# CVEs published 2023-10-02

79 CVEs were published on October 2, 2023: 4 critical, 14 high. Days are UTC.

- [CVE-2023-36628](https://cve.now/CVE-2023-36628.md): Privilege Escalation in VASA (CVSS 8.8, Pure Storage FlashArray Purity)
- [CVE-2023-32572](https://cve.now/CVE-2023-32572.md): FlashArray pgroup Retention Lock SafeMode Protection (CVSS 6.5, Pure Storage FlashArray Purity)
- [CVE-2023-28373](https://cve.now/CVE-2023-28373.md): FlashArray SafeMode Immutable Vulnerability (CVSS 4.4, Pure Storage FlashArray Purity)
- [CVE-2023-36627](https://cve.now/CVE-2023-36627.md): FlashBlade Snapshot Scheduler (CVSS 7.7, Pure Storage FlashBlade Purity)
- [CVE-2023-31042](https://cve.now/CVE-2023-31042.md): FlashBlade Object Store Protocol (CVSS 7.7, Pure Storage FlashBlade Purity)
- [CVE-2023-28372](https://cve.now/CVE-2023-28372.md): FlashBlade Object Store Privileged Access (CVSS 6.5, Pure Storage FlashBlade)
- [CVE-2023-5344](https://cve.now/CVE-2023-5344.md): Heap-based Buffer Overflow in vim/vim (CVSS 4.0, vim/vim)
- [CVE-2023-3592](https://cve.now/CVE-2023-3592.md): In Mosquitto before 2.0.16, a memory leak occurs when clients send v5 CONNECT packets with a will message that contains invalid property typ (CVSS 5.8, Eclipse Mosquitto)
- [CVE-2023-0809](https://cve.now/CVE-2023-0809.md): In Mosquitto before 2.0.16, excessive memory is allocated based on malicious initial packets that are not CONNECT packets. (CVSS 5.8, Eclipse Mosquitto)
- [CVE-2023-4659](https://cve.now/CVE-2023-4659.md): Cross-Site Request Forgery in Free5Gc (CVSS 9.8, Free5Gc Open5Gc)
- [CVE-2015-10124](https://cve.now/CVE-2015-10124.md): Most Popular Posts Widget Plugin functions.php show\_views sql injection (CVSS 6.3, Most Popular Posts Widget Plugin)
- [CVE-2023-3744](https://cve.now/CVE-2023-3744.md): Server-Side Request Forgery in SLiMS (CVSS 9.9, SLiMS)
- [CVE-2023-3770](https://cve.now/CVE-2023-3770.md): Vulnerability in Ingeteam's INGEPAC DA (CVSS 5.3, Ingeteam INGEPAC DA3451)
- [CVE-2023-3769](https://cve.now/CVE-2023-3769.md): Vulnerability in Ingeteam's INGEPAC EF (CVSS 8.6, Ingeteam INGEPAC FC5066)
- [CVE-2023-5106](https://cve.now/CVE-2023-5106.md): Incorrect Authorization in GitLab (CVSS 8.2, GitLab)
- [CVE-2023-3768](https://cve.now/CVE-2023-3768.md): Vulnerability in Ingeteam's INGEPAC EF/DA (CVSS 8.6, Ingeteam INGEPAC DA3451)
- [CVE-2023-5160](https://cve.now/CVE-2023-5160.md): Full name disclosure via team top membership with Show Full Name option disabled (CVSS 4.3, Mattermost)
- [CVE-2023-44228](https://cve.now/CVE-2023-44228.md): WordPress Onclick Show Popup Plugin \<= 8.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Gopi Ramasamy Onclick show popup)
- [CVE-2023-44266](https://cve.now/CVE-2023-44266.md): WordPress WP Adminify Plugin \<= 3.1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Jewel Theme WP Adminify)
- [CVE-2023-44230](https://cve.now/CVE-2023-44230.md): WordPress Popup contact form Plugin \<= 7.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Gopi Ramasamy Popup contact form)
- [CVE-2023-44265](https://cve.now/CVE-2023-44265.md): WordPress Popup contact form Plugin \<= 7.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Gopi Ramasamy Popup contact form)
- [CVE-2023-44264](https://cve.now/CVE-2023-44264.md): WordPress The Awesome Feed – Custom Feed Plugin \<= 2.2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Arrow Plugins The Awesome Feed – Custom Feed)
- [CVE-2023-44242](https://cve.now/CVE-2023-44242.md): WordPress Images Slideshow by 2J Plugin \<= 1.3.54 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, 2J Slideshow Team Slideshow, Image Slider by)
- [CVE-2023-44245](https://cve.now/CVE-2023-44245.md): WordPress Contractor Contact Form Website to Workflow Tool Plugin \<= 4.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Leap Contractor Contact Form Website to Workflow Tool)
- [CVE-2023-44262](https://cve.now/CVE-2023-44262.md): WordPress Blocks Plugin \<= 1.6.41 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Renzo Johnson Blocks)
- [CVE-2023-44145](https://cve.now/CVE-2023-44145.md): WordPress Anchor Episodes Index (Spotify for Podcasters) Plugin \<= 2.1.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, jesweb.dev Anchor Episodes Index)
- [CVE-2023-44144](https://cve.now/CVE-2023-44144.md): WordPress Dreamfox Media Payment gateway per Product for Woocommerce Plugin \<= 3.2.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Dreamfox Payment gateway per Product for WooCommerce)
- [CVE-2023-44263](https://cve.now/CVE-2023-44263.md): WordPress Social Metrics Plugin \<= 2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Riyaz Social Metrics)
- [CVE-2023-44239](https://cve.now/CVE-2023-44239.md): WordPress WWM Social Share On Image Hover Plugin \<= 2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Jobin Jose WWM Social Share On Image Hover)
- [CVE-2023-44244](https://cve.now/CVE-2023-44244.md): WordPress FooGallery Plugin \<= 2.2.44 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, FooPlugins FooGallery)
- [CVE-2023-44477](https://cve.now/CVE-2023-44477.md): WordPress Cooked Plugin \<= 1.7.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Boxy Studio Cooked)
- [CVE-2023-44474](https://cve.now/CVE-2023-44474.md): WordPress Tiger Forms Plugin \<= 2.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, MD Jakir Hosen Tiger Forms – Drag and Drop Form Builder)
- [CVE-2023-41859](https://cve.now/CVE-2023-41859.md): WordPress Order Delivery Date for WP e-Commerce Plugin \<= 1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Ashok Rane Order Delivery Date for WP e-Commerce)
- [CVE-2023-41856](https://cve.now/CVE-2023-41856.md): WordPress Click To Tweet Plugin \<= 2.0.14 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, ClickToTweet.com Click To Tweet)
- [CVE-2023-41855](https://cve.now/CVE-2023-41855.md): WordPress Regpack Plugin \<= 0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Regpacks Regpack)
- [CVE-2023-41847](https://cve.now/CVE-2023-41847.md): WordPress Notice Bar Plugin \<= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WEN Solutions Notice Bar)
- [CVE-2023-41800](https://cve.now/CVE-2023-41800.md): WordPress UniConsent Cookie Consent CMP for GDPR / CCPA Plugin \<= 1.4.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, UniConsent CMP for GDPR CPRA GPP TCF)
- [CVE-2023-41797](https://cve.now/CVE-2023-41797.md): WordPress Locations Plugin \<= 4.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Gold Plugins Locations)
- [CVE-2023-44479](https://cve.now/CVE-2023-44479.md): WordPress WP Jump Menu Plugin \<= 3.6.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Jim Krill WP Jump Menu)
- [CVE-2023-41737](https://cve.now/CVE-2023-41737.md): WordPress Swifty Bar, sticky bar by WPGens Plugin \<= 1.2.10 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Swifty Bar, sticky bar by WPGens)
- [CVE-2023-41736](https://cve.now/CVE-2023-41736.md): WordPress Email posts to subscribers Plugin \<= 6.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Gopi Ramasamy Email posts to subscribers)
- [CVE-2023-41734](https://cve.now/CVE-2023-41734.md): WordPress Insert Estimated Reading Time Plugin \<= 1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, nigauri Insert Estimated Reading Time)
- [CVE-2023-41733](https://cve.now/CVE-2023-41733.md): WordPress Back To The Top Button Plugin \<= 2.1.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, YYDevelopment Back To The Top Button)
- [CVE-2023-41731](https://cve.now/CVE-2023-41731.md): WordPress wordpress publish post email notification Plugin \<= 1.0.2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, I Thirteen Web Solution WordPress publish post email notifi…)
- [CVE-2023-41729](https://cve.now/CVE-2023-41729.md): WordPress SendPress Newsletters Plugin \<= 1.22.3.31 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, SendPress Newsletters)
- [CVE-2023-41728](https://cve.now/CVE-2023-41728.md): WordPress Rescue Shortcodes Plugin \<= 2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Rescue Themes Rescue Shortcodes)
- [CVE-2023-41692](https://cve.now/CVE-2023-41692.md): WordPress Attorney Theme \<= 3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Hennessey Digital Attorney)
- [CVE-2023-42132](https://cve.now/CVE-2023-42132.md): FD Application Apr. (no CVSS, Ministry of Health, Labour and Welfare FD Application)
- [CVE-2023-32830](https://cve.now/CVE-2023-32830.md): In TVAPI, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT5527, MT5583, MT5598, MT5599, MT5670, MT5680, MT…)
- [CVE-2023-32829](https://cve.now/CVE-2023-32829.md): In apusys, there is a possible out of bounds write due to an integer overflow. (CVSS 6.7, MediaTek MT6879, MT6886, MT6891, MT6895, MT6896, MT6983, MT…)
- [CVE-2023-32828](https://cve.now/CVE-2023-32828.md): In vpu, there is a possible out of bounds write due to an integer overflow. (CVSS 6.7, MediaTek MT6771, MT6779, MT6785, MT6853, MT6853T, MT6873, M…)
- [CVE-2023-32827](https://cve.now/CVE-2023-32827.md): In camera middleware, there is a possible out of bounds write due to a missing input validation. (CVSS 6.7, MediaTek MT6879, MT6886, MT6895, MT6983, MT6985, MT6989, MT…)
- [CVE-2023-32826](https://cve.now/CVE-2023-32826.md): In camera middleware, there is a possible out of bounds write due to a missing input validation. (CVSS 6.7, MediaTek MT6879, MT6886, MT6895, MT6983, MT6985, MT6989, MT…)
- [CVE-2023-32824](https://cve.now/CVE-2023-32824.md): In rpmb , there is a possible double free due to improper locking. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2023-32823](https://cve.now/CVE-2023-32823.md): In rpmb , there is a possible memory corruption due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2023-32822](https://cve.now/CVE-2023-32822.md): In ftm, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT2713, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2023-32821](https://cve.now/CVE-2023-32821.md): In video, there is a possible out of bounds write due to a permissions bypass. (no CVSS, MediaTek MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2023-32820](https://cve.now/CVE-2023-32820.md): In wlan firmware, there is a possible firmware assertion due to improper input handling. (CVSS 7.5, MediaTek MT5221, MT6781, MT6833, MT6853, MT6853T, MT6855, M…)
- [CVE-2023-32819](https://cve.now/CVE-2023-32819.md): In display, there is a possible information disclosure due to a missing bounds check. (no CVSS, MediaTek MT6765, MT6768, MT6833, MT6879, MT6883, MT6885, MT…)
- [CVE-2023-20819](https://cve.now/CVE-2023-20819.md): In CDMA PPP protocol, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT2731, MT6570, MT6580, MT6595, MT6732, MT6735, MT…)
- [CVE-2023-5329](https://cve.now/CVE-2023-5329.md): Field Logic DataCube4 Web API improper authentication (CVSS 4.3, Field Logic DataCube4)
- [CVE-2023-37605](https://cve.now/CVE-2023-37605.md): Weak Exception Handling vulnerability in baramundi software GmbH EMM Agent 23.1.50 and before allows an attacker to cause a denial of servic (no CVSS)
- [CVE-2023-41580](https://cve.now/CVE-2023-41580.md): Phpipam before v1.5.2 was discovered to contain a LDAP injection vulnerability via the dname parameter at /users/ad-search-result.php. (no CVSS)
- [CVE-2023-43267](https://cve.now/CVE-2023-43267.md): A cross-site scripting (XSS) vulnerability in the publish article function of emlog pro v2.1.14 allows attackers to execute arbitrary web sc (no CVSS)
- [CVE-2023-43268](https://cve.now/CVE-2023-43268.md): Deyue Remote Vehicle Management System v1.1 was discovered to contain a deserialization vulnerability. (no CVSS)
- [CVE-2023-43297](https://cve.now/CVE-2023-43297.md): An issue in animal-art-lab v13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. (no CVSS)
- [CVE-2023-43361](https://cve.now/CVE-2023-43361.md): Buffer Overflow vulnerability in Vorbis-tools v.1.4.2 allows a local attacker to execute arbitrary code and cause a denial of service during (no CVSS)
- [CVE-2023-43835](https://cve.now/CVE-2023-43835.md): Super Store Finder 3.7 and below is vulnerable to authenticated Arbitrary PHP Code Injection that could lead to Remote Code Execution when s (CVSS 8.8)
- [CVE-2023-43836](https://cve.now/CVE-2023-43836.md): There is a SQL injection vulnerability in the Jizhicms 2.4.9 backend, which users can use to obtain database information (no CVSS)
- [CVE-2023-43890](https://cve.now/CVE-2023-43890.md): Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the diagnostic tools page. (no CVSS)
- [CVE-2023-43891](https://cve.now/CVE-2023-43891.md): Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. (no CVSS)
- [CVE-2023-43892](https://cve.now/CVE-2023-43892.md): Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the Hostname parameter within the WAN settings. (CVSS 9.8)
- [CVE-2023-43893](https://cve.now/CVE-2023-43893.md): Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the wakeup\_mac parameter in the Wake-On-LAN (WoL) fun (no CVSS)
- [CVE-2023-43980](https://cve.now/CVE-2023-43980.md): Presto Changeo testsitecreator up to v1.1.1 was discovered to contain a SQL injection vulnerability via the component disable\_json.php. (no CVSS)
- [CVE-2023-44008](https://cve.now/CVE-2023-44008.md): File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the File Manager function. (no CVSS)
- [CVE-2023-44009](https://cve.now/CVE-2023-44009.md): File Upload vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the Skin Management function. (no CVSS)
- [CVE-2023-44011](https://cve.now/CVE-2023-44011.md): An issue in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the layout.master skin file at t (CVSS 9.8)
- [CVE-2023-44012](https://cve.now/CVE-2023-44012.md): Cross Site Scripting vulnerability in mojoPortal v.2.7.0.0 allows a remote attacker to execute arbitrary code via the helpkey parameter in t (CVSS 6.1)
- [CVE-2023-44463](https://cve.now/CVE-2023-44463.md): An issue was discovered in pretix before 2023.7.1. (CVSS 5.3, pretix)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.