CVEs published November 8, 2023
107 CVEs were published on November 8, 2023: 7 critical, 34 high.
- Published
- 107
- Critical
- 7
- High
- 34
- Medium
- 44
- Low
- 2
- Unrated
- 20
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 21
- Lenovo Desktop BIOS
- 15
- Lenovo BIOS
- 5
- Zavio IP Camera CF7500 · Zavio IP Camera CF7300 +9
- 5
- Helix Core
- 3
- FreeBSD
- 2
- 1Lenovo Preload Directory
- 1
- Apache Software Foundation Apache UIMA Java SDK Core · A… +3
- 1
- Apollo13Themes Apollo13 Framework Extensions
- 1
- Ashish Ajani WordPress Simple HTML Sitemap
- 1
Critical 7
- CVE-2023-3959Zavio IP Camera Stack-Based Buffer OverflowZavio IP Camera CF7500 · Zavio IP Camera CF7300 +9
- CVE-2023-45225Zavio IP Camera Stack-Based Buffer OverflowZavio IP Camera CF7500 · Zavio IP Camera CF7300 +9
- CVE-2023-43755Zavio IP Camera Stack-Based Buffer OverflowZavio IP Camera CF7500 · Zavio IP Camera CF7300 +9
- CVE-2023-45849Arbitrary Code Execution in Helix CoreHelix Core
- CVE-2021-43609An issue was discovered in Spiceworks Help Desk Server before 1.3.3.
- CVE-2023-29974An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements.
- CVE-2023-47397WeBid <=1.2.2 is vulnerable to code injection via admin/categoriestrans.php.
High 34
- CVE-2023-39435Zavio IP Camera Stack-Based Buffer OverflowZavio IP Camera CF7500 · Zavio IP Camera CF7300 +9
- CVE-2023-4249Zavio IP Camera Stack-Based Buffer OverflowZavio IP Camera CF7500 · Zavio IP Camera CF7300 +9
- CVE-2023-5079Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could resulLenovo LeCloud Application
- CVE-2023-4706 A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user acco1Lenovo Preload Directory
- CVE-2023-4632An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute codLenovo System Update
- CVE-2023-47113DLL Search Order Hijacking vulnerability in BleachBit for Windowsbleachbit
- CVE-2023-47111ZITADEL race condition in lockout policy executionzitadel · github.com/zitadel/zitadel
- CVE-2023-5913A potential Privilege Escalation vulnerability in opentext Fortify ScanCentral DAST API.opentext Fortify ScanCentral DAST
- CVE-2023-5760Time-of-check to time-of-use (TOCTOU) bug leads to full local privilege escalation.Avast/Avg Antivirus
- CVE-2023-46643WordPress Download CloudNet360 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)GARY JEZORSKI CloudNet360
- CVE-2023-46627WordPress WP Simple HTML Sitemap Plugin <= 2.1 is vulnerable to Cross Site Scripting (XSS)Ashish Ajani WordPress Simple HTML Sitemap
- CVE-2023-32298WordPress Simple User Listing Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)Kathy Darling Simple User Listing
- CVE-2023-5759Unauthenticated Remote Denial-of-Service via Buffer in Helix CoreHelix Core
- CVE-2023-45319Unauthenticated Remote Denial-of-Service (Commit) in Helix Core Helix Core
- CVE-2023-47107PILOS account takeover through password reset poisoningTHM-Health PILOS
- CVE-2023-46626WordPress FLOWFACT WP Connector Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)FLOWFACT WP Connector
- CVE-2023-35767Unauthenticated Remote Denial-of-Service via Shutdown Function in Helix CoreHelix Core · Helix Swarm
- CVE-2023-46621WordPress User Avatar Plugin <= 1.4.11 is vulnerable to Cross Site Scripting (XSS)Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar
- CVE-2023-6012Incorrect input data validation in Lanaccess ONSAFE MonitorHM Web ConsoleLanaccess ONSAFE MonitorHM
- CVE-2023-46762Out-of-bounds write vulnerability in the kernel driver module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46760Out-of-bounds write vulnerability in the kernel driver module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46767Out-of-bounds write vulnerability in the kernel driver module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46766Out-of-bounds write vulnerability in the kernel driver module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46765Vulnerability of uncaught exceptions in the NFC module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46774Vulnerability of uncaught exceptions in the NFC module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46772Vulnerability of parameters being out of the value range in the QMI service module.Huawei EMUI
- CVE-2023-46771Security vulnerability in the face unlock module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-44098Vulnerability of missing encryption in the card management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-39913Apache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formatsApache Software Foundation Apache UIMA Java SDK Core · A… +3
- CVE-2023-44115Vulnerability of improper permission control in the Booster module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46770Out-of-bounds vulnerability in the sensor module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-36667Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.
- CVE-2023-41111An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem (Exynos 9810, 9610, 9820, 980, 850,
- CVE-2023-41112An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem (Exynos 9810, 9610, 9820, 980, 850,
Medium, low and unrated 66
- CVE-2023-37533HCL Connections is vulnerable to reflected cross-site scriptingHCL Software HCL Connections
- CVE-2023-43577A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privilegeLenovo Desktop BIOS
- CVE-2023-43576A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privilegLenovo Desktop BIOS
- CVE-2023-43575A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevateLenovo Desktop BIOS
- CVE-2023-43574A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attackeLenovo Desktop BIOS
- CVE-2023-43573A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attackerLenovo Desktop BIOS
- CVE-2023-43572A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevaLenovo Desktop BIOS
- CVE-2023-45079A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write toLenovo BIOS
- CVE-2023-45078A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges toLenovo BIOS
- CVE-2023-45077A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to Lenovo BIOS
- CVE-2023-45076A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to Lenovo BIOS
- CVE-2023-45075A memory leakage vulnerability was reported in the SWSMI_Shadow DXE driver that may allow a local attacker with elevated privileges to writeLenovo BIOS
- CVE-2023-43581A buffer overflow was reported in the Update_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privilLenovo Desktop BIOS
- CVE-2023-43580A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated privLenovo Desktop BIOS
- CVE-2023-43579A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privileLenovo Desktop BIOS
- CVE-2023-43578A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privilegLenovo Desktop BIOS
- CVE-2023-43571A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevatLenovo Desktop BIOS
- CVE-2023-43570 A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated permLenovo Desktop BIOS
- CVE-2023-43569A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privilegesLenovo Desktop BIOS
- CVE-2023-43568A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with eleLenovo Desktop BIOS
- CVE-2023-43567A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elevLenovo Desktop BIOS
- CVE-2023-5078A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIOLenovo ThinkPad BIOS
- CVE-2023-5075A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevatedLenovo IdeaPad Duet 3-10IGL5
- CVE-2023-4891 A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service.Lenovo View Driver
- CVE-2023-47114Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packagesethyca fides · ethyca-fides
- CVE-2023-47109PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a blockPrestaShop blockreassurance · prestashop/blockreassurance
- CVE-2023-0392The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution.Okta LDAP Agent
- CVE-2023-26221TIBCO Spotfire Insufficiently Protected Credential vulnerabilityTIBCO Software Spotfire Analyst · TIBCO Software Spotfir… +1
- CVE-2023-5996Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2023-47231WordPress ShortCodes UI Plugin <= 1.9.8 is vulnerable to Cross Site Scripting (XSS)Bainternet ShortCodes UI
- CVE-2023-47229WordPress Download Top 25 Social Icons Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)Vyas Dipen Top 25 Social Icons
- CVE-2023-47228WordPress Layer Slider Plugin <= 1.1.9.7 is vulnerable to Cross Site Scripting (XSS)Muneeb Layer Slider
- CVE-2023-47227WordPress Social Feed | All social media in one place Plugin <= 1.5.4.6 is vulnerable to Cross Site Scripting (XSS)Web-Settler Social Feed | All social media in one place
- CVE-2023-47226WordPress Post Sliders & Post Grids Plugin <= 1.0.20 is vulnerable to Cross Site Scripting (XSS)I Thirteen Web Solution Post Sliders & Post Grids
- CVE-2023-47223WordPress Basic Interactive World Map Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)WP Map Plugins Basic Interactive World Map
- CVE-2023-47190WordPress Apollo13 Framework Extensions Plugin <= 1.9.0 is vulnerable to Cross Site Scripting (XSS)Apollo13Themes Apollo13 Framework Extensions
- CVE-2023-47181WordPress IdeaPush Plugin <= 8.52 is vulnerable to Cross Site Scripting (XSS)Martin Gibson IdeaPush
- CVE-2023-3282Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR EnginePalo Alto Networks Cortex XSOAR
- CVE-2023-46642WordPress SAHU TikTok Pixel for E-Commerce Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)sahumedia SAHU TikTok Pixel for E-Commerce
- CVE-2023-46640WordPress Medialist Plugin <= 1.3.9 is vulnerable to Cross Site Scripting (XSS)D. Relton Medialist
- CVE-2023-45140Group-based JIT MFA bypass on scp and sftp in The Bastionovh the-bastion
- CVE-2023-5136Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPXNI TopoGrafix DataPlugin for GPX · NI DIAdem +2
- CVE-2023-46613WordPress Add to Calendar Button Plugin < 1.5.1 is vulnerable to Cross Site Scripting (XSS)Jens Kuerschner Add to Calendar Button
- CVE-2023-46759Permission control vulnerability in the call module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46758Permission management vulnerability in the multi-screen interaction module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46757The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability Huawei HarmonyOS
- CVE-2023-46756Permission control vulnerability in the window management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46755Vulnerability of input parameters being not strictly verified in the input.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46764Unauthorized startup vulnerability of background apps.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46763Vulnerability of background app permission management in the framework module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46761Out-of-bounds write vulnerability in the kernel driver module.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48613Race condition vulnerability in the kernel module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-5978Incorrect libcap_net limitation list manipulationFreeBSD
- CVE-2023-5941libc stdio buffer overflowFreeBSD
- CVE-2023-41270Samsung Smart TV UE40D7000 WPS DoS attackSamsung TV UE40D7000
- CVE-2023-46769Use-After-Free (UAF) vulnerability in the dubai module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46768Multi-thread vulnerability in the idmap module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-5801Vulnerability of identity verification being bypassed in the face unlock module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-4061Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actorRed Hat JBoss Enterprise Application Platform · org.wildfly…
- CVE-2023-37790Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload fu
- CVE-2023-45857An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-axios
- CVE-2023-45875An issue was discovered in Couchbase Server 7.2.0.couchbase
- CVE-2023-46362jbig2enc v0.28 was discovered to contain a heap-use-after-free via jbig2enc_auto_threshold_using_hash in src/jbig2enc.cc.
- CVE-2023-46363jbig2enc v0.28 was discovered to contain a SEGV via jbig2_add_page in src/jbig2enc.cc:512.
- CVE-2023-46483Cross Site Scripting vulnerability in timetec AWDMS v.2.0 allows an attacker to obtain sensitive information via a crafted payload to the re
- CVE-2023-47379Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality.microweber/microweber