# CVEs published 2023-10-29

18 CVEs were published on October 29, 2023: 1 critical, 5 high. Days are UTC.

- [CVE-2023-4393](https://cve.now/CVE-2023-4393.md): HTML and SMTP Injection in LiquidFiles (CVSS 5.4, LiquidFiles Pty LiquidFiles)
- [CVE-2007-10003](https://cve.now/CVE-2007-10003.md): The Hackers Diet Plugin HTTP POST Request ajax\_blurb.php sql injection (CVSS 6.3, The Hackers Diet Plugin)
- [CVE-2005-10002](https://cve.now/CVE-2005-10002.md): almosteffortless secure-files Plugin secure-files.php sf\_downloads path traversal (CVSS 5.5, almosteffortless secure-files Plugin)
- [CVE-2021-33638](https://cve.now/CVE-2021-33638.md): Run copy with container in a malicious directory may cause container escaping (CVSS 8.4, openEuler iSulad)
- [CVE-2021-33637](https://cve.now/CVE-2021-33637.md): Export container in a malicious directory may cause process to be hijacked (CVSS 8.4, openEuler iSulad)
- [CVE-2021-33636](https://cve.now/CVE-2021-33636.md): Load malicious images may cause process to be hijacked (CVSS 8.4, openEuler iSulad)
- [CVE-2021-33635](https://cve.now/CVE-2021-33635.md): Pull malicious images may cause process to be hijacked (CVSS 9.8, openEuler iSulad)
- [CVE-2021-33634](https://cve.now/CVE-2021-33634.md): Malicious image running containers may cause DoS attacks (CVSS 6.3, openEuler lcr)
- [CVE-2023-40685](https://cve.now/CVE-2023-40685.md): IBM i privilege escalation (CVSS 7.4, IBM i)
- [CVE-2023-40686](https://cve.now/CVE-2023-40686.md): IBM i privilege escalation (CVSS 4.9, IBM i)
- [CVE-2023-43041](https://cve.now/CVE-2023-43041.md): IBM QRadar information disclosure (CVSS 6.5, IBM QRadar SIEM)
- [CVE-2023-5838](https://cve.now/CVE-2023-5838.md): Insufficient Session Expiration in linkstackorg/linkstack (CVSS 4.1, linkstackorg/linkstack)
- [CVE-2023-5840](https://cve.now/CVE-2023-5840.md): Weak Password Recovery Mechanism for Forgotten Password in linkstackorg/linkstack (CVSS 6.5, linkstackorg/linkstack)
- [CVE-2023-5839](https://cve.now/CVE-2023-5839.md): Privilege Chaining in hestiacp/hestiacp (CVSS 8.8, hestiacp/hestiacp)
- [CVE-2023-46858](https://cve.now/CVE-2023-46858.md): Moodle 4.3 allows /grade/report/grader/index.php?searchvalue= reflected XSS when logged in as a teacher. (no CVSS)
- [CVE-2023-46862](https://cve.now/CVE-2023-46862.md): An issue was discovered in the Linux kernel through 6.5.9. (no CVSS)
- [CVE-2023-46863](https://cve.now/CVE-2023-46863.md): Peppermint Ticket Management before 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/users/file/download?filepath=./../ P (no CVSS)
- [CVE-2023-46864](https://cve.now/CVE-2023-46864.md): Peppermint Ticket Management through 0.2.4 allows remote attackers to read arbitrary files via a /api/v1/ticket/1/file/download?filepath=../ (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-10-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.