# CVEs published 2023-09-21

55 CVEs were published on September 21, 2023: 5 critical, 19 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2023-4504](https://cve.now/CVE-2023-4504.md): OpenPrinting CUPS/libppd Postscript Parsing Heap Overflow (CVSS 7.0, OpenPrinting CUPS · OpenPrinting libppd)
- [CVE-2023-5068](https://cve.now/CVE-2023-5068.md): Delta Electronics DIAScreen Out-of-bounds Write (CVSS 7.8, Delta Electronics DIAScreen)
- [CVE-2023-41993](https://cve.now/CVE-2023-41993.md): The issue was addressed with improved checks. (CVSS 8.8, KEV, Apple macOS)
- [CVE-2023-41992](https://cve.now/CVE-2023-41992.md): The issue was addressed with improved checks. (CVSS 7.8, KEV, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-41991](https://cve.now/CVE-2023-41991.md): A certificate validation issue was addressed. (CVSS 5.5, KEV, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42810](https://cve.now/CVE-2023-42810.md): systeminformation SSID Command Injection Vulnerability (CVSS 9.8, sebhildebrandt systeminformation · systeminformation)
- [CVE-2023-42806](https://cve.now/CVE-2023-42806.md): Snapshot signature not including HeadID will allow replay attacks (CVSS 6.5, input-output-hk hydra)
- [CVE-2023-42805](https://cve.now/CVE-2023-42805.md): quinn-proto Denial of Service vulnerability (CVSS 7.5, quinn-rs quinn · quinn-proto)
- [CVE-2023-42807](https://cve.now/CVE-2023-42807.md): Frappe LMS SQL Injection Issue on People Page (CVSS 6.3, frappe lms)
- [CVE-2023-42458](https://cve.now/CVE-2023-42458.md): Zope vulnerable to Stored Cross Site Scripting with SVG images (CVSS 3.7, zopefoundation Zope · zope)
- [CVE-2023-42456](https://cve.now/CVE-2023-42456.md): sudo-rs Session File Relative Path Traversal vulnerability (CVSS 3.3, memorysafety sudo-rs · sudo-rs)
- [CVE-2023-42457](https://cve.now/CVE-2023-42457.md): plone.rest vulnerable to Denial of Service when ++api++ is used many times (CVSS 7.5, plone.rest · plone-rest)
- [CVE-2023-41048](https://cve.now/CVE-2023-41048.md): plone.namedfile vulnerable to Stored Cross Site Scripting with SVG images (CVSS 3.7, plone.namedfile · plone-namedfile)
- [CVE-2023-40183](https://cve.now/CVE-2023-40183.md): DataEase has a vulnerability to obtain user cookies (CVSS 7.5, dataease)
- [CVE-2023-43637](https://cve.now/CVE-2023-43637.md): Vault Key Partially Predetermined (CVSS 7.8, LF-Edge, Zededa EVE OS · github.com/lf-edge/eve)
- [CVE-2023-43631](https://cve.now/CVE-2023-43631.md): SSH as Root Unlockable Without Triggering Measured Boot (CVSS 8.8, LF-Edge, Zededa EVE OS · github.com/lf-edge/eve)
- [CVE-2023-43632](https://cve.now/CVE-2023-43632.md): Freely Allocate Buffer on The Stack With Data From Socket (CVSS 9.0, LF-Edge, Zededa EVE OS · github.com/lf-edge/eve)
- [CVE-2023-43633](https://cve.now/CVE-2023-43633.md): Debug Functions Unlockable Without Triggering Measured Boot (CVSS 8.8, LF-Edge, Zededa EVE OS · github.com/lf-edge/eve)
- [CVE-2023-43634](https://cve.now/CVE-2023-43634.md): Config Partition Not Protected by Measured Boot (CVSS 8.8, LF-Edge, Zededa EVE OS · github.com/lf-edge/eve)
- [CVE-2023-4753](https://cve.now/CVE-2023-4753.md): OpenHarmony v3.2.1 and prior version has a system call function usage error (CVSS 3.9, OpenHarmony)
- [CVE-2023-5104](https://cve.now/CVE-2023-5104.md): Improper Input Validation in nocodb/nocodb (CVSS 5.7, nocodb/nocodb · nocodb)
- [CVE-2023-4760](https://cve.now/CVE-2023-4760.md): Remote Code Execution in Eclipse RAP on Windows (CVSS 7.6, Eclipse Foundation Eclipse RAP)
- [CVE-2023-4292](https://cve.now/CVE-2023-4292.md): Frauscher FDS101 for FAdC/FAdCi SQL injection vulnerability (CVSS 5.3, Frauscher FDS101 for FAdC/FAdCi)
- [CVE-2023-4152](https://cve.now/CVE-2023-4152.md): Frauscher FDS101 for FAdC/FAdCi path traversal vulnerability (CVSS 7.5, Frauscher FDS101 for FAdC/FAdCi)
- [CVE-2023-4291](https://cve.now/CVE-2023-4291.md): Frauscher FDS101 for FAdC/FAdCi remote code execution vulnerability (CVSS 9.8, Frauscher FDS101 for FAdC/FAdCi)
- [CVE-2023-39252](https://cve.now/CVE-2023-39252.md): Dell SCG Policy Manager 5.16.00.14 contains a broken cryptographic algorithm vulnerability. (CVSS 5.9, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2015-5467](https://cve.now/CVE-2015-5467.md): web\\ViewAction in Yii (aka Yii2) 2.x before 2.0.5 allows attackers to execute any local .php file via a relative path in the view parameeter (no CVSS, yiisoft/yii2)
- [CVE-2015-8371](https://cve.now/CVE-2015-8371.md): Composer before 2016-02-10 allows cache poisoning from other projects built on the same host. (no CVSS, composer/composer)
- [CVE-2018-5478](https://cve.now/CVE-2018-5478.md): Contao 3.x before 3.5.32 allows XSS via the unsubscribe module in the frontend newsletter extension. (no CVSS, contao/core)
- [CVE-2023-31716](https://cve.now/CVE-2023-31716.md): FUXA \<= 1.1.12 has a Local File Inclusion vulnerability via file=fuxa.log (no CVSS, @frangoteam/fuxa)
- [CVE-2023-31717](https://cve.now/CVE-2023-31717.md): A SQL Injection attack in FUXA \<= 1.1.12 allows exfiltration of confidential information from the database. (no CVSS, fuxa-server)
- [CVE-2023-31718](https://cve.now/CVE-2023-31718.md): FUXA \<= 1.1.12 is vulnerable to Local via Inclusion via /api/download. (no CVSS, fuxa-server)
- [CVE-2023-31719](https://cve.now/CVE-2023-31719.md): FUXA \<= 1.1.12 is vulnerable to SQL Injection via /api/signin. (no CVSS, fuxa-server)
- [CVE-2023-34576](https://cve.now/CVE-2023-34576.md): SQL injection vulnerability in updatepos.php in PrestaShop opartfaq through 1.0.3 allows remote attackers to run arbitrary SQL commands via (CVSS 9.8)
- [CVE-2023-34577](https://cve.now/CVE-2023-34577.md): SQL injection vulnerability in Prestashop opartplannedpopup 1.4.11 and earlier allows remote attackers to run arbitrary SQL commands via Opa (CVSS 9.8)
- [CVE-2023-38343](https://cve.now/CVE-2023-38343.md): An XXE (XML external entity injection) vulnerability exists in the CSEP component of Ivanti Endpoint Manager before 2022 SU4. (no CVSS)
- [CVE-2023-38344](https://cve.now/CVE-2023-38344.md): An issue was discovered in Ivanti Endpoint Manager before 2022 SU4. (no CVSS)
- [CVE-2023-41614](https://cve.now/CVE-2023-41614.md): A stored cross-site scripting (XSS) vulnerability in the Add Animal Details function of Zoo Management System v1.0 allows attackers to execu (no CVSS)
- [CVE-2023-41616](https://cve.now/CVE-2023-41616.md): A reflected cross-site scripting (XSS) vulnerability in the Search Student function of Student Management System v1.2.3 and before allows at (no CVSS)
- [CVE-2023-42261](https://cve.now/CVE-2023-42261.md): Mobile Security Framework (MobSF) \<=v3.7.8 Beta is vulnerable to Insecure Permissions. (no CVSS, mobsf)
- [CVE-2023-42279](https://cve.now/CVE-2023-42279.md): Dreamer CMS v4.1.3 was discovered to contain a SQL injection vulnerability via the model-form-management-field form. (no CVSS)
- [CVE-2023-42280](https://cve.now/CVE-2023-42280.md): mee-admin 1.5 is vulnerable to Directory Traversal. (no CVSS)
- [CVE-2023-42482](https://cve.now/CVE-2023-42482.md): Samsung Mobile Processor Exynos 2200 allows a GPU Use After Free. (CVSS 4.7)
- [CVE-2023-43128](https://cve.now/CVE-2023-43128.md): D-LINK DIR-806 1200M11AC wireless router DIR806A1\_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP\_ST parameters. (no CVSS)
- [CVE-2023-43235](https://cve.now/CVE-2023-43235.md): D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter StartTime and EndTime in SetWifiDownSettings. (no CVSS)
- [CVE-2023-43236](https://cve.now/CVE-2023-43236.md): D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter statuscheckpppoeuser in dir\_setWanWifi. (CVSS 8.8)
- [CVE-2023-43237](https://cve.now/CVE-2023-43237.md): D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC. (CVSS 8.8)
- [CVE-2023-43238](https://cve.now/CVE-2023-43238.md): D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter nvmacaddr in form2Dhcpip.cgi. (CVSS 8.8)
- [CVE-2023-43239](https://cve.now/CVE-2023-43239.md): D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter flag\_5G in showMACfilterMAC. (CVSS 8.8)
- [CVE-2023-43240](https://cve.now/CVE-2023-43240.md): D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip\_address in ipportFilter. (no CVSS)
- [CVE-2023-43241](https://cve.now/CVE-2023-43241.md): D-Link DIR-823G v1.0.2B05 was discovered to contain a stack overflow via parameter TXPower and GuardInt in SetWLanRadioSecurity. (no CVSS)
- [CVE-2023-43242](https://cve.now/CVE-2023-43242.md): D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter removeRuleList in form2IPQoSTcDel. (CVSS 8.8)
- [CVE-2023-43274](https://cve.now/CVE-2023-43274.md): Phpjabbers PHP Shopping Cart 4.2 is vulnerable to SQL Injection via the id parameter. (CVSS 7.5)
- [CVE-2023-43309](https://cve.now/CVE-2023-43309.md): There is a stored cross-site scripting (XSS) vulnerability in Webmin 2.002 and below via the Cluster Cron Job tab Input field, which allows (no CVSS)
- [CVE-2023-43669](https://cve.now/CVE-2023-43669.md): The Tungstenite crate before 0.20.1 for Rust allows remote attackers to cause a denial of service (minutes of CPU consumption) via an excess (no CVSS, tungstenite)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.