023-40930](https://cve.now/CVE-2023-40930.md): An issue in the directory /system/bin/blkid of Skyworth v3.0 allows attackers to perform a directory traversal via mounting the Udisk to /mn (no CVSS)
- [CVE-2023-41484](https://cve.now/CVE-2023-41484.md): An issue in cimg.eu Cimg Library v2.9.3 allows an attacker to obtain sensitive information via a crafted JPEG file. (no CVSS)
- [CVE-2023-41902](https://cve.now/CVE-2023-41902.md): An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by (no CVSS)
- [CVE-2023-42147](https://cve.now/CVE-2023-42147.md): An issue in CloudExplorer Lite 1.3.1 allows an attacker to obtain sensitive information via the login key component. (no CVSS)
- [CVE-2023-42321](https://cve.now/CVE-2023-42321.md): Cross Site Request Forgery (CSRF) vulnerability in icmsdev iCMSv.7.0.16 allows a remote attacker to execute arbitrary code via the user.admi (no CVSS)
- [CVE-2023-42322](https://cve.now/CVE-2023-42322.md): Insecure Permissions vulnerability in icmsdev iCMS v.7.0.16 allows a remote attacker to obtain sensitive information. (CVSS 9.8)
- [CVE-2023-42331](https://cve.now/CVE-2023-42331.md): A file upload vulnerability in EliteCMS v1.01 allows a remote attacker to execute arbitrary code via the manage\_uploads.php component. (no CVSS)
- [CVE-2023-42334](https://cve.now/CVE-2023-42334.md): An Indirect Object Reference (IDOR) in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to escalate privileges via the (no CVSS)
- [CVE-2023-42335](https://cve.now/CVE-2023-42335.md): Unrestricted File Upload vulnerability in Fl3xx Dispatch 2.10.37 and fl3xx Crew 2.10.37 allows a remote attacker to execute arbitrary code v (no CVSS)
- [CVE-2023-42464](https://cve.now/CVE-2023-42464.md): A Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x before 3.1.17. (no CVSS)
- [CVE-2023-43134](https://cve.now/CVE-2023-43134.md): There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the d (no CVSS)
- [CVE-2023-43135](https://cve.now/CVE-2023-43135.md): There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensiti (no CVSS)
- [CVE-2023-43137](https://cve.now/CVE-2023-43137.md): TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authenticat (no CVSS)
- [CVE-2023-43138](https://cve.now/CVE-2023-43138.md): TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentica (no CVSS)
- [CVE-2023-43196](https://cve.now/CVE-2023-43196.md): D-Link DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the zn\_jb parameter in the arp\_sys.asp function. (no CVSS)
- [CVE-2023-43197](https://cve.now/CVE-2023-43197.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the fn parameter in the tgfile.asp function. (no CVSS)
- [CVE-2023-43198](https://cve.now/CVE-2023-43198.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the popupId parameter in the H5/hi\_block.asp function (no CVSS)
- [CVE-2023-43199](https://cve.now/CVE-2023-43199.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the prev parameter in the H5/login.cgi function. (no CVSS)
- [CVE-2023-43200](https://cve.now/CVE-2023-43200.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the id parameter in the yyxz.data function. (no CVSS)
- [CVE-2023-43201](https://cve.now/CVE-2023-43201.md): D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a stack overflow via the hi\_up parameter in the qos\_ext.asp function. (no CVSS)
- [CVE-2023-43202](https://cve.now/CVE-2023-43202.md): D-LINK DWL-6610 FW\_v\_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap\_download\_handler. (CVSS 8.0)
- [CVE-2023-43203](https://cve.now/CVE-2023-43203.md): D-LINK DWL-6610 FW\_v\_4.3.0.8B003C was discovered to contain a stack overflow vulnerability in the function update\_users. (CVSS 8.0)
- [CVE-2023-43204](https://cve.now/CVE-2023-43204.md): D-LINK DWL-6610 FW\_v\_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub\_2EF50. (CVSS 8.0)
- [CVE-2023-43206](https://cve.now/CVE-2023-43206.md): D-LINK DWL-6610 FW\_v\_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web\_cert\_download\_handler. (CVSS 8.0)
- [CVE-2023-43207](https://cve.now/CVE-2023-43207.md): D-LINK DWL-6610 FW\_v\_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config\_upload\_handler. (CVSS 8.0)
- [CVE-2023-43371](https://cve.now/CVE-2023-43371.md): Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the numcaselle parameter at /hoteldruid/creaprezzi.php. (CVSS 9.8)
- [CVE-2023-43373](https://cve.now/CVE-2023-43373.md): Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the n\_utente\_agg parameter at /hoteldruid/interconnessioni.php (CVSS 9.8)
- [CVE-2023-43374](https://cve.now/CVE-2023-43374.md): Hoteldruid v3.0.5 was discovered to contain a SQL injection vulnerability via the id\_utente\_log parameter at /hoteldruid/personalizza.php. (CVSS 9.8)
- [CVE-2023-43375](https://cve.now/CVE-2023-43375.md): Hoteldruid v3.0.5 was discovered to contain multiple SQL injection vulnerabilities at /hoteldruid/clienti.php via the annonascita, annoscadd (CVSS 9.8)
- [CVE-2023-43376](https://cve.now/CVE-2023-43376.md): A cross-site scripting (XSS) vulnerability in /hoteldruid/clienti.php of Hoteldruid v3.0.5 allows attackers to execute arbitrary web scripts (CVSS 5.4)
- [CVE-2023-43377](https://cve.now/CVE-2023-43377.md): A cross-site scripting (XSS) vulnerability in /hoteldruid/visualizza\_contratto.php of Hoteldruid v3.0.5 allows attackers to execute arbitrar (CVSS 5.4)
- [CVE-2023-43616](https://cve.now/CVE-2023-43616.md): An issue was discovered in Croc through 9.6.5. (no CVSS, github.com/schollz/croc · github.com/schollz/croc/v6 +2)
- [CVE-2023-43617](https://cve.now/CVE-2023-43617.md): An issue was discovered in Croc through 9.6.5. (no CVSS, github.com/schollz/croc/v9 · github.com/schollz/croc +2)
- [CVE-2023-43618](https://cve.now/CVE-2023-43618.md): An issue was discovered in Croc through 9.6.5. (no CVSS, github.com/schollz/croc/v9 · github.com/schollz/croc +2)
- [CVE-2023-43619](https://cve.now/CVE-2023-43619.md): An issue was discovered in Croc through 9.6.5. (no CVSS, github.com/schollz/croc · github.com/schollz/croc/v6 +2)
- [CVE-2023-43620](https://cve.now/CVE-2023-43620.md): An issue was discovered in Croc through 9.6.5. (no CVSS, github.com/schollz/croc/v9 · github.com/schollz/croc +2)
- [CVE-2023-43621](https://cve.now/CVE-2023-43621.md): An issue was discovered in Croc through 9.6.5. (no CVSS, github.com/schollz/croc/v9 · github.com/schollz/croc +2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.