CVEs published October 4, 2023
105 CVEs were published on October 4, 2023: 14 critical, 25 high. 2 are now in CISA KEV.
- Published
- 105
- Critical
- 14
- High
- 25
- Medium
- 50
- Low
- 2
- Unrated
- 14
- Now in CISA KEV
- 2
- Fix available
- 25
Most affected products
- Samsung Mobile Devices
- 6
- EFS Software Easy Chat Server
- 4
- EFS Software Easy Address Book Web Server
- 3
- FreeBSD
- 3
- input-output-hk hydra
- 3
- Red Hat Enterprise Linux
- 3
- Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- 2
- Chetan Gole WP-CopyProtect [Protect your blog posts]
- 2
- Facebook WhatsApp Desktop for Mac · Facebook WhatsApp De… +4
- 2
- HelpDezk Community
- 2
Critical 14
- CVE-2023-41094Touchlink authentication bypass due to packets processed after timeout or out of range in Ember ZNetSilicon Labs Ember ZNet
- CVE-2023-42809Redisson unsafe deserialization vulnerabilityredisson · org.redisson:redisson
- CVE-2023-38701Hydra's committed UTxOs at Commit validator and UTxOs at Initial validator can be spent arbitrarily by anyoneinput-output-hk hydra
- CVE-2023-5391 A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker to execute arbitrary code on the targeted Schneider Electric EcoStruxure Power Monitoring Expert ·… +1
- CVE-2023-5399 A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tamperinSchneider Electric C-Bus Toolkit
- CVE-2023-5402 A CWE-269: Improper Privilege Management vulnerability exists that could cause a remote code execution when the transfer command is used Schneider Electric C-Bus Toolkit
- CVE-2023-20101A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root Cisco Emergency Responder
- CVE-2022-36276SQL injection vulnerability in TCMAN GIMTCMAN GIM
- CVE-2023-22515Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknowAtlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2023-4494Easy Chat Server Stack-based buffer overflow vulnerabilityEFS Software Easy Chat Server
- CVE-2023-4491Easy Address Book Web Server Buffer overflow vulnerabilityEFS Software Easy Address Book Web Server
- CVE-2023-3038HelpDezk Community improper authorizationHelpDezk Community
- CVE-2023-4037SQL injection in Setelsa Security ConacWinSetelsa Security ConacWin
- CVE-2023-3701Relative path traversal in Aqua eSolutionsAqua eSolutions Aqua Drive
High 25
- CVE-2023-43809Soft Serve Public Key Authentication Bypass Vulnerability when Keyboard-Interactive SSH Authentication is Enabledcharmbracelet soft-serve · github.com/charmbracelet/soft-se…
- CVE-2023-43805Nexkey allows users to bypass authentication of Bull dashboardnexryai nexkey
- CVE-2023-43793Misskey allows users to bypass authentication of Bull dashboardmisskey-dev misskey
- CVE-2023-44210Sensitive information disclosure and manipulation due to missing authorization.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2023-42449Malicious head initialiser can extract PTs from control of Hydra scripts, leading to locked participant commits or spoofed commitsinput-output-hk hydra
- CVE-2023-42448Hydra's contestation period in head datum can be modified during Close transaction, allowing malicious participant to freely modify the contestation deadlineinput-output-hk hydra
- CVE-2023-39191Kernel: ebpf: insufficient stack type checks in dynptrRed Hat Enterprise Linux
- CVE-2023-42824The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2023-20259A vulnerability in an API endpoint of multiple Cisco Unified Communications Products could allow an unauthenticated, remote attacker to causCisco Emergency Responder · Cisco Unity Connection +2
- CVE-2023-3971Controller: html injection in custom login infoRed Hat Ansible Automation Platform 2.3 for RHEL · Red Hat…
- CVE-2023-4237Platform: ec2_key module prints out the private key directly to the standard outputRed Hat Ansible Automation Platform 2.4 for RHEL · ansible-…
- CVE-2023-5373SourceCodester Online Computer and Laptop Store Master.php register sql injectionSourceCodester Online Computer and Laptop Store
- CVE-2023-44208Sensitive information disclosure and manipulation due to missing authorization.Acronis Cyber Protect Home Office · Acronis True Image OEM
- CVE-2023-3361S3 credentials included when exporting elyra notebookodh-dashboard · Red Hat OpenShift Data Science
- CVE-2023-3037HelpDezk Community improper authorizationHelpDezk Community
- CVE-2023-4997Improper authorisation in Uptime DCProIntegra S.A. UptimeDC
- CVE-2023-3512Relative path traversal in Setelsa Security ConacWin CBSetelsa Security ConacWin CB
- CVE-2023-2809Use of Cleartext credentials in Sage 200 SpainSage 200 Spain
- CVE-2023-1584Quarkus-oidc: id and access tokens leak via the authorization code flowquarkus-oidc · Red Hat build of Quarkus 2.13.8.Final +2
- CVE-2023-4586Hotrod-client: hot rod client does not enable hostname validation when using tls that lead to a mitm attackRed Hat Data Grid
- CVE-2023-30733Stack-based Buffer Overflow in vulnerability HDCP trustlet prior to SMR Oct-2023 Release 1 allows local privileged attackers to perform codeSamsung Mobile Devices
- CVE-2023-30692Improper input validation vulnerability in Evaluator prior to SMR Oct-2023 Release 1 allows local attackers to launch privileged activities.Samsung Mobile Devices
- CVE-2023-30690Improper input validation vulnerability in Duo prior to SMR Oct-2023 Release 1 allows local attackers to launch privileged activities.Samsung Mobile Devices
- CVE-2023-22618If Security Hardening guide rules are not followed, then Nokia WaveLite products allow a local user to create new users with administrative
- CVE-2023-43261An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components
Medium, low and unrated 66
- CVE-2023-43799The Altair Desktop Client Does Not Sanitize External URLs before passing them to the underlying systemaltair-graphql altair
- CVE-2023-44389Zope management interface vulnerable to stored cross site scripting via the title propertyzopefoundation Zope · zope
- CVE-2023-44209Local privilege escalation due to improper soft link handling.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2023-42808Common Voice Cross-site Scripting vulnerabilityMozilla common-voice
- CVE-2023-38538A race condition in an event subsystem led to a heap use-after-free issue in established audio/video calls that could have resulted in app tFacebook WhatsApp Desktop for Mac · Facebook WhatsApp De… +4
- CVE-2023-38537A race condition in a network transport subsystem led to a heap use-after-free issue in established or unsilenced incoming audio/video callsFacebook WhatsApp Desktop for Mac · Facebook WhatsApp De… +4
- CVE-2023-3576Libtiff: memory leak in tiffcrop.cRed Hat Enterprise Linux
- CVE-2023-3428Imagemagick: heap-buffer-overflow in coders/tiff.cRed Hat Enterprise Linux
- CVE-2023-20235A vulnerability in the on-device application development workflow feature for the Cisco IOx application hosting infrastructure in Cisco IOS Cisco IOS XE Software
- CVE-2023-43804`Cookie` HTTP header isn't stripped on cross-origin redirectsurllib3
- CVE-2023-5371Memory Allocation with Excessive Size Value in WiresharkWireshark Foundation Wireshark
- CVE-2022-36277SQL injection vulnerability in TCMAN GIMTCMAN GIM
- CVE-2021-3784Garuda Linux Improper AuthorizationGaruda Linux
- CVE-2023-3665 A code injection vulnerability in Trellix ENS 10.7.0 April 2023 release and earlier, allowed a local user to disable the ENS AMSI componentTrellix Endpoint Security
- CVE-2023-4380Platform: token exposed at importing projectRed Hat Ansible Automation Platform 2.4 for RHEL
- CVE-2023-5113Certain HP Enterprise LaserJet, LaserJet Managed printers - Potential denial of service, potential Cross Site Scripting (XSS)Certain HP Enterprise LaserJet, LaserJet Managed printers
- CVE-2023-40559WordPress WooCommerce Dynamic Pricing and Discount Rules Plugin <= 2.4.0 is vulnerable to Cross Site Request Forgery (CSRF)theDotstore Dynamic Pricing and Discount Rules for WooComme…
- CVE-2023-40561Enhanced Ecommerce Google Analytics for WooCommercetheDotstore Enhanced Ecommerce Google Analytics for WooComm…
- CVE-2023-27433WordPress Make Paths Relative Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)YAS Global Team Make Paths Relative
- CVE-2022-43906IBM Security Guardium information disclosureIBM Security Guardium
- CVE-2023-40376IBM UrbanCode Deploy (UCD) improper authentication controlsIBM UrbanCode Deploy
- CVE-2023-40684IBM Content Navigator cross-site scriptingIBM Content Navigator
- CVE-2023-5374SourceCodester Online Computer and Laptop Store products.php sql injectionSourceCodester Online Computer and Laptop Store
- CVE-2023-25025WordPress WP-CopyProtect [Protect your blog posts] Plugin <= 3.1.0 is vulnerable to Cross Site Request Forgery (CSRF)Chetan Gole WP-CopyProtect [Protect your blog posts]
- CVE-2023-1832Improper authorization check in the server componentcandlepin-4.3.7 · candlepin-4.3.8 +1
- CVE-2023-4497Easy Chat Server XSS vulnerabilityEFS Software Easy Chat Server
- CVE-2023-4496Easy Chat Server XSS vulnerabilityEFS Software Easy Chat Server
- CVE-2023-4495Easy Chat Server XSS vulnerabilityEFS Software Easy Chat Server
- CVE-2023-4493Easy Address Book Web Server Stored XSS vulnerabilityEFS Software Easy Address Book Web Server
- CVE-2023-4492Easy Address Book Web Server XSS vulnerabilityEFS Software Easy Address Book Web Server
- CVE-2022-4132Memory leak on tls connectionsjss · Red Hat Enterprise Linux +3
- CVE-2023-3153Service monitor mac flow is not rate limitedovn · Red Hat Fast Datapath for RHEL +3
- CVE-2023-4090Cross-Site Scripting (XSS) vulnerability on WideStand CMS of AciliaAcilia Widestand CMS
- CVE-2023-2422Keycloak: oauth client impersonationRed Hat Single Sign-On · Red Hat RHEL-8 based Middleware… +1
- CVE-2023-25489WordPress Update Theme and Plugins from Zip File Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)Jeff Sherk Update Theme and Plugins from Zip File
- CVE-2023-25788WordPress Saphali Woocommerce Lite Plugin <= 1.8.13 is vulnerable to Cross Site Request Forgery (CSRF)Saphali Woocommerce Lite
- CVE-2023-25980WordPress Optimize Database after Deleting Revisions Plugin <= 5.1 is vulnerable to Cross Site Request Forgery (CSRF)CAGE Web Design | Rolf van Gelder Optimize Database after D…
- CVE-2023-37995WordPress WP-CopyProtect [Protect your blog posts] Plugin <= 3.1.0 is vulnerable to Cross Site Request Forgery (CSRF)Chetan Gole WP-CopyProtect [Protect your blog posts]
- CVE-2023-5377Out-of-bounds Read in gpac/gpacgpac/gpac
- CVE-2023-5375Open Redirect in mosparo/mosparomosparo/mosparo
- CVE-2023-44272A cross-site scripting vulnerability exists in Citadel versions prior to 994.Citadel
- CVE-2023-5370arm64 boot CPUs may lack speculative execution protectionsFreeBSD
- CVE-2023-5369copy_file_range insufficient capability rights checkFreeBSD
- CVE-2023-5368msdosfs data disclosureFreeBSD
- CVE-2023-30738An improper input validation in UEFI Firmware prior to Firmware update Oct-2023 Release in Galaxy Book, Galaxy Book Pro, Galaxy Book Pro 360Samsung Mobile Galaxy Book, Galaxy Book Pro, Galaxy Book Pr…
- CVE-2023-30737Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive information via impSamsung Mobile Samsung Health
- CVE-2023-30736Improper authorization in PushMsgReceiver of Samsung Assistant prior to version 8.7.00.1 allows attacker to execute javascript interface.Samsung Mobile Samsung Assistant
- CVE-2023-30735Improper Preservation of Permissions vulnerability in SAssistant prior to version 8.7 allows local attackers to access backup data in SAssisSamsung Mobile SAssistant
- CVE-2023-30734Improper access control vulnerability in Samsung Health prior to version 6.24.3.007 allows attackers to access sensitive information via impSamsung Mobile Samsung Health
- CVE-2023-30732Improper access control in system property prior to SMR Oct-2023 Release 1 allows local attacker to get CPU serial number.Samsung Mobile Devices
- CVE-2023-30731Logic error in package installation via debugger command prior to SMR Oct-2023 Release 1 allows physical attacker to install an application Samsung Mobile Devices
- CVE-2023-30727Improper access control vulnerability in SecSettings prior to SMR Oct-2023 Release 1 allows attackers to enable Wi-Fi and connect arbitrary Samsung Mobile Devices
- CVE-2023-5291Blog Filter <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeawordpresslife Blog Filter Post Filtering
- CVE-2023-3213WP Mail SMTP Pro <= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_pageWPForms (Awesome Motive) WP Mail SMTP Pro
- CVE-2023-5357Instagram for WordPress <= 2.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeesemono Instagram for WordPress
- CVE-2023-37404IBM Observability with Instana code executionIBM Observability with Instana
- CVE-2023-35905IBM FileNet Content Manager cross-site scriptingIBM FileNet Content Manager
- CVE-2023-27121A cross-site scripting (XSS) vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v
- CVE-2023-35803IQ Engine before 10.6r2 on Extreme Network AP devices has a Buffer Overflow.
- CVE-2023-36618Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of OS commands as root user by low-privileged authentic
- CVE-2023-36619Atos Unify OpenScape Session Border Controller through V10 R3.01.03 allows execution of administrative scripts by unauthenticated users.
- CVE-2023-40299Kong Insomnia 2023.4.0 on macOS allows attackers to execute code and access restricted files, or make requests for TCC permissions, by using
- CVE-2023-43321File Upload vulnerability in Digital China Networks DCFW-1800-SDC v.3.0 allows an authenticated attacker to execute arbitrary code via the w
- CVE-2023-43838An arbitrary file upload vulnerability in Personal Management System v1.4.64 allows attackers to execute arbitrary code via uploading a craf
- CVE-2023-43877Rite CMS 3.0 has Multiple Cross-Site scripting (XSS) vulnerabilities that allow attackers to execute arbitrary code via a payload crafted in
- CVE-2023-44075Cross Site Scripting vulnerability in Small CRM in PHP v.3.0 allows a remote attacker to execute arbitrary code via a crafted payload to the