CVEs published October 30, 2023
169 CVEs were published on October 30, 2023: 6 critical, 27 high.
- Published
- 169
- Critical
- 6
- High
- 27
- Medium
- 34
- Low
- 4
- Unrated
- 98
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Google Android
- 108
- baserproject basercms · baserproject/basercms
- 4
- bigbluebutton
- 4
- blakeblackshear frigate
- 3
- Lenovo ThinkPad BIOS
- 3
- g5theme Grid Plus – Unlimited grid layout
- 2
- mintplex-labs/anything-llm
- 2
- Adobe Acrobat for Edge
- 1
- amitsukapure Shortcode Menu
- 1
- bloafer PHP to Page
- 1
Critical 6
- CVE-2023-5199PHP to Page <= 0.3 - Authenticated (Subscriber+) Local File Inclusion to Remote Code Execution via Shortcodebloafer PHP to Page
- CVE-2023-5843Ads by datafeedr.com <= 1.1.3 - Unauthenticated (Limited) Remote Code Executiondatafeedrcom Ads by datafeedr.com
- CVE-2023-5832Improper Input Validation in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2023-45797DreamSecurity MagicLine Buffer Overflow VulnerabilityDream Security MagicLine4NX
- CVE-2023-46502An issue in openCRX v.5.2.2 allows a remote attacker to read internal files and execute server side request forgery attack via insecure Docuorg.opencrx:opencrx-client
- CVE-2023-47104tinyfiledialogs (aka tiny file dialogs) before 3.15.0 allows shell metacharacters (such as a backquote or a dollar sign) in titles, messages
High 27
- CVE-2023-46129xkeys Seal encryption used fixed key for all encryptionnats-io nkeys · github.com/nats-io/nkeys +1
- CVE-2023-45672Frigate unsafe deserialization in `load_config_with_no_duplicates` of `frigate/util/builtin.py`blakeblackshear frigate
- CVE-2023-45670Frigate cross-site request forgery in `config_save` and `config_set` request handlersblakeblackshear frigate
- CVE-2023-44397CloudExplorer Lite permission bypass vulnerabilityCloudExplorer-Dev CloudExplorer-Lite
- CVE-2023-45780In Print Service, there is a possible background activity launch due to a logic error in the code.Google Android
- CVE-2023-21390In Sim, there is a possible way to evade mobile preference restrictions due to a permission bypass.Google Android
- CVE-2023-21358In UWB Google, there is a possible way for a malicious app to masquerade as system app com.android.uwb.resources due to improperly used crypGoogle Android
- CVE-2023-21351In multiple locations, there is a possible background activity launch due to a logic error in the code.Google Android
- CVE-2023-21342In RemoteSpeechRecognitionService of RemoteSpeechRecognitionService.java, there is a possible way to launch an activity from the background Google Android
- CVE-2023-21341In Permission Manager, there is a possible way to bypass required permissions due to a missing permission check.Google Android
- CVE-2023-21339In Minikin, there is a possible way to trigger ANR by showing a malicious message due to resource exhaustion.Google Android
- CVE-2023-21337In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informationGoogle Android
- CVE-2023-21324In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to side channel inforGoogle Android
- CVE-2023-21298In Slice, there is a possible disclosure of installed applications due to side channel information disclosure.Google Android
- CVE-2021-39810In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app withGoogle Android
- CVE-2023-4964Potential open redirect vulnerability in opentext SMAX and AMX product. opentext Service Management Automation X · opentext Asset M…
- CVE-2023-5250Grid Plus <= 1.3.3 - Authenticated (Subscriber+) Local File Inclusion via Shortcodeg5theme Grid Plus – Unlimited grid layout
- CVE-2023-5315Google Maps made Simple <= 0.6 - Authenticated (Subscriber+) SQL Injection via Shortcodemschwar Google Maps made Simple
- CVE-2023-5583WP Simple Galleries <= 1.34 - Authenticated (Contributor+) PHP Object Injectionmaca134 WP Simple Galleries
- CVE-2023-5833Improper Access Control in mintplex-labs/anything-llmmintplex-labs/anything-llm
- CVE-2023-45799MLSoft TCO!stream Remote Code Execution VulnerabilityMLSoft TCO!stream
- CVE-2023-45798Yettiesoft VestCert Remote Code Execution VulnerabilityYettiesoft VestCert
- CVE-2020-36767tinyfiledialogs (aka tiny file dialogs) before 3.8.0 allows shell metacharacters in titles, messages, and other input data.
- CVE-2023-42323Cross Site Request Forgery (CSRF) vulnerability in DouHaocms v.3.3 allows a remote attacker to execute arbitrary code via the adminAction.cl
- CVE-2023-45956An issue discovered in Govee LED Strip v3.00.42 allows attackers to cause a denial of service via crafted Move and MoveWithOnoff commands.
- CVE-2023-46478An issue in minCal v.1.0.0 allows a remote attacker to execute arbitrary code via a crafted script to the customer_data parameter.
- CVE-2023-47101The installer (aka openvpn-client-installer) in Securepoint SSL VPN Client before 2.0.40 allows local privilege escalation during installati
Medium, low and unrated 136
- CVE-2023-46139KernelSU signature validation mismatchtiann KernelSU
- CVE-2023-46138JumpServer default admin user email leak password resetjumpserver
- CVE-2023-45671Frigate reflected XSS through `/<camera_name>` API endpointsblakeblackshear frigate
- CVE-2023-43798BigBlueButton Blind SSRF When Uploading Presentation (mitigation bypass)bigbluebutton
- CVE-2023-43797BigBlueButton Stored Cross-site Scripting vulnerability at Guest Lobbybigbluebutton
- CVE-2023-5349Draw while calling getdrawinfo()rmagick · Red Hat 3scale API Management Platform +1
- CVE-2023-43792baserCMS Code Injection Vulnerability in Mail Form Featurebaserproject basercms · baserproject/basercms
- CVE-2023-43649baserCMS CSRF vulnerability in Content preview Featurebaserproject basercms · baserproject/basercms
- CVE-2023-43648baserCMS Directory Traversal vulnerability in Form submission data management Featurebaserproject basercms · baserproject/basercms
- CVE-2023-43647baserCMS Cross-site Scripting vulnerability in File upload Featurebaserproject basercms · baserproject/basercms
- CVE-2023-42804BigBlueButton Path Traversal – Reading Certain File Extensionsbigbluebutton
- CVE-2023-42803BigBlueButton Unrestricted File Upload vulnerabilitybigbluebutton
- CVE-2023-41891FlyteAdmin SQL Injection in List Filtersflyteorg flyteadmin · github.com/flyteorg/flyteadmin
- CVE-2023-40101In collapse of canonicalize_md.c, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-21398In sdksandbox, there is a possible strandhogg style overlay attack due to a logic error in the code.Google Android
- CVE-2023-21397In Setup Wizard, there is a possible way to save a WiFi network due to an insecure default value.Google Android
- CVE-2023-21396In Activity Manager, there is a possible background activity launch due to a logic error in the code.Google Android
- CVE-2023-21395In Bluetooth, there is a possible out of bounds read due to a use after free.Google Android
- CVE-2023-21394In registerPhoneAccount of TelecomServiceImpl.java, there is a possible way to reveal images from another user due to a missing permission cGoogle Android
- CVE-2023-21393In Settings, there is a possible way for the user to change SIM due to a missing permission check.Google Android
- CVE-2023-21392In Bluetooth, there is a possible way to corrupt memory due to a use after free.Google Android
- CVE-2023-21391In Messaging, there is a possible way to disable the messaging application due to improper input validation.Google Android
- CVE-2023-21389In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check.Google Android
- CVE-2023-21388In Settings, there is a possible restriction bypass due to a missing permission check.Google Android
- CVE-2023-21387In User Backup Manager, there is a possible way to leak a token to bypass user confirmation for backup due to log information disclosure.Google Android
- CVE-2023-21385In Whitechapel, there is a possible out of bounds read due to memory corruption.Google Android
- CVE-2023-21384In Package Manager, there is a possible possible permissions bypass due to an unsafe PendingIntent.Google Android
- CVE-2023-21383In Settings, there is a possible way for the user to unintentionally send extra data due to an unclear prompt.Google Android
- CVE-2023-21382In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permissioGoogle Android
- CVE-2023-21381In Media Resource Manager, there is a possible local arbitrary code execution due to use after free.Google Android
- CVE-2023-21380In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow.Google Android
- CVE-2023-21379In Bluetooth, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-21378In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check.Google Android
- CVE-2023-21377In SELinux Policy, there is a possible restriction bypass due to a permissions bypass.Google Android
- CVE-2023-21376In Telephony, there is a possible way to retrieve the ICCID due to a logic error in the code.Google Android
- CVE-2023-21375In Sysproxy, there is a possible out of bounds write due to an integer underflow.Google Android
- CVE-2023-21374In System UI, there is a possible factory reset protection bypass due to a logic error in the code.Google Android
- CVE-2023-21373In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check.Google Android
- CVE-2023-21372In libdexfile, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-21371In Secure Element, there is a possible out of bounds write due to an integer overflow.Google Android
- CVE-2023-21370In the Security Element API, there is a possible out of bounds write due to an integer overflow.Google Android
- CVE-2023-21369In Usage Access, there is a possible way to display a Settings usage access restriction toggle screen due to a permissions bypass.Google Android
- CVE-2023-21368In Audio, there is a possible out of bounds read due to missing bounds check.Google Android
- CVE-2023-21367In Scudo, there is a possible way to exploit certain heap OOB read/write issues due to an insecure implementation/design.Google Android
- CVE-2023-21366In Scudo, there is a possible way for an attacker to predict heap allocation patterns due to insecure implementation/design.Google Android
- CVE-2023-21365In Contacts, there is a possible crash loop due to resource exhaustion.Google Android
- CVE-2023-21364In ContactsProvider, there is a possible crash loop due to resource exhaustion.Google Android
- CVE-2023-21362In Usage, there is a possible permanent DoS due to resource exhaustion.Google Android
- CVE-2023-21361In Bluetooth, there is a possibility of code-execution due to a use after free.Google Android
- CVE-2023-21360In Bluetooth, there is a possible out of bounds write due to improper input validation.Google Android
- CVE-2023-21359In Bluetooth, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-21357In NFC, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-21356In Bluetooth, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2023-21355In libaudioclient, there is a possible out of bounds write due to a use after free.Google Android
- CVE-2023-21354In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channelGoogle Android
- CVE-2023-21353In NFA, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-21352In NFA, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-21350In Media Projection, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informGoogle Android
- CVE-2023-21349In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informaGoogle Android
- CVE-2023-21348In Window Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatGoogle Android
- CVE-2023-21347In Bluetooth, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-21346In the Device Idle Controller, there is a possible way to determine whether an app is installed, without query permissions, due to side chanGoogle Android
- CVE-2023-21345In Game Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel inGoogle Android
- CVE-2023-21344In Job Scheduler, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatiGoogle Android
- CVE-2023-21343In ActivityStarter, there is a possible background activity launch due to an unsafe PendingIntent.Google Android
- CVE-2023-21340In Telecomm, there is a possible way to get the call state due to a missing permission check.Google Android
- CVE-2023-21338In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatioGoogle Android
- CVE-2023-21336In Input Method, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatioGoogle Android
- CVE-2023-21335In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information diGoogle Android
- CVE-2023-21334In App Ops Service, there is a possible disclosure of information about installed packages due to a logic error in the code.Google Android
- CVE-2023-21333In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatiGoogle Android
- CVE-2023-21332In Text Services, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatiGoogle Android
- CVE-2023-21331In InputMethod, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informationGoogle Android
- CVE-2023-21330In Overlay Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informaGoogle Android
- CVE-2023-21329In Activity Manager, there is a possible way to determine whether an app is installed due to a missing permission check.Google Android
- CVE-2023-21328In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permissiGoogle Android
- CVE-2023-21327In Permission Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel infoGoogle Android
- CVE-2023-21326In Package Manager Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channelGoogle Android
- CVE-2023-21325In Settings, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information diGoogle Android
- CVE-2023-21323In Activity Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informGoogle Android
- CVE-2023-21321In Package Manager, there is a possible cross-user settings disclosure due to a missing permission check.Google Android
- CVE-2023-21320In Device Policy, there is a possible way to verify if a particular admin app is registered on the device due to side channel information diGoogle Android
- CVE-2023-21319In UsageStatsService, there is a possible way to read installed 3rd party apps due to side channel information disclosure.Google Android
- CVE-2023-21318In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disGoogle Android
- CVE-2023-21317In ContentService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatGoogle Android
- CVE-2023-21316In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disGoogle Android
- CVE-2023-21315In Bluetooth, there is a possible out of bounds read due to a heap buffer overflow.Google Android
- CVE-2023-21314In Bluetooth, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-21313In Core, there is a possible way to forward calls without user knowledge due to a missing permission check.Google Android
- CVE-2023-21312In IntentResolver, there is a possible cross-user media read due to a confused deputy.Google Android
- CVE-2023-21311In Settings, there is a possible way to control private DNS settings from a secondary user due to a permissions bypass.Google Android
- CVE-2023-21310In Bluetooth, there is a possible out of bounds write due to a heap buffer overflow.Google Android
- CVE-2023-21309In libcore, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-21308In Composer, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-21307In Bluetooth, there is a possible way for a paired Bluetooth device to access a long term identifier for an Android device due to a permissiGoogle Android
- CVE-2023-21306In ContentService, there is a possible way to read installed sync content providers due to side channel information disclosure.Google Android
- CVE-2023-21305In Content, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disGoogle Android
- CVE-2023-21304In Content Service, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informaGoogle Android
- CVE-2023-21303In Content, here is a possible way to determine whether an app is installed, without query permissions, due to side channel information discGoogle Android
- CVE-2023-21302In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informaGoogle Android
- CVE-2023-21301In ActivityManagerService, there is a possible way to determine whether an app is installed, without query permissions, due to side channel Google Android
- CVE-2023-21300In PackageManager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informatGoogle Android
- CVE-2023-21299In Package Manager, there is a possible way to determine whether an app is installed, without query permissions, due to side channel informaGoogle Android
- CVE-2023-21297In SEPolicy, there is a possible way to access the factory MAC address due to a permissions bypass.Google Android
- CVE-2023-36920Clickjacking vulnerability in SAP Enable NowSAP SE SAP Enable Now
- CVE-2023-21296In Permission, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information Google Android
- CVE-2023-21295In SliceManagerService, there is a possible way to check if a content provider is installed due to a missing null check.Google Android
- CVE-2023-21294In Slice, there is a possible disclosure of installed packages due to a missing permission check.Google Android
- CVE-2023-21293In PackageManagerNative, there is a possible way to determine whether an app is installed, without query permissions, due to side channel inGoogle Android
- CVE-2022-20531In Telecom, there is a possible way to determine whether an app is installed, without query permissions, due to side channel information disGoogle Android
- CVE-2022-20264In Usage Stats Service, there is a possible way to determine whether an app is installed, without query permissions due to side channel infoGoogle Android
- CVE-2023-44323PDF Jbig2 memory-corruption Vulnerability - MSFT T5Adobe Acrobat for Edge
- CVE-2022-4575 A vulnerability due to improper write protection of UEFI variables was reported in the BIOS of some ThinkPad models could allow an attackerLenovo ThinkPad BIOS
- CVE-2022-48189An SMM driver input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated privLenovo ThinkPad BIOS
- CVE-2022-4574 An SMI handler input validation vulnerability in the BIOS of some ThinkPad models could allow an attacker with local access and elevated prLenovo ThinkPad BIOS
- CVE-2022-4573 An SMI handler input validation vulnerability in the ThinkPad X1 Fold Gen 1 could allow an attacker with local access and elevated privilegLenovo ThinkPad X1 Fold Gen
- CVE-2023-5251Grid Plus <= 1.3.2 - Missing Authorization to Authenticated (Subscriber+) Grid Layout Add/Update/Deleteg5theme Grid Plus – Unlimited grid layout
- CVE-2023-5362Carousel, Recent Post Slider and Banner Slider <= 2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodespicethemes Carousel, Recent Post Slider and Banner Slider
- CVE-2023-5335Buzzsprout Podcasting <= 1.8.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodemolehill Buzzsprout Podcasting
- CVE-2023-5666Accordion <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodethemepoints Accordions – Responsive Accordion & FAQ Plugin…
- CVE-2023-5049Giveaways and Contests by RafflePress <= 1.12.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesmub Giveaways and Contests by RafflePress – Get More Websi…
- CVE-2023-5566Simple Shortcodes <= 1.0.20 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesimplethemes Simple Shortcodes
- CVE-2023-5164Bellows Accordion Menu <= 1.4.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesevenspark Bellows Accordion Menu
- CVE-2023-5565Shortcode Menu <= 3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeamitsukapure Shortcode Menu
- CVE-2023-5252FareHarbor for WordPress <= 3.6.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeFareHarbor for WordPress
- CVE-2023-42431Potential XSS on user preferences pageHallo Welt! BlueSpice
- CVE-2023-5844Unverified Password Change in pimcore/admin-ui-classic-bundlepimcore/admin-ui-classic-bundle
- CVE-2023-45746Cross-site scripting vulnerability in Movable Type series allows a remote authenticated attacker to inject an arbitrary script.Six Apart Movable Type
- CVE-2023-44141Inkdrop prior to v5.6.0 allows a local attacker to conduct a code injection attack by having a legitimate user open a specially crafted markTakuya Matsuyama Inkdrop
- CVE-2021-25736Windows kube-proxy LoadBalancer contentionKubernetes · k8s.io/kubernetes
- CVE-2023-5842Cross-site Scripting (XSS) - Stored in dolibarr/dolibarrdolibarr/dolibarr
- CVE-2022-39172A stored XSS in the process overview (bersicht zugewiesener Vorgaenge) in mbsupport openVIVA c2 20220101 allows a remote, authenticated, low
- CVE-2023-46865/api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing th
- CVE-2023-46866In International Color Consortium DemoIccMAX 79ecb74, CIccCLUT::Interp3d in IccProfLib/IccTagLut.cpp in libSampleICC.a attempts to access ar
- CVE-2023-46867In International Color Consortium DemoIccMAX 79ecb74, CIccXformMatrixTRC::GetCurve in IccCmm.cpp in libSampleICC.a has a NULL pointer derefe
- CVE-2023-47090NATS nats-server before 2.9.23 and 2.10.x before 2.10.2 has an authentication bypass.github.com/nats-io/nats-server/v2