CVEs published September 21, 2023
55 CVEs were published on September 21, 2023: 5 critical, 19 high. 3 are now in CISA KEV.
- Published
- 55
- Critical
- 5
- High
- 19
- Medium
- 7
- Low
- 4
- Unrated
- 20
- Now in CISA KEV
- 3
- Fix available
- 24
Most affected products
- LF-Edge, Zededa EVE OS · github.com/lf-edge/eve
- 5
- Frauscher FDS101 for FAdC/FAdCi
- 3
- fuxa-server
- 3
- @frangoteam/fuxa
- 1
- Apple iOS and iPadOS · Apple macOS
- 1
- Apple macOS
- 1
- Apple macOS · Apple iOS and iPadOS
- 1
- composer/composer
- 1
- contao/core
- 1
- dataease
- 1
Critical 5
- CVE-2023-42810systeminformation SSID Command Injection Vulnerabilitysebhildebrandt systeminformation · systeminformation
- CVE-2023-43632Freely Allocate Buffer on The Stack With Data From SocketLF-Edge, Zededa EVE OS · github.com/lf-edge/eve
- CVE-2023-4291Frauscher FDS101 for FAdC/FAdCi remote code execution vulnerabilityFrauscher FDS101 for FAdC/FAdCi
- CVE-2023-34576SQL injection vulnerability in updatepos.php in PrestaShop opartfaq through 1.0.3 allows remote attackers to run arbitrary SQL commands via
- CVE-2023-34577SQL injection vulnerability in Prestashop opartplannedpopup 1.4.11 and earlier allows remote attackers to run arbitrary SQL commands via Opa
High 19
- CVE-2023-4504OpenPrinting CUPS/libppd Postscript Parsing Heap OverflowOpenPrinting CUPS · OpenPrinting libppd
- CVE-2023-5068Delta Electronics DIAScreen Out-of-bounds WriteDelta Electronics DIAScreen
- CVE-2023-41993The issue was addressed with improved checks.Apple macOS
- CVE-2023-41992The issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS
- CVE-2023-42805quinn-proto Denial of Service vulnerabilityquinn-rs quinn · quinn-proto
- CVE-2023-42457plone.rest vulnerable to Denial of Service when ++api++ is used many timesplone.rest · plone-rest
- CVE-2023-40183DataEase has a vulnerability to obtain user cookiesdataease
- CVE-2023-43637Vault Key Partially PredeterminedLF-Edge, Zededa EVE OS · github.com/lf-edge/eve
- CVE-2023-43631SSH as Root Unlockable Without Triggering Measured BootLF-Edge, Zededa EVE OS · github.com/lf-edge/eve
- CVE-2023-43633Debug Functions Unlockable Without Triggering Measured BootLF-Edge, Zededa EVE OS · github.com/lf-edge/eve
- CVE-2023-43634 Config Partition Not Protected by Measured BootLF-Edge, Zededa EVE OS · github.com/lf-edge/eve
- CVE-2023-4760Remote Code Execution in Eclipse RAP on WindowsEclipse Foundation Eclipse RAP
- CVE-2023-4152Frauscher FDS101 for FAdC/FAdCi path traversal vulnerabilityFrauscher FDS101 for FAdC/FAdCi
- CVE-2023-43236D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter statuscheckpppoeuser in dir_setWanWifi.
- CVE-2023-43237D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC.
- CVE-2023-43238D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter nvmacaddr in form2Dhcpip.cgi.
- CVE-2023-43239D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter flag_5G in showMACfilterMAC.
- CVE-2023-43242D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter removeRuleList in form2IPQoSTcDel.
- CVE-2023-43274Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter.
Medium, low and unrated 31
- CVE-2023-41991A certificate validation issue was addressed.Apple iOS and iPadOS · Apple macOS
- CVE-2023-42806Snapshot signature not including HeadID will allow replay attacksinput-output-hk hydra
- CVE-2023-42807Frappe LMS SQL Injection Issue on People Pagefrappe lms
- CVE-2023-42458Zope vulnerable to Stored Cross Site Scripting with SVG imageszopefoundation Zope · zope
- CVE-2023-42456sudo-rs Session File Relative Path Traversal vulnerabilitymemorysafety sudo-rs · sudo-rs
- CVE-2023-41048plone.namedfile vulnerable to Stored Cross Site Scripting with SVG imagesplone.namedfile · plone-namedfile
- CVE-2023-4753OpenHarmony v3.2.1 and prior version has a system call function usage errorOpenHarmony
- CVE-2023-5104Improper Input Validation in nocodb/nocodbnocodb/nocodb · nocodb
- CVE-2023-4292Frauscher FDS101 for FAdC/FAdCi SQL injection vulnerabilityFrauscher FDS101 for FAdC/FAdCi
- CVE-2023-39252 Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability.Dell Secure Connect Gateway (SCG) Policy Manager
- CVE-2015-5467web\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeteryiisoft/yii2
- CVE-2015-8371Composer before 2016-02-10 allows cache poisoning from other projects built on the same host.composer/composer
- CVE-2018-5478Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension.contao/core
- CVE-2023-31716FUXA <= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log@frangoteam/fuxa
- CVE-2023-31717A SQL Injection attack in FUXA <= 1.1.12 allows exfiltration of confidential information from the database.fuxa-server
- CVE-2023-31718FUXA <= 1.1.12 is vulnerable to Local via Inclusion via /api/download.fuxa-server
- CVE-2023-31719FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.fuxa-server
- CVE-2023-38343An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4.
- CVE-2023-38344An issue was discovered in Ivanti Endpoint Manager before 2022 SU4.
- CVE-2023-41614A stored cross-site scripting (XSS) vulnerability in the Add Animal Details function of Zoo Management System v1.0 allows attackers to execu
- CVE-2023-41616A reflected cross-site scripting (XSS) vulnerability in the Search Student function of Student Management System v1.2.3 and before allows at
- CVE-2023-42261Mobile Security Framework (MobSF) <=v3.7.8 Beta is vulnerable to Insecure Permissions.mobsf
- CVE-2023-42279Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form.
- CVE-2023-42280mee-admin 1.5 is vulnerable to Directory Traversal.
- CVE-2023-42482Samsung Mobile Processor Exynos 2200 allows a GPU Use After Free.
- CVE-2023-43128D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters.
- CVE-2023-43235D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter StartTime and EndTime in SetWifiDownSettings.
- CVE-2023-43240D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip_address in ipportFilter.
- CVE-2023-43241D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity.
- CVE-2023-43309There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows
- CVE-2023-43669The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excesstungstenite