# CVEs published 2023-10-25

212 CVEs were published on October 25, 2023: 25 critical, 99 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-46668](https://cve.now/CVE-2023-46668.md): Elastic Endpoint Insertion of Sensitive Information into Log File (CVSS 4.6, Elastic Endpoint)
- [CVE-2023-30967](https://cve.now/CVE-2023-30967.md): Gotham Orbital Simulator path traversal (CVSS 9.8, com.palantir.meta:orbital-simulator)
- [CVE-2023-30969](https://cve.now/CVE-2023-30969.md): Palantir Tiles missing authentication on API endpoints (CVSS 8.2, com.palantir.tiles:tiles)
- [CVE-2023-46232](https://cve.now/CVE-2023-46232.md): era-compiler-vyper First Immutable Variable Initialization vulnerability (CVSS 5.3, matter-labs era-compiler-vyper)
- [CVE-2023-46137](https://cve.now/CVE-2023-46137.md): twisted.web has disordered HTTP pipeline response (CVSS 5.3, twisted)
- [CVE-2023-46134](https://cve.now/CVE-2023-46134.md): D-Tale vulnerable to Remote Code Execution through the Custom Filter Input (CVSS 6.1, man-group dtale · dtale)
- [CVE-2023-46233](https://cve.now/CVE-2023-46233.md): crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard (CVSS 9.1, brix crypto-js · crypto-js)
- [CVE-2023-46133](https://cve.now/CVE-2023-46133.md): crypto-es PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard (CVSS 9.1, entronad crypto-es · crypto-es)
- [CVE-2023-45137](https://cve.now/CVE-2023-45137.md): XWiki Platform XSS with edit right in the create document form for existing pages (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +1)
- [CVE-2023-5574](https://cve.now/CVE-2023-5574.md): Xorg-x11-server: use-after-free bug in damagedestroy (CVSS 7.0, Red Hat Enterprise Linux)
- [CVE-2023-5380](https://cve.now/CVE-2023-5380.md): Xorg-x11-server: use-after-free bug in destroywindow (CVSS 4.7, Red Hat Enterprise Linux)
- [CVE-2023-5367](https://cve.now/CVE-2023-5367.md): Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty (CVSS 7.8, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EX…)
- [CVE-2023-45136](https://cve.now/CVE-2023-45136.md): XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled (CVSS 9.7, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2023-45135](https://cve.now/CVE-2023-45135.md): XWiki users can be tricked to execute scripts as the create page action doesn't display the page's title (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +1)
- [CVE-2023-5044](https://cve.now/CVE-2023-5044.md): Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation (CVSS 7.6, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2023-5043](https://cve.now/CVE-2023-5043.md): Ingress nginx annotation injection causes arbitrary command execution (CVSS 7.6, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2022-4886](https://cve.now/CVE-2022-4886.md): Ingress-nginx \`path\` sanitization can be bypassed with \`log\_format\` directive (CVSS 8.8, Kubernetes ingress-nginx · k8s.io/ingress-nginx)
- [CVE-2023-45134](https://cve.now/CVE-2023-45134.md): XWiki Platform XSS vulnerability from account in the create page form via template provider (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-web-t… +2)
- [CVE-2023-42844](https://cve.now/CVE-2023-42844.md): This issue was addressed with improved handling of symlinks. (no CVSS, Apple macOS)
- [CVE-2023-42852](https://cve.now/CVE-2023-42852.md): A logic issue was addressed with improved checks. (CVSS 8.8, Apple iOS and iPadOS · Apple Safari +3)
- [CVE-2023-41989](https://cve.now/CVE-2023-41989.md): The issue was addressed by restricting options offered on a locked device. (no CVSS, Apple macOS)
- [CVE-2023-40423](https://cve.now/CVE-2023-40423.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42849](https://cve.now/CVE-2023-42849.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-41988](https://cve.now/CVE-2023-41988.md): This issue was addressed by restricting options offered on a locked device. (no CVSS, Apple macOS · Apple watchOS +1)
- [CVE-2023-41072](https://cve.now/CVE-2023-41072.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-42845](https://cve.now/CVE-2023-42845.md): An authentication issue was addressed with improved state management. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-40408](https://cve.now/CVE-2023-40408.md): An inconsistent user interface issue was addressed with improved state management. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-41976](https://cve.now/CVE-2023-41976.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple iOS and iPadOS · Apple Safari +3)
- [CVE-2023-40449](https://cve.now/CVE-2023-40449.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-40404](https://cve.now/CVE-2023-40404.md): A use-after-free issue was addressed with improved memory management. (no CVSS, Apple macOS)
- [CVE-2023-40445](https://cve.now/CVE-2023-40445.md): The issue was addressed with improved UI handling. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2023-41254](https://cve.now/CVE-2023-41254.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-41983](https://cve.now/CVE-2023-41983.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple Safari +1)
- [CVE-2023-42842](https://cve.now/CVE-2023-42842.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-42854](https://cve.now/CVE-2023-42854.md): This issue was addressed by removing the vulnerable code. (no CVSS, Apple macOS)
- [CVE-2023-40413](https://cve.now/CVE-2023-40413.md): The issue was addressed with improved handling of caches. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-41982](https://cve.now/CVE-2023-41982.md): This issue was addressed by restricting options offered on a locked device. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-40444](https://cve.now/CVE-2023-40444.md): A permissions issue was addressed with additional restrictions. (no CVSS, Apple macOS)
- [CVE-2023-42438](https://cve.now/CVE-2023-42438.md): An inconsistent user interface issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-40405](https://cve.now/CVE-2023-40405.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS)
- [CVE-2023-40425](https://cve.now/CVE-2023-40425.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 4.4, Apple macOS)
- [CVE-2023-41977](https://cve.now/CVE-2023-41977.md): The issue was addressed with improved handling of caches. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-41077](https://cve.now/CVE-2023-41077.md): An app may be able to access protected user data. (CVSS 5.5, Apple macOS)
- [CVE-2023-42856](https://cve.now/CVE-2023-42856.md): The issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2023-40447](https://cve.now/CVE-2023-40447.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple Safari +3)
- [CVE-2023-41997](https://cve.now/CVE-2023-41997.md): This issue was addressed by restricting options offered on a locked device. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-42841](https://cve.now/CVE-2023-42841.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42857](https://cve.now/CVE-2023-42857.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-41975](https://cve.now/CVE-2023-41975.md): This issue was addressed by removing the vulnerable code. (no CVSS, Apple macOS)
- [CVE-2023-42861](https://cve.now/CVE-2023-42861.md): A logic issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-42850](https://cve.now/CVE-2023-42850.md): The issue was addressed with improved permissions logic. (no CVSS, Apple macOS)
- [CVE-2023-42846](https://cve.now/CVE-2023-42846.md): This issue was addressed by removing the vulnerable code. (no CVSS, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2023-40416](https://cve.now/CVE-2023-40416.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-32359](https://cve.now/CVE-2023-32359.md): This issue was addressed with improved redaction of sensitive information. (no CVSS, Apple iOS and iPadOS)
- [CVE-2023-40421](https://cve.now/CVE-2023-40421.md): A permissions issue was addressed with additional restrictions. (no CVSS, Apple macOS)
- [CVE-2023-40401](https://cve.now/CVE-2023-40401.md): The issue was addressed with additional permissions checks. (no CVSS, Apple macOS)
- [CVE-2023-42847](https://cve.now/CVE-2023-42847.md): A logic issue was addressed with improved checks. (no CVSS, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-37913](https://cve.now/CVE-2023-37913.md): org.xwiki.platform:xwiki-platform-office-importer vulnerable to arbitrary server side file writing from account through office converter (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-office-i…)
- [CVE-2023-37912](https://cve.now/CVE-2023-37912.md): XWiki Rendering's footnote macro vulnerable to privilege escalation via the footnote macro (CVSS 10.0, xwiki-rendering · org.xwiki.rendering:xwiki-rendering-ma… +1)
- [CVE-2023-37911](https://cve.now/CVE-2023-37911.md): org.xwiki.platform:xwiki-platform-oldcore may leak data through deleted and re-created documents (CVSS 6.5, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-37910](https://cve.now/CVE-2023-37910.md): org.xwiki.platform:xwiki-platform-attachment-api vulnerable to Missing Authorization on Attachment Move (CVSS 8.1, xwiki-platform · org.xwiki.platform:xwiki-platform-attachme…)
- [CVE-2023-5671](https://cve.now/CVE-2023-5671.md): HP Print and Scan Doctor for Windows may potentially be vulnerable to escalation of privilege. (no CVSS, HP Print and Scan Doctor for Windows)
- [CVE-2023-37909](https://cve.now/CVE-2023-37909.md): Privilege escalation (PR)/remote code execution from account through Menu.UIExtensionSheet (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-menu +1)
- [CVE-2023-37908](https://cve.now/CVE-2023-37908.md): org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability (CVSS 9.1, xwiki-rendering · org.xwiki.rendering:xwiki-rendering-xml)
- [CVE-2023-5472](https://cve.now/CVE-2023-5472.md): Use after free in Profiles in Google Chrome prior to 118.0.5993.117 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 8.8, Google Chrome)
- [CVE-2023-34447](https://cve.now/CVE-2023-34447.md): iTop XSS vulnerability on pages/UI.php (CVSS 8.8, Combodo iTop)
- [CVE-2023-34446](https://cve.now/CVE-2023-34446.md): iTop XSS vulnerability on pages/preferences.php (CVSS 8.8, Combodo iTop)
- [CVE-2023-42494](https://cve.now/CVE-2023-42494.md): EisBaer Scada - CWE-749: Exposed Dangerous Method or Function (CVSS 7.5, EisBaer Scada)
- [CVE-2023-42493](https://cve.now/CVE-2023-42493.md): EisBaer Scada - CWE-256: Plaintext Storage of a Password (CVSS 7.1, EisBaer Scada)
- [CVE-2023-42492](https://cve.now/CVE-2023-42492.md): EisBaer Scada - CWE-321: Use of Hard-coded Cryptographic Key (CVSS 7.1, EisBaer Scada)
- [CVE-2023-42490](https://cve.now/CVE-2023-42490.md): EisBaer Scada - CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 7.5, EisBaer Scada)
- [CVE-2023-42489](https://cve.now/CVE-2023-42489.md): EisBaer Scada - CWE-732: Incorrect Permission Assignment for Critical Resource (CVSS 7.5, EisBaer Scada)
- [CVE-2023-30912](https://cve.now/CVE-2023-30912.md): A remote code execution issue exists in HPE OneView. (CVSS 7.2, Hewlett Packard Enterprise (HPE) HPE OneView)
- [CVE-2023-42488](https://cve.now/CVE-2023-42488.md): EisBaer Scada - CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 7.5, EisBaer Scada)
- [CVE-2023-42491](https://cve.now/CVE-2023-42491.md): EisBaer Scada - CWE-285: Improper Authorization (CVSS 8.8, EisBaer Scada)
- [CVE-2023-46102](https://cve.now/CVE-2023-46102.md): The Android Client application, when enrolled to the AppHub server, connects to an MQTT broker to exchange messages and receive commands to (CVSS 8.8, Bosch Rexroth AG ctrlX HMI Web Panel - WR21)
- [CVE-2023-45851](https://cve.now/CVE-2023-45851.md): The Android Client application, when enrolled to the AppHub server,connects to an MQTT broker without enforcing any server authentication. (CVSS 8.8, Bosch Rexroth AG ctrlX HMI Web Panel - WR21)
- [CVE-2023-45321](https://cve.now/CVE-2023-45321.md): The Android Client application, when enrolled with the define method 1 (the user manually inserts the server ip address), use HTTP protocol (CVSS 8.3, Bosch Rexroth AG ctrlX HMI Web Panel - WR21)
- [CVE-2023-45220](https://cve.now/CVE-2023-45220.md): The Android Client application, when enrolled with the define method 1(the user manually inserts the server ip address), use HTTP protocol t (CVSS 8.8, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-41372](https://cve.now/CVE-2023-41372.md): The vulnerability allows an unprivileged (untrusted) third- party application to arbitrary modify the server settings of the Android Client (CVSS 7.8, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-41960](https://cve.now/CVE-2023-41960.md): The vulnerability allows an unprivileged(untrusted) third-party application to interact with a content-provider unsafely exposed by the Andr (CVSS 7.1, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-41255](https://cve.now/CVE-2023-41255.md): The vulnerability allows an unprivileged user with access to the subnet of the TPC-110W device to gain a root shell on the device itself abu (CVSS 8.8, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-46660](https://cve.now/CVE-2023-46660.md): Jenkins Zanata Plugin 0.6 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook t (no CVSS, Jenkins Project Jenkins Zanata Plugin · org.jenkins-ci.plug…)
- [CVE-2023-46659](https://cve.now/CVE-2023-46659.md): Jenkins Edgewall Trac Plugin 1.13 and earlier does not escape the Trac website URL on the build page, resulting in a stored cross-site scrip (no CVSS, Jenkins Project Jenkins Edgewall Trac Plugin · org.jenkins-…)
- [CVE-2023-46658](https://cve.now/CVE-2023-46658.md): Jenkins MSTeams Webhook Trigger Plugin 0.1.1 and earlier uses a non-constant time comparison function when checking whether the provided and (no CVSS, Jenkins Project Jenkins MSTeams Webhook Trigger Plugin · io…)
- [CVE-2023-46657](https://cve.now/CVE-2023-46657.md): Jenkins Gogs Plugin 1.0.15 and earlier uses a non-constant time comparison function when checking whether the provided and expected webhook (no CVSS, Jenkins Project Jenkins Gogs Plugin · org.jenkins-ci.plugin…)
- [CVE-2023-46656](https://cve.now/CVE-2023-46656.md): Jenkins Multibranch Scan Webhook Trigger Plugin 1.0.9 and earlier uses a non-constant time comparison function when checking whether the pro (no CVSS, Jenkins Project Jenkins Multibranch Scan Webhook Trigger Pl…)
- [CVE-2023-46655](https://cve.now/CVE-2023-46655.md): Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the directory from which artifacts are publish (no CVSS, Jenkins Project Jenkins CloudBees CD Plugin · org.jenkins-c…)
- [CVE-2023-46654](https://cve.now/CVE-2023-46654.md): Jenkins CloudBees CD Plugin 1.1.32 and earlier follows symbolic links to locations outside of the expected directory during the cleanup proc (no CVSS, Jenkins Project Jenkins CloudBees CD Plugin · org.jenkins-c…)
- [CVE-2023-46653](https://cve.now/CVE-2023-46653.md): Jenkins lambdatest-automation Plugin 1.20.10 and earlier logs LAMBDATEST Credentials access token at the INFO level, potentially resulting i (no CVSS, Jenkins Project Jenkins lambdatest-automation Plugin · org.…)
- [CVE-2023-46652](https://cve.now/CVE-2023-46652.md): A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enume (no CVSS, Jenkins Project Jenkins lambdatest-automation Plugin · org.…)
- [CVE-2023-46651](https://cve.now/CVE-2023-46651.md): Jenkins Warnings Plugin 10.5.0 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configu (no CVSS, Jenkins Project Jenkins Warnings Plugin · io.jenkins.plugin…)
- [CVE-2023-46650](https://cve.now/CVE-2023-46650.md): Jenkins GitHub Plugin 1.37.3 and earlier does not escape the GitHub project URL on the build page when showing changes, resulting in a store (no CVSS, Jenkins Project Jenkins GitHub Plugin · com.coravy.hudson.p…)
- [CVE-2023-43488](https://cve.now/CVE-2023-43488.md): The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to e (CVSS 7.9, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-45844](https://cve.now/CVE-2023-45844.md): The vulnerability allows a low privileged user that have access to the device when locked in Kiosk mode to install an arbitrary Android appl (CVSS 7.3, Rexroth ctrlX HMI Web Panel - WR21)
- [CVE-2023-5717](https://cve.now/CVE-2023-5717.md): Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component (CVSS 7.8, Linux Kernel)
- [CVE-2023-1356](https://cve.now/CVE-2023-1356.md): Reflected Cross-site Scripting In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-4692](https://cve.now/CVE-2023-4692.md): Grub2: out-of-bounds write at fs/ntfs.c may lead to unsigned code execution (CVSS 7.5, grub · Red Hat Enterprise Linux)
- [CVE-2023-4693](https://cve.now/CVE-2023-4693.md): Grub2: out-of-bounds read at fs/ntfs.c (CVSS 5.3, Red Hat Enterprise Linux)
- [CVE-2023-27262](https://cve.now/CVE-2023-27262.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-27260](https://cve.now/CVE-2023-27260.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-27261](https://cve.now/CVE-2023-27261.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 5.3, IDAttend Pty IDWeb)
- [CVE-2023-27377](https://cve.now/CVE-2023-27377.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27376](https://cve.now/CVE-2023-27376.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27375](https://cve.now/CVE-2023-27375.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27259](https://cve.now/CVE-2023-27259.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27258](https://cve.now/CVE-2023-27258.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27257](https://cve.now/CVE-2023-27257.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-27256](https://cve.now/CVE-2023-27256.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 5.8, IDAttend Pty IDWeb)
- [CVE-2023-27255](https://cve.now/CVE-2023-27255.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-27254](https://cve.now/CVE-2023-27254.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26584](https://cve.now/CVE-2023-26584.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26583](https://cve.now/CVE-2023-26583.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26582](https://cve.now/CVE-2023-26582.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26581](https://cve.now/CVE-2023-26581.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26580](https://cve.now/CVE-2023-26580.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26579](https://cve.now/CVE-2023-26579.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 5.3, IDAttend Pty IDWeb)
- [CVE-2023-26578](https://cve.now/CVE-2023-26578.md): Arbitrary File Upload to Web Root In IDAttend’s IDWeb Application (CVSS 8.8, IDAttend Pty IDWeb)
- [CVE-2023-26577](https://cve.now/CVE-2023-26577.md): Stored Cross-site Scripting In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26576](https://cve.now/CVE-2023-26576.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26575](https://cve.now/CVE-2023-26575.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26574](https://cve.now/CVE-2023-26574.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26573](https://cve.now/CVE-2023-26573.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 8.2, IDAttend Pty IDWeb)
- [CVE-2023-26572](https://cve.now/CVE-2023-26572.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26571](https://cve.now/CVE-2023-26571.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26570](https://cve.now/CVE-2023-26570.md): Missing Authentication In IDAttend’s IDWeb Application (CVSS 7.5, IDAttend Pty IDWeb)
- [CVE-2023-26569](https://cve.now/CVE-2023-26569.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-26568](https://cve.now/CVE-2023-26568.md): Unauthenticated SQL Injection In IDAttend’s IDWeb Application (CVSS 9.8, IDAttend Pty IDWeb)
- [CVE-2023-3010](https://cve.now/CVE-2023-3010.md): Grafana is an open-source platform for monitoring and observability. (CVSS 7.3, Grafana worldmap-panel)
- [CVE-2023-5311](https://cve.now/CVE-2023-5311.md): WP EXtra \<= 6.2 - Missing Authorization to .htaccess File Modification (CVSS 8.8, wpvncom WP EXtra – One Click Optimize)
- [CVE-2023-34056](https://cve.now/CVE-2023-34056.md): VMware vCenter Server Partial Information Disclosure Vulnerability (CVSS 4.3, VMware vCenter Server · VMware Cloud Foundation)
- [CVE-2023-34048](https://cve.now/CVE-2023-34048.md): VMware vCenter Server Out-of-Bounds Write Vulnerability (CVSS 9.8, KEV, VMware vCenter Server · VMware Cloud Foundation)
- [CVE-2023-46158](https://cve.now/CVE-2023-46158.md): IBM WebSphere Application Server session fixation (CVSS 4.9, IBM WebSphere Application Server Liberty)
- [CVE-2023-34085](https://cve.now/CVE-2023-34085.md): User Attribute Disclosure via DynamoDB Data Stores (CVSS 2.6, Ping Identity PingFederate)
- [CVE-2023-39219](https://cve.now/CVE-2023-39219.md): Admin Console Denial of Service via Java class enumeration (CVSS 7.5, Ping Identity PingFederate)
- [CVE-2023-37283](https://cve.now/CVE-2023-37283.md): Authentication Bypass via HTML Form & Identifier First Adapter (CVSS 8.1, Ping Identity PingFederate)
- [CVE-2023-46135](https://cve.now/CVE-2023-46135.md): Panic in SignedPayload::from\_payload (CVSS 5.3, rs-stellar-strkey · stellar-strkey)
- [CVE-2023-38041](https://cve.now/CVE-2023-38041.md): A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition. (CVSS 7.8, Ivanti Secure Access Client)
- [CVE-2023-41721](https://cve.now/CVE-2023-41721.md): Instances of UniFi Network Application that (i) are run on a UniFi Gateway Console, and (ii) are versions 7.5.176. (CVSS 10.0, Ubiquiti UniFi Network Application)
- [CVE-2023-46123](https://cve.now/CVE-2023-46123.md): jumpserver is vulnerable to password brute-force protection bypass via arbitrary IP values (CVSS 5.3, jumpserver)
- [CVE-2023-46119](https://cve.now/CVE-2023-46119.md): Parse Server may crash when uploading file without extension (CVSS 7.5, parse-community parse-server · parse-server)
- [CVE-2023-38845](https://cve.now/CVE-2023-38845.md): An issue in Anglaise Company Anglaise.Company v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. (no CVSS)
- [CVE-2023-38846](https://cve.now/CVE-2023-38846.md): An issue in Marbre Lapin Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. (no CVSS)
- [CVE-2023-38847](https://cve.now/CVE-2023-38847.md): An issue in CHRISTINA JAPAN Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. (no CVSS)
- [CVE-2023-38848](https://cve.now/CVE-2023-38848.md): An issue in rmc R Beauty CLINIC Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. (no CVSS)
- [CVE-2023-38849](https://cve.now/CVE-2023-38849.md): An issue in tire-sales Line v.13.6.1 allows a remote attacker to obtain sensitive information via crafted GET request. (CVSS 7.5)
- [CVE-2023-43905](https://cve.now/CVE-2023-43905.md): Incorrect access control in writercms v1.1.0 allows attackers to directly obtain backend account passwords via unspecified vectors. (CVSS 7.5)
- [CVE-2023-43906](https://cve.now/CVE-2023-43906.md): Xolo CMS v0.11 was discovered to contain a reflected cross-site scripting (XSS) vulnerability. (no CVSS)
- [CVE-2023-43961](https://cve.now/CVE-2023-43961.md): An issue in Dromara SaToken version 1.3.50RC and before when using Spring dynamic controllers, a specially crafted request may cause an auth (CVSS 8.8, cn.dev33:sa-token-core)
- [CVE-2023-44794](https://cve.now/CVE-2023-44794.md): An issue in Dromara SaToken version 1.36.0 and before allows a remote attacker to escalate privileges via a crafted payload to the URL. (no CVSS, cn.dev33:sa-token-core)
- [CVE-2023-46345](https://cve.now/CVE-2023-46345.md): Catdoc v0.95 was discovered to contain a NULL pointer dereference via the component xls2csv at src/xlsparse.c. (no CVSS)
- [CVE-2023-46346](https://cve.now/CVE-2023-46346.md): In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 4.1.1 from MyPrestaModules for PrestaShop, a (CVSS 7.5)
- [CVE-2023-46347](https://cve.now/CVE-2023-46347.md): In the module "Step by Step products Pack" (ndk\_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform S (CVSS 9.8)
- [CVE-2023-46358](https://cve.now/CVE-2023-46358.md): In the module "Referral and Affiliation Program" (referralbyphone) version 3.5.1 and before from Snegurka for PrestaShop, a guest can perfor (no CVSS)
- [CVE-2023-46396](https://cve.now/CVE-2023-46396.md): Audimex 15.0.0 is vulnerable to Cross Site Scripting (XSS) in /audimex/cgi-bin/wal.fcgi via company parameter search filters. (no CVSS)
- [CVE-2023-46408](https://cve.now/CVE-2023-46408.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_ The 41DD80 function. (no CVSS)
- [CVE-2023-46409](https://cve.now/CVE-2023-46409.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_ 41CC04 function. (no CVSS)
- [CVE-2023-46410](https://cve.now/CVE-2023-46410.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_ The 416F60 function. (no CVSS)
- [CVE-2023-46411](https://cve.now/CVE-2023-46411.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_415258 function. (no CVSS)
- [CVE-2023-46412](https://cve.now/CVE-2023-46412.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_41D998 function. (no CVSS)
- [CVE-2023-46413](https://cve.now/CVE-2023-46413.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a command execution vulnerability via the sub\_4155DC function. (no CVSS)
- [CVE-2023-46414](https://cve.now/CVE-2023-46414.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_ 41D494 function (CVSS 8.8)
- [CVE-2023-46415](https://cve.now/CVE-2023-46415.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_41E588 function. (CVSS 8.8)
- [CVE-2023-46416](https://cve.now/CVE-2023-46416.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_ The 41A414 func (CVSS 8.8)
- [CVE-2023-46417](https://cve.now/CVE-2023-46417.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_415498 function. (CVSS 8.8)
- [CVE-2023-46418](https://cve.now/CVE-2023-46418.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_412688 function. (CVSS 8.8)
- [CVE-2023-46419](https://cve.now/CVE-2023-46419.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_415730 function. (CVSS 8.8)
- [CVE-2023-46420](https://cve.now/CVE-2023-46420.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_41590C function. (CVSS 8.8)
- [CVE-2023-46421](https://cve.now/CVE-2023-46421.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_411D00 function. (CVSS 8.8)
- [CVE-2023-46422](https://cve.now/CVE-2023-46422.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_411994 function. (CVSS 8.8)
- [CVE-2023-46423](https://cve.now/CVE-2023-46423.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_417094 function. (CVSS 8.8)
- [CVE-2023-46424](https://cve.now/CVE-2023-46424.md): TOTOLINK X6000R v9.4.0cu.652\_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub\_422BD4 function. (CVSS 8.8)
- [CVE-2023-46518](https://cve.now/CVE-2023-46518.md): Mercury A15 V1.0 20230818\_1.0.3 was discovered to contain a command execution vulnerability via the component cloudDeviceTokenSuccCB. (no CVSS)
- [CVE-2023-46520](https://cve.now/CVE-2023-46520.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function uninstallPluginReqHand (CVSS 8.8)
- [CVE-2023-46521](https://cve.now/CVE-2023-46521.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function RegisterRegister. (CVSS 8.8)
- [CVE-2023-46522](https://cve.now/CVE-2023-46522.md): TP-LINK device TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin and TL-WDR7660 2.0.30 were discovered to contain a stack overflow via the f (CVSS 8.8)
- [CVE-2023-46523](https://cve.now/CVE-2023-46523.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function upgradeInfoRegister. (CVSS 8.8)
- [CVE-2023-46525](https://cve.now/CVE-2023-46525.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function loginRegister. (CVSS 8.8)
- [CVE-2023-46526](https://cve.now/CVE-2023-46526.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function resetCloudPwdRegister. (CVSS 8.8)
- [CVE-2023-46527](https://cve.now/CVE-2023-46527.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin and TL-WDR7660 2.0.30 was discovered to contain a stack overflow via the function (CVSS 8.8)
- [CVE-2023-46534](https://cve.now/CVE-2023-46534.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function modifyAccPwdRegister. (CVSS 8.8)
- [CVE-2023-46535](https://cve.now/CVE-2023-46535.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function getResetVeriRegister. (CVSS 8.8)
- [CVE-2023-46536](https://cve.now/CVE-2023-46536.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function chkRegVeriRegister. (CVSS 8.8)
- [CVE-2023-46537](https://cve.now/CVE-2023-46537.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function getRegVeriRegister. (CVSS 8.8)
- [CVE-2023-46538](https://cve.now/CVE-2023-46538.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function chkResetVeriRegister. (CVSS 8.8)
- [CVE-2023-46539](https://cve.now/CVE-2023-46539.md): TP-LINK TL-WR886N V7.0\_3.0.14\_Build\_221115\_Rel.56908n.bin was discovered to contain a stack overflow via the function registerRequestHandle. (CVSS 8.8)
- [CVE-2023-46540](https://cve.now/CVE-2023-46540.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formNtp. (CVSS 8.8)
- [CVE-2023-46541](https://cve.now/CVE-2023-46541.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpv6Setup. (CVSS 8.8)
- [CVE-2023-46542](https://cve.now/CVE-2023-46542.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMeshUploadConfig. (CVSS 8.8)
- [CVE-2023-46543](https://cve.now/CVE-2023-46543.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlSiteSurvey. (CVSS 8.8)
- [CVE-2023-46544](https://cve.now/CVE-2023-46544.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWirelessTbl. (CVSS 8.8)
- [CVE-2023-46545](https://cve.now/CVE-2023-46545.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWsc. (no CVSS)
- [CVE-2023-46546](https://cve.now/CVE-2023-46546.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formStats. (no CVSS)
- [CVE-2023-46547](https://cve.now/CVE-2023-46547.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSysLog. (no CVSS)
- [CVE-2023-46548](https://cve.now/CVE-2023-46548.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formWlanRedirect. (no CVSS)
- [CVE-2023-46549](https://cve.now/CVE-2023-46549.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formSetLg. (no CVSS)
- [CVE-2023-46550](https://cve.now/CVE-2023-46550.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice. (no CVSS)
- [CVE-2023-46551](https://cve.now/CVE-2023-46551.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formReflashClientTbl. (no CVSS)
- [CVE-2023-46552](https://cve.now/CVE-2023-46552.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAP. (CVSS 8.0)
- [CVE-2023-46553](https://cve.now/CVE-2023-46553.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formParentControl. (CVSS 8.0)
- [CVE-2023-46554](https://cve.now/CVE-2023-46554.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDel. (CVSS 8.8)
- [CVE-2023-46555](https://cve.now/CVE-2023-46555.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPortFw. (CVSS 8.8)
- [CVE-2023-46556](https://cve.now/CVE-2023-46556.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formFilter. (CVSS 8.8)
- [CVE-2023-46557](https://cve.now/CVE-2023-46557.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMultiAPVLAN. (CVSS 8.8)
- [CVE-2023-46558](https://cve.now/CVE-2023-46558.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formMapDelDevice. (CVSS 8.8)
- [CVE-2023-46559](https://cve.now/CVE-2023-46559.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIPv6Addr. (CVSS 8.0)
- [CVE-2023-46560](https://cve.now/CVE-2023-46560.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formTcpipSetup. (CVSS 8.0)
- [CVE-2023-46562](https://cve.now/CVE-2023-46562.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDosCfg. (CVSS 8.0)
- [CVE-2023-46563](https://cve.now/CVE-2023-46563.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formIpQoS. (CVSS 8.0)
- [CVE-2023-46564](https://cve.now/CVE-2023-46564.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formDMZ. (CVSS 8.0)
- [CVE-2023-46583](https://cve.now/CVE-2023-46583.md): Cross-Site Scripting (XSS) vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows attackers to execute arbit (no CVSS)
- [CVE-2023-46584](https://cve.now/CVE-2023-46584.md): SQL Injection vulnerability in PHPGurukul Nipah virus (NiV) " Testing Management System v.1.0 allows a remote attacker to escalate privilege (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.