CVEs published October 22, 2023
26 CVEs were published on October 22, 2023: 0 critical, 1 high.
- Published
- 26
- Critical
- 0
- High
- 1
- Medium
- 8
- Low
- 6
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- CodeAstro Internet Banking System
- 7
- IBM Cognos Dashboards on Cloud Pak for Data
- 3
- Chetan Gole Smooth Scroll Links [SSL]
- 1
- coderedcms
- 1
- django-grappelli
- 1
- Lee Le @ Userback Userback
- 1
- Netentsec NS-ASG Application Security Gateway
- 1
- next
- 1
- Wpmet Wp Ultimate Review
- 1
High 1
Medium, low and unrated 25
- CVE-2023-5700Netentsec NS-ASG Application Security Gateway uploadiscgwrouteconf.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2023-5699CodeAstro Internet Banking System pages_view_client.php cross site scriptingCodeAstro Internet Banking System
- CVE-2023-5698CodeAstro Internet Banking System pages_deposit_money.php cross site scriptingCodeAstro Internet Banking System
- CVE-2023-5697CodeAstro Internet Banking System pages_withdraw_money.php cross site scriptingCodeAstro Internet Banking System
- CVE-2023-5696CodeAstro Internet Banking System pages_transfer_money.php cross site scriptingCodeAstro Internet Banking System
- CVE-2023-5695CodeAstro Internet Banking System pages_reset_pwd.php cross site scriptingCodeAstro Internet Banking System
- CVE-2023-5694CodeAstro Internet Banking System pages_system_settings.php cross site scriptingCodeAstro Internet Banking System
- CVE-2023-5693CodeAstro Internet Banking System pages_reset_pwd.php sql injectionCodeAstro Internet Banking System
- CVE-2023-46095WordPress Smooth Scroll Links Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF)Chetan Gole Smooth Scroll Links [SSL]
- CVE-2023-46089WordPress Userback Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)Lee Le @ Userback Userback
- CVE-2023-46085WordPress Wp Ultimate Review Plugin <= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF)Wpmet Wp Ultimate Review
- CVE-2023-38735IBM Cognos Dashboards improper authenticationIBM Cognos Dashboards on Cloud Pak for Data
- CVE-2023-38276IBM Cognos Dashboards information disclosureIBM Cognos Dashboards on Cloud Pak for Data
- CVE-2023-38275IBM Cognos Dashboards information disclosureIBM Cognos Dashboards on Cloud Pak for Data
- CVE-2021-46897views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path travercoderedcms
- CVE-2021-46898views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but tdjango-grappelli
- CVE-2023-46298Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a next
- CVE-2023-46300iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integratio
- CVE-2023-46301iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload.
- CVE-2023-46303link_to_local_path in ebooks/conversion/plugins/html_input.py in calibre before 6.19.0 can, by default, add resources outside of the documen
- CVE-2023-46315The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Di
- CVE-2023-46317Knot Resolver before 5.7.0 performs many TCP reconnections upon receiving certain nonsensical responses from servers.
- CVE-2023-46319WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on
- CVE-2023-46321iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs.
- CVE-2023-46322iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs.