CVEs published in October 2023
2,902 vulnerabilities, 370 critical, 18 exploited.
- remyandrade file manager appSourceCodester File Manager App add-file.php unrestricted upload6.3 Medium
- dragon path 707gr1, airtel dragon path 707gr1 firmware, dragonpath router 707gr1 firmware +2 moreDragon Path 707GR1 Ping Diagnostics cross site scripting2.4 Low
- longmenedutech score query systemShaanxi Chanming Education Technology Score Query System sql injection7.3 High
- geoserver geowebcacheGeoServer GeoWebCache rest.html direct request5.3 Medium
- netentsec application security gateway, ns-asg application security gateway +1 moreNetentsec NS-ASG Application Security Gateway addaddress_interpret.php sql injection5.5 Medium
- browserify browserify-sign, debian linux +1 morebrowserify-sign vulnerable via an upper bound check issue in `dsaVerify` that leads to a signature forgery attack6.5 Medium
- netentsec application security gateway, ns-asg application security gateway +1 moreNetentsec NS-ASG Application Security Gateway uploadfirewall.php sql injection5.5 Medium
- zitadelXSS with User Avatar image in ZITADEL8.7 High
- tongda oa 2017, tongda2000 tongda office anywhere +1 moreTongda OA 2017 delete.php sql injection6.3 Medium
- tongda oa 2017, tongda2000 tongda office anywhere +1 moreTongda OA 2017 General News delete_query.php sql injection5.5 Medium
- web-dorado wdsocialwidgetsWordPress Spider Facebook Plugin <= 1.0.15 is vulnerable to Cross Site Scripting (XSS)7.1 High
- silabs.com ember znet sdk, silabs emberznet sdk +1 moreKeys Stored in Plaintext on Secure Vault High for Silabs Ember ZNet devices6.8 Medium
- silabs openthread sdkKeys Stored in Plaintext on Secure Vault High for Silabs OpenThread devices6.8 Medium
igraphOSS-FuzzSegv on unknown address in igraph_strvector_set_lenNo scoreigraphOSS-FuzzHeap-use-after-free in igraph_pajek_yyparseNo scoreopenscOSS-FuzzHeap-buffer-overflow in iasecc_parse_sizeNo scorelinuxUbuntu,linux-lowlatencyUbuntu +1 morelinux, linux-lowlatency vulnerabilitiesNo score- tongda oa 2017, tongda2000 tongda office anywhere +1 moreTongda OA 2017 delete_webmail.php DELETE_STR sql injection6.3 Medium
- mammothology wp full stripe freeWordPress WP Full Stripe Free Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- conversios track google analytics 4, facebook pixel & conversions api via google tag manager for woocommerce, google analytics integration for woocommerce +1 moreWordPress Conversios.io Plugin <= 6.5.3 is vulnerable to Cross Site Scripting (XSS)7.1 High
- totalpress custom post types, totalpress.org custom post types, custom fields & more +1 moreWordPress Custom post types Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- lava-code lava directory managerWordPress Lava Directory Manager Plugin <= 1.1.34 is vulnerable to Cross Site Scripting (XSS)7.1 High
- arrow plugins the awesome feed – custom feed, arrowplugins the awesome feed +1 moreWordPress The Awesome Feed – Custom Feed Plugin <= 2.2.5 is vulnerable to Cross Site Scripting (XSS)7.1 High
- edgarrojas woocommerce pdf invoice builder, create invoices, packing slips and more, rednao woocommerce pdf invoice builder +1 moreWordPress WooCommerce PDF Invoice Builder Plugin <= 1.2.102 is vulnerable to Cross Site Scripting (XSS)7.1 High
- wpdevart contact form builder, contact widget, contact form builder +1 moreWordPress Contact Form Builder, Contact Widget Plugin <= 2.1.6 is vulnerable to Cross Site Scripting (XSS)7.1 High
- tongda oa 2017, tongda2000 tongda office anywhere +1 moreTongda OA 2017 delete.php sql injection7.3 High
- vark minimum purchase for woocommerceWordPress Minimum Purchase for WooCommerce Plugin <= 2.0.0.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- borbis freshmail for wordpressWordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Scripting (XSS)5.8 Medium
- mihai iova wordpress knowledge base & documentation plugin – wp knowledgebase, wpknowledgebase wp knowledgebase +1 moreWordPress WP Knowledgebase Plugin <= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- add shortcodes actions and filters project shortcodes actions and filters, michael simpson add shortcodes actions and filters +1 moreWordPress Add Shortcodes Actions And Filters Plugin <= 2.0.9 is vulnerable to Cross Site Scripting (XSS)7.1 High
dbusTuxCare,dbus-1-docTuxCare,dbus-testsTuxCare +4 more +6 moreFix CVE(s): CVE-2023-34969, CVE-2020-34969No score- brent jett assistantAssistant < 1.4.4 - Editor+ SSRF8.8 High
- zephyrproject zephyrPotential buffer overflow vulnerability in the Zephyr STM32 Crypto driver4.4 Medium
- elastic apm server, beats, agent +1 more +3 moreBeats, Elastic Agent, APM Server, and Fleet Server Improper Certificate Validation issue5.9 Medium
- elastic kibanaKibana Insertion of Sensitive Information into Log File9.0 Critical
- elastic fleet serverFleet Server Insertion of Sensitive Information into Log File8.1 High
- obl.ong adminThe admin panel for Obl.ong before 1.1.2 allows authorization bypass because the email OTP...5.3 Medium
- frroutingAn issue was discovered in FRRouting FRR through 9.0.1. A crash can occur for a crafted BGP...5.9 Medium
- frroutingAn issue was discovered in FRRouting FRR through 9.0.1. It mishandles malformed MP_REACH_NLRI...5.9 Medium
- zentao bizZenTao Biz version 4.1.3 and before has a Cross Site Scripting (XSS) vulnerability in the Version...6.1 Medium
- mayurik inventory management systemSourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site...5.4 Medium
- mayurik inventory management systemSourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect...8.8 High
- oretnom23 packers and movers management systemSourcecodester Packers and Movers Management System v1.0 is vulnerable to SQL Injection via mpms/...9.8 Critical
- zentao bizZenTao Enterprise Edition version 4.1.3 and before is vulnerable to Cross Site Scripting (XSS).6.1 Medium
- iliasILIAS 7.25 (2023-09-12) allows any authenticated user to execute arbitrary operating system...9.0 Critical
- iliasThe Learning Module in ILIAS 7.25 (2023-09-12 release) allows an attacker (with basic user...8.1 High
- iliasILIAS (2013-09-12 release) contains a medium-criticality Directory Traversal local file inclusion...6.5 Medium
- cmsmadesimple cms made simpleAn issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a...7.8 High
- nextgen mirth connectNextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote...9.8 Critical
- d-link dar-7000, dlink dar-7000 firmware +1 moreSQL injection vulnerability in D-Link Online behavior audit gateway DAR-7000 V31R02B1413C allows...9.8 Critical
- Show moreLoading…