# CVEs published 2023-10-10

254 CVEs were published on October 10, 2023: 15 critical, 125 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2023-26220](https://cve.now/CVE-2023-26220.md): TIBCO Spotfire Stored Cross-site Scripting (XSS) vulnerability (CVSS 5.4, TIBCO Software Spotfire Analyst · TIBCO Software Spotfire S…)
- [CVE-2023-45648](https://cve.now/CVE-2023-45648.md): Apache Tomcat: Trailer header parsing too lenient (CVSS 5.3, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2023-42795](https://cve.now/CVE-2023-42795.md): Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests (CVSS 5.3, Apache Software Foundation Apache Tomcat · org.apache.to… +3)
- [CVE-2023-5497](https://cve.now/CVE-2023-5497.md): Tongda OA 2017 delete.php sql injection (CVSS 6.3, Tongda OA)
- [CVE-2023-4309](https://cve.now/CVE-2023-4309.md): Election Services Co. (CVSS 10.0, Election Services Co. (ESC) Internet Election Service)
- [CVE-2023-45129](https://cve.now/CVE-2023-45129.md): matrix-synapse vulnerable to denial of service due to malicious server ACL events (CVSS 4.9, matrix-org synapse · matrix-synapse)
- [CVE-2023-42794](https://cve.now/CVE-2023-42794.md): Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows (low (no CVSS), Apache Software Foundation Apache Tomcat · tomcat +1)
- [CVE-2023-36414](https://cve.now/CVE-2023-36414.md): Azure Identity SDK Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Azure Identity SDK for .NET · Azure.Identity)
- [CVE-2023-36415](https://cve.now/CVE-2023-36415.md): Azure Identity SDK Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Azure Identity SDK for Java · Microsoft Azure… +2)
- [CVE-2023-36416](https://cve.now/CVE-2023-36416.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 6.1, Microsoft Dynamics 365 (on-premises))
- [CVE-2023-36418](https://cve.now/CVE-2023-36418.md): Azure RTOS GUIX Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Azure RTOS GUIX Studio)
- [CVE-2023-36436](https://cve.now/CVE-2023-36436.md): Windows MSHTML Platform Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36565](https://cve.now/CVE-2023-36565.md): Microsoft Office Graphics Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Office 2019 for Mac · Microsoft Office LTSC fo… +2)
- [CVE-2023-36566](https://cve.now/CVE-2023-36566.md): Microsoft Common Data Model SDK Denial of Service Vulnerability (CVSS 6.5, Microsoft Common Data Model SDK for Java · Microsoft Com… +5)
- [CVE-2023-36743](https://cve.now/CVE-2023-36743.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36776](https://cve.now/CVE-2023-36776.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-36778](https://cve.now/CVE-2023-36778.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2023-36780](https://cve.now/CVE-2023-36780.md): Skype for Business Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Skype for Business Server 2019 CU7 · Microsoft Sk…)
- [CVE-2023-36785](https://cve.now/CVE-2023-36785.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SQL Server · Microsoft ODBC Driver 17 for SQL… +5)
- [CVE-2023-36786](https://cve.now/CVE-2023-36786.md): Skype for Business Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Skype for Business Server 2015 CU13 · Microsoft S…)
- [CVE-2023-36789](https://cve.now/CVE-2023-36789.md): Skype for Business Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Skype for Business Server 2019 CU7 · Microsoft Sk…)
- [CVE-2023-36790](https://cve.now/CVE-2023-36790.md): Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server 2008 Service Pack · Microsoft W… +1)
- [CVE-2023-38159](https://cve.now/CVE-2023-38159.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-38166](https://cve.now/CVE-2023-38166.md): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-29348](https://cve.now/CVE-2023-29348.md): Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2023-36417](https://cve.now/CVE-2023-36417.md): Microsoft SQL OLE DB Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +1)
- [CVE-2023-36419](https://cve.now/CVE-2023-36419.md): Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Azure HDInsight)
- [CVE-2023-36420](https://cve.now/CVE-2023-36420.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SQL Server · Microsoft ODBC Driver 17 for SQL… +5)
- [CVE-2023-36429](https://cve.now/CVE-2023-36429.md): Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Dynamics 365 (on-premises))
- [CVE-2023-36431](https://cve.now/CVE-2023-36431.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36433](https://cve.now/CVE-2023-36433.md): Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability (CVSS 6.5, Microsoft Dynamics 365 (on-premises))
- [CVE-2023-36434](https://cve.now/CVE-2023-36434.md): Windows IIS Server Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2023-36435](https://cve.now/CVE-2023-36435.md): Microsoft QUIC Denial of Service Vulnerability (CVSS 7.5, Microsoft PowerShell · Microsoft Windows Server +4)
- [CVE-2023-36438](https://cve.now/CVE-2023-36438.md): Windows TCP/IP Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36557](https://cve.now/CVE-2023-36557.md): PrintHTML API Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36561](https://cve.now/CVE-2023-36561.md): Azure DevOps Server Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Azure DevOps Server)
- [CVE-2023-36563](https://cve.now/CVE-2023-36563.md): Microsoft WordPad Information Disclosure Vulnerability (CVSS 6.5, KEV, Microsoft Windows)
- [CVE-2023-36564](https://cve.now/CVE-2023-36564.md): Windows Search Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2023-36567](https://cve.now/CVE-2023-36567.md): Windows Deployment Services Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36568](https://cve.now/CVE-2023-36568.md): Microsoft Office Click-To-Run Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2023-36569](https://cve.now/CVE-2023-36569.md): Microsoft Office Elevation of Privilege Vulnerability (CVSS 8.4, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2023-36570](https://cve.now/CVE-2023-36570.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36571](https://cve.now/CVE-2023-36571.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36572](https://cve.now/CVE-2023-36572.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36573](https://cve.now/CVE-2023-36573.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36574](https://cve.now/CVE-2023-36574.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36575](https://cve.now/CVE-2023-36575.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36576](https://cve.now/CVE-2023-36576.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-36577](https://cve.now/CVE-2023-36577.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-36578](https://cve.now/CVE-2023-36578.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36579](https://cve.now/CVE-2023-36579.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36581](https://cve.now/CVE-2023-36581.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36582](https://cve.now/CVE-2023-36582.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36583](https://cve.now/CVE-2023-36583.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36584](https://cve.now/CVE-2023-36584.md): Windows Mark of the Web Security Feature Bypass Vulnerability (CVSS 5.4, KEV, Microsoft Windows)
- [CVE-2023-36585](https://cve.now/CVE-2023-36585.md): Windows upnphost.dll Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36589](https://cve.now/CVE-2023-36589.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36590](https://cve.now/CVE-2023-36590.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36591](https://cve.now/CVE-2023-36591.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36592](https://cve.now/CVE-2023-36592.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2023-36593](https://cve.now/CVE-2023-36593.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36594](https://cve.now/CVE-2023-36594.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36596](https://cve.now/CVE-2023-36596.md): Remote Procedure Call Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36598](https://cve.now/CVE-2023-36598.md): Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36602](https://cve.now/CVE-2023-36602.md): Windows TCP/IP Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36603](https://cve.now/CVE-2023-36603.md): Windows TCP/IP Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36605](https://cve.now/CVE-2023-36605.md): Windows Named Pipe Filesystem Elevation of Privilege Vulnerability (CVSS 7.4, Microsoft Windows)
- [CVE-2023-36606](https://cve.now/CVE-2023-36606.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36697](https://cve.now/CVE-2023-36697.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2023-36698](https://cve.now/CVE-2023-36698.md): Windows Kernel Security Feature Bypass Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2023-36701](https://cve.now/CVE-2023-36701.md): Microsoft Resilient File System (ReFS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36702](https://cve.now/CVE-2023-36702.md): Microsoft DirectMusic Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36703](https://cve.now/CVE-2023-36703.md): DHCP Server Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2023-36704](https://cve.now/CVE-2023-36704.md): Windows Setup Files Cleanup Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36706](https://cve.now/CVE-2023-36706.md): Windows Deployment Services Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2023-36707](https://cve.now/CVE-2023-36707.md): Windows Deployment Services Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2023-36709](https://cve.now/CVE-2023-36709.md): Microsoft AllJoyn API Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36710](https://cve.now/CVE-2023-36710.md): Windows Media Foundation Core Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36711](https://cve.now/CVE-2023-36711.md): Windows Runtime C++ Template Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36712](https://cve.now/CVE-2023-36712.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36713](https://cve.now/CVE-2023-36713.md): Windows Common Log File System Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-36717](https://cve.now/CVE-2023-36717.md): Windows Virtual Trusted Platform Module Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2023-36718](https://cve.now/CVE-2023-36718.md): Microsoft Virtual Trusted Platform Module Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36720](https://cve.now/CVE-2023-36720.md): Windows Mixed Reality Developer Tools Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36721](https://cve.now/CVE-2023-36721.md): Windows Error Reporting Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-36722](https://cve.now/CVE-2023-36722.md): Active Directory Domain Services Information Disclosure Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2023-36723](https://cve.now/CVE-2023-36723.md): Windows Container Manager Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36724](https://cve.now/CVE-2023-36724.md): Windows Power Management Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-36725](https://cve.now/CVE-2023-36725.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36726](https://cve.now/CVE-2023-36726.md): Windows Internet Key Exchange (IKE) Extension Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36728](https://cve.now/CVE-2023-36728.md): Microsoft SQL Server Denial of Service Vulnerability (CVSS 5.5, Microsoft SQL Server · Microsoft OLE DB Driver 19 for SQ… +7)
- [CVE-2023-36729](https://cve.now/CVE-2023-36729.md): Named Pipe File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36730](https://cve.now/CVE-2023-36730.md): Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SQL Server · Microsoft ODBC Driver 17 for SQL… +5)
- [CVE-2023-36731](https://cve.now/CVE-2023-36731.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36732](https://cve.now/CVE-2023-36732.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-41774](https://cve.now/CVE-2023-41774.md): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-41773](https://cve.now/CVE-2023-41773.md): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-41772](https://cve.now/CVE-2023-41772.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-41771](https://cve.now/CVE-2023-41771.md): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-41770](https://cve.now/CVE-2023-41770.md): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-41769](https://cve.now/CVE-2023-41769.md): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-41768](https://cve.now/CVE-2023-41768.md): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-41767](https://cve.now/CVE-2023-41767.md): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-41766](https://cve.now/CVE-2023-41766.md): Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-41765](https://cve.now/CVE-2023-41765.md): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-41763](https://cve.now/CVE-2023-41763.md): Skype for Business Elevation of Privilege Vulnerability (CVSS 5.3, KEV, Microsoft Skype for Business Server 2015 CU13 · Microsoft S…)
- [CVE-2023-36737](https://cve.now/CVE-2023-36737.md): Azure Network Watcher VM Agent Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Azure Network Watcher VM Extension)
- [CVE-2023-38171](https://cve.now/CVE-2023-38171.md): Microsoft QUIC Denial of Service Vulnerability (CVSS 7.5, Microsoft Visual Studio · Microsoft Windows Server +5)
- [CVE-2023-36902](https://cve.now/CVE-2023-36902.md): Windows Runtime Remote Code Execution Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-35349](https://cve.now/CVE-2023-35349.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2023-5496](https://cve.now/CVE-2023-5496.md): Translator PoqDev Add-On Select Text cross site scripting (CVSS 3.1, Translator PoqDev Add-On)
- [CVE-2023-44399](https://cve.now/CVE-2023-44399.md): ZITADEL's password reset does not respect the "Ignoring unknown usernames" setting (CVSS 5.3, zitadel · github.com/zitadel/zitadel)
- [CVE-2023-36478](https://cve.now/CVE-2023-36478.md): HTTP/2 HPACK integer overflow and buffer allocation (CVSS 7.5, eclipse jetty.project · org.eclipse.jetty.http2:http2-hp… +1)
- [CVE-2023-41679](https://cve.now/CVE-2023-41679.md): An improper access control vulnerability \[CWE-284\] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 thro (CVSS 7.7, Fortinet FortiManager)
- [CVE-2023-25607](https://cve.now/CVE-2023-25607.md): An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability \[CWE-78 \] in FortiManager 7.2.0 (CVSS 7.4, Fortinet FortiAnalyzer · Fortinet FortiManager +1)
- [CVE-2023-37935](https://cve.now/CVE-2023-37935.md): A use of GET request method with sensitive query strings vulnerability in Fortinet FortiOS 7.0.0 - 7.0.12, 7.2.0 - 7.2.5 and 7.4.0 allows an (CVSS 6.5, Fortinet FortiOS)
- [CVE-2023-36548](https://cve.now/CVE-2023-36548.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6. (CVSS 9.6, Fortinet FortiWLM)
- [CVE-2023-36547](https://cve.now/CVE-2023-36547.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6. (CVSS 9.6, Fortinet FortiWLM)
- [CVE-2023-34993](https://cve.now/CVE-2023-34993.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6. (CVSS 9.6, Fortinet FortiWLM)
- [CVE-2023-36550](https://cve.now/CVE-2023-36550.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6. (CVSS 9.6, Fortinet FortiWLM)
- [CVE-2023-36549](https://cve.now/CVE-2023-36549.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6. (CVSS 8.6, Fortinet FortiWLM)
- [CVE-2023-34989](https://cve.now/CVE-2023-34989.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6. (CVSS 8.6, Fortinet FortiWLM)
- [CVE-2023-34987](https://cve.now/CVE-2023-34987.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6. (CVSS 8.6, Fortinet FortiWLM)
- [CVE-2023-34986](https://cve.now/CVE-2023-34986.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6. (CVSS 8.6, Fortinet FortiWLM)
- [CVE-2023-34985](https://cve.now/CVE-2023-34985.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6. (CVSS 8.6, Fortinet FortiWLM)
- [CVE-2023-34988](https://cve.now/CVE-2023-34988.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6. (CVSS 8.6, Fortinet FortiWLM)
- [CVE-2023-42782](https://cve.now/CVE-2023-42782.md): A insufficient verification of data authenticity vulnerability \[CWE-345\] in FortiAnalyzer version 7.4.0 and below 7.2.3 allows a remote unau (CVSS 5.0, Fortinet FortiAnalyzer)
- [CVE-2023-34992](https://cve.now/CVE-2023-34992.md): A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to e (CVSS 9.7, Fortinet FortiSIEM)
- [CVE-2023-36637](https://cve.now/CVE-2023-36637.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] in FortiMail version 7.2.0 through 7.2.2 and before 7. (CVSS 3.4, Fortinet FortiMail)
- [CVE-2023-37939](https://cve.now/CVE-2023-37939.md): An exposure of sensitive information to an unauthorized actor vulnerability \[CWE-200\] in FortiClient for Windows 7.2.0, 7.0 all versions, 6. (CVSS 3.0, Fortinet FortiClientMac · Fortinet FortiClientWindows +1)
- [CVE-2023-41675](https://cve.now/CVE-2023-41675.md): A use after free vulnerability \[CWE-416\] in FortiOS version 7.2.0 through 7.2.4 and version 7.0.0 through 7.0.10 and FortiProxy version 7.2. (CVSS 4.8, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2023-36556](https://cve.now/CVE-2023-36556.md): An incorrect authorization vulnerability \[CWE-863\] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6 (CVSS 8.6, Fortinet FortiMail)
- [CVE-2022-22298](https://cve.now/CVE-2022-22298.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiIsolator version 1.0.0, FortiI (CVSS 6.7, Fortinet FortiIsolator)
- [CVE-2023-25604](https://cve.now/CVE-2023-25604.md): An insertion of sensitive information into log file vulnerability in Fortinet FortiGuest 1.0.0 allows a local attacker to access plaintext p (CVSS 5.5, Fortinet FortiGuest)
- [CVE-2023-41841](https://cve.now/CVE-2023-41841.md): An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin (CVSS 7.4, Fortinet FortiOS)
- [CVE-2023-41838](https://cve.now/CVE-2023-41838.md): An improper neutralization of special elements used in an os command ('os command injection') in FortiManager 7.4.0 and 7.2.0 through 7.2.3 (CVSS 6.9, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2023-40718](https://cve.now/CVE-2023-40718.md): A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packe (CVSS 6.7, Fortinet IPS Engine)
- [CVE-2023-42788](https://cve.now/CVE-2023-42788.md): An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability \[CWE-78\] in FortiManager & Forti (CVSS 7.6, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2023-42787](https://cve.now/CVE-2023-42787.md): A client-side enforcement of server-side security \[CWE-602\] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiA (CVSS 6.2, Fortinet FortiAnalyzer · Fortinet FortiManager +1)
- [CVE-2023-44249](https://cve.now/CVE-2023-44249.md): An authorization bypass through user-controlled key \[CWE-639\] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and Fort (CVSS 4.1, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2023-36555](https://cve.now/CVE-2023-36555.md): An improper neutralization of script-related html tags in a web page (basic xss) in Fortinet FortiOS 7.2.0 - 7.2.4 allows an attacker to exe (CVSS 3.9, Fortinet FortiOS)
- [CVE-2023-33301](https://cve.now/CVE-2023-33301.md): An improper access control vulnerability in Fortinet FortiOS 7.2.0 - 7.2.4 and 7.4.0 allows an attacker to access a restricted resource from (CVSS 6.5, Fortinet FortiOS)
- [CVE-2023-5495](https://cve.now/CVE-2023-5495.md): QDocs Smart School HTTP POST Request sql injection (CVSS 6.3, QDocs Smart School)
- [CVE-2023-5494](https://cve.now/CVE-2023-5494.md): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform download.php os command injection (CVSS 6.3, Byzoro Smart S45F Multi-Service Secure Gateway Intelligent…)
- [CVE-2023-5493](https://cve.now/CVE-2023-5493.md): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform web.php unrestricted upload (CVSS 6.3, Byzoro Smart S45F Multi-Service Secure Gateway Intelligent…)
- [CVE-2023-44996](https://cve.now/CVE-2023-44996.md): WordPress Post View Count Plugin \<= 1.8.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Naresh Parmar Post View Count)
- [CVE-2023-44995](https://cve.now/CVE-2023-44995.md): WordPress WooCommerce Login Redirect Plugin \<= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WP Doctor WooCommerce Login Redirect)
- [CVE-2023-5492](https://cve.now/CVE-2023-5492.md): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform licence.php unrestricted upload (CVSS 6.3, Byzoro Smart S45F Multi-Service Secure Gateway Intelligent…)
- [CVE-2023-5491](https://cve.now/CVE-2023-5491.md): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform updatelib.php unrestricted upload (CVSS 6.3, Byzoro Smart S45F Multi-Service Secure Gateway Intelligent…)
- [CVE-2023-5490](https://cve.now/CVE-2023-5490.md): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform userattestation.php unrestricted upload (CVSS 6.3, Byzoro Smart S45F Multi-Service Secure Gateway Intelligent…)
- [CVE-2023-44994](https://cve.now/CVE-2023-44994.md): WordPress ShortCodes UI Plugin \<= 1.9.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Bainternet ShortCodes UI)
- [CVE-2023-5489](https://cve.now/CVE-2023-5489.md): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform uploadfile.php unrestricted upload (CVSS 6.3, Byzoro Smart S45F Multi-Service Secure Gateway Intelligent…)
- [CVE-2023-44476](https://cve.now/CVE-2023-44476.md): WordPress CopyRightPro Plugin \<= 2.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Andres Felipe Perea V. CopyRightPro)
- [CVE-2023-30806](https://cve.now/CVE-2023-30806.md): Sangfor Next-Gen Application Firewall PHPSESSID Command Injection (CVSS 9.8, Sangfor Net-Gen Application Firewall)
- [CVE-2023-44475](https://cve.now/CVE-2023-44475.md): WordPress Add Shortcodes Actions And Filters Plugin \<= 2.0.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Michael Simpson Add Shortcodes Actions And Filters)
- [CVE-2023-30805](https://cve.now/CVE-2023-30805.md): Sangfor Next-Gen Application Firewall Login Un Param Command Injection (CVSS 9.8, Sangfor Net-Gen Application Firewall)
- [CVE-2023-44471](https://cve.now/CVE-2023-44471.md): WordPress Backend Localization Plugin \<= 2.1.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Bernhard Kau Backend Localization)
- [CVE-2023-30804](https://cve.now/CVE-2023-30804.md): Sangfor Next-Gen Application Firewall Authenticated File Disclosure (CVSS 6.9, Sangfor Next-Gen Application Firewall)
- [CVE-2023-30803](https://cve.now/CVE-2023-30803.md): Sangfor Next-Gen Application Firewall Authentication Bypass (CVSS 9.8, Sangfor Net-Gen Application Firewall)
- [CVE-2023-30802](https://cve.now/CVE-2023-30802.md): Sangfor Next-Gen Application Firewall Source Code Disclosure (CVSS 5.3, Sangfor Net-Gen Application Firewall)
- [CVE-2023-5488](https://cve.now/CVE-2023-5488.md): Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform updatelib.php unrestricted upload (CVSS 6.3, Byzoro Smart S45F Multi-Service Secure Gateway Intelligent…)
- [CVE-2023-44470](https://cve.now/CVE-2023-44470.md): WordPress Kv TinyMCE Editor Add Fonts Plugin \<= 1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Kvvaradha Kv TinyMCE Editor Add Fonts)
- [CVE-2023-44241](https://cve.now/CVE-2023-44241.md): WordPress Keap Landing Pages Plugin \<= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Keap Landing Pages)
- [CVE-2023-30801](https://cve.now/CVE-2023-30801.md): qBittorrent Web UI Default Credentials Lead to RCE (CVSS 9.8, qBittorrent client)
- [CVE-2023-5499](https://cve.now/CVE-2023-5499.md): Shenzhen Reachfar v28 information exposure (CVSS 7.5, SHENZHEN REACHFAR TECHNOLOGY COMPANY LIMITED Shenzhen Reach…)
- [CVE-2023-4966](https://cve.now/CVE-2023-4966.md): Unauthenticated sensitive information disclosure (CVSS 9.4, KEV, Citrix NetScaler ADC · Citrix NetScaler Gateway)
- [CVE-2023-45226](https://cve.now/CVE-2023-45226.md): BIG-IP Next SPK SSH vulnerability (CVSS 7.4, F5 BIG-IP Next SPK)
- [CVE-2023-45219](https://cve.now/CVE-2023-45219.md): BIG-IP tmsh vulnerability (CVSS 4.4, F5 BIG-IP)
- [CVE-2023-43746](https://cve.now/CVE-2023-43746.md): BIG-IP Appliance mode external monitor vulnerability (CVSS 8.7, F5 BIG-IP)
- [CVE-2023-43611](https://cve.now/CVE-2023-43611.md): BIG-IP Edge Client for macOS vulnerability (CVSS 7.8, F5 BIG-IP Edge Client)
- [CVE-2023-43485](https://cve.now/CVE-2023-43485.md): BIGIP and BIG-IQ TACACS+ audit log Vulnerability (CVSS 5.5, F5 BIG-IP · F5 BIG-IQ)
- [CVE-2023-42768](https://cve.now/CVE-2023-42768.md): BIG-IP iControl REST vulnerability (CVSS 7.2, F5 BIG-IP)
- [CVE-2023-41964](https://cve.now/CVE-2023-41964.md): BIG-IP and BIG-IQ Database Variable vulnerability (CVSS 4.3, F5 BIG-IP · F5 BIG-IQ)
- [CVE-2023-41373](https://cve.now/CVE-2023-41373.md): BIG-IP Configuration Utility vulnerability (CVSS 8.8, F5 BIG-IP)
- [CVE-2023-41253](https://cve.now/CVE-2023-41253.md): BIG-IP DNS TSIG Key vulnerability (CVSS 5.5, F5 BIG-IP)
- [CVE-2023-41085](https://cve.now/CVE-2023-41085.md): BIG-IP IPSEC vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-40542](https://cve.now/CVE-2023-40542.md): BIG-IP TCP Profile vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-40537](https://cve.now/CVE-2023-40537.md): Multi-blade VIPRION Configuration utility session cookie vulnerability (CVSS 8.1, F5 BIG-IP)
- [CVE-2023-40534](https://cve.now/CVE-2023-40534.md): BIG-IP HTTP/2 vulnerability (CVSS 7.5, F5 BIG-IP)
- [CVE-2023-39447](https://cve.now/CVE-2023-39447.md): BIG-IP APM Guided Configuration vulnerability (CVSS 4.4, F5 BIG-IP)
- [CVE-2023-5450](https://cve.now/CVE-2023-5450.md): BIG-IP Edge Client for macOS vulnerability (CVSS 7.3, F5 BIG-IP Edge Client)
- [CVE-2023-43788](https://cve.now/CVE-2023-43788.md): Libxpm: out of bounds read in xpmcreatexpmimagefrombuffer() (CVSS 5.5, libXpm · Red Hat Enterprise Linux)
- [CVE-2023-43787](https://cve.now/CVE-2023-43787.md): Libx11: integer overflow in xcreateimage() leading to a heap overflow (CVSS 7.8, libX11 · Red Hat Enterprise Linux)
- [CVE-2023-43786](https://cve.now/CVE-2023-43786.md): Libx11: stack exhaustion from infinite recursion in putsubimage() (CVSS 5.5, libXpm · Red Hat Enterprise Linux)
- [CVE-2023-43785](https://cve.now/CVE-2023-43785.md): Libx11: out-of-bounds memory access in \_xkbreadkeysyms() (CVSS 6.5, libX11 · Red Hat Enterprise Linux)
- [CVE-2023-45601](https://cve.now/CVE-2023-45601.md): A vulnerability has been identified in Parasolid V35.0 (All versions \< V35.0.262), Parasolid V35.1 (All versions \< V35.1.250), Parasolid V36 (CVSS 7.8, Siemens Parasolid · Siemens Tecnomatix Plant Simulation)
- [CVE-2023-45205](https://cve.now/CVE-2023-45205.md): A vulnerability has been identified in SICAM PAS/PQS (All versions \>= V8.00 \< V8.20). (CVSS 7.8, Siemens SICAM PAS/PQS)
- [CVE-2023-45204](https://cve.now/CVE-2023-45204.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0009), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2023-44315](https://cve.now/CVE-2023-44315.md): A vulnerability has been identified in SINEC NMS (All versions \< V2.0). (CVSS 4.7, Siemens SINEC NMS)
- [CVE-2023-44087](https://cve.now/CVE-2023-44087.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0009), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2023-44086](https://cve.now/CVE-2023-44086.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0009), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2023-44085](https://cve.now/CVE-2023-44085.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0009), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2023-44084](https://cve.now/CVE-2023-44084.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0009), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2023-44083](https://cve.now/CVE-2023-44083.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0009), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2023-44082](https://cve.now/CVE-2023-44082.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0009), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2023-44081](https://cve.now/CVE-2023-44081.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0009), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2023-43625](https://cve.now/CVE-2023-43625.md): A vulnerability has been identified in Simcenter Amesim (All versions \< V2021.1). (CVSS 9.8, Siemens Simcenter Amesim)
- [CVE-2023-43623](https://cve.now/CVE-2023-43623.md): A vulnerability has been identified in Mendix Forgot Password (Mendix 10 compatible) (All versions \< V5.4.0), Mendix Forgot Password (Mendix (CVSS 5.3, Siemens Mendix Forgot Password)
- [CVE-2023-42796](https://cve.now/CVE-2023-42796.md): A vulnerability has been identified in CP-8031 MASTER MODULE (All versions \< CPCI85 V05.11), CP-8050 MASTER MODULE (All versions \< CPCI85 V0 (CVSS 7.5, Siemens CP-8031 MASTER MODULE · Siemens CP-8050 MASTER MODU…)
- [CVE-2023-38640](https://cve.now/CVE-2023-38640.md): A vulnerability has been identified in SICAM PAS/PQS (All versions \>= V8.00 \< V8.22). (CVSS 6.6, Siemens SICAM PAS/PQS)
- [CVE-2023-37195](https://cve.now/CVE-2023-37195.md): A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMAT (CVSS 4.4, Siemens SIMATIC CP)
- [CVE-2023-37194](https://cve.now/CVE-2023-37194.md): A vulnerability has been identified in SIMATIC CP 1604 (All versions), SIMATIC CP 1616 (All versions), SIMATIC CP 1623 (All versions), SIMAT (CVSS 6.7, Siemens SIMATIC CP)
- [CVE-2023-36380](https://cve.now/CVE-2023-36380.md): A vulnerability has been identified in CP-8031 MASTER MODULE (All versions \< CPCI85 V05.11 (only with activated debug support)), CP-8050 MAS (CVSS 9.8, Siemens CP-8031 MASTER MODULE · Siemens CP-8050 MASTER MODU…)
- [CVE-2023-35796](https://cve.now/CVE-2023-35796.md): A vulnerability has been identified in SINEMA Server V14 (All versions). (CVSS 8.3, Siemens SINEMA Server)
- [CVE-2023-30900](https://cve.now/CVE-2023-30900.md): A vulnerability has been identified in Xpedition Layout Browser (All versions \< VX.2.14). (CVSS 7.8, Siemens Xpedition Layout Browser)
- [CVE-2022-30527](https://cve.now/CVE-2022-30527.md): A vulnerability has been identified in SINEC NMS (All versions \< V2.0). (CVSS 7.8, Siemens SINEC NMS)
- [CVE-2023-4837](https://cve.now/CVE-2023-4837.md): Cross-site request forgery (CSRF) in SmodBIP (CVSS 8.8, Jan Syski SmodBIP)
- [CVE-2023-5498](https://cve.now/CVE-2023-5498.md): Cross-Site Request Forgery (CSRF) in chiefonboarding/chiefonboarding (CVSS 4.3, chiefonboarding/chiefonboarding)
- [CVE-2023-44261](https://cve.now/CVE-2023-44261.md): WordPress Block Plugin Update Plugin \<= 3.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Dinesh Karki Block Plugin Update)
- [CVE-2023-44259](https://cve.now/CVE-2023-44259.md): WordPress Mediavine Control Panel Plugin \<= 2.10.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Mediavine Control Panel)
- [CVE-2023-44257](https://cve.now/CVE-2023-44257.md): WordPress Mang Board WP Plugin \<= 1.7.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Hometory Mang Board WP)
- [CVE-2023-41876](https://cve.now/CVE-2023-41876.md): WordPress WP Gallery Metabox Plugin \<= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Hardik Kalathiya WP Gallery Metabox)
- [CVE-2023-41858](https://cve.now/CVE-2023-41858.md): WordPress Order Delivery Date for WP e-Commerce Plugin \<= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Ashok Rane Order Delivery Date for WP e-Commerce)
- [CVE-2023-41854](https://cve.now/CVE-2023-41854.md): WordPress wpCentral Plugin \<= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Softaculous wpCentral)
- [CVE-2023-41853](https://cve.now/CVE-2023-41853.md): WordPress WP iCal Availability Plugin \<= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WP iCal Availability)
- [CVE-2023-41852](https://cve.now/CVE-2023-41852.md): WordPress MailMunch – Grow your Email List Plugin \<= 3.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, MailMunch – Grow your Email List)
- [CVE-2023-41851](https://cve.now/CVE-2023-41851.md): WordPress WP Custom Post Template Plugin \<= 1.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Dotsquares WP Custom Post Template)
- [CVE-2023-41850](https://cve.now/CVE-2023-41850.md): WordPress Outbound Link Manager Plugin \<= 1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Morris Bryant, Ruben Sargsyan Outbound Link Manager)
- [CVE-2023-41730](https://cve.now/CVE-2023-41730.md): WordPress SendPress Newsletters Plugin \<= 1.22.3.31 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, SendPress Newsletters)
- [CVE-2023-41697](https://cve.now/CVE-2023-41697.md): WordPress Easy WP Cleaner Plugin \<= 1.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Nikunj Soni Easy WP Cleaner)
- [CVE-2023-41694](https://cve.now/CVE-2023-41694.md): WordPress Realbig Plugin \<= 1.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Realbig Team Realbig For WordPress)
- [CVE-2023-41684](https://cve.now/CVE-2023-41684.md): WordPress SIS Handball Plugin \<= 1.0.45 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Felix Welberg SIS Handball)
- [CVE-2023-5467](https://cve.now/CVE-2023-5467.md): GEO my WordPress \<= 4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ninjew GEO my WP)
- [CVE-2023-5468](https://cve.now/CVE-2023-5468.md): Slick Contact Forms \<= 1.3.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, remix4 Slick Contact Forms)
- [CVE-2023-42477](https://cve.now/CVE-2023-42477.md): Server-Side Request Forgery in SAP NetWeaver AS Java (GRMG Heartbeat application) (CVSS 6.5, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2023-42475](https://cve.now/CVE-2023-42475.md): Information Disclosure Vulnerability in Statutory Reporting (CVSS 4.3, SAP\_SE SAP S/4HANA Core)
- [CVE-2023-42474](https://cve.now/CVE-2023-42474.md): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Web Intelligence (CVSS 6.8, SAP\_SE SAP BusinessObjects Web Intelligence)
- [CVE-2023-42473](https://cve.now/CVE-2023-42473.md): Missing Authorization Check In S/4HANA (Manage Withholding Tax Items) (CVSS 5.4, SAP\_SE S/4HANA)
- [CVE-2023-41365](https://cve.now/CVE-2023-41365.md): Information Disclosure vulnerability in SAP Business One (B1i) (CVSS 4.3, SAP\_SE SAP Business One)
- [CVE-2023-40310](https://cve.now/CVE-2023-40310.md): Missing XML Validation vulnerability in SAP PowerDesigner Client BPMN2 import (CVSS 6.5, SAP\_SE SAP PowerDesigner Client)
- [CVE-2023-5471](https://cve.now/CVE-2023-5471.md): codeprojects Farmacia index.php sql injection (CVSS 6.3, codeprojects Farmacia)
- [CVE-2020-18336](https://cve.now/CVE-2020-18336.md): Cross Site Scripting (XSS) vulnerability found in Typora v.0.9.65 allows a remote attacker to obtain sensitive information via the PDF file (no CVSS)
- [CVE-2020-27213](https://cve.now/CVE-2020-27213.md): An issue was discovered in Ethernut Nut/OS 5.1. (no CVSS)
- [CVE-2020-27630](https://cve.now/CVE-2020-27630.md): In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random. (no CVSS)
- [CVE-2020-27631](https://cve.now/CVE-2020-27631.md): In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random. (no CVSS)
- [CVE-2020-27633](https://cve.now/CVE-2020-27633.md): In FNET 4.6.3, TCP ISNs are improperly random. (no CVSS)
- [CVE-2020-27634](https://cve.now/CVE-2020-27634.md): In Contiki 4.5, TCP ISNs are improperly random. (no CVSS)
- [CVE-2020-27635](https://cve.now/CVE-2020-27635.md): In PicoTCP 1.7.0, TCP ISNs are improperly random. (no CVSS)
- [CVE-2020-27636](https://cve.now/CVE-2020-27636.md): In Microchip MPLAB Net 3.6.1, TCP ISNs are improperly random. (no CVSS)
- [CVE-2023-31096](https://cve.now/CVE-2023-31096.md): An issue was discovered in Broadcom) LSI PCI-SV92EX Soft Modem Kernel Driver through 2.2.100.1 (aka AGRSM64.sys). (no CVSS)
- [CVE-2023-36126](https://cve.now/CVE-2023-36126.md): There is a Cross Site Scripting (XSS) vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0 (no CVSS)
- [CVE-2023-36127](https://cve.now/CVE-2023-36127.md): User enumeration is found in in PHPJabbers Appointment Scheduler 3.0. (no CVSS)
- [CVE-2023-42189](https://cve.now/CVE-2023-42189.md): Insecure Permissions vulnerability in Connectivity Standards Alliance Matter Official SDK v.1.1.0.0 , Nanoleaf Light strip v.3.5.10, Govee L (no CVSS)
- [CVE-2023-43896](https://cve.now/CVE-2023-43896.md): A buffer overflow in Macrium Reflect 8.1.7544 and below allows attackers to escalate privileges or execute arbitrary code. (no CVSS)
- [CVE-2023-44487](https://cve.now/CVE-2023-44487.md): The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as (CVSS 7.5, KEV, apisix · aspnet-core +20)
- [CVE-2023-44763](https://cve.now/CVE-2023-44763.md): Concrete CMS v9.2.1 is affected by an Arbitrary File Upload vulnerability via a Thumbnail file upload, which allows Cross-Site Scripting (XS (no CVSS, concrete5/concrete5)
- [CVE-2023-44826](https://cve.now/CVE-2023-44826.md): Cross Site Scripting vulnerability in ZenTaoPMS v.18.6 allows a local attacker to obtain sensitive information via a crafted script. (no CVSS)
- [CVE-2023-44827](https://cve.now/CVE-2023-44827.md): An issue in ZenTao Community Edition v.18.6 and before, ZenTao Biz v.8.6 and before, ZenTao Max v.4.7 and before allows an attacker to execu (no CVSS)
- [CVE-2023-44846](https://cve.now/CVE-2023-44846.md): An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin\_ notify.php component. (no CVSS)
- [CVE-2023-44847](https://cve.now/CVE-2023-44847.md): An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin\_ Weixin.php component. (no CVSS)
- [CVE-2023-44848](https://cve.now/CVE-2023-44848.md): An issue in SeaCMS v.12.8 allows an attacker to execute arbitrary code via the admin\_template.php component. (no CVSS)
- [CVE-2023-44959](https://cve.now/CVE-2023-44959.md): An issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP Ad (CVSS 8.8)
- [CVE-2023-45208](https://cve.now/CVE-2023-45208.md): A command injection in the parsing\_xml\_stasurvey function inside libcgifunc.so of the D-Link DAP-X1860 repeater 1.00 through 1.01b05-01 allo (no CVSS)
- [CVE-2023-45312](https://cve.now/CVE-2023-45312.md): In the mtproto\_proxy (aka MTProto proxy) component through 0.7.2 for Erlang, a low-privileged remote attacker can access an improperly secur (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.