CVEs published October 9, 2023
85 CVEs were published on October 9, 2023: 1 critical, 13 high.
- Published
- 85
- Critical
- 1
- High
- 13
- Medium
- 43
- Low
- 3
- Unrated
- 25
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- SICK AG APU0200
- 9
- Red Hat Enterprise Linux
- 4
- Mattermost
- 3
- Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- 2
- Delta Electronics WPLSoft
- 2
- JetBrains Ktor
- 2
- Lenovo ThinkPad T14s X13 Gen3 BIOS - Windows · Lenovo Th… +2
- 2
- Consensys gnark · github.com/consensys/gnark
- 1
- DAEXT Live News
- 1
- Dassault Systèmes Teamwork Cloud - Business Edition · Da… +2
- 1
Critical 1
High 13
- CVE-2023-5463XINJE XDPPro cfgmgr32.dll uncontrolled search pathXINJE XDPPro
- CVE-2023-43641libcue vulnerable to out-of-bounds array accesslipnitsk libcue
- CVE-2023-44392Arbitrary code execution vulnerability when using shared Kubernetes clustergarden-io garden
- CVE-2023-42455Wazuh vulnerable to user privilege escalationwazuh-kibana-app
- CVE-2023-44378gnark vulnerable to unsoundness in variable comparison/non-unique binary decompositionConsensys gnark · github.com/consensys/gnark
- CVE-2023-43698 Improper Neutralization of Input During Web Page Generation (’Cross-site Scripting’) in RDT400 in SICK APU allows an unprivileged remote atSICK AG APU0200
- CVE-2023-43699 Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the passworSICK AG APU0200
- CVE-2023-43700Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authSICK AG APU0200
- CVE-2023-43696 Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous acceSICK AG APU0200
- CVE-2023-45247Sensitive information disclosure and manipulation due to missing authorization.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2023-45612In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXEJetBrains Ktor
- CVE-2022-36228Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions.
- CVE-2023-45363An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.mediawiki/core
Medium, low and unrated 71
- CVE-2023-5462XINJE XD5E-30R-E Modbus denial of serviceXINJE XD5E-30R-E
- CVE-2022-48183 A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under Lenovo ThinkPad T14s X13 Gen3 BIOS - Windows · Lenovo Th… +2
- CVE-2022-48182 A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under Lenovo ThinkPad T14s X13 Gen3 BIOS - Windows · Lenovo Th… +2
- CVE-2022-3728 A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under Lenovo ThinkPad T14s Gen 3 BIOS · Lenovo ThinkPad X13 Gen3…
- CVE-2023-5461Delta Electronics WPLSoft Modbus cleartext transmissionDelta Electronics WPLSoft
- CVE-2023-5460Delta Electronics WPLSoft Modbus Data Packet heap-based overflowDelta Electronics WPLSoft
- CVE-2023-5459Delta Electronics DVP32ES2 PLC Password Transmission denial of serviceDelta Electronics DVP32ES2 PLC
- CVE-2023-41672WordPress Hide admin notices – Admin Notification Center Plugin <= 2.3.2 is vulnerable to Cross Site Request Forgery (CSRF)Rémi Leclercq Hide admin notices – Admin Notification Center
- CVE-2023-41670WordPress Use Memcached Plugin <= 1.0.5 is vulnerable to Cross Site Request Forgery (CSRF)Palasthotel (in person: Edward Bock) Use Memcached
- CVE-2022-3431A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not deaLenovo BIOS
- CVE-2023-41669WordPress Live News Plugin <= 1.06 is vulnerable to Cross Site Request Forgery (CSRF)DAEXT Live News
- CVE-2023-39194Kernel: xfrm: out-of-bounds read in __xfrm_state_filter_match()Red Hat Enterprise Linux
- CVE-2023-39193Kernel: netfilter: xtables sctp out-of-bounds read in match_flags()Red Hat Enterprise Linux
- CVE-2023-39192Kernel: netfilter: xtables out-of-bounds read in u32_match_it()Red Hat Enterprise Linux
- CVE-2023-39189Kernel: netfilter: nftables out-of-bounds read in nf_osf_match_one()Red Hat Enterprise Linux
- CVE-2023-41668WordPress Leadster Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)Leadster
- CVE-2023-41667WordPress WP-dTree Plugin <= 4.4.5 is vulnerable to Cross Site Request Forgery (CSRF)Ulf Benjaminsson WP-dTree
- CVE-2023-41047Improper Neutralization of Special Elements Used in a Template Engine in OctoPrintOctoPrint
- CVE-2023-5365HP LIFE Android Mobile – Potential Escalation of Privilege, Information DisclosureHP LIFE Android Mobile
- CVE-2023-44400Uptime Kuma has Persistentent User Sessions louislam uptime-kuma · uptime-kuma
- CVE-2023-30910HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests.Hewlett Packer Enterprise (HPE) HPE MSA Controller
- CVE-2023-41660WordPress WP Migration Plugin DB & Files – WP Synchro Plugin <= 1.9.1 is vulnerable to Cross Site Request Forgery (CSRF)WPSynchro WP Synchro
- CVE-2023-43643mXSS in AntiSamynahsra antisamy · org.owasp.antisamy:antisamy
- CVE-2023-36820micronaut security has invalid IdTokenClaimsValidator logic on audmicronaut-projects micronaut-security · io.micronaut.securi…
- CVE-2023-25822ReportPortal DoS vulnerability on creating a Launch with too many recursively nested elementsreportportal · com.epam.reportportal:service-api
- CVE-2022-35950OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line itemoroinc orocommerce · oro/commerce
- CVE-2023-5103Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to potentially reveal sensSICK AG APU0200
- CVE-2023-5102 Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionalitSICK AG APU0200
- CVE-2023-5101 Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files SICK AG APU0200
- CVE-2023-5100 Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensitSICK AG APU0200
- CVE-2023-43697 Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load SICK AG APU0200
- CVE-2023-45248Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect
- CVE-2023-5333 Denial of Service via multiple identical User IDs in /api/v4/users/idsMattermost
- CVE-2023-5331File Information Leak via IDOR in file_id in Draft PostsMattermost
- CVE-2023-5330 Denial of Service via Opengraph Data CacheMattermost
- CVE-2023-45613In JetBrains Ktor before 2.3.5 server certificates were not verifiedJetBrains Ktor
- CVE-2023-44993WordPress ChatBot Plugin <= 4.7.8 is vulnerable to Cross Site Request Forgery (CSRF)QuantumCloud AI ChatBot
- CVE-2023-44473WordPress Table of Contents Plus Plugin <= 2302 is vulnerable to Cross Site Request Forgery (CSRF)Michael Tran Table of Contents Plus
- CVE-2023-44240WordPress Timthumb Vulnerability Scanner Plugin <= 1.54 is vulnerable to Cross Site Request Forgery (CSRF)Peter Butler Timthumb Vulnerability Scanner
- CVE-2023-44246WordPress Shockingly Simple Favicon Plugin <= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF)Matias s Shockingly Simple Favicon
- CVE-2023-44238WordPress Remove slug from custom post type Plugin <= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF)Joakim Ling Remove slug from custom post type
- CVE-2023-44237WordPress WP Site Protector Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)Moriyan Jay WP Site Protector
- CVE-2023-44236WordPress WP Captcha Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)Devnath verma WP Captcha
- CVE-2023-3589Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022xDassault Systèmes Teamwork Cloud - Business Edition · Da… +2
- CVE-2023-44232WordPress WP Hide Pages Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)Huseyin Berberoglu WP Hide Pages
- CVE-2023-44231WordPress Contact Form Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF)NickDuncan Contact Form
- CVE-2023-44260WordPress Woocommerce ESTO Plugin <= 2.23.1 is vulnerable to Cross Site Request Forgery (CSRF)Mikk Mihkel Nurges, Rebing OÜ Woocommerce ESTO
- CVE-2023-39854The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the admin, master, or use
- CVE-2023-43271Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder thro
- CVE-2023-43899hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax_login.ashx.
- CVE-2023-44467langchain_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and execlangchain-experimental
- CVE-2023-44811Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive
- CVE-2023-44812Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to th
- CVE-2023-44813Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to th
- CVE-2023-44821Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif_Realloc calls, might allow a denial of service (memory
- CVE-2023-45349Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.34.7, 4000 Assistant V10 R1.42.0, 4000 Assistant V10 R0, 4000 Manager V10 R1 before
- CVE-2023-45350Atos Unify OpenScape 4000 Manager V10 R1 before V10 R1.42.1 and 4000 Manager V10 R0 allow Privilege escalation that may lead to the ability
- CVE-2023-45351Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.42.1, and 4000 Manag
- CVE-2023-45352Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary co
- CVE-2023-45353Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary co
- CVE-2023-45354Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated remote attacker to execute arbit
- CVE-2023-45355Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow com
- CVE-2023-45356Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command
- CVE-2023-45364An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1.
- CVE-2023-45367An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40
- CVE-2023-45369An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.4
- CVE-2023-45370An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.
- CVE-2023-45371An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.
- CVE-2023-45372An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.
- CVE-2023-45373An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before
- CVE-2023-45374An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.