CVEs published September 25, 2023
93 CVEs were published on September 25, 2023: 9 critical, 28 high.
- Published
- 93
- Critical
- 9
- High
- 28
- Medium
- 26
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 13
- Accusoft ImageGear
- 8
- Docker Desktop
- 6
- D-Link DAR-7000 · D-Link DAR-8000
- 4
- D-Link DAR-8000
- 3
- D-Link DAR-7000
- 2
- DoLogin Security
- 2
- Huawei HarmonyOS
- 2
- Import XML and RSS Feeds
- 2
- Red Hat RHINT Camel-K-1.10.1 · Red Hat RHPAM 7.13.1 asy… +21
- 2
Critical 9
- CVE-2023-43644Improper authentication in the SOCKS5 inbound in sing-boxSagerNet sing-box · github.com/sagernet/sing-box +1
- CVE-2023-4521Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCEImport XML and RSS Feeds
- CVE-2023-4490WP Job Portal < 2.0.6 - Unauthenticated SQLiWP Job Portal
- CVE-2023-35002A heap-based buffer overflow vulnerability exists in the pictwread functionality of Accusoft ImageGear 20.1.Accusoft ImageGear
- CVE-2023-32653An out-of-bounds write vulnerability exists in the dcm_pixel_data_decode functionality of Accusoft ImageGear 20.1.Accusoft ImageGear
- CVE-2023-39453A use-after-free vulnerability exists in the tif_parse_sub_IFD functionality of Accusoft ImageGear 20.1.Accusoft ImageGear
- CVE-2023-40163An out-of-bounds write vulnerability exists in the allocate_buffer_for_jpeg_decoding functionality of Accusoft ImageGear 20.1.Accusoft ImageGear
- CVE-2023-39640UpLight cookiebanner before 1.5.1 was discovered to contain a SQL injection vulnerability via the component Hook::getHookModuleExecList().
- CVE-2023-43131General Device Manager 2.5.2.2 is vulnerable to Buffer Overflow.
High 28
- CVE-2023-4259Potential buffer overflow vulnerabilities in the Zephyr eS-WiFi driverzephyrproject-rtos Zephyr
- CVE-2023-4258bt: mesh: vulnerability in provisioning protocol implementation on provisionee sidezephyrproject-rtos Zephyr
- CVE-2023-42753Kernel: netfilter: potential slab-out-of-bound access due to integer underflowRed Hat Enterprise Linux · Red Hat Virtualization 4 for Red…
- CVE-2022-4318Cri-o: /etc/passwd tampering privescRed Hat OpenShift Container Platform · Red Hat Enterpris… +1
- CVE-2022-4244Codehaus-plexus: directory traversalRed Hat RHINT Camel-K-1.10.1 · Red Hat RHPAM 7.13.1 asy… +21
- CVE-2022-4137Keycloak: reflected xss attackRed Hat Single Sign-On · org.keycloak:keycloak-parent
- CVE-2023-43642Missing upper bound check on chunk length in snappy-java xerial snappy-java · org.xerial.snappy:snappy-java
- CVE-2023-40581yt-dlp command injection when using `%q` in `--exec` on Windowsyt-dlp
- CVE-2023-41863WordPress PeproDev CF7 Database Plugin <= 1.7.0 is vulnerable to Cross Site Scripting (XSS)Pepro Dev. Group PeproDev CF7 Database
- CVE-2023-41867WordPress AcyMailing SMTP Newsletter Plugin <= 8.6.2 is vulnerable to Cross Site Scripting (XSS)AcyMailing Newsletter Team AcyMailing
- CVE-2023-41868WordPress Stagtools Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)Ram Ratan Maurya, Codestag StagTools
- CVE-2023-41871WordPress Poll Maker Plugin <= 4.7.0 is vulnerable to Cross Site Scripting (XSS)Poll Maker Team Poll Maker
- CVE-2023-3664FileOrganizer <= 1.0.2 - Admin+ Arbitrary File AccessFileOrganizer
- CVE-2023-3547All in One B2B for WooCommerce <= 1.0.3 - Multiple CSRFAll in One B2B for WooCommerce
- CVE-2023-4238Prevent files / folders access < 2.5.2 - Admin+ Arbitrary File UploadPrevent files / folders access
- CVE-2023-4300Import XML and RSS Feeds < 2.1.4 - Admin+ Arbitrary File UploadImport XML and RSS Feeds
- CVE-2023-5156Glibc: dos due to memory leak in getaddrinfo.cRed Hat Enterprise Linux
- CVE-2023-0633In Docker Desktop on Windows before 4.12.0 an argument injection to installer may result in LPEDocker Desktop
- CVE-2023-0626Docker Desktop before 4.12.0 is vulnerable to RCE via query parameters in message-box route Docker Desktop
- CVE-2023-0625Docker Desktop before 4.12.0 is vulnerable to RCE via a crafted extension description or changelogDocker Desktop
- CVE-2023-5166Docker Desktop before 4.23.0 allows Access Token theft via a crafted extension icon URLDocker Desktop
- CVE-2023-5165Docker Desktop before 4.23.0 allows Enhanced Container Isolation bypass via debug shellDocker Desktop
- CVE-2023-23567A heap-based buffer overflow vulnerability exists in the CreateDIBfromPict functionality of Accusoft ImageGear 20.1.Accusoft ImageGear
- CVE-2023-32614A heap-based buffer overflow vulnerability exists in the create_png_object functionality of Accusoft ImageGear 20.1.Accusoft ImageGear
- CVE-2023-32284An out-of-bounds write vulnerability exists in the tiff_planar_adobe functionality of Accusoft ImageGear 20.1.Accusoft ImageGear
- CVE-2023-3550Stored XSS leads to privilege escalation in MediaWiki v1.40.0MediaWiki
- CVE-2023-41872WordPress WoodMart Theme <= 7.2.4 is vulnerable to Cross Site Scripting (XSS)Xtemos WoodMart
- CVE-2023-41874WordPress Order Delivery Date for WooCommerce Plugin <= 3.20.0 is vulnerable to Cross Site Scripting (XSS)Tyche Softwares Order Delivery Date for WooCommerce
Medium, low and unrated 56
- CVE-2022-4245Codehaus-plexus: xml external entity (xxe) injectionRed Hat RHINT Camel-K-1.10.1 · Red Hat RHPAM 7.13.1 asy… +21
- CVE-2023-42817Cross-site Scripting (XSS) in pimcore admin-ui-classic-bundle translationspimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…
- CVE-2023-4156Heap out of bound read in builtin.cgawk · Red Hat Enterprise Linux +1
- CVE-2023-4476Locatoraid Store Locator < 3.9.24 - Reflected XSSLocatoraid Store Locator
- CVE-2023-4549DoLogin Security < 3.7 - Unauthenticated Stored Cross-Site ScriptingDoLogin Security
- CVE-2023-4502Translate WordPress with GTranslate < 3.0.4 - Admin+ Stored XSSTranslate WordPress with GTranslate
- CVE-2023-4148Ditty < 3.1.25 - Reflected XSSDitty
- CVE-2023-4631DoLogin Security < 3.7 - IP SpoofingDoLogin Security
- CVE-2023-4281Activity Log < 2.8.8 - IP SpoofingActivity Log
- CVE-2023-3226Popup Builder < 4.2.0 - Admin+ Stored Cross-Site ScriptingPopup Builder
- CVE-2023-4892Teedy v1.11 - Stored cross-site scripting (XSS)Teedy
- CVE-2023-5158Possible dos from guest to host invringh_kiov_advance in vhost driver at drivers/vhost/vringh.ckernel · Red Hat Enterprise Linux +1
- CVE-2023-0627Docker Desktop 4.11.x allows --no-windows-containers flag bypassDocker Desktop
- CVE-2023-28393A stack-based buffer overflow vulnerability exists in the tif_processing_dng_channel_count functionality of Accusoft ImageGear 20.1.Accusoft ImageGear
- CVE-2023-41303Command injection vulnerability in the distributed file system module.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48605Input verification vulnerability in the fingerprint module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41293Data security classification vulnerability in the DDMP module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41302Redirection permission verification vulnerability in the home screen module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41301Vulnerability of unauthorized API access in the PMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41300Vulnerability of parameters not being strictly verified in the PMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41299DoS vulnerability in the PMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41298Vulnerability of permission control in the window module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41297Vulnerability of defects introduced in the design process in the HiviewTunner module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41296Vulnerability of missing authorization in the kernel module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41295Vulnerability of improper permission management in the displayengine module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41294The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super Device services.Huawei HarmonyOS
- CVE-2023-39409DoS vulnerability in the PMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-39408DoS vulnerability in the PMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-39407The Watchkit has a risk of unauthorized file access.Successful exploitation of this vulnerability may affect confidentiality and integrity.Huawei HarmonyOS
- CVE-2023-5154D-Link DAR-8000 changelogo.php unrestricted uploadD-Link DAR-8000
- CVE-2023-5153D-Link DAR-8000 querysql.php sql injectionD-Link DAR-8000
- CVE-2023-5152D-Link DAR-7000/DAR-8000 importexport.php sql injectionD-Link DAR-7000 · D-Link DAR-8000
- CVE-2023-5151D-Link DAR-8000 autheditpwd.php sql injectionD-Link DAR-8000
- CVE-2023-5150D-Link DAR-7000/DAR-8000 web.php unrestricted uploadD-Link DAR-7000 · D-Link DAR-8000
- CVE-2023-5149D-Link DAR-7000 userattestation.php unrestricted uploadD-Link DAR-7000
- CVE-2023-5148D-Link DAR-7000/DAR-8000 uploadfile.php unrestricted uploadD-Link DAR-7000 · D-Link DAR-8000
- CVE-2023-41948WordPress Cookie Notice & Consent Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)Christoph Rado Cookie Notice & Consent
- CVE-2023-41949WordPress iFolders Plugin <= 1.5.0 is vulnerable to Cross Site Scripting (XSS)Avirtum iFolders
- CVE-2023-5147D-Link DAR-7000 updateos.php unrestricted uploadD-Link DAR-7000
- CVE-2023-5146D-Link DAR-7000/DAR-8000 updatelib.php unrestricted uploadD-Link DAR-7000 · D-Link DAR-8000
- CVE-2015-6964MultiBit HD before 0.1.2 allows attackers to conduct bit-flipping attacks that insert unspendable Bitcoin addresses into the list that Multi
- CVE-2023-38907An issue in TPLink Smart Bulb Tapo series L530 before 1.2.4, L510E before 1.1.0, L630 before 1.0.4, P100 before 1.5.0, and Tapo Application
- CVE-2023-41419An issue in Gevent before version 23.9.0 allows a remote attacker to escalate privileges via a crafted script to the WSGIServer component.gevent
- CVE-2023-42426Cross-site scripting (XSS) vulnerability in Froala Froala Editor v.4.1.1 allows remote attackers to execute arbitrary code via the 'Insert l
- CVE-2023-43132szvone vmqphp <=1.13 is vulnerable to SQL Injection.
- CVE-2023-43141TOTOLINK A3700R V9.1.2u.6134_B20201202 and N600R V5.3c.5137 are vulnerable to Incorrect Access Control.
- CVE-2023-43256A path traversal in Gladys Assistant v4.26.1 and below allows authenticated attackers to extract sensitive files in the host machine by expl
- CVE-2023-43278A Cross-Site Request Forgery (CSRF) in admin_manager.php of Seacms up to v12.8 allows attackers to arbitrarily add an admin account.
- CVE-2023-43319Cross Site Scripting (XSS) vulnerability in the Sign-In page of IceWarp WebClient 10.3.5 allows attackers to execute arbitrary web scripts o
- CVE-2023-43325A reflected cross-site scripting (XSS) vulnerability in the data[redirect_url] parameter of mooSocial v3.1.8 allows attackers to steal user'
- CVE-2023-43326A reflected cross-site scripting (XSS) vulnerability exisits in multiple url of mooSocial v3.1.8 allows attackers to steal user's session co
- CVE-2023-43339Cross-Site Scripting (XSS) vulnerability in cmsmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload i
- CVE-2023-43382Directory Traversal vulnerability in itechyou dreamer CMS v.4.1.3 allows a remote attacker to execute arbitrary code via the themePath in th
- CVE-2023-43456Cross Site Scripting vulnerability in Service Provider Management System v.1.0 allows a remote attacker to execute arbitrary code and obtain
- CVE-2023-43457An issue in Service Provider Management System v.1.0 allows a remote attacker to gain privileges via the ID parameter in the /php-spms/admin
- CVE-2023-43458Cross Site Scripting (XSS) vulnerability in Resort Reservation System v.1.0 allows a remote attacker to execute arbitrary code and obtain se