CVEs published in September 2023
2,233 vulnerabilities, 282 critical, 23 exploited.
- hyundai model (2017), 2017 firmware +1 moreHyundai car CWE-294: Authentication Bypass by Capture-replay7.4 High
- startrinity softswitchStarTrinity Softswitch version 2023-02-16 - multiple CSRF (CWE-352)8.1 High
- startrinity softswitchStarTrinity Softswitch version 2023-02-16 – Open Redirect (CWE-601)8.8 High
- startrinity softswitchStarTrinity Softswitch version 2023-02-16 - Persistent XSS (CWE-79)8.8 High
- startrinity softswitchStarTrinity Softswitch version 2023-02-16 - multiple Reflected XSS (CWE-79)8.8 High
- proscend icr series routers fw, a510-f1 firmware, a510-l1 firmware +18 more +20 moreProscend Advice ICR Series routers fw version 1.7610.0 Critical
- farsight tech nordic ab provide, farsight provide server +1 moreFarsight Tech Nordic AB ProVide4.8 Medium
- 7-twenty bot7Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').8.8 High
- synel terminals, bioentry-w2 firmware, bioentry p2 firmware +19 more +21 moreSynel Terminals - CWE-494: Download of Code Without Integrity Check7.2 High
lexicalcrates.ioMultiple soundness issues in lexicalNo scorelexical-corecrates.iolexical-core has multiple soundness issuesNo score- suitedash :: one dashboard® client portal : suitedash direct login, suitedash client portal \ +1 moreWordPress Client Portal : SuiteDash Direct Login Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- qualityunit post affiliate proWordPress Post Affiliate Pro Plugin <= 1.25.0 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- essentialplugin audio player with playlist ultimateWordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- realwebcare wrc pricing tablesWordPress WRC Pricing Tables Plugin <= 2.3.7 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- visualmodo borderlessWordPress Borderless Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- elastic email sender, elastic email sender email sender, elasticemail elastic email sender +2 moreWordPress Elastic Email Sender Plugin <= 1.2.6 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- exifographyWordPress Exifography Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- vim, vim vim/vim, apple macos +2 more +4 moreHeap-based Buffer Overflow in vim/vim7.8 High
- vim, vim vim/vim, apple macos +2 moreUntrusted Search Path in vim/vim7.8 High
- vim, vim vim/vim, apple macos +2 moreOut-of-bounds Write in vim/vim4.8 Medium
- vim, vim vim/vim, apple macos +1 more +3 moreInteger Overflow or Wraparound in vim/vim7.8 High
- moxa mxsecurity, mxsecurity series +1 moreMXsecurity Register Database Pollution5.3 Medium
- moxa mxsecurity, mxsecurity series +1 moreMXsecurity Hardcoded Credential7.5 High
- moxa mxsecurity, mxsecurity series +1 moreMXsecurity Device Information Disclosure7.5 High
- moxa mxsecurity, mxsecurity series +1 moreMXsecurity Authenticated Information Disclosure Due to SQL Injection7.1 High
- moxa mxsecurity, mxsecurity series +1 moreMXsecurity Authentication Bypass9.8 Critical
- linux, linux kernel +1 moreksmbd: fix out of bounds read in smb2_sess_setup9.1 Critical
terraformSUSESecurity update for terraformNo score- new-nine font awesome 4 menusFont Awesome 4 Menus <= 4.7.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
github.com/bnb-chain/tss-libGotss-lib leaks secret keys in response to incorrectly constructed Paillier moduliNo score- playtubePlayTube Redirect information disclosure4.3 Medium
- ibos, ibos oa +1 moreIBOS OA addcomment addComment sql injection5.5 Medium
- xwiki, xwiki xwiki-platform +1 moreVelocity execution without script rights in Xwiki platform6.3 Medium
- decentraland single-sign-on-client, single sign on client +1 moreImproper Neutralization of Script in Attributes in @dcl/single-sign-on-client7.5 High
- suntront smart table integrated management systemXintian Smart Table Integrated Management System AddUpdateRole.aspx sql injection5.5 Medium
- d-link dar-8000-10, dlink dar-8000-10 firmware +1 moreD-Link DAR-8000-10 decodmail.php os command injection5.0 Medium
- totvs rmTOTVS RM Portal cross site scripting4.3 Medium
- totvs rmTOTVS RM Portal Login.aspx cross site scripting2.3 Low
- infosoftbd clcknshopInfosoftbd Clcknshop GET Parameter all sql injection6.3 Medium
- infosoftbd clcknshopInfosoftbd Clcknshop all cross site scripting3.5 Low
- motorola smartphone firmware, motorola mobility smartphones +1 moreI some cases, when the device is USB-tethered to a host PC, and the device is sharing its mobile...4.9 Medium
- gpac, gpac gpac/gpac +1 moreInteger Overflow or Wraparound in gpac/gpac5.9 Medium
- gpac, gpac gpac/gpac +1 moreOut-of-bounds Read in gpac/gpac5.9 Medium
- gpac, gpac gpac/gpac +1 moreFloating Point Comparison with Incorrect Operator in gpac/gpac4.0 Medium
- github enterprise serverInformation disclosure in GitHub Enterprise Server leading to private repository leakage5.3 Medium
crasOSS-FuzzUse-of-uninitialized-value in dev_io_captureNo score- rust-vmm vm-memoryDefault functions in VolatileMemory trait lack bounds checks in vm-memory2.5 Low
- dharmesh patel post list with featured imageWordPress Post List With Featured Image Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)7.1 High
- fortinet fortianalyzer, fortimanager, fortios +1 more +3 moreAn improper certificate validation vulnerability [CWE-295] in FortiManager 7.0.1 and below, 6.4.6...5.4 Medium
- Show moreLoading…