# CVEs published 2023-11-01 143 CVEs were published on November 1, 2023: 5 critical, 30 high. Days are UTC. - [CVE-2023-5910](https://cve.now/CVE-2023-5910.md): PopojiCMS Web Config install.php cross site scripting (CVSS 2.6, PopojiCMS) - [CVE-2023-45203](https://cve.now/CVE-2023-45203.md): Online Examination System v1.0 - Multiple Open Redirects (CVSS 6.1, Projectworlds Pvt. Limited Online Examination System) - [CVE-2023-45202](https://cve.now/CVE-2023-45202.md): Online Examination System v1.0 - Multiple Open Redirects (CVSS 6.1, Projectworlds Pvt. Limited Online Examination System) - [CVE-2023-45201](https://cve.now/CVE-2023-45201.md): Online Examination System v1.0 - Multiple Open Redirects (CVSS 6.1, Projectworlds Pvt. Limited Online Examination System) - [CVE-2023-1193](https://cve.now/CVE-2023-1193.md): Use-after-free in setup\_async\_work() (CVSS 6.5, Kernel · Red Hat Enterprise Linux +1) - [CVE-2023-46724](https://cve.now/CVE-2023-46724.md): SQUID-2023:4 Denial of Service in SSL Certificate validation (CVSS 8.6, squid-cache squid) - [CVE-2023-3397](https://cve.now/CVE-2023-3397.md): Kernel: slab-use-after-free write in txend due to race condition (CVSS 7.0, Red Hat Enterprise Linux) - [CVE-2023-1192](https://cve.now/CVE-2023-1192.md): Use-after-free in smb2\_is\_status\_io\_timeout() (CVSS 6.5, kernel · Red Hat Enterprise Linux +1) - [CVE-2023-5358](https://cve.now/CVE-2023-5358.md): Improper access control in Report log filters feature in Devolutions Server 2023.2.10.0 and earlier allows attackers to retrieve logs from v (no CVSS, Devolutions Server) - [CVE-2023-20083](https://cve.now/CVE-2023-20083.md): A vulnerability in ICMPv6 inspection when configured with the Snort 2 detection engine for Cisco Firepower Threat Defense (FTD) Software cou (CVSS 8.6, Cisco Firepower Threat Defense Software) - [CVE-2023-20267](https://cve.now/CVE-2023-20267.md): A vulnerability in the IP geolocation rules of Snort 3 could allow an unauthenticated, remote attacker to potentially bypass IP address rest (CVSS 4.0, Cisco Firepower Threat Defense Software) - [CVE-2023-20247](https://cve.now/CVE-2023-20247.md): A vulnerability in the remote access SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (CVSS 5.0, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…) - [CVE-2023-20095](https://cve.now/CVE-2023-20095.md): A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…) - [CVE-2023-5859](https://cve.now/CVE-2023-5859.md): Incorrect security UI in Picture In Picture in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing vi (no CVSS, Google Chrome) - [CVE-2023-5858](https://cve.now/CVE-2023-5858.md): Inappropriate implementation in WebApp Provider in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI (CVSS 4.3, Google Chrome) - [CVE-2023-5857](https://cve.now/CVE-2023-5857.md): Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially execute arbitrar (no CVSS, Google Chrome) - [CVE-2023-5856](https://cve.now/CVE-2023-5856.md): Use after free in Side Panel in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific U (CVSS 8.8, Google Chrome) - [CVE-2023-5855](https://cve.now/CVE-2023-5855.md): Use after free in Reading Mode in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific (CVSS 8.8, Google Chrome) - [CVE-2023-5854](https://cve.now/CVE-2023-5854.md): Use after free in Profiles in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI (CVSS 8.8, Google Chrome) - [CVE-2023-5853](https://cve.now/CVE-2023-5853.md): Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a crafted (no CVSS, Google Chrome) - [CVE-2023-5852](https://cve.now/CVE-2023-5852.md): Use after free in Printing in Google Chrome prior to 119.0.6045.105 allowed a remote attacker who convinced a user to engage in specific UI (CVSS 8.8, Google Chrome) - [CVE-2023-5851](https://cve.now/CVE-2023-5851.md): Inappropriate implementation in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to obfuscate security UI via a (no CVSS, Google Chrome) - [CVE-2023-5850](https://cve.now/CVE-2023-5850.md): Incorrect security UI in Downloads in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform domain spoofing via a craft (no CVSS, Google Chrome) - [CVE-2023-5849](https://cve.now/CVE-2023-5849.md): Integer overflow in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome) - [CVE-2023-5482](https://cve.now/CVE-2023-5482.md): Insufficient data validation in USB in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to perform out of bounds memory acces (CVSS 8.8, Google Chrome) - [CVE-2023-5480](https://cve.now/CVE-2023-5480.md): Inappropriate implementation in Payments in Google Chrome prior to 119.0.6045.105 allowed a remote attacker to bypass XSS preventions via a (no CVSS, Google Chrome) - [CVE-2023-20246](https://cve.now/CVE-2023-20246.md): Multiple Cisco products are affected by a vulnerability in Snort access control policies that could allow an unauthenticated, remote attacke (CVSS 5.8, Cisco Firepower Threat Defense Software · Cisco Umbrella In…) - [CVE-2023-20175](https://cve.now/CVE-2023-20175.md): A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the (CVSS 8.8, Cisco Identity Services Engine Software) - [CVE-2023-20170](https://cve.now/CVE-2023-20170.md): A vulnerability in a specific Cisco ISE CLI command could allow an authenticated, local attacker to perform command injection attacks on the (CVSS 6.0, Cisco Identity Services Engine Software) - [CVE-2023-5765](https://cve.now/CVE-2023-5765.md): Improper access control in the password analyzer feature in Devolutions Remote Desktop Manager 2023.2.33 and earlier on Windows allows an at (no CVSS, Devolutions Remote Desktop Manager) - [CVE-2023-20063](https://cve.now/CVE-2023-20063.md): Cisco Cisco Firepower Threat Defense Software and Cisco Firepower Management Center Code Injection Vulnerability (CVSS 8.2, Cisco Firepower Management Center · Cisco Firepower Threat…) - [CVE-2023-20042](https://cve.now/CVE-2023-20042.md): A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FT (CVSS 6.8, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…) - [CVE-2023-20264](https://cve.now/CVE-2023-20264.md): A vulnerability in the implementation of Security Assertion Markup Language (SAML) 2.0 single sign-on (SSO) for remote access VPN in Cisco A (CVSS 6.1, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…) - [CVE-2023-20220](https://cve.now/CVE-2023-20220.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authentica (CVSS 7.2, Cisco Firepower Management Center) - [CVE-2023-20219](https://cve.now/CVE-2023-20219.md): Multiple vulnerabilities in the web management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, r (CVSS 7.2, Cisco Firepower Management Center) - [CVE-2023-20070](https://cve.now/CVE-2023-20070.md): A vulnerability in the TLS 1.3 implementation of the Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote at (CVSS 4.0, Cisco Firepower Threat Defense Software) - [CVE-2023-5766](https://cve.now/CVE-2023-5766.md): A remote code execution vulnerability in Remote Desktop Manager 2023.2.33 and earlier on Windows allows an attacker to remotely execute co (CVSS 8.8, Devolutions Remote Desktop Manager) - [CVE-2023-20071](https://cve.now/CVE-2023-20071.md): Multiple Cisco products are affected by a vulnerability in the Snort detection engine that could allow an unauthenticated, remote attacker t (CVSS 5.8, Cisco Firepower Threat Defense Software · Cisco Umbrella… +2) - [CVE-2023-20048](https://cve.now/CVE-2023-20048.md): A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attac (CVSS 9.9, Cisco Firepower Management Center) - [CVE-2023-20031](https://cve.now/CVE-2023-20031.md): A vulnerability in the SSL/TLS certificate handling of Snort 3 Detection Engine integration with Cisco Firepower Threat Defense (FTD) Softwa (CVSS 4.0, Cisco Firepower Threat Defense Software) - [CVE-2023-20255](https://cve.now/CVE-2023-20255.md): A vulnerability in an API of the Web Bridge feature of Cisco Meeting Server could allow an unauthenticated, remote attacker to cause a denia (CVSS 5.3, Cisco Meeting Server) - [CVE-2023-20196](https://cve.now/CVE-2023-20196.md): Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. (CVSS 4.7, Cisco Identity Services Engine Software) - [CVE-2023-20195](https://cve.now/CVE-2023-20195.md): Two vulnerabilities in Cisco ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. (CVSS 4.7, Cisco Identity Services Engine Software) - [CVE-2023-20213](https://cve.now/CVE-2023-20213.md): A vulnerability in the CDP processing feature of Cisco ISE could allow an unauthenticated, adjacent attacker to cause a denial of service (D (CVSS 4.3, Cisco Identity Services Engine Software) - [CVE-2023-20245](https://cve.now/CVE-2023-20245.md): Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Def (CVSS 5.8, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…) - [CVE-2023-20256](https://cve.now/CVE-2023-20256.md): Multiple vulnerabilities in the per-user-override feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Def (CVSS 5.0, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…) - [CVE-2023-20005](https://cve.now/CVE-2023-20005.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenti (CVSS 4.8, Cisco Firepower Management Center) - [CVE-2023-20074](https://cve.now/CVE-2023-20074.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenti (CVSS 4.8, Cisco Firepower Management Center) - [CVE-2023-20206](https://cve.now/CVE-2023-20206.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenti (CVSS 6.1, Cisco Firepower Management Center) - [CVE-2023-20041](https://cve.now/CVE-2023-20041.md): Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an unauthenti (CVSS 4.8, Cisco Firepower Management Center) - [CVE-2023-20270](https://cve.now/CVE-2023-20270.md): A vulnerability in the interaction between the Server Message Block (SMB) protocol preprocessor and the Snort 3 detection engine for Cisco F (CVSS 5.8, Cisco Firepower Threat Defense Software) - [CVE-2023-20244](https://cve.now/CVE-2023-20244.md): A vulnerability in the internal packet processing of Cisco Firepower Threat Defense (FTD) Software for Cisco Firepower 2100 Series Firewalls (CVSS 8.6, Cisco Firepower Threat Defense Software) - [CVE-2023-20155](https://cve.now/CVE-2023-20155.md): A vulnerability in a logging API in Cisco Firepower Management Center (FMC) Software could allow an unauthenticated, remote attacker to caus (CVSS 7.5, Cisco Firepower Management Center) - [CVE-2023-20114](https://cve.now/CVE-2023-20114.md): A vulnerability in the file download feature of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attack (CVSS 6.5, Cisco Firepower Management Center) - [CVE-2023-20086](https://cve.now/CVE-2023-20086.md): A vulnerability in ICMPv6 processing of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software c (CVSS 8.6, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…) - [CVE-2023-20177](https://cve.now/CVE-2023-20177.md): A vulnerability in the SSL file policy implementation of Cisco Firepower Threat Defense (FTD) Software that occurs when the SSL/TLS connecti (CVSS 4.0, Cisco Firepower Threat Defense Software) - [CVE-2023-5178](https://cve.now/CVE-2023-5178.md): Kernel: use after free in nvmet\_tcp\_free\_crypto in nvme (CVSS 8.8, Red Hat Enterprise Linux · Red Hat Virtualization 4 for Red…) - [CVE-2023-3972](https://cve.now/CVE-2023-3972.md): Insights-client: unsafe handling of temporary files and directories (CVSS 7.8, Red Hat Enterprise Linux) - [CVE-2023-33228](https://cve.now/CVE-2023-33228.md): SolarWinds Network Configuration Manager Sensitive Information Disclosure Vulnerability (CVSS 4.5, SolarWinds Network Configuration Manager) - [CVE-2023-33227](https://cve.now/CVE-2023-33227.md): Directory Traversal Remote Code Execution Vulnerability (CVSS 8.0, SolarWinds Network Configuration Manager) - [CVE-2023-33226](https://cve.now/CVE-2023-33226.md): Directory Traversal Remote Code Execution Vulnerability (CVSS 8.0, SolarWinds Network Configuration Manager) - [CVE-2023-5847](https://cve.now/CVE-2023-5847.md): Under certain conditions, a low privileged attacker could load a specially crafted file during installation or upgrade to escalate privileg (CVSS 6.7, Tenable Nessus) - [CVE-2023-40061](https://cve.now/CVE-2023-40061.md): Insecure Job Execution Mechanism Vulnerability (CVSS 8.8, SolarWinds Platform) - [CVE-2023-40062](https://cve.now/CVE-2023-40062.md): Incomplete List of Disallowed Inputs Remote Code Execution Vulnerability (CVSS 8.0, SolarWinds Platform) - [CVE-2023-5627](https://cve.now/CVE-2023-5627.md): Incorrect Implementation of Authentication Algorithm Vulnerability (CVSS 7.5, Moxa NPort 6000 Series) - [CVE-2023-4452](https://cve.now/CVE-2023-4452.md): Web Server Buffer Overflow Vulnerability (CVSS 6.5, Moxa EDR-810 Series · Moxa EDR G902 Series +1) - [CVE-2023-5625](https://cve.now/CVE-2023-5625.md): Python-eventlet: patch regression for cve-2021-21419 in some red hat builds (CVSS 5.3, Ironic content for Red Hat OpenShift Container Platform · R…) - [CVE-2023-42655](https://cve.now/CVE-2023-42655.md): In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. (CVSS 6.7, Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000) - [CVE-2023-42654](https://cve.now/CVE-2023-42654.md): In dm service, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2022-48461](https://cve.now/CVE-2022-48461.md): In sensor driver, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2022-48460](https://cve.now/CVE-2022-48460.md): In setting service, there is a possible undefined behavior due to incorrect error handling. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2022-48459](https://cve.now/CVE-2022-48459.md): In TeleService, there is a possible system crash due to improper input validation. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2022-48458](https://cve.now/CVE-2022-48458.md): In TeleService, there is a possible system crash due to improper input validation. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2022-48457](https://cve.now/CVE-2022-48457.md): In TeleService, there is a possible system crash due to improper input validation. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2022-48456](https://cve.now/CVE-2022-48456.md): In camera driver, there is a possible out of bounds write due to a incorrect bounds check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2022-48455](https://cve.now/CVE-2022-48455.md): In wifi service, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2022-48454](https://cve.now/CVE-2022-48454.md): In wifi service, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42750](https://cve.now/CVE-2023-42750.md): In gnss service, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42653](https://cve.now/CVE-2023-42653.md): In faceid service, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42652](https://cve.now/CVE-2023-42652.md): In engineermode, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42651](https://cve.now/CVE-2023-42651.md): In engineermode, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42650](https://cve.now/CVE-2023-42650.md): In engineermode, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42649](https://cve.now/CVE-2023-42649.md): In engineermode, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42648](https://cve.now/CVE-2023-42648.md): In engineermode, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42647](https://cve.now/CVE-2023-42647.md): In Ifaa service, there is a possible way to write permission usage records of an app due to a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42646](https://cve.now/CVE-2023-42646.md): In Ifaa service, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42645](https://cve.now/CVE-2023-42645.md): In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. T760/T770/T820/S8000) - [CVE-2023-42644](https://cve.now/CVE-2023-42644.md): In dm service, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42643](https://cve.now/CVE-2023-42643.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42642](https://cve.now/CVE-2023-42642.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42641](https://cve.now/CVE-2023-42641.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42640](https://cve.now/CVE-2023-42640.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42639](https://cve.now/CVE-2023-42639.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42638](https://cve.now/CVE-2023-42638.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42637](https://cve.now/CVE-2023-42637.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42636](https://cve.now/CVE-2023-42636.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42635](https://cve.now/CVE-2023-42635.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42634](https://cve.now/CVE-2023-42634.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42633](https://cve.now/CVE-2023-42633.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42632](https://cve.now/CVE-2023-42632.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-42631](https://cve.now/CVE-2023-42631.md): In validationtools, there is a possible missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…) - [CVE-2023-1720](https://cve.now/CVE-2023-1720.md): Bitrix24 Stored Cross-Site Scripting (XSS) via File Upload (CVSS 9.6, Bitrix24) - [CVE-2023-1719](https://cve.now/CVE-2023-1719.md): Bitrix24 Insecure Global Variable Extraction (CVSS 7.5, Bitrix24) - [CVE-2023-1718](https://cve.now/CVE-2023-1718.md): Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access (CVSS 7.5, Bitrix24) - [CVE-2023-1717](https://cve.now/CVE-2023-1717.md): Bitrix24 Cross-Site Scripting (XSS) via Client-side Prototype Pollution (CVSS 9.6, Bitrix24) - [CVE-2023-1716](https://cve.now/CVE-2023-1716.md): Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (2 of 2) (CVSS 9.0, Bitrix24) - [CVE-2023-1715](https://cve.now/CVE-2023-1715.md): Bitrix24 Stored Cross-Site Scripting (XSS) via Improper Input Neutralization on Invoice Edit Page (1 of 2) (CVSS 9.0, Bitrix24) - [CVE-2023-1714](https://cve.now/CVE-2023-1714.md): Bitrix24 Remote Command Execution (RCE) via Unsafe Variable Extraction (CVSS 8.8, Bitrix24) - [CVE-2023-1713](https://cve.now/CVE-2023-1713.md): Bitrix24 Remote Command Execution (RCE) via Insecure Temporary File Creation (CVSS 8.8, Bitrix24) - [CVE-2023-4198](https://cve.now/CVE-2023-4198.md): Dolibarr ERP CRM (\<= 17.0.3) Improper Access Control (CVSS 6.5, Dolibarr ERP CRM · dolibarr/dolibarr) - [CVE-2023-4197](https://cve.now/CVE-2023-4197.md): Dolibarr ERP CRM (\<= 18.0.1) Improper Input Sanitization Authenticated RCE (CVSS 7.5, Dolibarr ERP CRM · dolibarr/dolibarr) - [CVE-2023-5516](https://cve.now/CVE-2023-5516.md): Poorly constructed webap requests and URI components with special characters trigger unhandled errors and exceptions, disclosing informatio (CVSS 5.3, Hitachi Energy eSOMS) - [CVE-2023-5515](https://cve.now/CVE-2023-5515.md): The responses for web queries with certain parameters disclose internal path of resources. (CVSS 5.3, Hitachi Energy eSOMS) - [CVE-2023-5514](https://cve.now/CVE-2023-5514.md): The response messages received from the eSOMS report generation using certain parameter queries with full file path can be abused for enume (CVSS 5.3, Hitachi Energy eSOMS) - [CVE-2023-2622](https://cve.now/CVE-2023-2622.md): Authenticated clients can read arbitrary files on the MAIN Computer system using the remote procedure call (RPC) of the InspectSetup servic (CVSS 2.7, Hitachi Energy MACH System Software) - [CVE-2023-2621](https://cve.now/CVE-2023-2621.md): The McFeeder server (distributed as part of SSW package), is susceptible to an arbitrary file write vulnerability on the MAIN computer syst (CVSS 6.5, Hitachi Energy MACH System Software) - [CVE-2023-5904](https://cve.now/CVE-2023-5904.md): Cross-site Scripting (XSS) - Stored in pkp/pkp-lib (CVSS 2.7, pkp/pkp-lib) - [CVE-2023-5903](https://cve.now/CVE-2023-5903.md): Cross-site Scripting (XSS) - Stored in pkp/pkp-lib (CVSS 2.7, pkp/pkp-lib) - [CVE-2023-5900](https://cve.now/CVE-2023-5900.md): Cross-Site Request Forgery in pkp/pkp-lib (CVSS 3.5, pkp/pkp-lib) - [CVE-2023-5901](https://cve.now/CVE-2023-5901.md): Cross-site Scripting in pkp/pkp-lib (CVSS 3.5, pkp/pkp-lib) - [CVE-2023-5897](https://cve.now/CVE-2023-5897.md): Cross-Site Request Forgery (CSRF) in pkp/customLocale (CVSS 6.3, pkp/customLocale) - [CVE-2023-5898](https://cve.now/CVE-2023-5898.md): Cross-Site Request Forgery (CSRF) in pkp/pkp-lib (CVSS 3.5, pkp/pkp-lib) - [CVE-2023-5902](https://cve.now/CVE-2023-5902.md): Cross-Site Request Forgery (CSRF) in pkp/pkp-lib (CVSS 4.3, pkp/pkp-lib) - [CVE-2023-5896](https://cve.now/CVE-2023-5896.md): Cross-site Scripting (XSS) - Stored in pkp/pkp-lib (CVSS 2.7, pkp/pkp-lib) - [CVE-2023-5899](https://cve.now/CVE-2023-5899.md): Cross-Site Request Forgery (CSRF) in pkp/pkp-lib (CVSS 3.5, pkp/pkp-lib) - [CVE-2023-5895](https://cve.now/CVE-2023-5895.md): Cross-site Scripting (XSS) - DOM in pkp/pkp-lib (CVSS 3.5, pkp/pkp-lib) - [CVE-2023-5894](https://cve.now/CVE-2023-5894.md): Cross-site Scripting (XSS) - Stored in pkp/ojs (CVSS 3.5, pkp/ojs) - [CVE-2023-5889](https://cve.now/CVE-2023-5889.md): Insufficient Session Expiration in pkp/pkp-lib (CVSS 4.3, pkp/pkp-lib) - [CVE-2023-5891](https://cve.now/CVE-2023-5891.md): Cross-site Scripting (XSS) - Reflected in pkp/pkp-lib (CVSS 5.4, pkp/pkp-lib) - [CVE-2023-5892](https://cve.now/CVE-2023-5892.md): Cross-site Scripting (XSS) - Stored in pkp/pkp-lib (CVSS 5.4, pkp/pkp-lib) - [CVE-2023-5893](https://cve.now/CVE-2023-5893.md): Cross-Site Request Forgery (CSRF) in pkp/pkp-lib (CVSS 3.5, pkp/pkp-lib) - [CVE-2023-5890](https://cve.now/CVE-2023-5890.md): Cross-site Scripting (XSS) - Stored in pkp/pkp-lib (CVSS 4.6, pkp/pkp-lib) - [CVE-2023-39281](https://cve.now/CVE-2023-39281.md): A stack buffer overflow vulnerability discovered in AsfSecureBootDxe in Insyde InsydeH2O with kernel 5.0 through 5.5 allows attackers to run (CVSS 5.7) - [CVE-2023-44025](https://cve.now/CVE-2023-44025.md): SQL injection vulnerability in addify Addifyfreegifts v.1.0.2 and before allows a remote attacker to execute arbitrary code via a crafted sc (no CVSS) - [CVE-2023-44954](https://cve.now/CVE-2023-44954.md): Cross Site Scripting vulnerability in BigTree CMS v.4.5.7 allows a remote attacker to execute arbitrary code via the ID parameter in the Dev (CVSS 5.4) - [CVE-2023-46428](https://cve.now/CVE-2023-46428.md): An arbitrary file upload vulnerability in HadSky v7.12.10 allows attackers to execute arbitrary code via a crafted file. (no CVSS) - [CVE-2023-46448](https://cve.now/CVE-2023-46448.md): Reflected Cross-Site Scripting (XSS) vulnerability in dmpop Mejiro Commit Versions Prior To 3096393 allows attackers to run arbitrary code v (CVSS 6.1) - [CVE-2023-46482](https://cve.now/CVE-2023-46482.md): SQL injection vulnerability in wuzhicms v.4.1.0 allows a remote attacker to execute arbitrary code via the Database Backup Functionality in (no CVSS) - [CVE-2023-46911](https://cve.now/CVE-2023-46911.md): There is a Cross Site Scripting (XSS) vulnerability in the choose\_style\_tree.do interface of Jspxcms v10.2.0 backend. (no CVSS) - [CVE-2023-46927](https://cve.now/CVE-2023-46927.md): GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in gf\_isom\_use\_compact\_size gpac/src/isomedia/isom\_write.c:3403:3 in g (CVSS 5.5) - [CVE-2023-46928](https://cve.now/CVE-2023-46928.md): GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf\_media\_change\_pl /afltest/gpac/src/media\_tools/isom\_tools.c:3293:4 (CVSS 5.5) - [CVE-2023-46930](https://cve.now/CVE-2023-46930.md): GPAC 2.3-DEV-rev605-gfc9e29089-master contains a SEGV in gpac/MP4Box in gf\_isom\_find\_od\_id\_for\_track /afltest/gpac/src/isomedia/media\_odf.c: (CVSS 5.5) - [CVE-2023-46931](https://cve.now/CVE-2023-46931.md): GPAC 2.3-DEV-rev605-gfc9e29089-master contains a heap-buffer-overflow in ffdmx\_parse\_side\_data /afltest/gpac/src/filters/ff\_dmx.c:202:14 in (CVSS 5.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2023-11-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.