CVEs published November 7, 2023
162 CVEs were published on November 7, 2023: 27 critical, 26 high.
- Published
- 162
- Critical
- 27
- High
- 26
- Medium
- 94
- Low
- 5
- Unrated
- 10
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Qualcomm Snapdragon
- 23
- Samsung Mobile Devices
- 13
- Samsung Mobile Samsung Account
- 7
- Projectworlds Pvt. Limited Online Matrimonial Project
- 6
- spikefinned ImageMapper
- 4
- Veeam One
- 4
- squidex
- 3
- garykeorkunian Amazonify
- 2
- Projectworlds Pvt. Limited Online Job Portal
- 2
- Samsung Mobile Samsung Push Service
- 2
Critical 27
- CVE-2023-46800Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Matrimonial Project
- CVE-2023-46793Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Matrimonial Project
- CVE-2023-46789Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Matrimonial Project
- CVE-2023-46788Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Matrimonial Project
- CVE-2023-46787Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Matrimonial Project
- CVE-2023-46785Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Matrimonial Project
- CVE-2023-46679Online Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Job Portal
- CVE-2023-46677Online Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Job Portal
- CVE-2023-46243Code execution via the edit action in XWiki platformxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-46242Code injection in XWiki Platformxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-46244Privilege escalation in Xwiki platformxwiki-platform · org.xwiki.platform:xwiki-platform-display-…
- CVE-2023-46253Remote code execution in Squidexsquidex
- CVE-2023-42659WS_FTP Server Arbitrary File UploadProgress Software WS_FTP Server
- CVE-2023-46851Apache Allura: sensitive information exposure via importApache Software Foundation Apache Allura
- CVE-2023-38548A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of Veeam One
- CVE-2023-38547A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access itsVeeam One
- CVE-2023-33045Buffer Copy Without Checking Size of Input in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-28574Improper Input Validation in CoreQualcomm Snapdragon
- CVE-2023-22388Use of Out-of-range Pointer Offset in Multi-mode Call ProcessorQualcomm Snapdragon
- CVE-2023-21671Improper Input Validation in CoreQualcomm Snapdragon
- CVE-2023-33478RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php.
- CVE-2023-33479RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file.
- CVE-2023-33481RemoteClinic 2.0 is vulnerable to a time-based blind SQL injection attack in the 'start' GET parameter of patients/index.php.
- CVE-2023-45380In the module "Order Duplicator " Clone and Delete Existing Order" (orderduplicate) in version <= 1.1.7 from Silbersaiten for PrestaShop, a
- CVE-2023-46501An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin pass
- CVE-2023-47455Tenda AX1806 V1.0.0.1 contains a heap overflow vulnerability in setSchedWifi function, in which the src and v12 are directly obtained from h
- CVE-2023-47456Tenda AX1806 V1.0.0.1 contains a stack overflow vulnerability in function sub_455D4, called by function fromSetWirelessRepeat.
High 26
- CVE-2023-4154Samba: ad dc password exposure to privileged users and rodcssamba · Red Hat Enterprise Linux +2
- CVE-2023-46730Server-Side Request Forgery in groupoffice Intermesh groupoffice
- CVE-2022-41616WordPress Export Users Data CSV Plugin <= 2.1 is vulnerable to CSV InjectionKaushik Kalathiya Export Users Data CSV
- CVE-2023-4295Mali GPU Kernel Driver allows improper GPU memory processing operationsArm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…
- CVE-2023-3889Mali GPU Kernel Driver exposes sensitive data from freed memoryArm Valhall GPU Kernel Driver
- CVE-2023-5179An issue was discovered in Open Design Alliance Drawings SDK before 2024.10.Open Design Alliance ODA Drawings SDK - All Versions <
- CVE-2023-25983WordPress KB Support Plugin <= 1.5.84 is vulnerable to CSV InjectionWPOmnia KB Support
- CVE-2023-5709WD WidgetTwitter <= 1.0.9 - Authenticated (Contributor+) SQL Injection via Shortcode10web WD WidgetTwitter
- CVE-2023-47510Unauth.WPSolutions-HQ WPDBSpringClean
- CVE-2023-42537An improper input validation in get_head_crc in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read Samsung Mobile Devices
- CVE-2023-42536An improper input validation in saped_dec in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read andSamsung Mobile Devices
- CVE-2023-42535Out-of-bounds Write in read_block of vold prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-33074Use After Free in AudioQualcomm Snapdragon
- CVE-2023-33061Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33059Buffer Copy Without Checking Size of Input in AudioQualcomm Snapdragon
- CVE-2023-33056NULL Pointer dereference in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33055Buffer Copy Without Checking Size of Input in AudioQualcomm Snapdragon
- CVE-2023-33048Buffer over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33047Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33031Buffer Copy Without Checking Size of Input in Automotive AudioQualcomm Snapdragon
- CVE-2023-28556Improper Authorization in HLOSQualcomm Snapdragon
- CVE-2023-28545Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OSQualcomm Snapdragon
- CVE-2023-24852Improper Authentication in CoreQualcomm Snapdragon
- CVE-2021-43419An Information Disclosure vulnerability exists in Opay Mobile application 1.5.1.26 and maybe be higher in the logcat app.
- CVE-2023-33480RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to
- CVE-2023-47360Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length.
Medium, low and unrated 109
- CVE-2023-6002Log InjectionYugabyteDB
- CVE-2023-6001Prometheus Metrics Accessible Pre-AuthenticationYugabyteDB Anywhere
- CVE-2023-5982UpdraftPlus <= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Updatedavidanderson UpdraftPlus: WP Backup & Migration Plugin
- CVE-2023-5819Amazonify <= 0.8.1 - Authenticated (Admin+) Stored Cross-Site Scriptinggarykeorkunian Amazonify
- CVE-2023-5818Amazonify <= 0.8.1 - Cross-Site Request Forgery to Amazon Tracking ID Updategarykeorkunian Amazonify
- CVE-2023-4956Quay: clickjacking on config-editor page severityRed Hat Quay
- CVE-2023-5309Broken Session Management in Puppet EnterprisePuppet Enterprise
- CVE-2023-46252Cross-Site Scripting (XSS) via postMessage Handler in Squidexsquidex
- CVE-2023-5998Out-of-bounds Read in gpac/gpacgpac/gpac
- CVE-2023-28499WordPress Slide Anything Plugin <= 2.4.9 is vulnerable to Cross Site Scripting (XSS)simonpedge Slide Anything – Responsive Content / HTML Slide…
- CVE-2023-46737Possible endless data attack from attacker-controlled registry in cosignsigstore cosign · github.com/sigstore/cosign +1
- CVE-2023-32966WordPress Jazz Popups Plugin <= 1.8.7 is vulnerable to Cross Site Request Forgery (CSRF) leading to Stored XSSCRUDLab Jazz Popups
- CVE-2022-47181WordPress Email Templates Plugin <= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF)wpexpertsio Email Templates Customizer and Designer for Wor…
- CVE-2023-46744Stored Cross-site Scripting in Squidexsquidex
- CVE-2023-41798WordPress Directorist Plugin <= 7.7.1 is vulnerable to CSV InjectionwpWax Directorist – WordPress Business Directory Plugin wit…
- CVE-2022-38702WordPress WP CSV Exporter Plugin <= 2.0 is vulnerable to CSV InjectionNakashima Masahiro WP CSV Exporter
- CVE-2022-42882WordPress Simple CSV/XLS Exporter Plugin <= 1.5.8 is vulnerable to CSV InjectionShambix Simple CSV/XLS Exporter
- CVE-2022-44738WordPress Posts and Users Stats Plugin <= 1.1.3 is vulnerable to CSV InjectionPatrick Robrecht Posts and Users Stats
- CVE-2022-45078WordPress User Blocker Plugin <= 1.5.5 is vulnerable to CSV InjectionSolwin Infotech User Blocker
- CVE-2022-45360WordPress Commenter Emails Plugin <= 2.6.1 is vulnerable to CSV InjectionScott Reilly Commenter Emails
- CVE-2022-45370WordPress WordPress Comments Import & Export Plugin <= 2.3.1 is vulnerable to CSV InjectionWebToffee WordPress Comments Import & Export
- CVE-2022-45348WordPress amr users Plugin <= 4.59.4 is vulnerable to CSV Injectionanmari amr users
- CVE-2022-45810WordPress Email Subscribers & Newsletters Plugin <= 5.5.2 is vulnerable to CSV InjectionIcegram Express – Email Marketing, Newsletters and Automati…
- CVE-2022-46821WordPress Emails & Newsletters with Jackmail Plugin <= 1.2.22 is vulnerable to CSV InjectionJackmail & Sarbacane Emails & Newsletters with Jackmail
- CVE-2022-46804WordPress Export Users Data Distinct Plugin <= 1.3 is vulnerable to CSV InjectionNarola Infotech Solutions LLP Export Users Data Distinct
- CVE-2022-46803WordPress Noptin Plugin <= 1.9.5 is vulnerable to CSV InjectionNoptin Newsletter Simple Newsletter Plugin – Noptin
- CVE-2022-46809WordPress ReviewX Plugin <= 1.6.7 is vulnerable to CSV InjectionWPDeveloper ReviewX – Multi-criteria Rating & Reviews for W…
- CVE-2023-0898Uncontrolled Search Path Element in GE MiCOM S1 AgileGeneral Electric MiCOM S1 Agile
- CVE-2022-46801WordPress Site Reviews Plugin <= 6.2.0 is vulnerable to CSV InjectionPaul Ryley Site Reviews
- CVE-2022-46802WordPress Product Reviews Import Export for WooCommerce Plugin <= 1.4.8 is vulnerable to CSV InjectionWebToffee Product Reviews Import Export for WooCommerce
- CVE-2023-36527WordPress Post to CSV by BestWebSoft Plugin <= 1.4.0 is vulnerable to CSV InjectionPost to CSV by BestWebSoft
- CVE-2023-23796WordPress Form Builder Plugin <= 1.9.9.0 is vulnerable to CSV InjectionMuneeb Form Builder | Create Responsive Contact Forms
- CVE-2023-23678WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin <= 2.2.5 is vulnerable to CSV InjectionWPEkaClub WP Cookie Consent
- CVE-2022-45357WordPress 1003 Mortgage Application Plugin <= 1.75 is vulnerable to CSV InjectionLenderd 1003 Mortgage Application
- CVE-2023-22719WordPress GiveWP Plugin <= 2.25.1 is vulnerable to CSV InjectionGiveWP
- CVE-2023-4272Mali GPU Kernel Driver exposes sensitive data from freed memoryArm Midgard GPU Kernel Driver · Arm Bifrost GPU Kernel D… +2
- CVE-2022-47442WordPress UsersWP Plugin <= 1.2.3.9 is vulnerable to CSV InjectionAyeCode UsersWP
- CVE-2022-45350WordPress Simple History Plugin <= 3.3.1 is vulnerable to CSV InjectionPär Thernström Simple History – user activity log, audit to…
- CVE-2023-0436Secret logging may occur in debug mode of Atlas Operator MongoDB Atlas Kubernetes Operator
- CVE-2023-4888Simple Like Page Plugin <= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodetopdevs Simple Like Page Plugin – Fast & Privacy-Friendly P…
- CVE-2023-5660SendPress Newsletters <= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodebrewlabs SendPress Newsletters
- CVE-2023-5567QR Code Tag <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodedspreen QR Code Tag
- CVE-2023-4842Social Sharing Plugin - Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewarfareplugins Social Sharing Plugin – Social Warfare
- CVE-2023-5661Social Feed <= 1.5.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcodeumarbajwa Social Feed | All social media in one place
- CVE-2023-5659Interact: Embed A Quiz On Your Site <= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodetryinteract Interact: Embed A Quiz On Your Site
- CVE-2023-5703Gift Up Gift Cards for WordPress and WooCommerce <= 2.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodekoanleeroy Gift Up Gift Cards for WordPress and WooCommerce
- CVE-2023-5577Bitly's WordPress Plugin <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodebitlydeveloper Bitly's WordPress Plugin
- CVE-2023-5669Featured Image Caption <= 0.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodecconover Featured Image Caption
- CVE-2023-46819Apache OFBiz: Execution of Solr plugin queries without authenticationApache Software Foundation Apache OFBiz
- CVE-2023-5532ImageMapper <= 1.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting via imgmap_save_area_titlespikefinned ImageMapper
- CVE-2023-5507ImageMapper <= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodespikefinned ImageMapper
- CVE-2023-5975ImageMapper <= 1.2.6 - Cross-Site Request Forgery to Plugin Settings Change via ajaxspikefinned ImageMapper
- CVE-2023-5658WP MapIt <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodephpwebdev WP MapIt
- CVE-2023-5506ImageMapper <= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page/Post Deletion via imgmap_delete_area_ajaxspikefinned ImageMapper
- CVE-2023-5743Telephone Number Linker <= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodestoatoffear Telephone Number Linker
- CVE-2021-4431msyk FMDataAPI FMDataAPI_Sample.php cross site scriptingmsyk FMDataAPI
- CVE-2023-42555Use of implicit intent for sensitive communication vulnerability in EasySetup prior to version 11.1.13 allows attackers to get the bluetoothSamsung Mobile EasySetup
- CVE-2023-42554Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication.Samsung Mobile Samsung Pass
- CVE-2023-42553Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email.Samsung Mobile Samsung Email
- CVE-2023-42552Implicit intent hijacking vulnerability in Firewall application prior to versions 12.1.00.24 in Android 11, 13.1.00.16 in Android 12 and 14.Samsung Mobile Firewall
- CVE-2023-42551Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version 14.5.00.7 allows atSamsung Mobile Samsung Account
- CVE-2023-42550Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5.00.7 allows attackeSamsung Mobile Samsung Account
- CVE-2023-42549Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior to version 14.5.00.Samsung Mobile Samsung Account
- CVE-2023-42548Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prior to version 14.5.00.Samsung Mobile Samsung Account
- CVE-2023-42547Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prior to version 14.5.00Samsung Mobile Samsung Account
- CVE-2023-42546Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account prior to version 14.5.Samsung Mobile Samsung Account
- CVE-2023-42545Use of implicit intent for sensitive communication vulnerability in Phone prior to versions 12.7.20.12 in Android 11, 13.1.48, 13.5.28 in AnSamsung Mobile Phone
- CVE-2023-42544Improper access control vulnerability in Quick Share prior to 13.5.52.0 allows local attacker to access local files.Samsung Mobile Quick Share
- CVE-2023-42543Improper verification of intent by broadcast receiver vulnerability in Bixby Voice prior to version 3.3.35.12 allows attackers to access arbSamsung Mobile Bixby Voice
- CVE-2023-42542Improper access control vulnerability in Samsung Push Service prior to 3.4.10 allows local attackers to get register ID to identify the deviSamsung Mobile Samsung Push Service
- CVE-2023-42541Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id.Samsung Mobile Samsung Push Service
- CVE-2023-42540Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive information via impSamsung Mobile Samsung Account
- CVE-2023-42539PendingIntent hijacking vulnerability in ChallengeNotificationManager in Samsung Health prior to version 6.25 allows local attackers to acceSamsung Mobile Samsung Health
- CVE-2023-42538An improper input validation in saped_rec_silence in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds Samsung Mobile Devices
- CVE-2023-42534Improper input validation vulnerability in ChooserActivity prior to SMR Nov-2023 Release 1 allows local attackers to read arbitrary files wiSamsung Mobile Devices
- CVE-2023-42533Improper Input Validation with USB Gadget Interface prior to SMR Nov-2023 Release 1 allows a physical attacker to execute arbitrary code in Samsung Mobile Devices
- CVE-2023-42532Improper Certificate Validation in FotaAgent prior to SMR Nov-2023 Release1 allows remote attacker to intercept the network traffic includinSamsung Mobile Devices
- CVE-2023-42531Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass restrictions on startSamsung Mobile Devices
- CVE-2023-42530Improper access control vulnerability in SecSettings prior to SMR Nov-2023 Release 1 allows attackers to enable Wi-Fi and Wi-Fi Direct withoSamsung Mobile Devices
- CVE-2023-42529Out-of-bound write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-42528Improper Input Validation vulnerability in ProcessNvBuffering of libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to executeSamsung Mobile Devices
- CVE-2023-42527Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to expose sSamsung Mobile Devices
- CVE-2023-30739Arbitrary File Descriptor Write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-46845EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code execEC-CUBE CO. EC-CUBE 4 series · EC-CUBE CO. EC-CUBE 3 series
- CVE-2023-5076Ziteboard Online Whiteboard <= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ziteboard ShortcodeZiteboard Online Whiteboard
- CVE-2023-38549A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of Veeam One
- CVE-2023-41723A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule.Veeam One
- CVE-2019-25156dstar2018 Agency search.php cross site scriptingdstar2018 Agency
- CVE-2023-28572Buffer Over-read in WLAN HOSTQualcomm Snapdragon
- CVE-2023-28570Buffer Copy without Checking Size of Input in AudioQualcomm Snapdragon
- CVE-2023-28569Buffer Over-read in WLAN HALQualcomm Snapdragon
- CVE-2023-28568Buffer Over-read in WLAN HALQualcomm Snapdragon
- CVE-2023-28566Buffer Over-read in WLAN HALQualcomm Snapdragon
- CVE-2023-28563Buffer Over-read in IOE FirmwareQualcomm Snapdragon
- CVE-2023-28554Buffer Over-read in Qualcomm IPCQualcomm Snapdragon
- CVE-2023-28553Buffer Over-read in WLAN HostQualcomm Snapdragon
- CVE-2023-35140The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated Zyxel GS1900-24EP firmware
- CVE-2023-5976Improper Access Control in microweber/microwebermicroweber/microweber
- CVE-2023-41425Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted scrip
- CVE-2023-42283Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query
- CVE-2023-42284Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL
- CVE-2023-42361Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an a
- CVE-2023-43885Missing error handling in the HTTP server component of Tenda RX9 Pro Firmware V22.03.02.20 allows authenticated attackers to arbitrarily loc
- CVE-2023-43886A buffer overflow in the HTTP server component of Tenda RX9 Pro v22.03.02.20 might allow an authenticated attacker to overwrite memory.
- CVE-2023-43984Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information fro
- CVE-2023-46001Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the
- CVE-2023-46998Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted bootbox
- CVE-2023-47102UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid.
- CVE-2023-47359Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() an