# CVEs published 2023-10-12

87 CVEs were published on October 12, 2023: 9 critical, 26 high. Days are UTC.

- [CVE-2023-5563](https://cve.now/CVE-2023-5563.md): The SJA1000 CAN controller driver backend automatically attempt to recover from a bus-off event when built with CONFIG\_CAN\_AUTO\_BUS\_OFF\_RECO (CVSS 7.1, zephyrproject-rtos Zephyr)
- [CVE-2023-44204](https://cve.now/CVE-2023-44204.md): Junos OS and Junos OS Evolved: The rpd will crash upon receiving a malformed BGP UPDATE message (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-44203](https://cve.now/CVE-2023-44203.md): Junos OS: QFX5000 Series, EX2300, EX3400, EX4100, EX4400 and EX4600: Packet flooding will occur when IGMP traffic is sent to an isolated VLAN (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-44201](https://cve.now/CVE-2023-44201.md): Junos OS and Junos OS Evolved: A local attacker can retrieve sensitive information and elevate privileges on the device to an authorized user. (CVSS 5.0, Juniper Networks Junos OS)
- [CVE-2023-44199](https://cve.now/CVE-2023-44199.md): Junos OS: MX Series: In a PTP scenario a prolonged routing protocol churn can trigger an FPC reboot (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-44198](https://cve.now/CVE-2023-44198.md): Junos OS: SRX Series and MX Series: SIP ALG doesn't drop specifically malformed retransmitted SIP packets (CVSS 5.8, Juniper Networks Junos OS)
- [CVE-2023-44197](https://cve.now/CVE-2023-44197.md): Junos OS and Junos OS Evolved: An rpd crash may occur when BGP is processing newly learned routes (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-44196](https://cve.now/CVE-2023-44196.md): Junos OS Evolved: PTX10003 Series: Packets which are not destined to the router can reach the RE (CVSS 6.5, Juniper Networks Junos OS Evolved)
- [CVE-2023-44195](https://cve.now/CVE-2023-44195.md): Junos OS Evolved: Packets which are not destined to the router can reach the RE (CVSS 5.4, Juniper Networks Junos OS Evolved)
- [CVE-2023-44194](https://cve.now/CVE-2023-44194.md): Junos OS: An unauthenticated attacker with local access to the device can create a backdoor with root privileges (CVSS 8.4, Juniper Networks Junos OS)
- [CVE-2023-44193](https://cve.now/CVE-2023-44193.md): Junos OS: MX Series: An FPC crash is observed when CFM is enabled in a VPLS scenario and a specific LDP related command is run (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2023-44192](https://cve.now/CVE-2023-44192.md): Junos OS: QFX5000 Series: DMA memory leak is observed when specific DHCP packets are transmitted over pseudo-VTEP (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-44191](https://cve.now/CVE-2023-44191.md): Junos OS: QFX5000 Series and EX4000 Series: Denial of Service (DoS) on a large scale VLAN due to PFE hogging (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-44185](https://cve.now/CVE-2023-44185.md): Junos OS and Junos OS Evolved: In an BGP scenario RPD crashes upon receiving and processing a specific malformed ISO VPN BGP UPDATE packet (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-44184](https://cve.now/CVE-2023-44184.md): Junos OS and Junos OS Evolved: High CPU load due to specific NETCONF command (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-44183](https://cve.now/CVE-2023-44183.md): Junos OS: QFX5000 Series, EX4600 Series: In a VxLAN scenario an adjacent attacker within the VxLAN sending genuine packets may cause a DMA memory leak to occur. (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-44182](https://cve.now/CVE-2023-44182.md): Junos OS and Junos OS Evolved: An Unchecked Return Value in multiple users interfaces affects confidentiality and integrity of device operations (CVSS 7.3, Juniper Networks Junos OS)
- [CVE-2023-44181](https://cve.now/CVE-2023-44181.md): Junos OS: QFX5k: l2 loop in the overlay impacts the stability in a EVPN/VXLAN environment (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-44178](https://cve.now/CVE-2023-44178.md): Junos OS : Stack overflow vulnerability in CLI command processing (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2023-44176](https://cve.now/CVE-2023-44176.md): Junos OS : Stack overflow vulnerability in CLI command processing (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2023-44177](https://cve.now/CVE-2023-44177.md): Junos OS and Junos OS Evolved: Stack overflow vulnerability in CLI command processing (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2023-44175](https://cve.now/CVE-2023-44175.md): Junos OS and Junos OS Evolved: Receipt of a specific genuine PIM packet causes RPD crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-36843](https://cve.now/CVE-2023-36843.md): Junos OS: SRX Series: The PFE will crash on receiving malformed SSL traffic when Sky ATP is enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-36841](https://cve.now/CVE-2023-36841.md): Junos OS: MX Series: Receipt of malformed TCP traffic will cause a Denial of Service (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-36839](https://cve.now/CVE-2023-36839.md): Junos OS and Junos OS Evolved: An l2cpd crash will occur when specific LLDP packets are received (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-22392](https://cve.now/CVE-2023-22392.md): Junos OS: PTX Series and QFX10000 Series: Received flow-routes which aren't installed as the hardware doesn't support them, lead to an FPC heap memory leak (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-27316](https://cve.now/CVE-2023-27316.md): Privilege Escalation Vulnerability in SnapCenter (CVSS 8.8, NetApp SnapCenter)
- [CVE-2023-5562](https://cve.now/CVE-2023-5562.md): Unsafe default allows for cross-site scripting attacks in KNIME Server and KNIME Business Hub (CVSS 6.1, KNIME Analytics Platform)
- [CVE-2023-27314](https://cve.now/CVE-2023-27314.md): Denial of Service Vulnerability in ONTAP 9 (CVSS 7.5, NetApp ONTAP)
- [CVE-2023-27313](https://cve.now/CVE-2023-27313.md): Privilege Escalation Vulnerability in SnapCenter (CVSS 8.3, NetApp SnapCenter)
- [CVE-2023-27312](https://cve.now/CVE-2023-27312.md): Privilege Escalation Vulnerability in SnapCenter Plugin for VMware vSphere (CVSS 5.4, NetApp SnapCenter Plugin for VMware vSphere)
- [CVE-2023-45143](https://cve.now/CVE-2023-45143.md): Undici's cookie header not cleared on cross-origin redirect in fetch (CVSS 3.9, nodejs undici · undici)
- [CVE-2023-45142](https://cve.now/CVE-2023-45142.md): OpenTelemetry-Go Contrib has DoS vulnerability in otelhttp due to unbound cardinality metrics (CVSS 7.5, open-telemetry opentelemetry-go-contrib · go.opentelemet… +6)
- [CVE-2023-45138](https://cve.now/CVE-2023-45138.md): Change Request Application vulnerable to XSS and remote code execution through change request title (CVSS 10.0, xwiki-contrib application-changerequest · org.xwiki.contrib…)
- [CVE-2023-45133](https://cve.now/CVE-2023-45133.md): Babel vulnerable to arbitrary code execution when compiling specifically crafted malicious code (CVSS 9.4, babel · @babel/traverse +1)
- [CVE-2023-5072](https://cve.now/CVE-2023-5072.md): DoS Vulnerability in JSON-Java (CVSS 7.5, org.json:json)
- [CVE-2023-27395](https://cve.now/CVE-2023-27395.md): A heap-based buffer overflow vulnerability exists in the vpnserver WpcParsePacket() functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 (CVSS 9.0, SoftEther VPN)
- [CVE-2023-22325](https://cve.now/CVE-2023-22325.md): A denial of service vulnerability exists in the DCRegister DDNS\_RPC\_MAX\_RECV\_SIZE functionality of SoftEther VPN 4.41-9782-beta, 5.01.9674 a (CVSS 5.9, SoftEther VPN)
- [CVE-2023-22308](https://cve.now/CVE-2023-22308.md): An integer underflow vulnerability exists in the vpnserver OvsProcessData functionality of SoftEther VPN 5.01.9674 and 5.02. (CVSS 7.5, SoftEther VPN)
- [CVE-2023-23581](https://cve.now/CVE-2023-23581.md): A denial-of-service vulnerability exists in the vpnserver EnSafeHttpHeaderValueStr functionality of SoftEther VPN 5.01.9674 and 5.02. (CVSS 7.5, SoftEther VPN)
- [CVE-2023-25774](https://cve.now/CVE-2023-25774.md): A denial-of-service vulnerability exists in the vpnserver ConnectionAccept() functionality of SoftEther VPN 5.02. (CVSS 7.5, SoftEther VPN)
- [CVE-2023-32275](https://cve.now/CVE-2023-32275.md): An information disclosure vulnerability exists in the CtEnumCa() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. (CVSS 5.5, SoftEther VPN)
- [CVE-2023-27516](https://cve.now/CVE-2023-27516.md): An authentication bypass vulnerability exists in the CiRpcAccepted() functionality of SoftEther VPN 4.41-9782-beta and 5.01.9674. (CVSS 7.3, SoftEther VPN)
- [CVE-2023-32634](https://cve.now/CVE-2023-32634.md): An authentication bypass vulnerability exists in the CiRpcServerThread() functionality of SoftEther VPN 5.01.9674 and 4.41-9782-beta. (CVSS 7.8, SoftEther VPN)
- [CVE-2023-31192](https://cve.now/CVE-2023-31192.md): An information disclosure vulnerability exists in the ClientConnect() functionality of SoftEther VPN 5.01.9674. (CVSS 5.3, SoftEther VPN)
- [CVE-2023-45106](https://cve.now/CVE-2023-45106.md): WordPress Urvanov Syntax Highlighter Plugin \<= 2.8.33 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Fedor Urvanov, Aram Kocharyan Urvanov Syntax Highlighter)
- [CVE-2023-45103](https://cve.now/CVE-2023-45103.md): WordPress Permalinks Customizer Plugin \<= 2.8.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, YAS Global Team Permalinks Customizer)
- [CVE-2023-45102](https://cve.now/CVE-2023-45102.md): WordPress Blog Manager Light Plugin \<= 1.20 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, OTWthemes Blog Manager Light)
- [CVE-2023-41131](https://cve.now/CVE-2023-41131.md): WordPress Sp\*tify Play Button for WordPress Plugin \<= 2.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Jonk @ Follow me Darling Sp\*tify Play Button for WordPress)
- [CVE-2023-32124](https://cve.now/CVE-2023-32124.md): WordPress Publish Confirm Message Plugin \<= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Arul Prasad J Publish Confirm Message)
- [CVE-2023-27315](https://cve.now/CVE-2023-27315.md): Information Disclosure Vulnerability in SnapGathers (CVSS 6.5, NetApp SnapGathers)
- [CVE-2023-45068](https://cve.now/CVE-2023-45068.md): WordPress Contact Form by Supsystic Plugin \<= 1.7.27 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Contact Form by Supsystic)
- [CVE-2023-45063](https://cve.now/CVE-2023-45063.md): WordPress AI Content Writing Assistant (Content Writer, ChatGPT, Image Generator) All in One Plugin \<= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, ReCorp AI Content Writing Assistant (Content Writer, GPT 3…)
- [CVE-2023-45060](https://cve.now/CVE-2023-45060.md): WordPress Interactive World Map Plugin \<= 3.2.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Fla-shop.com Interactive World Map)
- [CVE-2023-45058](https://cve.now/CVE-2023-45058.md): WordPress Short URL Plugin \<= 1.6.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, KaizenCoders Short URL)
- [CVE-2023-45052](https://cve.now/CVE-2023-45052.md): WordPress WP Bing Map Pro Plugin \< 5.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, dan009 WP Bing Map Pro)
- [CVE-2023-45048](https://cve.now/CVE-2023-45048.md): WordPress Social proof testimonials and reviews by Repuso Plugin \<= 5.00 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Social proof testimonials and reviews by Repuso)
- [CVE-2023-45011](https://cve.now/CVE-2023-45011.md): WordPress WP Power Stats Plugin \<= 2.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Igor Buyanov WP Power Stats)
- [CVE-2023-44998](https://cve.now/CVE-2023-44998.md): WordPress Category Meta Plugin \<= 1.2.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, josecoelho, Randy Hoyt, steveclarkcouk, Vitaliy Kukin, Eric…)
- [CVE-2023-5045](https://cve.now/CVE-2023-5045.md): SQLi in Biltay's Kayısı (CVSS 9.8, Biltay Technology Kayisi)
- [CVE-2023-5046](https://cve.now/CVE-2023-5046.md): SQLi in Biltay's Procost (CVSS 9.8, Biltay Technology Procost)
- [CVE-2023-43789](https://cve.now/CVE-2023-43789.md): Libxpm: out of bounds read on xpm with corrupted colormap (CVSS 5.5, libXpm · Red Hat Enterprise Linux)
- [CVE-2023-23737](https://cve.now/CVE-2023-23737.md): WordPress MainWP Broken Links Checker Extension Plugin \<= 4.0 is vulnerable to SQL Injection (CVSS 9.3, MainWP Broken Links Checker Extension)
- [CVE-2023-23651](https://cve.now/CVE-2023-23651.md): WordPress MainWP Google Analytics Extension Plugin \<= 4.0.4 - SQL Injection vulnerability (CVSS 8.5, MainWP Google Analytics Extension)
- [CVE-2023-5556](https://cve.now/CVE-2023-5556.md): Cross-site Scripting (XSS) - Reflected in structurizr/onpremises (CVSS 5.3, structurizr/onpremises)
- [CVE-2023-5555](https://cve.now/CVE-2023-5555.md): Cross-site Scripting (XSS) - Generic in frappe/lms (CVSS 7.1, frappe/lms)
- [CVE-2023-5554](https://cve.now/CVE-2023-5554.md): Lack of TLS certificate verification in log transmission of a financial module within LINE client for iOS prior to 13.16.0. (CVSS 4.8, LINE client for iOS)
- [CVE-2023-45047](https://cve.now/CVE-2023-45047.md): WordPress LeadSquared Suite Plugin \<= 0.7.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, LeadSquared Suite)
- [CVE-2023-5470](https://cve.now/CVE-2023-5470.md): Etsy Shop \<= 3.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, fsheedy Etsy Shop)
- [CVE-2023-32724](https://cve.now/CVE-2023-32724.md): JavaScript engine memory pointers are directly available for Zabbix users for modification (CVSS 9.1, Zabbix)
- [CVE-2023-32723](https://cve.now/CVE-2023-32723.md): Inefficient permission check in class CControllerAuthenticationUpdate (CVSS 8.5, Zabbix)
- [CVE-2023-32722](https://cve.now/CVE-2023-32722.md): Stack-buffer Overflow in library module zbxjson (CVSS 9.6, Zabbix)
- [CVE-2023-32721](https://cve.now/CVE-2023-32721.md): Stored XSS in Maps element (CVSS 7.6, Zabbix)
- [CVE-2023-29453](https://cve.now/CVE-2023-29453.md): Agent 2 package are built with Go version affected by CVE-2023-24538 (CVSS 9.8, Zabbix)
- [CVE-2023-5531](https://cve.now/CVE-2023-5531.md): Thumbnail Slider With Lightbox \<= 1.0 - Cross-Site Request Forgery (CVSS 4.3, nik00726 Thumbnail Slider With Lightbox)
- [CVE-2023-23632](https://cve.now/CVE-2023-23632.md): BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. (no CVSS)
- [CVE-2023-40829](https://cve.now/CVE-2023-40829.md): There is an interface unauthorized access vulnerability in the background of Tencent Enterprise Wechat Privatization 2.5.x and 2.6.930000. (no CVSS)
- [CVE-2023-40833](https://cve.now/CVE-2023-40833.md): An issue in Thecosy IceCMS v.1.0.0 allows a remote attacker to gain privileges via the Id and key parameters in getCosSetting. (no CVSS)
- [CVE-2023-41261](https://cve.now/CVE-2023-41261.md): An issue was discovered in /fcgi/scrut\_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. (no CVSS)
- [CVE-2023-41262](https://cve.now/CVE-2023-41262.md): An issue was discovered in /fcgi/scrut\_fcgi.fcgi in Plixer Scrutinizer before 19.3.1. (no CVSS)
- [CVE-2023-41263](https://cve.now/CVE-2023-41263.md): An issue was discovered in Plixer Scrutinizer before 19.3.1. (no CVSS)
- [CVE-2023-42298](https://cve.now/CVE-2023-42298.md): An issue in GPAC GPAC v.2.2.1 and before allows a local attacker to cause a denial of service via the Q\_DecCoordOnUnitSphere function of fil (no CVSS)
- [CVE-2023-43147](https://cve.now/CVE-2023-43147.md): PHPJabbers Limo Booking Software 1.0 is vulnerable to Cross Site Request Forgery (CSRF) to add an admin user via the Add Users Function, aka (no CVSS)
- [CVE-2023-43148](https://cve.now/CVE-2023-43148.md): SPA-Cart 1.9.0.3 has a Cross Site Request Forgery (CSRF) vulnerability that allows a remote attacker to delete all accounts. (no CVSS)
- [CVE-2023-43149](https://cve.now/CVE-2023-43149.md): SPA-Cart 1.9.0.3 is vulnerable to Cross Site Request Forgery (CSRF) that allows a remote attacker to add an admin user with role status. (no CVSS)
- [CVE-2023-45510](https://cve.now/CVE-2023-45510.md): tsMuxer version git-2539d07 was discovered to contain an alloc-dealloc-mismatch (operator new \[\] vs operator delete) error. (no CVSS)
- [CVE-2023-45511](https://cve.now/CVE-2023-45511.md): A memory leak in tsMuxer version git-2539d07 allows attackers to cause a Denial of Service (DoS) via a crafted MP4 file. (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.