CVEs published November 3, 2023
103 CVEs were published on November 3, 2023: 13 critical, 46 high.
- Published
- 103
- Critical
- 13
- High
- 46
- Medium
- 29
- Low
- 0
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- Chunghwa Telecom NOKIA G-040W-Q
- 6
- ASUS RT-AX55
- 4
- Ivanti Avalanche
- 4
- ManageEngine Desktop Central
- 3
- Red Hat Enterprise Linux
- 3
- Themeum Tutor LMS
- 3
- django
- 2
- Microsoft Edge
- 2
- QNAP Systems QTS · QNAP Systems QuTS hero +1
- 2
- Red Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- 2
Critical 13
- CVE-2023-36529WordPress Houzez CRM Plugin <= 1.3.4 is vulnerable to SQL InjectionFavethemes Houzez - Real Estate WordPress Theme
- CVE-2023-23369QTS, Multimedia Console, and Media Streaming add-onQNAP Systems Multimedia Console · QNAP Systems QTS +1
- CVE-2023-23368QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-3961Samba: smbd allows client access to unix domain sockets on the file system as rootRed Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- CVE-2023-25960WordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to SQL InjectionZendrop – Global Dropshipping
- CVE-2023-3277MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalationinspireui MStore API – Create Native Android & iOS Apps On…
- CVE-2023-46846Squid: request/response smuggling in http/1.1 and icapsquid · Red Hat Enterprise Linux 7 Extended Lifecycle Su… +1
- CVE-2023-41355Chunghwa Telecom NOKIA G-040W-Q - Improper Input ValidationChunghwa Telecom NOKIA G-040W-Q
- CVE-2023-41351Chunghwa Telecom NOKIA G-040W-Q - Broken Access ControlChunghwa Telecom NOKIA G-040W-Q
- CVE-2023-46404PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.
- CVE-2023-46817An issue was discovered in phpFox before 4.8.14.
- CVE-2023-46954SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitra
- CVE-2023-46980An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted sc
High 46
- CVE-2023-40215WordPress Demon image annotation Plugin <= 5.1 is vulnerable to SQL InjectionDemonisblack demon image annotation
- CVE-2023-35910WordPress Quasar form Plugin <= 6.0 is vulnerable to SQL InjectionNucleus_genius Quasar form free – Contact Form Builder for…
- CVE-2023-32741WordPress Contact Form to Any API Plugin <= 1.1.2 is vulnerable to SQL InjectionIT Path Solutions PVT Contact Form to Any API
- CVE-2023-36677WordPress SP Project & Document Manager Plugin <= 4.67 is vulnerable to SQL InjectionSmartypants SP Project & Document Manager
- CVE-2023-41726Ivanti Avalanche Incorrect Default Permissions allows Local Privilege Escalation VulnerabilityIvanti Avalanche
- CVE-2023-41725Ivanti Avalanche EnterpriseServer Service Unrestricted File Upload Local Privilege Escalation VulnerabilityIvanti Avalanche
- CVE-2022-43554Ivanti Avalanche Smart Device Service Missing Authentication Local Privilege Escalation VulnerabilityIvanti Avalanche
- CVE-2022-43555Ivanti Avalanche Printer Device Service Missing Authentication Local Privilege Escalation VulnerabilityIvanti Avalanche
- CVE-2022-44569A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.Ivanti Automation
- CVE-2023-3893Kubernetes - csi-proxy - Insufficient input sanitization leads to privilege escalationKubernetes csi-proxy · github.com/kubernetes-csi/csi-pro… +1
- CVE-2023-34179WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to SQL InjectionGroundhogg
- CVE-2023-25700WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL InjectionThemeum Tutor LMS
- CVE-2023-39299Music StationQNAP Systems Music Station
- CVE-2023-25800WordPress Tutor LMS Plugin <= 2.2.0 is vulnerable to SQL InjectionThemeum Tutor LMS
- CVE-2023-25990WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL InjectionThemeum Tutor LMS
- CVE-2023-32508WordPress Order Your Posts Manually Plugin <= 2.2.5 is vulnerable to SQL InjectionRolf van Gelder Order Your Posts Manually
- CVE-2023-32121WordPress Zero Spam Plugin <= 5.4.4 is vulnerable to SQL InjectionHighfivery Zero Spam for WordPress
- CVE-2022-46818WordPress Email posts to subscribers Plugin <= 6.2 is vulnerable to SQL InjectionGopi Ramasamy Email posts to subscribers
- CVE-2022-46859WordPress Spiffy Calendar Plugin <= 4.9.1 is vulnerable to SQL InjectionSpiffy Plugins Spiffy Calendar
- CVE-2023-26015WordPress MapPress Maps for WordPress Plugin <= 2.85.4 is vulnerable to SQL InjectionChris Richardson MapPress Maps for WordPress
- CVE-2022-46808WordPress ARMember Plugin <= 3.4.11 is vulnerable to SQL InjectionRepute Infosystems ARMember
- CVE-2022-47445WordPress Be POPIA Compliant Plugin <= 1.2.0 is vulnerable to SQL InjectionWeb-X Be POPIA Compliant
- CVE-2022-45805WordPress Paytm Payment Gateway Plugin <= 2.7.3 is vulnerable to SQL InjectionPaytm Payment Gateway
- CVE-2023-34383WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL InjectionweDevs WP Project Manager
- CVE-2023-41652WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to SQL InjectionDavid F. Carr RSVPMaker
- CVE-2023-4591Inclusion of Functionality from Untrusted Control Sphere in WPN-XM ServerstackWPN-XM Serverstack
- CVE-2023-1476Kpatch: mm/mremap.c: incomplete fix for cve-2022-41222Red Hat Enterprise Linux
- CVE-2023-46847Squid: denial of service in http digest authenticationsquid · Red Hat Enterprise Linux 6 Extended Lifecycle Su… +1
- CVE-2023-46848Squid: denial of service in ftpsquid · Red Hat Enterprise Linux
- CVE-2023-5824Squid: dos against http and httpsRed Hat Enterprise Linux
- CVE-2023-1194Use-after-free in parse_lease_state()kernel · Red Hat Enterprise Linux +1
- CVE-2023-5948Improper Authorization in teamamaze/amazefileutilitiesteamamaze/amazefileutilities
- CVE-2023-41357Galaxy Software Services Vitals ESP - Arbitrary File UploadGalaxy Software Services Vitals ESP
- CVE-2023-41344NCSIST ManageEngine MDM - Path TraversalNCSIST ManageEngine MDM
- CVE-2023-41353Chunghwa Telecom NOKIA G-040W-Q - Weak Password RequirementsChunghwa Telecom NOKIA G-040W-Q
- CVE-2023-41352Chunghwa Telecom NOKIA G-040W-Q - Command InjectionChunghwa Telecom NOKIA G-040W-Q
- CVE-2023-41350Chunghwa Telecom NOKIA G-040W-Q - Excessive Authentication AttemptsChunghwa Telecom NOKIA G-040W-Q
- CVE-2023-41348ASUS RT-AX55 - command injection - 4ASUS RT-AX55
- CVE-2023-41347ASUS RT-AX55 - command injection - 3ASUS RT-AX55
- CVE-2023-41346ASUS RT-AX55 - command injection - 2ASUS RT-AX55
- CVE-2023-41345ASUS RT-AX55 - command injection - 1ASUS RT-AX55
- CVE-2023-36034Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2023-31102Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.
- CVE-2023-45024Best Practical Request Tracker (RT) 5 before 5.0.5 allows Information Disclosure via a transaction search in the transaction query builder.
- CVE-2023-46947Subrion 4.2.1 has a remote command execution vulnerability in the backend.intelliants/subrion
- CVE-2023-47234An issue was discovered in FRRouting FRR through 9.0.1.
Medium, low and unrated 44
- CVE-2023-38391WordPress Onepage Builder – Easiest Landing Page Builder For WordPress Plugin <= 2.4.1 is vulnerable to SQL InjectionThemesgrove Onepage Builder
- CVE-2023-45189IBM Robotic Process Automation information disclosureIBM Robotic Process Automation
- CVE-2022-3172Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)Kubernetes kube-apiserver
- CVE-2023-39301QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-5088Qemu: improper ide controller reset can lead to mbr overwriteRed Hat Enterprise Linux
- CVE-2023-5946The Digirisk plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'current_group_id' parameter in version 6.0.0.0 duevarisk Digirisk
- CVE-2022-47426WordPress Neshan Maps Plugin <= 1.1.4 is vulnerable to SQL InjectionNeshan Maps Platform Neshan Maps
- CVE-2023-5945The video carousel slider with lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in version 1.0.nik00726 video carousel slider with lightbox
- CVE-2023-5707SEO Slider <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeseothemes SEO Slider
- CVE-2022-47588WordPress Simple Photo Gallery Plugin <= v1.8.1 is vulnerable to SQL InjectionTips and Tricks HQ, Peter Petreski Simple Photo Gallery
- CVE-2023-4592Improper Neutralization of Input During Web Page Generation in WPN-XM ServerstackWPN-XM Serverstack
- CVE-2023-4769Server-Side Request Forgery in ManageEngine Desktop CentralManageEngine Desktop Central
- CVE-2023-4768Improper Neutralization of CRLF Sequences in ManageEngine Desktop CentralManageEngine Desktop Central
- CVE-2023-4767Improper Neutralization of CRLF Sequences in ManageEngine Desktop CentralManageEngine Desktop Central
- CVE-2023-4043Parsson DoS when parsing numbers from untrusted sourcesEclipse Foundation Parsson · org.eclipse.parsson:project
- CVE-2023-42670Samba: ad dc busy rpc multiple listener dossamba · Red Hat Enterprise Linux +1
- CVE-2023-4091Samba: smb clients can truncate files with read-only permissionsRed Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- CVE-2023-5763Glassfish remote code executionEclipse Foundation Glassfish · org.glassfish.main.orb:orb-c…
- CVE-2023-41356WisdomGarden Tronclass ilearn - Path TraversalWisdomGarden Tronclass ilearn
- CVE-2023-41354Chunghwa Telecom NOKIA G-040W-Q - Exposure of Sensitive InformationChunghwa Telecom NOKIA G-040W-Q
- CVE-2023-41343Ragic No-Code Database Builder - Stored XSSRagic No-Code Database Builder
- CVE-2023-35896IBM Content Navigator server-side request forgeryIBM Content Navigator
- CVE-2023-36022Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2023-36029Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2023-46176IBM MQ privilege escalationIBM MQ Appliance
- CVE-2017-7252bcrypt password hashing in Botan before 2.1.0 does not correctly handle passwords with a length between 57 and 72 characters, which makes it
- CVE-2020-28407In swtpm before 0.4.2 and 0.5.x before 0.5.1, a local attacker may be able to overwrite arbitrary files via a symlink attack against a tempo
- CVE-2023-34259Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the
- CVE-2023-34260Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed
- CVE-2023-34261Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow identification of valid user accounts via username enumeration because they
- CVE-2023-36620An issue was discovered in the Boomerang Parental Control application before 13.83 for Android.
- CVE-2023-36621An issue was discovered in the Boomerang Parental Control application through 13.83 for Android.
- CVE-2023-38965Lost and Found Information System 1.0 allows account takeover via username and password to a /classes/Users.php?f=save URI.
- CVE-2023-41164In Django 3.2 before 3.2.21, 4.1 before 4.1.11, and 4.2 before 4.2.5, django.utils.encoding.uri_to_iri() is subject to a potential DoS (denidjango
- CVE-2023-41259Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Disclosure via fake or spoofed RT email headers in
- CVE-2023-41260Best Practical Request Tracker (RT) before 4.4.7 and 5.x before 5.0.5 allows Information Exposure in responses to mail-gateway REST API call
- CVE-2023-41914SchedMD Slurm 23.02.x before 23.02.6 and 22.05.x before 22.05.10 allows filesystem race conditions for gaining ownership of a file, overwrit
- CVE-2023-43665In Django 3.2 before 3.2.22, 4.1 before 4.1.12, and 4.2 before 4.2.6, the django.utils.text.Truncator chars() and words() methods (when useddjango
- CVE-2023-43982Bon Presta boninstagramcarousel between v5.2.1 to v7.0.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the url paramete
- CVE-2023-44271An issue was discovered in Pillow before 10.0.0.pillow
- CVE-2023-45360An issue was discovered in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.
- CVE-2023-45362An issue was discovered in DifferenceEngine.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.
- CVE-2023-47233The brcm80211 component in the Linux kernel through 6.5.10 has a brcmf_cfg80211_detach use-after-free in the device unplugging (disconnect t
- CVE-2023-47235An issue was discovered in FRRouting FRR through 9.0.1.