# CVEs published 2023-10-24

122 CVEs were published on October 24, 2023: 3 critical, 33 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-46136](https://cve.now/CVE-2023-46136.md): Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning (CVSS 8.0, pallets werkzeug · werkzeug)
- [CVE-2023-46118](https://cve.now/CVE-2023-46118.md): Denial of Service by publishing large messages over the HTTP API (CVSS 4.9, rabbitmq-server)
- [CVE-2023-46120](https://cve.now/CVE-2023-46120.md): RabbitMQ Java client's lack of message size limitation leads to remote DoS attack (CVSS 4.9, rabbitmq-java-client · com.rabbitmq:amqp-client)
- [CVE-2023-46124](https://cve.now/CVE-2023-46124.md): Server-Side Request Forgery Vulnerability in Custom Integration Upload (CVSS 8.2, ethyca fides · ethyca-fides)
- [CVE-2023-46125](https://cve.now/CVE-2023-46125.md): Fides Information Disclosure Vulnerability in Config API Endpoint (CVSS 6.5, ethyca fides · ethyca-fides)
- [CVE-2023-43795](https://cve.now/CVE-2023-43795.md): WPS Server Side Request Forgery in GeoServer (CVSS 8.6, geoserver · org.geoserver.extension:gs-wps-core)
- [CVE-2023-46126](https://cve.now/CVE-2023-46126.md): Fides JavaScript Injection Vulnerability in Privacy Center URL (CVSS 3.9, ethyca fides · ethyca-fides)
- [CVE-2023-26219](https://cve.now/CVE-2023-26219.md): TIBCO Operational Intelligence Hawk RedTail Credential Exposure Vulnerability (CVSS 7.4, TIBCO Software TIBCO Hawk · TIBCO Software TIBCO Operati… +1)
- [CVE-2023-5568](https://cve.now/CVE-2023-5568.md): Samba: heap buffer overflow with freshness tokens in the heimdal kdc (CVSS 5.9, Red Hat Enterprise Linux · Red Hat Storage)
- [CVE-2023-5752](https://cve.now/CVE-2023-5752.md): Mercurial configuration injectable in repo revision when installing via pip (CVSS 5.5, Pip maintainers pip · pip)
- [CVE-2023-39930](https://cve.now/CVE-2023-39930.md): PingFederate PingID Radius PCV Authentication Bypass (CVSS 7.5, Ping Identity PingID Radius PCV)
- [CVE-2022-3699](https://cve.now/CVE-2022-3699.md): A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to (CVSS 7.8, Lenovo HardwareScanPlugin · Lenovo Diagnostics)
- [CVE-2022-3698](https://cve.now/CVE-2022-3698.md): A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics vers (CVSS 4.4, Lenovo HardwareScanPlugin · Lenovo Diagnostics)
- [CVE-2022-0353](https://cve.now/CVE-2022-0353.md): A denial of service vulnerability was reported in the Lenovo HardwareScanPlugin versions prior to 1.3.1.2 and Lenovo Diagnostics vers (CVSS 4.4, Lenovo HardwareScanPlugin · Lenovo Diagnostics)
- [CVE-2023-3112](https://cve.now/CVE-2023-3112.md): A vulnerability was reported in Elliptic Labs Virtual Lock Sensor for ThinkPad T14 Gen 3 that could allow an attacker with local access to e (CVSS 7.8, Lenovo Elliptic Labs Virtual Lock Sensor · Lenovo AI Virtua…)
- [CVE-2023-4608](https://cve.now/CVE-2023-4608.md): An authenticated XCC user with elevated privileges can perform blind SQL injection in limited cases through a crafted API command. (CVSS 4.1, Lenovo XClarity Controller)
- [CVE-2023-4607](https://cve.now/CVE-2023-4607.md): An authenticated XCC user can change permissions for any user through a crafted API command. (CVSS 7.5, Lenovo XClarity Controller)
- [CVE-2023-4606](https://cve.now/CVE-2023-4606.md): An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. (CVSS 8.1, Lenovo XClarity Controller)
- [CVE-2023-41339](https://cve.now/CVE-2023-41339.md): Unsecured WMS dynamic styling sld=\<url\> parameter affords blind unauthenticated SSRF in GeoServer (CVSS 8.6, geoserver · org.geoserver:gs-wms +1)
- [CVE-2023-5758](https://cve.now/CVE-2023-5758.md): When opening a page in reader mode, the redirect URL could have caused attacker-controlled script to execute in a reflected Cross-Site Scrip (CVSS 6.1, Mozilla Firefox for iOS)
- [CVE-2023-39231](https://cve.now/CVE-2023-39231.md): PingFederate PingOne MFA IK Device Pairing Second Factor Authentication Bypass (CVSS 7.3, Ping Identity PingOne MFA Integration Kit)
- [CVE-2023-43510](https://cve.now/CVE-2023-43510.md): Authenticated Remote Command Injection in ClearPass Policy Manager Web-Based Management Interface Leading to Partial System Compromise (CVSS 4.7, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2023-43509](https://cve.now/CVE-2023-43509.md): Unauthenticated Endpoint Allows Sending Arbitrary OnGuard Notifications (CVSS 5.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2023-43508](https://cve.now/CVE-2023-43508.md): Authorization Bypass Leading to Privilege Escalation in ClearPass Policy Manager Web-Based Management Interface (CVSS 6.3, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2023-43507](https://cve.now/CVE-2023-43507.md): Authenticated SQL Injection Vulnerability in ClearPass Policy Manager Web-based Management Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2023-43506](https://cve.now/CVE-2023-43506.md): Local Privilege Escalation in ClearPass OnGuard Linux Agent (CVSS 7.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2023-42031](https://cve.now/CVE-2023-42031.md): IBM CICS TX denial of service (CVSS 4.9, IBM TXSeries for Multiplatforms · IBM CICS TX Standard +1)
- [CVE-2023-5753](https://cve.now/CVE-2023-5753.md): Potential buffer overflow vulnerabilities in the Zephyr Bluetooth subsystem (CVSS 6.3, zephyrproject-rtos Zephyr)
- [CVE-2023-5363](https://cve.now/CVE-2023-5363.md): Incorrect cipher key & IV length processing (CVSS 7.5, OpenSSL)
- [CVE-2023-46128](https://cve.now/CVE-2023-46128.md): Exposure of hashed user passwords via REST API in Nautobot (CVSS 6.5, nautobot)
- [CVE-2023-20273](https://cve.now/CVE-2023-20273.md): A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the pri (CVSS 7.2, KEV, Cisco IOS XE Software)
- [CVE-2023-5744](https://cve.now/CVE-2023-5744.md): Very Simple Google Maps \<= 2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, masterk Very Simple Google Maps)
- [CVE-2023-5740](https://cve.now/CVE-2023-5740.md): Live Chat with Facebook Messenger \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ninjateam Live Chat with Facebook Messenger)
- [CVE-2023-5126](https://cve.now/CVE-2023-5126.md): Delete Me \<= 3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 4.9, cmc3215 Delete Me)
- [CVE-2023-5110](https://cve.now/CVE-2023-5110.md): BSK PDF Manager \<= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, bannersky BSK PDF Manager)
- [CVE-2023-5085](https://cve.now/CVE-2023-5085.md): Advanced Menu Widget \<= 0.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, johnnypea Advanced Menu Widget)
- [CVE-2023-5127](https://cve.now/CVE-2023-5127.md): WP Font Awesome \<= 1.7.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, zayedbaloch WP Font Awesome)
- [CVE-2023-5745](https://cve.now/CVE-2023-5745.md): Reusable Text Blocks \<= 1.5.3 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode (CVSS 5.5, richardgabriel Reusable Text Blocks)
- [CVE-2023-46071](https://cve.now/CVE-2023-46071.md): WordPress Protección de Datos RGPD Plugin \<= 3.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, ClickDatos Protección de Datos RGPD)
- [CVE-2023-46070](https://cve.now/CVE-2023-46070.md): WordPress EG-Attachments Plugin \<= 2.1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Emmanuel GEORJON EG-Attachments)
- [CVE-2023-46069](https://cve.now/CVE-2023-46069.md): WordPress Ajax Archive Calendar Plugin \<= 2.6.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Osmansorkar Ajax Archive Calendar)
- [CVE-2023-46068](https://cve.now/CVE-2023-46068.md): WordPress Maileon Plugin \<= 2.16.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, XQueue Maileon for WordPress)
- [CVE-2023-45837](https://cve.now/CVE-2023-45837.md): WordPress Ultimate Taxonomy Manager Plugin \<= 2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, XYDAC Ultimate Taxonomy Manager)
- [CVE-2023-5732](https://cve.now/CVE-2023-5732.md): Address bar spoofing via bidirectional characters (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-5731](https://cve.now/CVE-2023-5731.md): Memory safety bugs present in Firefox 118. (no CVSS, Mozilla Firefox)
- [CVE-2023-5730](https://cve.now/CVE-2023-5730.md): Memory safety bugs present in Firefox 118, Firefox ESR 115.3, and Thunderbird 115.3. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-5729](https://cve.now/CVE-2023-5729.md): A malicious web site can enter fullscreen mode while simultaneously triggering a WebAuthn prompt. (no CVSS, Mozilla Firefox)
- [CVE-2023-5728](https://cve.now/CVE-2023-5728.md): During garbage collection extra operations were performed on a object that should not be. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-5727](https://cve.now/CVE-2023-5727.md): The executable file warning was not presented when downloading .msix, .msixbundle, .appx, and .appxbundle files, which can run commands on a (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-5726](https://cve.now/CVE-2023-5726.md): A website could have obscured the full screen notification by using the file open dialog. (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-5725](https://cve.now/CVE-2023-5725.md): A malicious installed WebExtension could open arbitrary URLs, which under the right circumstance could be leveraged to collect sensitive use (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-5724](https://cve.now/CVE-2023-5724.md): Drivers are not always robust to extremely large draw calls and in some cases this scenario could have led to a crash. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-5723](https://cve.now/CVE-2023-5723.md): An attacker with temporary script access to a site could have set a cookie containing invalid characters using \`document.cookie\` that could (no CVSS, Mozilla Firefox)
- [CVE-2023-5722](https://cve.now/CVE-2023-5722.md): Using iterative requests an attacker was able to learn the size of an opaque response, as well as the contents of a server-supplied Vary hea (no CVSS, Mozilla Firefox)
- [CVE-2023-5721](https://cve.now/CVE-2023-5721.md): It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an insufficient acti (no CVSS, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-45835](https://cve.now/CVE-2023-45835.md): WordPress Libsyn Publisher Hub Plugin \<= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Libsyn Publisher Hub)
- [CVE-2023-45833](https://cve.now/CVE-2023-45833.md): WordPress LeadSquared Suite Plugin \<= 0.7.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, LeadSquared Suite)
- [CVE-2023-45829](https://cve.now/CVE-2023-45829.md): WordPress Newsletter & Bulk Email Sender Plugin \<= 2.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, HappyBox Newsletter & Bulk Email Sender – Email Newsletter…)
- [CVE-2023-45772](https://cve.now/CVE-2023-45772.md): WordPress Proofreading Plugin \<= 1.0.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Scribit Proofreading)
- [CVE-2023-45770](https://cve.now/CVE-2023-45770.md): WordPress Fast WP Speed Plugin \<= 1.0.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Fastwpspeed Fast WP Speed)
- [CVE-2023-45832](https://cve.now/CVE-2023-45832.md): WordPress WP GoToWebinar Plugin \<= 14.45 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Martin Gibson WP GoToWebinar)
- [CVE-2023-45769](https://cve.now/CVE-2023-45769.md): WordPress WP Report Post Plugin \<= 2.1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Alex Raven WP Report Post)
- [CVE-2023-45768](https://cve.now/CVE-2023-45768.md): WordPress Next Page Plugin \<= 1.5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Stephanie Leary Next Page)
- [CVE-2023-45767](https://cve.now/CVE-2023-45767.md): WordPress Simple Tweet Plugin \<= 1.4.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Wokamoto Simple Tweet)
- [CVE-2023-45764](https://cve.now/CVE-2023-45764.md): WordPress Scroll post excerpt Plugin \<= 8.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Gopi Ramasamy Scroll post excerpt)
- [CVE-2023-45761](https://cve.now/CVE-2023-45761.md): WordPress Sendle Shipping Plugin \<= 5.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Joovii Sendle Shipping Plugin)
- [CVE-2023-39924](https://cve.now/CVE-2023-39924.md): WordPress Simple File List Plugin \<= 6.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Mitchell Bennis Simple File List)
- [CVE-2023-45759](https://cve.now/CVE-2023-45759.md): WordPress Peter’s Custom Anti-Spam Plugin \<= 3.2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Peter Keung Peter’s Custom Anti-Spam)
- [CVE-2023-45758](https://cve.now/CVE-2023-45758.md): WordPress Amministrazione Trasparente Plugin \<= 8.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Marco Milesi Amministrazione Trasparente)
- [CVE-2023-45756](https://cve.now/CVE-2023-45756.md): WordPress ApplyOnline – Application Form Builder and Manager Plugin \<= 2.5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Spider Teams ApplyOnline – Application Form Builder and Man…)
- [CVE-2023-25032](https://cve.now/CVE-2023-25032.md): WordPress Print, PDF, Email by PrintFriendly Plugin \<= 5.5.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Print, PDF, & Email by PrintFriendly Print, PDF, Email by P…)
- [CVE-2023-45755](https://cve.now/CVE-2023-45755.md): WordPress BuddyPress Global Search Plugin \<= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, BuddyBoss BuddyPress Global Search)
- [CVE-2023-45754](https://cve.now/CVE-2023-45754.md): WordPress Easy Testimonial Slider and Form Plugin \<= 1.0.18 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, I Thirteen Web Solution Easy Testimonial Slider and Form)
- [CVE-2023-45750](https://cve.now/CVE-2023-45750.md): WordPress Nexter Extension Plugin \<= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, POSIMYTH Nexter Extension)
- [CVE-2023-45747](https://cve.now/CVE-2023-45747.md): WordPress WP Lightbox 2 Plugin \<= 3.0.6.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Syed Balkhi WP Lightbox)
- [CVE-2023-45646](https://cve.now/CVE-2023-45646.md): WordPress PDF Block Plugin \<= 1.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Henryholtgeerts PDF Block)
- [CVE-2023-45644](https://cve.now/CVE-2023-45644.md): WordPress CPT Shortcode Generator Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Anurag Deshmukh CPT Shortcode Generator)
- [CVE-2023-45640](https://cve.now/CVE-2023-45640.md): WordPress WP ULike Plugin \<= 4.6.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, TechnoWich WP ULike – Most Advanced WordPress Marketing Too…)
- [CVE-2023-45637](https://cve.now/CVE-2023-45637.md): WordPress EventPrime Plugin \<= 3.1.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2023-45634](https://cve.now/CVE-2023-45634.md): WordPress Copy Or Move Comments Plugin \<= 5.0.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, Biztechc Copy or Move Comments)
- [CVE-2023-46204](https://cve.now/CVE-2023-46204.md): WordPress Duplicate Theme Plugin \<= 0.1.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Muller Digital Duplicate Theme)
- [CVE-2023-46202](https://cve.now/CVE-2023-46202.md): WordPress Auto Login New User After Registration Plugin \<= 1.9.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Jeff Sherk Auto Login New User After Registration)
- [CVE-2023-46198](https://cve.now/CVE-2023-46198.md): WordPress Appointment Calendar Plugin \<= 2.9.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Scientech It Solution Appointment Calendar)
- [CVE-2023-46193](https://cve.now/CVE-2023-46193.md): WordPress Internal Link Building Plugin \<= 1.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Internet Marketing Ninjas Internal Link Building)
- [CVE-2023-46191](https://cve.now/CVE-2023-46191.md): WordPress Open Graph Metabox Plugin \<= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Niels van Renselaar Open Graph Metabox)
- [CVE-2023-5748](https://cve.now/CVE-2023-5748.md): Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in cgi component in Synology SSL VPN Client before 1.4. (CVSS 3.3, Synology SSL VPN Client)
- [CVE-2023-46190](https://cve.now/CVE-2023-46190.md): WordPress Novo-Map : your WP posts on custom google maps Plugin \<= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Novo-media Novo-Map : your WP posts on custom google maps)
- [CVE-2023-46189](https://cve.now/CVE-2023-46189.md): WordPress Google Calendar Events Plugin \<= 3.2.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Simple Calendar – Google Calendar Plugin)
- [CVE-2023-46152](https://cve.now/CVE-2023-46152.md): WordPress WOLF Plugin \<= 1.0.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, realmag777 WOLF – WordPress Posts Bulk Editor and Manager P…)
- [CVE-2023-46151](https://cve.now/CVE-2023-46151.md): WordPress Product Category Tree Plugin \<= 2.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, AWESOME TOGI Product Category Tree)
- [CVE-2023-46150](https://cve.now/CVE-2023-46150.md): WordPress WP Radio plugin \<= 3.1.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WP Military WP Radio)
- [CVE-2023-5746](https://cve.now/CVE-2023-5746.md): A vulnerability regarding use of externally-controlled format string is found in the cgi component. (CVSS 9.8, Synology Camera Firmware)
- [CVE-2022-38484](https://cve.now/CVE-2022-38484.md): An arbitrary file upload and directory traversal vulnerability exist in the file upload functionality of the System Setup menu in AgeVolt Po (no CVSS)
- [CVE-2022-38485](https://cve.now/CVE-2022-38485.md): A directory traversal vulnerability exists in the AgeVolt Portal prior to version 0.1 that leads to Information Disclosure. (CVSS 6.5)
- [CVE-2023-29973](https://cve.now/CVE-2023-29973.md): Pfsense CE version 2.6.0 is vulnerable to No rate limit which can lead to an attacker creating multiple malicious users in firewall. (no CVSS)
- [CVE-2023-31580](https://cve.now/CVE-2023-31580.md): light-oauth2 before version 2.1.27 obtains the public key without any verification. (no CVSS, com.networknt:light-oauth2)
- [CVE-2023-31581](https://cve.now/CVE-2023-31581.md): Dromara Sureness before v1.0.8 was discovered to use a hardcoded key. (no CVSS, com.usthe.sureness:sureness-core)
- [CVE-2023-31582](https://cve.now/CVE-2023-31582.md): jose4j before v0.9.3 allows attackers to set a low iteration count of 1000 or less. (no CVSS, org.bitbucket.b\_c:jose4j)
- [CVE-2023-36085](https://cve.now/CVE-2023-36085.md): The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" end (no CVSS)
- [CVE-2023-39619](https://cve.now/CVE-2023-39619.md): ReDos in NPMJS Node Email Check v.1.0.4 allows an attacker to cause a denial of service via a crafted string to the scpSyntax component. (no CVSS, node-email-check)
- [CVE-2023-39732](https://cve.now/CVE-2023-39732.md): The leakage of the client secret in Tokueimaru\_waiting Line 13.6.1 allows attackers to obtain the channel access token and send crafted broa (no CVSS)
- [CVE-2023-39733](https://cve.now/CVE-2023-39733.md): The leakage of the client secret in TonTon-Tei Line v13.6.1 allows attackers to obtain the channel access token and send crafted broadcast m (no CVSS)
- [CVE-2023-39734](https://cve.now/CVE-2023-39734.md): The leakage of the client secret in VISION MEAT WORKS TrackDiner10/10\_mc Line v13.6.1 allows attackers to obtain the channel access token an (no CVSS)
- [CVE-2023-39735](https://cve.now/CVE-2023-39735.md): The leakage of the client secret in Uomasa\_Saiji\_news Line 13.6.1 allows attackers to obtain the channel access token and send crafted broad (CVSS 8.2)
- [CVE-2023-39736](https://cve.now/CVE-2023-39736.md): The leakage of the client secret in Fukunaga\_memberscard Line 13.6.1 allows attackers to obtain the channel access token and send crafted br (CVSS 8.2)
- [CVE-2023-39737](https://cve.now/CVE-2023-39737.md): The leakage of the client secret in Matsuya Line 13.6.1 allows attackers to obtain the channel access token and send crafted broadcast messa (CVSS 8.2)
- [CVE-2023-39739](https://cve.now/CVE-2023-39739.md): The leakage of the client secret in REGINA SWEETS&BAKERY Line 13.6.1 allows attackers to obtain the channel access token and send crafted br (CVSS 8.2)
- [CVE-2023-39740](https://cve.now/CVE-2023-39740.md): The leakage of the client secret in Onigiriya-musubee Line 13.6.1 allows attackers to obtain the channel access token and send crafted broad (no CVSS)
- [CVE-2023-43281](https://cve.now/CVE-2023-43281.md): Double Free vulnerability in Nothings Stb Image.h v.2.28 allows a remote attacker to cause a denial of service via a crafted file to the stb (no CVSS)
- [CVE-2023-43360](https://cve.now/CVE-2023-43360.md): Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the T (no CVSS)
- [CVE-2023-44767](https://cve.now/CVE-2023-44767.md): A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content. (no CVSS)
- [CVE-2023-44769](https://cve.now/CVE-2023-44769.md): A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script (no CVSS, tribalsystems/zenario)
- [CVE-2023-45554](https://cve.now/CVE-2023-45554.md): File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via modification of the imageext parameter fr (CVSS 9.8)
- [CVE-2023-45555](https://cve.now/CVE-2023-45555.md): File Upload vulnerability in zzzCMS v.2.1.9 allows a remote attacker to execute arbitrary code via a crafted file to the down\_url function i (no CVSS)
- [CVE-2023-45990](https://cve.now/CVE-2023-45990.md): Insecure Permissions vulnerability in WenwenaiCMS v.1.0 allows a remote attacker to escalate privileges. (no CVSS)
- [CVE-2023-46010](https://cve.now/CVE-2023-46010.md): An issue in SeaCMS v.12.9 allows an attacker to execute arbitrary commands via the admin\_safe.php component. (no CVSS)
- [CVE-2023-46316](https://cve.now/CVE-2023-46316.md): In buc Traceroute 2.0.12 through 2.1.2 before 2.1.3, the wrapper scripts do not properly parse command lines. (CVSS 5.5)
- [CVE-2023-46369](https://cve.now/CVE-2023-46369.md): Tenda W18E V16.01.0.8(1576) contains a stack overflow vulnerability via the portMirrorMirroredPorts parameter in the formSetNetCheckTools fu (CVSS 9.8)
- [CVE-2023-46370](https://cve.now/CVE-2023-46370.md): Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function. (no CVSS)
- [CVE-2023-46371](https://cve.now/CVE-2023-46371.md): TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJsonToBin. (no CVSS)
- [CVE-2023-46373](https://cve.now/CVE-2023-46373.md): TP-Link TL-WDR7660 2.0.30 has a stack overflow vulnerability via the function deviceInfoJsonToBincauses. (no CVSS)
- [CVE-2023-46574](https://cve.now/CVE-2023-46574.md): An issue in TOTOLINK A3700R v.9.1.2u.6165\_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the Uplo (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.