CVEs published September 22, 2023
41 CVEs were published on September 22, 2023: 1 critical, 14 high. 1 is now in CISA KEV.
- Published
- 41
- Critical
- 1
- High
- 14
- Medium
- 10
- Low
- 0
- Unrated
- 16
- Now in CISA KEV
- 1
- Fix available
- 12
Most affected products
- Juplink RX4-1500
- 3
- ChewKeanHo AutomataCI
- 1
- dglingren Media Library Assistant
- 1
- foreman · Red Hat Satellite
- 1
- galaxyproject galaxy
- 1
- GitHub Enterprise Server
- 1
- gnome-shell
- 1
- gomarkdown markdown · github.com/gomarkdown/markdown
- 1
- Linux
- 1
- matomoteam Connect Matomo – Analytics Dashboard for WordPre…
- 1
Critical 1
High 14
- CVE-2023-42821github.com/gomarkdown/markdown Out-of-bounds Read while parsing citationsgomarkdown markdown · github.com/gomarkdown/markdown
- CVE-2023-41031Juplink RX4-1500 homemng.htm Command Injection VulnerabilityJuplink RX4-1500
- CVE-2023-41029Juplink RX4-1500 Command Injection VulnerabilityJuplink RX4-1500
- CVE-2023-41027Juplink RX4-1500 Credential Disclosure VulnerabilityJuplink RX4-1500
- CVE-2023-42798AutomataCI Release Job Can Revert Repo to First CommitChewKeanHo AutomataCI
- CVE-2022-4039Rhsso-container-image: unsecured management interface exposed to adjecent networkRed Hat RHEL-8 based Middleware Containers · Red Hat Single…
- CVE-2022-3874Os command injection via ct_command and fcct_commandforeman · Red Hat Satellite
- CVE-2023-34319Linux: buffer overrun in netback due to unusual packetLinux
- CVE-2023-23364Multimedia ConsoleQNAP Systems Multimedia Console
- CVE-2023-23363QTSQNAP Systems QTS
- CVE-2023-23362QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-38346An issue was discovered in Wind River VxWorks 6.9 and 7.
- CVE-2023-43761Certain WithSecure products allow Denial of Service (infinite loop).
- CVE-2023-43765Certain WithSecure products allow Denial of Service in the aeelf component.
Medium, low and unrated 26
- CVE-2023-43640TaxonWorks SQL injection vulnerabilitySpeciesFileGroup taxonworks
- CVE-2023-42812Galaxy vulnerable to Server Side Request Forgery during data importsgalaxyproject galaxy
- CVE-2023-42811AEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failureRustCrypto AEADs · aes-gcm
- CVE-2023-23766Incorrect comparison vulnerability in GitHub Enterprise Server leading to commit smugglingGitHub Enterprise Server
- CVE-2023-5002Pgadmin4: remote code execution by an authenticated userpgadmin4
- CVE-2023-4774WP-Matomo Integration (WP-Piwik) <= 1.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodematomoteam Connect Matomo – Analytics Dashboard for WordPre…
- CVE-2023-4716Media Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodedglingren Media Library Assistant
- CVE-2023-43090Gnome-shell: screenshot tool allows viewing open windows when session is lockedgnome-shell
- CVE-2023-40989SQL injection vulnerbility in jeecgboot jeecg-boot v 3.0, 3.5.3 that allows a remote attacker to execute arbitrary code via a crafted requesorg.jeecgframework.boot:jeecg-boot-common
- CVE-2023-43129D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of REMOTE_PORT paramete
- CVE-2023-43130D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection.
- CVE-2023-43144Projectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id" parameter in delete.php.
- CVE-2023-43270dst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the userId parameter at /home/playerOperate.
- CVE-2023-43338Cesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the function mjs_get_ptr().
- CVE-2023-43468SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the login.php componen
- CVE-2023-43469SQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to execute arbitrary code via the ForPass.php compon
- CVE-2023-43470SQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to execute arbitrary code via the checklogin.php c
- CVE-2023-43760Certain WithSecure products allow Denial of Service via a fuzzed PE32 file.
- CVE-2023-43763Certain WithSecure products allow XSS via an unvalidated parameter in the endpoint.
- CVE-2023-43766Certain WithSecure products allow Local privilege escalation via the lhz archive unpack handler.
- CVE-2023-43767Certain WithSecure products allow Denial of Service via the aepack archive unpack handler.
- CVE-2023-43770Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of
- CVE-2023-43771In nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port could crash the program.
- CVE-2023-43782Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File.
- CVE-2023-43783Cadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File.
- CVE-2023-43784Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to an Amazon AWS Firehose component.