# CVEs published 2023-10-17

159 CVEs were published on October 17, 2023: 11 critical, 28 high. Days are UTC.

- [CVE-2023-5552](https://cve.now/CVE-2023-5552.md): A password disclosure vulnerability in the Secure PDF eXchange (SPX) feature allows attackers with full email access to decrypt PDFs in Soph (CVSS 7.1, Sophos Firewall)
- [CVE-2023-5626](https://cve.now/CVE-2023-5626.md): Cross-Site Request Forgery (CSRF) in pkp/ojs (CVSS 3.5, pkp/ojs)
- [CVE-2023-3042](https://cve.now/CVE-2023-3042.md): CNA SHORTNAME: dotCMSORG UUID: 5b9d93f2-25c7-46b4-ab60-d201718c9dd8 (CVSS 5.3, dotCMS core)
- [CVE-2023-45811](https://cve.now/CVE-2023-45811.md): Prototype pollution vulnerability leading to arbitrary code execution in synchrony deobfuscator (CVSS 8.2, relative synchrony · deobfuscator)
- [CVE-2023-41715](https://cve.now/CVE-2023-41715.md): SonicOS post-authentication Improper Privilege Management vulnerability in the SonicOS SSL VPN Tunnel allows users to elevate their privileg (CVSS 8.8, SonicWall SonicOS)
- [CVE-2023-42507](https://cve.now/CVE-2023-42507.md): Stack-based buffer overflow vulnerability exists in OnSinView2 versions 2.0.1 and earlier. (no CVSS, JTEKT ELECTRONICS OnSinView2)
- [CVE-2023-42506](https://cve.now/CVE-2023-42506.md): Improper restriction of operations within the bounds of a memory buffer issue exists in OnSinView2 versions 2.0.1 and earlier. (no CVSS, JTEKT ELECTRONICS OnSinView2)
- [CVE-2023-45810](https://cve.now/CVE-2023-45810.md): OpenFGA denial of service (CVSS 5.3, openfga · github.com/openfga/openfga)
- [CVE-2023-41713](https://cve.now/CVE-2023-41713.md): SonicOS Use of Hard-coded Password vulnerability in the 'dynHandleBuyToolbar' demo function. (no CVSS, SonicWall SonicOS)
- [CVE-2023-41712](https://cve.now/CVE-2023-41712.md): SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the SSL VPN plainprefs.exp URL endpoint leads to a firewall crash. (no CVSS, SonicWall SonicOS)
- [CVE-2023-41711](https://cve.now/CVE-2023-41711.md): SonicOS post-authentication Stack-Based Buffer Overflow Vulnerability in the sonicwall.exp, prefs.exp URL endpoints lead to a firewall crash (no CVSS, SonicWall SonicOS)
- [CVE-2023-39280](https://cve.now/CVE-2023-39280.md): SonicOS p ost-authentication Stack-Based Buffer Overflow vulnerability in the ssoStats-s.xml, ssoStats-s.wri URL endpoints leads to a firew (no CVSS, SonicWall SonicOS)
- [CVE-2023-39279](https://cve.now/CVE-2023-39279.md): SonicOS post-authentication Stack-Based Buffer Overflow vulnerability in the getPacketReplayData.json URL endpoint leads to a firewall crash (no CVSS, SonicWall SonicOS)
- [CVE-2023-39278](https://cve.now/CVE-2023-39278.md): SonicOS post-authentication user assertion failure leads to Stack-Based Buffer Overflow vulnerability via main.cgi leads to a firewall crash (no CVSS, SonicWall SonicOS)
- [CVE-2023-39277](https://cve.now/CVE-2023-39277.md): SonicOS post-authentication stack-based buffer overflow vulnerability in the sonicflow.csv and appflowsessions.csv URL endpoints leads to a (no CVSS, SonicWall SonicOS)
- [CVE-2023-39276](https://cve.now/CVE-2023-39276.md): SonicOS post-authentication stack-based buffer overflow vulnerability in the getBookmarkList.json URL endpoint leads to a firewall crash. (no CVSS, SonicWall SonicOS)
- [CVE-2023-22130](https://cve.now/CVE-2023-22130.md): Vulnerability in the Sun ZFS Storage Appliance product of Oracle Systems (component: Core). (CVSS 5.9, Oracle Sun ZFS Storage Appliance Kit (AK) Software)
- [CVE-2023-22129](https://cve.now/CVE-2023-22129.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel). (CVSS 5.5, Oracle Solaris Operating System)
- [CVE-2023-22128](https://cve.now/CVE-2023-22128.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem). (CVSS 3.1, Oracle Solaris Operating System)
- [CVE-2023-22127](https://cve.now/CVE-2023-22127.md): Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Content Access SDK, Image Export SDK, PDF (CVSS 6.3, Oracle Outside In Technology)
- [CVE-2023-22126](https://cve.now/CVE-2023-22126.md): Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server). (CVSS 5.3, Oracle WebCenter Content)
- [CVE-2023-22125](https://cve.now/CVE-2023-22125.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.4, Oracle Banking Trade Finance)
- [CVE-2023-22124](https://cve.now/CVE-2023-22124.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.4, Oracle Banking Trade Finance)
- [CVE-2023-22123](https://cve.now/CVE-2023-22123.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.4, Oracle Banking Trade Finance)
- [CVE-2023-22122](https://cve.now/CVE-2023-22122.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.9, Oracle Banking Trade Finance)
- [CVE-2023-22121](https://cve.now/CVE-2023-22121.md): Vulnerability in the Oracle Banking Trade Finance product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.4, Oracle Banking Trade Finance)
- [CVE-2023-22119](https://cve.now/CVE-2023-22119.md): Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.9, Oracle FLEXCUBE Universal Banking)
- [CVE-2023-22118](https://cve.now/CVE-2023-22118.md): Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 6.5, Oracle FLEXCUBE Universal Banking)
- [CVE-2023-22117](https://cve.now/CVE-2023-22117.md): Vulnerability in the Oracle FLEXCUBE Universal Banking product of Oracle Financial Services Applications (component: Infrastructure). (CVSS 5.4, Oracle FLEXCUBE Universal Banking)
- [CVE-2023-22115](https://cve.now/CVE-2023-22115.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22114](https://cve.now/CVE-2023-22114.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22113](https://cve.now/CVE-2023-22113.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). (CVSS 2.7, Oracle MySQL Server)
- [CVE-2023-22112](https://cve.now/CVE-2023-22112.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22111](https://cve.now/CVE-2023-22111.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22110](https://cve.now/CVE-2023-22110.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22109](https://cve.now/CVE-2023-22109.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Dashboards). (CVSS 4.6, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-22108](https://cve.now/CVE-2023-22108.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2023-22107](https://cve.now/CVE-2023-22107.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: UI Components). (CVSS 6.1, Oracle Enterprise Command Center Framework)
- [CVE-2023-22106](https://cve.now/CVE-2023-22106.md): Vulnerability in the Oracle Enterprise Command Center Framework product of Oracle E-Business Suite (component: API). (CVSS 6.5, Oracle Enterprise Command Center Framework)
- [CVE-2023-22105](https://cve.now/CVE-2023-22105.md): Vulnerability in the BI Publisher product of Oracle Analytics (component: Web Server). (CVSS 5.4, Oracle BI Publisher)
- [CVE-2023-22104](https://cve.now/CVE-2023-22104.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22103](https://cve.now/CVE-2023-22103.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22102](https://cve.now/CVE-2023-22102.md): Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). (CVSS 8.3, Oracle MySQL Connectors · com.mysql:mysql-connector-j +1)
- [CVE-2023-22101](https://cve.now/CVE-2023-22101.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 8.1, Oracle WebLogic Server)
- [CVE-2023-22100](https://cve.now/CVE-2023-22100.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.9, Oracle VM VirtualBox)
- [CVE-2023-22099](https://cve.now/CVE-2023-22099.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2023-22098](https://cve.now/CVE-2023-22098.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2023-22097](https://cve.now/CVE-2023-22097.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22096](https://cve.now/CVE-2023-22096.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 4.3, Oracle Database - Enterprise Edition)
- [CVE-2023-22095](https://cve.now/CVE-2023-22095.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2023-22094](https://cve.now/CVE-2023-22094.md): Vulnerability in the MySQL Installer product of Oracle MySQL (component: Installer: General). (CVSS 7.9, Oracle MySQL Installer)
- [CVE-2023-22093](https://cve.now/CVE-2023-22093.md): Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Requisition and Vacancy). (CVSS 6.5, Oracle iRecruitment)
- [CVE-2023-22092](https://cve.now/CVE-2023-22092.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22091](https://cve.now/CVE-2023-22091.md): Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler). (CVSS 4.8, Oracle GraalVM Enterprise Edition)
- [CVE-2023-22090](https://cve.now/CVE-2023-22090.md): Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Events & Notifications). (CVSS 6.5, Oracle PeopleSoft Enterprise CC Common Application Objects)
- [CVE-2023-22089](https://cve.now/CVE-2023-22089.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server)
- [CVE-2023-22088](https://cve.now/CVE-2023-22088.md): Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: User Manag (CVSS 4.3, Oracle Communications Order and Service Management)
- [CVE-2023-22087](https://cve.now/CVE-2023-22087.md): Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). (CVSS 8.8, Oracle Hospitality OPERA 5 Property Services)
- [CVE-2023-22086](https://cve.now/CVE-2023-22086.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2023-22085](https://cve.now/CVE-2023-22085.md): Vulnerability in the Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera). (CVSS 8.8, Oracle Hospitality OPERA 5 Property Services)
- [CVE-2023-22084](https://cve.now/CVE-2023-22084.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22083](https://cve.now/CVE-2023-22083.md): Vulnerability in the Oracle Enterprise Session Border Controller product of Oracle Communications (component: Web UI). (CVSS 4.3, Oracle Enterprise Communications Broker · Oracle Enterprise…)
- [CVE-2023-22082](https://cve.now/CVE-2023-22082.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin). (CVSS 5.4, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-22081](https://cve.now/CVE-2023-22081.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2023-22080](https://cve.now/CVE-2023-22080.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology). (CVSS 6.1, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2023-22079](https://cve.now/CVE-2023-22079.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2023-22078](https://cve.now/CVE-2023-22078.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22077](https://cve.now/CVE-2023-22077.md): Vulnerability in the Oracle Database Recovery Manager component of Oracle Database Server. (CVSS 4.9, Oracle Database - Enterprise Edition)
- [CVE-2023-22076](https://cve.now/CVE-2023-22076.md): Vulnerability in the Oracle Applications Framework product of Oracle E-Business Suite (component: Personalization). (CVSS 6.1, Oracle Applications Framework)
- [CVE-2023-22075](https://cve.now/CVE-2023-22075.md): Vulnerability in the Oracle Database Sharding component of Oracle Database Server. (CVSS 2.4, Oracle Database - Enterprise Edition)
- [CVE-2023-22074](https://cve.now/CVE-2023-22074.md): Vulnerability in the Oracle Database Sharding component of Oracle Database Server. (CVSS 2.4, Oracle Database - Enterprise Edition)
- [CVE-2023-22073](https://cve.now/CVE-2023-22073.md): Vulnerability in the Oracle Notification Server component of Oracle Database Server. (CVSS 4.3, Oracle Database - Enterprise Edition)
- [CVE-2023-22072](https://cve.now/CVE-2023-22072.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server)
- [CVE-2023-22071](https://cve.now/CVE-2023-22071.md): Vulnerability in the PL/SQL component of Oracle Database Server. (CVSS 5.9, Oracle PL/SQL)
- [CVE-2023-22070](https://cve.now/CVE-2023-22070.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22069](https://cve.now/CVE-2023-22069.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 9.8, Oracle WebLogic Server)
- [CVE-2023-22068](https://cve.now/CVE-2023-22068.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22067](https://cve.now/CVE-2023-22067.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: CORBA). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2023-22066](https://cve.now/CVE-2023-22066.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22065](https://cve.now/CVE-2023-22065.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22064](https://cve.now/CVE-2023-22064.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22059](https://cve.now/CVE-2023-22059.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2023-22032](https://cve.now/CVE-2023-22032.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22029](https://cve.now/CVE-2023-22029.md): Vulnerability in the Oracle Commerce Guided Search product of Oracle Commerce (component: Workbench). (CVSS 6.1, Commerce Guided Search / Oracle Commerce Experience Manager)
- [CVE-2023-22028](https://cve.now/CVE-2023-22028.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22026](https://cve.now/CVE-2023-22026.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-22025](https://cve.now/CVE-2023-22025.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition, product of Oracle Java SE (component: Hotspo (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2023-22019](https://cve.now/CVE-2023-22019.md): Vulnerability in the Oracle HTTP Server product of Oracle Fusion Middleware (component: Web Listener). (CVSS 7.5, Oracle HTTP Server)
- [CVE-2023-22015](https://cve.now/CVE-2023-22015.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-43794](https://cve.now/CVE-2023-43794.md): SQL Injection in nocodb (CVSS 6.5, nocodb)
- [CVE-2023-45803](https://cve.now/CVE-2023-45803.md): Request body not stripped after redirect in urllib3 (CVSS 4.2, urllib3)
- [CVE-2023-4896](https://cve.now/CVE-2023-4896.md): Authenticated Disclosure of Sensitive Information in AirWave Management Platform (CVSS 6.8, HewarHewlett Packard Enterprise (HPE) Aruba AirWave Managem…)
- [CVE-2023-37537](https://cve.now/CVE-2023-37537.md): HCL AppScan Presence deployed as Windows service might be vulnerable to an Unquoted Service Path vulnerability (CVSS 7.8, HCL Software HCL AppScan Presence)
- [CVE-2023-20598](https://cve.now/CVE-2023-20598.md): An improper privilege management in the AMD Radeon™ Graphics driver may allow an authenticated attacker to craft an IOCTL request to gain (CVSS 7.8, AMD Radeon™ RX 5000 Series Graphics Cards · AMD Radeon™… +10)
- [CVE-2023-43777](https://cve.now/CVE-2023-43777.md): Insecure storage of password in easySoft (CVSS 5.9, Eaton easySoft)
- [CVE-2023-43776](https://cve.now/CVE-2023-43776.md): Weak encoding vulnerability in easyE4 (CVSS 6.8, Eaton easyE4)
- [CVE-2022-3761](https://cve.now/CVE-2022-3761.md): OpenVPN Connect versions before 3.4.0.4506 (macOS) and OpenVPN Connect before 3.4.0.3100 (Windows) allows man-in-the-middle attackers to int (no CVSS, OpenVPN Connect)
- [CVE-2023-42627](https://cve.now/CVE-2023-42627.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the Commerce module in Liferay Portal 7.3.5 through 7.4.3.91, and Liferay DXP (CVSS 9.6, Liferay DXP · Liferay Portal +2)
- [CVE-2023-42628](https://cve.now/CVE-2023-42628.md): Stored cross-site scripting (XSS) vulnerability in the Wiki widget in Liferay Portal 7.1.0 through 7.4.3.87, and Liferay DXP 7.0 fix pack 83 (CVSS 9.0, Liferay DXP · Liferay Portal +2)
- [CVE-2023-45007](https://cve.now/CVE-2023-45007.md): WordPress Fotomoto Plugin \<= 1.2.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Fotomoto)
- [CVE-2023-45006](https://cve.now/CVE-2023-45006.md): WordPress WooODT Lite Plugin \<= 2.4.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, ByConsole WooODT Lite – WooCommerce Order Delivery or Picku…)
- [CVE-2023-45004](https://cve.now/CVE-2023-45004.md): WordPress Woo Custom Emails Plugin \<= 2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, wp3sixty Woo Custom Emails)
- [CVE-2023-45003](https://cve.now/CVE-2023-45003.md): WordPress Social Feed Plugin \<= 2.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Arrow Plugins Social Feed | Custom Feed for Social Media Ne…)
- [CVE-2023-45010](https://cve.now/CVE-2023-45010.md): WordPress Complete Open Graph Plugin \<= 3.4.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Alex MacArthur Complete Open Graph)
- [CVE-2023-5522](https://cve.now/CVE-2023-5522.md): Mobile app freezes when receiving a post with hundreds of emojis (CVSS 4.3, Mattermost)
- [CVE-2023-44311](https://cve.now/CVE-2023-44311.md): Multiple reflected cross-site scripting (XSS) vulnerabilities in the Plugin for OAuth 2.0 module's OAuth2ProviderApplicationRedirect class i (CVSS 9.6, Liferay DXP · Liferay Portal +2)
- [CVE-2023-5339](https://cve.now/CVE-2023-5339.md): Mattermost Desktop logs all keystrokes during initial run after fresh installation (CVSS 4.7, Mattermost)
- [CVE-2023-44310](https://cve.now/CVE-2023-44310.md): Stored cross-site scripting (XSS) vulnerability in Page Tree menu Liferay Portal 7.3.6 through 7.4.3.78, and Liferay DXP 7.3 fix pack 1 thro (CVSS 9.0, Liferay DXP · Liferay Portal +2)
- [CVE-2023-45005](https://cve.now/CVE-2023-45005.md): WordPress Seriously Simple Stats Plugin \<= 1.5.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Castos Seriously Simple Stats)
- [CVE-2023-44990](https://cve.now/CVE-2023-44990.md): WordPress WOLF Plugin \<= 1.0.7.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, realmag777 WOLF – WordPress Posts Bulk Editor and Manager P…)
- [CVE-2023-24385](https://cve.now/CVE-2023-24385.md): WordPress Media Library Assistant Plugin \<= 3.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, David Lingren Media Library Assistant)
- [CVE-2023-44309](https://cve.now/CVE-2023-44309.md): Multiple stored cross-site scripting (XSS) vulnerabilities in the fragment components in Liferay Portal 7.4.2 through 7.4.3.53, and Liferay (CVSS 9.0, Liferay DXP · Liferay Portal +2)
- [CVE-2023-42629](https://cve.now/CVE-2023-42629.md): Stored cross-site scripting (XSS) vulnerability in the manage vocabulary page in Liferay Portal 7.4.2 through 7.4.3.87, and Liferay DXP 7.4 (CVSS 9.0, Liferay DXP · Liferay Portal +2)
- [CVE-2023-42497](https://cve.now/CVE-2023-42497.md): Reflected cross-site scripting (XSS) vulnerability on the Export for Translation page in Liferay Portal 7.4.3.4 through 7.4.3.85, and Lifera (CVSS 9.6, Liferay DXP · Liferay Portal +2)
- [CVE-2023-4399](https://cve.now/CVE-2023-4399.md): Grafana is an open-source platform for monitoring and observability. (CVSS 6.6, Grafana Enterprise)
- [CVE-2023-39456](https://cve.now/CVE-2023-39456.md): Apache Traffic Server: Malformed http/2 frames can cause an abort (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2023-41752](https://cve.now/CVE-2023-41752.md): Apache Traffic Server: s3\_auth plugin problem with hash calculation (CVSS 7.5, Apache Software Foundation Apache Traffic Server)
- [CVE-2023-4089](https://cve.now/CVE-2023-4089.md): WAGO: Multiple products vulnerable to local file inclusion (CVSS 2.7, WAGO Compact Controller CC100 · WAGO Edge Controller +5)
- [CVE-2023-34210](https://cve.now/CVE-2023-34210.md): SQL Injection in EasyUse MailHunter Ultimate (CVSS 7.7, EasyUse Digital Technology MailHunter Ultimate)
- [CVE-2023-34209](https://cve.now/CVE-2023-34209.md): Exposure of Sensitive System Information to an Unauthorized Control Sphere in EasyUse MailHunter Ultimate (CVSS 5.0, EasyUse Digital Technology MailHunter Ultimate)
- [CVE-2023-34208](https://cve.now/CVE-2023-34208.md): Path Traversal in EasyUse MailHunter Ultimate (CVSS 6.5, EasyUse Digital Technology MailHunter Ultimate)
- [CVE-2023-34207](https://cve.now/CVE-2023-34207.md): Unrestricted Upload of File with Dangerous Type in EasyUse MailHunter Ultimate (CVSS 9.9, EasyUse Digital Technology MailHunter Ultimate)
- [CVE-2022-43891](https://cve.now/CVE-2022-43891.md): IBM Security Verify Privilege information disclosure (CVSS 2.7, IBM Security Verify Privilege)
- [CVE-2022-43892](https://cve.now/CVE-2022-43892.md): IBM Security Verify Privilege information disclosure (CVSS 3.7, IBM Security Verify Privilege)
- [CVE-2022-43893](https://cve.now/CVE-2022-43893.md): IBM Security Verify Privilege denial of service (CVSS 2.7, IBM Security Verify Privilege)
- [CVE-2022-43889](https://cve.now/CVE-2022-43889.md): IBM Security Verify Privilege information disclosure (CVSS 5.3, IBM Security Verify Privilege)
- [CVE-2021-29913](https://cve.now/CVE-2021-29913.md): IBM Security Verify Privilege improper input validation (CVSS 6.5, IBM Security Verify Privilege)
- [CVE-2022-22380](https://cve.now/CVE-2022-22380.md): IBM Security Verify Privilege improper authentication (CVSS 5.0, IBM Security Verify Privilege)
- [CVE-2022-22375](https://cve.now/CVE-2022-22375.md): IBM Security Verify Privilege command execution (CVSS 7.2, IBM Security Verify Privilege)
- [CVE-2021-20581](https://cve.now/CVE-2021-20581.md): IBM Security Verify Privilege information disclosure (CVSS 5.3, IBM Security Verify Privilege)
- [CVE-2021-38859](https://cve.now/CVE-2021-38859.md): IBM Security Verify Privilege information disclosure (CVSS 4.3, IBM Security Verify Privilege)
- [CVE-2022-22385](https://cve.now/CVE-2022-22385.md): IBM Security Verify Privilege information disclosure (CVSS 5.9, IBM Security Verify Privilege)
- [CVE-2022-22386](https://cve.now/CVE-2022-22386.md): IBM Security Verify Privilege information disclosure (CVSS 5.3, IBM Security Verify Privilege)
- [CVE-2022-22384](https://cve.now/CVE-2022-22384.md): IBM Security Verify Privilege improper input validation (CVSS 4.3, IBM Security Verify Privilege)
- [CVE-2022-22377](https://cve.now/CVE-2022-22377.md): IBM Security Verify Privilege information disclosure (CVSS 5.3, IBM Security Verify Privilege)
- [CVE-2023-27132](https://cve.now/CVE-2023-27132.md): TSplus Remote Work 16.0.0.0 places a cleartext password on the "var pass" line of the HTML source code for the secure single sign-on web por (no CVSS)
- [CVE-2023-27133](https://cve.now/CVE-2023-27133.md): TSplus Remote Work 16.0.0.0 has weak permissions for .exe, .js, and .html files under the %PROGRAMFILES(X86)%\\TSplus-RemoteWork\\Clients\\www (no CVSS)
- [CVE-2023-36321](https://cve.now/CVE-2023-36321.md): Connected Vehicle Systems Alliance (COVESA) up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dlt\_common.c (CVSS 7.5)
- [CVE-2023-39902](https://cve.now/CVE-2023-39902.md): A software vulnerability has been identified in the U-Boot Secondary Program Loader (SPL) before 2023.07 on select NXP i.MX 8M family proces (CVSS 7.0)
- [CVE-2023-41629](https://cve.now/CVE-2023-41629.md): A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal. (no CVSS)
- [CVE-2023-41630](https://cve.now/CVE-2023-41630.md): eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the Gii code generator component. (no CVSS)
- [CVE-2023-41631](https://cve.now/CVE-2023-41631.md): eSST Monitoring v2.147.1 was discovered to contain a remote code execution (RCE) vulnerability via the file upload function. (no CVSS)
- [CVE-2023-43959](https://cve.now/CVE-2023-43959.md): An issue in YeaLinkSIP-T19P-E2 v.53.84.0.15 allows a remote privileged attacker to execute arbitrary code via a crafted request the ping fun (no CVSS)
- [CVE-2023-44693](https://cve.now/CVE-2023-44693.md): D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php. (no CVSS)
- [CVE-2023-44694](https://cve.now/CVE-2023-44694.md): D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /log/mailrecvview.php. (no CVSS)
- [CVE-2023-44824](https://cve.now/CVE-2023-44824.md): An issue in Expense Management System v.1.0 allows a local attacker to execute arbitrary code via a crafted file uploaded to the sign-up.php (no CVSS)
- [CVE-2023-45357](https://cve.now/CVE-2023-45357.md): Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a sensitive information disclosure vulnerability. (CVSS 4.3)
- [CVE-2023-45358](https://cve.now/CVE-2023-45358.md): Archer Platform 6.x before 6.13 P2 HF2 (6.13.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. (CVSS 8.5)
- [CVE-2023-45375](https://cve.now/CVE-2023-45375.md): In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via \`Pire (no CVSS)
- [CVE-2023-45386](https://cve.now/CVE-2023-45386.md): In the module extratabspro before version 2.2.8 from MyPresta.eu for PrestaShop, a guest can perform SQL injection via \`extratabspro::search (no CVSS)
- [CVE-2023-45901](https://cve.now/CVE-2023-45901.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin\\/category\\/add. (no CVSS)
- [CVE-2023-45902](https://cve.now/CVE-2023-45902.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/attachment/delete. (no CVSS)
- [CVE-2023-45903](https://cve.now/CVE-2023-45903.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/label/delete. (no CVSS)
- [CVE-2023-45904](https://cve.now/CVE-2023-45904.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /variable/update. (no CVSS)
- [CVE-2023-45905](https://cve.now/CVE-2023-45905.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/add. (no CVSS)
- [CVE-2023-45906](https://cve.now/CVE-2023-45906.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/user/add. (no CVSS)
- [CVE-2023-45907](https://cve.now/CVE-2023-45907.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/variable/delete. (no CVSS)
- [CVE-2023-45951](https://cve.now/CVE-2023-45951.md): lylme\_spage v1.7.0 was discovered to contain a SQL injection vulnerability via the $userip parameter at function.php. (no CVSS)
- [CVE-2023-45952](https://cve.now/CVE-2023-45952.md): An arbitrary file upload vulnerability in the component ajax\_link.php of lylme\_spage v1.7.0 allows attackers to execute arbitrary code via u (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.