# CVEs published 2023-10-05

59 CVEs were published on October 5, 2023: 6 critical, 21 high. Days are UTC.

- [CVE-2015-10125](https://cve.now/CVE-2015-10125.md): WP Ultimate CSV Importer Plugin cross-site request forgery (CVSS 4.3, WP Ultimate CSV Importer Plugin)
- [CVE-2023-45243](https://cve.now/CVE-2023-45243.md): Sensitive information disclosure due to missing authorization. (CVSS 5.5, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2023-45242](https://cve.now/CVE-2023-45242.md): Sensitive information disclosure due to missing authorization. (CVSS 5.5, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2023-45241](https://cve.now/CVE-2023-45241.md): Sensitive information leak through log files. (CVSS 4.4, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2023-45240](https://cve.now/CVE-2023-45240.md): Sensitive information disclosure due to missing authorization. (CVSS 5.5, Acronis Agent)
- [CVE-2023-44214](https://cve.now/CVE-2023-44214.md): Sensitive information disclosure due to missing authorization. (CVSS 5.5, Acronis Agent)
- [CVE-2023-44213](https://cve.now/CVE-2023-44213.md): Sensitive information disclosure due to excessive collection of system information. (CVSS 3.3, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2023-44211](https://cve.now/CVE-2023-44211.md): Sensitive information disclosure and manipulation due to missing authorization. (CVSS 7.1, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2023-44212](https://cve.now/CVE-2023-44212.md): Sensitive information disclosure and manipulation due to missing authorization. (CVSS 7.3, Acronis Agent)
- [CVE-2023-39323](https://cve.now/CVE-2023-39323.md): Arbitrary code execution during build via line directives in cmd/go (CVSS 8.1, Go toolchain cmd/go · toolchain)
- [CVE-2023-5441](https://cve.now/CVE-2023-5441.md): NULL Pointer Dereference in vim/vim (CVSS 6.2, vim/vim)
- [CVE-2023-41175](https://cve.now/CVE-2023-41175.md): Libtiff: potential integer overflow in raw2tiff.c (CVSS 6.5, libtiff · Red Hat Enterprise Linux)
- [CVE-2023-40745](https://cve.now/CVE-2023-40745.md): Libtiff: integer overflow in tiffcp.c (CVSS 6.5, libtiff · Red Hat Enterprise Linux)
- [CVE-2023-42755](https://cve.now/CVE-2023-42755.md): Kernel: rsvp: out-of-bounds read in rsvp\_classify() (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2023-42754](https://cve.now/CVE-2023-42754.md): Kernel: ipv4: null pointer dereference in ipv4\_send\_dest\_unreach() (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2023-32485](https://cve.now/CVE-2023-32485.md): Dell SmartFabric Storage Software version 1.3 and lower contain an improper input validation vulnerability. (CVSS 9.8, Dell SmartFabric Storage Software)
- [CVE-2023-43073](https://cve.now/CVE-2023-43073.md): Dell SmartFabric Storage Software v1.4 (and earlier) contains an Improper Input Validation vulnerability in RADIUS configuration. (CVSS 4.3, Dell SmartFabric Storage Software)
- [CVE-2023-44387](https://cve.now/CVE-2023-44387.md): Gradle has incorrect permission assignment for symlinked files used in copy or archiving operations (CVSS 3.2, gradle)
- [CVE-2023-43072](https://cve.now/CVE-2023-43072.md): Dell SmartFabric Storage Software v1.4 (and earlier) contains an improper access control vulnerability in the CLI. (CVSS 4.4, Dell SmartFabric Storage Software)
- [CVE-2023-43071](https://cve.now/CVE-2023-43071.md): Dell SmartFabric Storage Software v1.4 (and earlier) contains possible vulnerabilities for HTML injection or CVS formula injection which mi (CVSS 4.4, Dell SmartFabric Storage Software)
- [CVE-2023-44386](https://cve.now/CVE-2023-44386.md): Incorrect request error handling triggers server crash in Vapor (CVSS 5.3, vapor)
- [CVE-2023-43070](https://cve.now/CVE-2023-43070.md): Dell SmartFabric Storage Software v1.4 (and earlier) contains a Path Traversal Vulnerability in the HTTP interface. (CVSS 6.3, Dell SmartFabric Storage Software)
- [CVE-2023-43069](https://cve.now/CVE-2023-43069.md): Dell SmartFabric Storage Software v1.4 (and earlier) contain(s) an OS Command Injection Vulnerability in the CLI. (CVSS 7.8, Dell SmartFabric Storage Software)
- [CVE-2023-43068](https://cve.now/CVE-2023-43068.md): Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the restricted shell in SSH. (CVSS 7.8, Dell SmartFabric Storage Software)
- [CVE-2023-5346](https://cve.now/CVE-2023-5346.md): Type confusion in V8 in Google Chrome prior to 117.0.5938.149 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-4401](https://cve.now/CVE-2023-4401.md): Dell SmartFabric Storage Software v1.4 (and earlier) contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. (CVSS 7.8, Dell SmartFabric Storage Software)
- [CVE-2023-5423](https://cve.now/CVE-2023-5423.md): SourceCodester Online Pizza Ordering System sql injection (CVSS 4.7, SourceCodester Online Pizza Ordering System)
- [CVE-2023-2306](https://cve.now/CVE-2023-2306.md): Qognify NiceVision Use of Hard-coded Credentials (CVSS 10.0, Qognify NiceVision)
- [CVE-2023-4570](https://cve.now/CVE-2023-4570.md): Improper Restriction in NI MeasurementLink Python Services (CVSS 8.8, NI MeasurementLink · ni-measurementlink-service)
- [CVE-2023-45160](https://cve.now/CVE-2023-45160.md): Elevated Temp Directory Execution in 1E Client (CVSS 8.8, 1E Client)
- [CVE-2023-44390](https://cve.now/CVE-2023-44390.md): HtmlSanitizer vulnerable to Cross-site Scripting in Foreign Content (CVSS 6.1, mganss HtmlSanitizer · HtmlSanitizer)
- [CVE-2022-3248](https://cve.now/CVE-2022-3248.md): Openshift api admission checks does not enforce "custom-host" permissions (CVSS 4.4, kubernetes · Red Hat Advanced Cluster Management for Kub… +3)
- [CVE-2022-4145](https://cve.now/CVE-2022-4145.md): Content spoofing (CVSS 4.3, openshift · Red Hat OpenShift Container Platform)
- [CVE-2023-45159](https://cve.now/CVE-2023-45159.md): 1E Client installer can perform arbitrary file deletion on protected files (CVSS 8.4, 1E Client)
- [CVE-2023-26236](https://cve.now/CVE-2023-26236.md): An issue was discovered in WatchGuard EPDR 8.0.21.0002. (no CVSS)
- [CVE-2023-26237](https://cve.now/CVE-2023-26237.md): An issue was discovered in WatchGuard EPDR 8.0.21.0002. (CVSS 6.7)
- [CVE-2023-26238](https://cve.now/CVE-2023-26238.md): An issue was discovered in WatchGuard EPDR 8.0.21.0002. (no CVSS)
- [CVE-2023-26239](https://cve.now/CVE-2023-26239.md): An issue was discovered in WatchGuard EPDR 8.0.21.0002. (no CVSS)
- [CVE-2023-40920](https://cve.now/CVE-2023-40920.md): Prixan prixanconnect up to v1.62 was discovered to contain a SQL injection vulnerability via the component CartsGuruCatalogModuleFrontContro (CVSS 9.8)
- [CVE-2023-43260](https://cve.now/CVE-2023-43260.md): Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 was discovered to contain a cross-site scripting (XSS) vulnerability via the admin (no CVSS)
- [CVE-2023-43269](https://cve.now/CVE-2023-43269.md): pigcms up to 7.0 was discovered to contain an arbitrary file upload vulnerability. (CVSS 9.8)
- [CVE-2023-43284](https://cve.now/CVE-2023-43284.md): D-Link Wireless MU-MIMO Gigabit AC1200 Router DIR-846 100A53DBR-Retail devices allow an authenticated remote attacker to execute arbitrary c (CVSS 8.8)
- [CVE-2023-43343](https://cve.now/CVE-2023-43343.md): Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted scr (CVSS 5.4)
- [CVE-2023-43981](https://cve.now/CVE-2023-43981.md): Presto Changeo testsitecreator up to 1.1.1 was discovered to contain a deserialization vulnerability via the component delete\_excluded\_folde (CVSS 9.8)
- [CVE-2023-43983](https://cve.now/CVE-2023-43983.md): Presto Changeo attributegrid up to 2.0.3 was discovered to contain a SQL injection vulnerability via the component disable\_json.php. (CVSS 9.8)
- [CVE-2023-44024](https://cve.now/CVE-2023-44024.md): SQL injection vulnerability in KnowBand Module One Page Checkout, Social Login & Mailchimp (supercheckout) v.8.0.3 and before allows a remot (no CVSS)
- [CVE-2023-44828](https://cve.now/CVE-2023-44828.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the CurrentPassword parameter in the CheckPasswdSettings functio (CVSS 7.5)
- [CVE-2023-44829](https://cve.now/CVE-2023-44829.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the AdminPassword parameter in the SetDeviceSettings function. (CVSS 7.5)
- [CVE-2023-44830](https://cve.now/CVE-2023-44830.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the EndTime parameter in the SetParentsControlInfo function. (CVSS 7.5)
- [CVE-2023-44831](https://cve.now/CVE-2023-44831.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Type parameter in the SetWLanRadioSettings function. (CVSS 7.5)
- [CVE-2023-44832](https://cve.now/CVE-2023-44832.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the MacAddress parameter in the SetWanSettings function. (CVSS 7.5)
- [CVE-2023-44833](https://cve.now/CVE-2023-44833.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the GuardInt parameter in the SetWLanRadioSettings function. (CVSS 7.5)
- [CVE-2023-44834](https://cve.now/CVE-2023-44834.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the StartTime parameter in the SetParentsControlInfo function. (CVSS 7.5)
- [CVE-2023-44835](https://cve.now/CVE-2023-44835.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Mac parameter in the SetParentsControlInfo function. (CVSS 7.5)
- [CVE-2023-44836](https://cve.now/CVE-2023-44836.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the SSID parameter in the SetWLanRadioSettings function. (CVSS 7.5)
- [CVE-2023-44837](https://cve.now/CVE-2023-44837.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Password parameter in the SetWanSettings function. (CVSS 7.5)
- [CVE-2023-44838](https://cve.now/CVE-2023-44838.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the TXPower parameter in the SetWLanRadioSettings function. (no CVSS)
- [CVE-2023-44839](https://cve.now/CVE-2023-44839.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Encryption parameter in the SetWLanRadioSecurity function. (no CVSS)
- [CVE-2023-45198](https://cve.now/CVE-2023-45198.md): ftpd before "NetBSD-ftpd 20230930" can leak information about the host filesystem before authentication via an MLSD or MLST command. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.