CVEs published October 2, 2023
79 CVEs were published on October 2, 2023: 4 critical, 14 high.
- Published
- 79
- Critical
- 4
- High
- 14
- Medium
- 45
- Low
- 0
- Unrated
- 16
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Pure Storage FlashArray Purity
- 3
- Eclipse Mosquitto
- 2
- Gopi Ramasamy Popup contact form
- 2
- Ingeteam INGEPAC DA3451
- 2
- MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- 2
- MediaTek MT6879, MT6886, MT6895, MT6983, MT6985, MT6989, MT…
- 2
- Pure Storage FlashBlade Purity
- 2
- 2J Slideshow Team Slideshow, Image Slider by
- 1
- Arrow Plugins The Awesome Feed – Custom Feed
- 1
- Ashok Rane Order Delivery Date for WP e-Commerce
- 1
Critical 4
- CVE-2023-4659Cross-Site Request Forgery in Free5GcFree5Gc Open5Gc
- CVE-2023-3744Server-Side Request Forgery in SLiMSSLiMS
- CVE-2023-43892Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings.
- CVE-2023-44011An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at t
High 14
- CVE-2023-36628Privilege Escalation in VASAPure Storage FlashArray Purity
- CVE-2023-36627FlashBlade Snapshot SchedulerPure Storage FlashBlade Purity
- CVE-2023-31042FlashBlade Object Store ProtocolPure Storage FlashBlade Purity
- CVE-2023-3769Vulnerability in Ingeteam's INGEPAC EF Ingeteam INGEPAC FC5066
- CVE-2023-5106Incorrect Authorization in GitLabGitLab
- CVE-2023-3768Vulnerability in Ingeteam's INGEPAC EF/DAIngeteam INGEPAC DA3451
- CVE-2023-44245WordPress Contractor Contact Form Website to Workflow Tool Plugin <= 4.0.0 is vulnerable to Cross Site Scripting (XSS)Leap Contractor Contact Form Website to Workflow Tool
- CVE-2023-44144WordPress Dreamfox Media Payment gateway per Product for Woocommerce Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)Dreamfox Payment gateway per Product for WooCommerce
- CVE-2023-44244WordPress FooGallery Plugin <= 2.2.44 is vulnerable to Cross Site Scripting (XSS)FooPlugins FooGallery
- CVE-2023-44474WordPress Tiger Forms Plugin <= 2.0.0 is vulnerable to Cross Site Scripting (XSS)MD Jakir Hosen Tiger Forms – Drag and Drop Form Builder
- CVE-2023-41856WordPress Click To Tweet Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS)ClickToTweet.com Click To Tweet
- CVE-2023-41692WordPress Attorney Theme <= 3 is vulnerable to Cross Site Scripting (XSS)Hennessey Digital Attorney
- CVE-2023-32820In wlan firmware, there is a possible firmware assertion due to improper input handling.MediaTek MT5221, MT6781, MT6833, MT6853, MT6853T, MT6855, M…
- CVE-2023-43835Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when s
Medium, low and unrated 61
- CVE-2023-32572FlashArray pgroup Retention Lock SafeMode ProtectionPure Storage FlashArray Purity
- CVE-2023-28373FlashArray SafeMode Immutable Vulnerability Pure Storage FlashArray Purity
- CVE-2023-28372FlashBlade Object Store Privileged AccessPure Storage FlashBlade
- CVE-2023-5344Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2023-3592In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property typEclipse Mosquitto
- CVE-2023-0809In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets.Eclipse Mosquitto
- CVE-2015-10124Most Popular Posts Widget Plugin functions.php show_views sql injectionMost Popular Posts Widget Plugin
- CVE-2023-3770Vulnerability in Ingeteam's INGEPAC DAIngeteam INGEPAC DA3451
- CVE-2023-5160Full name disclosure via team top membership with Show Full Name option disabledMattermost
- CVE-2023-44228WordPress Onclick Show Popup Plugin <= 8.1 is vulnerable to Cross Site Scripting (XSS)Gopi Ramasamy Onclick show popup
- CVE-2023-44266WordPress WP Adminify Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)Jewel Theme WP Adminify
- CVE-2023-44230WordPress Popup contact form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)Gopi Ramasamy Popup contact form
- CVE-2023-44265WordPress Popup contact form Plugin <= 7.1 is vulnerable to Cross Site Scripting (XSS)Gopi Ramasamy Popup contact form
- CVE-2023-44264WordPress The Awesome Feed – Custom Feed Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)Arrow Plugins The Awesome Feed – Custom Feed
- CVE-2023-44242WordPress Images Slideshow by 2J Plugin <= 1.3.54 is vulnerable to Cross Site Scripting (XSS)2J Slideshow Team Slideshow, Image Slider by
- CVE-2023-44262WordPress Blocks Plugin <= 1.6.41 is vulnerable to Cross Site Scripting (XSS)Renzo Johnson Blocks
- CVE-2023-44145WordPress Anchor Episodes Index (Spotify for Podcasters) Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)jesweb.dev Anchor Episodes Index
- CVE-2023-44263WordPress Social Metrics Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)Riyaz Social Metrics
- CVE-2023-44239WordPress WWM Social Share On Image Hover Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)Jobin Jose WWM Social Share On Image Hover
- CVE-2023-44477WordPress Cooked Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)Boxy Studio Cooked
- CVE-2023-41859WordPress Order Delivery Date for WP e-Commerce Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)Ashok Rane Order Delivery Date for WP e-Commerce
- CVE-2023-41855WordPress Regpack Plugin <= 0.1 is vulnerable to Cross Site Scripting (XSS)Regpacks Regpack
- CVE-2023-41847WordPress Notice Bar Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)WEN Solutions Notice Bar
- CVE-2023-41800WordPress UniConsent Cookie Consent CMP for GDPR / CCPA Plugin <= 1.4.2 is vulnerable to Cross Site Scripting (XSS)UniConsent CMP for GDPR CPRA GPP TCF
- CVE-2023-41797WordPress Locations Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)Gold Plugins Locations
- CVE-2023-44479WordPress WP Jump Menu Plugin <= 3.6.4 is vulnerable to Cross Site Scripting (XSS)Jim Krill WP Jump Menu
- CVE-2023-41737WordPress Swifty Bar, sticky bar by WPGens Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)Swifty Bar, sticky bar by WPGens
- CVE-2023-41736WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to Cross Site Scripting (XSS)Gopi Ramasamy Email posts to subscribers
- CVE-2023-41734WordPress Insert Estimated Reading Time Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)nigauri Insert Estimated Reading Time
- CVE-2023-41733WordPress Back To The Top Button Plugin <= 2.1.5 is vulnerable to Cross Site Scripting (XSS)YYDevelopment Back To The Top Button
- CVE-2023-41731WordPress wordpress publish post email notification Plugin <= 1.0.2.2 is vulnerable to Cross Site Scripting (XSS)I Thirteen Web Solution WordPress publish post email notifi…
- CVE-2023-41729WordPress SendPress Newsletters Plugin <= 1.22.3.31 is vulnerable to Cross Site Scripting (XSS)SendPress Newsletters
- CVE-2023-41728WordPress Rescue Shortcodes Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)Rescue Themes Rescue Shortcodes
- CVE-2023-42132FD Application Apr.Ministry of Health, Labour and Welfare FD Application
- CVE-2023-32830In TVAPI, there is a possible out of bounds write due to a missing bounds check.MediaTek MT5527, MT5583, MT5598, MT5599, MT5670, MT5680, MT…
- CVE-2023-32829In apusys, there is a possible out of bounds write due to an integer overflow.MediaTek MT6879, MT6886, MT6891, MT6895, MT6896, MT6983, MT…
- CVE-2023-32828In vpu, there is a possible out of bounds write due to an integer overflow.MediaTek MT6771, MT6779, MT6785, MT6853, MT6853T, MT6873, M…
- CVE-2023-32827In camera middleware, there is a possible out of bounds write due to a missing input validation.MediaTek MT6879, MT6886, MT6895, MT6983, MT6985, MT6989, MT…
- CVE-2023-32826In camera middleware, there is a possible out of bounds write due to a missing input validation.MediaTek MT6879, MT6886, MT6895, MT6983, MT6985, MT6989, MT…
- CVE-2023-32824In rpmb , there is a possible double free due to improper locking.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2023-32823In rpmb , there is a possible memory corruption due to a missing bounds check.MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2023-32822In ftm, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2713, MT6739, MT6761, MT6762, MT6765, MT6768, MT…
- CVE-2023-32821In video, there is a possible out of bounds write due to a permissions bypass.MediaTek MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT…
- CVE-2023-32819In display, there is a possible information disclosure due to a missing bounds check.MediaTek MT6765, MT6768, MT6833, MT6879, MT6883, MT6885, MT…
- CVE-2023-20819In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2731, MT6570, MT6580, MT6595, MT6732, MT6735, MT…
- CVE-2023-5329Field Logic DataCube4 Web API improper authenticationField Logic DataCube4
- CVE-2023-37605Weak Exception Handling vulnerability in baramundi software GmbH EMM Agent 23.1.50 and before allows an attacker to cause a denial of servic
- CVE-2023-41580Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php.
- CVE-2023-43267A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web sc
- CVE-2023-43268Deyue Remote Vehicle Management System v1.1 was discovered to contain a deserialization vulnerability.
- CVE-2023-43297An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
- CVE-2023-43361Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during
- CVE-2023-43836There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information
- CVE-2023-43890Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page.
- CVE-2023-43891Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function.
- CVE-2023-43893Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup_mac parameter in the Wake-On-LAN (WoL) fun
- CVE-2023-43980Presto Changeo testsitecreator up to v1.1.1 was discovered to contain a SQL injection vulnerability via the component disable_json.php.
- CVE-2023-44008File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function.
- CVE-2023-44009File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function.
- CVE-2023-44012Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in t
- CVE-2023-44463An issue was discovered in pretix before 2023.7.1.pretix