CVEs published October 23, 2023
53 CVEs were published on October 23, 2023: 0 critical, 10 high.
- Published
- 53
- Critical
- 0
- High
- 10
- Medium
- 21
- Low
- 4
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Zscaler Client Connector
- 12
- Dell Unity
- 4
- IBM Security Verify Governance
- 4
- Apache Software Foundation Apache HTTP Server
- 3
- IBM Sterling Partner Engagement Manager
- 2
- wabt
- 2
- Apache Software Foundation Apache Airflow · apache-airflow
- 1
- concrete5/concrete5
- 1
- frappe
- 1
- github.com/free5gc/udm
- 1
High 10
- CVE-2023-5633Kernel: vmwgfx: reference count issue leads to use-after-free in surface handlingRed Hat Enterprise Linux
- CVE-2023-33839IBM Security Verify Governance command executionIBM Security Verify Governance
- CVE-2023-28804Linux ZCC allows unsigned updates, allowing elevated Code ExecutionZscaler Client Connector
- CVE-2023-28796IPC Bypass Through PLT Section in ELFZscaler Client Connector
- CVE-2023-28795Client IPC validation bypassZscaler Client Connector
- CVE-2023-28793Heap Based Buffer Overflow in LibraryZscaler Client Connector
- CVE-2021-26738Privilege Escalation for ZCC macOS via PATH VariableZscaler Client Connector
- CVE-2023-5246Authentication Bypass by Capture-replay in SICK Flexi Soft Gateways with Partnumbers 1044073, 1127717, 1130282, 1044074, 1121597, 1099832, 1SICK AG FX0-GMOD00000 · SICK AG FX0-GMOD00010 +11
- CVE-2023-33517carRental 1.0 is vulnerable to Incorrect Access Control (Arbitrary File Read on the Back-end System).
- CVE-2023-45966umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability.
Medium, low and unrated 43
- CVE-2023-33837IBM Security Verify Governance information disclosureIBM Security Verify Governance
- CVE-2022-22466IBM Security Verify Governance information disclosureIBM Security Verify Governance
- CVE-2023-33840IBM Security Verify Governance cross-site scriptingIBM Security Verify Governance
- CVE-2023-46288Apache Airflow: Sensitive parameters exposed in API when "non-sensitive-only" configuration is setApache Software Foundation Apache Airflow · apache-airflow
- CVE-2023-38722IBM Sterling Partner Engagement Manager cross-site scriptingIBM Sterling Partner Engagement Manager
- CVE-2023-43045IBM Sterling Partner Engagement Manager security bypassIBM Sterling Partner Engagement Manager
- CVE-2023-37532A path traversal vulnerability affects HCL CommerceHCL Software HCL Commerce
- CVE-2023-46122Arbitrary file write via archive extraction (Zip Slip) vulnerability in sbtsbt · org.scala-sbt:sbt +3
- CVE-2023-43067 Dell Unity prior to 5.3 contains an XML External Entity injection vulnerability.Dell Unity
- CVE-2023-43066 Dell Unity prior to 5.3 contains a Restricted Shell Bypass vulnerability.Dell Unity
- CVE-2023-43065 Dell Unity prior to 5.3 contains a Cross-site scripting vulnerability.Dell Unity
- CVE-2023-43074 Dell Unity 5.3 contain(s) an Arbitrary File Creation vulnerability.Dell Unity
- CVE-2023-46127Frappe vulnerable to HTML injection by any Desk userfrappe
- CVE-2023-5718The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API.Vue.js devtools
- CVE-2023-28805ZCC on Linux privilege escalationZscaler Client Connector
- CVE-2023-28803Traffic being bypassed by ZCC by configuring synthetic IP range as local networkZscaler Client Connector
- CVE-2023-28797LPE using arbitrary file delete with SymlinksZscaler Client Connector
- CVE-2021-26737Privilege Escalation Using PID Reuse in ZCC macOSZscaler Client Connector
- CVE-2021-26736ZApp Installer Privilege Escalation VulnerabilitiesZscaler Client Connector
- CVE-2021-26735Untrusted Search Path While Executing REG DELETE by UninstallerZscaler Client Connector
- CVE-2021-26734Junction Delete leading to elevation of privilegeZscaler Client Connector
- CVE-2023-31122Apache HTTP Server: mod_macro buffer over-readApache Software Foundation Apache HTTP Server
- CVE-2023-43622Apache HTTP Server: DoS in HTTP/2 with initial windows size 0Apache Software Foundation Apache HTTP Server
- CVE-2023-45802Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RSTApache Software Foundation Apache HTTP Server
- CVE-2023-43624CX-Designer Ver.3.740 and earlier (included in CX-One CXONE-AL[][]D-V4) contains an improper restriction of XML external entity reference (OMRON CX-Designer
- CVE-2023-5702Viessmann Vitogate 300 direct requestViessmann Vitogate
- CVE-2023-5701vnotex vnote Markdown File cross site scriptingvnotex vnote
- CVE-2023-27148A stored cross-site scripting (XSS) vulnerability in the Admin panel in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary w
- CVE-2023-27149A stored cross-site scripting (XSS) vulnerability in Enhancesoft osTicket v1.17.2 allows attackers to execute arbitrary web scripts or HTML
- CVE-2023-27152DECISO OPNsense 23.1 does not impose rate limits for authentication, allowing attackers to perform a brute-force attack to bypass authentica
- CVE-2023-37635UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the app
- CVE-2023-37636A stored cross-site scripting (XSS) vulnerability in UVDesk Community Skeleton v1.1.1 allows attackers to execute arbitrary web scripts or H
- CVE-2023-42295An issue in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of service via the read_rle_im
- CVE-2023-43358Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the T
- CVE-2023-44760Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted scriptconcrete5/concrete5
- CVE-2023-45998kodbox 1.44 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-46058Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted pa
- CVE-2023-46059Cross Site Scripting (XSS) vulnerability in Geeklog-Core geeklog v.2.2.2 allows a remote attacker to execute arbitrary code via a crafted pa
- CVE-2023-46324pkg/suci/suci.go in free5GC udm before 1.2.0, when Go before 1.19 is used, allows an Invalid Curve Attack because it may compute a shared segithub.com/free5gc/udm
- CVE-2023-46331WebAssembly wabt 1.0.33 has an Out-of-Bound Memory Read in in DataSegment::IsValidRange(), which lead to segmentation fault.wabt
- CVE-2023-46332WebAssembly wabt 1.0.33 contains an Out-of-Bound Memory Write in DataSegment::Drop(), which lead to segmentation fault.wabt
- CVE-2023-46602In International Color Consortium DemoIccMAX 79ecb74, there is a stack-based buffer overflow in the icFixXml function in IccXML/IccLibXML/Ic
- CVE-2023-46603In International Color Consortium DemoIccMAX 79ecb74, there is an out-of-bounds read in the CIccPRMG::GetChroma function in IccProfLib/IccPr