# CVEs published 2023-10-09

85 CVEs were published on October 9, 2023: 1 critical, 13 high. Days are UTC.

- [CVE-2023-5463](https://cve.now/CVE-2023-5463.md): XINJE XDPPro cfgmgr32.dll uncontrolled search path (CVSS 7.8, XINJE XDPPro)
- [CVE-2023-5462](https://cve.now/CVE-2023-5462.md): XINJE XD5E-30R-E Modbus denial of service (CVSS 6.5, XINJE XD5E-30R-E)
- [CVE-2023-43641](https://cve.now/CVE-2023-43641.md): libcue vulnerable to out-of-bounds array access (CVSS 8.8, lipnitsk libcue)
- [CVE-2022-48183](https://cve.now/CVE-2022-48183.md): A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under (CVSS 6.1, Lenovo ThinkPad T14s X13 Gen3 BIOS - Windows · Lenovo Th… +2)
- [CVE-2022-48182](https://cve.now/CVE-2022-48182.md): A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under (CVSS 6.1, Lenovo ThinkPad T14s X13 Gen3 BIOS - Windows · Lenovo Th… +2)
- [CVE-2022-3728](https://cve.now/CVE-2022-3728.md): A vulnerability was reported in ThinkPad T14s Gen 3 and X13 Gen3 that could cause the BIOS tamper detection mechanism to not trigger under (CVSS 6.1, Lenovo ThinkPad T14s Gen 3 BIOS · Lenovo ThinkPad X13 Gen3…)
- [CVE-2023-5461](https://cve.now/CVE-2023-5461.md): Delta Electronics WPLSoft Modbus cleartext transmission (CVSS 3.7, Delta Electronics WPLSoft)
- [CVE-2023-44392](https://cve.now/CVE-2023-44392.md): Arbitrary code execution vulnerability when using shared Kubernetes cluster (CVSS 8.3, garden-io garden)
- [CVE-2023-5460](https://cve.now/CVE-2023-5460.md): Delta Electronics WPLSoft Modbus Data Packet heap-based overflow (CVSS 3.5, Delta Electronics WPLSoft)
- [CVE-2023-5459](https://cve.now/CVE-2023-5459.md): Delta Electronics DVP32ES2 PLC Password Transmission denial of service (CVSS 6.5, Delta Electronics DVP32ES2 PLC)
- [CVE-2023-41672](https://cve.now/CVE-2023-41672.md): WordPress Hide admin notices – Admin Notification Center Plugin \<= 2.3.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Rémi Leclercq Hide admin notices – Admin Notification Center)
- [CVE-2023-41670](https://cve.now/CVE-2023-41670.md): WordPress Use Memcached Plugin \<= 1.0.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Palasthotel (in person: Edward Bock) Use Memcached)
- [CVE-2022-3431](https://cve.now/CVE-2022-3431.md): A potential vulnerability in a driver used during manufacturing process on some consumer Lenovo Notebook devices that was mistakenly not dea (CVSS 6.7, Lenovo BIOS)
- [CVE-2023-41669](https://cve.now/CVE-2023-41669.md): WordPress Live News Plugin \<= 1.06 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, DAEXT Live News)
- [CVE-2023-39194](https://cve.now/CVE-2023-39194.md): Kernel: xfrm: out-of-bounds read in \_\_xfrm\_state\_filter\_match() (CVSS 3.2, Red Hat Enterprise Linux)
- [CVE-2023-39193](https://cve.now/CVE-2023-39193.md): Kernel: netfilter: xtables sctp out-of-bounds read in match\_flags() (CVSS 6.1, Red Hat Enterprise Linux)
- [CVE-2023-39192](https://cve.now/CVE-2023-39192.md): Kernel: netfilter: xtables out-of-bounds read in u32\_match\_it() (CVSS 6.7, Red Hat Enterprise Linux)
- [CVE-2023-39189](https://cve.now/CVE-2023-39189.md): Kernel: netfilter: nftables out-of-bounds read in nf\_osf\_match\_one() (CVSS 5.1, Red Hat Enterprise Linux)
- [CVE-2023-41668](https://cve.now/CVE-2023-41668.md): WordPress Leadster Plugin \<= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Leadster)
- [CVE-2023-41667](https://cve.now/CVE-2023-41667.md): WordPress WP-dTree Plugin \<= 4.4.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Ulf Benjaminsson WP-dTree)
- [CVE-2023-42455](https://cve.now/CVE-2023-42455.md): Wazuh vulnerable to user privilege escalation (CVSS 8.8, wazuh-kibana-app)
- [CVE-2023-41047](https://cve.now/CVE-2023-41047.md): Improper Neutralization of Special Elements Used in a Template Engine in OctoPrint (CVSS 6.2, OctoPrint)
- [CVE-2023-5365](https://cve.now/CVE-2023-5365.md): HP LIFE Android Mobile – Potential Escalation of Privilege, Information Disclosure (no CVSS, HP LIFE Android Mobile)
- [CVE-2023-44400](https://cve.now/CVE-2023-44400.md): Uptime Kuma has Persistentent User Sessions (CVSS 6.7, louislam uptime-kuma · uptime-kuma)
- [CVE-2023-30910](https://cve.now/CVE-2023-30910.md): HPE MSA Controller prior to version IN210R004 could be remotely exploited to allow inconsistent interpretation of HTTP requests. (CVSS 5.4, Hewlett Packer Enterprise (HPE) HPE MSA Controller)
- [CVE-2023-44393](https://cve.now/CVE-2023-44393.md): Piwigo Reflected XSS vulnerability (CVSS 9.3, Piwigo)
- [CVE-2023-41660](https://cve.now/CVE-2023-41660.md): WordPress WP Migration Plugin DB & Files – WP Synchro Plugin \<= 1.9.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.5, WPSynchro WP Synchro)
- [CVE-2023-44378](https://cve.now/CVE-2023-44378.md): gnark vulnerable to unsoundness in variable comparison/non-unique binary decomposition (CVSS 7.1, Consensys gnark · github.com/consensys/gnark)
- [CVE-2023-43643](https://cve.now/CVE-2023-43643.md): mXSS in AntiSamy (CVSS 6.1, nahsra antisamy · org.owasp.antisamy:antisamy)
- [CVE-2023-36820](https://cve.now/CVE-2023-36820.md): micronaut security has invalid IdTokenClaimsValidator logic on aud (CVSS 4.8, micronaut-projects micronaut-security · io.micronaut.securi…)
- [CVE-2023-25822](https://cve.now/CVE-2023-25822.md): ReportPortal DoS vulnerability on creating a Launch with too many recursively nested elements (CVSS 6.3, reportportal · com.epam.reportportal:service-api)
- [CVE-2022-35950](https://cve.now/CVE-2022-35950.md): OroCommerce Cross-site Scripting vulnerability in add note dialog of Shopping List line item (CVSS 6.9, oroinc orocommerce · oro/commerce)
- [CVE-2023-5103](https://cve.now/CVE-2023-5103.md): Improper Restriction of Rendered UI Layers or Frames in RDT400 in SICK APU allows an unprivileged remote attacker to potentially reveal sens (CVSS 4.3, SICK AG APU0200)
- [CVE-2023-5102](https://cve.now/CVE-2023-5102.md): Insufficient Control Flow Management in RDT400 in SICK APU allows an unprivileged remote attacker to potentially enable hidden functionalit (CVSS 5.3, SICK AG APU0200)
- [CVE-2023-5101](https://cve.now/CVE-2023-5101.md): Files or Directories Accessible to External Parties in RDT400 in SICK APU allows an unprivileged remote attacker to download various files (CVSS 5.3, SICK AG APU0200)
- [CVE-2023-5100](https://cve.now/CVE-2023-5100.md): Cleartext Transmission of Sensitive Information in RDT400 in SICK APU allows an unprivileged remote attacker to retrieve potentially sensit (CVSS 5.9, SICK AG APU0200)
- [CVE-2023-43697](https://cve.now/CVE-2023-43697.md): Modification of Assumed-Immutable Data (MAID) in RDT400 in SICK APU allows an unprivileged remote attacker to make the site unable to load (CVSS 6.5, SICK AG APU0200)
- [CVE-2023-43698](https://cve.now/CVE-2023-43698.md): Improper Neutralization of Input During Web Page Generation (’Cross-site Scripting’) in RDT400 in SICK APU allows an unprivileged remote at (CVSS 7.1, SICK AG APU0200)
- [CVE-2023-43699](https://cve.now/CVE-2023-43699.md): Improper Restriction of Excessive Authentication Attempts in RDT400 in SICK APU allows an unprivileged remote attacker to guess the passwor (CVSS 7.5, SICK AG APU0200)
- [CVE-2023-43700](https://cve.now/CVE-2023-43700.md): Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require auth (CVSS 7.7, SICK AG APU0200)
- [CVE-2023-43696](https://cve.now/CVE-2023-43696.md): Improper Access Control in SICK APU allows an unprivileged remote attacker to download as well as upload arbitrary files via anonymous acce (CVSS 8.2, SICK AG APU0200)
- [CVE-2023-45247](https://cve.now/CVE-2023-45247.md): Sensitive information disclosure and manipulation due to missing authorization. (CVSS 7.1, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2023-45248](https://cve.now/CVE-2023-45248.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 6.6, Acronis Cyber Protect Cloud Agent · Acronis Cyber Protect)
- [CVE-2023-5333](https://cve.now/CVE-2023-5333.md): Denial of Service via multiple identical User IDs in /api/v4/users/ids (CVSS 4.3, Mattermost)
- [CVE-2023-5331](https://cve.now/CVE-2023-5331.md): File Information Leak via IDOR in file\_id in Draft Posts (CVSS 4.3, Mattermost)
- [CVE-2023-5330](https://cve.now/CVE-2023-5330.md): Denial of Service via Opengraph Data Cache (CVSS 4.3, Mattermost)
- [CVE-2023-45613](https://cve.now/CVE-2023-45613.md): In JetBrains Ktor before 2.3.5 server certificates were not verified (CVSS 6.8, JetBrains Ktor)
- [CVE-2023-45612](https://cve.now/CVE-2023-45612.md): In JetBrains Ktor before 2.3.5 default configuration of ContentNegotiation with XML format was vulnerable to XXE (CVSS 8.6, JetBrains Ktor)
- [CVE-2023-44993](https://cve.now/CVE-2023-44993.md): WordPress ChatBot Plugin \<= 4.7.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, QuantumCloud AI ChatBot)
- [CVE-2023-44473](https://cve.now/CVE-2023-44473.md): WordPress Table of Contents Plus Plugin \<= 2302 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Michael Tran Table of Contents Plus)
- [CVE-2023-44240](https://cve.now/CVE-2023-44240.md): WordPress Timthumb Vulnerability Scanner Plugin \<= 1.54 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Peter Butler Timthumb Vulnerability Scanner)
- [CVE-2023-44246](https://cve.now/CVE-2023-44246.md): WordPress Shockingly Simple Favicon Plugin \<= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Matias s Shockingly Simple Favicon)
- [CVE-2023-44238](https://cve.now/CVE-2023-44238.md): WordPress Remove slug from custom post type Plugin \<= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Joakim Ling Remove slug from custom post type)
- [CVE-2023-44237](https://cve.now/CVE-2023-44237.md): WordPress WP Site Protector Plugin \<= 2.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Moriyan Jay WP Site Protector)
- [CVE-2023-44236](https://cve.now/CVE-2023-44236.md): WordPress WP Captcha Plugin \<= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Devnath verma WP Captcha)
- [CVE-2023-3589](https://cve.now/CVE-2023-3589.md): Cross-Site Request Forgery (CSRF) vulnerability affecting Teamwork Cloud from No Magic Release 2021x through No Magic Release 2022x (CVSS 6.8, Dassault Systèmes Teamwork Cloud - Business Edition · Da… +2)
- [CVE-2023-44232](https://cve.now/CVE-2023-44232.md): WordPress WP Hide Pages Plugin \<= 1.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Huseyin Berberoglu WP Hide Pages)
- [CVE-2023-44231](https://cve.now/CVE-2023-44231.md): WordPress Contact Form Plugin \<= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, NickDuncan Contact Form)
- [CVE-2023-44260](https://cve.now/CVE-2023-44260.md): WordPress Woocommerce ESTO Plugin \<= 2.23.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Mikk Mihkel Nurges, Rebing OÜ Woocommerce ESTO)
- [CVE-2022-36228](https://cve.now/CVE-2022-36228.md): Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. (CVSS 7.3)
- [CVE-2023-39854](https://cve.now/CVE-2023-39854.md): The web interface of ATX Ucrypt through 3.5 allows authenticated users (or attackers using default credentials for the admin, master, or use (no CVSS)
- [CVE-2023-43271](https://cve.now/CVE-2023-43271.md): Incorrect access control in 70mai a500s v1.2.119 allows attackers to directly access and delete the video files of the driving recorder thro (no CVSS)
- [CVE-2023-43899](https://cve.now/CVE-2023-43899.md): hansun CMS v1.0 was discovered to contain a SQL injection vulnerability via the component /ajax/ajax\_login.ashx. (no CVSS)
- [CVE-2023-44467](https://cve.now/CVE-2023-44467.md): langchain\_experimental (aka LangChain Experimental) in LangChain before 0.0.306 allows an attacker to bypass the CVE-2023-36258 fix and exec (no CVSS, langchain-experimental)
- [CVE-2023-44811](https://cve.now/CVE-2023-44811.md): Cross Site Request Forgery (CSRF) vulnerability in MooSocial v.3.1.8 allows a remote attacker to execute arbitrary code and obtain sensitive (no CVSS)
- [CVE-2023-44812](https://cve.now/CVE-2023-44812.md): Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to th (no CVSS)
- [CVE-2023-44813](https://cve.now/CVE-2023-44813.md): Cross Site Scripting (XSS) vulnerability in mooSocial v.3.1.8 allows a remote attacker to execute arbitrary code via a crafted payload to th (no CVSS)
- [CVE-2023-44821](https://cve.now/CVE-2023-44821.md): Gifsicle through 1.94, if deployed in a way that allows untrusted input to affect Gif\_Realloc calls, might allow a denial of service (memory (no CVSS)
- [CVE-2023-45349](https://cve.now/CVE-2023-45349.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.34.7, 4000 Assistant V10 R1.42.0, 4000 Assistant V10 R0, 4000 Manager V10 R1 before (no CVSS)
- [CVE-2023-45350](https://cve.now/CVE-2023-45350.md): Atos Unify OpenScape 4000 Manager V10 R1 before V10 R1.42.1 and 4000 Manager V10 R0 allow Privilege escalation that may lead to the ability (no CVSS)
- [CVE-2023-45351](https://cve.now/CVE-2023-45351.md): Atos Unify OpenScape 4000 Assistant V10 R1 before V10 R1.42.1, 4000 Assistant V10 R0, 4000 Manager V10 R1 before V10 R1.42.1, and 4000 Manag (no CVSS)
- [CVE-2023-45352](https://cve.now/CVE-2023-45352.md): Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary co (no CVSS)
- [CVE-2023-45353](https://cve.now/CVE-2023-45353.md): Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated attacker to execute arbitrary co (no CVSS)
- [CVE-2023-45354](https://cve.now/CVE-2023-45354.md): Atos Unify OpenScape Common Management Portal V10 before V10 R4.17.0 and V10 R5.1.0 allows an authenticated remote attacker to execute arbit (no CVSS)
- [CVE-2023-45355](https://cve.now/CVE-2023-45355.md): Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 and 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow com (no CVSS)
- [CVE-2023-45356](https://cve.now/CVE-2023-45356.md): Atos Unify OpenScape 4000 Platform V10 R1 before Hotfix V10 R1.42.2 4000 and Manager Platform V10 R1 before Hotfix V10 R1.42.2 allow command (no CVSS)
- [CVE-2023-45363](https://cve.now/CVE-2023-45363.md): An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. (CVSS 7.5, mediawiki/core)
- [CVE-2023-45364](https://cve.now/CVE-2023-45364.md): An issue was discovered in includes/page/Article.php in MediaWiki 1.36.x through 1.39.x before 1.39.5 and 1.40.x before 1.40.1. (no CVSS)
- [CVE-2023-45367](https://cve.now/CVE-2023-45367.md): An issue was discovered in the CheckUser extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40 (no CVSS)
- [CVE-2023-45369](https://cve.now/CVE-2023-45369.md): An issue was discovered in the PageTriage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.4 (no CVSS)
- [CVE-2023-45370](https://cve.now/CVE-2023-45370.md): An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1. (no CVSS)
- [CVE-2023-45371](https://cve.now/CVE-2023-45371.md): An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40. (no CVSS)
- [CVE-2023-45372](https://cve.now/CVE-2023-45372.md): An issue was discovered in the Wikibase extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40. (no CVSS)
- [CVE-2023-45373](https://cve.now/CVE-2023-45373.md): An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before (no CVSS)
- [CVE-2023-45374](https://cve.now/CVE-2023-45374.md): An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.