CVEs published October 3, 2023
136 CVEs were published on October 3, 2023: 8 critical, 40 high. 1 is now in CISA KEV.
- Published
- 136
- Critical
- 8
- High
- 40
- Medium
- 64
- Low
- 0
- Unrated
- 24
- Now in CISA KEV
- 1
- Fix available
- 14
Most affected products
- Qualcomm Snapdragon
- 22
- FURUNO SYSTEMS Co. ACERA
- 5
- IDM Sistemas QSige QSige
- 5
- Open5GS
- 4
- BuddyBoss
- 3
- NXLog Manager
- 3
- PoS/ Dienstleistung, Entwicklung & Vertrieb cashIT! - servi…
- 3
- Riello UPS Netman-204
- 3
- salesagility/suitecrm
- 3
- Artica PFMS Pandora FMS
- 2
Critical 8
- CVE-2023-32670BuddyBoss XSS vulnerabilityBuddyBoss
- CVE-2022-47893NetMan 204 Remote Code ExecutionRiello UPS Netman-204
- CVE-2023-3654Origin Check BypassPoS/ Dienstleistung, Entwicklung & Vertrieb cashIT! - servi…
- CVE-2023-3656Unauthenticated Remote Code ExecutionPoS/ Dienstleistung, Entwicklung & Vertrieb cashIT! - servi…
- CVE-2023-33028Buffer Copy without Checking Size of Input in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-28540Improper Authentication in Data ModemQualcomm Snapdragon
- CVE-2023-24855Use of Out-of-range Pointer Offset in ModemQualcomm Snapdragon
- CVE-2023-40830Tenda AC6 v15.03.05.19 is vulnerable to Buffer Overflow as the Index parameter does not verify the length.
High 40
- CVE-2023-4911Glibc: buffer overflow in ld.so leading to privilege escalationglibc · Red Hat Enterprise Linux +1
- CVE-2023-4817Unrestricted file upload vulnerability in ICP DAS ET-7060ICP DAS ET-7060
- CVE-2023-4883Multiple vulnerabilities in Open5GSOpen5GS
- CVE-2023-4882Multiple vulnerabilities in Open5GSOpen5GS
- CVE-2023-3350Cryptographic Issues on IBERMATICA RPSIBERMATICA RPS
- CVE-2023-3349Information exposure on IBERMATICA RPSIBERMATICA RPS
- CVE-2023-0506ByDemes Group Airspace CCTV Web Service Improper Access ControlByDemes Group Airspace CCTV Web Service
- CVE-2023-2681SQL Injection on JoraniJorani
- CVE-2023-5353Improper Access Control in salesagility/suitecrmsalesagility/suitecrm
- CVE-2023-5351Cross-site Scripting (XSS) - Stored in salesagility/suitecrmsalesagility/suitecrm
- CVE-2023-4103Multiple vulnerabilities in IDM Sistemas QSigeIDM Sistemas QSige QSige
- CVE-2023-4102Multiple vulnerabilities in IDM Sistemas QSigeIDM Sistemas QSige QSige
- CVE-2023-4101Multiple vulnerabilities in IDM Sistemas QSigeIDM Sistemas QSige QSige
- CVE-2022-47891Admin password reset in NetMan 204Riello UPS Netman-204
- CVE-2023-4099Multiple vulnerabilities in IDM Sistemas QSigeQSige de IDM Sistemas QSige
- CVE-2023-4098Multiple vulnerabilities in IDM Sistemas QSigeQSige de IDM Sistemas QSige
- CVE-2023-4097Multiple vulnerabilities in IDM Sistemas QSigeIDM Sistemas QSige QSige
- CVE-2023-44218 A flaw within the SonicWall NetExtender Pre-Logon feature enables an unauthorized user to gain access to the host Windows operating system SonicWall NetExtender
- CVE-2023-44217 A local privilege escalation vulnerability in SonicWall Net Extender MSI client for Windows 10.2.336 and earlier versions allows a local loSonicWall NetExtender
- CVE-2023-3655Unauthenticated Remote Database ExfiltrationPoS/ Dienstleistung, Entwicklung & Vertrieb cashIT! - servi…
- CVE-2023-33039Use After Free in Automotive DisplayQualcomm Snapdragon
- CVE-2023-33035Buffer Copy Without Checking Size of Input in AudioQualcomm Snapdragon
- CVE-2023-33034Signed-to-unsigned conversion error in AudioQualcomm Snapdragon
- CVE-2023-33029Use After Free in DSP ServiceQualcomm Snapdragon
- CVE-2023-33027Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33026Buffer over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-24853Improper Input Validation in HLOSQualcomm Snapdragon
- CVE-2023-24850Improper Validation of Array Index in HLOSQualcomm Snapdragon
- CVE-2023-24849Buffer Over-read in Data ModemQualcomm Snapdragon
- CVE-2023-24848Buffer Over-read in Data ModemQualcomm Snapdragon
- CVE-2023-24847NULL pointer Dereference in ModemQualcomm Snapdragon
- CVE-2023-24844Improper Access Control in CoreQualcomm Snapdragon
- CVE-2023-24843Reachable Assertion in ModemQualcomm Snapdragon
- CVE-2023-22385Buffer Over-read in Data ModemQualcomm Snapdragon
- CVE-2023-22382Improper Input Validation in AutomotiveQualcomm Snapdragon
- CVE-2023-21673Improper Access Control in KernelQualcomm Snapdragon
- CVE-2023-26152All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath static-server
- CVE-2023-5345Use-after-free in Linux kernel's fs/smb/client componentLinux Kernel
- CVE-2023-3440File and Directory Permission Vulnerability in JP1/Performance ManagementHitachi JP1/Performance Management - Manager · Hitachi… +22
- CVE-2023-42771Authentication bypass vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a netFURUNO SYSTEMS Co. ACERA
Medium, low and unrated 88
- CVE-2022-22447IBM Disconnected Log Collector information disclosureIBM Disconnected Log Collector
- CVE-2023-5255Denial of Service for Revocation of Auto Renewed CertificatesPuppet Enterprise
- CVE-2023-4732Kernel: race between task migrating pages and another task calling exit_mmap to release those same pages getting invalid opcode bug in include/linux/swapops.hRed Hat Enterprise Linux · Red Hat Virtualization 4 for Red…
- CVE-2023-34970Mali GPU Kernel Driver Allows Improper GPU Memory Processing OperationsArm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…
- CVE-2023-33200Mali GPU Kernel Driver Allows Improper GPU Memory Processing OperationsArm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- CVE-2023-4564Multiple vulnerabilities in Canopsis of CapensisCapensis Canopsis
- CVE-2023-3196Multiple vulnerabilities in Canopsis of CapensisCapensis Canopsis
- CVE-2023-4885Multiple vulnerabilities in Open5GSOpen5GS
- CVE-2023-4884Multiple vulnerabilities in Open5GSOpen5GS
- CVE-2023-4886Foreman: world readable file containing secretsRed Hat Satellite 6.13 for RHEL · Red Hat Satellite 6.14 fo…
- CVE-2023-4929NPort 5000 Series Firmware Improper Validation of Integrity Check VulnerabilityMoxa NPort 5000AI-M12 Series · Moxa NPort 5100 Series +11
- CVE-2023-40558WordPress Video Gallery & Management Plugin <= 3.3.5 is vulnerable to Cross Site Request Forgery (CSRF)eMarket Design YouTube Video Gallery by YouTube Showcase
- CVE-2023-39158WordPress Woocommerce Category Banner Management Plugin <= 2.4.2 is vulnerable to Cross Site Request Forgery (CSRF)theDotstore Banner Management For WooCommerce
- CVE-2023-41244WordPress Localize Remote Images Plugin <= 1.0.9 is vulnerable to Cross Site Request Forgery (CSRF)Buildfail Localize Remote Images
- CVE-2023-41693WordPress MyCryptoCheckout Plugin <= 2.125 is vulnerable to Cross Site Request Forgery (CSRF)edward_plainview MyCryptoCheckout
- CVE-2023-27435WordPress HTTP Auth Plugin <= 0.3.2 is vulnerable to Cross Site Request Forgery (CSRF)Sami Ahmed Siddiqui HTTP Auth
- CVE-2023-32091WordPress POEditor Plugin <= 0.9.4 is vulnerable to Cross Site Request Forgery (CSRF)POEditor
- CVE-2023-2544Authorization Bypass on UPV PEIXUniversitat Politècnica de València (UPV) UPV PEIX
- CVE-2023-32792Cross-Site Request Forgery on NXLog ManagerNXLog Manager
- CVE-2023-40009WordPress WP Pipes Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)ThimPress WP Pipes
- CVE-2023-32791Cross-Site Request Forgery on NXLog ManagerNXLog Manager
- CVE-2023-32790XSS on NXLog Manager NXLog Manager
- CVE-2023-39159WordPress Fraud Prevention For Woocommerce Plugin <= 2.1.5 is vulnerable to Cross Site Request Forgery (CSRF)theDotstore Fraud Prevention For Woocommerce
- CVE-2023-40212WordPress WooCommerce Product Attachment Plugin <= 2.1.8 is vulnerable to Cross Site Request Forgery (CSRF)theDotstore Product Attachment for WooCommerce
- CVE-2023-40199WordPress WP Like Button Plugin <= 1.7.0 is vulnerable to Cross Site Request Forgery (CSRF)CRUDLab WP Like Button
- CVE-2023-40198WordPress Easy Cookie Law Plugin <= 3.1 is vulnerable to Cross Site Request Forgery (CSRF)Antsanchez Easy Cookie Law
- CVE-2023-42508JFrog Artifactory Improper header input validation leads to email manipulation sent from the platformJFrog Artifactory
- CVE-2023-32671BuddyBoss XSS vulnerabilityBuddyBoss
- CVE-2023-32669Authorization Bypass on BuddyBossBuddyBoss
- CVE-2023-40201WordPress Futurio Extra Plugin <= 1.8.4 is vulnerable to Cross Site Request Forgery (CSRF)FuturioWP Futurio Extra
- CVE-2023-40202WordPress WP HTML Mail Plugin <= 3.4.1 is vulnerable to Cross Site Request Forgery (CSRF)Hannes Etzelstorfer // codemiq WP HTML Mail
- CVE-2023-5350SQL Injection in salesagility/suitecrmsalesagility/suitecrm
- CVE-2023-40210WordPress SB Child List Plugin <= 4.5 is vulnerable to Cross Site Request Forgery (CSRF)Sean Barton (Tortoise IT) SB Child List
- CVE-2022-47892Information disclosure in NetMan 204Riello UPS Netman-204
- CVE-2023-2830WordPress WP Testimonials Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)Trustindex.io WP Testimonials
- CVE-2023-4100Multiple vulnerabilities in IDM Sistemas QSigeIDM Sistemas QSige QSige
- CVE-2023-39989WordPress Header Footer Code Manager Plugin <= 1.1.34 is vulnerable to Cross Site Request Forgery (CSRF)99robots Header Footer Code Manager
- CVE-2023-39917WordPress Photo Gallery by Ays Plugin <= 5.2.6 is vulnerable to Cross Site Request Forgery (CSRF)Photo Gallery Team Photo Gallery by Ays – Responsive Image…
- CVE-2023-39165WordPress Sign-up Sheets Plugin <= 2.2.8 is vulnerable to Cross Site Request Forgery (CSRF)Fetch Designs Sign-up Sheets
- CVE-2023-39923WordPress The Post Grid Plugin <= 7.2.7 is vulnerable to Cross Site Request Forgery (CSRF)RadiusTheme The Post Grid
- CVE-2023-25989Cross-Site Request Forgery (CSRF) vulnerability in multiple WordPress plugins by MeksMeks Video Importer · Meks Time Ago +8
- CVE-2023-0828Stored Cross Site Scripting in syslog sectionArtica PFMS Pandora FMS
- CVE-2023-24518Disabling the administrator's account through cross-site request forgeryArtica PFMS Pandora FMS
- CVE-2023-25463WordPress wp tell a friend popup form Plugin <= 7.1 is vulnerable to Cross Site Request Forgery (CSRF)Gopi Ramasamy WP tell a friend popup form
- CVE-2023-38390WordPress Mobile Address Bar Changer Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)Anshul Labs Mobile Address Bar Changer
- CVE-2023-38396WordPress Google Map Shortcode Plugin <= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF)Alain Gonzalez google-map-shortcode
- CVE-2023-37990WordPress Perelink Pro Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)Mike Perelink Pro
- CVE-2023-38398WordPress Taboola Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF)Taboola
- CVE-2022-46841WordPress Oxygen Builder Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)Soflyy Oxygen Builder
- CVE-2023-38381WordPress WP-FlyBox Plugin <= 6.46 is vulnerable to Cross Site Request Forgery (CSRF)Cyle Conoly WP-FlyBox
- CVE-2023-37998WordPress Disabler Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)Saas Disabler
- CVE-2023-37996WordPress GTmetrix for WordPress Plugin <= 0.4.7 is vulnerable to Cross Site Request Forgery (CSRF)GTmetrix for WordPress
- CVE-2023-37992WordPress Smarty for WordPress Plugin <= 3.1.35 is vulnerable to Cross Site Request Forgery (CSRF)PressPage Entertainment Smarty for WordPress
- CVE-2023-37991WordPress WP Emoji One Plugin <= 0.6.0 is vulnerable to Cross Site Request Forgery (CSRF)Monchito.net WP Emoji One
- CVE-2023-37891WordPress Exit Popups & Onsite Retargeting by OptiMonk Plugin <= 2.0.4 is vulnerable to Cross Site Request Forgery (CSRF)OptiMonk: Popups, Personalization & A/B Testing
- CVE-2023-28571Buffer Over-read in WLAN HOSTQualcomm Snapdragon
- CVE-2023-28539Buffer Copy Without Checking Size of Input in WLAN HostQualcomm Snapdragon
- CVE-2023-22384Buffer Copy Without Checking Size of Input in VR ServiceQualcomm Snapdragon
- CVE-2023-26150Versions of the package asyncua before 0.9.96 are vulnerable to Improper Authentication such that it is possible to access Address Space witasyncua
- CVE-2023-26151Versions of the package asyncua before 0.9.96 are vulnerable to Denial of Service (DoS) such that an attacker can send a malformed packet anasyncua
- CVE-2023-5334WP Responsive header image slider <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewponlinesupport WP Responsive header image slider
- CVE-2023-3967DoS Vulnerability in Hitachi Ops Center Common ServicesHitachi Ops Center Common Services
- CVE-2023-3335Information Exposure Vulnerability in Hitachi Ops Center AdministratorHitachi Ops Center Administrator
- CVE-2023-43627Path traversal vulnerability in ACERA 1320 firmware ver.01.26 and earlier, and ACERA 1310 firmware ver.01.26 and earlier allows a network-adFURUNO SYSTEMS Co. ACERA
- CVE-2023-41086Cross-site request forgery (CSRF) vulnerability exists in FURUNO SYSTEMS wireless LAN access point devices.FURUNO SYSTEMS Co. ACERA
- CVE-2023-39429Cross-site scripting vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to inject an arbitrary sFURUNO SYSTEMS Co. ACERA
- CVE-2023-39222OS command injection vulnerability in FURUNO SYSTEMS wireless LAN access point devices allows an authenticated user to execute an arbitrary FURUNO SYSTEMS Co. ACERA
- CVE-2023-33268An issue was discovered in DTS Monitoring 3.57.0.
- CVE-2023-33269An issue was discovered in DTS Monitoring 3.57.0.
- CVE-2023-33270An issue was discovered in DTS Monitoring 3.57.0.
- CVE-2023-33271An issue was discovered in DTS Monitoring 3.57.0.
- CVE-2023-33272An issue was discovered in DTS Monitoring 3.57.0.
- CVE-2023-33273An issue was discovered in DTS Monitoring 3.57.0.
- CVE-2023-39645Improper neutralization of SQL parameter in Theme Volty CMS Payment Icon module for PrestaShop.
- CVE-2023-39646Improper neutralization of SQL parameter in Theme Volty CMS Category Chain Slider module for PrestaShop.
- CVE-2023-39647Improper neutralization of SQL parameter in Theme Volty CMS Category Product module for PrestaShop.
- CVE-2023-39648Improper neutralization of SQL parameter in Theme Volty CMS Testimonial module for PrestaShop.
- CVE-2023-39649Improper neutralization of SQL parameter in Theme Volty CMS Category Slider module for PrestaShop.
- CVE-2023-39651Improper neutralization of SQL parameter in Theme Volty CMS BrandList module for PrestaShop In the module “Theme Volty CMS BrandList” (tvcms
- CVE-2023-40519A cross-site scripting (XSS) vulnerability in the bpk-common/auth/login/index.html login portal in Broadpeak Centralized Accounts Management
- CVE-2023-43176A deserialization vulnerability in Afterlogic Aurora Files v9.7.3 allows attackers to execute arbitrary code via supplying a crafted .sabred
- CVE-2023-43898Nothings stb 2.28 was discovered to contain a Null Pointer Dereference via the function stbi__convert_format.
- CVE-2023-43951SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Column Management component.
- CVE-2023-43952SSCMS 7.2.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Material Management component.
- CVE-2023-43953SSCMS 7.2.2 was discovered to contain a cross-site scripting (XSS) vulnerability via the Content Management component.
- CVE-2023-43976An issue in CatoNetworks CatoClient before v.5.4.0 allows attackers to escalate privileges and winning the race condition (TOCTOU) via the P
- CVE-2023-44973An arbitrary file upload vulnerability in the component /content/templates/ of Emlog Pro v2.2.0 allows attackers to execute arbitrary code v
- CVE-2023-44974An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via