CVEs published in September 2023
2,233 vulnerabilities, 282 critical, 23 exploited.
- apache supersetApache Superset: Metadata db write access can lead to remote code execution6.6 Medium
- apache supersetApache Superset: Possible Unauthorized Registration of SQLite Database Connections3.8 Low
- apache supersetApache Superset: Stack traces enabled by default4.3 Medium
- apache supersetApache Superset: Improper data permission validation on Jinja templated queries5.0 Medium
- apache supersetApache Superset: Improper API permission for low privilege users allows for SSRF4.3 Medium
- apache supersetApache Superset: Improper Authorization check on import charts4.3 Medium
- f-revocrmF-RevoCRM 7.3 series prior to version7.3.8 contains a cross-site scripting vulnerability. If this...5.4 Medium
- f-revocrmF-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this...9.8 Critical
- apache supersetApache Superset: Improper API permission for low privilege users5.4 Medium
- jenkins frugal testing, jenkins project frugal testing plugin +1 moreMissing permission checks in Jenkins Frugal Testing Plugin4.3 Medium
- jenkins frugal testing, jenkins project frugal testing plugin +1 moreCSRF vulnerability in Jenkins Frugal Testing Plugin3.5 Low
- jenkins assembla auth, jenkins project assembla auth plugin +1 moreDisabled permissions granted by Jenkins Assembla Auth Plugin8.8 High
- jenkins aws codecommit trigger, jenkins project aws codecommit trigger plugin +1 moreHTML injection vulnerability in Jenkins AWS CodeCommit Trigger Plugin6.1 Medium
- jenkins aws codecommit trigger, jenkins project aws codecommit trigger plugin +1 moreMissing permission check in Jenkins AWS CodeCommit Trigger Plugin6.5 Medium
- jenkins aws codecommit trigger, jenkins project aws codecommit trigger plugin +1 moreCSRF vulnerability in Jenkins AWS CodeCommit Trigger Plugin4.3 Medium
- jenkins aws codecommit trigger, jenkins project aws codecommit trigger plugin +1 moreMissing permission check in Jenkins AWS CodeCommit Trigger Plugin allows enumerating credentials IDs4.3 Medium
- jenkins tap, jenkins project tap plugin +1 moreStored XSS vulnerability in Jenkins TAP Plugin5.4 Medium
- jenkins ssh2 easy, jenkins project ssh2 easy plugin +1 moreDisabled permissions can be granted by Jenkins SSH2 Easy Plugin8.8 High
- jenkins ivy, jenkins project ivy plugin +1 moreCSRF vulnerability in Jenkins Ivy Plugin6.5 Medium
- jenkins bitbucket push and pull request, jenkins project bitbucket push and pull request plugin +1 moreSSRF vulnerability in Jenkins Bitbucket Push and Pull Request Plugin allows capturing credentials7.5 High
- jenkins google login, jenkins project google login plugin +1 moreJenkins Google Login Plugin non-constant time token comparison7.5 High
- jenkins azure ad, jenkins project azure ad plugin +1 moreNon-constant time nonce comparison in Jenkins Microsoft Entra ID (previously Azure AD) Plugin7.5 High
- jenkins pipeline maven integration, jenkins project pipeline maven integration plugin +1 moreImproper masking of credentials in Jenkins Pipeline Maven Integration Plugin5.3 Medium
- jenkins job configuration history, jenkins project job configuration history plugin +1 moreJob Configuration History Plugin's path traversal allows exploiting XXE vulnerability8.8 High
- jenkins job configuration history, jenkins project job configuration history plugin +1 morePath traversal allows exploiting XXE vulnerability in Jenkins Job Configuration History Plugin6.5 Medium
- jenkins job configuration history, jenkins project job configuration history plugin +1 moreXSS vulnerability in Jenkins Job Configuration History Plugin5.4 Medium
- jenkins job configuration history, jenkins project job configuration history plugin +1 morePath traversal in Jenkins Job Configuration History Plugin4.3 Medium
- delinea secret serverInsufficient verification of data authenticity vulnerability in Delinea Secret Server9.1 Critical
- delinea secret serverFile accessibility vulnerability in Delinea Secret Server6.8 Medium
- tp-link tl-wr802n, tl-wr802n firmware, tl-wr841n +3 more +5 moreMultiple TP-LINK products allow a network-adjacent unauthenticated attacker to execute arbitrary...8.8 High
- tp-link archer c20, archer c50, archer c55 +3 more +5 moreMultiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS...8.0 High
- tp-link archer c50, archer c55, archer c55 firmware +1 more +3 moreArcher C50 firmware versions prior to 'Archer C50(JP)_V3_230505' and Archer C55 firmware versions...8.8 High
- tp-link archer c20, archer c20 firmware +1 moreImproper authentication vulnerability in Archer C20 firmware versions prior to 'Archer C20(JP...8.8 High
- tp-link archer c1200, archer c9, archer c1200 firmware +2 more +4 moreArcher C1200 firmware versions prior to 'Archer C1200(JP)_V2_230508' and Archer C9 firmware...8.8 High
- tp-link archer a10, archer a10 firmware +1 moreArcher A10 firmware versions prior to 'Archer A10(JP)_V2_230504' allows a network-adjacent...8.8 High
- tp-link archer c3150, archer c3150 firmware +1 moreArcher C3150 firmware versions prior to 'Archer C3150(JP)_V2_230511' allows a network-adjacent...8.0 High
- tp-link archer c5, archer c7, archer c7 firmware +2 moreArcher C5 firmware all versions and Archer C7 firmware versions prior to 'Archer C7(JP)_V2_230602...8.0 High
- tp-link archer c5400, archer c5400 firmware +1 moreArcher C5400 firmware versions prior to 'Archer C5400(JP)_V2_230506' allows a network-adjacent...8.0 High
- tp-link deco m4, deco m4 firmware +1 moreDeco M4 firmware versions prior to 'Deco M4(JP)_V2_1.5.8 Build 20230619' allows a network...8.0 High
- tp-link archer a10, archer ax10, archer ax11000 +5 more +7 moreMultiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS...8.0 High
- tp-link archer ax6000, archer ax6000 firmware +1 moreArcher AX6000 firmware versions prior to 'Archer AX6000(JP)_V1_1.3.0 Build 20221208' allows a...8.0 High
- estatik mortgage calculatorWordPress Mortgage Calculator Estatik Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)7.1 High
- ujwol bastakoti ct commerceWordPress CT Commerce Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- david lingren media library assistantMedia Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution9.8 Critical
- carrrotWordPress Carrot Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- wpzest custom admin login page | wpzest, custom admin login page \| wpzest plugin +1 moreWordPress Custom Admin Login Page | WPZest Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- plausible analytics, plausible.io plausible analytics +1 moreWordPress Plausible Analytics Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)5.8 Medium
- adenion blog2social, blog2social, adenion blog2social: social media auto post & scheduler +1 moreWordPress Blog2Social Plugin <= 7.2.0 is vulnerable to Cross Site Scripting (XSS)7.1 High
- codeinitiator fitness calculators pluginWordPress Fitness calculators plugin Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- greg ross schedule posts calendarWordPress Schedule Posts Calendar Plugin <= 5.2 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- Show moreLoading…