CVEs published September 28, 2023
73 CVEs were published on September 28, 2023: 9 critical, 14 high. 1 is now in CISA KEV.
- Published
- 73
- Critical
- 9
- High
- 14
- Medium
- 20
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 1
- Fix available
- 16
Most affected products
- gugoan/economizzer
- 5
- Online Movie Ticket Booking System
- 5
- Asset Management System
- 2
- Generex UPS CS141
- 2
- Google Chrome
- 2
- Online Book Store Project
- 2
- PrestaShop · prestashop/prestashop
- 2
- Red Hat Enterprise Linux
- 2
- discourse-encrypt
- 1
- Drupal Core · drupal/core
- 1
Critical 9
- CVE-2023-43654TorchServe Server-Side Request Forgerypytorch serve · torchserve
- CVE-2023-44166Online Movie Ticket Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Online Movie Ticket Booking System
- CVE-2023-44164Online Movie Ticket Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Online Movie Ticket Booking System
- CVE-2023-44163Online Movie Ticket Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Online Movie Ticket Booking System
- CVE-2023-43739Online Book Store Project v1.0 - Unauthenticated SQL Injection (SQLi)Online Book Store Project
- CVE-2023-43013Asset Management System v1.0 - Unauthenticated SQL Injection (SQLi)Asset Management System
- CVE-2023-5185Gym Management System Project v1.0 - Insecure File UploadGym Management System Project
- CVE-2023-5053SQL Injection in hospital-management-system-in-php 378c157 in index.phphospital-management-system
- CVE-2023-5004Hospital-management-system-in-php 378c157 - Blind SQL InjectionHospital-management-system
High 14
- CVE-2023-5077Vault's Google Cloud Secrets Engine Removed Existing IAM Conditions When Creating / Updating RolesetsHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-43662Arbitrary file read vulnerability in Shoko ServerShokoAnime ShokoServer
- CVE-2023-43014Asset Management System v1.0 - Authenticated SQL Injection (SQLi)Asset Management System
- CVE-2023-43740Online Book Store Project v1.0 - Insecure File UploadOnline Book Store Project
- CVE-2023-4316Zod 3.22.2 - Regular expression Denial of ServiceZod
- CVE-2023-5256Drupal core - Critical - Cache poisoning - SA-CORE-2023-006Drupal Core · drupal/core
- CVE-2023-43657Improper escaping of encrypted topic titles can lead to Cross-site Scripting under non-default site configurationdiscourse-encrypt
- CVE-2023-40375IBM i privilege escalationIBM i
- CVE-2023-5217Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potenGoogle Chrome · Google libvpx +1
- CVE-2022-47186Unrestricted Upload of File vulnerability in Generex CS141Generex UPS CS141
- CVE-2023-26145This affects versions of the package pydash before 6.0.0.pydash
- CVE-2023-41450An issue in phpkobo AjaxNewsTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload to the reque parameter.
- CVE-2023-43226An arbitrary file upload vulnerability in dede/baidunews.php in DedeCMS 5.7.111 and earlier allows attackers to execute arbitrary code via u
- CVE-2023-43862D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formLanguageChange function.
Medium, low and unrated 50
- CVE-2023-3775Vault Enterprise's Sentinel RGP Policies Allowed For Cross-Namespace Denial of ServiceHashiCorp Vault Enterprise
- CVE-2023-44174Online Movie Ticket Booking System v1.0 - Stored Cross-Site Scripting (XSS)Online Movie Ticket Booking System
- CVE-2023-44173Online Movie Ticket Booking System v1.0 - Reflected Cross-Site Scripting (XSS)Online Movie Ticket Booking System
- CVE-2023-43664Employee without any access rights can list all installed modules in PrestashopPrestaShop · prestashop/prestashop
- CVE-2023-43663Improper Privilege Management in PrestashopPrestaShop · prestashop/prestashop
- CVE-2023-43044IBM License Metric Tool directory traversalIBM License Metric Tool
- CVE-2023-5187Use after free in Extensions in Google Chrome prior to 117.0.5938.132 allowed an attacker who convinced a user to install a malicious extensGoogle Chrome
- CVE-2023-5186Use after free in Passwords in Google Chrome prior to 117.0.5938.132 allowed a remote attacker who convinced a user to engage in specific UIGoogle Chrome
- CVE-2023-40307Privileges Memory Corruption (Out-of-bound write)SAP SE SAP Privileges
- CVE-2023-42756Kernel: netfilter: race condition between ipset_cmd_add and ipset_cmd_swapRed Hat Enterprise Linux
- CVE-2023-5215Libnbd: crash or misbehaviour when nbd server returns an unexpected block sizeRed Hat Enterprise Linux
- CVE-2022-47187File upload XSS vulnerability in Generex CS141Generex UPS CS141
- CVE-2023-26149Versions of the package quill-mention before 4.0.0 are vulnerable to Cross-site Scripting (XSS) due to improper user-input sanitization, viaquill-mention
- CVE-2023-5233Font Awesome Integration <= 5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodemcostales84 Font Awesome Integration
- CVE-2023-5230TM WooCommerce Compare & Wishlist <= 1.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodetemplatemonster-2002 TM WooCommerce Compare & Wishlist
- CVE-2023-5232Font Awesome More Icons <= 3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodejr00ck Font Awesome More Icons
- CVE-2023-5244Cross-site Scripting (XSS) - Reflected in microweber/microwebermicroweber/microweber
- CVE-2023-30415Sourcecodester Packers and Movers Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /in
- CVE-2023-38870A SQL injection vulnerability exists in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1.
- CVE-2023-38871The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer has a user enumeration vulnerability in the login and forgot password gugoan/economizzer
- CVE-2023-38872An Insecure Direct Object Reference (IDOR) vulnerability in gugoan Economizzer commit 3730880 (April 2023) and v.0.9-beta1 allows any unauthgugoan/economizzer
- CVE-2023-38873The commit 3730880 (April 2023) and v.0.9-beta1 of gugoan Economizzer is vulnerable to Clickjacking.gugoan/economizzer
- CVE-2023-38874A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (Aprilgugoan/economizzer
- CVE-2023-38877A host header injection vulnerability exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April 2023).gugoan/economizzer
- CVE-2023-41444An issue in Binalyze IREC.sys v.3.11.0 and before allows a local attacker to execute arbitrary code and escalate privileges via the fun_1400
- CVE-2023-41446Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted script
- CVE-2023-41447Cross Site Scripting vulnerability in phpkobo AjaxNewTicker v.1.0.5 allows a remote attacker to execute arbitrary code via a crafted payload
- CVE-2023-41911Samsung Mobile Processor Exynos 2200 allows a GPU Double Free (issue 1 of 2).
- CVE-2023-42222WebCatalog before 49.0 is vulnerable to Incorrect Access Control.
- CVE-2023-43323mooSocial 3.1.8 is vulnerable to external service interaction on post function.
- CVE-2023-43860D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanNonLogin function.
- CVE-2023-43861D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPPoE function.
- CVE-2023-43863D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanDhcpplus function.
- CVE-2023-43864D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard55 function.
- CVE-2023-43865D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanPPTP function.
- CVE-2023-43866D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard7 function.
- CVE-2023-43867D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWanL2TP function.
- CVE-2023-43868D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via websGetVar function.
- CVE-2023-43869D-Link DIR-619L B1 2.02 is vulnerable to Buffer Overflow via formSetWAN_Wizard56 function.
- CVE-2023-43871A File upload vulnerability in WBCE v.1.6.1 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).
- CVE-2023-43872A File upload vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to upload a pdf file with hidden Cross Site Scripting (XSS).
- CVE-2023-43873A Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the
- CVE-2023-43874Multiple Cross Site Scripting (XSS) vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script
- CVE-2023-43876A Cross-Site Scripting (XSS) vulnerability in installation of October v.3.4.16 allows an attacker to execute arbitrary web scripts via a cra
- CVE-2023-43878Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a crafted payload in
- CVE-2023-43879Rite CMS 3.0 has a Cross-Site scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payload into the G
- CVE-2023-43884A Cross-site scripting (XSS) vulnerability in Reference ID from the panel Transactions, of Subrion v4.2.1 allows attackers to execute arbitrintelliants/subrion
- CVE-2023-44273Consensys gnark-crypto through 0.11.2 allows Signature Malleability.github.com/consensys/gnark-crypto
- CVE-2023-44275OPNsense before 23.7.5 allows XSS via the index.php column_count parameter to the Lobby Dashboard.
- CVE-2023-44276OPNsense before 23.7.5 allows XSS via the index.php sequence parameter to the Lobby Dashboard.