CVEs published September 26, 2023
166 CVEs were published on September 26, 2023: 6 critical, 32 high. 1 is now in CISA KEV.
- Published
- 166
- Critical
- 6
- High
- 32
- Medium
- 26
- Low
- 5
- Unrated
- 97
- Now in CISA KEV
- 1
- Fix available
- 103
Most affected products
- Apple macOS
- 25
- Apple iOS and iPadOS · Apple macOS +2
- 14
- Huawei HarmonyOS · Huawei EMUI
- 10
- Apple iOS and iPadOS · Apple tvOS +2
- 9
- glpi-project glpi
- 9
- Collne Welcart e-Commerce
- 8
- Apple iOS and iPadOS · Apple macOS
- 6
- Apple iOS and iPadOS · Apple tvOS +1
- 6
- Apple iOS and iPadOS · Apple macOS +1
- 5
- SiberianCMS
- 4
Critical 6
- CVE-2023-5183Authenticated RCE due to unsafe JSON deserializationIllumio Core PCE
- CVE-2023-40455A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2023-38586An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2023-40400This issue was addressed with improved checks.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-3767OS command injection on EasyPHP Webserver EasyPHP Webserver
- CVE-2021-38243xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php.
High 32
- CVE-2023-42462File deletion through document upload process in GLPIglpi-project glpi
- CVE-2023-41326Account takeover via Kanban feature in GLPIglpi-project glpi
- CVE-2023-41324Account takeover through API in GLPIglpi-project glpi
- CVE-2023-41320Account takeover via SQL Injection in UI layout preferences in GLPIglpi-project glpi
- CVE-2023-42819Path traversal in Jumpserverjumpserver
- CVE-2023-42820Random seed leakage in Jumpserverjumpserver
- CVE-2023-32377A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2023-40419The issue was addressed with improved checks.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2023-41068An access issue was addressed with improved access restrictions.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2023-41063The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-40432The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-38615The issue was addressed with improved memory handling.Apple macOS
- CVE-2023-40412The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-39434A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-41074The issue was addressed with improved checks.Apple iOS and iPadOS · Apple tvOS +6
- CVE-2023-40409The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-40431The issue was addressed with improved memory handling.Apple iOS and iPadOS
- CVE-2023-32396This issue was addressed with improved checks.Apple iOS and iPadOS · Apple Xcode +3
- CVE-2023-35074The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +3
- CVE-2023-41071A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-4264Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystemzephyrproject-rtos Zephyr
- CVE-2023-39347Cilium NetworkPolicy bypass via pod labelscilium · github.com/cilium/cilium
- CVE-2023-43646Inefficient Regular Expression Complexity in get-func-namechaijs get-func-name · get-func-name
- CVE-2023-32541A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520.Hancom Office
- CVE-2023-28055 Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client.Dell NetWorker
- CVE-2023-5157Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6Red Hat Enterprise Linux · Red Hat Software Collections for…
- CVE-2023-5197Use-after-free in Linux kernel's netfilter: nf_tables componentLinux Kernel
- CVE-2023-39378 SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') by an unauthenticated userSiberianCMS
- CVE-2023-39377 SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified methodSiberianCMS
- CVE-2023-39375SiberianCMS - CWE-274: Improper Handling of Insufficient PrivilegesSiberianCMS
- CVE-2023-41861WordPress Restrict Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)Restrict
- CVE-2023-2315Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2Opencart · opencart/opencart
Medium, low and unrated 128
- CVE-2023-41878Weak password of selenium VNC in MeterSpheremetersphere
- CVE-2023-42461SQL injection in ITIL actors in GLPIglpi-project glpi
- CVE-2023-41888Phishing through a login page malicious URL in GLPIglpi-project glpi
- CVE-2023-41323Users login enumeration by unauthenticated user in GLPIglpi-project glpi
- CVE-2023-41322Privilege Escalation from technician to super-admin in GLPIglpi-project glpi
- CVE-2023-23958Symantec Protection Engine Hash Leak VulnerabilitySymantec Protection Engine
- CVE-2023-2358Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format Hitachi Vantara Pentaho Business Analytics Server
- CVE-2023-41321Sensitive fields enumeration through API in GLPIglpi-project glpi
- CVE-2023-43645Denial of service from circular relationship definitions in OpenFGAopenfga · github.com/openfga/openfga
- CVE-2023-41335Temporary storage of plaintext passwords during password changes in matrix synapsematrix-org synapse · matrix-synapse
- CVE-2023-42453Improper validation of receipts allows forged read receipts in matrix synapsematrix-org synapse · matrix-synapse
- CVE-2023-41332Denial of service via Kubernetes annotations in specific Cilium configurationscilium · github.com/cilium/cilium
- CVE-2023-41333Bypass of namespace restrictions in CiliumNetworkPolicy cilium · github.com/cilium/cilium
- CVE-2023-40402A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2023-40443The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2023-32361The issue was addressed with improved handling of caches.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-41073An authorization issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-40418An authentication issue was addressed with improved state management.Apple watchOS
- CVE-2023-41065A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-40434A configuration issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS
- CVE-2023-40422The issue was addressed with improved memory handling.Apple macOS
- CVE-2023-41232An out-of-bounds read was addressed with improved bounds checking.Apple iOS and iPadOS · Apple macOS
- CVE-2023-40435This issue was addressed by enabling hardened runtime.Apple Xcode
- CVE-2023-40399The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-41984The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-40454A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-40403The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-40395The issue was addressed with improved handling of caches.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-29497A privacy issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2023-40388A privacy issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2023-40520The issue was addressed with improved checks.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2023-40424The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-41995A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple macOS
- CVE-2023-41079The issue was addressed with improved permissions logic.Apple macOS
- CVE-2023-40541This issue was addressed by adding an additional prompt for user consent.Apple macOS
- CVE-2023-40384A permissions issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2023-39233The issue was addressed with improved checks.Apple macOS
- CVE-2023-35990The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-40428The issue was addressed with improved handling of caches.Apple iOS and iPadOS
- CVE-2023-40429A permissions issue was addressed with improved validation.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-40452The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-41078An authorization issue was addressed with improved state management.Apple macOS
- CVE-2023-40448The issue was addressed with improved handling of protocols.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-40426A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2023-37448A lock screen issue was addressed with improved state management.Apple macOS
- CVE-2023-35984The issue was addressed with improved checks.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-40410An out-of-bounds read was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-40386A privacy issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2023-41981The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-40451This issue was addressed with improved iframe sandbox enforcement.Apple Safari
- CVE-2023-40406The issue was addressed with improved checks.Apple macOS
- CVE-2023-40391The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple Xcode +2
- CVE-2023-41979A race condition was addressed with improved locking.Apple macOS
- CVE-2023-41996The issue was addressed with improved checks.Apple macOS
- CVE-2023-40407The issue was addressed with improved bounds checks.Apple macOS
- CVE-2023-40450The issue was addressed with improved checks.Apple macOS
- CVE-2023-41980A permissions issue was addressed with additional restrictions.Apple iOS and iPadOS · Apple macOS
- CVE-2023-40427The issue was addressed with improved handling of caches.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-41968This issue was addressed with improved validation of symlinks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-23495A permissions issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2023-40441A resource exhaustion issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS
- CVE-2023-38596The issue was addressed with improved handling of protocols.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-40420The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-40436The issue was addressed with improved bounds checks.Apple macOS
- CVE-2023-41067A logic issue was addressed with improved checks.Apple macOS
- CVE-2023-41070A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-41174The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2023-41066An authentication issue was addressed with improved state management.Apple macOS
- CVE-2023-32421A privacy issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2023-40456The issue was addressed with improved checks.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2023-41986The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS
- CVE-2023-40417A window management issue was addressed with improved state management.Apple iOS and iPadOS · Apple Safari +2
- CVE-2023-36851Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary filesJuniper Networks Junos OS
- CVE-2023-4260Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystemzephyrproject-rtos Zephyr
- CVE-2023-42460_abi_decode input not validated in complex expressions in Vypervyperlang vyper · vyper
- CVE-2023-30961Palantir Gotham UI bug that could lead to incorrect data classificationcom.palantir.acme:gotham-fe-bundle · com.palantir.acme:tita…
- CVE-2023-30959Stored XSS via javascript URI in Apollo Change Requests commentcom.palantir.apollo:autopilot
- CVE-2023-34043VMware Aria Operations contains a local privilege escalation vulnerability.VMware Aria Operations
- CVE-2023-43775Security issue in SMP Gateway automation platformEaton SMP SG-4260 · Eaton SMP SG-4250 +2
- CVE-2023-4065Operator: plaintext password in operator logRed Hat RHEL-8 based Middleware Containers · Red Hat AMQ Br…
- CVE-2023-39376SiberianCMS - CWE-284: Improper Access Control Authorized user may disable a security feature over the networkSiberianCMS
- CVE-2023-43614Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attaCollne Welcart e-Commerce
- CVE-2023-43610SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting Collne Welcart e-Commerce
- CVE-2023-43493SQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to Collne Welcart e-Commerce
- CVE-2023-43484Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker tCollne Welcart e-Commerce
- CVE-2023-41962Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthentiCollne Welcart e-Commerce
- CVE-2023-41233Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unautCollne Welcart e-Commerce
- CVE-2023-40532Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial inCollne Welcart e-Commerce
- CVE-2023-40219Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized direcCollne Welcart e-Commerce
- CVE-2023-41860WordPress Travel Map Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)TravelMap Travel Map
- CVE-2023-5192Excessive Data Query Operations in a Large Data Table in pimcore/demopimcore/demo
- CVE-2023-5162Options for Twenty Seventeen <= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodedomainsupport Options for Twenty Seventeen
- CVE-2023-5135Simple Cloudflare Turnstile <= 1.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeelliotvs Simple CAPTCHA Alternative with Cloudflare Turnsti…
- CVE-2023-5161Modal Window <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpcalc Modal Window – create popup modal window
- CVE-2023-4505Staff / Employee Business Directory for Active Directory <= 1.2.3 - Authenticated (Admin+) LDAP Passbackcyberlord92 Staff/Employee Business Directory for Active Di…
- CVE-2023-4506Active Directory Integration / LDAP Integration <= 4.1.10 - LDAP Passbackcyberlord92 Active Directory Integration / LDAP Integration
- CVE-2022-48606Stability-related vulnerability in the binder background management and control module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-4565Broadcast permission control vulnerability in the framework module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41312Permission control vulnerability in the audio module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41311Permission control vulnerability in the audio module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41310Keep-alive vulnerability in the sticky broadcast mechanism.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41309Permission control vulnerability in the MediaPlaybackController module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41308Screenshot vulnerability in the input module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41307Memory overwriting vulnerability in the security module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41306Vulnerability of mutex management in the bone voice ID trusted application (TA) module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41305Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-35793An issue was discovered in Cassia Access Controller 2.1.1.2303271039.
- CVE-2023-41904Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs.
- CVE-2023-43154In Macrob7 Macs Framework Content Management System (CMS) 1.1.4f, loose comparison in "isValidLogin()" function during login attempt results
- CVE-2023-43187A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers
- CVE-2023-43216SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ip.php.
- CVE-2023-43222SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin_ping.php file.
- CVE-2023-43232A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute a
- CVE-2023-43234DedeBIZ v6.2.11 was discovered to contain multiple remote code execution (RCE) vulnerabilities at /admin/file_manage_control.php via the $ac
- CVE-2023-43263A Cross-site scripting (XSS) vulnerability in Froala Editor v.4.1.1 allows attackers to execute arbitrary code via the Markdown component.
- CVE-2023-43291Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php com
- CVE-2023-43331A cross-site scripting (XSS) vulnerability in the Add User function of Small CRM v3.0 allows attackers to execute arbitrary web scripts or H
- CVE-2023-43381SQL Injection vulnerability in Tianchoy Blog v.1.8.8 allows a remote attacker to obtain sensitive information via the id parameter in the lo
- CVE-2023-43856Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java.
- CVE-2023-43857Dreamer CMS v4.1.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /admin/u/toIndex.
- CVE-2023-44042A stored cross-site scripting (XSS) vulnerability in /settings/index.php of Black Cat CMS 1.4.1 allows attackers to execute arbitrary web sc
- CVE-2023-44043A reflected cross-site scripting (XSS) vulnerability in /install/index.php of Black Cat CMS 1.4.1 allows attackers to execute arbitrary web
- CVE-2023-44044Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php.
- CVE-2023-44169SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_notify.php.
- CVE-2023-44170SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_ping.php.
- CVE-2023-44171SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_smtp.php.
- CVE-2023-44172SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin_weixin.php.
- CVE-2023-44216PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origi