CVEs published November 1, 2023
143 CVEs were published on November 1, 2023: 5 critical, 30 high.
- Published
- 143
- Critical
- 5
- High
- 30
- Medium
- 51
- Low
- 12
- Unrated
- 45
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- 32
- pkp/pkp-lib
- 14
- Google Chrome
- 13
- Cisco Firepower Management Center
- 9
- Bitrix24
- 8
- Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- 7
- Cisco Firepower Threat Defense Software
- 7
- Cisco Identity Services Engine Software
- 5
- Hitachi Energy eSOMS
- 3
- Projectworlds Pvt. Limited Online Examination System
- 3
Critical 5
- CVE-2023-20048A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacCisco Firepower Management Center
- CVE-2023-1720Bitrix24 Stored Cross-Site Scripting (XSS) via File UploadBitrix24
- CVE-2023-1717Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype PollutionBitrix24
- CVE-2023-1716Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2)Bitrix24
- CVE-2023-1715Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2)Bitrix24
High 30
- CVE-2023-46724SQUID-2023:4 Denial of Service in SSL Certificate validationsquid-cache squid
- CVE-2023-3397Kernel: slab-use-after-free write in txend due to race conditionRed Hat Enterprise Linux
- CVE-2023-20083A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software couCisco Firepower Threat Defense Software
- CVE-2023-20095A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTDCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2023-5856Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UGoogle Chrome
- CVE-2023-5855Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specificGoogle Chrome
- CVE-2023-5854Use after free in Profiles in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI Google Chrome
- CVE-2023-5852Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI Google Chrome
- CVE-2023-5849Integer overflow in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2023-5482Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory accesGoogle Chrome
- CVE-2023-20175A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on theCisco Identity Services Engine Software
- CVE-2023-20063Cisco Cisco Firepower Threat Defense Software and Cisco Firepower Management Center Code Injection VulnerabilityCisco Firepower Management Center · Cisco Firepower Threat…
- CVE-2023-20220Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticaCisco Firepower Management Center
- CVE-2023-20219Multiple vulnerabilities in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, rCisco Firepower Management Center
- CVE-2023-5766 A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute coDevolutions Remote Desktop Manager
- CVE-2023-20244A vulnerability in the internal packet processing of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series FirewallsCisco Firepower Threat Defense Software
- CVE-2023-20155A vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to causCisco Firepower Management Center
- CVE-2023-20086A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software cCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2023-5178Kernel: use after free in nvmet_tcp_free_crypto in nvmeRed Hat Enterprise Linux · Red Hat Virtualization 4 for Red…
- CVE-2023-3972Insights-client: unsafe handling of temporary files and directoriesRed Hat Enterprise Linux
- CVE-2023-33227Directory Traversal Remote Code Execution VulnerabilitySolarWinds Network Configuration Manager
- CVE-2023-33226Directory Traversal Remote Code Execution VulnerabilitySolarWinds Network Configuration Manager
- CVE-2023-40061Insecure Job Execution Mechanism Vulnerability SolarWinds Platform
- CVE-2023-40062Incomplete List of Disallowed Inputs Remote Code Execution VulnerabilitySolarWinds Platform
- CVE-2023-5627Incorrect Implementation of Authentication Algorithm VulnerabilityMoxa NPort 6000 Series
- CVE-2023-1719Bitrix24 Insecure Global Variable ExtractionBitrix24
- CVE-2023-1718Bitrix24 Denial-of-Service (DoS) via Improper File Stream AccessBitrix24
- CVE-2023-1714Bitrix24 Remote Command Execution (RCE) via Unsafe Variable ExtractionBitrix24
- CVE-2023-1713Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File CreationBitrix24
- CVE-2023-4197Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCEDolibarr ERP CRM · dolibarr/dolibarr
Medium, low and unrated 108
- CVE-2023-5910PopojiCMS Web Config install.php cross site scriptingPopojiCMS
- CVE-2023-45203Online Examination System v1.0 - Multiple Open RedirectsProjectworlds Pvt. Limited Online Examination System
- CVE-2023-45202Online Examination System v1.0 - Multiple Open RedirectsProjectworlds Pvt. Limited Online Examination System
- CVE-2023-45201Online Examination System v1.0 - Multiple Open RedirectsProjectworlds Pvt. Limited Online Examination System
- CVE-2023-1193Use-after-free in setup_async_work()Kernel · Red Hat Enterprise Linux +1
- CVE-2023-1192Use-after-free in smb2_is_status_io_timeout()kernel · Red Hat Enterprise Linux +1
- CVE-2023-5358Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from vDevolutions Server
- CVE-2023-20267A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially bypass IP address restCisco Firepower Threat Defense Software
- CVE-2023-20247A vulnerability in the remote access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2023-5859Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing viGoogle Chrome
- CVE-2023-5858Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI Google Chrome
- CVE-2023-5857Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrarGoogle Chrome
- CVE-2023-5853Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a craftedGoogle Chrome
- CVE-2023-5851Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a Google Chrome
- CVE-2023-5850Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a craftGoogle Chrome
- CVE-2023-5480Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a Google Chrome
- CVE-2023-20246Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attackeCisco Firepower Threat Defense Software · Cisco Umbrella In…
- CVE-2023-20170A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on theCisco Identity Services Engine Software
- CVE-2023-5765Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an atDevolutions Remote Desktop Manager
- CVE-2023-20042A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2023-20264A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco ACisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2023-20070A vulnerability in the TLS 1.3 implementation of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote atCisco Firepower Threat Defense Software
- CVE-2023-20071Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker tCisco Firepower Threat Defense Software · Cisco Umbrella… +2
- CVE-2023-20031A vulnerability in the SSL/TLS certificate handling of Snort 3 Detection Engine integration with Cisco Firepower Threat Defense (FTD) SoftwaCisco Firepower Threat Defense Software
- CVE-2023-20255A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a deniaCisco Meeting Server
- CVE-2023-20196Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device.Cisco Identity Services Engine Software
- CVE-2023-20195Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device.Cisco Identity Services Engine Software
- CVE-2023-20213A vulnerability in the CDP processing feature of Cisco ISE could allow an unauthenticated, adjacent attacker to cause a denial of service (DCisco Identity Services Engine Software
- CVE-2023-20245Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2023-20256Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat DefCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2023-20005Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiCisco Firepower Management Center
- CVE-2023-20074Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiCisco Firepower Management Center
- CVE-2023-20206Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiCisco Firepower Management Center
- CVE-2023-20041Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthentiCisco Firepower Management Center
- CVE-2023-20270A vulnerability in the interaction between the Server Message Block (SMB) protocol preprocessor and the Snort 3 detection engine for Cisco FCisco Firepower Threat Defense Software
- CVE-2023-20114A vulnerability in the file download feature of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attackCisco Firepower Management Center
- CVE-2023-20177A vulnerability in the SSL file policy implementation of Cisco Firepower Threat Defense (FTD) Software that occurs when the SSL/TLS connectiCisco Firepower Threat Defense Software
- CVE-2023-33228SolarWinds Network Configuration Manager Sensitive Information Disclosure VulnerabilitySolarWinds Network Configuration Manager
- CVE-2023-5847 Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privilegTenable Nessus
- CVE-2023-4452Web Server Buffer Overflow VulnerabilityMoxa EDR-810 Series · Moxa EDR G902 Series +1
- CVE-2023-5625Python-eventlet: patch regression for cve-2021-21419 in some red hat buildsIronic content for Red Hat OpenShift Container Platform · R…
- CVE-2023-42655In sim service, there is a possible way to write permission usage records of an app due to a missing permission check.Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000
- CVE-2023-42654In dm service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2022-48461In sensor driver, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2022-48460In setting service, there is a possible undefined behavior due to incorrect error handling.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2022-48459In TeleService, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2022-48458In TeleService, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2022-48457In TeleService, there is a possible system crash due to improper input validation.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2022-48456In camera driver, there is a possible out of bounds write due to a incorrect bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2022-48455In wifi service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2022-48454In wifi service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42750In gnss service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42653In faceid service, there is a possible out of bounds write due to a missing bounds check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42652In engineermode, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42651In engineermode, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42650In engineermode, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42649In engineermode, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42648In engineermode, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42647In Ifaa service, there is a possible way to write permission usage records of an app due to a missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42646In Ifaa service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42645In sim service, there is a possible way to write permission usage records of an app due to a missing permission check.Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000
- CVE-2023-42644In dm service, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42643In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42642In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42641In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42640In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42639In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42638In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42637In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42636In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42635In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42634In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42633In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42632In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-42631In validationtools, there is a possible missing permission check.Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…
- CVE-2023-4198Dolibarr ERP CRM (<= 17.0.3) Improper Access ControlDolibarr ERP CRM · dolibarr/dolibarr
- CVE-2023-5516 Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing informatioHitachi Energy eSOMS
- CVE-2023-5515 The responses for web queries with certain parameters disclose internal path of resources.Hitachi Energy eSOMS
- CVE-2023-5514 The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enumeHitachi Energy eSOMS
- CVE-2023-2622 Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup servicHitachi Energy MACH System Software
- CVE-2023-2621 The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer systHitachi Energy MACH System Software
- CVE-2023-5904Cross-site Scripting (XSS) - Stored in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5903Cross-site Scripting (XSS) - Stored in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5900Cross-Site Request Forgery in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5901Cross-site Scripting in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5897Cross-Site Request Forgery (CSRF) in pkp/customLocalepkp/customLocale
- CVE-2023-5898Cross-Site Request Forgery (CSRF) in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5902Cross-Site Request Forgery (CSRF) in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5896Cross-site Scripting (XSS) - Stored in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5899Cross-Site Request Forgery (CSRF) in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5895Cross-site Scripting (XSS) - DOM in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5894Cross-site Scripting (XSS) - Stored in pkp/ojspkp/ojs
- CVE-2023-5889Insufficient Session Expiration in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5891Cross-site Scripting (XSS) - Reflected in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5892Cross-site Scripting (XSS) - Stored in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5893Cross-Site Request Forgery (CSRF) in pkp/pkp-libpkp/pkp-lib
- CVE-2023-5890Cross-site Scripting (XSS) - Stored in pkp/pkp-libpkp/pkp-lib
- CVE-2023-39281A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run
- CVE-2023-44025SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted sc
- CVE-2023-44954Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Dev
- CVE-2023-46428An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file.
- CVE-2023-46448Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code v
- CVE-2023-46482SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in
- CVE-2023-46911There is a Cross Site Scripting (XSS) vulnerability in the choose_style_tree.do interface of Jspxcms v10.2.0 backend.
- CVE-2023-46927GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf_isom_use_compact_size gpac/src/isomedia/isom_write.c:3403:3 in g
- CVE-2023-46928GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_media_change_pl /afltest/gpac/src/media_tools/isom_tools.c:3293:4
- CVE-2023-46930GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf_isom_find_od_id_for_track /afltest/gpac/src/isomedia/media_odf.c:
- CVE-2023-46931GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in ffdmx_parse_side_data /afltest/gpac/src/filters/ff_dmx.c:202:14 in