Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: September 2023

84 records · 22 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2023-4708
    48Plan

    Infosoftbd Clcknshop GET Parameter all sql injection

    CriticalCVSS 9.8Proof of conceptEPSS 31%

    infosoftbd · clcknshopSep 1, 2023

  • CVE-2023-39361
    66This week

    Unauthenticated SQL Injection in graph_view.php in Cacti

    CriticalCVSS 9.8Proof of conceptEPSS 88%

    cacti · cactiSep 5, 2023

  • CVE-2023-39362
    54Plan

    Authenticated command injection in SNMP options of a Device

    HighCVSS 7.2Proof of conceptEPSS 85%

    cacti · cactiSep 5, 2023

  • CVE-2023-4762
    77This week

    Type Confusion in V8 in Google Chrome prior to 116.0.5845.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

    HighCVSS 8.8KEVWeaponizedEPSS 41%

    google · chromeSep 5, 2023

  • CVE-2023-35719
    34Monitor

    ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability

    MediumCVSS 6.8No exploitEPSS 24%

    zohocorp · manageengine adselfservice plusSep 6, 2023

  • CVE-2023-4634
    65This week

    Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution

    CriticalCVSS 9.8Proof of conceptEPSS 85%

    davidlingren · media library assistantSep 6, 2023

  • CVE-2023-37941
    40Plan

    Apache Superset: Metadata db write access can lead to remote code execution

    MediumCVSS 6.6WeaponizedEPSS 35%

    apache · supersetSep 6, 2023

  • CVE-2023-39265
    60This week

    Apache Superset: Possible Unauthorized Registration of SQLite Database Connections

    MediumCVSS 6.5WeaponizedEPSS 86%

    apache · supersetSep 6, 2023

  • CVE-2023-20238
    44Plan

    A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Se

    CriticalCVSS 9.8No exploitEPSS 15%

    cisco · broadworks application delivery platformSep 6, 2023

  • CVE-2023-20269
    74This week

    A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD

    CriticalCVSS 9.1KEVWeaponizedEPSS 25%

    cisco · adaptive security appliance softwareSep 6, 2023

  • CVE-2023-41061
    62This week

    A validation issue was addressed with improved logic.

    HighCVSS 7.8KEVWeaponizedEPSS 4%

    apple · ipadosSep 7, 2023

  • CVE-2023-41064
    77This week

    A buffer overflow issue was addressed with improved memory handling.

    HighCVSS 7.8KEVWeaponizedEPSS 53%

    apple · ipadosSep 7, 2023

  • CVE-2023-4528
    38Monitor

    JSCAPE MFT Server Unsafe Deserialization on Management Port

    HighCVSS 7.2No exploitEPSS 31%

    redwood · jscape mftSep 7, 2023

  • CVE-2023-39584
    40Plan

    Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability.

    HighCVSS 7.5No exploitEPSS 34%

    hexo · hexoSep 8, 2023

  • CVE-2023-4873
    46Plan

    Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform importexport.php os command injection

    CriticalCVSS 9.8No exploitEPSS 22%

    byzoro · smart s45f firmwareSep 9, 2023

  • CVE-2023-31068
    41Plan

    An issue was discovered in TSplus Remote Access through 16.0.2.14.

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    tsplus · tsplus remote workSep 11, 2023

  • CVE-2023-38743
    31Monitor

    Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine.

    HighCVSS 7.2Proof of conceptEPSS 11%

    zohocorp · manageengine admanager plusSep 11, 2023

  • CVE-2023-39780
    77This week

    On ASUS RT-AX55 3.0.0.4.386.51598 devices, authenticated attackers can perform OS command injection via the /start_apply.htm qos_bw_rulelist

    HighCVSS 8.8KEVWeaponizedEPSS 39%

    asus · rt-ax55 firmwareSep 11, 2023

  • CVE-2023-35674
    62This week

    In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code.

    HighCVSS 7.8KEVWeaponizedEPSS 2%

    google · androidSep 11, 2023

  • CVE-2023-41990
    61This week

    The issue was addressed with improved handling of caches.

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    apple · ipadosSep 11, 2023

  • CVE-2023-2071
    44Plan

    FactoryTalk View Machine Edition Vulnerable to Remote Code Execution

    CriticalCVSS 9.8No exploitEPSS 17%

    rockwellautomation · factorytalk viewSep 12, 2023

  • CVE-2023-4863
    95Now

    Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bo

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    google · chromeSep 12, 2023

  • CVE-2023-36744
    49Plan

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 8.0No exploitEPSS 57%

    microsoft · exchange serverSep 12, 2023

  • CVE-2023-36745
    56Plan

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 8.0Proof of conceptEPSS 79%

    microsoft · exchange serverSep 12, 2023

  • CVE-2023-36756
    47Plan

    Microsoft Exchange Server Remote Code Execution Vulnerability

    HighCVSS 8.0No exploitEPSS 49%

    microsoft · exchange serverSep 12, 2023

  • CVE-2023-36757
    43Plan

    Microsoft Exchange Server Spoofing Vulnerability

    HighCVSS 8.0No exploitEPSS 36%

    microsoft · exchange serverSep 12, 2023

  • CVE-2023-36761
    62This week

    Microsoft Word Information Disclosure Vulnerability

    MediumCVSS 6.5KEVWeaponizedEPSS 19%

    microsoft · 365 appsSep 12, 2023

  • CVE-2023-36777
    38Monitor

    Microsoft Exchange Server Information Disclosure Vulnerability

    MediumCVSS 5.7No exploitEPSS 52%

    microsoft · exchange serverSep 12, 2023

  • CVE-2023-36802
    69This week

    Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 27%

    microsoft · windows 10 1809Sep 12, 2023

  • CVE-2023-38146
    60This week

    Windows Themes Remote Code Execution Vulnerability

    HighCVSS 8.8WeaponizedEPSS 37%

    microsoft · windows 11 21h2Sep 12, 2023

  • CVE-2023-38152
    28Monitor

    DHCP Server Service Information Disclosure Vulnerability

    MediumCVSS 5.3No exploitEPSS 24%

    microsoft · windows server 2008Sep 12, 2023

  • CVE-2023-38162
    33Monitor

    DHCP Server Service Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 10%

    microsoft · windows server 2012Sep 12, 2023

  • CVE-2023-3710
    54Plan

    Printer web page invalid command execution

    CriticalCVSS 9.8Proof of conceptEPSS 49%

    honeywell · pm43 firmwareSep 12, 2023

  • CVE-2023-26369
    63This week

    [Google Project Zero] Adobe Acrobat DC OOBW 0-day actively exploited in the wild

    HighCVSS 7.8KEVWeaponizedEPSS 6%

    adobe · acrobatSep 13, 2023

  • CVE-2023-41892
    67This week

    Craft CMS Remote Code Execution vulnerability

    CriticalCVSS 9.8WeaponizedEPSS 94%

    craftcms · craft cmsSep 13, 2023

  • CVE-2023-38204
    59Plan

    Bypass APSB23-41 (CVE-2023-38203) - Pre-Auth RCE ColdFusion 2021 Update 8

    CriticalCVSS 9.8No exploitEPSS 66%

    adobe · coldfusionSep 14, 2023

  • CVE-2023-38205
    90Now

    ColdFusion Bypass - Vulnerability disclosure in ColdFusion | BYPASS CVE-2023-29298

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    adobe · coldfusionSep 14, 2023

  • CVE-2023-38039
    47Plan

    When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.

    HighCVSS 7.5Proof of conceptEPSS 58%

    haxx · curlSep 15, 2023

  • CVE-2023-32461
    26Monitor

    Dell PowerEdge BIOS and Dell Precision BIOS contain a buffer overflow vulnerability.

    MediumCVSS 6.7No exploitEPSS 0%

    dell · poweredge r660 firmwareSep 15, 2023

  • CVE-2023-41887
    52Plan

    Remote Code exec in project import with mysql jdbc url attack

    CriticalCVSS 9.8No exploitEPSS 42%

    openrefine · openrefineSep 15, 2023

  • CVE-2023-42442
    40Plan

    JumpServer session replays download without authentication

    MediumCVSS 5.3Proof of conceptEPSS 63%

    fit2cloud · jumpserverSep 15, 2023

  • CVE-2023-33831
    47Plan

    A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands

    CriticalCVSS 9.8Proof of conceptEPSS 25%

    frangoteam · fuxaSep 18, 2023

  • CVE-2023-41599
    25Monitor

    An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal.

    MediumCVSS 5.3Proof of conceptEPSS 12%

    jfinalcms project · jfinalcmsSep 18, 2023

  • CVE-2023-41179
    59Plan

    A vulnerability in the 3rd party AV uninstaller module contained in Trend Micro Apex One (on-prem and SaaS), Worry-Free Business Security an

    HighCVSS 7.2KEVWeaponizedEPSS 4%

    trendmicro · apex oneSep 19, 2023

  • CVE-2023-22513
    40Plan

    This High severity RCE (Remote Code Execution) vulnerability was introduced in version 8.0.0 of Bitbucket Data Center and Server.

    HighCVSS 8.8No exploitEPSS 15%

    atlassian · bitbucket data centerSep 19, 2023

  • CVE-2023-42793
    99Now

    In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    jetbrains · teamcitySep 19, 2023

  • CVE-2023-40931
    30Monitor

    A SQL injection vulnerability in Nagios XI from version 5.11.0 up to and including 5.11.1 allows authenticated attackers to execute arbitrar

    MediumCVSS 6.5Proof of conceptEPSS 11%

    nagios · nagios xiSep 19, 2023

  • CVE-2023-38886
    38Monitor

    An issue in Dolibarr ERP CRM v.17.0.1 and before allows a remote privileged attacker to execute arbitrary code via a crafted command/script.

    HighCVSS 7.2No exploitEPSS 31%

    dolibarr · dolibarr erp\/crmSep 19, 2023

  • CVE-2023-43477
    40Plan

    Post-Auth Command Injection in Telstra Smart Modem Gen 2 (Arcadyan LH1000)

    HighCVSS 8.8No exploitEPSS 17%

    telstra · arcadyan lh1000 firmwareSep 20, 2023

  • CVE-2023-43478
    44Plan

    Unauthenticated configuration restore and firmware update

    CriticalCVSS 9.8No exploitEPSS 17%

    telstra · arcadyan lh1000 firmwareSep 20, 2023

  • CVE-2023-5074
    60This week

    Authentication Bypass in D-Link D-View 8

    CriticalCVSS 9.8Proof of conceptEPSS 69%

    dlink · d-view 8Sep 20, 2023

  • CVE-2023-39677
    40Plan

    MyPrestaModules Prestashop Module v6.2.9 and UpdateProducts Prestashop Module v3.6.9 were discovered to contain a PHPInfo information disclo

    HighCVSS 7.5Proof of conceptEPSS 32%

    myprestamodules · product catalog \(csv\, excel\) importSep 20, 2023

  • CVE-2023-43237
    43Plan

    D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter macCloneMac in setMAC.

    CriticalCVSS 9.8No exploitEPSS 13%

    dlink · dir-816 a2 firmwareSep 21, 2023

  • CVE-2023-43239
    43Plan

    D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter flag_5G in showMACfilterMAC.

    CriticalCVSS 9.8No exploitEPSS 13%

    dlink · dir-816 a2 firmwareSep 21, 2023

  • CVE-2023-43240
    43Plan

    D-Link DIR-816 A2 v1.10CNB05 was discovered to contain a stack overflow via parameter sip_address in ipportFilter.

    CriticalCVSS 9.8No exploitEPSS 13%

    dlink · dir-816 a2 firmwareSep 21, 2023

  • CVE-2023-41991
    56Plan

    A certificate validation issue was addressed.

    MediumCVSS 5.5KEVWeaponizedEPSS 13%

    apple · ipadosSep 21, 2023

  • CVE-2023-41992
    64This week

    The issue was addressed with improved checks.

    HighCVSS 7.8KEVWeaponizedEPSS 9%

    apple · ipadosSep 21, 2023

  • CVE-2023-41993
    72This week

    The issue was addressed with improved checks.

    HighCVSS 8.8KEVWeaponizedEPSS 24%

    apple · ipadosSep 21, 2023

  • CVE-2023-31719
    47Plan

    FUXA <= 1.1.12 is vulnerable to SQL Injection via /api/signin.

    CriticalCVSS 9.8Proof of conceptEPSS 26%

    frangoteam · fuxaSep 21, 2023

  • CVE-2023-43770
    73This week

    Roundcube before 1.4.14, 1.5.x before 1.5.4, and 1.6.x before 1.6.3 allows XSS via text/plain e-mail messages with crafted links because of

    MediumCVSS 6.1KEVWeaponizedEPSS 63%

    roundcube · webmailSep 22, 2023

  • CVE-2023-5145
    45Plan

    D-Link DAR-7000 licence.php unrestricted upload

    HighCVSS 8.8No exploitEPSS 34%

    dlink · dar-7000 firmwareSep 24, 2023

  • CVE-2023-5146
    45Plan

    D-Link DAR-7000/DAR-8000 updatelib.php unrestricted upload

    HighCVSS 8.8No exploitEPSS 32%

    dlink · dar-7000 firmwareSep 24, 2023

  • CVE-2023-5147
    43Plan

    D-Link DAR-7000 updateos.php unrestricted upload

    HighCVSS 8.8No exploitEPSS 26%

    dlink · dar-7000 firmwareSep 24, 2023

  • CVE-2023-5148
    44Plan

    D-Link DAR-7000/DAR-8000 uploadfile.php unrestricted upload

    HighCVSS 8.8No exploitEPSS 30%

    dlink · dar-7000 firmwareSep 24, 2023

  • CVE-2023-5149
    41Plan

    D-Link DAR-7000 userattestation.php unrestricted upload

    HighCVSS 8.8No exploitEPSS 20%

    dlink · dar-7000 firmwareSep 24, 2023

  • CVE-2023-5150
    42Plan

    D-Link DAR-7000/DAR-8000 web.php unrestricted upload

    HighCVSS 8.8No exploitEPSS 22%

    dlink · dar-7000 firmwareSep 24, 2023

  • CVE-2023-5151
    59Plan

    D-Link DAR-8000 autheditpwd.php sql injection

    HighCVSS 8.8No exploitEPSS 80%

    dlink · dar-8000 firmwareSep 24, 2023

  • CVE-2023-5154
    40Plan

    D-Link DAR-8000 changelogo.php unrestricted upload

    HighCVSS 8.8No exploitEPSS 15%

    dlink · dar-8000 firmwareSep 24, 2023

  • CVE-2023-4521
    51Plan

    Import XML and RSS Feeds < 2.1.5 - Unauthenticated RCE

    CriticalCVSS 9.8Proof of conceptEPSS 40%

    mooveagency · import xml and rss feedsSep 25, 2023

  • CVE-2023-36851
    60This week

    Junos OS: SRX Series: A vulnerability in J-Web allows an unauthenticated attacker to upload and download arbitrary files

    MediumCVSS 5.3KEVWeaponizedEPSS 1%

    juniper · junosSep 27, 2023

  • CVE-2023-40044
    92Now

    WS_FTP Server Ad Hoc Transfer Module .NET Deserialization Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 90%

    progress · ws ftp serverSep 27, 2023

  • CVE-2023-41320
    50Plan

    Account takeover via SQL Injection in UI layout preferences in GLPI

    CriticalCVSS 9.8No exploitEPSS 36%

    glpi-project · glpiSep 27, 2023

  • CVE-2023-41323
    31Monitor

    Users login enumeration by unauthenticated user in GLPI

    MediumCVSS 5.3No exploitEPSS 33%

    glpi-project · glpiSep 27, 2023

  • CVE-2023-41326
    46Plan

    Account takeover via Kanban feature in GLPI

    HighCVSS 8.8No exploitEPSS 36%

    glpi-project · glpiSep 27, 2023

  • CVE-2023-42657
    43Plan

    WS_FTP Server Directory Traversal

    CriticalCVSS 9.6No exploitEPSS 16%

    progress · ws ftp serverSep 27, 2023

  • CVE-2023-43187
    53Plan

    A remote code execution (RCE) vulnerability in the xmlrpc.php endpoint of NodeBB Inc NodeBB forum software prior to v1.18.6 allows attackers

    CriticalCVSS 9.8Proof of conceptEPSS 47%

    nodebb · nodebbSep 27, 2023

  • CVE-2023-44018
    44Plan

    Tenda AC10U v1.0 US_AC10UV1.0RTL_V15.03.06.49_multi_TDE01 was discovered to contain a stack overflow via the domain parameter in the add_whi

    CriticalCVSS 9.8No exploitEPSS 15%

    tendacn · ac10u firmwareSep 27, 2023

  • CVE-2023-5222
    63This week

    Viessmann Vitogate 300 Web Management Interface vitogate.cgi isValidUser hard-coded password

    CriticalCVSS 9.8Proof of conceptEPSS 80%

    viessmann · vitogate 300 firmwareSep 27, 2023

  • CVE-2023-20109
    57Plan

    A vulnerability in the Cisco Group Encrypted Transport VPN (GET VPN) feature of Cisco IOS Software and Cisco IOS XE Software could allow an

    MediumCVSS 6.6KEVWeaponizedEPSS 2%

    cisco · iosSep 27, 2023

  • CVE-2023-38874
    44Plan

    A remote code execution (RCE) vulnerability via an insecure file upload exists in gugoan's Economizzer v.0.9-beta1 and commit 3730880 (April

    HighCVSS 8.8No exploitEPSS 31%

    economizzer · economizzerSep 28, 2023

  • CVE-2023-5217
    80Now

    Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to poten

    HighCVSS 8.8KEVWeaponizedEPSS 49%

    google · chromeSep 28, 2023

  • CVE-2023-43654
    60This week

    TorchServe Server-Side Request Forgery

    CriticalCVSS 9.8WeaponizedEPSS 42%

    pytorch · torchserveSep 28, 2023

  • CVE-2023-30591
    48Plan

    NodeBB Pre-Authentication Denial-of-Service

    HighCVSS 7.5No exploitEPSS 58%

    nodebb · nodebbSep 29, 2023

  • CVE-2023-44466
    49Plan

    An issue was discovered in net/ceph/messenger_v2.c in the Linux kernel before 6.4.5.

    HighCVSS 8.8No exploitEPSS 45%

    linux · linux kernelSep 29, 2023