CVEs published September 29, 2023
78 CVEs were published on September 29, 2023: 1 critical, 9 high.
- Published
- 78
- Critical
- 1
- High
- 9
- Medium
- 48
- Low
- 13
- Unrated
- 7
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- GitLab
- 12
- SourceCodester Engineers Online Portal
- 9
- Mattermost · github.com/mattermost/mattermost/server/v8 +1
- 5
- SourceCodester Best Courier Management System
- 5
- Tongda OA
- 4
- ithewei/libhv
- 3
- DedeBIZ
- 2
- ECshop
- 2
- OpenRapid RapidCMS
- 2
- Xinhu RockOA
- 2
Critical 1
High 9
- CVE-2023-26218TIBCO Nimbus Reflected Cross-site Scripting (XSS) vulnerabilitiesTIBCO Software TIBCO Nimbus
- CVE-2023-39308WordPress User Feedback Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)UserFeedback Team User Feedback
- CVE-2023-5289Allocation of Resources Without Limits or Throttling in ikus060/rdiffwebikus060/rdiffweb · rdiffweb
- CVE-2023-41691WordPress WooCommerce PensoPay Plugin <= 6.3.1 is vulnerable to Cross Site Scripting (XSS)WooCommerce PensoPay
- CVE-2023-41663WordPress WP Bannerize Pro Plugin <= 1.6.9 is vulnerable to Cross Site Scripting (XSS)Giovambattista Fazioli WP Bannerize Pro
- CVE-2023-41662WordPress WP-dTree Plugin <= 4.4.5 is vulnerable to Cross Site Scripting (XSS)Ulf Benjaminsson WP-dTree
- CVE-2023-41658WordPress Photo Gallery Slideshow & Masonry Tiled Gallery Plugin <= 1.0.13 is vulnerable to Cross Site Scripting (XSS)I Thirteen Web Solution Photo Gallery Slideshow & Masonry T…
- CVE-2023-32477 Dell Common Event Enabler 8.9.8.2 for Windows and prior, contain an improper access control vulnerability.Dell Common Event Enabler
- CVE-2023-30591NodeBB Pre-Authentication Denial-of-ServiceNodeBB
Medium, low and unrated 68
- CVE-2023-5297Xinhu RockOA start backupXinhu RockOA
- CVE-2023-5296Xinhu RockOA Password password recoveryXinhu RockOA
- CVE-2023-5294ECshop order.php sql injectionECshop
- CVE-2023-5293ECshop leancloud.php sql injectionECshop
- CVE-2023-5287BEECMS cross site scriptingBEECMS
- CVE-2023-5286SourceCodester Expense Tracker App Category add_category.php cross site scriptingSourceCodester Expense Tracker App
- CVE-2023-43655Remote Code Execution via web-accessible composer.pharcomposer · composer/composer
- CVE-2023-5285Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-5284SourceCodester Engineers Online Portal upload_save_student.php unrestricted uploadSourceCodester Engineers Online Portal
- CVE-2023-5283SourceCodester Engineers Online Portal teacher_signup.php sql injectionSourceCodester Engineers Online Portal
- CVE-2023-5282SourceCodester Engineers Online Portal seed_message_student.php sql injectionSourceCodester Engineers Online Portal
- CVE-2023-5281SourceCodester Engineers Online Portal remove_inbox_message.php sql injectionSourceCodester Engineers Online Portal
- CVE-2023-5280SourceCodester Engineers Online Portal my_students.php sql injectionSourceCodester Engineers Online Portal
- CVE-2023-5279SourceCodester Engineers Online Portal my_classmates.php sql injectionSourceCodester Engineers Online Portal
- CVE-2023-5278SourceCodester Engineers Online Portal login.php sql injectionSourceCodester Engineers Online Portal
- CVE-2023-5277SourceCodester Engineers Online Portal student_avatar.php unrestricted uploadSourceCodester Engineers Online Portal
- CVE-2023-5276SourceCodester Engineers Online Portal downloadable_student.php sql injectionSourceCodester Engineers Online Portal
- CVE-2023-3024Bluetooth LE segmented 'prepare write response' packet may lead to out-of-bounds memory accesssilabs.com GSDK
- CVE-2023-5273SourceCodester Best Courier Management System manage_parcel_status.php cross site scriptingSourceCodester Best Courier Management System
- CVE-2023-5272SourceCodester Best Courier Management System GET Parameter edit_parcel.php sql injectionSourceCodester Best Courier Management System
- CVE-2023-39410Apache Avro Java SDK: Memory when deserializing untrusted data in Avro Java SDKApache Software Foundation Apache Avro Java SDK · avro +1
- CVE-2023-5271SourceCodester Best Courier Management System edit_parcel.php sql injectionSourceCodester Best Courier Management System
- CVE-2023-5270SourceCodester Best Courier Management System view_parcel.php sql injectionSourceCodester Best Courier Management System
- CVE-2023-5269SourceCodester Best Courier Management System GET Parameter parcel_list.php sql injectionSourceCodester Best Courier Management System
- CVE-2023-5268DedeBIZ makehtml_taglist_action.php sql injectionDedeBIZ
- CVE-2023-5267Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-5266DedeBIZ tags_main.php sql injectionDedeBIZ
- CVE-2023-5265Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-5264huakecms cms_content.php sql injectionhuakecms
- CVE-2023-5263ZZZCMS Database Backup File save.php restore permissionZZZCMS
- CVE-2023-41687WordPress Goods Catalog Plugin <= 2.4.1 is vulnerable to Cross Site Scripting (XSS)Irina Sokolovskaya Goods Catalog
- CVE-2023-41666WordPress Stock Quotes List Plugin <= 2.9.9 is vulnerable to Cross Site Scripting (XSS)Stockdio Stock Quotes List
- CVE-2023-41661WordPress Smarty for WordPress Plugin <= 3.1.35 is vulnerable to Cross Site Scripting (XSS)PressPage Entertainment Smarty for WordPress
- CVE-2023-5262OpenRapid RapidCMS uploadicon.php isImg unrestricted uploadOpenRapid RapidCMS
- CVE-2023-41657WordPress HollerBox Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS)Groundhogg HollerBox
- CVE-2023-41655WordPress authLdap Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS)Andreas Heigl authLdap
- CVE-2023-5261Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-5260SourceCodester Simple Membership System group_validator.php sql injectionSourceCodester Simple Membership System
- CVE-2023-5259ForU CMS cms_admin.php denial of serviceForU CMS
- CVE-2023-5258OpenRapid RapidCMS addgood.php sql injectionOpenRapid RapidCMS
- CVE-2023-5257WhiteHSBG JNDIExploit HTTPServer.java handleFileRequest path traversalWhiteHSBG JNDIExploit
- CVE-2023-5194A system/user manager can demote / deactivate another managerMattermost · github.com/mattermost/mattermost/server/v8 +1
- CVE-2023-5195A team member can soft delete other teams that they are not part ofMattermost · github.com/mattermost/mattermost/server/v8 +1
- CVE-2023-5193System Role with manage posts permission can read posts of Direct MessagesMattermost · github.com/mattermost/mattermost/server/v8 +1
- CVE-2023-5196DoS via Channel Notification PropertiesMattermost · github.com/mattermost/mattermost/server/v8 +1
- CVE-2023-5159A User Manager role with user edit permissions could manage/update botsMattermost · github.com/mattermost/mattermost/server/v8 +1
- CVE-2023-3413Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2023-3922URL Redirection to Untrusted Site ('Open Redirect') in GitLabGitLab
- CVE-2023-5198Incorrect Authorization in GitLabGitLab
- CVE-2023-0989Improper Ownership Management in GitLabGitLab
- CVE-2023-2233Missing Authorization in GitLabGitLab
- CVE-2023-3115Incorrect User Management in GitLabGitLab
- CVE-2023-3920Incorrect Authorization in GitLabGitLab
- CVE-2023-3917Improper Validation of Specified Type of Input in GitLabGitLab
- CVE-2023-3914Incorrect User Management in GitLabGitLab
- CVE-2023-3906Improper Validation of Specified Type of Input in GitLabGitLab
- CVE-2023-3979Incorrect Authorization in GitLabGitLab
- CVE-2023-4532Incorrect Authorization in GitLabGitLab
- CVE-2023-26147All versions of the package ithewei/libhv are vulnerable to HTTP Response Splitting when untrusted user input is used to build headers valueithewei/libhv
- CVE-2023-26148All versions of the package ithewei/libhv are vulnerable to CRLF Injection when untrusted user input is used to set request headers.ithewei/libhv
- CVE-2023-26146All versions of the package ithewei/libhv are vulnerable to Cross-site Scripting (XSS) such that when a file with a name containing a maliciithewei/libhv
- CVE-2022-35908Cambium Enterprise Wi-Fi System Software before 6.4.2 does not sanitize the ping host argument in device-agent.
- CVE-2023-43909Hospital Management System thru commit 4770d was discovered to contain a SQL injection vulnerability via the app_contact parameter in appsea
- CVE-2023-43944A Stored Cross Site Scripting (XSS) vulnerability was found in SourceCodester Task Management System 1.0.
- CVE-2023-44270An issue was discovered in PostCSS before 8.4.31.postcss
- CVE-2023-44464pretix before 2023.7.2 allows Pillow to parse EPS files.pretix
- CVE-2023-44466An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5.
- CVE-2023-44469A Server-Side Request Forgery issue in the OpenID Connect Issuer in LemonLDAP::NG before 2.17.1 allows authenticated remote attackers to sen