# CVEs published 2023-10-22

26 CVEs were published on October 22, 2023: 0 critical, 1 high. Days are UTC.

- [CVE-2023-5700](https://cve.now/CVE-2023-5700.md): Netentsec NS-ASG Application Security Gateway uploadiscgwrouteconf.php sql injection (CVSS 5.5, Netentsec NS-ASG Application Security Gateway)
- [CVE-2023-5699](https://cve.now/CVE-2023-5699.md): CodeAstro Internet Banking System pages\_view\_client.php cross site scripting (CVSS 3.5, CodeAstro Internet Banking System)
- [CVE-2023-5698](https://cve.now/CVE-2023-5698.md): CodeAstro Internet Banking System pages\_deposit\_money.php cross site scripting (CVSS 3.5, CodeAstro Internet Banking System)
- [CVE-2023-5697](https://cve.now/CVE-2023-5697.md): CodeAstro Internet Banking System pages\_withdraw\_money.php cross site scripting (CVSS 3.5, CodeAstro Internet Banking System)
- [CVE-2023-5696](https://cve.now/CVE-2023-5696.md): CodeAstro Internet Banking System pages\_transfer\_money.php cross site scripting (CVSS 3.5, CodeAstro Internet Banking System)
- [CVE-2023-5695](https://cve.now/CVE-2023-5695.md): CodeAstro Internet Banking System pages\_reset\_pwd.php cross site scripting (CVSS 3.5, CodeAstro Internet Banking System)
- [CVE-2023-5694](https://cve.now/CVE-2023-5694.md): CodeAstro Internet Banking System pages\_system\_settings.php cross site scripting (CVSS 3.5, CodeAstro Internet Banking System)
- [CVE-2023-5693](https://cve.now/CVE-2023-5693.md): CodeAstro Internet Banking System pages\_reset\_pwd.php sql injection (CVSS 6.3, CodeAstro Internet Banking System)
- [CVE-2023-46095](https://cve.now/CVE-2023-46095.md): WordPress Smooth Scroll Links Plugin \<= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Chetan Gole Smooth Scroll Links \[SSL\])
- [CVE-2023-46089](https://cve.now/CVE-2023-46089.md): WordPress Userback Plugin \<= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Lee Le @ Userback Userback)
- [CVE-2023-46085](https://cve.now/CVE-2023-46085.md): WordPress Wp Ultimate Review Plugin \<= 2.2.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Wpmet Wp Ultimate Review)
- [CVE-2023-38735](https://cve.now/CVE-2023-38735.md): IBM Cognos Dashboards improper authentication (CVSS 5.7, IBM Cognos Dashboards on Cloud Pak for Data)
- [CVE-2023-38276](https://cve.now/CVE-2023-38276.md): IBM Cognos Dashboards information disclosure (CVSS 5.9, IBM Cognos Dashboards on Cloud Pak for Data)
- [CVE-2023-38275](https://cve.now/CVE-2023-38275.md): IBM Cognos Dashboards information disclosure (CVSS 5.9, IBM Cognos Dashboards on Cloud Pak for Data)
- [CVE-2021-46897](https://cve.now/CVE-2021-46897.md): views.py in Wagtail CRX CodeRed Extensions (formerly CodeRed CMS or coderedcms) before 0.22.3 allows upward protected/..%2f..%2f path traver (no CVSS, coderedcms)
- [CVE-2021-46898](https://cve.now/CVE-2021-46898.md): views/switch.py in django-grappelli (aka Django Grappelli) before 2.15.2 attempts to prevent external redirection with startswith("/") but t (no CVSS, django-grappelli)
- [CVE-2023-46298](https://cve.now/CVE-2023-46298.md): Next.js before 13.4.20-canary.13 lacks a cache-control header and thus empty prefetch responses may sometimes be cached by a CDN, causing a (no CVSS, next)
- [CVE-2023-46300](https://cve.now/CVE-2023-46300.md): iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to tmux integratio (no CVSS)
- [CVE-2023-46301](https://cve.now/CVE-2023-46301.md): iTerm2 before 3.4.20 allow (potentially remote) code execution because of mishandling of certain escape sequences related to upload. (no CVSS)
- [CVE-2023-46303](https://cve.now/CVE-2023-46303.md): link\_to\_local\_path in ebooks/conversion/plugins/html\_input.py in calibre before 6.19.0 can, by default, add resources outside of the documen (no CVSS)
- [CVE-2023-46306](https://cve.now/CVE-2023-46306.md): The web administration interface in NetModule Router Software (NRSW) 4.6 before 4.6.0.106 and 4.8 before 4.8.0.101 executes an OS command co (CVSS 8.4)
- [CVE-2023-46315](https://cve.now/CVE-2023-46315.md): The zanllp sd-webui-infinite-image-browsing (aka Infinite Image Browsing) extension before 977815a for stable-diffusion-webui (aka Stable Di (no CVSS)
- [CVE-2023-46317](https://cve.now/CVE-2023-46317.md): Knot Resolver before 5.7.0 performs many TCP reconnections upon receiving certain nonsensical responses from servers. (no CVSS)
- [CVE-2023-46319](https://cve.now/CVE-2023-46319.md): WALLIX Bastion 9.x before 9.0.9 and 10.x before 10.0.5 allows unauthenticated access to sensitive information by bypassing access control on (no CVSS)
- [CVE-2023-46321](https://cve.now/CVE-2023-46321.md): iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize paths in x-man-page URLs. (no CVSS)
- [CVE-2023-46322](https://cve.now/CVE-2023-46322.md): iTermSessionLauncher.m in iTerm2 before 3.5.0beta12 does not sanitize ssh hostnames in URLs. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.