CVEs published in October 2023
2,902 vulnerabilities, 370 critical, 18 exploited.
- apache airflowApache Airflow: Improper access control to DAG resources6.5 Medium
- apache airflowApache Airflow: Configuration information leakage vulnerability4.3 Medium
- apache airflowApache Airflow: Improper access control vulnerability in the "List dag warnings" feature6.5 Medium
- nrhirani node-qpdfnode-qpdf vulnerable to command injection7.3 High
- linux kernel, siemens ruggedcom rst2428p, scalance xc-300/xr-300/xc-400/xr-500wg/xr-500 family +2 more +4 moreAn issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access, an...6.4 Medium
- linux kernel, netapp active iq unified manager, h410c firmware +2 moreAn issue was discovered in drivers/usb/storage/ene_ub6250.c for the ENE UB6250 reader driver in...5.5 Medium
- qdpmqdPM 9.2 allows remote code execution by using the Add Attachments feature of Edit Project to...9.8 Critical
- qdpmqdPM 9.2 allows Directory Traversal to list files and directories by navigating to the /uploads URI.7.5 High
- smihica pyminizip, zlib, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 morepyminizip affected by zlib's integer overflow/heap based buffer overflow vulnerability due to vulnerable dependency9.8 Critical
- viessmann vitogate 300 firmwareIn Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass...9.8 Critical
- zpesystems nodegrid osAn issue in ZPE Systems, Inc Nodegrid OS v.5.8.10 thru v.5.8.13 and v.5.10.3 thru v.5.10.5 allows...7.5 High
- shoprunners aftermailMultiple improper neutralization of SQL parameters in module AfterMail (aftermailpresta) for...9.8 Critical
- store-opart multi html blockMultiple Stored Cross Site Scripting (XSS) vulnerabilities in Opart opartmultihtmlblock before...6.1 Medium
- farmbot farmbot-web-app, web app +1 moreSQL injection vulnerability in Farmbot-Web-App7.7 High
- zephyrproject zephyrUnchecked user input length in the Zephyr WiFi shell module7.6 High
- zephyrproject zephyrPotential buffer overflow vulnerability in the Zephyr IEEE 802.15.4 nRF 15.4 driver7.6 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability4.2 Medium
- qnap video stationVideo Station4.6 Medium
- qnap video stationVideo Station10.0 Critical
- qnap systems inc. qts, quts hero, qutscloud +1 more +3 moreQTS, QuTS hero, QuTScloud6.6 Medium
- qnap container stationContainer Station6.6 Medium
- qnap qts, quts hero, qutscloud +2 moreQTS, QuTS hero, QuTScloud7.5 High
- qnap qts, quts hero, qutscloud +2 moreQTS, QuTS hero, QuTScloud3.8 Low
- qnap qts, quts hero, qutscloud +2 moreQTS, QuTS hero, QuTScloud4.9 Medium
- hp thinupdateA potential security vulnerability has been identified in the HP ThinUpdate utility (also known...7.5 High
- hp inc. displays, hp e22 g4 fhd firmware, e23 g4 fhd firmware +27 more +29 moreA potential security vulnerability has been identified in certain HP Displays supporting the...3.3 Low
- hp t430 thin client firmware, t638 thin client firmware, hp inc. t430 and t638 thin clients +2 moreHP is aware of a potential security vulnerability in HP t430 and t638 Thin Client PCs. These...6.8 Medium
- ibm app connect enterpriseIBM App Connect Enterprise information disclosure4.4 Medium
- dotonpaper pinpoint booking system, pinpoint booking system +1 moreWordPress Pinpoint Booking System Plugin <= 2.9.9.4.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- automatededitor automated editorWordPress Automated Editor Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- coleds simple seoWordPress Simple SEO Plugin <= 2.0.25 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- hitsteps web analyticsWordPress Hitsteps Web Analytics Plugin <= 5.86 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- fortinet fortisandboxAn improper neutralization of input during web page generation ('cross-site scripting') in...3.4 Low
- fortinet fortisandboxA improper neutralization of input during web page generation ('cross-site scripting') in...7.3 High
- fortinet fortisandboxA improper neutralization of input during web page generation ('cross-site scripting') in...7.3 High
- fortinet fortisandboxA improper neutralization of input during web page generation ('cross-site scripting') in...7.3 High
- fortinet fortisandboxA improper limitation of a pathname to a restricted directory ('path traversal') in Fortinet...7.9 High
- sharkdropship irivyouWordPress IRivYou Plugin <= 2.2.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- fortinet fortiedrA insufficient session expiration in Fortinet FortiEDR version 5.0.0 through 5.0.1 allows...7.7 High
- myback.link whitepageWordPress WhitePage Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
jsignOSS-FuzzSecurity exception in net.jsign.bouncycastle.asn1.ASN1StreamParser.readVectorNo score- rockwell automation factorytalk linxRockwell Automation FactoryTalk Linx Vulnerable to Denial-of-Service and Information Disclosure8.2 High
- 1e platformBlind SQL vulnerability in 1E platform9.9 Critical
- embedcalendly embed calendly, turn2honey emc – easily embed calendly scheduling +1 moreEmbed Calendly <= 3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- hestiacp, hestiacp hestiacp/hestiacp +1 moreCross-site Scripting (XSS) - Stored in hestiacp/hestiacp3.2 Low
- froxlor, froxlor froxlor/froxlor +1 moreCross-site Scripting (XSS) - Stored in froxlor/froxlor4.3 Medium
- devolutions serverImproper access control in PAM propagation scripts in Devolutions Server 2023.2.8.0 and ealier...7.5 High
- parity frontierFrontier opcode SUICIDE touches too many storage values on large contracts7.5 High
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server has improper restriction of excessive authentication attempts on WebDAV endpoint5.0 Medium
- mailrelayWordPress Mailrelay Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- Show moreLoading…