CVEs published October 12, 2023
87 CVEs were published on October 12, 2023: 9 critical, 26 high.
- Published
- 87
- Critical
- 9
- High
- 26
- Medium
- 40
- Low
- 1
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 44
Most affected products
- Juniper Networks Junos OS
- 23
- SoftEther VPN
- 9
- Zabbix
- 5
- Juniper Networks Junos OS Evolved
- 2
- NetApp SnapCenter
- 2
- Arul Prasad J Publish Confirm Message
- 1
- babel · @babel/traverse +1
- 1
- Biltay Technology Kayisi
- 1
- Biltay Technology Procost
- 1
- Contact Form by Supsystic
- 1
Critical 9
- CVE-2023-45138Change Request Application vulnerable to XSS and remote code execution through change request titlexwiki-contrib application-changerequest · org.xwiki.contrib…
- CVE-2023-45133Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious codebabel · @babel/traverse +1
- CVE-2023-27395A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674SoftEther VPN
- CVE-2023-5045SQLi in Biltay's KayısıBiltay Technology Kayisi
- CVE-2023-5046SQLi in Biltay's ProcostBiltay Technology Procost
- CVE-2023-23737WordPress MainWP Broken Links Checker Extension Plugin <= 4.0 is vulnerable to SQL InjectionMainWP Broken Links Checker Extension
- CVE-2023-32724JavaScript engine memory pointers are directly available for Zabbix users for modificationZabbix
- CVE-2023-32722Stack-buffer Overflow in library module zbxjsonZabbix
- CVE-2023-29453Agent 2 package are built with Go version affected by CVE-2023-24538Zabbix
High 26
- CVE-2023-5563The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG_CAN_AUTO_BUS_OFF_RECOzephyrproject-rtos Zephyr
- CVE-2023-44199Junos OS: MX Series: In a PTP scenario a prolonged routing protocol churn can trigger an FPC rebootJuniper Networks Junos OS
- CVE-2023-44197Junos OS and Junos OS Evolved: An rpd crash may occur when BGP is processing newly learned routesJuniper Networks Junos OS
- CVE-2023-44194Junos OS: An unauthenticated attacker with local access to the device can create a backdoor with root privilegesJuniper Networks Junos OS
- CVE-2023-44192Junos OS: QFX5000 Series: DMA memory leak is observed when specific DHCP packets are transmitted over pseudo-VTEPJuniper Networks Junos OS
- CVE-2023-44191Junos OS: QFX5000 Series and EX4000 Series: Denial of Service (DoS) on a large scale VLAN due to PFE hoggingJuniper Networks Junos OS
- CVE-2023-44185Junos OS and Junos OS Evolved: In an BGP scenario RPD crashes upon receiving and processing a specific malformed ISO VPN BGP UPDATE packetJuniper Networks Junos OS
- CVE-2023-44182Junos OS and Junos OS Evolved: An Unchecked Return Value in multiple users interfaces affects confidentiality and integrity of device operationsJuniper Networks Junos OS
- CVE-2023-44181Junos OS: QFX5k: l2 loop in the overlay impacts the stability in a EVPN/VXLAN environmentJuniper Networks Junos OS
- CVE-2023-36843Junos OS: SRX Series: The PFE will crash on receiving malformed SSL traffic when Sky ATP is enabledJuniper Networks Junos OS
- CVE-2023-36841Junos OS: MX Series: Receipt of malformed TCP traffic will cause a Denial of ServiceJuniper Networks Junos OS
- CVE-2023-27316Privilege Escalation Vulnerability in SnapCenterNetApp SnapCenter
- CVE-2023-27314Denial of Service Vulnerability in ONTAP 9NetApp ONTAP
- CVE-2023-27313Privilege Escalation Vulnerability in SnapCenterNetApp SnapCenter
- CVE-2023-45142OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metricsopen-telemetry opentelemetry-go-contrib · go.opentelemet… +6
- CVE-2023-5072DoS Vulnerability in JSON-Javaorg.json:json
- CVE-2023-22308An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02.SoftEther VPN
- CVE-2023-23581A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02.SoftEther VPN
- CVE-2023-25774A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02.SoftEther VPN
- CVE-2023-27516An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674.SoftEther VPN
- CVE-2023-32634An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta.SoftEther VPN
- CVE-2023-23651WordPress MainWP Google Analytics Extension Plugin <= 4.0.4 - SQL Injection vulnerabilityMainWP Google Analytics Extension
- CVE-2023-5555Cross-site Scripting (XSS) - Generic in frappe/lmsfrappe/lms
- CVE-2023-45047WordPress LeadSquared Suite Plugin <= 0.7.4 is vulnerable to Cross Site Request Forgery (CSRF)LeadSquared Suite
- CVE-2023-32723Inefficient permission check in class CControllerAuthenticationUpdateZabbix
- CVE-2023-32721Stored XSS in Maps elementZabbix
Medium, low and unrated 52
- CVE-2023-44204Junos OS and Junos OS Evolved: The rpd will crash upon receiving a malformed BGP UPDATE messageJuniper Networks Junos OS
- CVE-2023-44203Junos OS: QFX5000 Series, EX2300, EX3400, EX4100, EX4400 and EX4600: Packet flooding will occur when IGMP traffic is sent to an isolated VLANJuniper Networks Junos OS
- CVE-2023-44201Junos OS and Junos OS Evolved: A local attacker can retrieve sensitive information and elevate privileges on the device to an authorized user. Juniper Networks Junos OS
- CVE-2023-44198Junos OS: SRX Series and MX Series: SIP ALG doesn't drop specifically malformed retransmitted SIP packetsJuniper Networks Junos OS
- CVE-2023-44196Junos OS Evolved: PTX10003 Series: Packets which are not destined to the router can reach the REJuniper Networks Junos OS Evolved
- CVE-2023-44195Junos OS Evolved: Packets which are not destined to the router can reach the REJuniper Networks Junos OS Evolved
- CVE-2023-44193Junos OS: MX Series: An FPC crash is observed when CFM is enabled in a VPLS scenario and a specific LDP related command is runJuniper Networks Junos OS
- CVE-2023-44184Junos OS and Junos OS Evolved: High CPU load due to specific NETCONF commandJuniper Networks Junos OS
- CVE-2023-44183Junos OS: QFX5000 Series, EX4600 Series: In a VxLAN scenario an adjacent attacker within the VxLAN sending genuine packets may cause a DMA memory leak to occur.Juniper Networks Junos OS
- CVE-2023-44178Junos OS : Stack overflow vulnerability in CLI command processingJuniper Networks Junos OS
- CVE-2023-44176Junos OS : Stack overflow vulnerability in CLI command processingJuniper Networks Junos OS
- CVE-2023-44177Junos OS and Junos OS Evolved: Stack overflow vulnerability in CLI command processingJuniper Networks Junos OS
- CVE-2023-44175Junos OS and Junos OS Evolved: Receipt of a specific genuine PIM packet causes RPD crashJuniper Networks Junos OS
- CVE-2023-36839Junos OS and Junos OS Evolved: An l2cpd crash will occur when specific LLDP packets are receivedJuniper Networks Junos OS
- CVE-2023-22392Junos OS: PTX Series and QFX10000 Series: Received flow-routes which aren't installed as the hardware doesn't support them, lead to an FPC heap memory leakJuniper Networks Junos OS
- CVE-2023-5562Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business HubKNIME Analytics Platform
- CVE-2023-27312Privilege Escalation Vulnerability in SnapCenter Plugin for VMware vSphere NetApp SnapCenter Plugin for VMware vSphere
- CVE-2023-45143Undici's cookie header not cleared on cross-origin redirect in fetchnodejs undici · undici
- CVE-2023-22325A denial of service vulnerability exists in the DCRegister DDNS_RPC_MAX_RECV_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 aSoftEther VPN
- CVE-2023-32275An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674.SoftEther VPN
- CVE-2023-31192An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674.SoftEther VPN
- CVE-2023-45106WordPress Urvanov Syntax Highlighter Plugin <= 2.8.33 is vulnerable to Cross Site Request Forgery (CSRF)Fedor Urvanov, Aram Kocharyan Urvanov Syntax Highlighter
- CVE-2023-45103WordPress Permalinks Customizer Plugin <= 2.8.2 is vulnerable to Cross Site Request Forgery (CSRF)YAS Global Team Permalinks Customizer
- CVE-2023-45102WordPress Blog Manager Light Plugin <= 1.20 is vulnerable to Cross Site Request Forgery (CSRF)OTWthemes Blog Manager Light
- CVE-2023-41131WordPress Sp*tify Play Button for WordPress Plugin <= 2.10 is vulnerable to Cross Site Request Forgery (CSRF)Jonk @ Follow me Darling Sp*tify Play Button for WordPress
- CVE-2023-32124WordPress Publish Confirm Message Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)Arul Prasad J Publish Confirm Message
- CVE-2023-27315Information Disclosure Vulnerability in SnapGathers NetApp SnapGathers
- CVE-2023-45068WordPress Contact Form by Supsystic Plugin <= 1.7.27 is vulnerable to Cross Site Request Forgery (CSRF)Contact Form by Supsystic
- CVE-2023-45063WordPress AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)ReCorp AI Content Writing Assistant (Content Writer, GPT 3…
- CVE-2023-45060WordPress Interactive World Map Plugin <= 3.2.0 is vulnerable to Cross Site Request Forgery (CSRF)Fla-shop.com Interactive World Map
- CVE-2023-45058WordPress Short URL Plugin <= 1.6.8 is vulnerable to Cross Site Request Forgery (CSRF)KaizenCoders Short URL
- CVE-2023-45052WordPress WP Bing Map Pro Plugin < 5.0 is vulnerable to Cross Site Request Forgery (CSRF)dan009 WP Bing Map Pro
- CVE-2023-45048WordPress Social proof testimonials and reviews by Repuso Plugin <= 5.00 is vulnerable to Cross Site Request Forgery (CSRF)Social proof testimonials and reviews by Repuso
- CVE-2023-45011WordPress WP Power Stats Plugin <= 2.2.3 is vulnerable to Cross Site Request Forgery (CSRF)Igor Buyanov WP Power Stats
- CVE-2023-44998WordPress Category Meta Plugin <= 1.2.8 is vulnerable to Cross Site Request Forgery (CSRF)josecoelho, Randy Hoyt, steveclarkcouk, Vitaliy Kukin, Eric…
- CVE-2023-43789Libxpm: out of bounds read on xpm with corrupted colormaplibXpm · Red Hat Enterprise Linux
- CVE-2023-5556Cross-site Scripting (XSS) - Reflected in structurizr/onpremisesstructurizr/onpremises
- CVE-2023-5554Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.16.0.LINE client for iOS
- CVE-2023-5470Etsy Shop <= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodefsheedy Etsy Shop
- CVE-2023-5531Thumbnail Slider With Lightbox <= 1.0 - Cross-Site Request Forgerynik00726 Thumbnail Slider With Lightbox
- CVE-2023-23632BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass.
- CVE-2023-40829There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.5.x and 2.6.930000.
- CVE-2023-40833An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting.
- CVE-2023-41261An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1.
- CVE-2023-41262An issue was discovered in /fcgi/scrut_fcgi.fcgi in Plixer Scrutinizer before 19.3.1.
- CVE-2023-41263An issue was discovered in Plixer Scrutinizer before 19.3.1.
- CVE-2023-42298An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q_DecCoordOnUnitSphere function of fil
- CVE-2023-43147PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka
- CVE-2023-43148SPA-Cart 1.9.0.3 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to delete all accounts.
- CVE-2023-43149SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery (CSRF) that allows a remote attacker to add an admin user with role status.
- CVE-2023-45510tsMuxer version git-2539d07 was discovered to contain an alloc-dealloc-mismatch (operator new [] vs operator delete) error.
- CVE-2023-45511A memory leak in tsMuxer version git-2539d07 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file.