CVEs published in September 2023
2,233 vulnerabilities, 282 critical, 23 exploited.
- razormist simple membership systemSourceCodester Simple Membership System club_validator.php sql injection6.3 Medium
icuOSS-FuzzHeap-buffer-overflow in icu_74::SimpleDateFormat::subFormatNo scoreassimpOSS-FuzzHeap-buffer-overflow in Assimp::MD5::MD5MeshParser::MD5MeshParserNo score- china unicom tewa-800g, chinaunicom tewa-800g firmware +1 moreChina Unicom TEWA-800G debug log file2.0 Low
- jinher oa, tongda2000 tongda office anywhere +1 moreTongda OA cross site scripting3.5 Low
- kohaKOHA MARC search.pl cross site scripting3.5 Low
- planno planning biblioPlanno Comment cross site scripting3.5 Low
- jinher oa, tongda2000 tongda office anywhere +1 moreTongda OA delete.php sql injection5.5 Medium
- dedecmsDedeCMS select_templets_post.php absolute path traversal5.5 Medium
- oretnom23 ac repair and services systemSourceCodester AC Repair and Services System cross site scripting3.5 Low
- revive adserver, revive-adserver revive adserver +1 moreA reflected XSS vulnerability exists in Revive Adserver 5.4.1 and earlier versions..6.1 Medium
- 07fly crm, customer relationship management +1 more07FLY CRM Administrator Login Page sql injection7.3 High
- jinher oa, tongda2000 tongda office anywhere +1 moreTongda OA delete.php sql injection6.3 Medium
- oretnom23 lost and found information systemSourceCodester Lost and Found Information System POST Parameter sql injection6.3 Medium
- lmxcmslmxcms admin.php sql injection5.5 Medium
- ssssssss spider-flowspider-flow API DataSourceController.java DriverManager.getConnection deserialization6.3 Medium
- ucms project ucmsUCMS cross site scripting3.5 Low
- food ordering website project ordering website, sakshi2610 food ordering website +1 moreSakshi2610 Food Ordering Website categoryfood.php sql injection6.3 Medium
- pluck cms, pluck-cms pluck +1 morePluck CMS Installation install.php cross site scripting2.6 Low
- topaz ofdTopaz OFD Protection Module Warsaw core.exe unquoted search path5.3 Medium
- netatalk, debian linux +1 moreA Type Confusion vulnerability was found in the Spotlight RPC functions in afpd in Netatalk 3.1.x...9.8 Critical
mongooseOSS-FuzzNegative-size-param in http_cbNo scorewasmedgeOSS-FuzzUNKNOWN in WasmEdge::Loader::SharedLibrary::loadNo scoregstreamerOSS-FuzzHeap-use-after-free in g_datalist_get_flagsNo score- hyno dropbox folder shareDropbox Folder Share <= 1.9.7 - Unauthenticated Server-Side Request Forgery via 'link'7.2 High
- gopiplus horizontal scrolling announcementHorizontal scrolling announcement <= 9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- hit-reach allow php in posts and pagesAllow PHP in Posts and Pages <= 3.0.4 - Authenticated (Subscriber+) Remote Code Execution via Shortcode9.9 Critical
- netis-systems wf2409e, wf2409e firmware +1 moreAn issue in NETIS SYSTEMS WF2409Ev4 v.1.0.1.705 allows a remote attacker to execute arbitrary...9.8 Critical
- webmin userminMultiple stored cross-site scripting (XSS) vulnerabilities in Usermin 2.000 allow remote...5.4 Medium
- vbulletinA cross-site scripting (XSS) vulnerability in the Admin Control Panel of vBulletin 5.7.5 and 6.0...5.4 Medium
- filebrowserA cross-site scripting (XSS) vulnerability in FileBrowser before v2.23.0 allows an authenticated...9.0 Critical
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability7.1 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability6.1 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability9.6 Critical
- fit2cloud jumpserverJumpServer session replays download without authentication8.2 High
- geonodeGeoNode SSRF Bypass to return internal host data7.5 High
- red hat openstack platform 16.2, redhat openstack platform +1 morePlain-text passwords saved in /var/log/messages4.4 Medium
- redhat network observability, red hat network-observability-1.1.0-rhel-8 +1 moreNetwork-observability-console-plugin-container: setting loki authtoken configuration to disable or host mode leads to authentication longer being enforced7.5 High
- red hat rhods-1.22-rhel-8, redhat openshift data science +1 moreOdh-notebook-controller-container: missing authorization allows for file contents disclosure8.8 High
- shirasagiLate-Unicode normalization vulnerability in SHIRASAGI5.3 Medium
- trustedfirmware op-tee, op-tee optee os +1 moreOP-TEE double free in shdr_verify_signature7.4 High
- freeswitchFreeSWITCH allows authorized users to cause a denial of service attack by sending re-INVITE with SDP containing duplicate codec names7.5 High
- freeswitchFreeSWITCH allows remote users to trigger out of bounds write by offering an ICE candidate with unknown component ID7.5 High
- discourseDiscourse DoS via SvgSprite cache6.5 Medium
- discourseDiscourse DoS via remote theme assets4.9 Medium
- discourseDiscourse DoS via 2FA and Security Key Names6.5 Medium
- discourseDiscourse vulnerable to DoS via drafts6.5 Medium
- contiki-ngOut-of-bounds read when processing a received IPv6 packet5.3 Medium
- contiki-ngOut-of-bounds read during IPHC address decompression5.3 Medium
directusnpmDirectus affected by VM2 sandbox escape vulnerability7.6 High- Show moreLoading…