CVEs published October 26, 2023
89 CVEs were published on October 26, 2023: 10 critical, 28 high. 3 are now in CISA KEV.
- Published
- 89
- Critical
- 10
- High
- 28
- Medium
- 27
- Low
- 3
- Unrated
- 21
- Now in CISA KEV
- 3
- Fix available
- 14
Most affected products
- Sielco PolyEco1000
- 7
- Sielco Analog FM transmitter · Sielco Radio Link
- 4
- Tongda OA
- 4
- Elasticsearch · org.elasticsearch:elasticsearch
- 3
- Tenable Nessus Network Monitor
- 3
- CodeAstro POS System
- 2
- F5 BIG-IP
- 2
- Netentsec NS-ASG Application Security Gateway
- 2
- SourceCodester Sticky Notes App
- 2
- Arrow Plugins The Awesome Feed – Custom Feed
- 1
Critical 10
- CVE-2023-46665Improper Access Control in Sielco PolyEco1000Sielco PolyEco1000
- CVE-2023-46747BIG-IP Configuration utility unauthenticated remote code execution vulnerabilityF5 BIG-IP
- CVE-2023-46661Improper Access Control in Sielco PolyEco1000Sielco PolyEco1000
- CVE-2023-5754Improper Restriction of Excessive Authentication Attempts in Sielco PolyEco1000Sielco PolyEco1000
- CVE-2023-44267Online Art Gallery v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Art Gallery
- CVE-2023-42769Sielco Radio Link and Analog FM Transmitters Improper Access ControlSielco Analog FM transmitter · Sielco Radio Link
- CVE-2023-31422Kibana Insertion of Sensitive Information into Log FileElastic Kibana
- CVE-2018-17558Hardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18
- CVE-2023-43208NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution.
- CVE-2023-45869ILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system commands remotely, when a highly privileged acco
High 28
- CVE-2023-46748BIG-IP Configuration utility authenticated SQL injection vulnerabilityF5 BIG-IP
- CVE-2023-46664Improper Access Control in Sielco PolyEco1000Sielco PolyEco1000
- CVE-2023-46663Improper Access Control in Sielco PolyEco1000Sielco PolyEco1000
- CVE-2023-5804PHPGurukul Nipah Virus Testing Management System login.php sql injectionPHPGurukul Nipah Virus Testing Management System
- CVE-2023-46662Improper Access Control in Sielco PolyEco1000Sielco PolyEco1000
- CVE-2023-0897Session FIxation in Sielco PolyEco1000Sielco PolyEco1000
- CVE-2023-39427Ashlar-Vellum Cobalt, Xenon, Argon, Lithium Out-of-bounds WriteAshlar-Vellum Cobalt · Ashlar-Vellum Xenon +2
- CVE-2023-39936Ashlar-Vellum Graphite Out-of-bounds ReadAshlar-Vellum Graphite
- CVE-2023-31418Elasticsearch uncontrolled resource consumptionElasticsearch · org.elasticsearch:elasticsearch
- CVE-2023-5794PHPGurukul Online Railway Catering System Login index.php sql injectionPHPGurukul Online Railway Catering System
- CVE-2023-5624Blind SQL InjectionTenable Nessus Network Monitor
- CVE-2023-5623Privilege Escalation Tenable Nessus Network Monitor
- CVE-2023-5622Privilege Escalation Tenable Nessus Network Monitor
- CVE-2023-45317Sielco Radio Link and Analog FM Transmitters Cross-Site Request ForgerySielco Analog FM transmitter · Sielco Radio Link
- CVE-2023-5787Shaanxi Chanming Education Technology Score Query System sql injectionShaanxi Chanming Education Technology Score Query System
- CVE-2023-46238XSS with User Avatar image in ZITADELzitadel
- CVE-2023-46090WordPress Spider Facebook Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)WebDorado WDSocialWidgets
- CVE-2023-46094WordPress Conversios.io Plugin <= 6.5.3 is vulnerable to Cross Site Scripting (XSS)Conversios Track Google Analytics 4, Facebook Pixel & Conve…
- CVE-2023-46081WordPress Lava Directory Manager Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS)Lavacode Lava Directory Manager
- CVE-2023-46077WordPress The Awesome Feed – Custom Feed Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)Arrow Plugins The Awesome Feed – Custom Feed
- CVE-2023-46076WordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.102 is vulnerable to Cross Site Scripting (XSS)RedNao WooCommerce PDF Invoice Builder, Create invoices, pa…
- CVE-2023-46075WordPress Contact Form Builder, Contact Widget Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)wpdevart Contact Form Builder, Contact Widget
- CVE-2023-5780Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-46072WordPress Add Shortcodes Actions And Filters Plugin <= 2.0.9 is vulnerable to Cross Site Scripting (XSS)Michael Simpson Add Shortcodes Actions And Filters
- CVE-2023-5798Assistant < 1.4.4 - Editor+ SSRFAssistant
- CVE-2023-46667Fleet Server Insertion of Sensitive Information into Log FileElastic Fleet Server
- CVE-2018-16739An issue was discovered on certain ABUS TVIP devices.
- CVE-2018-17559Due to incorrect access control, unauthenticated remote attackers can view the /video.mjpg video stream of certain ABUS TVIP cameras.
Medium, low and unrated 51
- CVE-2023-5805SourceCodester Simple Real Estate Portal System view_estate.php sql injectionSourceCodester Simple Real Estate Portal System
- CVE-2023-31416Elastic Cloud on Kubernetes (ECK) secret token configuration issueElastic Cloud on Kubernetes
- CVE-2023-31417Elasticsearch Insertion of sensitive information in audit logsElasticsearch · org.elasticsearch:elasticsearch
- CVE-2023-5796CodeAstro POS System Logo setting unrestricted uploadCodeAstro POS System
- CVE-2023-5795CodeAstro POS System Profile Picture profil unrestricted uploadCodeAstro POS System
- CVE-2023-31419Elasticsearch StackOverflow vulnerabilityElasticsearch · org.elasticsearch:elasticsearch
- CVE-2023-5793flusity CMS Dashboard customblock.php loadCustomBlocCreateForm cross site scriptingflusity CMS
- CVE-2023-5792SourceCodester Sticky Notes App delete-note.php sql injectionSourceCodester Sticky Notes App
- CVE-2023-5791SourceCodester Sticky Notes App add-note.php cross site scriptingSourceCodester Sticky Notes App
- CVE-2023-41966Sielco Radio Link and Analog FM Transmitters Privilege Defined With Unsafe ActionsSielco Analog FM transmitter · Sielco Radio Link
- CVE-2023-45228Sielco Radio Link and Analog FM Transmitters Improper Access ControlSielco Analog FM transmitter · Sielco Radio Link
- CVE-2023-46666Elastic Sharepoint Online Python Connector Improper Access ControlElastic Sharepoint Online Python Connector
- CVE-2023-5790SourceCodester File Manager App add-file.php unrestricted uploadSourceCodester File Manager App
- CVE-2023-5789Dragon Path 707GR1 Ping Diagnostics cross site scriptingDragon Path 707GR1
- CVE-2023-5786GeoServer GeoWebCache rest.html direct requestGeoServer GeoWebCache
- CVE-2023-5785Netentsec NS-ASG Application Security Gateway addaddress_interpret.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2023-46234browserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attackbrowserify-sign
- CVE-2023-5784Netentsec NS-ASG Application Security Gateway uploadfirewall.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2023-5783Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-5782Tongda OA 2017 General News delete_query.php sql injectionTongda OA
- CVE-2023-41096Keys Stored in Plaintext on Secure Vault High for Silabs Ember ZNet devicessilabs.com Ember ZNet SDK
- CVE-2023-41095Keys Stored in Plaintext on Secure Vault High for Silabs OpenThread devicessilabs.com OpenThread SDK
- CVE-2023-5781Tongda OA 2017 delete_webmail.php DELETE_STR sql injectionTongda OA
- CVE-2023-46088WordPress WP Full Stripe Free Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)Mammothology WP Full Stripe Free
- CVE-2023-32116WordPress Custom post types Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS)TotalPress.org Custom post types, Custom Fields & more
- CVE-2023-30492WordPress Minimum Purchase for WooCommerce Plugin <= 2.0.0.1 is vulnerable to Cross Site Scripting (XSS)Vark Minimum Purchase for WooCommerce
- CVE-2023-46074WordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS)Borbis Media FreshMail For WordPress
- CVE-2023-5802WordPress WP Knowledgebase Plugin <= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF)Mihai Iova WordPress Knowledge base & Documentation Plugin…
- CVE-2023-5139Potential buffer overflow vulnerability in the Zephyr STM32 Crypto driverzephyrproject-rtos Zephyr
- CVE-2023-31421Beats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issueElastic Beats · Elastic Agent +2
- CVE-2018-17878Buffer Overflow vulnerability in certain ABUS TVIP cameras allows attackers to gain control of the program via crafted string sent to sprint
- CVE-2018-17879An issue was discovered on certain ABUS TVIP cameras.
- CVE-2020-17477Incorrect LDAP ACLs in ucs-school-ldap-acls-master in UCS@school before 4.4v5-errata allow remote teachers, staff, and school administrators
- CVE-2023-27170Xpand IT Write-back manager v2.3.1 allows attackers to perform a directory traversal via modification of the siteName parameter.
- CVE-2023-33558An information disclosure vulnerability in the component users-grid-data.php of Ocomon before v4.0.1 allows attackers to obtain sensitive in
- CVE-2023-33559A local file inclusion vulnerability via the lang parameter in OcoMon before v4.0.1 allows attackers to execute arbitrary code by supplying
- CVE-2023-38328An issue was discovered in eGroupWare 17.1.20190111.
- CVE-2023-39726An issue in Mintty v.3.6.4 and before allows a remote attacker to execute arbitrary code via crafted commands to the terminal.
- CVE-2023-42188IceCMS v2.0.1 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2023-42406SQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows a remote attacker to obtain sensitive infor
- CVE-2023-43352An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu compo
- CVE-2023-45867ILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion vulnerability in the ScormAicc module.
- CVE-2023-45868The Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user privileges) to achieve a high-impact Directory Tr
- CVE-2023-46374ZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-46435Sourcecodester Packers and Movers Management System v1.0 is vulnerable to SQL Injection via mpms/?p=services/view_service&id.
- CVE-2023-46449Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control.
- CVE-2023-46450Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the Add supplier functio
- CVE-2023-46491ZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version Library.
- CVE-2023-46752An issue was discovered in FRRouting FRR through 9.0.1.
- CVE-2023-46753An issue was discovered in FRRouting FRR through 9.0.1.
- CVE-2023-46754The admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP feature accepts arbitrary numerical values.