CVEs published in September 2023
2,233 vulnerabilities, 282 critical, 23 exploited.
- eclipse jgitImproper handling of case insensitive filesystems in Eclipse JGit allows arbitrary file write8.8 High
- wftpserver wing ftp server, wing ftp server ftp server +1 moreCross-Site Scripting Vulnerability in Wing FTP Server <= 7.2.03.0 Low
- wftpserver wing ftp server, wing ftp server ftp server +1 moreInsecure Default Permissions in Wing FTP Server <= 7.2.06.1 Medium
- wftpserver wing ftp server, wing ftp server ftp server +1 moreExposed Session Variable in Wing FTP Server <= 7.2.06.5 Medium
- wftpserver wing ftp server, wing ftp server ftp server +1 moreWeak Access Control between Domains in Wing FTP Server <= 7.2.04.9 Medium
- adobe commerce, magento open source +1 moreAdobe Commerce post-auth improper input validation leads to remote code execution9.1 Critical
- cbm control de ciber, control de ciber de ciber +1 moreBuffer Overflow vulnerability in Control de Ciber version 1.650, in the printing function....8.2 High
- cbm control de ciber, control de ciber de ciber +1 moreControl de Ciber, in its 1.650 version, is affected by a Denial of Service condition through the...8.2 High
- cbm control de ciber, control de ciber de ciber +1 moreCyber Control, in its 1.650 version, is affected by a vulnerability in the generation on the...8.2 High
terraform-provider-awsopenSUSESecurity update for terraform-provider-awsNo scoreterraform-provider-nullopenSUSESecurity update for terraform-provider-nullNo scoreterraform-provider-helmopenSUSESecurity update for terraform-provider-helmNo score- dell sd rom utilitySD ROM Utility, versions prior to 1.0.2.0 contain an Improper Access Control vulnerability. A...7.3 High
- crowcpp crowAll versions of the package crow are vulnerable to HTTP Response Splitting when untrusted user...6.5 Medium
- sap commoncryptolib, content server, extended application services and runtime +8 more +10 moreMissing Authorization check in SAP CommonCryptoLib9.8 Critical
- sap powerdesigner, sap se powerdesigner client +1 moreCode Injection vulnerability in SAP PowerDesigner Client6.3 Medium
- sap businessobjects business intelligence, sap se businessobjects business intelligence platform (promotion management) +1 moreInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management)9.9 Critical
- sap businessobjects, sap se businessobjects suite (installer) +1 moreArbitrary File Delete via Directory Junction in SAP BusinessObjects Suite(installer)6.2 Medium
- sap se netweaver as abap (applications based on unified rendering), sap netweaver application server abap +1 moreCode Injection vulnerability in SAP NetWeaver AS ABAP (applications based on Unified Rendering)5.5 Medium
- sap s4core, sap se manage purchase contracts app +1 moreMissing Authorization check in SAP Manage Purchase Contracts App5.4 Medium
- sap netweaver, sap se netweaver (guided procedures) +1 moreMissing Authentication check in SAP NetWeaver (Guided Procedures)5.3 Medium
- sap s\/4 hana, sap se s4 hana abap (manage checkbook apps) +1 moreInsecure Direct Object Reference (IDOR) vulnerability in S4 HANA (Manage checkbook apps)2.7 Low
- sap se s/4hana (create single payment application), sap s\/4 hana +1 moreExternal Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application)3.5 Low
- sap businessobjects business intelligence platform, sap se businessobjects business intelligence platform (web intelligence html interface) +1 moreInsufficient File type validation in SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface)8.7 High
- themeisle google maps plugin by intergeoGoogle Maps Plugin by Intergeo <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- chrisvrichardson mappress maps for wordpress, mappresspro mappress +1 moreMapPress Maps for WordPress <= 2.88.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- akarmenia crayon syntax highlighter, aramk crayon-syntax-highlighter +1 moreCrayon Syntax Highlighter <= 2.8.4 - Authenticated (Contributor+) Server Side Request Forgery6.4 Medium
- designchemical jquery accordion menu widgetJQuery Accordion Menu Widget <= 3.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- nodejs node, node.js +1 moreThe use of the deprecated API `process.binding()` can bypass the permission model through path...7.5 High
- node.js, nodejs node +1 moreA vulnerability has been identified in Node.js version 20, affecting users of the experimental...5.3 Medium
- sap commoncryptolib, content server, extended application services and runtime +8 more +10 moreMemory Corruption vulnerability in SAP CommonCryptoLib7.5 High
- sap businessobjects business intelligence, sap se businessobjects business intelligence platform (version management system) +1 moreInformation Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Version Management System)5.3 Medium
- nvidia bluefield 1, bluefield 2 ga, bluefield 2 lts +5 more +7 moreNVIDIA ConnectX Host Firmware for the BlueField Data Processing Unit contains a vulnerability...7.8 High
- terryl wp githuber mdCross Site Scripting vulnerability in WP Githuber MD plugin v.1.16.2 allows a remote attacker to...5.4 Medium
- icewarpCross Site Scripting (XSS) in Webmail Calendar in IceWarp 10.3.1 allows remote attackers to...6.1 Medium
- opencartOpenCart v4.0.2.2 is vulnerable to Brute Force Attack.9.8 Critical
- dedecmsDedeCMS 5.7.102 has a File Upload vulnerability via uploads/dede/module_make.php.9.8 Critical
- samsung exynos 1280 firmware, exynos 1380 firmware, exynos 2100 firmware +3 more +5 moreAn issue was discovered in the NPU kernel driver in Samsung Exynos Mobile Processor 9820, 980,...2.0 Low
- d-link dir-816 a2, dlink dir-816 firmware +1 moreD-Link DIR-816 A2 1.10 B05 was discovered to contain a command injection vulnerability via the...9.8 Critical
- maximus5 conemuConEmu before commit 230724 does not sanitize title responses correctly for control characters, potentially leading to arbitrary code execution. This is related to an incomplete fix for CVE-2022-46387…9.8 Critical
- voltronicpower snmp web proAn issue in SNMP Web Pro v.1.1 allows a remote attacker to execute arbitrary code and obtain...9.8 Critical
- microsoft .net, .net 6.0, .net 7.0 +7 more +9 more.NET Core and Visual Studio Denial of Service Vulnerability6.5 Medium
- xpand-it write-back managerXpand IT Write-back manager v2.3.1 uses a hardcoded salt in license class configuration which...6.5 Medium
- apachefriends xampp, xampp apache distribution +1 moreThe installer in XAMPP through 8.1.12 allows local users to write to the C:\xampp directory....6.7 Medium
- apple ipados, macos, ios and ipados +1 more +3 moreA privacy issue was addressed with improved private data redaction for log entries. This issue is...3.3 Low
- apple ipados, macos, tvos +4 more +6 moreThe issue was addressed with improved handling of caches. This issue is fixed in macOS Ventura 13...7.8 High
- apple macosThis issue was addressed with improved state management of S/MIME encrypted emails. This issue is...7.5 High
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anything-llm +1 moreSQL Injection in mintplex-labs/anything-llm8.1 High
- mintplex-labs mintplex-labs/anything-llm, mintplexlabs anything-llm +1 moreAuthentication Bypass by Primary Weakness in mintplex-labs/anything-llm8.2 High
- openmage magento, magento-lts +1 moreMagento LTS's guest order "protect code" can be brute-forced too easily7.5 High
- Show moreLoading…