CVEs published October 11, 2023
111 CVEs were published on October 11, 2023: 13 critical, 21 high.
- Published
- 111
- Critical
- 13
- High
- 21
- Medium
- 20
- Low
- 2
- Unrated
- 55
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 20
- Google Android
- 15
- Google Chrome
- 14
- Yifan YF325
- 13
- Peplink Surf SOHO HW1
- 6
- Juniper Networks Junos OS Evolved
- 3
- vantage6
- 3
- Xiaomi Router
- 3
- Adobe Bridge
- 2
- HCL Software BigFix Insights for Vulnerability Remediation
- 2
Critical 13
- CVE-2023-45132IgnoreIP/IgnoreCIDR should not trust X-Forwarded-Forwargio naxsi
- CVE-2023-43661Cachet vulnerable to Authenticated Remote Code Executioncachethq cachet · cachethq/cachet
- CVE-2023-32645A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-24479An authentication bypass vulnerability exists in the httpd nvram.cgi functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-34365A stack-based buffer overflow vulnerability exists in the libutils.so nvram_restore functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-34346A stack-based buffer overflow vulnerability exists in the httpd gwcfg.cgi get functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-34426A stack-based buffer overflow vulnerability exists in the httpd manage_request functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-35966Two heap-based buffer overflow vulnerabilities exist in the httpd manage_post functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-35965Two heap-based buffer overflow vulnerabilities exist in the httpd manage_post functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-35968Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-35967Two heap-based buffer overflow vulnerabilities exist in the gwcfg_cgi_set_manage_post_data functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-37538HCL Digital Experience is susceptible to cross site scripting (XSS)HCL Software Digital Experience
- CVE-2023-44981Apache ZooKeeper: Authorization bypass in SASL Quorum Peer AuthenticationApache Software Foundation Apache ZooKeeper · org.apache.zo…
High 21
- CVE-2023-1943Privilege Escalation in kOps using GCE/GCP Provider in Gossip ModeKubernetes kops · k8s.io/kops
- CVE-2023-5474Heap buffer overflow in PDF in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who convinced a user to engage in specific useGoogle Chrome
- CVE-2023-5476Use after free in Blink History in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2023-5218Use after free in Site Isolation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2023-44186Junos OS and Junos OS Evolved: RPD crash when attempting to send a very long AS PATH to a non-4-byte-AS capable BGP neighborJuniper Networks Junos OS
- CVE-2023-5535Use After Free in vim/vimvim/vim
- CVE-2023-34356An OS command injection vulnerability exists in the data.cgi xfer_dns functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).Peplink Surf SOHO HW1
- CVE-2023-28381An OS command injection vulnerability exists in the admin.cgi MVPN_trial_init functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).Peplink Surf SOHO HW1
- CVE-2023-27380An OS command injection vulnerability exists in the admin.cgi USSD_send functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).Peplink Surf SOHO HW1
- CVE-2023-35194An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).Peplink Surf SOHO HW1
- CVE-2023-35193An OS command injection vulnerability exists in the api.cgi cmd.mvpn.x509.write functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).Peplink Surf SOHO HW1
- CVE-2023-35056A buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-35055A buffer overflow vulnerability exists in the httpd next_page functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-31272A stack-based buffer overflow vulnerability exists in the httpd do_wds functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-32632A command execution vulnerability exists in the validate.so diag_ping_start functionality of Yifan YF325 v1.0_20221108.Yifan YF325
- CVE-2023-44108Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-5521Incorrect Authorization in tiann/kernelsutiann/kernelsu
- CVE-2023-26370ZDI-CAN-21257: Adobe Photoshop PSD File Parsing Uninitialized Variable Remote Code Execution VulnerabilityAdobe Photoshop Desktop
- CVE-2023-4990Directory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow attackers to read arbitrary files.MCL Technologies MCL-Net
- CVE-2023-26320Xiaomi Router external request interface vulnerability leads to stack overflowXiaomi Router
- CVE-2023-37536HCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.3HCL Software BigFix Platform
Medium, low and unrated 77
- CVE-2023-5473Use after free in Cast in Google Chrome prior to 118.0.5993.70 allowed a remote attacker who had compromised the renderer process to potentiGoogle Chrome
- CVE-2023-5486Inappropriate implementation in Input in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafted HGoogle Chrome
- CVE-2023-5477Inappropriate implementation in Installer in Google Chrome prior to 118.0.5993.70 allowed a local attacker to bypass discretionary access coGoogle Chrome
- CVE-2023-5478Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to leak cross-origin data via a cGoogle Chrome
- CVE-2023-5485Inappropriate implementation in Autofill in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass autofill restrictions vGoogle Chrome
- CVE-2023-5479Inappropriate implementation in Extensions API in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install aGoogle Chrome
- CVE-2023-5481Inappropriate implementation in Downloads in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a craftGoogle Chrome
- CVE-2023-5483Inappropriate implementation in Intents in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to bypass content security policy Google Chrome
- CVE-2023-5475Inappropriate implementation in DevTools in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malicGoogle Chrome
- CVE-2023-5484Inappropriate implementation in Navigation in Google Chrome prior to 118.0.5993.70 allowed a remote attacker to spoof security UI via a crafGoogle Chrome
- CVE-2023-5487Inappropriate implementation in Fullscreen in Google Chrome prior to 118.0.5993.70 allowed an attacker who convinced a user to install a malGoogle Chrome
- CVE-2023-39325HTTP/2 rapid reset can cause excessive work in net/httpGo standard library net/http · golang.org/x/net/http2 +2
- CVE-2023-44190Junos OS Evolved: PTX10001, PTX10004, PTX10008, PTX10016: MAC address validation bypass vulnerabilityJuniper Networks Junos OS Evolved
- CVE-2023-44189Junos OS Evolved: PTX10003 Series: MAC address validation bypass vulnerabilityJuniper Networks Junos OS Evolved
- CVE-2023-44188Junos OS: jkdsd crash due to multiple telemetry requestsJuniper Networks Junos OS
- CVE-2023-44187Junos OS Evolved: 'file copy' CLI command can disclose password to shell usersJuniper Networks Junos OS Evolved
- CVE-2023-3781there is a possible use-after-free write due to improper locking.Google Android
- CVE-2023-41882vantage6 Improper Access Control vulnerabilityvantage6
- CVE-2023-41881Deleting a collaboration should also delete linked resourcesvantage6
- CVE-2023-40142In TBD of TBD, there is a possible way to bypass carrier restrictions due to a logic error in the code.Google Android
- CVE-2023-40141In temp_residency_name_store of thermal_metrics.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2023-35662there is a possible out of bounds write due to buffer overflow.Google Android
- CVE-2023-35661In ProfSixDecomTcpSACKoption of RohcPacketCommon.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-35660In lwis_transaction_client_cleanup of lwis_transaction.c, there is a possible way to corrupt memory due to a use after free.Google Android
- CVE-2023-35655In CanConvertPadV2Op of darwinn_mlir_converter_aidl.cc, there is a possible out of bounds read due to a heap buffer overflow.Google Android
- CVE-2023-35654In ctrl_roi of stmvl53l1_module.c, there is a possible out of bounds read due to an incorrect bounds check.Google Android
- CVE-2023-28635Defining resource name as integer in vantage6 may give unintended accessvantage6 · vantage6-node
- CVE-2023-35653In TBD of TBD, there is a possible way to access location information due to a permissions bypass.Google Android
- CVE-2023-35652In ProtocolEmergencyCallListIndAdapter::Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds checGoogle Android
- CVE-2023-35649In several functions of Exynos modem files, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2023-35648In ProtocolMiscLceIndAdapter::GetConfLevel() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds checGoogle Android
- CVE-2023-35647In ProtocolEmbmsGlobalCellIdAdapter::Init() of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds checGoogle Android
- CVE-2023-35646In TBD of TBD, there is a possible stack buffer overflow due to a missing bounds check.Google Android
- CVE-2023-35645In tbd of tbd, there is a possible memory corruption due to a race condition.Google Android
- CVE-2023-23930vantage6's Pickle serialization is insecurevantage6
- CVE-2023-4936Synaptics-DisplayLink-privilege escalation vulnerability via a dynamic library sideloadingSynaptics DisplayLink USB Graphics Software for Windows
- CVE-2023-34354A stored cross-site scripting (XSS) vulnerability exists in the upload_brand.cgi functionality of peplink Surf SOHO HW1 v6.3.5 (in QEMU).Peplink Surf SOHO HW1
- CVE-2023-4957Authentication Bypass on Zebra ZTCZebra Technologies ZTC ZT410
- CVE-2023-44107 Vulnerability of defects introduced in the design process in the screen projection module.Successful exploitation of this vulnerability mayHuawei HarmonyOS
- CVE-2023-44105Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this vulnerability may cHuawei HarmonyOS · Huawei EMUI
- CVE-2023-44119Vulnerability of mutual exclusion management in the kernel module.Successful exploitation of this vulnerability will affect availability.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-44118Vulnerability of undefined permissions in the MeeTime module.Successful exploitation of this vulnerability will affect availability and confHuawei HarmonyOS · Huawei EMUI
- CVE-2023-44116Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this vulnerability may caHuawei HarmonyOS · Huawei EMUI
- CVE-2023-44114Out-of-bounds array vulnerability in the dataipa module.Successful exploitation of this vulnerability may affect service confidentiality.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-44111Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service coHuawei HarmonyOS · Huawei EMUI
- CVE-2023-44110Out-of-bounds access vulnerability in the audio module.Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-41304Parameter verification vulnerability in the window module.Successful exploitation of this vulnerability may cause the size of an app window Huawei HarmonyOS · Huawei EMUI
- CVE-2023-5520Out-of-bounds Read in gpac/gpacgpac/gpac
- CVE-2023-44106API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may cause features to perforHuawei HarmonyOS · Huawei EMUI
- CVE-2023-44104Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidenHuawei HarmonyOS · Huawei EMUI
- CVE-2023-44103Out-of-bounds read vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidentiality.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-44102Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability can cause the Bluetooth funHuawei HarmonyOS · Huawei EMUI
- CVE-2023-44101The Bluetooth module has a vulnerability in permission control for broadcast notifications.Successful exploitation of this vulnerability mayHuawei HarmonyOS
- CVE-2023-44100Broadcast permission control vulnerability in the Bluetooth module.Successful exploitation of this vulnerability may affect service confidenHuawei HarmonyOS · Huawei EMUI
- CVE-2023-44097Vulnerability of the permission to access device SNs being improperly managed.Successful exploitation of this vulnerability may affect serviHuawei HarmonyOS · Huawei EMUI
- CVE-2023-44095Use-After-Free (UAF) vulnerability in the surfaceflinger module.Successful exploitation of this vulnerability can cause system crash.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-38217ZDI-CAN-21403: Adobe Bridge Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Bridge
- CVE-2023-38216ZDI-CAN-21404: Adobe Bridge Font Parsing Use-After-Free Information Disclosure VulnerabilityAdobe Bridge
- CVE-2023-44094Type confusion vulnerability in the distributed file module.Successful exploitation of this vulnerability may cause the device to restart.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-44109Clone vulnerability in the huks ta module.Successful exploitation of this vulnerability may affect service confidentiality.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-44096 Vulnerability of brute-force attacks on the device authentication module.Successful exploitation of this vulnerability may affect service cHuawei HarmonyOS · Huawei EMUI
- CVE-2023-44093Vulnerability of package names' public keys not being verified in the security module.Successful exploitation of this vulnerability may affeHuawei HarmonyOS · Huawei EMUI
- CVE-2023-42138Out-of-bounds read vulnerability exists in KV STUDIO Ver.KEYENCE KV STUDIO · KEYENCE KV REPLAY VIEWER
- CVE-2023-44997WordPress WP Forms Puzzle Captcha Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF)Nitin Rathod WP Forms Puzzle Captcha
- CVE-2023-26319Xiaomi Router administration interface vulnerability leads command injection and stack overflowXiaomi Router
- CVE-2023-26318Xiaomi router web interface post-authorization stack overflowXiaomi Router
- CVE-2022-44757HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to weak cryptographyHCL Software BigFix Insights for Vulnerability Remediation
- CVE-2022-44758HCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper credential handlingHCL Software BigFix Insights for Vulnerability Remediation
- CVE-2022-42451HCL BigFix Patch Management is vulnerable to insecurely stored credentialsHCL Software BigFix Patch Management
- CVE-2023-45194Use of default credentials vulnerability in MR-GM2 firmware Ver.Micro Research MR-GM2 · Micro Research MR-GM3
- CVE-2023-44689e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 Digital Agency e-Gov Client Application
- CVE-2023-5511Cross-Site Request Forgery (CSRF) in snipe/snipe-itsnipe/snipe-it
- CVE-2023-38817An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echo_driver.sys co
- CVE-2023-43960An issue in DLINK DPH-400SE FRU 2.2.15.8 allows a remote attacker to escalate privileges via the User Modify function in the Maintenance/Acc
- CVE-2023-44961SQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote attacker to obtain sensitive information via the i
- CVE-2023-44962File Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker to read arbitrary files via the upload-cover
- CVE-2023-45396An Insecure Direct Object Reference (IDOR) vulnerability leads to events profiles access in Elenos ETG150 FM transmitter running on version