CVEs published in October 2023
2,902 vulnerabilities, 370 critical, 18 exploited.
- huawei emui, harmonyos +1 moreAPI permission management vulnerability in the Fwk-Display module.Successful exploitation of this...9.8 Critical
- huawei emui, harmonyos +1 moreBroadcast permission control vulnerability in the Bluetooth module.Successful exploitation of...7.5 High
- huawei emui, harmonyos +1 moreOut-of-bounds read vulnerability in the Bluetooth module.Successful exploitation of this...7.5 High
- huawei emui, harmonyos +1 moreBroadcast permission control vulnerability in the Bluetooth module.Successful exploitation of...5.3 Medium
- adobe photoshop desktop, photoshop 2022, photoshop 2023 +1 more +3 moreZDI-CAN-21257: Adobe Photoshop PSD File Parsing Uninitialized Variable Remote Code Execution Vulnerability7.8 High
- huawei harmonyosThe Bluetooth module has a vulnerability in permission control for broadcast notifications...7.5 High
- huawei emui, harmonyos +1 moreBroadcast permission control vulnerability in the Bluetooth module.Successful exploitation of...7.5 High
- huawei emui, harmonyos +1 moreVulnerability of the permission to access device SNs being improperly managed.Successful...7.5 High
- huawei emui, harmonyos +1 moreUse-After-Free (UAF) vulnerability in the surfaceflinger module.Successful exploitation of this...7.5 High
- adobe bridgeZDI-CAN-21403: Adobe Bridge Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability5.5 Medium
- adobe bridgeZDI-CAN-21404: Adobe Bridge Font Parsing Use-After-Free Information Disclosure Vulnerability5.5 Medium
- huawei emui, harmonyos +1 moreType confusion vulnerability in the distributed file module.Successful exploitation of this...5.3 Medium
- huawei emui, harmonyos +1 moreClone vulnerability in the huks ta module.Successful exploitation of this vulnerability may...7.5 High
- huawei emui, harmonyos +1 moreVulnerability of brute-force attacks on the device authentication module.Successful exploitation...7.5 High
- huawei emui, harmonyos +1 moreVulnerability of package names' public keys not being verified in the security module.Successful...7.5 High
- unknown wordpress file sharing pluginWordPress File Sharing Plugin < 2.0.5 - Subscriber+ Sensitive Data and Files Exposure via IDOR4.3 Medium
- keyence kv replay viewer, kv studio +1 moreOut-of-bounds read vulnerability exists in KV STUDIO Ver. 11.62 and earlier and KV REPLAY VIEWER...7.8 High
- nitin rathod wp forms puzzle captchaWordPress WP Forms Puzzle Captcha Plugin <= 4.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- mcl technologies mcl-net, espeak-ng espeak ng, mcl-collection mcl-net firmware +2 moreDirectory traversal vulnerability in MCL-Net versions prior to 4.6 Update Package (P01) may allow...8.3 High
- xiaomi router, mi xiaomi router ax3200 firmware +1 moreXiaomi Router external request interface vulnerability leads to stack overflow7.5 High
- hcl software bigfix platform, apache xerces-c\+\+, fedoraproject fedora +2 moreHCL BigFix Platform is vulnerable to an integer overflow in xerces-c++ 3.2.38.2 High
- xiaomi router, mi xiaomi router ax3200 firmware +1 moreXiaomi Router administration interface vulnerability leads command injection and stack overflow6.7 Medium
- xiaomi router, mi xiaomi router ax3200 firmware +1 moreXiaomi router web interface post-authorization stack overflow6.7 Medium
- hcl software bigfix insights for vulnerability remediationHCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to weak cryptography6.5 Medium
- hcl software bigfix insights for vulnerability remediationHCL BigFix Insights for Vulnerability Remediation (IVR) is vulnerable to improper credential handling6.5 Medium
- hcl software bigfix patch managementHCL BigFix Patch Management is vulnerable to insecurely stored credentials4.6 Medium
firefoxUbuntufirefox regressionsNo score- micro research ltd. mr-gm2, mr-gm3 (-d/-k/-s/-dk/-dks/-m/-w), mrl mr-gm2 firmware +6 more +8 moreUse of default credentials vulnerability in MR-GM2 firmware Ver. 3.00.03 and earlier, and MR-GM3 ...4.3 Medium
- digital agency e-gov client application (macos version), e-gov client application (windows version), e-gov +2 moree-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application...4.3 Medium
- snipe snipe/snipe-it, snipeitapp snipe-it +1 moreCross-Site Request Forgery (CSRF) in snipe/snipe-it6.3 Medium
- elenos etg150 fm, etg150 firmware +1 moreAn Insecure Direct Object Reference (IDOR) vulnerability leads to events profiles access in...6.5 Medium
- koha-community koha library softwareFile Upload vulnerability in Koha Library Software 23.05.04 and before allows a remote attacker...5.3 Medium
- koha-community koha library softwareSQL Injection vulnerability in Koha Library Software 23.0.5.04 and before allows a remote...7.5 High
- d-link dph-400se fru, dlink dph-400se firmware +1 moreAn issue in DLINK DPH-400SE FRU 2.2.15.8 allows a remote attacker to escalate privileges via the...8.8 High
- samba, fedoraproject fedora, red hat enterprise linux 6 +12 more +14 moreSamba: smbd allows client access to unix domain sockets on the file system as root9.1 Critical
- echo anti cheat toolAn issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via...7.8 High
- curl, haxx libcurl, siemens ruggedcom ape1808 +3 more +5 moreThis flaw allows an attacker to insert cookies at will into a running program using libcurl, if...3.7 Low
- curl, fedoraproject fedora, haxx libcurl +15 more +17 moreThis flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is...9.8 Critical
- linux, linux kernel, xen +2 morePossible deadlock in Linux kernel event handling4.9 Medium
- nettyNetty: Memory Leak in DNS Record Decoder via Malformed Domain Names5.3 Medium
- nettyNetty: Denial of Service in XmlFrameDecoder via CPU Exhaustion7.5 High
- nettyNetty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder5.7 Medium
- nettyNetty: STOMP CONNECT Frame Header Injection6.5 Medium
- nettyNetty: HAProxy V1 Protocol CRLF Injection via AF_UNIX Address5.5 Medium
- nettyNetty Bzip2Decoder: Infinite Loop in RLE State Machine Leads to Event-Loop Thread Hang8.7 High
- nettyNetty codec-http2: Lack of Host Header Deduplication in HTTP/2→HTTP/1.x Translation Leads to Request Routing Bypass6.9 Medium
- nettyNetty HttpContentEncoder: Unbounded Per-Connection Queue Growth via HTTP/1.1 Pipelining Leads to Denial of Service6.9 Medium
- nettyNetty: WebSockets V07/V08 handshaker missing Connection/Upgrade validation6.3 Medium
- nettyNetty: TOCTOU in OcspServerCertificateValidator7.4 High
- nettyNetty: Out-of-date OCSP Responses Accepted by OcspServerCertificateValidator7.4 High
- Show moreLoading…