CVEs published October 18, 2023
74 CVEs were published on October 18, 2023: 4 critical, 24 high. 2 are now in CISA KEV.
- Published
- 74
- Critical
- 4
- High
- 24
- Medium
- 29
- Low
- 1
- Unrated
- 16
- Now in CISA KEV
- 2
- Fix available
- 21
Most affected products
- arduino-create-agent · github.com/arduino/arduino-create-ag…
- 4
- Baker Hughes - Bently Nevada Bently Nevada 3500 System
- 3
- NodeJS Node
- 3
- Pegasystems Pega Platform
- 3
- 10Web Form Builder Team Form Maker by 10Web – Mobile-Friend…
- 2
- curl
- 2
- Google Android
- 2
- Ivanti Endpoint Manager
- 2
- 100plugins Open User Map
- 1
- Advantech R-SeeNet
- 1
Critical 4
- CVE-2023-37502An unrestricted file upload vulnerability affects HCL CompassHCL Software HCL Compass
- CVE-2023-45146Remote code execution in XXL-RPCxuexueli xxl-rpc · com.xuxueli:xxl-rpc-core
- CVE-2023-5642Advantech R-SeeNet Unauthenticated Read/WriteAdvantech R-SeeNet
- CVE-2023-45911An issue in WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 allows unauthenticated attackers to login as any user without a password.
High 24
- CVE-2023-34437Baker Hughes Bently Nevada 3500 System Incorrect Permission Assignment for Critical ResourceBaker Hughes - Bently Nevada Bently Nevada 3500 System
- CVE-2023-45812Improper Check or Handling of Exceptional Conditions in apollo-routerapollographql router · apollo-router
- CVE-2023-43800Insufficient Verification of Data Authenticity in Arduino Create Agentarduino-create-agent · github.com/arduino/arduino-create-ag…
- CVE-2023-43802Path traversal in Arduino Create Agentarduino-create-agent · github.com/arduino/arduino-create-ag…
- CVE-2023-4601Stack-based Buffer Overflow in NI System Configuration SoftwareNI System Configuration
- CVE-2023-30781WordPress Tweeple Plugin <= 0.9.5 is vulnerable to Cross Site Scripting (XSS)Theme Blvd Tweeple
- CVE-2023-45632WordPress Video Player Plugin <= 1.5.22 is vulnerable to Cross Site Scripting (XSS)WebDorado SpiderVPlayer
- CVE-2023-45630WordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)wpdevart Gallery – Image and Video Gallery with Thumbnails
- CVE-2023-45602WordPress Ebook Store Plugin <= 5.785 is vulnerable to Cross Site Scripting (XSS)Shopfiles Ebook Store
- CVE-2023-45071WordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS)10Web Form Builder Team Form Maker by 10Web – Mobile-Friend…
- CVE-2023-45070WordPress Form Maker by 10Web Plugin <= 1.15.18 is vulnerable to Cross Site Scripting (XSS)10Web Form Builder Team Form Maker by 10Web – Mobile-Friend…
- CVE-2023-45065WordPress Bulk NoIndex & NoFollow Toolkit Plugin <= 1.42 is vulnerable to Cross Site Scripting (XSS)Mad Fish Digital Bulk NoIndex & NoFollow Toolkit
- CVE-2023-45727Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1North Grid Proself Enterprise/Standard Edition · North G… +1
- CVE-2023-45064WordPress OPcache Dashboard Plugin <= 0.3.1 is vulnerable to Cross Site Scripting (XSS)Daisuke Takahashi(Extend Wings) OPcache Dashboard
- CVE-2023-45062WordPress Download canvasio3D Light Plugin <= 2.4.6 is vulnerable to Cross Site Scripting (XSS)Thomas Scholl canvasio3D Light
- CVE-2023-5632Unconditionally adding an event to the epoll causes excessive CPU consumptionEclipse Mosquitto
- CVE-2023-45054WordPress Product Category Tree Plugin <= 2.5 is vulnerable to Cross Site Scripting (XSS)AWESOME TOGI Product Category Tree
- CVE-2023-25476WordPress AmpedSense – AdSense Split Tester Plugin <= 4.68 is vulnerable to Cross Site Scripting (XSS)Ezoic AmpedSense – AdSense Split Tester
- CVE-2023-5538MpOperationLogs <= 1.0.1 - Unauthenticated Stored Cross-Site Scriptingburningx mpOperationLogs
- CVE-2023-39331A previously disclosed vulnerability (CVE-2023-30584) was patched insufficiently in commit 205f1e6.NodeJS Node
- CVE-2023-38545This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.curl
- CVE-2023-42319Geth (aka go-ethereum) through 1.13.4, when --http --graphql is used, allows remote attackers to cause a denial of service (memory consumptigithub.com/ethereum/go-ethereum
- CVE-2023-43250XNSoft Nconvert 7.136 is vulnerable to Buffer Overflow.
- CVE-2023-45383In the module "SoNice etiquetage" (sonice_etiquetage) up to version 2.5.9 from Common-Services for PrestaShop, a guest can download personal
Medium, low and unrated 46
- CVE-2023-36857Baker Hughes Bently Nevada 3500 System Authentication Bypass by Capture-replayBaker Hughes - Bently Nevada Bently Nevada 3500 System
- CVE-2023-34441Baker Hughes Bently Nevada 3500 System Cleartext Transmission of Sensitive InformationBaker Hughes - Bently Nevada Bently Nevada 3500 System
- CVE-2023-45814Tokens cached in the AuthenticationService are susceptible to reuse in BunkumLittleBigRefresh Bunkum · Bunkum
- CVE-2023-43801Path traversal in Arduino Create Agentarduino-create-agent · github.com/arduino/arduino-create-ag…
- CVE-2023-43803Path traversal in Arduino Create Agentarduino-create-agent · github.com/arduino/arduino-create-ag…
- CVE-2023-45813Inefficient Regular Expression Complexity in TorBotDedSecInside TorBot · torbot
- CVE-2023-45145Redis Unix-domain socket may have be exposed with the wrong permissions for a short time window.redis
- CVE-2023-35663 In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-35656 In multiple functions of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-26300A potential security vulnerability has been identified in the system BIOS for certain HP PC products which might allow escalation of privileHP PC products
- CVE-2023-30911HPE Integrated Lights-Out 5, and Integrated Lights-Out 6 using iLOrest may cause denial of service.Hewlett Packard Enterprise (HPE) HPE Integrated Lights-Out
- CVE-2023-20261A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to retrieve arbitrary files froCisco SD-WAN vManage
- CVE-2023-5631Stored XSS vulnerability in RoundcubeRoundcubemail
- CVE-2023-45628WordPress QR Twitter Widget Plugin <= 0.2.3 is vulnerable to Cross Site Scripting (XSS)QROkes QR Twitter Widget
- CVE-2023-45604WordPress Get Custom Field Values Plugin <= 4.0.1 is vulnerable to Cross Site Scripting (XSS)Scott Reilly Get Custom Field Values
- CVE-2023-45607WordPress WordPress Popular Posts Plugin <= 6.3.2 is vulnerable to Cross Site Scripting (XSS)Hector Cabrera WordPress Popular Posts
- CVE-2023-45608WordPress Smart Cookie Kit Plugin <= 2.3.1 is vulnerable to Cross Site Scripting (XSS)Nicola Modugno Smart Cookie Kit
- CVE-2023-45073WordPress Mendeley Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)Michael Koch Mendeley Plugin
- CVE-2023-31217WordPress User Location and IP Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)MyTechTalky User Location and IP
- CVE-2023-45072WordPress Order auto complete for WooCommerce Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)Kardi Order auto complete for WooCommerce
- CVE-2023-45067WordPress WP Simple HTML Sitemap Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)Ashish Ajani WordPress Simple HTML Sitemap
- CVE-2023-32089 Pega Platform versions 8.1 to 8.8.2 are affected by an XSS issue with Pin description Pegasystems Pega Platform
- CVE-2023-32088 Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with ad-hoc case creation Pegasystems Pega Platform
- CVE-2023-32087 Pega Platform versions 8.1 to Infinity 23.1.0 are affected by an XSS issue with task creation Pegasystems Pega Platform
- CVE-2023-45059WordPress Gumroad Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)Gumroad
- CVE-2023-45057WordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Scripting (XSS)Hitsteps Web Analytics
- CVE-2023-45056WordPress Open User Map | Everybody can add locations Plugin <= 1.3.26 is vulnerable to Cross Site Scripting (XSS)100plugins Open User Map
- CVE-2023-45051WordPress Image vertical reel scroll slideshow Plugin <= 9.0 is vulnerable to Cross Site Scripting (XSS)Gopi Ramasamy Image vertical reel scroll slideshow
- CVE-2023-45049WordPress YouTube Playlist Player Plugin <= 4.6.7 is vulnerable to Cross Site Scripting (XSS)Ciprian Popescu YouTube Playlist Player
- CVE-2023-45008WordPress Comment Reply Email Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)WPJohnny Comment Reply Email
- CVE-2023-4938BEAR <= 1.1.3.3 - Missing Authorization to Product Manipulationrealmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2023-5621Thumbnail Slider With Lightbox <= 1.0 - Authenticated (Administrator+) Stored Cross-Site Scripting via Image Titlenik00726 Thumbnail Slider With Lightbox
- CVE-2023-3254Widgets for Google Reviews <= 10.9 - Cross-Site Request Forgery to Plugin Settings Resettrustindex Widgets for Google Reviews
- CVE-2023-38552When the Node.js policy feature checks the integrity of a resource against a trusted manifest, the application can intercept the operation aNodeJS Node
- CVE-2023-39332Various `node:fs` functions allow specifying paths as either strings or `Uint8Array` objects.NodeJS Node
- CVE-2023-35083Allows an authenticated attacker with network access to read arbitrary files on Endpoint Manager recently discovered on 2022 SU3 and all preIvanti Endpoint Manager
- CVE-2023-35084Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022 su3 and all previousIvanti Endpoint Manager
- CVE-2023-38546This flaw allows an attacker to insert cookies at will into a running program using libcurl, if the specific series of conditions are met.curl
- CVE-2023-45909zzzcms v2.2.0 was discovered to contain an open redirect vulnerability.
- CVE-2023-45912WIPOTEC GmbH ComScale v4.3.29.21344 and v4.4.12.723 fails to validate user sessions, allowing unauthenticated attackers to read files from t
- CVE-2023-45958Thirty Bees Core v1.4.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the backup_pagination parameter a
- CVE-2023-46004Sourcecodester Best Courier Management System 1.0 is vulnerable to Arbitrary file upload in the update_user function.
- CVE-2023-46005Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_branch.php.
- CVE-2023-46006Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_user.php.
- CVE-2023-46007Sourcecodester Best Courier Management System 1.0 is vulnerable to SQL Injection via the parameter id in /edit_staff.php.
- CVE-2023-46009gifsicle-1.94 was found to have a floating point exception (FPE) vulnerability via resize_stream at src/xform.c.