# CVEs published 2023-10-13

64 CVEs were published on October 13, 2023: 4 critical, 20 high. Days are UTC.

- [CVE-2023-45674](https://cve.now/CVE-2023-45674.md): SQL injection vulnerability in Farmbot-Web-App (CVSS 7.7, Farmbot-Web-App)
- [CVE-2023-4257](https://cve.now/CVE-2023-4257.md): Unchecked user input length in the Zephyr WiFi shell module (CVSS 7.6, zephyrproject-rtos Zephyr)
- [CVE-2023-4263](https://cve.now/CVE-2023-4263.md): Potential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver (CVSS 7.6, zephyrproject-rtos Zephyr)
- [CVE-2023-36559](https://cve.now/CVE-2023-36559.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.2, Microsoft Edge)
- [CVE-2023-34977](https://cve.now/CVE-2023-34977.md): Video Station (CVSS 4.6, QNAP Systems Video Station)
- [CVE-2023-34976](https://cve.now/CVE-2023-34976.md): Video Station (CVSS 10.0, QNAP Systems Video Station)
- [CVE-2023-34975](https://cve.now/CVE-2023-34975.md): QTS, QuTS hero, QuTScloud (CVSS 6.6, QNAP Systems QuTS hero · QNAP Systems QTS +1)
- [CVE-2023-32976](https://cve.now/CVE-2023-32976.md): Container Station (CVSS 6.6, QNAP Systems Container Station)
- [CVE-2023-32974](https://cve.now/CVE-2023-32974.md): QTS, QuTS hero, QuTScloud (CVSS 7.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-32973](https://cve.now/CVE-2023-32973.md): QTS, QuTS hero, QuTScloud (CVSS 3.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-32970](https://cve.now/CVE-2023-32970.md): QTS, QuTS hero, QuTScloud (CVSS 4.9, QNAP Systems QuTS hero · QNAP Systems QuTScloud +1)
- [CVE-2023-4499](https://cve.now/CVE-2023-4499.md): A potential security vulnerability has been identified in the HP ThinUpdate utility (also known as HP Recovery Image and Software Download T (no CVSS, HP ThinUpdate)
- [CVE-2023-5449](https://cve.now/CVE-2023-5449.md): A potential security vulnerability has been identified in certain HP Displays supporting the Theft Deterrence feature which may allow a moni (no CVSS, HP Displays)
- [CVE-2023-5409](https://cve.now/CVE-2023-5409.md): HP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. (no CVSS, HP t430 and t638 Thin Clients)
- [CVE-2023-40682](https://cve.now/CVE-2023-40682.md): IBM App Connect Enterprise information disclosure (CVSS 4.4, IBM App Connect Enterprise)
- [CVE-2023-45270](https://cve.now/CVE-2023-45270.md): WordPress Pinpoint Booking System Plugin \<= 2.9.9.4.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, PINPOINT.WORLD Pinpoint Booking System)
- [CVE-2023-45276](https://cve.now/CVE-2023-45276.md): WordPress Automated Editor Plugin \<= 1.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, automatededitor.com Automated Editor)
- [CVE-2023-45269](https://cve.now/CVE-2023-45269.md): WordPress Simple SEO Plugin \<= 2.0.25 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, David Cole Simple SEO)
- [CVE-2023-45268](https://cve.now/CVE-2023-45268.md): WordPress Hitsteps Web Analytics Plugin \<= 5.86 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Hitsteps Web Analytics)
- [CVE-2023-41836](https://cve.now/CVE-2023-41836.md): An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0, FortiS (CVSS 3.4, Fortinet FortiSandbox)
- [CVE-2023-41843](https://cve.now/CVE-2023-41843.md): A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through (CVSS 7.3, Fortinet FortiSandbox)
- [CVE-2023-41680](https://cve.now/CVE-2023-41680.md): A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through (CVSS 7.3, Fortinet FortiSandbox)
- [CVE-2023-41681](https://cve.now/CVE-2023-41681.md): A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through (CVSS 7.3, Fortinet FortiSandbox)
- [CVE-2023-41682](https://cve.now/CVE-2023-41682.md): A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiSandbox 4.4.0, FortiSandbox (CVSS 7.9, Fortinet FortiSandbox)
- [CVE-2023-45267](https://cve.now/CVE-2023-45267.md): WordPress IRivYou Plugin \<= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Zizou1988 IRivYou)
- [CVE-2023-33303](https://cve.now/CVE-2023-33303.md): A insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows attacker to execute unauthorized code or commands (CVSS 7.7, Fortinet FortiEDR)
- [CVE-2023-45109](https://cve.now/CVE-2023-45109.md): WordPress WhitePage Plugin \<= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, ZAKSTAN WhitePage)
- [CVE-2023-29464](https://cve.now/CVE-2023-29464.md): Rockwell Automation FactoryTalk Linx Vulnerable to Denial-of-Service and Information Disclosure (CVSS 8.2, Rockwell Automation FactoryTalk Linx)
- [CVE-2023-45162](https://cve.now/CVE-2023-45162.md): Blind SQL vulnerability in 1E platform (CVSS 9.9, 1E Platform)
- [CVE-2023-4995](https://cve.now/CVE-2023-4995.md): Embed Calendly \<= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, turn2honey EMC – Easily Embed Calendly Scheduling)
- [CVE-2023-4517](https://cve.now/CVE-2023-4517.md): Cross-site Scripting (XSS) - Stored in hestiacp/hestiacp (CVSS 3.2, hestiacp/hestiacp)
- [CVE-2023-4829](https://cve.now/CVE-2023-4829.md): Cross-site Scripting (XSS) - Stored in froxlor/froxlor (CVSS 4.3, froxlor/froxlor)
- [CVE-2023-5240](https://cve.now/CVE-2023-5240.md): Improper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier allows an attack with permission to manage PA (no CVSS, Devolutions Server)
- [CVE-2023-45130](https://cve.now/CVE-2023-45130.md): Frontier opcode SUICIDE touches too many storage values on large contracts (CVSS 7.5, paritytech frontier)
- [CVE-2023-39960](https://cve.now/CVE-2023-39960.md): Nextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint (CVSS 5.0, nextcloud security-advisories)
- [CVE-2023-45108](https://cve.now/CVE-2023-45108.md): WordPress Mailrelay Plugin \<= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Mailrelay)
- [CVE-2023-45107](https://cve.now/CVE-2023-45107.md): WordPress GoodBarber Plugin \<= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, GoodBarber)
- [CVE-2023-43079](https://cve.now/CVE-2023-43079.md): Dell OpenManage Server Administrator, versions 11.0.0.0 and prior, contains an Improper Access Control vulnerability. (CVSS 7.3, Dell OpenManage Server Administrator)
- [CVE-2023-39999](https://cve.now/CVE-2023-39999.md): WordPress \< 6.3.2 is vulnerable to Broken Access Control (CVSS 4.3, WordPress.org WordPress · wordpress +1)
- [CVE-2023-5573](https://cve.now/CVE-2023-5573.md): Allocation of Resources Without Limits or Throttling in vriteio/vrite (CVSS 4.7, vriteio/vrite · @vrite/sdk)
- [CVE-2023-38000](https://cve.now/CVE-2023-38000.md): Auth. Stored Cross-Site Scripting (XSS) vulnerability in WordPress core and Gutenberg plugin via Navigation Links Block (CVSS 6.5, WordPress.org WordPress · Gutenberg Team Gutenberg)
- [CVE-2023-5572](https://cve.now/CVE-2023-5572.md): Server-Side Request Forgery (SSRF) in vriteio/vrite (CVSS 10.0, vriteio/vrite · @vrite/sdk)
- [CVE-2023-5571](https://cve.now/CVE-2023-5571.md): Improper Input Validation in vriteio/vrite (CVSS 6.5, vriteio/vrite · @vrite/sdk)
- [CVE-2023-38251](https://cve.now/CVE-2023-38251.md): Adobe Commerce | Uncontrolled Resource Consumption (CWE-400) (CVSS 5.3, Adobe Commerce · magento/community-edition +1)
- [CVE-2023-38219](https://cve.now/CVE-2023-38219.md): Validate Your Inputs | Cross-site Scripting (Stored XSS) (CWE-79) - Customer to Admin stored XSS with Gift wrapping (CVSS 8.7, Adobe Commerce · magento/community-edition +1)
- [CVE-2023-38220](https://cve.now/CVE-2023-38220.md): Full page cache enumeration via cookie X-Magento-Vary (CVSS 7.5, Adobe Commerce · magento/community-edition +1)
- [CVE-2023-26367](https://cve.now/CVE-2023-26367.md): Error based file extraction via PHP filter chains during product bulk import logic (CVSS 4.9, Adobe Commerce · magento/community-edition +1)
- [CVE-2023-26366](https://cve.now/CVE-2023-26366.md): Validate Your Inputs | Server-Side Request Forgery (SSRF) (CWE-918) (CVSS 6.8, Adobe Commerce · magento/community-edition +1)
- [CVE-2023-38218](https://cve.now/CVE-2023-38218.md): Incorrect Authorization - Customer account takeover (CVSS 8.8, Adobe Commerce · magento/community-edition +1)
- [CVE-2023-38250](https://cve.now/CVE-2023-38250.md): Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 8.0, Adobe Commerce · magento/community-edition +1)
- [CVE-2023-38249](https://cve.now/CVE-2023-38249.md): Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 8.0, Adobe Commerce · magento/community-edition +1)
- [CVE-2023-38221](https://cve.now/CVE-2023-38221.md): Adobe Commerce | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (CWE-89) (CVSS 8.0, Adobe Commerce · magento/community-edition +1)
- [CVE-2023-42752](https://cve.now/CVE-2023-42752.md): Kernel: integer overflow in igmpv3\_newpack leading to exploitable memory access (CVSS 5.5, Kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-5557](https://cve.now/CVE-2023-5557.md): Tracker-miners: sandbox escape (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2023-4562](https://cve.now/CVE-2023-4562.md): Information Disclosure, Information Tampering and Authentication Bypass Vulnerability in MELSEC-F Series main module (CVSS 9.1, Mitsubishi Electric MELSEC-F Series FX3U-16MT/ES · Mit… +151)
- [CVE-2023-5564](https://cve.now/CVE-2023-5564.md): Cross-site Scripting (XSS) - Stored in froxlor/froxlor (CVSS 5.2, froxlor/froxlor)
- [CVE-2023-45391](https://cve.now/CVE-2023-45391.md): A stored cross-site scripting (XSS) vulnerability in the Create A New Employee function of Granding UTime Master v9.0.7-Build:Apr 4,2023 all (no CVSS)
- [CVE-2023-45393](https://cve.now/CVE-2023-45393.md): An indirect object reference (IDOR) in GRANDING UTime Master v9.0.7-Build:Apr 4,2023 allows authenticated attackers to access sensitive info (no CVSS)
- [CVE-2023-45463](https://cve.now/CVE-2023-45463.md): Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the hostName parameter in the FUN\_0040dabc function. (CVSS 7.5)
- [CVE-2023-45464](https://cve.now/CVE-2023-45464.md): Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the servDomain parameter. (no CVSS)
- [CVE-2023-45465](https://cve.now/CVE-2023-45465.md): Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS setti (no CVSS)
- [CVE-2023-45466](https://cve.now/CVE-2023-45466.md): Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin\_host parameter in the WPS Settings. (no CVSS)
- [CVE-2023-45467](https://cve.now/CVE-2023-45467.md): Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ntpServIP parameter in the Time Settings. (no CVSS)
- [CVE-2023-45468](https://cve.now/CVE-2023-45468.md): Netis N3Mv2-V1.0.1.865 was discovered to contain a buffer overflow via the pingWdogIp. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.