CVEs published in September 2023
2,233 vulnerabilities, 282 critical, 23 exploited.
- opswat metadefender kioskAn issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Long inputs were not properly...9.8 Critical
- opswat metadefender kiosk, media validation agent +1 moreAn issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. It has an unquoted service path...7.8 High
- opswat metadefender kioskAn issue was discovered in OPSWAT MetaDefender KIOSK 4.6.1.9996. Built-in features of Windows ...9.8 Critical
- quboworld smart plug 10a firmwareAn issue was discovered in Qubo Smart Plug10A version HSP02_01_01_14_SYSTEM-10 A, allows local...5.5 Medium
- freewillsolutions smart tradeFreewill iFIS (aka SMART Trade) 20.01.01.04 allows OS Command Injection via shell metacharacters...9.8 Critical
- bezeq vtech nb403-il, vtech iad604-il firmware, vtech nb403-il firmware +2 moreAn issue was discovered in Bezeq Vtech NB403-IL version BZ_2.02.07.09.13.01 and Vtech IAD604-IL...7.5 High
- hashicorp vault, vault enterprise +1 moreVault's Transit Secrets Engine Allowed Nonce Specified without Convergent Encryption6.8 Medium
- gnu binutils, fedora extra packages for enterprise linux 7, extra packages for enterprise linux 8 +7 more +9 moreLocal variable `ch_type` in function `bfd_init_section_decompress_status` can be uninitialized4.7 Medium
- phpipamphpipam Header redirect2.7 Low
- yordam medasproXSS in Yordams MedasPro6.1 Medium
- yepas digital yepasInformation Disclosure in Digital Yepas9.8 Critical
- yepas digital yepasAuthentication Bypass in Digital Yepas9.8 Critical
- exagate sysguard 3001, sysguard 3001 firmware +1 moreAuthentication Bypass in Exagate SYSGuard 30019.8 Critical
- movusSQLi in Movus Admin Panel9.8 Critical
- aceka company managementSQLi in Aceka Holdings Company Management9.8 Critical
- pmmp pocketmine-mpPocketMine-MP before 5.3.1 Denial of Service via LoginPacket8.7 High
- pmmp pocketmine-mpPocketMine-MP 5.2.0 Server Crash via Incorrect EC Curve8.7 High
- green rocket security greenradiusCross Site Scripting (XSS) Issue on "Client Based Authentication Policy Configuration" Screen2.0 Low
- hp oneview, hewlett packard enterprise (hpe) hpe oneview, hpe oneview global dashboard +2 moreA remote authentication bypass issue exists in some OneView APIs.9.8 Critical
serenityOSS-FuzzHeap-buffer-overflow in Video::VP9::Decoder::create_video_frameNo score- siemens simatic pcs neo (administration console) v4.0, simatic pcs neo (administration console) v4.0 update 1, simatic pcs neo +2 moreA vulnerability has been identified in SIMATIC PCS neo (Administration Console) V4.0 (All...5.5 Medium
- siemens spectrum power 7A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q3). The affected...8.2 High
- schneider electric igss update service (igssupdateservice.exe), schneider-electric interactive graphical scada system +1 moreA CWE-306: Missing Authentication for Critical Function vulnerability exists in the IGSS Update...7.8 High
- apache airflow hdfs providerApache HDFS Provider error message suggested installation of incorrect pip package7.8 High
- apache commons compressApache Commons Compress: Denial of service via CPU consumption for malformed TAR file5.5 Medium
- adobe coldfusionBypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 89.8 Critical
- adobe coldfusionColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-292987.5 High
- adobe coldfusionColdFusion | Improper Access Control (CWE-284)5.3 Medium
- trellix data loss prevention endpoint for windows, data loss prevention +1 moreA Privilege escalation vulnerability exists in Trellix Windows DLP endpoint for windows which...7.1 High
- contribsys sidekiqsidekiq Denial of Service vulnerability7.5 High
- yan&co woocommerce cvr payment gatewayWooCommerce CVR Payment Gateway < 6.1.0 - Missing Authorization to Authenticated (Contributor+) CVR Update4.3 Medium
- booster for woocommerce, pluggabl booster for woocommerce – pdf invoices, abandoned cart, variation swatches & 100+ tools +1 moreBooster for WooCommerce <= 7.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- awesome weather widget project weather widget, richardgabriel awesome weather widget +1 moreAwesome Weather Widget <= 3.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- smashballoon feeds for youtube, smub feeds for youtube (youtube video, channel, and gallery plugin) +1 moreFeeds for YouTube <= 2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- fit2cloud rackshiftSQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary...9.8 Critical
- tellerAn arbitrary file upload vulnerability in Teller Web App v.4.4.0 allows a remote attacker to...5.4 Medium
- lenosp project lenospAn arbitrary file upload vulnerability in the /user/upload component of lenosp 1.0-1.2.0 allows...8.8 High
- lenosp project lenospLenosp 1.0.0-1.2.0 is vulnerable to SQL Injection via the log query module.6.5 Medium
- froala editorFroala Editor Cross-site Scripting vulnerability5.4 Medium
- appfire time to slaA cross-site scripting (XSS) vulnerability in Time to SLA plugin v10.13.5 allows attackers to...6.1 Medium
- webmin userminA Stored Cross-Site Scripting (XSS) vulnerability in the SSH configuration tab in Usermin 2.001...5.4 Medium
- webmin userminA Stored Cross-Site Scripting (XSS) vulnerability while editing the autoreply file page in...5.4 Medium
- webmin userminA Stored Cross-Site Scripting (XSS) vulnerability in the filter and forward mail tab in Usermin 2...5.4 Medium
- china mobile communications mobile intelligent home gateway, chinamobile intelligent home gateway firmware +1 moreCommand Execution vulnerability in China Mobile Communications China Mobile Intelligent Home...9.8 Critical
- sichuan tianyi kanghe communication co ltd china telecom tianyi home gateway, tianyisc tewa-700g firmware +1 moreInsecure Permissions vulnerability in Sichuan Tianyi Kanghe Communication Co., Ltd China Telecom...5.5 Medium
- didotech engineering \& lifecycle managementA SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0...8.8 High
- didotech engineering \& lifecycle managementA SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0...8.8 High
- cloudroits wesite job searchA SQL injection vulnerability in Cloudroits Website Job Search v.15.0 allows a remote...8.8 High
- didotech engineering \& lifecycle managementA SQL injection vulnerability in Didotech srl Engineering & Lifecycle Management (aka pdm) v.14.0...8.8 High
- moosocialCross Site Scripting vulnerability in mooSocial mooSocial Software 3.1.6 and 3.1.7 allows a...6.1 Medium
- Show moreLoading…