CVEs published October 6, 2023
70 CVEs were published on October 6, 2023: 3 critical, 13 high.
- Published
- 70
- Critical
- 3
- High
- 13
- Medium
- 32
- Low
- 4
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- concrete5/concrete5
- 5
- Google Android
- 5
- Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- 2
- Gangesh Matta Simple Org Chart
- 2
- QNAP Systems Music Station
- 2
- QNAP Systems QTS · QNAP Systems QuTS hero +1
- 2
- QNAP Systems QVPN Windows
- 2
- tribalsystems/zenario
- 2
- Acronis Agent
- 1
- Andreas Heigl authLdap
- 1
Critical 3
High 13
- CVE-2023-3725Potential buffer overflow vulnerability in the Zephyr CANbus subsystemzephyrproject-rtos Zephyr
- CVE-2023-21266In multiple functions of ActivityManagerService.java, there is a possible way to escape Google Play protection due to a permissions bypass.Google Android
- CVE-2023-5366Openvswitch don't match packets on nd_target fieldopenvswitch · Red Hat Fast Datapath for RHEL +5
- CVE-2023-23366Music StationQNAP Systems Music Station
- CVE-2023-23365Music StationQNAP Systems Music Station
- CVE-2023-39928A use-after-free vulnerability exists in the MediaRecorder API of Webkit WebKitGTK 2.40.5.Webkit
- CVE-2023-43810opentelemetry-instrumentation Denial of Service vulnerability due to unbound cardinality metricsopen-telemetry opentelemetry-python-contrib · opentelemetry…
- CVE-2023-35897IBM Spectrum Protect code executionIBM Storage Protect Client · IBM Storage Protect for Virtua…
- CVE-2023-45246Sensitive information disclosure and manipulation due to missing authorization.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2023-45244Sensitive information disclosure and manipulation due to missing authorization.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2023-26153Versions of the package geokit-rails before 2.5.0 are vulnerable to Command Injection due to unsafe deserialisation of YAML within the 'geo_geokit-rails
- CVE-2023-45282In NASA Open MCT (aka openmct) before 3.1.0, prototype pollution can occur via an import action.openmct
- CVE-2023-45303ThingsBoard before 3.5 allows Server-Side Template Injection if users are allowed to modify an email template, because Apache FreeMarker suporg.thingsboard:thingsboard
Medium, low and unrated 54
- CVE-2023-5182Sensitive data could be exposed in logs of subiquity version 23.09.1 and earlier.Canonical subiquity
- CVE-2022-33160IBM Security Directory Suite information disclosureIBM Security Directory Suite
- CVE-2022-34355IBM Jazz Foundation information disclosureIBM Engineering Lifecycle Management
- CVE-2023-5452Cross-site Scripting (XSS) - Stored in snipe/snipe-itsnipe/snipe-it
- CVE-2023-21291In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing permission check.Google Android
- CVE-2023-21253In multiple locations, there is a possible way to crash multiple system services due to resource exhaustion.Google Android
- CVE-2023-21252In validatePassword of WifiConfigurationUtil.java, there is a possible way to get the device into a boot loop due to improper input validatiGoogle Android
- CVE-2023-21244In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check.Google Android
- CVE-2023-5214CVE-2023-5214 - Privilege Escalation in Puppet Bolt Puppet Bolt · bolt
- CVE-2023-45239A lack of input validation exists in tac_plus prior to commit 4fdf178 which, when pre or post auth commands are enabled, allows an attacker Meta tac_plus
- CVE-2023-44384Discourse-Jira could make SSRF attack by setting Jira URL to an arbitrary locationdiscourse-jira
- CVE-2023-32972QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-32971QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-23371QVPN Device ClientQNAP Systems QVPN Windows
- CVE-2023-23370QVPN Device ClientQNAP Systems QVPN Windows
- CVE-2023-44233WordPress FooGallery Plugin <= 2.2.44 is vulnerable to Cross Site Request Forgery (CSRF)FooPlugins Best WordPress Gallery Plugin – FooGallery
- CVE-2023-44243WordPress Instant CSS Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)Dylan Blokhuis Instant CSS
- CVE-2023-44146WordPress Checkfront Online Booking System Plugin <= 3.6 is vulnerable to Cross Site Request Forgery (CSRF)Checkfront Online Booking System
- CVE-2023-41950WordPress Laposta Signup Basic Plugin <= 1.4.1 is vulnerable to Cross Site Request Forgery (CSRF)Laposta - Roel Bousardt Laposta Signup Basic
- CVE-2023-40607WordPress CLUEVO LMS, E-Learning Platform Plugin <= 1.10.0 is vulnerable to Cross Site Request Forgery (CSRF)CLUEVO LMS, E-Learning Platform
- CVE-2023-41801WordPress AWP Classifieds Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)AWP Classifieds Team Ad Directory & Listings by AWP Classif…
- CVE-2023-41732WordPress CP Blocks Plugin <= 1.0.20 is vulnerable to Cross Site Request Forgery (CSRF)CodePeople CP Blocks
- CVE-2023-41659WordPress Responsive Gallery Grid Plugin <= 2.3.10 is vulnerable to Cross Site Request Forgery (CSRF)Jules Colle, BDWM Responsive Gallery Grid
- CVE-2023-41654WordPress authLdap Plugin <= 2.5.8 is vulnerable to Cross Site Request Forgery (CSRF)Andreas Heigl authLdap
- CVE-2023-41650WordPress Remove/hide Author, Date, Category Like Entry-Meta Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)Venugopal Remove/hide Author, Date, Category Like Entry-Meta
- CVE-2023-42445Possible local file exfiltration by XML External entity injectiongradle
- CVE-2023-43058IBM Robotic Process Automation privilege escalationIBM Robotic Process Automation
- CVE-2023-29235WordPress Maintenance Switch Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)Fugu Maintenance Switch
- CVE-2023-28791WordPress Simple Org Chart Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)Gangesh Matta Simple Org Chart
- CVE-2023-27615WordPress WP Super Minify Plugin <= 1.5.1 is vulnerable to Cross Site Request Forgery (CSRF)Dipak C. Gajjar WP Super Minify
- CVE-2023-27448WordPress MakeStories (for Google Web Stories) Plugin <= 2.8.0 is vulnerable to Cross Site Request Forgery (CSRF)MakeStories Team MakeStories
- CVE-2023-25033WordPress Social Share Boost Plugin <= 4.5 is vulnerable to Cross Site Request Forgery (CSRF)Sumo Social Share Boost
- CVE-2022-47175WordPress Royal Elementor Addons Plugin <= 1.3.75 is vulnerable to Cross Site Request Forgery (CSRF)P Royal Royal Elementor Addons and Templates
- CVE-2023-25480WordPress Post and Page Builder by BoldGrid – Visual Drag and Drop Editor Plugin <= 1.24.1 is vulnerable to Cross Site Request Forgery (CSRF)Post and Page Builder by BoldGrid – Visual Drag and Drop Ed…
- CVE-2023-40671WordPress DX-auto-save-images Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)大侠wp DX-auto-save-images
- CVE-2023-40008WordPress Simple Org Chart Plugin <= 2.3.4 is vulnerable to Cross Site Request Forgery (CSRF)Gangesh Matta Simple Org Chart
- CVE-2023-45245Sensitive information disclosure due to missing authorization.Acronis Agent
- CVE-2023-4469Profile Extra Fields by BestWebSoft <= 1.2.7 - Missing Authorization to Sensitive Information ExposureProfile Extra Fields by BestWebSoft
- CVE-2015-10126Easy2Map Photos Plugin sql injectionEasy2Map Photos Plugin
- CVE-2023-40556WordPress Schedule Posts Calendar Plugin <= 5.2 is vulnerable to Cross Site Request Forgery (CSRF)Greg Ross Schedule Posts Calendar
- CVE-2023-36123Directory Traversal vulnerability in Hex-Dragon Plain Craft Launcher 2 version Alpha 1.3.9, allows local attackers to execute arbitrary code
- CVE-2023-44061File Upload vulnerability in Simple and Nice Shopping Cart Script v.1.0 allows a remote attacker to execute arbitrary code via the upload fu
- CVE-2023-44758GDidees CMS 3.0 is affected by a Cross-Site Scripting (XSS) vulnerability that allows attackers to execute arbitrary code via a crafted payl
- CVE-2023-44761Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS versions affected to 8.5.13 and below, and 9.0.0 through 9.2.1 allow a lconcrete5/concrete5
- CVE-2023-44762A Cross Site Scripting (XSS) vulnerability in Concrete CMS from versions 9.2.0 to 9.2.2 allows an attacker to execute arbitrary code via a cconcrete5/concrete5
- CVE-2023-44764A Cross Site Scripting (XSS) vulnerability in Concrete CMS before 9.2.3 exists via the Name parameter during installation (aka Site of Instaconcrete5/concrete5
- CVE-2023-44765A Cross Site Scripting (XSS) vulnerability in Concrete CMS versions 8.5.12 and below, and 9.0 through 9.2.1 allows an attacker to execute arconcrete5/concrete5
- CVE-2023-44766A Cross Site Scripting (XSS) vulnerability in Concrete CMS v.9.2.1 allows an attacker to execute arbitrary code via a crafted script to the concrete5/concrete5
- CVE-2023-44770A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows an attacker to execute arbitrary code via a crafted script to ttribalsystems/zenario
- CVE-2023-44771A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted scripttribalsystems/zenario
- CVE-2023-44807D-Link DIR-820L 1.05B03 has a stack overflow vulnerability in the cancelPing function.
- CVE-2023-44860An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTT
- CVE-2023-45311fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arfsevents
- CVE-2023-45322libxml2 through 2.11.5 has a use-after-free that can only occur after a certain memory allocation fails.