# CVEs published 2023-10-14 30 CVEs were published on October 14, 2023: 0 critical, 3 high. Days are UTC. - [CVE-2023-5585](https://cve.now/CVE-2023-5585.md): SourceCodester Online Motorcycle Rental System Bike List cross site scripting (CVSS 2.4, SourceCodester Online Motorcycle Rental System) - [CVE-2023-30994](https://cve.now/CVE-2023-30994.md): IBM QRadar SIEM information disclosure (CVSS 5.4, IBM QRadar SIEM) - [CVE-2023-40367](https://cve.now/CVE-2023-40367.md): IBM QRadar SIEM cross-site scripting (CVSS 5.4, IBM QRadar SIEM) - [CVE-2023-45176](https://cve.now/CVE-2023-45176.md): IBM App Connect Enterprise and IBM Integration Bus denial of service (CVSS 6.2, IBM App Connect Enterprise · IBM Integration Bus) - [CVE-2022-43868](https://cve.now/CVE-2022-43868.md): IBM Security Verify Access information disclosure (CVSS 5.3, IBM Security Verify Access) - [CVE-2022-43740](https://cve.now/CVE-2022-43740.md): IBM Security Verify Access denial of service (CVSS 7.5, IBM Security Verify Access) - [CVE-2023-35024](https://cve.now/CVE-2023-35024.md): IBM Cloud Pak for Business Automation cross-site scripting (CVSS 4.6, IBM Cloud Pak for Business Automation) - [CVE-2022-32755](https://cve.now/CVE-2022-32755.md): IBM Security Directory Server external entity injection (CVSS 5.5, IBM Security Directory Server) - [CVE-2022-33165](https://cve.now/CVE-2022-33165.md): IBM Security Directory Server information disclosure (CVSS 6.8, IBM Security Directory Server) - [CVE-2022-33161](https://cve.now/CVE-2022-33161.md): IBM Security Directory Server information disclosure (CVSS 5.3, IBM Security Directory Server) - [CVE-2023-5582](https://cve.now/CVE-2023-5582.md): ZZZCMS Personal Profile Page cross site scripting (CVSS 3.5, ZZZCMS) - [CVE-2023-5581](https://cve.now/CVE-2023-5581.md): SourceCodester Medicine Tracker System index.php cross site scripting (CVSS 3.5, SourceCodester Medicine Tracker System) - [CVE-2023-5580](https://cve.now/CVE-2023-5580.md): SourceCodester Library System index.php sql injection (CVSS 6.3, SourceCodester Library System) - [CVE-2023-5579](https://cve.now/CVE-2023-5579.md): yhz66 Sandbox User Data information disclosure (CVSS 3.5, yhz66 Sandbox) - [CVE-2023-1259](https://cve.now/CVE-2023-1259.md): Hotjar \<= 1.0.15 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, Hotjar) - [CVE-2023-5578](https://cve.now/CVE-2023-5578.md): Portábilis i-Educar HTTP GET Request agenda\_imprimir.php cross site scripting (CVSS 5.1, Portábilis i-Educar) - [CVE-2023-42663](https://cve.now/CVE-2023-42663.md): Apache Airflow: Bypass permission verification to view task instances of other dags (low (no CVSS), Apache Software Foundation Apache Airflow · apache-airflow) - [CVE-2023-42792](https://cve.now/CVE-2023-42792.md): Apache Airflow: Improper access control to DAG resources (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow) - [CVE-2023-45348](https://cve.now/CVE-2023-45348.md): Apache Airflow: Configuration information leakage vulnerability (no CVSS, Apache Software Foundation Apache Airflow · apache-airflow) - [CVE-2023-42780](https://cve.now/CVE-2023-42780.md): Apache Airflow: Improper access control vulnerability in the "List dag warnings" feature (low (no CVSS), Apache Software Foundation Apache Airflow · apache-airflow) - [CVE-2023-26155](https://cve.now/CVE-2023-26155.md): All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt() fails to sanitize (CVSS 7.3, node-qpdf) - [CVE-2023-30148](https://cve.now/CVE-2023-30148.md): Multiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before version 2.0.12 and Opart multihtmlblock\* vers (CVSS 6.1) - [CVE-2023-30154](https://cve.now/CVE-2023-30154.md): Multiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for PrestaShop, before version 2.2.1, allows remote (no CVSS) - [CVE-2023-44037](https://cve.now/CVE-2023-44037.md): An issue in ZPE Systems, Inc Nodegrid OS v.5.8.10 thru v.5.8.13 and v.5.10.3 thru v.5.10.5 allows a remote attacker to obtain sensitive info (no CVSS) - [CVE-2023-45852](https://cve.now/CVE-2023-45852.md): In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands vi (no CVSS) - [CVE-2023-45853](https://cve.now/CVE-2023-45853.md): MiniZip in zlib through 1.3 has an integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4\_64 via a long filename, (CVSS 8.8, pyminizip) - [CVE-2023-45855](https://cve.now/CVE-2023-45855.md): qdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI. (no CVSS) - [CVE-2023-45856](https://cve.now/CVE-2023-45856.md): qdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to upload a .php file to the /uploads URI. (no CVSS) - [CVE-2023-45862](https://cve.now/CVE-2023-45862.md): An issue was discovered in drivers/usb/storage/ene\_ub6250.c for the ENE UB6250 reader driver in the Linux kernel before 6.2.5. (no CVSS) - [CVE-2023-45863](https://cve.now/CVE-2023-45863.md): An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2023-10-14 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.