CVEs published November 6, 2023
116 CVEs were published on November 6, 2023: 9 critical, 40 high.
- Published
- 116
- Critical
- 9
- High
- 40
- Medium
- 57
- Low
- 4
- Unrated
- 6
- Now in CISA KEV
- 0
- Fix available
- 44
Most affected products
- GitLab
- 7
- 1E Platform
- 3
- Awesome Support
- 3
- Accessibility Suite by Online ADA
- 2
- Mattermost · github.com/mattermost/mattermost-server/v6 +1
- 2
- OpenSC · Red Hat Enterprise Linux
- 2
- Red Hat Enterprise Linux
- 2
- Advanced Page Visit Counter – Most Wanted Analytics Plugin…
- 1
- Aiyaz, maheshpatel Contact form 7 Custom validation
- 1
- Alter
- 1
Critical 9
- CVE-2023-5601WooCommerce Ninja Forms Product Add-ons < 1.7.1 - Unauthenticated Arbitrary File UploadWooCommerce Ninja Forms Product Add-ons
- CVE-2023-5777Weintek EasyBuilder Pro Use of Hard-coded CredentialsWeintek EasyBuilder Pro
- CVE-2023-46731Remote code execution through the section parameter in Administration as guest in XWiki Platformxwiki-platform · org.xwiki.platform:xwiki-platform-admin… +1
- CVE-2023-46732Reflected Cross-site scripting through revision parameter in content menu in XWiki Platformxwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…
- CVE-2023-59641E-Exchange-DisplayMessage instruction allows for arbitrary code execution1E Platform
- CVE-2023-451631E-Exchange-CommandLinePing instruction before v18.1 allows for arbitrary code execution1E Platform
- CVE-2023-451611E-Exchange-URLResponseTime instruction before v20.1 allows arbitrary code execution1E Platform
- CVE-2023-4699Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA productsMitsubishi Electric MELSEC-F Series FX3U-16MT/ES · Mit… +281
- CVE-2023-47253Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.ph
High 40
- CVE-2023-5355Awesome Support < 6.1.5 - Submitter+ Arbitrary File DeletionAwesome Support
- CVE-2023-5082History Log by click5 < 1.0.13 - Admin+ Time-Based Blind SQL InjectionHistory Log by click5
- CVE-2023-5454Templately < 2.2.6 - Arbitrary post trashing via Missing AuthorizationTemplately
- CVE-2023-5719Red Lion Crimson Improper Neutralization of Null Byte or NUL CharacterRed Lion Crimson
- CVE-2023-39345Unauthorized Access to Private Fields in User Registration API in strapistrapi · @strapi/plugin-users-permissions +1
- CVE-2023-46251Visual editor persistent Cross-site Scripting (XSS) in MyBBmybb
- CVE-2023-44398Out-of-bounds write in exiv2exiv2
- CVE-2023-45827Prototype Pollution vulnerability in @clickbar/dot-diverclickbar dot-diver · @clickbar/dot-diver
- CVE-2023-46728SQUID-2021:8 Denial of Service in Gopher gatewaysquid-cache squid
- CVE-2023-41378Calico Typha hangs during unclean TLS handshakeCalico Typha · Tigera Typha +1
- CVE-2023-5950Rapid7 Velociraptor Reflected XSS Rapid7 Velociraptor
- CVE-2023-3399Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2023-47185WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Scripting (XSS)gVectors Team Comments — wpDiscuz
- CVE-2023-47182WordPress Login Screen Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS)Nazmul Hossain Nihal Login Screen Manager
- CVE-2023-46822WordPress WooCommerce – Store Exporter Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)Visser Labs Store Exporter for WooCommerce – Export Product…
- CVE-2023-46823WordPress ImageLinks Interactive Image Builder Plugin <= 1.5.4 is vulnerable to SQL InjectionAvirtum ImageLinks Interactive Image Builder for WordPress
- CVE-2023-46821WordPress GD Security Headers Plugin <= 1.7 is vulnerable to SQL InjectionMilan Petrovic GD Security Headers
- CVE-2023-46084WordPress Icons Font Loader Plugin <= 1.1.2 is vulnerable to SQL InjectionbPlugins Icons Font Loader
- CVE-2023-45830WordPress Accessibility Suite by Online ADA Plugin <= 4.12 is vulnerable to SQL InjectionAccessibility Suite by Online ADA
- CVE-2023-45657WordPress Nexter Theme <= 2.0.3 is vulnerable to SQL InjectionPOSIMYTH Nexter
- CVE-2023-35911WordPress Contact Form Generator Plugin <= 2.6.0 is vulnerable to SQL InjectionCreative Solutions Contact Form Generator : Creative form b…
- CVE-2023-45069WordPress Video Gallery – YouTube Gallery Plugin <= 2.1.3 is vulnerable to SQL InjectionVideo Gallery by Total-Soft Video Gallery – Best WordPress…
- CVE-2023-45074WordPress Advanced Page Visit Counter Plugin <= 7.1.1 is vulnerable to SQL InjectionAdvanced Page Visit Counter – Most Wanted Analytics Plugin…
- CVE-2023-45055WordPress MStore API Plugin <= 4.0.6 is vulnerable to SQL InjectionInspireUI MStore API
- CVE-2023-28748WordPress Copy Or Move Comments Plugin <= 5.0.4 is vulnerable to SQL Injectionbiztechc Copy or Move Comments
- CVE-2023-45001WordPress Seriously Simple Stats Plugin <= 1.5.0 is vulnerable to SQL InjectionCastos Seriously Simple Stats
- CVE-2023-41685WordPress Woocommerce Support System Plugin <= 1.2.1 is vulnerable to SQL InjectionilGhera Woocommerce Support System
- CVE-2023-40609WordPress Contact form 7 Custom validation Plugin <= 1.1.3 is vulnerable to SQL InjectionAiyaz, maheshpatel Contact form 7 Custom validation
- CVE-2023-33924WordPress SIS Handball Plugin <= 1.0.45 is vulnerable to SQL InjectionFelix Welberg SIS Handball
- CVE-2023-40207WordPress Donations Made Easy – Smart Donations Plugin <= 4.0.12 is vulnerable to SQL InjectionRedNao Donations Made Easy – Smart Donations
- CVE-2022-46849WordPress Coming Soon Plugin <= 1.5.9 is vulnerable to SQL InjectionWeblizar Coming Soon Page – Responsive Coming Soon & Mainte…
- CVE-2022-46860WordPress Short URL Plugin <= 1.6.4 is vulnerable to SQL InjectionKaizenCoders Short URL
- CVE-2022-45373WordPress Slimstat Analytics Plugin <= 5.0.4 is vulnerable to SQL InjectionJason Crouse, VeronaLabs Slimstat Analytics
- CVE-2023-32840In modem CCCI, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2731, MT2735, MT6731, MT6739, MT6761, MT6762, MT…
- CVE-2023-20702In 5G NRLC, there is a possible invalid memory access due to lack of error handling.MediaTek MT6835, MT6873, MT6875, MT6879, MT6883, MT6885, MT…
- CVE-2023-32837In video, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6883, MT6885, MT6889, MT6893, MT8797, MT8798
- CVE-2023-32832In video, there is a possible memory corruption due to a race condition.MediaTek MT6883, MT6885, MT6889, MT6893, MT6895, MT6983, MT…
- CVE-2022-48192Cross-site scripting vulnerability in Softing smartLink SW-HT
- CVE-2023-38407bgpd/bgp_label.c in FRRouting (FRR) before 8.5 attempts to read beyond the end of the stream during labeled unicast parsing.
- CVE-2023-47004Buffer Overflow vulnerability in Redis RedisGraph v.2.x through v.2.12.8 and fixed in v.2.12.9 allows an attacker to execute arbitrary code
Medium, low and unrated 67
- CVE-2023-36409Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2023-36769Microsoft OneNote Spoofing VulnerabilityMicrosoft Office · Microsoft OneNote
- CVE-2023-5605URL Shortify < 1.7.9.1 - Admin+ Stored XSSURL Shortify
- CVE-2023-5530Ninja Forms < 3.6.34 - Admin+ Stored XSSNinja Forms Contact Form
- CVE-2023-5181WP Discord Invite < 2.5.2 - Admin+ Stored Cross Site Scripting WP Discord Invite
- CVE-2023-4858WP Simple Table Manager Plugin <= 1.5.6 - Admin+ Stored Cross-Site ScriptingSimple Table Manager
- CVE-2023-4810Responsive Pricing Table < 5.1.8 - Admin+ Stored Cross-Site ScripingResponsive Pricing Table
- CVE-2023-4930Front End PM < 11.4.3 - Sensitive Data Exposure via Directory ListingFront End PM
- CVE-2023-5352Awesome Support < 6.1.5 - Insufficient permission check in wpas_edit_replyAwesome Support
- CVE-2023-5228User Registration < 3.0.4.2 - Admin+ Stored XSSUser Registration
- CVE-2023-5354Awesome Support < 6.1.5 - Reflected Cross-Site ScriptingAwesome Support
- CVE-2023-5771HTML injection in AdminUI through email subjectProofpoint Enterprise Protection
- CVE-2023-46254Service accounts can see namespaces of other tenants in capsule-proxyprojectcapsule capsule-proxy · github.com/projectcapsule… +1
- CVE-2023-4700Missing Authorization in GitLabGitLab
- CVE-2023-40661Opensc: multiple memory issues with pkcs15-init (enrollment tool)OpenSC · Red Hat Enterprise Linux
- CVE-2023-40660Opensc: potential pin bypass when card tracks its own login stateOpenSC · Red Hat Enterprise Linux
- CVE-2023-4535Opensc: out-of-bounds read in myeid driver handling encryption using symmetric keysRed Hat Enterprise Linux
- CVE-2023-5969 Denial of Service via Link Preview in /api/v4/redirect_locationMattermost · github.com/mattermost/mattermost-server/v6 +1
- CVE-2023-5678Excessive time spent in DH check / generation with large Q parameter valueOpenSSL
- CVE-2023-5968Password hash in response body after username updateMattermost · github.com/mattermost/mattermost-server/v6 +3
- CVE-2023-5967Denial of Service via crashing the Calls PluginMattermost · github.com/mattermost/mattermost-server/v6 +1
- CVE-2023-49103scale-admin-portal: logged out users tokens can be accessedRed Hat 3scale API Management Platform
- CVE-2023-5963Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2023-3909Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2023-3246Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2023-47186WordPress Kadence WooCommerce Email Designer Plugin <= 1.5.11 is vulnerable to Cross Site Request Forgery (CSRF)Kadence WP Kadence WooCommerce Email Designer
- CVE-2023-5823WordPress TK Google Fonts GDPR Compliant Plugin <= 2.2.11 is vulnerable to Cross Site Request Forgery (CSRF)ThemeKraft TK Google Fonts GDPR Compliant
- CVE-2023-46781WordPress Current Menu Item for Custom Post Types Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)Roland Murg Current Menu Item for Custom Post Types
- CVE-2023-46780WordPress Alter Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)Alter
- CVE-2023-46779WordPress EasyRecipe Plugin <= 3.5.3251 is vulnerable to Cross Site Request Forgery (CSRF)EasyRecipe
- CVE-2023-46778WordPress Auto Limit Posts Reloaded Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)TheFreeWindows Auto Limit Posts Reloaded
- CVE-2023-46777WordPress Feather Login Page Plugin <= 1.1.3 is vulnerable to Cross Site Request Forgery (CSRF)Custom Login Page | Temporary Users | Rebrand Login | Login…
- CVE-2023-46776WordPress Auto Excerpt everywhere Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)Serena Villa Auto Excerpt everywhere
- CVE-2023-46775WordPress Original texts Yandex WebMaster Plugin <= 1.18 is vulnerable to Cross Site Request Forgery (CSRF)Djo Original texts Yandex WebMaster
- CVE-2023-5090Kernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrsRed Hat Enterprise Linux
- CVE-2023-5825Loop with Unreachable Exit Condition ('Infinite Loop') in GitLabGitLab
- CVE-2023-5831Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2023-4996Local privilege escalation Netskope Client
- CVE-2023-47184WordPress Admin Bar & Dashboard Access Control Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)Proper Fraction LLC. Admin Bar & Dashboard Access Control
- CVE-2023-47177WordPress Linker Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)Yakir Sitbon, Ariel Klikstein Linker
- CVE-2023-46824WordPress Slick Popup Plugin <= 1.7.14 is vulnerable to Cross Site Scripting (XSS)Om Ak Solutions Slick Popup: Contact Form 7 Popup Plugin
- CVE-2023-23702WordPress Comments Ratings Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)Pixelgrade Comments Ratings
- CVE-2023-46783WordPress Pre-Orders for WooCommerce Plugin <= 1.2.13 is vulnerable to Cross Site Scripting (XSS)Bright Plugins Pre-Orders for WooCommerce
- CVE-2023-46782WordPress MomentoPress for Momento360 Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)Chris Yee MomentoPress for Momento360
- CVE-2023-45046WordPress Pressference Exporter Plugin <= 1.0.3 is vulnerable to SQL InjectionPressference Exporter
- CVE-2023-27605WordPress WP Reroute Email Plugin <= 1.4.6 is vulnerable to SQL InjectionSajjad Hossain WP Reroute Email
- CVE-2023-38382WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL InjectionDaniel Söderström / Sidney van de Stouwe Subscribe to Categ…
- CVE-2022-47432WordPress Shortcode IMDB Plugin <= 6.0.8 is vulnerable to SQL InjectionKemal YAZICI - PluginPress Shortcode IMDB
- CVE-2022-47430WordPress The School Management – Education & Learning Management Plugin <= 4.1 is vulnerable to SQL InjectionWeblizar The School Management – Education & Learning Manag…
- CVE-2022-47420WordPress Accessibility Suite by Online ADA Plugin <= 4.12 is vulnerable to SQL InjectionAccessibility Suite by Online ADA
- CVE-2022-47428WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL InjectionWpDevArt Booking calendar, Appointment Booking System
- CVE-2021-4430Ortus Solutions ColdBox Elixir ENV Variable defaultConfig.js information disclosureOrtus Solutions ColdBox Elixir
- CVE-2023-28794PAC Files Exposed to Internet WebsitesZscaler Client Connector
- CVE-2023-42669Samba: "rpcecho" development server allows denial of service via sleep() call on ad dcsamba · Red Hat Enterprise Linux +2
- CVE-2023-4625Denial-of-Service（DoS） Vulnerability in Web server function on MELSEC Series CPU moduleMitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +78
- CVE-2023-32825In bluethooth service, there is a possible out of bounds reads due to improper input validation.MediaTek MT2713, MT6580, MT6761, MT6765, MT6768, MT6779, MT…
- CVE-2023-32839In dpe, there is a possible out of bounds write due to a missing valid range checking.MediaTek MT2713, MT6895, MT6983, MT8188, MT8195, MT8673, MT…
- CVE-2023-32838In dpe, there is a possible out of bounds write due to a missing valid range checking.MediaTek MT2713, MT6895, MT6983, MT8188, MT8195, MT8390, MT…
- CVE-2023-32836In display, there is a possible out of bounds write due to an integer overflow.MediaTek MT6893, MT6895, MT6983, MT6985, MT8797, MT8798
- CVE-2023-32835In keyinstall, there is a possible memory corruption due to type confusion.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2023-32834In secmem, there is a possible memory corruption due to type confusion.MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6761, MT…
- CVE-2023-32818In vdec, there is a possible out of bounds write due to type confusion.MediaTek MT6761, MT6763, MT6765, MT6768, MT6771, MT6779, MT…
- CVE-2023-46802e-Tax software Version3.0.10 and earlier improperly restricts XML external entity references (XXE) due to the configuration of the embedded National Tax Agency e-Tax software
- CVE-2018-25093Vaerys-Dawn DiscordSailv2 Tag access controlVaerys-Dawn DiscordSailv2
- CVE-2022-48193Weak ciphers vulnerability in Softing smartLink SW-HT
- CVE-2023-38406bgpd/bgp_flowspec.c in FRRouting (FRR) before 8.4.3 mishandles an nlri length of zero, aka a "flowspec overflow."
- CVE-2023-45556Cross Site Scripting vulnerability in Mybb Mybb Forums v.1.8.33 allows a local attacker to execute arbitrary code via the theme Name paramet