# CVEs published 2023-11-02

96 CVEs were published on November 2, 2023: 21 critical, 12 high. Days are UTC.

- [CVE-2023-43018](https://cve.now/CVE-2023-43018.md): IBM CICS TX privilege escalation (CVSS 5.9, IBM CICS TX Standard · IBM CICS TX Advanced)
- [CVE-2023-42029](https://cve.now/CVE-2023-42029.md): IBM CICS TX cross-site scripting (CVSS 4.8, IBM CICS TX Standard · IBM CICS TX Advanced +1)
- [CVE-2023-42027](https://cve.now/CVE-2023-42027.md): IBM CICS TX cross-site request forgery (CVSS 4.3, IBM CICS TX Standard · IBM CICS TX Advanced +1)
- [CVE-2023-5930](https://cve.now/CVE-2023-5930.md): Campcodes Simple Student Information System manage\_academic.php cross site scripting (CVSS 3.5, Campcodes Simple Student Information System)
- [CVE-2023-5929](https://cve.now/CVE-2023-5929.md): Campcodes Simple Student Information System manage\_academic.php sql injection (CVSS 5.5, Campcodes Simple Student Information System)
- [CVE-2023-5928](https://cve.now/CVE-2023-5928.md): Campcodes Simple Student Information System manage\_department.php sql injection (CVSS 5.5, Campcodes Simple Student Information System)
- [CVE-2023-5927](https://cve.now/CVE-2023-5927.md): Campcodes Simple Student Information System manage\_course.php sql injection (CVSS 5.5, Campcodes Simple Student Information System)
- [CVE-2023-5926](https://cve.now/CVE-2023-5926.md): Campcodes Simple Student Information System update\_status.php sql injection (CVSS 5.5, Campcodes Simple Student Information System)
- [CVE-2023-5925](https://cve.now/CVE-2023-5925.md): Campcodes Simple Student Information System Master.php sql injection (CVSS 5.5, Campcodes Simple Student Information System)
- [CVE-2023-31027](https://cve.now/CVE-2023-31027.md): CVE (CVSS 8.2, NVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…)
- [CVE-2023-31026](https://cve.now/CVE-2023-31026.md): CVE (CVSS 6.0, nvidia vGPU driver and Cloud gaming driver)
- [CVE-2023-31023](https://cve.now/CVE-2023-31023.md): CVE (CVSS 5.5, NVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…)
- [CVE-2023-31022](https://cve.now/CVE-2023-31022.md): CVE (CVSS 5.5, NVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…)
- [CVE-2023-31021](https://cve.now/CVE-2023-31021.md): CVE (CVSS 5.5, nvidia vGPU driver and Cloud gaming driver)
- [CVE-2023-31020](https://cve.now/CVE-2023-31020.md): CVE (CVSS 6.1, NVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…)
- [CVE-2023-31019](https://cve.now/CVE-2023-31019.md): CVE (CVSS 7.8, NVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…)
- [CVE-2023-31018](https://cve.now/CVE-2023-31018.md): CVE (CVSS 6.5, nvidia vGPU driver and Cloud gaming driver)
- [CVE-2023-31017](https://cve.now/CVE-2023-31017.md): CVE (CVSS 7.8, NVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…)
- [CVE-2023-31016](https://cve.now/CVE-2023-31016.md): CVE (CVSS 7.3, NVIDIA GPU Display driver, vGPU driver, and Cloud gaming dr…)
- [CVE-2023-5924](https://cve.now/CVE-2023-5924.md): Campcodes Simple Student Information System view\_course.php sql injection (CVSS 5.5, Campcodes Simple Student Information System)
- [CVE-2023-5923](https://cve.now/CVE-2023-5923.md): Campcodes Simple Student Information System index.php sql injection (CVSS 5.5, Campcodes Simple Student Information System)
- [CVE-2023-5846](https://cve.now/CVE-2023-5846.md): Use of Password Hash With Insufficient Computational Effort in Franklin Fueling System TS-550 (CVSS 8.3, Franklin Fueling System TS-550)
- [CVE-2023-5035](https://cve.now/CVE-2023-5035.md): Cookie Without Secure Flag (CVSS 3.1, Moxa PT-G503 Series)
- [CVE-2023-4217](https://cve.now/CVE-2023-4217.md): Session cookies attribute not set properly (CVSS 3.1, Moxa PT-G503 Series)
- [CVE-2022-4900](https://cve.now/CVE-2022-4900.md): Potential buffer overflow in php\_cli\_server\_startup\_workers (CVSS 6.2, php · Red Hat Enterprise Linux +2)
- [CVE-2023-38473](https://cve.now/CVE-2023-38473.md): Reachable assertion in avahi\_alternative\_host\_name (CVSS 6.2, avahi · Red Hat Enterprise Linux +1)
- [CVE-2023-38472](https://cve.now/CVE-2023-38472.md): Reachable assertion in avahi\_rdata\_parse (CVSS 6.2, avahi · Red Hat Enterprise Linux +1)
- [CVE-2023-38471](https://cve.now/CVE-2023-38471.md): Reachable assertion in dbus\_set\_host\_name (CVSS 6.2, avahi · Red Hat Enterprise Linux +1)
- [CVE-2023-38470](https://cve.now/CVE-2023-38470.md): Reachable assertion in avahi\_escape\_label (CVSS 6.2, avahi · Red Hat Enterprise Linux +1)
- [CVE-2023-38469](https://cve.now/CVE-2023-38469.md): Reachable assertion in avahi\_dns\_packet\_append\_record (CVSS 6.2, avahi · Red Hat Enterprise Linux +1)
- [CVE-2023-46725](https://cve.now/CVE-2023-46725.md): FoodCoopShop Server-Side Request Forgery vulnerability (CVSS 8.1, foodcoopshop · foodcoopshop/foodcoopshop)
- [CVE-2023-45347](https://cve.now/CVE-2023-45347.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-45346](https://cve.now/CVE-2023-45346.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-45345](https://cve.now/CVE-2023-45345.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-45338](https://cve.now/CVE-2023-45338.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-45343](https://cve.now/CVE-2023-45343.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-45341](https://cve.now/CVE-2023-45341.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-45344](https://cve.now/CVE-2023-45344.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-45342](https://cve.now/CVE-2023-45342.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-45340](https://cve.now/CVE-2023-45340.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-42802](https://cve.now/CVE-2023-42802.md): GLPI vulnerable to unallowed PHP script execution (CVSS 10.0, glpi-project glpi)
- [CVE-2023-5919](https://cve.now/CVE-2023-5919.md): SourceCodester Company Website CMS Create Blog Page createblog unrestricted upload (CVSS 4.7, SourceCodester Company Website CMS)
- [CVE-2023-45336](https://cve.now/CVE-2023-45336.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-45334](https://cve.now/CVE-2023-45334.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-45325](https://cve.now/CVE-2023-45325.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-45323](https://cve.now/CVE-2023-45323.md): Online Food Ordering System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Food Ordering System)
- [CVE-2023-29047](https://cve.now/CVE-2023-29047.md): Imageconverter API endpoints provided methods that were not sufficiently validating and sanitizing client input, allowing to inject arbitrar (CVSS 5.3, OX Software OX App Suite)
- [CVE-2023-29046](https://cve.now/CVE-2023-29046.md): Connections to external data sources, like e-mail autoconfiguration, were not terminated in case they hit a timeout, instead those connectio (CVSS 4.3, OX Software OX App Suite)
- [CVE-2023-29045](https://cve.now/CVE-2023-29045.md): Documents operations, in this case "drawing", could be manipulated to contain invalid data types, possibly script code. (CVSS 5.4, OX Software OX App Suite)
- [CVE-2023-29044](https://cve.now/CVE-2023-29044.md): Documents operations could be manipulated to contain invalid data types, possibly script code. (CVSS 5.4, OX Software OX App Suite)
- [CVE-2023-29043](https://cve.now/CVE-2023-29043.md): Presentations may contain references to images, which are user-controlled, and could include malicious script code that is being processed w (CVSS 6.1, OX Software OX App Suite)
- [CVE-2023-26456](https://cve.now/CVE-2023-26456.md): Users were able to set an arbitrary "product name" for OX Guard. (CVSS 5.4, OX Software OX App Suite)
- [CVE-2023-26455](https://cve.now/CVE-2023-26455.md): RMI was not requiring authentication when calling ChronosRMIService:setEventOrganizer. (CVSS 5.6, OX Software OX App Suite)
- [CVE-2023-26454](https://cve.now/CVE-2023-26454.md): Requests to fetch image metadata could be abused to include SQL queries that would be executed unchecked. (CVSS 7.6, OX Software OX App Suite)
- [CVE-2023-26453](https://cve.now/CVE-2023-26453.md): Requests to cache an image could be abused to include SQL queries that would be executed unchecked. (CVSS 7.6, OX Software OX App Suite)
- [CVE-2023-26452](https://cve.now/CVE-2023-26452.md): Requests to cache an image and return its metadata could be abused to include SQL queries that would be executed unchecked. (CVSS 7.6, OX Software OX App Suite)
- [CVE-2023-3164](https://cve.now/CVE-2023-3164.md): Heap-buffer-overflow in extractimagesection() (CVSS 5.5, libtiff · Red Hat Enterprise Linux +1)
- [CVE-2023-5860](https://cve.now/CVE-2023-5860.md): Icons Font Loader \<= 1.1.2 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, bplugins Icons Font Loader – Load Web Fonts and Icon Librar…)
- [CVE-2023-5918](https://cve.now/CVE-2023-5918.md): SourceCodester Visitor Management System manage\_user.php sql injection (CVSS 6.3, SourceCodester Visitor Management System)
- [CVE-2023-43076](https://cve.now/CVE-2023-43076.md): Dell PowerScale OneFS 8.2.x,9.0.0.x-9.5.0.x contains a denial-of-service vulnerability. (CVSS 6.5, Dell PowerScale OneFS)
- [CVE-2023-5917](https://cve.now/CVE-2023-5917.md): phpBB Smiley Pack acp\_icons.php main cross site scripting (CVSS 2.4, phpBB · phpbb/phpbb)
- [CVE-2023-5916](https://cve.now/CVE-2023-5916.md): Lissy93 Dashy Configuration save access control (CVSS 4.3, Lissy93 Dashy)
- [CVE-2023-43087](https://cve.now/CVE-2023-43087.md): Dell PowerScale OneFS 8.2.x, 9.0.0.x-9.5.0.x contains an improper handling of insufficient permissions. (CVSS 4.3, Dell PowerScale OneFS)
- [CVE-2023-5920](https://cve.now/CVE-2023-5920.md): Lack Of Secure Keyboard Entry Protection in MacOS Desktop (CVSS 2.9, Mattermost Desktop)
- [CVE-2023-5606](https://cve.now/CVE-2023-5606.md): The ChatBot for WordPress is vulnerable to Stored Cross-Site Scripting via the FAQ Builder in versions 4.8.6 through 4.9.6 due to insufficie (CVSS 4.4, quantumcloud AI ChatBot)
- [CVE-2023-5875](https://cve.now/CVE-2023-5875.md): Lack of Hardening against media exploitation from a remote origin (CVSS 3.7, Mattermost Desktop)
- [CVE-2023-5876](https://cve.now/CVE-2023-5876.md): Regex DoS from a malicious server enrolled in Desktop (CVSS 3.1, Mattermost Desktop)
- [CVE-2023-46595](https://cve.now/CVE-2023-46595.md): Net-NTLM leak via HTML injection in FireFlow VisualFlow workflow editor (CVSS 5.9, Algosec FireFlow)
- [CVE-2023-5408](https://cve.now/CVE-2023-5408.md): Openshift: modification of node role labels (CVSS 7.2, Red Hat OpenShift Container Platform)
- [CVE-2023-46327](https://cve.now/CVE-2023-46327.md): Multiple MFPs (multifunction printers) provided by FUJIFILM Business Innovation Corp. (no CVSS, FUJIFILM Business Inovation Apeos C3070 Asia Pacific M… +159)
- [CVE-2023-45019](https://cve.now/CVE-2023-45019.md): Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Bus Booking System)
- [CVE-2023-45018](https://cve.now/CVE-2023-45018.md): Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Bus Booking System)
- [CVE-2023-45015](https://cve.now/CVE-2023-45015.md): Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Bus Booking System)
- [CVE-2023-45012](https://cve.now/CVE-2023-45012.md): Online Bus Booking System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Bus Booking System)
- [CVE-2023-45111](https://cve.now/CVE-2023-45111.md): Online Examination System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Examination System)
- [CVE-2023-31579](https://cve.now/CVE-2023-31579.md): Dromara Lamp-Cloud before v3.8.1 was discovered to use a hardcoded cryptographic key when creating and verifying a Json Web Token. (no CVSS, top.tangyh.basic:lamp-core · top.tangyh.basic:lamp-util)
- [CVE-2023-39042](https://cve.now/CVE-2023-39042.md): An information leak in Gyouza-newhushimi v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39047](https://cve.now/CVE-2023-39047.md): An information leak in shouzu sweets oz v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39048](https://cve.now/CVE-2023-39048.md): An information leak in Tokudaya.honten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39050](https://cve.now/CVE-2023-39050.md): An information leak in Daiky-value.Fukueten v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39051](https://cve.now/CVE-2023-39051.md): An information leak in VISION MEAT WORKS Track Diner 10/10mbl v13.6.1 allows attackers to obtain the channel access token and send crafted m (no CVSS)
- [CVE-2023-39053](https://cve.now/CVE-2023-39053.md): An information leak in Hattoriya v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39054](https://cve.now/CVE-2023-39054.md): An information leak in Tokudaya.ekimae\_mc v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39057](https://cve.now/CVE-2023-39057.md): An information leak in hirochanKAKIwaiting v13.6.1 allows attackers to obtain the channel access token and send crafted messages. (no CVSS)
- [CVE-2023-39283](https://cve.now/CVE-2023-39283.md): An SMM memory corruption vulnerability in the SMM driver (SMRAM write) in CsmInt10HookSmm in Insyde InsydeH2O with kernel 5.0 through 5.5 al (no CVSS)
- [CVE-2023-39284](https://cve.now/CVE-2023-39284.md): An issue was discovered in IhisiServicesSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. (no CVSS)
- [CVE-2023-42299](https://cve.now/CVE-2023-42299.md): Buffer Overflow vulnerability in OpenImageIO oiio v.2.4.12.0 allows a remote attacker to execute arbitrary code and cause a denial of servic (no CVSS)
- [CVE-2023-43193](https://cve.now/CVE-2023-43193.md): Submitty before v22.06.00 is vulnerable to Cross Site Scripting (XSS). (no CVSS)
- [CVE-2023-43194](https://cve.now/CVE-2023-43194.md): Submitty before v22.06.00 is vulnerable to Incorrect Access Control. (no CVSS)
- [CVE-2023-43336](https://cve.now/CVE-2023-43336.md): Sangoma Technologies FreePBX before cdr 15.0.18, 16.0.40, 15.0.16, and 16.0.17 was discovered to contain an access control issue via a modif (no CVSS)
- [CVE-2023-46352](https://cve.now/CVE-2023-46352.md): In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from Smar (CVSS 7.5)
- [CVE-2023-46475](https://cve.now/CVE-2023-46475.md): A Stored Cross-Site Scripting vulnerability was discovered in ZenTao 18.3 where a user can create a project, and in the name field of the pr (no CVSS)
- [CVE-2023-46695](https://cve.now/CVE-2023-46695.md): An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7. (no CVSS, django)
- [CVE-2023-46925](https://cve.now/CVE-2023-46925.md): Reportico 7.1.21 is vulnerable to Cross Site Scripting (XSS). (CVSS 4.8, reportico-web/reportico)
- [CVE-2023-46958](https://cve.now/CVE-2023-46958.md): An issue in lmxcms v.1.41 allows a remote attacker to execute arbitrary code via a crafted script to the admin.php file. (CVSS 9.8)
- [CVE-2023-47204](https://cve.now/CVE-2023-47204.md): Unsafe YAML deserialization in yaml.Loader in transmute-core before 1.13.5 allows attackers to execute arbitrary Python code. (CVSS 9.8, transmute-core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.