CVEs published October 25, 2023
212 CVEs were published on October 25, 2023: 25 critical, 99 high. 1 is now in CISA KEV.
- Published
- 212
- Critical
- 25
- High
- 99
- Medium
- 16
- Low
- 1
- Unrated
- 71
- Now in CISA KEV
- 1
- Fix available
- 79
Most affected products
- IDAttend Pty IDWeb
- 30
- Apple macOS
- 16
- EisBaer Scada
- 7
- Apple iOS and iPadOS · Apple macOS +1
- 6
- Rexroth ctrlX HMI Web Panel - WR21
- 6
- Apple iOS and iPadOS · Apple macOS
- 5
- Apple macOS · Apple iOS and iPadOS
- 4
- Apple iOS and iPadOS · Apple Safari +3
- 3
- Bosch Rexroth AG ctrlX HMI Web Panel - WR21
- 3
- Kubernetes ingress-nginx · k8s.io/ingress-nginx
- 3
Critical 25
- CVE-2023-30967Gotham Orbital Simulator path traversalcom.palantir.meta:orbital-simulator
- CVE-2023-46233crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standardbrix crypto-js · crypto-js
- CVE-2023-46133crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standardentronad crypto-es · crypto-es
- CVE-2023-45137XWiki Platform XSS with edit right in the create document form for existing pagesxwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +1
- CVE-2023-45136XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabledxwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2023-45135XWiki users can be tricked to execute scripts as the create page action doesn't display the page's titlexwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +1
- CVE-2023-45134XWiki Platform XSS vulnerability from account in the create page form via template providerxwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +2
- CVE-2023-37913org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converterxwiki-platform · org.xwiki.platform:xwiki-platform-office-i…
- CVE-2023-37912XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macroxwiki-rendering · org.xwiki.rendering:xwiki-rendering-ma… +1
- CVE-2023-37909Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheetxwiki-platform · org.xwiki.platform:xwiki-platform-menu +1
- CVE-2023-37908org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerabilityxwiki-rendering · org.xwiki.rendering:xwiki-rendering-xml
- CVE-2023-27262Unauthenticated SQL Injection In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-27260Unauthenticated SQL Injection In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-27255Unauthenticated SQL Injection In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-27254Unauthenticated SQL Injection In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26584Unauthenticated SQL Injection In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26583Unauthenticated SQL Injection In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26582Unauthenticated SQL Injection In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26581Unauthenticated SQL Injection In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26572Unauthenticated SQL Injection In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26569Unauthenticated SQL Injection In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26568Unauthenticated SQL Injection In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-34048VMware vCenter Server Out-of-Bounds Write VulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2023-41721Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176.Ubiquiti UniFi Network Application
- CVE-2023-46347In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform S
High 99
- CVE-2023-30969Palantir Tiles missing authentication on API endpointscom.palantir.tiles:tiles
- CVE-2023-5574Xorg-x11-server: use-after-free bug in damagedestroyRed Hat Enterprise Linux
- CVE-2023-5367Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputpropertyRed Hat Enterprise Linux 6 Extended Lifecycle Support - EX…
- CVE-2023-5044Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotationKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2023-5043Ingress nginx annotation injection causes arbitrary command executionKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2022-4886Ingress-nginx `path` sanitization can be bypassed with `log_format` directiveKubernetes ingress-nginx · k8s.io/ingress-nginx
- CVE-2023-42852A logic issue was addressed with improved checks.Apple iOS and iPadOS · Apple Safari +3
- CVE-2023-40445The issue was addressed with improved UI handling.Apple iOS and iPadOS
- CVE-2023-42841The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-37910org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Movexwiki-platform · org.xwiki.platform:xwiki-platform-attachme…
- CVE-2023-5472Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2023-34447iTop XSS vulnerability on pages/UI.php Combodo iTop
- CVE-2023-34446iTop XSS vulnerability on pages/preferences.php Combodo iTop
- CVE-2023-42494 EisBaer Scada - CWE-749: Exposed Dangerous Method or FunctionEisBaer Scada
- CVE-2023-42493 EisBaer Scada - CWE-256: Plaintext Storage of a PasswordEisBaer Scada
- CVE-2023-42492 EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic KeyEisBaer Scada
- CVE-2023-42490 EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized ActorEisBaer Scada
- CVE-2023-42489 EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical ResourceEisBaer Scada
- CVE-2023-30912 A remote code execution issue exists in HPE OneView.Hewlett Packard Enterprise (HPE) HPE OneView
- CVE-2023-42488 EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')EisBaer Scada
- CVE-2023-42491EisBaer Scada - CWE-285: Improper AuthorizationEisBaer Scada
- CVE-2023-46102The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands toBosch Rexroth AG ctrlX HMI Web Panel - WR21
- CVE-2023-45851The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication.Bosch Rexroth AG ctrlX HMI Web Panel - WR21
- CVE-2023-45321The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocolBosch Rexroth AG ctrlX HMI Web Panel - WR21
- CVE-2023-45220The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol tRexroth ctrlX HMI Web Panel - WR21
- CVE-2023-41372The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client Rexroth ctrlX HMI Web Panel - WR21
- CVE-2023-41960The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the AndrRexroth ctrlX HMI Web Panel - WR21
- CVE-2023-41255The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abuRexroth ctrlX HMI Web Panel - WR21
- CVE-2023-43488The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to eRexroth ctrlX HMI Web Panel - WR21
- CVE-2023-45844The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android applRexroth ctrlX HMI Web Panel - WR21
- CVE-2023-5717Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) componentLinux Kernel
- CVE-2023-1356Reflected Cross-site Scripting In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-4692Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code executiongrub · Red Hat Enterprise Linux
- CVE-2023-27377Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-27376Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-27375Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-27259Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-27258Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-27257Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26580Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26578Arbitrary File Upload to Web Root In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26577Stored Cross-site Scripting In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26576Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26575Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26574Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26573Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26571Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26570Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-3010Grafana is an open-source platform for monitoring and observability.Grafana worldmap-panel
- CVE-2023-5311WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modificationwpvncom WP EXtra – One Click Optimize
- CVE-2023-39219Admin Console Denial of Service via Java class enumerationPing Identity PingFederate
- CVE-2023-37283Authentication Bypass via HTML Form & Identifier First AdapterPing Identity PingFederate
- CVE-2023-38041A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition.Ivanti Secure Access Client
- CVE-2023-46119Parse Server may crash when uploading file without extensionparse-community parse-server · parse-server
- CVE-2023-38849An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
- CVE-2023-43905Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors.
- CVE-2023-43961An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an authcn.dev33:sa-token-core
- CVE-2023-46346In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a
- CVE-2023-46414TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function
- CVE-2023-46415TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function.
- CVE-2023-46416TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 func
- CVE-2023-46417TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function.
- CVE-2023-46418TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_412688 function.
- CVE-2023-46419TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415730 function.
- CVE-2023-46420TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41590C function.
- CVE-2023-46421TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411D00 function.
- CVE-2023-46422TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_411994 function.
- CVE-2023-46423TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_417094 function.
- CVE-2023-46424TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_422BD4 function.
- CVE-2023-46520TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function uninstallPluginReqHand
- CVE-2023-46521TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function RegisterRegister.
- CVE-2023-46522TP-LINK device TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin and TL-WDR7660 2.0.30 were discovered to contain a stack overflow via the f
- CVE-2023-46523TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function upgradeInfoRegister.
- CVE-2023-46525TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function loginRegister.
- CVE-2023-46526TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function resetCloudPwdRegister.
- CVE-2023-46527TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin and TL-WDR7660 2.0.30 was discovered to contain a stack overflow via the function
- CVE-2023-46534TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function modifyAccPwdRegister.
- CVE-2023-46535TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getResetVeriRegister.
- CVE-2023-46536TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkRegVeriRegister.
- CVE-2023-46537TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function getRegVeriRegister.
- CVE-2023-46538TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function chkResetVeriRegister.
- CVE-2023-46539TP-LINK TL-WR886N V7.0_3.0.14_Build_221115_Rel.56908n.bin was discovered to contain a stack overflow via the function registerRequestHandle.
- CVE-2023-46540TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formNtp.
- CVE-2023-46541TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpv6Setup.
- CVE-2023-46542TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMeshUploadConfig.
- CVE-2023-46543TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlSiteSurvey.
- CVE-2023-46544TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWirelessTbl.
- CVE-2023-46552TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAP.
- CVE-2023-46553TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formParentControl.
- CVE-2023-46554TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDel.
- CVE-2023-46555TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPortFw.
- CVE-2023-46556TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formFilter.
- CVE-2023-46557TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAPVLAN.
- CVE-2023-46558TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice.
- CVE-2023-46559TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIPv6Addr.
- CVE-2023-46560TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup.
- CVE-2023-46562TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg.
- CVE-2023-46563TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS.
- CVE-2023-46564TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ.
Medium, low and unrated 88
- CVE-2023-46668Elastic Endpoint Insertion of Sensitive Information into Log FileElastic Endpoint
- CVE-2023-46232era-compiler-vyper First Immutable Variable Initialization vulnerabilitymatter-labs era-compiler-vyper
- CVE-2023-46137twisted.web has disordered HTTP pipeline responsetwisted
- CVE-2023-46134D-Tale vulnerable to Remote Code Execution through the Custom Filter Inputman-group dtale · dtale
- CVE-2023-5380Xorg-x11-server: use-after-free bug in destroywindowRed Hat Enterprise Linux
- CVE-2023-42844This issue was addressed with improved handling of symlinks.Apple macOS
- CVE-2023-41989The issue was addressed by restricting options offered on a locked device.Apple macOS
- CVE-2023-40423The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-42849The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-41988This issue was addressed by restricting options offered on a locked device.Apple macOS · Apple watchOS +1
- CVE-2023-41072A privacy issue was addressed with improved private data redaction for log entries.Apple macOS · Apple iOS and iPadOS
- CVE-2023-42845An authentication issue was addressed with improved state management.Apple macOS · Apple iOS and iPadOS
- CVE-2023-40408An inconsistent user interface issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-41976A use-after-free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple Safari +3
- CVE-2023-40449The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-40404A use-after-free issue was addressed with improved memory management.Apple macOS
- CVE-2023-41254A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-41983The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple Safari +1
- CVE-2023-42842The issue was addressed with improved checks.Apple macOS
- CVE-2023-42854This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2023-40413The issue was addressed with improved handling of caches.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-41982This issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-40444A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2023-42438An inconsistent user interface issue was addressed with improved state management.Apple macOS
- CVE-2023-40405A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2023-40425A privacy issue was addressed with improved private data redaction for log entries.Apple macOS
- CVE-2023-41977The issue was addressed with improved handling of caches.Apple iOS and iPadOS · Apple macOS
- CVE-2023-41077An app may be able to access protected user data.Apple macOS
- CVE-2023-42856The issue was addressed with improved memory handling.Apple macOS
- CVE-2023-40447The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple Safari +3
- CVE-2023-41997This issue was addressed by restricting options offered on a locked device.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-42857A privacy issue was addressed with improved private data redaction for log entries.Apple macOS · Apple iOS and iPadOS
- CVE-2023-41975This issue was addressed by removing the vulnerable code.Apple macOS
- CVE-2023-42861A logic issue was addressed with improved state management.Apple macOS
- CVE-2023-42850The issue was addressed with improved permissions logic.Apple macOS
- CVE-2023-42846This issue was addressed by removing the vulnerable code.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2023-40416The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-32359This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS
- CVE-2023-40421A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2023-40401The issue was addressed with additional permissions checks.Apple macOS
- CVE-2023-42847A logic issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS
- CVE-2023-37911org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documentsxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-5671HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege.HP Print and Scan Doctor for Windows
- CVE-2023-46660Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook tJenkins Project Jenkins Zanata Plugin · org.jenkins-ci.plug…
- CVE-2023-46659Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scripJenkins Project Jenkins Edgewall Trac Plugin · org.jenkins-…
- CVE-2023-46658Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided andJenkins Project Jenkins MSTeams Webhook Trigger Plugin · io…
- CVE-2023-46657Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook Jenkins Project Jenkins Gogs Plugin · org.jenkins-ci.plugin…
- CVE-2023-46656Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the proJenkins Project Jenkins Multibranch Scan Webhook Trigger Pl…
- CVE-2023-46655Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are publishJenkins Project Jenkins CloudBees CD Plugin · org.jenkins-c…
- CVE-2023-46654Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup procJenkins Project Jenkins CloudBees CD Plugin · org.jenkins-c…
- CVE-2023-46653Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting iJenkins Project Jenkins lambdatest-automation Plugin · org.…
- CVE-2023-46652A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumeJenkins Project Jenkins lambdatest-automation Plugin · org.…
- CVE-2023-46651Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/ConfiguJenkins Project Jenkins Warnings Plugin · io.jenkins.plugin…
- CVE-2023-46650Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a storeJenkins Project Jenkins GitHub Plugin · com.coravy.hudson.p…
- CVE-2023-4693Grub2: out-of-bounds read at fs/ntfs.cRed Hat Enterprise Linux
- CVE-2023-27261Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-27256Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-26579Missing Authentication In IDAttend’s IDWeb ApplicationIDAttend Pty IDWeb
- CVE-2023-34056VMware vCenter Server Partial Information Disclosure VulnerabilityVMware vCenter Server · VMware Cloud Foundation
- CVE-2023-46158IBM WebSphere Application Server session fixationIBM WebSphere Application Server Liberty
- CVE-2023-34085User Attribute Disclosure via DynamoDB Data StoresPing Identity PingFederate
- CVE-2023-46135Panic in SignedPayload::from_payloadrs-stellar-strkey · stellar-strkey
- CVE-2023-46123jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP valuesjumpserver
- CVE-2023-38845An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
- CVE-2023-38846An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
- CVE-2023-38847An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
- CVE-2023-38848An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request.
- CVE-2023-43906Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability.
- CVE-2023-44794An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL.cn.dev33:sa-token-core
- CVE-2023-46345Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c.
- CVE-2023-46358In the module "Referral and Affiliation Program" (referralbyphone) version 3.5.1 and before from Snegurka for PrestaShop, a guest can perfor
- CVE-2023-46396Audimex 15.0.0 is vulnerable to Cross Site Scripting (XSS) in /audimex/cgi-bin/wal.fcgi via company parameter search filters.
- CVE-2023-46408TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function.
- CVE-2023-46409TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function.
- CVE-2023-46410TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function.
- CVE-2023-46411TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function.
- CVE-2023-46412TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function.
- CVE-2023-46413TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function.
- CVE-2023-46518Mercury A15 V1.0 20230818_1.0.3 was discovered to contain a command execution vulnerability via the component cloudDeviceTokenSuccCB.
- CVE-2023-46545TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWsc.
- CVE-2023-46546TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formStats.
- CVE-2023-46547TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSysLog.
- CVE-2023-46548TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlanRedirect.
- CVE-2023-46549TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSetLg.
- CVE-2023-46550TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice.
- CVE-2023-46551TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl.
- CVE-2023-46583Cross-Site Scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows attackers to execute arbit
- CVE-2023-46584SQL Injection vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows a remote attacker to escalate privilege