CVEs published November 2, 2023
96 CVEs were published on November 2, 2023: 21 critical, 12 high.
- Published
- 96
- Critical
- 21
- High
- 12
- Medium
- 38
- Low
- 7
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Projectworlds Pvt. Limited Online Food Ordering System
- 13
- OX Software OX App Suite
- 10
- Campcodes Simple Student Information System
- 8
- NVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…
- 7
- avahi · Red Hat Enterprise Linux +1
- 5
- Projectworlds Pvt. Limited Online Bus Booking System
- 4
- Mattermost Desktop
- 3
- nvidia vGPU driver and Cloud gaming driver
- 3
- Dell PowerScale OneFS
- 2
- IBM CICS TX Standard · IBM CICS TX Advanced +1
- 2
Critical 21
- CVE-2023-45347Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45346Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45345Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45338Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45343Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45341Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45344Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45342Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45340Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-42802GLPI vulnerable to unallowed PHP script executionglpi-project glpi
- CVE-2023-45336Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45334Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45325Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45323Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Food Ordering System
- CVE-2023-45019Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Bus Booking System
- CVE-2023-45018Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Bus Booking System
- CVE-2023-45015Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Bus Booking System
- CVE-2023-45012Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Bus Booking System
- CVE-2023-45111Online Examination System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Examination System
- CVE-2023-46958An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file.
- CVE-2023-47204Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code.transmute-core
High 12
- CVE-2023-31027CVENVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…
- CVE-2023-31019CVENVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…
- CVE-2023-31017CVENVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…
- CVE-2023-31016CVENVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…
- CVE-2023-5846Use of Password Hash With Insufficient Computational Effort in Franklin Fueling System TS-550Franklin Fueling System TS-550
- CVE-2023-46725FoodCoopShop Server-Side Request Forgery vulnerabilityfoodcoopshop · foodcoopshop/foodcoopshop
- CVE-2023-26454Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked.OX Software OX App Suite
- CVE-2023-26453Requests to cache an image could be abused to include SQL queries that would be executed unchecked.OX Software OX App Suite
- CVE-2023-26452Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked.OX Software OX App Suite
- CVE-2023-5860Icons Font Loader <= 1.1.2 - Authenticated (Administrator+) Arbitrary File Uploadbplugins Icons Font Loader – Load Web Fonts and Icon Librar…
- CVE-2023-5408Openshift: modification of node role labelsRed Hat OpenShift Container Platform
- CVE-2023-46352In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from Smar
Medium, low and unrated 63
- CVE-2023-43018IBM CICS TX privilege escalationIBM CICS TX Standard · IBM CICS TX Advanced
- CVE-2023-42029IBM CICS TX cross-site scriptingIBM CICS TX Standard · IBM CICS TX Advanced +1
- CVE-2023-42027IBM CICS TX cross-site request forgeryIBM CICS TX Standard · IBM CICS TX Advanced +1
- CVE-2023-5930Campcodes Simple Student Information System manage_academic.php cross site scriptingCampcodes Simple Student Information System
- CVE-2023-5929Campcodes Simple Student Information System manage_academic.php sql injectionCampcodes Simple Student Information System
- CVE-2023-5928Campcodes Simple Student Information System manage_department.php sql injectionCampcodes Simple Student Information System
- CVE-2023-5927Campcodes Simple Student Information System manage_course.php sql injectionCampcodes Simple Student Information System
- CVE-2023-5926Campcodes Simple Student Information System update_status.php sql injectionCampcodes Simple Student Information System
- CVE-2023-5925Campcodes Simple Student Information System Master.php sql injectionCampcodes Simple Student Information System
- CVE-2023-31026CVEnvidia vGPU driver and Cloud gaming driver
- CVE-2023-31023CVENVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…
- CVE-2023-31022CVENVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…
- CVE-2023-31021CVEnvidia vGPU driver and Cloud gaming driver
- CVE-2023-31020CVENVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…
- CVE-2023-31018CVEnvidia vGPU driver and Cloud gaming driver
- CVE-2023-5924Campcodes Simple Student Information System view_course.php sql injectionCampcodes Simple Student Information System
- CVE-2023-5923Campcodes Simple Student Information System index.php sql injectionCampcodes Simple Student Information System
- CVE-2023-5035Cookie Without Secure FlagMoxa PT-G503 Series
- CVE-2023-4217Session cookies attribute not set properlyMoxa PT-G503 Series
- CVE-2022-4900Potential buffer overflow in php_cli_server_startup_workersphp · Red Hat Enterprise Linux +2
- CVE-2023-38473Reachable assertion in avahi_alternative_host_nameavahi · Red Hat Enterprise Linux +1
- CVE-2023-38472Reachable assertion in avahi_rdata_parseavahi · Red Hat Enterprise Linux +1
- CVE-2023-38471Reachable assertion in dbus_set_host_nameavahi · Red Hat Enterprise Linux +1
- CVE-2023-38470Reachable assertion in avahi_escape_labelavahi · Red Hat Enterprise Linux +1
- CVE-2023-38469Reachable assertion in avahi_dns_packet_append_recordavahi · Red Hat Enterprise Linux +1
- CVE-2023-5919SourceCodester Company Website CMS Create Blog Page createblog unrestricted uploadSourceCodester Company Website CMS
- CVE-2023-29047Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrarOX Software OX App Suite
- CVE-2023-29046Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connectioOX Software OX App Suite
- CVE-2023-29045Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code.OX Software OX App Suite
- CVE-2023-29044Documents operations could be manipulated to contain invalid data types, possibly script code.OX Software OX App Suite
- CVE-2023-29043Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed wOX Software OX App Suite
- CVE-2023-26456Users were able to set an arbitrary "product name" for OX Guard.OX Software OX App Suite
- CVE-2023-26455RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer.OX Software OX App Suite
- CVE-2023-3164Heap-buffer-overflow in extractimagesection()libtiff · Red Hat Enterprise Linux +1
- CVE-2023-5918SourceCodester Visitor Management System manage_user.php sql injectionSourceCodester Visitor Management System
- CVE-2023-43076 Dell PowerScale OneFS 8.2.x,9.0.0.x-9.5.0.x contains a denial-of-service vulnerability.Dell PowerScale OneFS
- CVE-2023-5917phpBB Smiley Pack acp_icons.php main cross site scriptingphpBB · phpbb/phpbb
- CVE-2023-5916Lissy93 Dashy Configuration save access controlLissy93 Dashy
- CVE-2023-43087 Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions.Dell PowerScale OneFS
- CVE-2023-5920Lack Of Secure Keyboard Entry Protection in MacOS DesktopMattermost Desktop
- CVE-2023-5606The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficiequantumcloud AI ChatBot
- CVE-2023-5875Lack of Hardening against media exploitation from a remote originMattermost Desktop
- CVE-2023-5876Regex DoS from a malicious server enrolled in DesktopMattermost Desktop
- CVE-2023-46595Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editorAlgosec FireFlow
- CVE-2023-46327Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp.FUJIFILM Business Inovation Apeos C3070 Asia Pacific M… +159
- CVE-2023-31579Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token.top.tangyh.basic:lamp-core · top.tangyh.basic:lamp-util
- CVE-2023-39042An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39047An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39048An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39050An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39051An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted m
- CVE-2023-39053An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39054An information leak in Tokudaya.ekimae_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39057An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages.
- CVE-2023-39283An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 al
- CVE-2023-39284An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2023-42299Buffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of servic
- CVE-2023-43193Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-43194Submitty before v22.06.00 is vulnerable to Incorrect Access Control.
- CVE-2023-43336Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modif
- CVE-2023-46475A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the pr
- CVE-2023-46695An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.django
- CVE-2023-46925Reportico 7.1.21 is vulnerable to Cross Site Scripting (XSS).reportico-web/reportico