# CVEs published 2023-11-07

162 CVEs were published on November 7, 2023: 27 critical, 26 high. Days are UTC.

- [CVE-2023-6002](https://cve.now/CVE-2023-6002.md): Log Injection (CVSS 6.5, YugabyteDB)
- [CVE-2023-6001](https://cve.now/CVE-2023-6001.md): Prometheus Metrics Accessible Pre-Authentication (CVSS 5.3, YugabyteDB Anywhere)
- [CVE-2023-46800](https://cve.now/CVE-2023-46800.md): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Matrimonial Project)
- [CVE-2023-46793](https://cve.now/CVE-2023-46793.md): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Matrimonial Project)
- [CVE-2023-46789](https://cve.now/CVE-2023-46789.md): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Matrimonial Project)
- [CVE-2023-46788](https://cve.now/CVE-2023-46788.md): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Matrimonial Project)
- [CVE-2023-46787](https://cve.now/CVE-2023-46787.md): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Matrimonial Project)
- [CVE-2023-46785](https://cve.now/CVE-2023-46785.md): Online Matrimonial Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Matrimonial Project)
- [CVE-2023-46679](https://cve.now/CVE-2023-46679.md): Online Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Job Portal)
- [CVE-2023-46677](https://cve.now/CVE-2023-46677.md): Online Job Portal v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Job Portal)
- [CVE-2023-5982](https://cve.now/CVE-2023-5982.md): UpdraftPlus \<= 1.23.10 - Cross-Site Request Forgery to Google Drive Storage Update (CVSS 5.4, davidanderson UpdraftPlus: WP Backup & Migration Plugin)
- [CVE-2023-5819](https://cve.now/CVE-2023-5819.md): Amazonify \<= 0.8.1 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, garykeorkunian Amazonify)
- [CVE-2023-5818](https://cve.now/CVE-2023-5818.md): Amazonify \<= 0.8.1 - Cross-Site Request Forgery to Amazon Tracking ID Update (CVSS 4.3, garykeorkunian Amazonify)
- [CVE-2023-4154](https://cve.now/CVE-2023-4154.md): Samba: ad dc password exposure to privileged users and rodcs (CVSS 7.5, samba · Red Hat Enterprise Linux +2)
- [CVE-2023-4956](https://cve.now/CVE-2023-4956.md): Quay: clickjacking on config-editor page severity (CVSS 6.5, Red Hat Quay)
- [CVE-2023-46243](https://cve.now/CVE-2023-46243.md): Code execution via the edit action in XWiki platform (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-46242](https://cve.now/CVE-2023-46242.md): Code injection in XWiki Platform (CVSS 9.7, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-46244](https://cve.now/CVE-2023-46244.md): Privilege escalation in Xwiki platform (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-display-…)
- [CVE-2023-5309](https://cve.now/CVE-2023-5309.md): Broken Session Management in Puppet Enterprise (CVSS 6.8, Puppet Enterprise)
- [CVE-2023-46252](https://cve.now/CVE-2023-46252.md): Cross-Site Scripting (XSS) via postMessage Handler in Squidex (CVSS 6.8, squidex)
- [CVE-2023-46253](https://cve.now/CVE-2023-46253.md): Remote code execution in Squidex (CVSS 9.1, squidex)
- [CVE-2023-5998](https://cve.now/CVE-2023-5998.md): Out-of-bounds Read in gpac/gpac (CVSS 4.0, gpac/gpac)
- [CVE-2023-46730](https://cve.now/CVE-2023-46730.md): Server-Side Request Forgery in groupoffice (CVSS 7.4, Intermesh groupoffice)
- [CVE-2023-28499](https://cve.now/CVE-2023-28499.md): WordPress Slide Anything Plugin \<= 2.4.9 is vulnerable to Cross Site Scripting (XSS) (no CVSS, simonpedge Slide Anything – Responsive Content / HTML Slide…)
- [CVE-2023-46737](https://cve.now/CVE-2023-46737.md): Possible endless data attack from attacker-controlled registry in cosign (CVSS 3.1, sigstore cosign · github.com/sigstore/cosign +1)
- [CVE-2023-32966](https://cve.now/CVE-2023-32966.md): WordPress Jazz Popups Plugin \<= 1.8.7 is vulnerable to Cross Site Request Forgery (CSRF) leading to Stored XSS (CVSS 5.4, CRUDLab Jazz Popups)
- [CVE-2022-47181](https://cve.now/CVE-2022-47181.md): WordPress Email Templates Plugin \<= 1.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, wpexpertsio Email Templates Customizer and Designer for Wor…)
- [CVE-2023-46744](https://cve.now/CVE-2023-46744.md): Stored Cross-site Scripting in Squidex (CVSS 5.4, squidex)
- [CVE-2023-41798](https://cve.now/CVE-2023-41798.md): WordPress Directorist Plugin \<= 7.7.1 is vulnerable to CSV Injection (CVSS 5.1, wpWax Directorist – WordPress Business Directory Plugin wit…)
- [CVE-2022-41616](https://cve.now/CVE-2022-41616.md): WordPress Export Users Data CSV Plugin \<= 2.1 is vulnerable to CSV Injection (CVSS 7.6, Kaushik Kalathiya Export Users Data CSV)
- [CVE-2022-38702](https://cve.now/CVE-2022-38702.md): WordPress WP CSV Exporter Plugin \<= 2.0 is vulnerable to CSV Injection (CVSS 5.8, Nakashima Masahiro WP CSV Exporter)
- [CVE-2022-42882](https://cve.now/CVE-2022-42882.md): WordPress Simple CSV/XLS Exporter Plugin \<= 1.5.8 is vulnerable to CSV Injection (CVSS 5.8, Shambix Simple CSV/XLS Exporter)
- [CVE-2022-44738](https://cve.now/CVE-2022-44738.md): WordPress Posts and Users Stats Plugin \<= 1.1.3 is vulnerable to CSV Injection (CVSS 5.8, Patrick Robrecht Posts and Users Stats)
- [CVE-2022-45078](https://cve.now/CVE-2022-45078.md): WordPress User Blocker Plugin \<= 1.5.5 is vulnerable to CSV Injection (CVSS 5.9, Solwin Infotech User Blocker)
- [CVE-2022-45360](https://cve.now/CVE-2022-45360.md): WordPress Commenter Emails Plugin \<= 2.6.1 is vulnerable to CSV Injection (CVSS 4.7, Scott Reilly Commenter Emails)
- [CVE-2022-45370](https://cve.now/CVE-2022-45370.md): WordPress WordPress Comments Import & Export Plugin \<= 2.3.1 is vulnerable to CSV Injection (CVSS 6.1, WebToffee WordPress Comments Import & Export)
- [CVE-2022-45348](https://cve.now/CVE-2022-45348.md): WordPress amr users Plugin \<= 4.59.4 is vulnerable to CSV Injection (CVSS 5.8, anmari amr users)
- [CVE-2022-45810](https://cve.now/CVE-2022-45810.md): WordPress Email Subscribers & Newsletters Plugin \<= 5.5.2 is vulnerable to CSV Injection (CVSS 6.1, Icegram Express – Email Marketing, Newsletters and Automati…)
- [CVE-2022-46821](https://cve.now/CVE-2022-46821.md): WordPress Emails & Newsletters with Jackmail Plugin \<= 1.2.22 is vulnerable to CSV Injection (CVSS 5.8, Jackmail & Sarbacane Emails & Newsletters with Jackmail)
- [CVE-2022-46804](https://cve.now/CVE-2022-46804.md): WordPress Export Users Data Distinct Plugin \<= 1.3 is vulnerable to CSV Injection (CVSS 5.8, Narola Infotech Solutions LLP Export Users Data Distinct)
- [CVE-2022-46803](https://cve.now/CVE-2022-46803.md): WordPress Noptin Plugin \<= 1.9.5 is vulnerable to CSV Injection (CVSS 6.1, Noptin Newsletter Simple Newsletter Plugin – Noptin)
- [CVE-2022-46809](https://cve.now/CVE-2022-46809.md): WordPress ReviewX Plugin \<= 1.6.7 is vulnerable to CSV Injection (CVSS 6.1, WPDeveloper ReviewX – Multi-criteria Rating & Reviews for W…)
- [CVE-2023-0898](https://cve.now/CVE-2023-0898.md): Uncontrolled Search Path Element in GE MiCOM S1 Agile (CVSS 5.3, General Electric MiCOM S1 Agile)
- [CVE-2022-46801](https://cve.now/CVE-2022-46801.md): WordPress Site Reviews Plugin \<= 6.2.0 is vulnerable to CSV Injection (CVSS 6.1, Paul Ryley Site Reviews)
- [CVE-2022-46802](https://cve.now/CVE-2022-46802.md): WordPress Product Reviews Import Export for WooCommerce Plugin \<= 1.4.8 is vulnerable to CSV Injection (CVSS 6.1, WebToffee Product Reviews Import Export for WooCommerce)
- [CVE-2023-36527](https://cve.now/CVE-2023-36527.md): WordPress Post to CSV by BestWebSoft Plugin \<= 1.4.0 is vulnerable to CSV Injection (CVSS 4.7, Post to CSV by BestWebSoft)
- [CVE-2023-23796](https://cve.now/CVE-2023-23796.md): WordPress Form Builder Plugin \<= 1.9.9.0 is vulnerable to CSV Injection (CVSS 4.7, Muneeb Form Builder | Create Responsive Contact Forms)
- [CVE-2023-23678](https://cve.now/CVE-2023-23678.md): WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent Plugin \<= 2.2.5 is vulnerable to CSV Injection (CVSS 4.0, WPEkaClub WP Cookie Consent)
- [CVE-2022-45357](https://cve.now/CVE-2022-45357.md): WordPress 1003 Mortgage Application Plugin \<= 1.75 is vulnerable to CSV Injection (CVSS 6.1, Lenderd 1003 Mortgage Application)
- [CVE-2023-4295](https://cve.now/CVE-2023-4295.md): Mali GPU Kernel Driver allows improper GPU memory processing operations (CVSS 7.8, Arm Valhall GPU Kernel Driver · Arm 5th Gen GPU Architectur…)
- [CVE-2023-22719](https://cve.now/CVE-2023-22719.md): WordPress GiveWP Plugin \<= 2.25.1 is vulnerable to CSV Injection (CVSS 4.7, GiveWP)
- [CVE-2023-3889](https://cve.now/CVE-2023-3889.md): Mali GPU Kernel Driver exposes sensitive data from freed memory (CVSS 7.8, Arm Valhall GPU Kernel Driver)
- [CVE-2023-4272](https://cve.now/CVE-2023-4272.md): Mali GPU Kernel Driver exposes sensitive data from freed memory (CVSS 5.5, Arm Midgard GPU Kernel Driver · Arm Bifrost GPU Kernel D… +2)
- [CVE-2023-5179](https://cve.now/CVE-2023-5179.md): An issue was discovered in Open Design Alliance Drawings SDK before 2024.10. (CVSS 7.8, Open Design Alliance ODA Drawings SDK - All Versions \<)
- [CVE-2023-42659](https://cve.now/CVE-2023-42659.md): WS\_FTP Server Arbitrary File Upload (CVSS 9.1, Progress Software WS\_FTP Server)
- [CVE-2023-25983](https://cve.now/CVE-2023-25983.md): WordPress KB Support Plugin \<= 1.5.84 is vulnerable to CSV Injection (CVSS 8.8, WPOmnia KB Support)
- [CVE-2022-47442](https://cve.now/CVE-2022-47442.md): WordPress UsersWP Plugin \<= 1.2.3.9 is vulnerable to CSV Injection (CVSS 5.8, AyeCode UsersWP)
- [CVE-2022-45350](https://cve.now/CVE-2022-45350.md): WordPress Simple History Plugin \<= 3.3.1 is vulnerable to CSV Injection (CVSS 3.0, Pär Thernström Simple History – user activity log, audit to…)
- [CVE-2023-0436](https://cve.now/CVE-2023-0436.md): Secret logging may occur in debug mode of Atlas Operator (CVSS 4.5, MongoDB Atlas Kubernetes Operator)
- [CVE-2023-4888](https://cve.now/CVE-2023-4888.md): Simple Like Page Plugin \<= 1.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, topdevs Simple Like Page Plugin – Fast & Privacy-Friendly P…)
- [CVE-2023-5660](https://cve.now/CVE-2023-5660.md): SendPress Newsletters \<= 1.22.3.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, brewlabs SendPress Newsletters)
- [CVE-2023-5567](https://cve.now/CVE-2023-5567.md): QR Code Tag \<= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, dspreen QR Code Tag)
- [CVE-2023-4842](https://cve.now/CVE-2023-4842.md): Social Sharing Plugin - Social Warfare \<= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, warfareplugins Social Sharing Plugin – Social Warfare)
- [CVE-2023-5661](https://cve.now/CVE-2023-5661.md): Social Feed \<= 1.5.4.6 - Authenticated (Author+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, umarbajwa Social Feed | All social media in one place)
- [CVE-2023-5709](https://cve.now/CVE-2023-5709.md): WD WidgetTwitter \<= 1.0.9 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8, 10web WD WidgetTwitter)
- [CVE-2023-5659](https://cve.now/CVE-2023-5659.md): Interact: Embed A Quiz On Your Site \<= 3.0.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, tryinteract Interact: Embed A Quiz On Your Site)
- [CVE-2023-5703](https://cve.now/CVE-2023-5703.md): Gift Up Gift Cards for WordPress and WooCommerce \<= 2.20.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, koanleeroy Gift Up Gift Cards for WordPress and WooCommerce)
- [CVE-2023-5577](https://cve.now/CVE-2023-5577.md): Bitly's WordPress Plugin \<= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, bitlydeveloper Bitly's WordPress Plugin)
- [CVE-2023-5669](https://cve.now/CVE-2023-5669.md): Featured Image Caption \<= 0.8.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, cconover Featured Image Caption)
- [CVE-2023-46819](https://cve.now/CVE-2023-46819.md): Apache OFBiz: Execution of Solr plugin queries without authentication (CVSS 5.3, Apache Software Foundation Apache OFBiz)
- [CVE-2023-5532](https://cve.now/CVE-2023-5532.md): ImageMapper \<= 1.2.6 - Cross-Site Request Forgery to Stored Cross-Site Scripting via imgmap\_save\_area\_title (CVSS 6.1, spikefinned ImageMapper)
- [CVE-2023-5507](https://cve.now/CVE-2023-5507.md): ImageMapper \<= 1.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, spikefinned ImageMapper)
- [CVE-2023-5975](https://cve.now/CVE-2023-5975.md): ImageMapper \<= 1.2.6 - Cross-Site Request Forgery to Plugin Settings Change via ajax (CVSS 4.3, spikefinned ImageMapper)
- [CVE-2023-5658](https://cve.now/CVE-2023-5658.md): WP MapIt \<= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, phpwebdev WP MapIt)
- [CVE-2023-5506](https://cve.now/CVE-2023-5506.md): ImageMapper \<= 1.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page/Post Deletion via imgmap\_delete\_area\_ajax (CVSS 5.4, spikefinned ImageMapper)
- [CVE-2023-5743](https://cve.now/CVE-2023-5743.md): Telephone Number Linker \<= 1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, stoatoffear Telephone Number Linker)
- [CVE-2021-4431](https://cve.now/CVE-2021-4431.md): msyk FMDataAPI FMDataAPI\_Sample.php cross site scripting (CVSS 3.5, msyk FMDataAPI)
- [CVE-2023-47510](https://cve.now/CVE-2023-47510.md): Unauth. (CVSS 7.1, WPSolutions-HQ WPDBSpringClean)
- [CVE-2023-46851](https://cve.now/CVE-2023-46851.md): Apache Allura: sensitive information exposure via import (critical (no CVSS), Apache Software Foundation Apache Allura)
- [CVE-2023-42555](https://cve.now/CVE-2023-42555.md): Use of implicit intent for sensitive communication vulnerability in EasySetup prior to version 11.1.13 allows attackers to get the bluetooth (CVSS 6.3, Samsung Mobile EasySetup)
- [CVE-2023-42554](https://cve.now/CVE-2023-42554.md): Improper Authentication vulnerabiity in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication. (CVSS 5.4, Samsung Mobile Samsung Pass)
- [CVE-2023-42553](https://cve.now/CVE-2023-42553.md): Improper authorization verification vulnerability in Samsung Email prior to version 6.1.90.4 allows attackers to read sandbox data of email. (CVSS 4.0, Samsung Mobile Samsung Email)
- [CVE-2023-42552](https://cve.now/CVE-2023-42552.md): Implicit intent hijacking vulnerability in Firewall application prior to versions 12.1.00.24 in Android 11, 13.1.00.16 in Android 12 and 14. (CVSS 4.4, Samsung Mobile Firewall)
- [CVE-2023-42551](https://cve.now/CVE-2023-42551.md): Use of implicit intent for sensitive communication vulnerability in startTncActivity in Samsung Account prior to version 14.5.00.7 allows at (CVSS 5.5, Samsung Mobile Samsung Account)
- [CVE-2023-42550](https://cve.now/CVE-2023-42550.md): Use of implicit intent for sensitive communication vulnerability in startSignIn in Samsung Account prior to version 14.5.00.7 allows attacke (CVSS 5.5, Samsung Mobile Samsung Account)
- [CVE-2023-42549](https://cve.now/CVE-2023-42549.md): Use of implicit intent for sensitive communication vulnerability in startNameValidationActivity in Samsung Account prior to version 14.5.00. (CVSS 5.5, Samsung Mobile Samsung Account)
- [CVE-2023-42548](https://cve.now/CVE-2023-42548.md): Use of implicit intent for sensitive communication vulnerability in startMandatoryCheckActivity in Samsung Account prior to version 14.5.00. (CVSS 5.5, Samsung Mobile Samsung Account)
- [CVE-2023-42547](https://cve.now/CVE-2023-42547.md): Use of implicit intent for sensitive communication vulnerability in startEmailValidationActivity in Samsung Account prior to version 14.5.00 (CVSS 5.5, Samsung Mobile Samsung Account)
- [CVE-2023-42546](https://cve.now/CVE-2023-42546.md): Use of implicit intent for sensitive communication vulnerability in startAgreeToDisclaimerActivity in Samsung Account prior to version 14.5. (CVSS 5.5, Samsung Mobile Samsung Account)
- [CVE-2023-42545](https://cve.now/CVE-2023-42545.md): Use of implicit intent for sensitive communication vulnerability in Phone prior to versions 12.7.20.12 in Android 11, 13.1.48, 13.5.28 in An (CVSS 5.5, Samsung Mobile Phone)
- [CVE-2023-42544](https://cve.now/CVE-2023-42544.md): Improper access control vulnerability in Quick Share prior to 13.5.52.0 allows local attacker to access local files. (CVSS 5.5, Samsung Mobile Quick Share)
- [CVE-2023-42543](https://cve.now/CVE-2023-42543.md): Improper verification of intent by broadcast receiver vulnerability in Bixby Voice prior to version 3.3.35.12 allows attackers to access arb (CVSS 6.2, Samsung Mobile Bixby Voice)
- [CVE-2023-42542](https://cve.now/CVE-2023-42542.md): Improper access control vulnerability in Samsung Push Service prior to 3.4.10 allows local attackers to get register ID to identify the devi (CVSS 3.3, Samsung Mobile Samsung Push Service)
- [CVE-2023-42541](https://cve.now/CVE-2023-42541.md): Improper authorization in PushClientProvider of Samsung Push Service prior to version 3.4.10 allows attacker to access unique id. (CVSS 4.0, Samsung Mobile Samsung Push Service)
- [CVE-2023-42540](https://cve.now/CVE-2023-42540.md): Improper access control vulnerability in Samsung Account prior to version 14.5.01.1 allows attackers to access sensitive information via imp (CVSS 4.0, Samsung Mobile Samsung Account)
- [CVE-2023-42539](https://cve.now/CVE-2023-42539.md): PendingIntent hijacking vulnerability in ChallengeNotificationManager in Samsung Health prior to version 6.25 allows local attackers to acce (CVSS 4.7, Samsung Mobile Samsung Health)
- [CVE-2023-42538](https://cve.now/CVE-2023-42538.md): An improper input validation in saped\_rec\_silence in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2023-42537](https://cve.now/CVE-2023-42537.md): An improper input validation in get\_head\_crc in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2023-42536](https://cve.now/CVE-2023-42536.md): An improper input validation in saped\_dec in libsaped prior to SMR Nov-2023 Release 1 allows local attackers to cause out-of-bounds read and (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2023-42535](https://cve.now/CVE-2023-42535.md): Out-of-bounds Write in read\_block of vold prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code. (CVSS 8.4, Samsung Mobile Devices)
- [CVE-2023-42534](https://cve.now/CVE-2023-42534.md): Improper input validation vulnerability in ChooserActivity prior to SMR Nov-2023 Release 1 allows local attackers to read arbitrary files wi (CVSS 6.3, Samsung Mobile Devices)
- [CVE-2023-42533](https://cve.now/CVE-2023-42533.md): Improper Input Validation with USB Gadget Interface prior to SMR Nov-2023 Release 1 allows a physical attacker to execute arbitrary code in (CVSS 6.6, Samsung Mobile Devices)
- [CVE-2023-42532](https://cve.now/CVE-2023-42532.md): Improper Certificate Validation in FotaAgent prior to SMR Nov-2023 Release1 allows remote attacker to intercept the network traffic includin (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2023-42531](https://cve.now/CVE-2023-42531.md): Improper access control vulnerability in SmsController prior to SMR Nov-2023 Release1 allows local attackers to bypass restrictions on start (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2023-42530](https://cve.now/CVE-2023-42530.md): Improper access control vulnerability in SecSettings prior to SMR Nov-2023 Release 1 allows attackers to enable Wi-Fi and Wi-Fi Direct witho (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-42529](https://cve.now/CVE-2023-42529.md): Out-of-bound write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to execute arbitrary code. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-42528](https://cve.now/CVE-2023-42528.md): Improper Input Validation vulnerability in ProcessNvBuffering of libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-42527](https://cve.now/CVE-2023-42527.md): Improper input validation vulnerability in ProcessWriteFile of libsec-ril prior to SMR Nov-2023 Release 1 allows local attackers to expose s (CVSS 5.6, Samsung Mobile Devices)
- [CVE-2023-30739](https://cve.now/CVE-2023-30739.md): Arbitrary File Descriptor Write vulnerability in libsec-ril prior to SMR Nov-2023 Release 1 allows local attacker to execute arbitrary code. (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-46845](https://cve.now/CVE-2023-46845.md): EC-CUBE 3 series (3.0.0 to 3.0.18-p6) and 4 series (4.0.0 to 4.0.6-p3, 4.1.0 to 4.1.2-p2, and 4.2.0 to 4.2.2) contain an arbitrary code exec (no CVSS, EC-CUBE CO. EC-CUBE 4 series · EC-CUBE CO. EC-CUBE 3 series)
- [CVE-2023-5076](https://cve.now/CVE-2023-5076.md): Ziteboard Online Whiteboard \<= 2.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via ziteboard Shortcode (CVSS 6.4, Ziteboard Online Whiteboard)
- [CVE-2023-38548](https://cve.now/CVE-2023-38548.md): A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of (CVSS 9.8, Veeam One)
- [CVE-2023-38549](https://cve.now/CVE-2023-38549.md): A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of (CVSS 4.5, Veeam One)
- [CVE-2023-38547](https://cve.now/CVE-2023-38547.md): A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its (CVSS 9.9, Veeam One)
- [CVE-2023-41723](https://cve.now/CVE-2023-41723.md): A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule. (CVSS 4.3, Veeam One)
- [CVE-2019-25156](https://cve.now/CVE-2019-25156.md): dstar2018 Agency search.php cross site scripting (CVSS 3.5, dstar2018 Agency)
- [CVE-2023-33074](https://cve.now/CVE-2023-33074.md): Use After Free in Audio (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-33061](https://cve.now/CVE-2023-33061.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33059](https://cve.now/CVE-2023-33059.md): Buffer Copy Without Checking Size of Input in Audio (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-33056](https://cve.now/CVE-2023-33056.md): NULL Pointer dereference in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33055](https://cve.now/CVE-2023-33055.md): Buffer Copy Without Checking Size of Input in Audio (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-33048](https://cve.now/CVE-2023-33048.md): Buffer over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33047](https://cve.now/CVE-2023-33047.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33045](https://cve.now/CVE-2023-33045.md): Buffer Copy Without Checking Size of Input in WLAN Firmware (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2023-33031](https://cve.now/CVE-2023-33031.md): Buffer Copy Without Checking Size of Input in Automotive Audio (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28574](https://cve.now/CVE-2023-28574.md): Improper Input Validation in Core (CVSS 9.0, Qualcomm Snapdragon)
- [CVE-2023-28572](https://cve.now/CVE-2023-28572.md): Buffer Over-read in WLAN HOST (CVSS 6.6, Qualcomm Snapdragon)
- [CVE-2023-28570](https://cve.now/CVE-2023-28570.md): Buffer Copy without Checking Size of Input in Audio (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-28569](https://cve.now/CVE-2023-28569.md): Buffer Over-read in WLAN HAL (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2023-28568](https://cve.now/CVE-2023-28568.md): Buffer Over-read in WLAN HAL (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2023-28566](https://cve.now/CVE-2023-28566.md): Buffer Over-read in WLAN HAL (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2023-28563](https://cve.now/CVE-2023-28563.md): Buffer Over-read in IOE Firmware (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2023-28556](https://cve.now/CVE-2023-28556.md): Improper Authorization in HLOS (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2023-28554](https://cve.now/CVE-2023-28554.md): Buffer Over-read in Qualcomm IPC (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2023-28553](https://cve.now/CVE-2023-28553.md): Buffer Over-read in WLAN Host (CVSS 6.1, Qualcomm Snapdragon)
- [CVE-2023-28545](https://cve.now/CVE-2023-28545.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in TZ Secure OS (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2023-24852](https://cve.now/CVE-2023-24852.md): Improper Authentication in Core (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-22388](https://cve.now/CVE-2023-22388.md): Use of Out-of-range Pointer Offset in Multi-mode Call Processor (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2023-21671](https://cve.now/CVE-2023-21671.md): Improper Input Validation in Core (CVSS 9.3, Qualcomm Snapdragon)
- [CVE-2023-35140](https://cve.now/CVE-2023-35140.md): The improper privilege management vulnerability in the Zyxel GS1900-24EP switch firmware version V2.70(ABTO.5) could allow an authenticated (CVSS 5.5, Zyxel GS1900-24EP firmware)
- [CVE-2023-5976](https://cve.now/CVE-2023-5976.md): Improper Access Control in microweber/microweber (CVSS 4.6, microweber/microweber)
- [CVE-2021-43419](https://cve.now/CVE-2021-43419.md): An Information Disclosure vulnerability exists in Opay Mobile application 1.5.1.26 and maybe be higher in the logcat app. (CVSS 7.5)
- [CVE-2023-33478](https://cve.now/CVE-2023-33478.md): RemoteClinic 2.0 has a SQL injection vulnerability in the ID parameter of /medicines/stocks.php. (CVSS 9.8)
- [CVE-2023-33479](https://cve.now/CVE-2023-33479.md): RemoteClinic version 2.0 contains a SQL injection vulnerability in the /staff/edit.php file. (CVSS 9.8)
- [CVE-2023-33480](https://cve.now/CVE-2023-33480.md): RemoteClinic 2.0 contains a critical vulnerability chain that can be exploited by a remote attacker with low-privileged user credentials to (CVSS 8.8)
- [CVE-2023-33481](https://cve.now/CVE-2023-33481.md): RemoteClinic 2.0 is vulnerable to a time-based blind SQL injection attack in the 'start' GET parameter of patients/index.php. (CVSS 9.8)
- [CVE-2023-41425](https://cve.now/CVE-2023-41425.md): Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted scrip (CVSS 6.1)
- [CVE-2023-42283](https://cve.now/CVE-2023-42283.md): Blind SQL injection in api\_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query (no CVSS)
- [CVE-2023-42284](https://cve.now/CVE-2023-42284.md): Blind SQL injection in api\_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL (no CVSS)
- [CVE-2023-42361](https://cve.now/CVE-2023-42361.md): Local File Inclusion vulnerability in Midori-global Better PDF Exporter for Jira Server and Jira Data Center v.10.3.0 and before allows an a (no CVSS)
- [CVE-2023-43885](https://cve.now/CVE-2023-43885.md): Missing error handling in the HTTP server component of Tenda RX9 Pro Firmware V22.03.02.20 allows authenticated attackers to arbitrarily loc (no CVSS)
- [CVE-2023-43886](https://cve.now/CVE-2023-43886.md): A buffer overflow in the HTTP server component of Tenda RX9 Pro v22.03.02.20 might allow an authenticated attacker to overwrite memory. (no CVSS)
- [CVE-2023-43984](https://cve.now/CVE-2023-43984.md): Insecure permissions in Smart Soft advancedexport before v4.4.7 allow unauthenticated attackers to arbitrarily download user information fro (no CVSS)
- [CVE-2023-45380](https://cve.now/CVE-2023-45380.md): In the module "Order Duplicator " Clone and Delete Existing Order" (orderduplicate) in version \<= 1.1.7 from Silbersaiten for PrestaShop, a (CVSS 9.1)
- [CVE-2023-46001](https://cve.now/CVE-2023-46001.md): Buffer Overflow vulnerability in gpac MP4Box v.2.3-DEV-rev573-g201320819-master allows a local attacker to cause a denial of service via the (CVSS 5.5)
- [CVE-2023-46501](https://cve.now/CVE-2023-46501.md): An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin pass (CVSS 9.1)
- [CVE-2023-46998](https://cve.now/CVE-2023-46998.md): Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted (no CVSS, bootbox)
- [CVE-2023-47102](https://cve.now/CVE-2023-47102.md): UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid. (CVSS 5.3)
- [CVE-2023-47359](https://cve.now/CVE-2023-47359.md): Videolan VLC prior to version 3.0.20 contains an incorrect offset read that leads to a Heap-Based Buffer Overflow in function GetPacket() an (no CVSS)
- [CVE-2023-47360](https://cve.now/CVE-2023-47360.md): Videolan VLC prior to version 3.0.20 contains an Integer underflow that leads to an incorrect packet length. (CVSS 7.5)
- [CVE-2023-47455](https://cve.now/CVE-2023-47455.md): Tenda AX1806 V1.0.0.1 contains a heap overflow vulnerability in setSchedWifi function, in which the src and v12 are directly obtained from h (CVSS 9.1)
- [CVE-2023-47456](https://cve.now/CVE-2023-47456.md): Tenda AX1806 V1.0.0.1 contains a stack overflow vulnerability in function sub\_455D4, called by function fromSetWirelessRepeat. (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.