Archive

10 October 2023

Vulnerabilities first published on this day (UTC), newest first.

← September 2023 2023 / October /10 November 2023 →

All Critical High Medium Low Exploited only Public exploit

256 results · Feed

High 7.5

GHSA-xpw8-rcwv-8f8p

io.netty:netty-codec-http2 vulnerable to HTTP/2 Rapid Reset Attack

A client might overload the server by issue frequent RST frames. This can cause a massive amount of load on the remote system and so cause a DDOS attack. ### Impact This is a DDOS attack, any http2 server is affected and so you should update as soon as possib…

io.netty:netty-codec-http2 Maven

Oct 10, 2023
Medium 5.4

CVE-2023-26220

TIBCO Spotfire Stored Cross-site Scripting (XSS) vulnerability

The Spotfire Library component of TIBCO Software Inc.'s Spotfire Analyst and Spotfire Server contains an easily exploitable vulnerability that allows a low privileged attacker with network access to execute a Stored Cross Site Scripting (XSS) on the affected …

TIBCO Software Spotfire Analyst Spotfire Server

Oct 10, 2023
Medium 5.3

CVE-2023-45648 Scanner template

Apache Tomcat: Trailer header parsing too lenient

Improper Input Validation vulnerability in Apache Tomcat.Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.81 and from 8.5.0 through 8.5.93 did not correctly parse HTTP trailer headers. A specially crafted, in…

Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat9 Debian Ubuntu Maven

Oct 10, 2023
High 7.5

GHSA-vx74-f528-fxqg

github.com/nghttp2/nghttp2 has HTTP/2 Rapid Reset

### Impact Rapidly creating and cancelling streams (HEADERS frame immediately followed by RST_STREAM) without bound cause denial of service. See https://www.cve.org/CVERecord?id=CVE-2023-44487 for details. ### Patches nghttp2 v1.57.0 mitigates this vulnerabil…

github.com/nghttp2/nghttp2 Go

Oct 10, 2023
Medium 5.3

CVE-2023-42795

Apache Tomcat: Failure during request clean-up leads to sensitive data leaking to subsequent requests

Incomplete Cleanup vulnerability in Apache Tomcat.When recycling various internal objects in Apache Tomcat from 11.0.0-M1 through 11.0.0-M11, from 10.1.0-M1 through 10.1.13, from 9.0.0-M1 through 9.0.80 and from 8.5.0 through 8.5.93, an error could cause Tomc…

Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat tomcat8 Debian Ubuntu Maven

Oct 10, 2023
Medium 6.3

CVE-2023-5497

Tongda OA 2017 delete.php sql injection

A vulnerability classified as critical has been found in Tongda OA 2017 11.10. Affected is an unknown function of the file general/hr/salary/welfare_manage/delete.php. The manipulation of the argument WELFARE_ID leads to sql injection. It is possible to launc…

Tongda OA 2017

Oct 10, 2023
Critical 10.0

CVE-2023-4309

Election Services Co. (ESC) Internet Election Service is vulnerable to SQL injection in multiple pages and parameters. …

Election Services Co. (ESC) Internet Election Service

Oct 10, 2023
Medium 4.9

CVE-2023-45129

matrix-synapse vulnerable to denial of service due to malicious server ACL events

Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. Prior to version 1.94.0, a malicious server ACL event can impact performance temporarily or permanently leading to a persistent denial of service. Homeservers run…

Matrix synapse matrix-synapse matrix-synapse Ubuntu Alpine PyPI

Oct 10, 2023
Medium 5.9

CVE-2023-42794

Apache Tomcat: FileUpload: DoS due to accumulation of temporary files on Windows

Incomplete Cleanup vulnerability in Apache Tomcat. The internal fork of Commons FileUpload packaged with Apache Tomcat 9.0.70 through 9.0.80 and 8.5.85 through 8.5.93 included an unreleased, in progress refactoring that exposed a potential denial of service o…

Apache Software Foundation Apache Tomcat org.apache.tomcat:tomcat-coyote Maven

Oct 10, 2023
High 8.8

CVE-2023-36414

Azure Identity SDK Remote Code Execution Vulnerability

Azure Identity SDK Remote Code Execution Vulnerability

Microsoft Azure Identity SDK for .NET Azure.Identity NuGet

Oct 10, 2023
High 8.8

CVE-2023-36415

Azure Identity SDK Remote Code Execution Vulnerability

Azure Identity SDK Remote Code Execution Vulnerability

Microsoft Azure Identity SDK for .NET Azure Identity SDK for Python Azure Identity SDK for JavaScript

Oct 10, 2023
High 7.8

CVE-2023-36418

Azure RTOS GUIX Studio Remote Code Execution Vulnerability

Azure RTOS GUIX Studio Remote Code Execution Vulnerability

Microsoft Azure RTOS GUIX Studio

Oct 10, 2023
Medium 6.1

CVE-2023-36416

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability

Microsoft Microsoft Dynamics 365 (on-premises) version 9.0 Microsoft Dynamics 365 (on-premises) version 9.1

Oct 10, 2023
High 7.8

CVE-2023-36436

Windows MSHTML Platform Remote Code Execution Vulnerability

Windows MSHTML Platform Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 10, 2023
High 7.0

CVE-2023-36565

Microsoft Office Graphics Elevation of Privilege Vulnerability

Microsoft Office Graphics Elevation of Privilege Vulnerability

Microsoft Microsoft Office LTSC for Mac 2021 Microsoft Office 2019 for Mac Microsoft Office for Android Android

Oct 10, 2023
Medium 6.5

CVE-2023-36566

Microsoft Common Data Model SDK Denial of Service Vulnerability

Microsoft Common Data Model SDK Denial of Service Vulnerability

Microsoft Microsoft Common Data Model SDK for TypeScript Microsoft Common Data Model SDK for C# Microsoft Common Data Model SDK for Java Maven PyPI NuGet

Oct 10, 2023
High 7.8

CVE-2023-36743

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 10, 2023
High 7.0

CVE-2023-36776

Win32k Elevation of Privilege Vulnerability

Win32k Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 10, 2023
High 8.0

CVE-2023-36778

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 12 Microsoft Exchange Server 2019 Cumulative Update 13

Oct 10, 2023
High 7.2

CVE-2023-36780

Skype for Business Remote Code Execution Vulnerability

Skype for Business Remote Code Execution Vulnerability

Microsoft Skype for Business Server 2015 CU13 Skype for Business Server 2019 CU7

Oct 10, 2023
High 7.2

CVE-2023-36786

Skype for Business Remote Code Execution Vulnerability

Skype for Business Remote Code Execution Vulnerability

Microsoft Skype for Business Server 2015 CU13 Skype for Business Server 2019 CU7

Oct 10, 2023
High 7.8

CVE-2023-36785

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft ODBC Driver 17 for SQL Server on Linux Linux Windows macOS

Oct 10, 2023
High 7.8

CVE-2023-36790

Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability

Windows RDP Encoder Mirror Driver Elevation of Privilege Vulnerability

Microsoft Windows Server 2008 R2 Service Pack 1 Windows Server 2008 R2 Service Pack 1 (Server Core installation) Windows Server 2008 Service Pack 2 Windows

Oct 10, 2023
High 7.2

CVE-2023-36789

Skype for Business Remote Code Execution Vulnerability

Skype for Business Remote Code Execution Vulnerability

Microsoft Skype for Business Server 2015 CU13 Skype for Business Server 2019 CU7

Oct 10, 2023
High 8.1

CVE-2023-38166

Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

Layer 2 Tunneling Protocol Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 10, 2023
High 7.0

CVE-2023-38159

Windows Graphics Component Elevation of Privilege Vulnerability

Windows Graphics Component Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 10, 2023
High 7.5

CVE-2023-29348

Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability

Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows Server 2022 Windows

Oct 10, 2023
High 7.8

CVE-2023-36417

Microsoft SQL OLE DB Remote Code Execution Vulnerability

Microsoft SQL OLE DB Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft OLE DB Driver 18 for SQL Server

Oct 10, 2023
High 7.8

CVE-2023-36420

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability

Microsoft Microsoft SQL Server 2019 (GDR) Microsoft SQL Server 2022 (GDR) Microsoft ODBC Driver 18 for SQL Server on Linux Linux Windows macOS

Oct 10, 2023
High 8.8

CVE-2023-36419

Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability

Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability

Microsoft Azure HDInsight

Oct 10, 2023
Medium 6.5

CVE-2023-36429

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Microsoft Microsoft Dynamics 365 (on-premises) version 9.0 Microsoft Dynamics 365 (on-premises) version 9.1

Oct 10, 2023
High 7.5

CVE-2023-36431

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 10, 2023
Critical 9.8

CVE-2023-36434

Windows IIS Server Elevation of Privilege Vulnerability

Windows IIS Server Elevation of Privilege Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 10, 2023
Medium 6.5

CVE-2023-36433

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Microsoft Microsoft Dynamics 365 (on-premises) version 9.0 Microsoft Dynamics 365 (on-premises) version 9.1

Oct 10, 2023
High 7.5

CVE-2023-36435

Microsoft QUIC Denial of Service Vulnerability

Microsoft QUIC Denial of Service Vulnerability

Microsoft Windows Server 2022 Windows 11 version 22H2 Windows 11 version 21H2 Windows Alpine NuGet

Oct 10, 2023
High 7.5

CVE-2023-36438

Windows TCP/IP Information Disclosure Vulnerability

Windows TCP/IP Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 10, 2023
High 7.8

CVE-2023-36557

PrintHTML API Remote Code Execution Vulnerability

PrintHTML API Remote Code Execution Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 10, 2023
High 7.3

CVE-2023-36561

Azure DevOps Server Elevation of Privilege Vulnerability

Azure DevOps Server Elevation of Privilege Vulnerability

Microsoft Azure DevOps Server 2020.1.2 Azure DevOps Server 2022.0.1 Azure DevOps Server 2020.0.2

Oct 10, 2023
Medium 6.5

CVE-2023-36563 Exploited EPSS 20%

Microsoft WordPad Information Disclosure Vulnerability

Microsoft WordPad Information Disclosure Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 10, 2023
KEV Oct 10, 2023
Medium 6.5

CVE-2023-36564

Windows Search Security Feature Bypass Vulnerability

Windows Search Security Feature Bypass Vulnerability

Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows

Oct 10, 2023