CVEs published October 13, 2023
64 CVEs were published on October 13, 2023: 4 critical, 20 high.
- Published
- 64
- Critical
- 4
- High
- 20
- Medium
- 26
- Low
- 3
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Adobe Commerce · magento/community-edition +1
- 9
- Fortinet FortiSandbox
- 5
- vriteio/vrite · @vrite/sdk
- 3
- froxlor/froxlor
- 2
- QNAP Systems QTS · QNAP Systems QuTS hero +1
- 2
- QNAP Systems Video Station
- 2
- zephyrproject-rtos Zephyr
- 2
- 1E Platform
- 1
- automatededitor.com Automated Editor
- 1
- David Cole Simple SEO
- 1
Critical 4
- CVE-2023-34976Video StationQNAP Systems Video Station
- CVE-2023-45162Blind SQL vulnerability in 1E platform1E Platform
- CVE-2023-5572Server-Side Request Forgery (SSRF) in vriteio/vritevriteio/vrite · @vrite/sdk
- CVE-2023-4562Information Disclosure, Information Tampering and Authentication Bypass Vulnerability in MELSEC-F Series main moduleMitsubishi Electric MELSEC-F Series FX3U-16MT/ES · Mit… +151
High 20
- CVE-2023-45674SQL injection vulnerability in Farmbot-Web-AppFarmbot-Web-App
- CVE-2023-4257Unchecked user input length in the Zephyr WiFi shell modulezephyrproject-rtos Zephyr
- CVE-2023-4263Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driverzephyrproject-rtos Zephyr
- CVE-2023-32974QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41843A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through Fortinet FortiSandbox
- CVE-2023-41680A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through Fortinet FortiSandbox
- CVE-2023-41681A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through Fortinet FortiSandbox
- CVE-2023-41682A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox Fortinet FortiSandbox
- CVE-2023-33303A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands Fortinet FortiEDR
- CVE-2023-29464Rockwell Automation FactoryTalk Linx Vulnerable to Denial-of-Service and Information DisclosureRockwell Automation FactoryTalk Linx
- CVE-2023-45130Frontier opcode SUICIDE touches too many storage values on large contractsparitytech frontier
- CVE-2023-43079 Dell OpenManage Server Administrator, versions 11.0.0.0 and prior, contains an Improper Access Control vulnerability.Dell OpenManage Server Administrator
- CVE-2023-38219Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrappingAdobe Commerce · magento/community-edition +1
- CVE-2023-38220Full page cache enumeration via cookie X-Magento-VaryAdobe Commerce · magento/community-edition +1
- CVE-2023-38218Incorrect Authorization - Customer account takeoverAdobe Commerce · magento/community-edition +1
- CVE-2023-38250Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Commerce · magento/community-edition +1
- CVE-2023-38249Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Commerce · magento/community-edition +1
- CVE-2023-38221Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89)Adobe Commerce · magento/community-edition +1
- CVE-2023-5557Tracker-miners: sandbox escapeRed Hat Enterprise Linux
- CVE-2023-45463Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN_0040dabc function.
Medium, low and unrated 40
- CVE-2023-36559Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2023-34977Video StationQNAP Systems Video Station
- CVE-2023-34975QTS, QuTS hero, QuTScloudQNAP Systems QuTS hero · QNAP Systems QTS +1
- CVE-2023-32976Container StationQNAP Systems Container Station
- CVE-2023-32973QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-32970QTS, QuTS hero, QuTScloudQNAP Systems QuTS hero · QNAP Systems QuTScloud +1
- CVE-2023-4499A potential security vulnerability has been identified in the HP ThinUpdate utility (also known as HP Recovery Image and Software Download THP ThinUpdate
- CVE-2023-5449A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a moniHP Displays
- CVE-2023-5409HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs.HP t430 and t638 Thin Clients
- CVE-2023-40682IBM App Connect Enterprise information disclosureIBM App Connect Enterprise
- CVE-2023-45270WordPress Pinpoint Booking System Plugin <= 2.9.9.4.0 is vulnerable to Cross Site Request Forgery (CSRF)PINPOINT.WORLD Pinpoint Booking System
- CVE-2023-45276WordPress Automated Editor Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)automatededitor.com Automated Editor
- CVE-2023-45269WordPress Simple SEO Plugin <= 2.0.25 is vulnerable to Cross Site Request Forgery (CSRF)David Cole Simple SEO
- CVE-2023-45268WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Request Forgery (CSRF)Hitsteps Web Analytics
- CVE-2023-41836An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSFortinet FortiSandbox
- CVE-2023-45267WordPress IRivYou Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)Zizou1988 IRivYou
- CVE-2023-45109WordPress WhitePage Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)ZAKSTAN WhitePage
- CVE-2023-4995Embed Calendly <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeturn2honey EMC – Easily Embed Calendly Scheduling
- CVE-2023-4517Cross-site Scripting (XSS) - Stored in hestiacp/hestiacphestiacp/hestiacp
- CVE-2023-4829Cross-site Scripting (XSS) - Stored in froxlor/froxlorfroxlor/froxlor
- CVE-2023-5240Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PADevolutions Server
- CVE-2023-39960Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpointnextcloud security-advisories
- CVE-2023-45108WordPress Mailrelay Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)Mailrelay
- CVE-2023-45107WordPress GoodBarber Plugin <= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF)GoodBarber
- CVE-2023-39999WordPress < 6.3.2 is vulnerable to Broken Access ControlWordPress.org WordPress · wordpress +1
- CVE-2023-5573Allocation of Resources Without Limits or Throttling in vriteio/vritevriteio/vrite · @vrite/sdk
- CVE-2023-38000Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links BlockWordPress.org WordPress · Gutenberg Team Gutenberg
- CVE-2023-5571Improper Input Validation in vriteio/vritevriteio/vrite · @vrite/sdk
- CVE-2023-38251Adobe Commerce | Uncontrolled Resource Consumption (CWE-400)Adobe Commerce · magento/community-edition +1
- CVE-2023-26367Error based file extraction via PHP filter chains during product bulk import logicAdobe Commerce · magento/community-edition +1
- CVE-2023-26366Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918)Adobe Commerce · magento/community-edition +1
- CVE-2023-42752Kernel: integer overflow in igmpv3_newpack leading to exploitable memory accessKernel · Red Hat Enterprise Linux +1
- CVE-2023-5564Cross-site Scripting (XSS) - Stored in froxlor/froxlorfroxlor/froxlor
- CVE-2023-45391A stored cross-site scripting (XSS) vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 all
- CVE-2023-45393An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive info
- CVE-2023-45464Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter.
- CVE-2023-45465Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS setti
- CVE-2023-45466Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings.
- CVE-2023-45467Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings.
- CVE-2023-45468Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp.