CVEs published in September 2023
2,233 vulnerabilities, 282 critical, 23 exploited.
- gitoxidelabs gix-transportgix-transport code execution vulnerability4.1 Medium
- easy registration forms registration forms, easyregistrationforms easy registration forms +1 moreEasy Registration Forms <= 2.1.1 - Authenticated (Subscriber+) Information Disclosure via Shortcode4.3 Medium
- formget contact form by formget, pankajagarwal contact form by formget – best form builder plugin for wordpress +1 moreContact Form by FormGet <= 5.5.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- speciesfilegroup taxonworksTaxonWorks SQL injection vulnerability6.5 Medium
- gomarkdown markdowngithub.com/gomarkdown/markdown Out-of-bounds Read while parsing citations7.5 High
- juplink rx4-1500, rx4-1500 firmware +1 moreJuplink RX4-1500 homemng.htm Command Injection Vulnerability8.0 High
- juplink rx4-1500, rx4-1500 firmware +1 moreJuplink RX4-1500 Command Injection Vulnerability8.0 High
- galaxyproject galaxyGalaxy vulnerable to Server Side Request Forgery during data imports6.3 Medium
- juplink rx4-1500, rx4-1500 firmware +1 moreJuplink RX4-1500 Credential Disclosure Vulnerability8.0 High
- aes-gcm project aes-gcm, rustcrypto aeads, fedoraproject fedora +2 moreAEADs/aes-gcm: Plaintext exposed in decrypt_in_place_detached even on tag verification failure4.7 Medium
- chewkeanho automataciAutomataCI Release Job Can Revert Repo to First Commit8.2 High
- github enterprise serverIncorrect comparison vulnerability in GitHub Enterprise Server leading to commit smuggling4.5 Medium
libredwgOSS-FuzzHeap-double-free in dwg_free_objectNo score- redhat single sign-on, red hat single sign-on 7, rhel-8 based middleware containers +4 more +6 moreRhsso-container-image: unsecured management interface exposed to adjecent network8.0 High
- theforeman foreman, red hat satellite 6, redhat satellite +2 moreOs command injection via ct_command and fcct_command8.0 High
- pgadmin, pgadmin 4, fedoraproject fedora +2 morePgadmin4: remote code execution by an authenticated user6.0 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreKernel: deadlock in ksmbd_find_crypto_ctx()5.9 Medium
- red hat enterprise linux 10, enterprise linux 6, enterprise linux 7 +2 more +4 moreKernel: ksmbd brute force delay bypass via asynchronous requests3.7 Low
- linux, linux kernel +1 moreksmbd: not allow guest user on multichannel9.1 Critical
- braekling connect matomo, matomoteam connect matomo – analytics dashboard for wordpress +1 moreWP-Matomo Integration (WP-Piwik) <= 1.0.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- david lingren media library assistantMedia Library Assistant <= 3.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- qnap multimedia consoleMultimedia Console8.1 High
- qnap qtsQTS8.1 High
- qnap qts, quts hero, qutscloud +2 moreQTS, QuTS hero, QuTScloud8.8 High
- plesk onyx** DISPUTED ** Plesk Onyx 17.8.11 has accessKeyId and secretAccessKey fields that are related to...7.5 High
- falktx cadenceCadence through 0.9.2 2023-08-21 uses an Insecure /tmp/cadence-wineasio.reg Temporary File. The...7.5 High
- falktx cadenceCadence through 0.9.2 2023-08-21 uses an Insecure /tmp/.cadence-aloop-daemon.x Temporary File....5.5 Medium
- mikebrady not quite ptpIn nqptp-message-handlers.c in nqptp before 1.2.3, crafted packets received on the control port...5.5 Medium
- debian linux, roundcube webmail +1 moreRoundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e...6.1 Medium
- f-secure atlant, client security, elements endpoint protection +4 more +6 moreCertain WithSecure products allow Denial of Service via the aepack archive unpack handler. This...7.5 High
- f-secure atlant, client security, elements endpoint protection +4 more +6 moreCertain WithSecure products allow Local privilege escalation via the lhz archive unpack handler....7.8 High
- f-secure atlant, client security, elements endpoint protection +4 more +6 moreCertain WithSecure products allow Denial of Service in the aeelf component. This affects...7.5 High
- withsecure f-secure policy managerCertain WithSecure products allow XSS via an unvalidated parameter in the endpoint. This affects...6.1 Medium
- withsecure policy manager proxy, f-secure policy manager +1 moreCertain WithSecure products allow Unauthenticated Remote Code Execution via the web server ...9.8 Critical
- f-secure atlant, client security, elements endpoint protection +4 more +6 moreCertain WithSecure products allow Denial of Service (infinite loop). This affects WithSecure...7.5 High
- f-secure atlant, client security, elements endpoint protection +4 more +6 moreCertain WithSecure products allow Denial of Service via a fuzzed PE32 file. This affects...7.5 High
- janobe online voting systemSQL injection vulnerability in janobe Online Voting System v.1.0 allows a remote attacker to...9.8 Critical
- online job portal project job portalSQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to...9.8 Critical
- online job portal project job portalSQL injection vulnerability in janobe Online Job Portal v.2020 allows a remote attacker to...9.8 Critical
- cesanta mjsCesanta mjs v2.20.0 was discovered to contain a function pointer hijacking vulnerability via the...9.8 Critical
- dst-admin project dst-admindst-admin v1.5.0 was discovered to contain a remote command execution (RCE) vulnerability via the...9.8 Critical
- projectworlds asset management system project in phpProjectworldsl Assets-management-system-in-php 1.0 is vulnerable to SQL Injection via the "id"...9.8 Critical
- d-link dir-806 1200m11ac, dlink dir-806 firmware +1 moreD-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection.9.8 Critical
- d-link dir-806 1200m11ac, dlink dir-806 firmware +1 moreD-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection...9.8 Critical
- jeecg bootSQL injection in jeecgboot9.8 Critical
- windriver vxworksAn issue was discovered in Wind River VxWorks 6.9 and 7. The function ``tarExtract`` implements...8.8 High
- delta electronics diascreenDelta Electronics DIAScreen Out-of-bounds Write7.8 High
- apple macos, ipad os, ipados +13 more +15 moreThe issue was addressed with improved checks. This issue is fixed in Safari 16.6.1, macOS Ventura...8.8 High
- apple ipados, macos, ios and ipados +2 more +4 moreThe issue was addressed with improved checks. This issue is fixed in iOS 16.7 and iPadOS 16.7, OS...7.8 High
- apple ipados, macos, ios and ipados +2 more +4 moreA certificate validation issue was addressed. This issue is fixed in iOS 16.7 and iPadOS 16.7, OS...5.5 Medium
- Show moreLoading…