CVEs published in October 2023
42 tracked CVEs from 10 vendors had their first vendor advisory published in October 2023: 7 critical, 19 high, 5 in CISA KEV. Newest first.
22 more from this month are covered only by Red Hat's per-package records, listed on the Red Hat vendor page.
- Added
CVE-2023-22518CriticalCISA KEV
Atlassian Confluence Data Center and Server Improper Authorization Vulnerability
Atlassian · 1 advisory - Added
CVE-2023-46748HighCISA KEV
F5 BIG-IP Configuration Utility SQL Injection Vulnerability
F5 · 1 advisory - Added
CVE-2023-46747CriticalCISA KEV
F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability
F5 · 1 advisory - Added
CVE-2023-23373High
OS command injection vulnerability has been reported to affect QUSBCam2.
QNAP · 1 advisory - Added
CVE-2023-1260Critical
Kubernetes Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2023-5552High
Sophos Firewall: password disclosure vulnerability in the Secure PDF eXchange (SPX) feature
Sophos · 1 advisory - Added
CVE-2023-34977Medium
Video Station: cross-site scripting (XSS) vulnerability has been reported to affect Video Station.
QNAP · 1 advisory - Added
CVE-2023-34976Critical
Video Station: SQL injection vulnerability has been reported to affect Video Station.
QNAP · 1 advisory - Added
CVE-2023-34975Medium
QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.
QNAP · 1 advisory - Added
CVE-2023-32976Medium
OS command injection vulnerability has been reported to affect Container Station.
QNAP · 1 advisory - Added
CVE-2023-32974High
QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.
QNAP · 1 advisory - Added
QTS: buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions
QNAP · 1 advisory - Added
CVE-2023-32970Medium
QTS: NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions.
QNAP · 1 advisory - Added
CVE-2023-38546High
NetApp · 1 advisory - Added
CVE-2023-38545High
NetApp, Veeam · 2 advisories - Added
CVE-2023-42794Unrated
Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows
Apache · 1 advisory - Added
CVE-2023-29348High
Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability
MS Server · 1 advisory - Added
CVE-2023-42787Medium
client-side enforcement of server-side security [CWE-602] vulnerability in Fortinet FortiManager version 7.4.0 and before 7.2.3 and FortiAnalyzer version 7.4.0 and before 7.2.3 may allow a remote attacker with low privileges to access a privileged web console via client side code execution
Fortinet · 1 advisory - Added
CVE-2023-5450High
insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may
F5 · 1 advisory - Added
CVE-2023-45226High
The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials
F5 · 1 advisory - Added
CVE-2023-45219Medium
Exposure of Sensitive Information vulnerability exist in an undisclosed BIG-IP TMOS shell (tmsh) command which may
F5 · 1 advisory - Added
CVE-2023-43746High
BIG-IP: When running in Appliance mode, an authenticated user assigned the Administrator role
F5 · 1 advisory - Added
CVE-2023-43611High
F5 · 1 advisory - Added
CVE-2023-43485Medium
When TACACS+ audit forwarding is configured on BIG-IP or BIG-IQ system, sharedsecret is logged in plaintext in the audit log
F5 · 1 advisory - Added
CVE-2023-42768High
BIG-IP: When a non-admin user has been assigned an administrator role
F5 · 1 advisory - Added
CVE-2023-41964Medium
BIG-IP: The BIG-IP and BIG-IQ systems do not encrypt some sensitive information written to Database (DB) variables.
F5 · 1 advisory - Added
CVE-2023-41373Critical
directory traversal vulnerability exists in the BIG-IP Configuration Utility that may
F5 · 1 advisory - Added
CVE-2023-41253Medium
When on BIG-IP DNS or BIG-IP LTM enabled with DNS Services License, and a TSIG key is created, it is logged in plaintext in the…
F5 · 1 advisory - Added
CVE-2023-41085High
When IPSec is configured on a Virtual Server, undisclosed traffic can cause TMM to terminate.
F5 · 1 advisory - Added
CVE-2023-40542High
When TCP Verified Accept is enabled on a TCP profile that is configured on a Virtual Server, undisclosed requests
F5 · 1 advisory - Added
CVE-2023-40537High
BIG-IP: authenticated user's session cookie
F5 · 1 advisory - Added
CVE-2023-40534High
When a client-side HTTP/2 profile and the HTTP MRF Router option are enabled for a virtual server, and an iRule using the…
F5 · 1 advisory - Added
CVE-2023-39447Medium
BIG-IP: When BIG-IP APM Guided Configurations are configured, undisclosed sensitive information may be logged in restnoded log.
F5 · 1 advisory - Added
QTS: buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions
QNAP · 1 advisory - Added
QTS: buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions
QNAP · 1 advisory - Added
CVE-2023-23371Medium
cleartext transmission of sensitive information vulnerability has been reported to affect QVPN Device Client.
QNAP · 1 advisory - Added
CVE-2023-23370Medium
insufficiently protected credentials vulnerability has been reported to affect QVPN Device Client.
QNAP · 1 advisory - Added
CVE-2023-23366High
Music Station: path traversal vulnerability has been reported to affect Music Station.
QNAP · 1 advisory - Added
CVE-2023-23365High
Music Station: path traversal vulnerability has been reported to affect Music Station.
QNAP · 1 advisory - Added
CVE-2022-48565Critical
Python Vulnerability in NetApp Products
NetApp · 1 advisory - Added
CVE-2023-22515CriticalCISA KEV
Atlassian Confluence Data Center and Server Broken Access Control Vulnerability
Atlassian · 1 advisory - Added
CVE-2023-4911HighCISA KEV
GNU C Library Buffer Overflow Vulnerability
NetApp, Red Hat · 2 advisories