| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2023-36582 | Hig | 0.48 | 7.3 | 0.01 | Oct 10, 2023 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | ||
| CVE-2023-36581 | Hig | 0.49 | 7.5 | 0.02 | Oct 10, 2023 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability | ||
| CVE-2023-36579 | Hig | 0.49 | 7.5 | 0.02 | Oct 10, 2023 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability | ||
| CVE-2023-36578 | Hig | 0.48 | 7.3 | 0.01 | Oct 10, 2023 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | ||
| CVE-2023-36577 | Hig | 0.57 | 8.8 | 0.02 | Oct 10, 2023 | Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability | ||
| CVE-2023-36575 | Hig | 0.48 | 7.3 | 0.01 | Oct 10, 2023 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | ||
| CVE-2023-36574 | Hig | 0.48 | 7.3 | 0.01 | Oct 10, 2023 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | ||
| CVE-2023-36573 | Hig | 0.48 | 7.3 | 0.01 | Oct 10, 2023 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | ||
| CVE-2023-36572 | Hig | 0.48 | 7.3 | 0.01 | Oct 10, 2023 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | ||
| CVE-2023-36571 | Hig | 0.48 | 7.3 | 0.01 | Oct 10, 2023 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | ||
| CVE-2023-36570 | Hig | 0.48 | 7.3 | 0.01 | Oct 10, 2023 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | ||
| CVE-2023-36569 | Hig | 0.55 | 8.4 | 0.01 | Oct 10, 2023 | Microsoft Office Elevation of Privilege Vulnerability | ||
| CVE-2023-36568 | Hig | 0.46 | 7.0 | 0.00 | Oct 10, 2023 | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability | ||
| CVE-2023-36567 | Hig | 0.49 | 7.5 | 0.02 | Oct 10, 2023 | Windows Deployment Services Information Disclosure Vulnerability | ||
| CVE-2023-36565 | Hig | 0.46 | 7.0 | 0.00 | Oct 10, 2023 | Microsoft Office Graphics Elevation of Privilege Vulnerability | ||
| CVE-2023-36561 | Hig | 0.48 | 7.3 | 0.01 | Oct 10, 2023 | Azure DevOps Server Elevation of Privilege Vulnerability | ||
| CVE-2023-36557 | Hig | 0.51 | 7.8 | 0.01 | Oct 10, 2023 | PrintHTML API Remote Code Execution Vulnerability | ||
| CVE-2023-36438 | Hig | 0.49 | 7.5 | 0.02 | Oct 10, 2023 | Windows TCP/IP Information Disclosure Vulnerability | ||
| CVE-2023-36436 | Hig | 0.51 | 7.8 | 0.01 | Oct 10, 2023 | Windows MSHTML Platform Remote Code Execution Vulnerability | ||
| CVE-2023-36435 | Hig | 0.42 | 7.5 | 0.06 | Oct 10, 2023 | Microsoft QUIC Denial of Service Vulnerability | ||
| CVE-2023-36431 | Hig | 0.49 | 7.5 | 0.02 | Oct 10, 2023 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability | ||
| CVE-2023-36420 | Hig | 0.51 | 7.8 | 0.01 | Oct 10, 2023 | Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability | ||
| CVE-2023-36419 | Hig | 0.57 | 8.8 | 0.02 | Oct 10, 2023 | Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability | ||
| CVE-2023-36418 | Hig | 0.51 | 7.8 | 0.01 | Oct 10, 2023 | Azure RTOS GUIX Studio Remote Code Execution Vulnerability | ||
| CVE-2023-36417 | Hig | 0.51 | 7.8 | 0.01 | Oct 10, 2023 | Microsoft SQL OLE DB Remote Code Execution Vulnerability | ||
| CVE-2023-36415 | Hig | 0.57 | 8.8 | 0.02 | Oct 10, 2023 | Azure Identity SDK Remote Code Execution Vulnerability | ||
| CVE-2023-36414 | Hig | 0.57 | 8.8 | 0.02 | Oct 10, 2023 | Azure Identity SDK Remote Code Execution Vulnerability | ||
| CVE-2023-29348 | Hig | 0.49 | 7.5 | 0.02 | Oct 10, 2023 | Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability | ||
| CVE-2023-42788 | Hig | 0.51 | 7.8 | 0.02 | Oct 10, 2023 | An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through… | ||
| CVE-2023-41841 | Hig | 0.53 | 8.1 | 0.01 | Oct 10, 2023 | An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform elevated actions. | ||
| CVE-2023-41838 | Hig | 0.46 | 7.1 | 0.01 | Oct 10, 2023 | An improper neutralization of special elements used in an os command ('os command injection') in FortiManager 7.4.0 and 7.2.0 through 7.2.3 may allow attacker to execute unauthorized code or commands via FortiManager cli. | ||
| CVE-2023-41679 | Hig | 0.55 | 8.5 | 0.01 | Oct 10, 2023 | An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with at least "device management" permission… | ||
| CVE-2023-40718 | Hig | 0.49 | 7.5 | 0.01 | Oct 10, 2023 | A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets. | ||
| CVE-2023-36556 | Hig | 0.57 | 8.8 | 0.01 | Oct 10, 2023 | An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests. | ||
| CVE-2023-36549 | Hig | 0.57 | 8.8 | 0.02 | Oct 10, 2023 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters. | ||
| CVE-2023-36478 | Hig | 0.42 | 7.5 | 0.05 | Oct 10, 2023 | Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit.… | ||
| CVE-2023-34989 | Hig | 0.57 | 8.8 | 0.02 | Oct 10, 2023 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters. | ||
| CVE-2023-34988 | Hig | 0.57 | 8.8 | 0.02 | Oct 10, 2023 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters. | ||
| CVE-2023-34987 | Hig | 0.57 | 8.8 | 0.02 | Oct 10, 2023 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters. | ||
| CVE-2023-34986 | Hig | 0.57 | 8.8 | 0.02 | Oct 10, 2023 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters. | ||
| CVE-2023-34985 | Hig | 0.57 | 8.8 | 0.02 | Oct 10, 2023 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters. | ||
| CVE-2023-25607 | Hig | 0.51 | 7.8 | 0.02 | Oct 10, 2023 | An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions, FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0… | ||
| CVE-2020-27213 | Hig | 0.49 | 7.5 | 0.01 | Oct 10, 2023 | An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and… | ||
| CVE-2023-43896 | Hig | 0.51 | 7.8 | 0.00 | Oct 10, 2023 | A buffer overflow in Macrium Reflect 8.1.7544 and below allows attackers to escalate privileges or execute arbitrary code. | ||
| CVE-2023-5499 | Hig | 0.49 | 7.5 | 0.01 | Oct 10, 2023 | Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the week's logs stored in the 'log2' directory. An attacker could retrieve sensitive information such as remembered wifi networks, sent messages,… | ||
| CVE-2023-44487 | Hig | 0.65 | 7.5 | 1.00 | KEV | Oct 10, 2023 | The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023. | |
| CVE-2023-5450 | — | Hig | 0.47 | 7.3 | 0.00 | Oct 10, 2023 | An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not… | |
| CVE-2023-45226 | Hig | 0.48 | 7.4 | 0.00 | Oct 10, 2023 | The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell (SSH) server on those containers. This is only… | ||
| CVE-2023-43787 | Hig | 0.51 | 7.8 | 0.00 | Oct 10, 2023 | A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges. | ||
| CVE-2023-43746 | Hig | 0.57 | 8.7 | 0.01 | Oct 10, 2023 | When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary. Note:… |
- risk 0.48cvss 7.3epss 0.01
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
- risk 0.49cvss 7.5epss 0.02
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
- risk 0.49cvss 7.5epss 0.02
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
- risk 0.48cvss 7.3epss 0.01
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
- risk 0.57cvss 8.8epss 0.02
Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
- risk 0.48cvss 7.3epss 0.01
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
- risk 0.48cvss 7.3epss 0.01
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
- risk 0.48cvss 7.3epss 0.01
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
- risk 0.48cvss 7.3epss 0.01
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
- risk 0.48cvss 7.3epss 0.01
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
- risk 0.48cvss 7.3epss 0.01
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
- risk 0.55cvss 8.4epss 0.01
Microsoft Office Elevation of Privilege Vulnerability
- risk 0.46cvss 7.0epss 0.00
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability
- risk 0.49cvss 7.5epss 0.02
Windows Deployment Services Information Disclosure Vulnerability
- risk 0.46cvss 7.0epss 0.00
Microsoft Office Graphics Elevation of Privilege Vulnerability
- risk 0.48cvss 7.3epss 0.01
Azure DevOps Server Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
PrintHTML API Remote Code Execution Vulnerability
- risk 0.49cvss 7.5epss 0.02
Windows TCP/IP Information Disclosure Vulnerability
- risk 0.51cvss 7.8epss 0.01
Windows MSHTML Platform Remote Code Execution Vulnerability
- risk 0.42cvss 7.5epss 0.06
Microsoft QUIC Denial of Service Vulnerability
- risk 0.49cvss 7.5epss 0.02
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
- risk 0.51cvss 7.8epss 0.01
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
- risk 0.57cvss 8.8epss 0.02
Azure HDInsight Apache Oozie Workflow Scheduler XXE Elevation of Privilege Vulnerability
- risk 0.51cvss 7.8epss 0.01
Azure RTOS GUIX Studio Remote Code Execution Vulnerability
- risk 0.51cvss 7.8epss 0.01
Microsoft SQL OLE DB Remote Code Execution Vulnerability
- risk 0.57cvss 8.8epss 0.02
Azure Identity SDK Remote Code Execution Vulnerability
- risk 0.57cvss 8.8epss 0.02
Azure Identity SDK Remote Code Execution Vulnerability
- risk 0.49cvss 7.5epss 0.02
Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability
- risk 0.51cvss 7.8epss 0.02
An improper neutralization of special elements used in an os command ('OS Command Injection') vulnerability [CWE-78] in FortiManager & FortiAnalyzer version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.8, version 6.4.0 through 6.4.12 and version 6.2.0 through…
- risk 0.53cvss 8.1epss 0.01
An improper authorization vulnerability in Fortinet FortiOS 7.0.0 - 7.0.11 and 7.2.0 - 7.2.4 allows an attacker belonging to the prof-admin profile to perform elevated actions.
- risk 0.46cvss 7.1epss 0.01
An improper neutralization of special elements used in an os command ('os command injection') in FortiManager 7.4.0 and 7.2.0 through 7.2.3 may allow attacker to execute unauthorized code or commands via FortiManager cli.
- risk 0.55cvss 8.5epss 0.01
An improper access control vulnerability [CWE-284] in FortiManager management interface 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions may allow a remote and authenticated attacker with at least "device management" permission…
- risk 0.49cvss 7.5epss 0.01
A interpretation conflict in Fortinet IPS Engine versions 7.321, 7.166 and 6.158 allows attacker to evade IPS features via crafted TCP packets.
- risk 0.57cvss 8.8epss 0.01
An incorrect authorization vulnerability [CWE-863] in FortiMail webmail version 7.2.0 through 7.2.2, version 7.0.0 through 7.0.5 and below 6.4.7 allows an authenticated attacker to login on other users accounts from the same web domain via crafted HTTP or HTTPs requests.
- risk 0.57cvss 8.8epss 0.02
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http get request parameters.
- risk 0.42cvss 7.5epss 0.05
Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit.…
- risk 0.57cvss 8.8epss 0.02
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.
- risk 0.57cvss 8.8epss 0.02
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.
- risk 0.57cvss 8.8epss 0.02
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.
- risk 0.57cvss 8.8epss 0.02
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.
- risk 0.57cvss 8.8epss 0.02
A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted HTTP get request parameters.
- risk 0.51cvss 7.8epss 0.02
An improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerability [CWE-78 ] in FortiManager 7.2.0 through 7.2.2, 7.0.0 through 7.0.7, 6.4.0 through 6.4.11, 6.2 all versions, 6.0 all versions, FortiAnalyzer 7.2.0 through 7.2.2, 7.0.0…
- risk 0.49cvss 7.5epss 0.01
An issue was discovered in Ethernut Nut/OS 5.1. The code that generates Initial Sequence Numbers (ISNs) for TCP connections derives the ISN from an insufficiently random source. As a result, an attacker may be able to determine the ISN of current and future TCP connections and…
- risk 0.51cvss 7.8epss 0.00
A buffer overflow in Macrium Reflect 8.1.7544 and below allows attackers to escalate privileges or execute arbitrary code.
- risk 0.49cvss 7.5epss 0.01
Information exposure vulnerability in Shenzhen Reachfar v28, the exploitation of which could allow a remote attacker to retrieve all the week's logs stored in the 'log2' directory. An attacker could retrieve sensitive information such as remembered wifi networks, sent messages,…
- risk 0.65cvss 7.5epss 1.00
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
- risk 0.47cvss 7.3epss 0.00
An insufficient verification of data vulnerability exists in BIG-IP Edge Client Installer on macOS that may allow an attacker elevation of privileges during the installation process. Note: Software versions which have reached End of Technical Support (EoTS) are not…
- risk 0.48cvss 7.4epss 0.00
The BIG-IP SPK TMM (Traffic Management Module) f5-debug-sidecar and f5-debug-sshd containers contains hardcoded credentials that may allow an attacker with the ability to intercept traffic to impersonate the SPK Secure Shell (SSH) server on those containers. This is only…
- risk 0.51cvss 7.8epss 0.00
A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.
- risk 0.57cvss 8.7epss 0.01
When running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing BIG-IP external monitor on a BIG-IP system. A successful exploit can allow the attacker to cross a security boundary. Note:…