Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: October 2023

118 records · 19 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2023-5322
    40Plan

    D-Link DAR-7000 edit_manageadmin.php sql injection

    HighCVSS 8.8No exploitEPSS 16%

    dlink · dar-7000 firmwareOct 1, 2023

  • CVE-2023-4211
    52Plan

    Mali GPU Kernel Driver Allows Improper GPU Memory Processing Operations

    MediumCVSS 5.5KEVWeaponizedEPSS 1%

    arm · 5th gen gpu architecture kernel driverOct 1, 2023

  • CVE-2023-5350
    60This week

    SQL Injection in salesagility/suitecrm

    CriticalCVSS 9.1WeaponizedEPSS 2%

    salesagility · suitecrmOct 3, 2023

  • CVE-2023-44974
    45Plan

    An arbitrary file upload vulnerability in the component /admin/plugin.php of Emlog Pro v2.2.0 allows attackers to execute arbitrary code via

    CriticalCVSS 9.8No exploitEPSS 20%

    emlog · emlogOct 3, 2023

  • CVE-2023-4911
    80Now

    Glibc: buffer overflow in ld.so leading to privilege escalation

    HighCVSS 7.8KEVWeaponizedEPSS 63%

    gnu · glibcOct 3, 2023

  • CVE-2023-5375
    34Monitor

    Open Redirect in mosparo/mosparo

    MediumCVSS 6.1Proof of conceptEPSS 34%

    mosparo · mosparoOct 4, 2023

  • CVE-2023-43261
    49Plan

    An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components

    HighCVSS 7.5Proof of conceptEPSS 63%

    milesight · ur5x firmwareOct 4, 2023

  • CVE-2023-22515
    99Now

    Atlassian has been made aware of an issue reported by a handful of customers where external attackers may have exploited a previously unknow

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    atlassian · confluence data centerOct 4, 2023

  • CVE-2023-27121
    31Monitor

    A cross-site scripting (XSS) vulnerability in the component /framework/cron/action/humanize of Pleasant Solutions Pleasant Password Server v

    MediumCVSS 6.1No exploitEPSS 22%

    pleasantsolutions · pleasant password serverOct 4, 2023

  • CVE-2023-42824
    61This week

    The issue was addressed with improved checks.

    HighCVSS 7.8KEVWeaponizedEPSS 0%

    apple · ipadosOct 4, 2023

  • CVE-2023-5399
    50Plan

    A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause tamperin

    CriticalCVSS 9.8No exploitEPSS 35%

    schneider-electric · spacelogic c-bus toolkitOct 4, 2023

  • CVE-2023-44386
    21Monitor

    Incorrect request error handling triggers server crash in Vapor

    MediumCVSS 5.3No exploitEPSS 0%

    vapor · vaporOct 5, 2023

  • CVE-2023-44860
    37Monitor

    An issue in NETIS SYSTEMS N3Mv2 v.1.0.1.865 allows a remote attacker to cause a denial of service via the authorization component in the HTT

    HighCVSS 7.5No exploitEPSS 22%

    netis-systems · n3m firmwareOct 6, 2023

  • CVE-2023-45363
    37Monitor

    An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.

    HighCVSS 7.5No exploitEPSS 23%

    mediawiki · mediawikiOct 9, 2023

  • CVE-2023-43641
    40Plan

    libcue vulnerable to out-of-bounds array access

    HighCVSS 8.8No exploitEPSS 17%

    lipnitsk · libcueOct 9, 2023

  • CVE-2023-44959
    42Plan

    An issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP Ad

    HighCVSS 8.8No exploitEPSS 22%

    dlink · dsl-3782 firmwareOct 9, 2023

  • CVE-2023-44487
    90Now

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    siemens · simatic s7-1500 cpu 1518f-4 pn\/dp mfp firmwareOct 10, 2023

  • CVE-2023-4966
    90Now

    Unauthenticated sensitive information disclosure

    HighCVSS 7.5KEVWeaponizedEPSS 99%

    citrix · netscaler application delivery controllerOct 10, 2023

  • CVE-2023-30803
    45Plan

    Sangfor Next-Gen Application Firewall Authentication Bypass

    CriticalCVSS 9.8No exploitEPSS 20%

    sangfor · next-gen application firewallOct 10, 2023

  • CVE-2023-30805
    58Plan

    Sangfor Next-Gen Application Firewall Login Un Param Command Injection

    CriticalCVSS 9.8No exploitEPSS 64%

    sangfor · next-gen application firewallOct 10, 2023

  • CVE-2023-30806
    58Plan

    Sangfor Next-Gen Application Firewall PHPSESSID Command Injection

    CriticalCVSS 9.8No exploitEPSS 64%

    sangfor · next-gen application firewallOct 10, 2023

  • CVE-2023-34992
    64This week

    A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to e

    CriticalCVSS 9.8Proof of conceptEPSS 81%

    fortinet · fortisiemOct 10, 2023

  • CVE-2023-34993
    45Plan

    A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.

    CriticalCVSS 9.8Proof of conceptEPSS 21%

    fortinet · fortiwlmOct 10, 2023

  • CVE-2023-36563
    58Plan

    Microsoft WordPad Information Disclosure Vulnerability

    MediumCVSS 5.5KEVWeaponizedEPSS 20%

    microsoft · windows 10 1507Oct 10, 2023

  • CVE-2023-36584
    60This week

    Windows Mark of the Web Security Feature Bypass Vulnerability

    MediumCVSS 5.4KEVWeaponizedEPSS 3%

    microsoft · windows 10 1507Oct 10, 2023

  • CVE-2023-36606
    51Plan

    Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 69%

    microsoft · windows 10Oct 10, 2023

  • CVE-2023-38171
    51Plan

    Microsoft QUIC Denial of Service Vulnerability

    HighCVSS 7.5No exploitEPSS 71%

    microsoft · .netOct 10, 2023

  • CVE-2023-41763
    78This week

    Skype for Business Elevation of Privilege Vulnerability

    MediumCVSS 5.3KEVWeaponizedEPSS 90%

    microsoft · skype for business serverOct 10, 2023

  • CVE-2023-41772
    35Monitor

    Win32k Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 13%

    microsoft · windows 10 1809Oct 10, 2023

  • CVE-2023-30804
    39Monitor

    Sangfor Next-Gen Application Firewall Authenticated File Disclosure

    MediumCVSS 6.9No exploitEPSS 38%

    sangfor · next-gen application firewallOct 10, 2023

  • CVE-2023-32645
    56Plan

    A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108.

    CriticalCVSS 9.8No exploitEPSS 55%

    yifanwireless · yf325 firmwareOct 11, 2023

  • CVE-2023-43661
    50Plan

    Cachet vulnerable to Authenticated Remote Code Execution

    HighCVSS 8.8No exploitEPSS 51%

    all-three · cachetOct 11, 2023

  • CVE-2023-45138
    60This week

    Change Request Application vulnerable to XSS and remote code execution through change request title

    CriticalCVSS 9.6No exploitEPSS 71%

    xwiki · change requestOct 12, 2023

  • CVE-2023-29464
    40Plan

    Rockwell Automation FactoryTalk Linx Vulnerable to Denial-of-Service and Information Disclosure

    CriticalCVSS 9.1No exploitEPSS 14%

    rockwellautomation · factorytalk linxOct 13, 2023

  • CVE-2023-45852
    44Plan

    In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands vi

    CriticalCVSS 9.8Proof of conceptEPSS 15%

    viessmann · vitogate 300 firmwareOct 13, 2023

  • CVE-2023-5591
    33Monitor

    SQL Injection in librenms/librenms

    MediumCVSS 6.5No exploitEPSS 23%

    librenms · librenmsOct 15, 2023

  • CVE-2023-20198
    100Now

    Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software.

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    cisco · ios xeOct 16, 2023

  • CVE-2023-5003
    38Monitor

    Active Directory Integration < 4.1.10 - Unauthenticated Log Disclosure

    HighCVSS 7.5Proof of conceptEPSS 26%

    miniorange · active directory integration \/ ldap integrationOct 16, 2023

  • CVE-2023-45375
    47Plan

    In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `Pire

    HighCVSS 8.8Proof of conceptEPSS 41%

    01generator · pireospayOct 17, 2023

  • CVE-2023-44693
    43Plan

    D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php.

    CriticalCVSS 9.8No exploitEPSS 14%

    dlink · dar-7000 firmwareOct 17, 2023

  • CVE-2023-39456
    47Plan

    Apache Traffic Server: Malformed http/2 frames can cause an abort

    HighCVSS 7.5No exploitEPSS 58%

    apache · traffic serverOct 17, 2023

  • CVE-2023-38545
    63This week

    This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake.

    CriticalCVSS 9.8Proof of conceptEPSS 78%

    haxx · libcurlOct 18, 2023

  • CVE-2023-45727
    61This week

    Proself Enterprise/Standard Edition Ver5.62 and earlier, Proself Gateway Edition Ver1.65 and earlier, and Proself Mail Sanitize Edition Ver1

    HighCVSS 7.5KEVWeaponizedEPSS 4%

    northgrid · proselfOct 18, 2023

  • CVE-2023-5631
    74This week

    Stored XSS vulnerability in Roundcube

    MediumCVSS 5.4KEVWeaponizedEPSS 76%

    roundcube · webmailOct 18, 2023

  • CVE-2023-5642
    45Plan

    Advantech R-SeeNet Unauthenticated Read/Write

    CriticalCVSS 9.8No exploitEPSS 19%

    advantech · r-seenetOct 18, 2023

  • CVE-2023-46229
    48Plan

    LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an

    HighCVSS 8.8Proof of conceptEPSS 44%

    langchain · langchainOct 19, 2023

  • CVE-2023-35180
    43Plan

    SolarWinds Access Rights Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 27%

    solarwinds · access rights managerOct 19, 2023

  • CVE-2023-46042
    46Plan

    An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo().

    CriticalCVSS 9.8No exploitEPSS 22%

    get-simple · getsimplecmsOct 19, 2023

  • CVE-2023-34051
    52Plan

    VMware Aria Operations for Logs contains an authentication bypass vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 44%

    vmware · aria operations for logsOct 20, 2023

  • CVE-2023-43353
    21Monitor

    Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the e

    MediumCVSS 5.4Proof of conceptEPSS 0%

    cmsmadesimple · cms made simpleOct 20, 2023

  • CVE-2023-43354
    21Monitor

    Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the P

    MediumCVSS 5.4Proof of conceptEPSS 0%

    cmsmadesimple · cms made simpleOct 20, 2023

  • CVE-2023-43355
    21Monitor

    Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the p

    MediumCVSS 5.4Proof of conceptEPSS 0%

    cmsmadesimple · cms made simpleOct 20, 2023

  • CVE-2023-43356
    21Monitor

    Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the G

    MediumCVSS 5.4Proof of conceptEPSS 0%

    cmsmadesimple · cms made simpleOct 20, 2023

  • CVE-2023-43357
    21Monitor

    Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the T

    MediumCVSS 5.4Proof of conceptEPSS 0%

    cmsmadesimple · cms made simpleOct 20, 2023

  • CVE-2023-43346
    21Monitor

    Cross-site scripting (XSS) vulnerability in opensolution Quick CMS v.6.7 allows a local attacker to execute arbitrary code via a crafted scr

    MediumCVSS 5.4Proof of conceptEPSS 0%

    opensolution · quick cmsOct 20, 2023

  • CVE-2023-38192
    24Monitor

    An issue was discovered in SuperWebMailer 9.00.0.01710.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    superwebmailer · superwebmailerOct 20, 2023

  • CVE-2023-38194
    24Monitor

    An issue was discovered in SuperWebMailer 9.00.0.01710.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    superwebmailer · superwebmailerOct 20, 2023

  • CVE-2023-46003
    21Monitor

    I-doit pro 25 and below is vulnerable to Cross Site Scripting (XSS) via index.php.

    MediumCVSS 5.4Proof of conceptEPSS 0%

    i-doit · i-doitOct 20, 2023

  • CVE-2023-5683
    44Plan

    Byzoro Smart S85F Management Platform importconf.php os command injection

    CriticalCVSS 9.8No exploitEPSS 17%

    byzoro · smart s85f firmwareOct 21, 2023

  • CVE-2023-5684
    63This week

    Byzoro Smart S85F Management Platform importexport.php os command injection

    CriticalCVSS 9.8No exploitEPSS 78%

    byzoro · smart s85f firmwareOct 21, 2023

  • CVE-2023-5702
    30Monitor

    Viessmann Vitogate 300 direct request

    MediumCVSS 6.5Proof of conceptEPSS 14%

    viessmann · vitogate 300 firmwareOct 22, 2023

  • CVE-2023-43622
    51Plan

    Apache HTTP Server: DoS in HTTP/2 with initial windows size 0

    HighCVSS 7.5Proof of conceptEPSS 70%

    apache · http serverOct 23, 2023

  • CVE-2023-45802
    24Monitor

    Apache HTTP Server: HTTP/2 stream memory not reclaimed right away on RST

    MediumCVSS 5.9Proof of conceptEPSS 3%

    apache · http serverOct 23, 2023

  • CVE-2023-46127
    32Monitor

    Frappe vulnerable to HTML injection by any Desk user

    MediumCVSS 5.4No exploitEPSS 36%

    frappe · frappeOct 23, 2023

  • CVE-2023-37635
    39Monitor

    UVDesk Community Skeleton v1.1.1 allows unauthenticated attackers to perform brute force attacks on the login page to gain access to the app

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    uvdesk · community-skeletonOct 23, 2023

  • CVE-2023-45966
    30Monitor

    umputun remark42 version 1.12.1 and before has a Blind Server-Side Request Forgery (SSRF) vulnerability.

    HighCVSS 7.5Proof of conceptEPSS 0%

    remark42 · remark42Oct 23, 2023

  • CVE-2023-43358
    21Monitor

    Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the T

    MediumCVSS 5.4Proof of conceptEPSS 0%

    cmsmadesimple · cms made simpleOct 23, 2023

  • CVE-2023-44760
    19Monitor

    Multiple Cross Site Scripting (XSS) vulnerabilities in Concrete CMS v.9.2.1 allow an attacker to execute arbitrary code via a crafted script

    MediumCVSS 4.8Proof of conceptEPSS 0%

    concretecms · concrete cmsOct 23, 2023

  • CVE-2022-3699
    40Plan

    A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to

    HighCVSS 7.8WeaponizedEPSS 4%

    lenovo · diagnosticsOct 25, 2023

  • CVE-2023-20273
    86Now

    A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands with the pri

    HighCVSS 7.2KEVWeaponizedEPSS 92%

    cisco · ios xeOct 25, 2023

  • CVE-2023-34048
    99Now

    VMware vCenter Server Out-of-Bounds Write Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · vcenter serverOct 25, 2023

  • CVE-2023-34446
    24Monitor

    iTop XSS vulnerability on pages/preferences.php

    MediumCVSS 6.1Proof of conceptEPSS 0%

    combodo · itopOct 25, 2023

  • CVE-2023-36085
    24Monitor

    The sisqualWFM 7.1.319.103 thru 7.1.319.111 for Android, has a host header injection vulnerability in its "/sisqualIdentityServer/core/" end

    MediumCVSS 6.1Proof of conceptEPSS 0%

    sisqualwfm · sisqualwfmOct 25, 2023

  • CVE-2023-37908
    38Monitor

    org.xwiki.rendering:xwiki-rendering-xml Improper Neutralization of Invalid Characters in Identifiers in Web Pages vulnerability

    CriticalCVSS 9.6Proof of conceptEPSS 1%

    xwiki · xwiki-renderingOct 25, 2023

  • CVE-2023-38041
    28Monitor

    A logged in user may elevate its permissions by abusing a Time-of-Check to Time-of-Use (TOCTOU) race condition.

    HighCVSS 7.0Proof of conceptEPSS 0%

    ivanti · secure access clientOct 25, 2023

  • CVE-2023-43360
    21Monitor

    Cross Site Scripting vulnerability in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted script to the T

    MediumCVSS 5.4Proof of conceptEPSS 0%

    cmsmadesimple · cms made simpleOct 25, 2023

  • CVE-2023-43795
    60This week

    WPS Server Side Request Forgery in GeoServer

    CriticalCVSS 9.8Proof of conceptEPSS 68%

    osgeo · geoserverOct 25, 2023

  • CVE-2023-44767
    19Monitor

    A File upload vulnerability in RiteCMS 3.0 allows a local attacker to upload a SVG file with XSS content.

    MediumCVSS 4.8Proof of conceptEPSS 0%

    ritecms · ritecmsOct 25, 2023

  • CVE-2023-44769
    21Monitor

    A Cross-Site Scripting (XSS) vulnerability in Zenario CMS v.9.4.59197 allows a local attacker to execute arbitrary code via a crafted script

    MediumCVSS 5.4Proof of conceptEPSS 0%

    tribalsystems · zenarioOct 25, 2023

  • CVE-2023-46136
    30Monitor

    Werkzeug vulnerable to high resource usage when parsing multipart/form-data containing a large part with CR/LF character at the beginning

    HighCVSS 7.5Proof of conceptEPSS 1%

    palletsprojects · werkzeugOct 25, 2023

  • CVE-2023-46347
    54Plan

    In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform S

    CriticalCVSS 9.8Proof of conceptEPSS 49%

    ndkdesign · ndk steppingpackOct 25, 2023

  • CVE-2023-46370
    44Plan

    Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function.

    CriticalCVSS 9.8No exploitEPSS 18%

    tenda · w18e firmwareOct 25, 2023

  • CVE-2023-46371
    39Monitor

    TP-Link device TL-WDR7660 2.0.30 and TL-WR886N 2.0.12 has a stack overflow vulnerability via the function upgradeInfoJsonToBin.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    tp-link · tl-wdr7660 firmwareOct 25, 2023

  • CVE-2023-46574
    59Plan

    An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the Uplo

    CriticalCVSS 9.8Proof of conceptEPSS 65%

    totolink · a3700r firmwareOct 25, 2023

  • CVE-2023-40404
    31Monitor

    A use-after-free issue was addressed with improved memory management.

    HighCVSS 7.8Proof of conceptEPSS 1%

    apple · macosOct 25, 2023

  • CVE-2023-45136
    40Plan

    XWiki Platform web templates vulnerable to reflected XSS in the create document form if name validation is enabled

    CriticalCVSS 9.6Proof of conceptEPSS 5%

    xwiki · xwikiOct 25, 2023

  • CVE-2023-5043
    36Monitor

    Ingress nginx annotation injection causes arbitrary command execution

    HighCVSS 8.8Proof of conceptEPSS 2%

    kubernetes · ingress-nginxOct 25, 2023

  • CVE-2023-5044
    52Plan

    Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation

    HighCVSS 8.8Proof of conceptEPSS 56%

    kubernetes · ingress-nginxOct 25, 2023

  • CVE-2023-5717
    31Monitor

    Out-of-bounds write in Linux kernel's Linux Kernel Performance Events (perf) component

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelOct 25, 2023

  • CVE-2023-46449
    35Monitor

    Sourcecodester Free and Open Source inventory management system v1.0 is vulnerable to Incorrect Access Control.

    HighCVSS 8.8Proof of conceptEPSS 0%

    mayurik · inventory management systemOct 26, 2023

  • CVE-2023-46450
    21Monitor

    Sourcecodester Free and Open Source inventory management system 1.0 is vulnerable to Cross Site Scripting (XSS) via the Add supplier functio

    MediumCVSS 5.4Proof of conceptEPSS 0%

    mayurik · inventory management systemOct 26, 2023

  • CVE-2023-43208
    94Now

    NextGen Healthcare Mirth Connect before version 4.4.1 is vulnerable to unauthenticated remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 82%

    nextgen · mirth connectOct 26, 2023

  • CVE-2023-31419
    49Plan

    Elasticsearch StackOverflow vulnerability

    HighCVSS 7.5Proof of conceptEPSS 61%

    elastic · elasticsearchOct 26, 2023

  • CVE-2023-46747
    98Now

    BIG-IP Configuration utility unauthenticated remote code execution vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 96%

    f5 · big-ip access policy managerOct 26, 2023

  • CVE-2023-46748
    66This week

    BIG-IP Configuration utility authenticated SQL injection vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 4%

    f5 · big-ip access policy managerOct 26, 2023

  • CVE-2018-17879
    46Plan

    An issue was discovered on certain ABUS TVIP cameras.

    CriticalCVSS 9.8No exploitEPSS 21%

    abus · tvip 10000 firmwareOct 26, 2023

  • CVE-2023-43352
    31Monitor

    An issue in CMSmadesimple v.2.2.18 allows a local attacker to execute arbitrary code via a crafted payload to the Content Manager Menu compo

    HighCVSS 7.8Proof of conceptEPSS 0%

    cmsmadesimple · cms made simpleOct 26, 2023

  • CVE-2023-46813
    28Monitor

    An issue was discovered in the Linux kernel before 6.5.9, exploitable by local users with userspace access to MMIO registers.

    HighCVSS 7.0Proof of conceptEPSS 0%

    linux · linux kernelOct 26, 2023

  • CVE-2023-45498
    60This week

    VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.

    CriticalCVSS 9.8WeaponizedEPSS 20%

    vinchin · vinchin backup and recoveryOct 27, 2023

  • CVE-2023-45499
    60This week

    VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain hardcoded credentials.

    CriticalCVSS 9.8WeaponizedEPSS 7%

    vinchin · vinchin backup and recoveryOct 27, 2023