# CVEs published 2023-09-26

166 CVEs were published on September 26, 2023: 6 critical, 32 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-41878](https://cve.now/CVE-2023-41878.md): Weak password of selenium VNC in MeterSphere (CVSS 4.6, metersphere)
- [CVE-2023-42462](https://cve.now/CVE-2023-42462.md): File deletion through document upload process in GLPI (CVSS 7.7, glpi-project glpi)
- [CVE-2023-42461](https://cve.now/CVE-2023-42461.md): SQL injection in ITIL actors in GLPI (CVSS 6.5, glpi-project glpi)
- [CVE-2023-41888](https://cve.now/CVE-2023-41888.md): Phishing through a login page malicious URL in GLPI (CVSS 5.3, glpi-project glpi)
- [CVE-2023-41326](https://cve.now/CVE-2023-41326.md): Account takeover via Kanban feature in GLPI (CVSS 8.1, glpi-project glpi)
- [CVE-2023-41324](https://cve.now/CVE-2023-41324.md): Account takeover through API in GLPI (CVSS 8.1, glpi-project glpi)
- [CVE-2023-41323](https://cve.now/CVE-2023-41323.md): Users login enumeration by unauthenticated user in GLPI (CVSS 5.3, glpi-project glpi)
- [CVE-2023-41322](https://cve.now/CVE-2023-41322.md): Privilege Escalation from technician to super-admin in GLPI (CVSS 4.9, glpi-project glpi)
- [CVE-2023-23958](https://cve.now/CVE-2023-23958.md): Symantec Protection Engine Hash Leak Vulnerability (CVSS 6.8, Symantec Protection Engine)
- [CVE-2023-2358](https://cve.now/CVE-2023-2358.md): Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format (CVSS 4.3, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2023-5183](https://cve.now/CVE-2023-5183.md): Authenticated RCE due to unsafe JSON deserialization (CVSS 9.9, Illumio Core PCE)
- [CVE-2023-41321](https://cve.now/CVE-2023-41321.md): Sensitive fields enumeration through API in GLPI (CVSS 4.9, glpi-project glpi)
- [CVE-2023-41320](https://cve.now/CVE-2023-41320.md): Account takeover via SQL Injection in UI layout preferences in GLPI (CVSS 8.1, glpi-project glpi)
- [CVE-2023-43645](https://cve.now/CVE-2023-43645.md): Denial of service from circular relationship definitions in OpenFGA (CVSS 5.9, openfga · github.com/openfga/openfga)
- [CVE-2023-41335](https://cve.now/CVE-2023-41335.md): Temporary storage of plaintext passwords during password changes in matrix synapse (CVSS 3.7, matrix-org synapse · matrix-synapse)
- [CVE-2023-42453](https://cve.now/CVE-2023-42453.md): Improper validation of receipts allows forged read receipts in matrix synapse (CVSS 3.1, matrix-org synapse · matrix-synapse)
- [CVE-2023-42819](https://cve.now/CVE-2023-42819.md): Path traversal in Jumpserver (CVSS 8.9, jumpserver)
- [CVE-2023-42820](https://cve.now/CVE-2023-42820.md): Random seed leakage in Jumpserver (CVSS 7.0, jumpserver)
- [CVE-2023-41332](https://cve.now/CVE-2023-41332.md): Denial of service via Kubernetes annotations in specific Cilium configurations (CVSS 3.5, cilium · github.com/cilium/cilium)
- [CVE-2023-41333](https://cve.now/CVE-2023-41333.md): Bypass of namespace restrictions in CiliumNetworkPolicy (CVSS 6.9, cilium · github.com/cilium/cilium)
- [CVE-2023-40402](https://cve.now/CVE-2023-40402.md): A permissions issue was addressed with additional restrictions. (no CVSS, Apple macOS)
- [CVE-2023-40455](https://cve.now/CVE-2023-40455.md): A permissions issue was addressed with additional restrictions. (CVSS 10.0, Apple macOS)
- [CVE-2023-40443](https://cve.now/CVE-2023-40443.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS)
- [CVE-2023-32361](https://cve.now/CVE-2023-32361.md): The issue was addressed with improved handling of caches. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-41073](https://cve.now/CVE-2023-41073.md): An authorization issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-32377](https://cve.now/CVE-2023-32377.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-40418](https://cve.now/CVE-2023-40418.md): An authentication issue was addressed with improved state management. (CVSS 5.5, Apple watchOS)
- [CVE-2023-41065](https://cve.now/CVE-2023-41065.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-40434](https://cve.now/CVE-2023-40434.md): A configuration issue was addressed with additional restrictions. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-40422](https://cve.now/CVE-2023-40422.md): The issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2023-41232](https://cve.now/CVE-2023-41232.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-40435](https://cve.now/CVE-2023-40435.md): This issue was addressed by enabling hardened runtime. (no CVSS, Apple Xcode)
- [CVE-2023-40419](https://cve.now/CVE-2023-40419.md): The issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2023-40399](https://cve.now/CVE-2023-40399.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-41984](https://cve.now/CVE-2023-41984.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-41068](https://cve.now/CVE-2023-41068.md): An access issue was addressed with improved access restrictions. (CVSS 7.8, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2023-40454](https://cve.now/CVE-2023-40454.md): A permissions issue was addressed with additional restrictions. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-40403](https://cve.now/CVE-2023-40403.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-40395](https://cve.now/CVE-2023-40395.md): The issue was addressed with improved handling of caches. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-29497](https://cve.now/CVE-2023-29497.md): A privacy issue was addressed with improved handling of temporary files. (no CVSS, Apple macOS)
- [CVE-2023-41063](https://cve.now/CVE-2023-41063.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-40388](https://cve.now/CVE-2023-40388.md): A privacy issue was addressed with improved handling of temporary files. (no CVSS, Apple macOS)
- [CVE-2023-40520](https://cve.now/CVE-2023-40520.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2023-40432](https://cve.now/CVE-2023-40432.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-38615](https://cve.now/CVE-2023-38615.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-40424](https://cve.now/CVE-2023-40424.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-41995](https://cve.now/CVE-2023-41995.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-41079](https://cve.now/CVE-2023-41079.md): The issue was addressed with improved permissions logic. (no CVSS, Apple macOS)
- [CVE-2023-40541](https://cve.now/CVE-2023-40541.md): This issue was addressed by adding an additional prompt for user consent. (no CVSS, Apple macOS)
- [CVE-2023-40384](https://cve.now/CVE-2023-40384.md): A permissions issue was addressed with improved redaction of sensitive information. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2023-40412](https://cve.now/CVE-2023-40412.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-39233](https://cve.now/CVE-2023-39233.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-35990](https://cve.now/CVE-2023-35990.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-40428](https://cve.now/CVE-2023-40428.md): The issue was addressed with improved handling of caches. (no CVSS, Apple iOS and iPadOS)
- [CVE-2023-40429](https://cve.now/CVE-2023-40429.md): A permissions issue was addressed with improved validation. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-39434](https://cve.now/CVE-2023-39434.md): A use-after-free issue was addressed with improved memory management. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-40452](https://cve.now/CVE-2023-40452.md): The issue was addressed with improved bounds checks. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-41078](https://cve.now/CVE-2023-41078.md): An authorization issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-40448](https://cve.now/CVE-2023-40448.md): The issue was addressed with improved handling of protocols. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-41074](https://cve.now/CVE-2023-41074.md): The issue was addressed with improved checks. (CVSS 8.8, Apple iOS and iPadOS · Apple tvOS +6)
- [CVE-2023-40409](https://cve.now/CVE-2023-40409.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-40426](https://cve.now/CVE-2023-40426.md): A permissions issue was addressed with additional restrictions. (no CVSS, Apple macOS)
- [CVE-2023-37448](https://cve.now/CVE-2023-37448.md): A lock screen issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-38586](https://cve.now/CVE-2023-38586.md): An access issue was addressed with additional sandbox restrictions. (CVSS 10.0, Apple macOS)
- [CVE-2023-35984](https://cve.now/CVE-2023-35984.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-40410](https://cve.now/CVE-2023-40410.md): An out-of-bounds read was addressed with improved input validation. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-40386](https://cve.now/CVE-2023-40386.md): A privacy issue was addressed with improved handling of temporary files. (no CVSS, Apple macOS)
- [CVE-2023-41981](https://cve.now/CVE-2023-41981.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-40451](https://cve.now/CVE-2023-40451.md): This issue was addressed with improved iframe sandbox enforcement. (no CVSS, Apple Safari)
- [CVE-2023-40406](https://cve.now/CVE-2023-40406.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-40391](https://cve.now/CVE-2023-40391.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple Xcode +2)
- [CVE-2023-41979](https://cve.now/CVE-2023-41979.md): A race condition was addressed with improved locking. (no CVSS, Apple macOS)
- [CVE-2023-41996](https://cve.now/CVE-2023-41996.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-40407](https://cve.now/CVE-2023-40407.md): The issue was addressed with improved bounds checks. (no CVSS, Apple macOS)
- [CVE-2023-40450](https://cve.now/CVE-2023-40450.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-41980](https://cve.now/CVE-2023-41980.md): A permissions issue was addressed with additional restrictions. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-40431](https://cve.now/CVE-2023-40431.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS)
- [CVE-2023-40427](https://cve.now/CVE-2023-40427.md): The issue was addressed with improved handling of caches. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-32396](https://cve.now/CVE-2023-32396.md): This issue was addressed with improved checks. (CVSS 7.8, Apple iOS and iPadOS · Apple Xcode +3)
- [CVE-2023-41968](https://cve.now/CVE-2023-41968.md): This issue was addressed with improved validation of symlinks. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-23495](https://cve.now/CVE-2023-23495.md): A permissions issue was addressed with improved redaction of sensitive information. (no CVSS, Apple macOS)
- [CVE-2023-40441](https://cve.now/CVE-2023-40441.md): A resource exhaustion issue was addressed with improved input validation. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-40400](https://cve.now/CVE-2023-40400.md): This issue was addressed with improved checks. (CVSS 9.8, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-38596](https://cve.now/CVE-2023-38596.md): The issue was addressed with improved handling of protocols. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-40420](https://cve.now/CVE-2023-40420.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-40436](https://cve.now/CVE-2023-40436.md): The issue was addressed with improved bounds checks. (no CVSS, Apple macOS)
- [CVE-2023-35074](https://cve.now/CVE-2023-35074.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple iOS and iPadOS · Apple tvOS +3)
- [CVE-2023-41067](https://cve.now/CVE-2023-41067.md): A logic issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-41071](https://cve.now/CVE-2023-41071.md): A use-after-free issue was addressed with improved memory management. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-41070](https://cve.now/CVE-2023-41070.md): A logic issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-41174](https://cve.now/CVE-2023-41174.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2023-41066](https://cve.now/CVE-2023-41066.md): An authentication issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-32421](https://cve.now/CVE-2023-32421.md): A privacy issue was addressed with improved handling of temporary files. (no CVSS, Apple macOS)
- [CVE-2023-40456](https://cve.now/CVE-2023-40456.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2023-41986](https://cve.now/CVE-2023-41986.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-40417](https://cve.now/CVE-2023-40417.md): A window management issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple Safari +2)
- [CVE-2023-36851](https://cve.now/CVE-2023-36851.md): Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files (CVSS 5.3, KEV, Juniper Networks Junos OS)
- [CVE-2023-4260](https://cve.now/CVE-2023-4260.md): Potential off-by-one buffer overflow vulnerability in the Zephyr FS subsystem (CVSS 6.3, zephyrproject-rtos Zephyr)
- [CVE-2023-42460](https://cve.now/CVE-2023-42460.md): \_abi\_decode input not validated in complex expressions in Vyper (CVSS 5.3, vyperlang vyper · vyper)
- [CVE-2023-4264](https://cve.now/CVE-2023-4264.md): Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem (CVSS 7.1, zephyrproject-rtos Zephyr)
- [CVE-2023-39347](https://cve.now/CVE-2023-39347.md): Cilium NetworkPolicy bypass via pod labels (CVSS 7.6, cilium · github.com/cilium/cilium)
- [CVE-2023-43646](https://cve.now/CVE-2023-43646.md): Inefficient Regular Expression Complexity in get-func-name (CVSS 8.6, chaijs get-func-name · get-func-name)
- [CVE-2023-30961](https://cve.now/CVE-2023-30961.md): Palantir Gotham UI bug that could lead to incorrect data classification (CVSS 6.5, com.palantir.acme:gotham-fe-bundle · com.palantir.acme:tita…)
- [CVE-2023-30959](https://cve.now/CVE-2023-30959.md): Stored XSS via javascript URI in Apollo Change Requests comment (CVSS 4.1, com.palantir.apollo:autopilot)
- [CVE-2023-34043](https://cve.now/CVE-2023-34043.md): VMware Aria Operations contains a local privilege escalation vulnerability. (CVSS 6.7, VMware Aria Operations)
- [CVE-2023-32541](https://cve.now/CVE-2023-32541.md): A use-after-free vulnerability exists in the footerr functionality of Hancom Office 2020 HWord 11.0.0.7520. (CVSS 8.8, Hancom Office)
- [CVE-2023-43775](https://cve.now/CVE-2023-43775.md): Security issue in SMP Gateway automation platform (CVSS 4.7, Eaton SMP SG-4260 · Eaton SMP SG-4250 +2)
- [CVE-2023-28055](https://cve.now/CVE-2023-28055.md): Dell NetWorker, Version 19.7 has an improper authorization vulnerability in the NetWorker client. (CVSS 8.8, Dell NetWorker)
- [CVE-2023-5157](https://cve.now/CVE-2023-5157.md): Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6 (CVSS 7.5, Red Hat Enterprise Linux · Red Hat Software Collections for…)
- [CVE-2023-4065](https://cve.now/CVE-2023-4065.md): Operator: plaintext password in operator log (CVSS 5.5, Red Hat RHEL-8 based Middleware Containers · Red Hat AMQ Br…)
- [CVE-2023-5197](https://cve.now/CVE-2023-5197.md): Use-after-free in Linux kernel's netfilter: nf\_tables component (CVSS 7.8, Linux Kernel)
- [CVE-2023-39378](https://cve.now/CVE-2023-39378.md): SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') by an unauthenticated user (CVSS 8.8, SiberianCMS)
- [CVE-2023-39377](https://cve.now/CVE-2023-39377.md): SiberianCMS - CWE-434: Unrestricted Upload of File with Dangerous Type - A malicious user with administrative privileges may be able to upload a dangerous filetype via an unspecified method (CVSS 7.2, SiberianCMS)
- [CVE-2023-39376](https://cve.now/CVE-2023-39376.md): SiberianCMS - CWE-284: Improper Access Control Authorized user may disable a security feature over the network (CVSS 6.5, SiberianCMS)
- [CVE-2023-39375](https://cve.now/CVE-2023-39375.md): SiberianCMS - CWE-274: Improper Handling of Insufficient Privileges (CVSS 7.5, SiberianCMS)
- [CVE-2023-43614](https://cve.now/CVE-2023-43614.md): Cross-site scripting vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated atta (no CVSS, Collne Welcart e-Commerce)
- [CVE-2023-43610](https://cve.now/CVE-2023-43610.md): SQL injection vulnerability in Order Data Edit page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor (without setting (no CVSS, Collne Welcart e-Commerce)
- [CVE-2023-43493](https://cve.now/CVE-2023-43493.md): SQL injection vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to (no CVSS, Collne Welcart e-Commerce)
- [CVE-2023-43484](https://cve.now/CVE-2023-43484.md): Cross-site scripting vulnerability in Item List page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenticated attacker t (no CVSS, Collne Welcart e-Commerce)
- [CVE-2023-41962](https://cve.now/CVE-2023-41962.md): Cross-site scripting vulnerability in Credit Card Payment Setup page of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unauthenti (no CVSS, Collne Welcart e-Commerce)
- [CVE-2023-41233](https://cve.now/CVE-2023-41233.md): Cross-site scripting vulnerability in Item List page registration process of Welcart e-Commerce versions 2.7 to 2.8.21 allows a remote unaut (no CVSS, Collne Welcart e-Commerce)
- [CVE-2023-40532](https://cve.now/CVE-2023-40532.md): Path traversal vulnerability in Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with author or higher privilege to obtain partial in (no CVSS, Collne Welcart e-Commerce)
- [CVE-2023-40219](https://cve.now/CVE-2023-40219.md): Welcart e-Commerce versions 2.7 to 2.8.21 allows a user with editor or higher privilege to upload an arbitrary file to an unauthorized direc (no CVSS, Collne Welcart e-Commerce)
- [CVE-2023-3767](https://cve.now/CVE-2023-3767.md): OS command injection on EasyPHP Webserver (CVSS 9.8, EasyPHP Webserver)
- [CVE-2023-41860](https://cve.now/CVE-2023-41860.md): WordPress Travel Map Plugin \<= 1.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, TravelMap Travel Map)
- [CVE-2023-41861](https://cve.now/CVE-2023-41861.md): WordPress Restrict Plugin \<= 2.2.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Restrict)
- [CVE-2023-5192](https://cve.now/CVE-2023-5192.md): Excessive Data Query Operations in a Large Data Table in pimcore/demo (CVSS 6.1, pimcore/demo)
- [CVE-2023-2315](https://cve.now/CVE-2023-2315.md): Path Traversal in OpenCart versions 4.0.0.0 to 4.0.2.2 (CVSS 8.1, Opencart · opencart/opencart)
- [CVE-2023-5162](https://cve.now/CVE-2023-5162.md): Options for Twenty Seventeen \<= 2.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, domainsupport Options for Twenty Seventeen)
- [CVE-2023-5135](https://cve.now/CVE-2023-5135.md): Simple Cloudflare Turnstile \<= 1.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, elliotvs Simple CAPTCHA Alternative with Cloudflare Turnsti…)
- [CVE-2023-5161](https://cve.now/CVE-2023-5161.md): Modal Window \<= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpcalc Modal Window – create popup modal window)
- [CVE-2023-4505](https://cve.now/CVE-2023-4505.md): Staff / Employee Business Directory for Active Directory \<= 1.2.3 - Authenticated (Admin+) LDAP Passback (CVSS 2.2, cyberlord92 Staff/Employee Business Directory for Active Di…)
- [CVE-2023-4506](https://cve.now/CVE-2023-4506.md): Active Directory Integration / LDAP Integration \<= 4.1.10 - LDAP Passback (CVSS 2.2, cyberlord92 Active Directory Integration / LDAP Integration)
- [CVE-2022-48606](https://cve.now/CVE-2022-48606.md): Stability-related vulnerability in the binder background management and control module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-4565](https://cve.now/CVE-2023-4565.md): Broadcast permission control vulnerability in the framework module. (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-41312](https://cve.now/CVE-2023-41312.md): Permission control vulnerability in the audio module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-41311](https://cve.now/CVE-2023-41311.md): Permission control vulnerability in the audio module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-41310](https://cve.now/CVE-2023-41310.md): Keep-alive vulnerability in the sticky broadcast mechanism. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-41309](https://cve.now/CVE-2023-41309.md): Permission control vulnerability in the MediaPlaybackController module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-41308](https://cve.now/CVE-2023-41308.md): Screenshot vulnerability in the input module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-41307](https://cve.now/CVE-2023-41307.md): Memory overwriting vulnerability in the security module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-41306](https://cve.now/CVE-2023-41306.md): Vulnerability of mutex management in the bone voice ID trusted application (TA) module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-41305](https://cve.now/CVE-2023-41305.md): Vulnerability of 5G messages being sent without being encrypted in a VPN environment in the SMS message module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-38243](https://cve.now/CVE-2021-38243.md): xunruicms up to v4.5.1 was discovered to contain a remote code execution (RCE) vulnerability in /index.php. (CVSS 9.8)
- [CVE-2023-35793](https://cve.now/CVE-2023-35793.md): An issue was discovered in Cassia Access Controller 2.1.1.2303271039. (no CVSS)
- [CVE-2023-41904](https://cve.now/CVE-2023-41904.md): Zoho ManageEngine ADManager Plus before 7203 allows 2FA bypass (for AuthToken generation) in REST APIs. (no CVSS)
- [CVE-2023-43154](https://cve.now/CVE-2023-43154.md): In Macrob7 Macs Framework Content Management System (CMS) 1.1.4f, loose comparison in "isValidLogin()" function during login attempt results (no CVSS)
- [CVE-2023-43187](https://cve.now/CVE-2023-43187.md): A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers (no CVSS)
- [CVE-2023-43216](https://cve.now/CVE-2023-43216.md): SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin\_ip.php. (no CVSS)
- [CVE-2023-43222](https://cve.now/CVE-2023-43222.md): SeaCMS v12.8 has an arbitrary code writing vulnerability in the /jxz7g2/admin\_ping.php file. (no CVSS)
- [CVE-2023-43232](https://cve.now/CVE-2023-43232.md): A stored cross-site scripting (XSS) vulnerability in the Website column management function of DedeBIZ v6.2.11 allows attackers to execute a (no CVSS)
- [CVE-2023-43234](https://cve.now/CVE-2023-43234.md): DedeBIZ v6.2.11 was discovered to contain multiple remote code execution (RCE) vulnerabilities at /admin/file\_manage\_control.php via the $ac (no CVSS)
- [CVE-2023-43263](https://cve.now/CVE-2023-43263.md): A Cross-site scripting (XSS) vulnerability in Froala Editor v.4.1.1 allows attackers to execute arbitrary code via the Markdown component. (no CVSS)
- [CVE-2023-43291](https://cve.now/CVE-2023-43291.md): Deserialization of Untrusted Data in emlog pro v.2.1.15 and earlier allows a remote attacker to execute arbitrary code via the cache.php com (no CVSS)
- [CVE-2023-43331](https://cve.now/CVE-2023-43331.md): A cross-site scripting (XSS) vulnerability in the Add User function of Small CRM v3.0 allows attackers to execute arbitrary web scripts or H (no CVSS)
- [CVE-2023-43381](https://cve.now/CVE-2023-43381.md): SQL Injection vulnerability in Tianchoy Blog v.1.8.8 allows a remote attacker to obtain sensitive information via the id parameter in the lo (no CVSS)
- [CVE-2023-43856](https://cve.now/CVE-2023-43856.md): Dreamer CMS v4.1.3 was discovered to contain an arbitrary file read vulnerability via the component /admin/TemplateController.java. (no CVSS)
- [CVE-2023-43857](https://cve.now/CVE-2023-43857.md): Dreamer CMS v4.1.3 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component /admin/u/toIndex. (no CVSS)
- [CVE-2023-44042](https://cve.now/CVE-2023-44042.md): A stored cross-site scripting (XSS) vulnerability in /settings/index.php of Black Cat CMS 1.4.1 allows attackers to execute arbitrary web sc (no CVSS)
- [CVE-2023-44043](https://cve.now/CVE-2023-44043.md): A reflected cross-site scripting (XSS) vulnerability in /install/index.php of Black Cat CMS 1.4.1 allows attackers to execute arbitrary web (no CVSS)
- [CVE-2023-44044](https://cve.now/CVE-2023-44044.md): Super Store Finder v3.6 and below was discovered to contain a SQL injection vulnerability via the Search parameter at /admin/stores.php. (no CVSS)
- [CVE-2023-44169](https://cve.now/CVE-2023-44169.md): SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin\_notify.php. (no CVSS)
- [CVE-2023-44170](https://cve.now/CVE-2023-44170.md): SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin\_ping.php. (no CVSS)
- [CVE-2023-44171](https://cve.now/CVE-2023-44171.md): SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin\_smtp.php. (no CVSS)
- [CVE-2023-44172](https://cve.now/CVE-2023-44172.md): SeaCMS V12.9 was discovered to contain an arbitrary file write vulnerability via the component admin\_weixin.php. (no CVSS)
- [CVE-2023-44216](https://cve.now/CVE-2023-44216.md): PVRIC (PowerVR Image Compression) on Imagination 2018 and later GPU devices offers software-transparent compression that enables cross-origi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-09-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.