# CVEs published 2023-11-08

107 CVEs were published on November 8, 2023: 7 critical, 34 high. Days are UTC.

- [CVE-2023-37533](https://cve.now/CVE-2023-37533.md): HCL Connections is vulnerable to reflected cross-site scripting (CVSS 5.4, HCL Software HCL Connections)
- [CVE-2023-3959](https://cve.now/CVE-2023-3959.md): Zavio IP Camera Stack-Based Buffer Overflow (CVSS 9.8, Zavio IP Camera CF7500 · Zavio IP Camera CF7300 +9)
- [CVE-2023-45225](https://cve.now/CVE-2023-45225.md): Zavio IP Camera Stack-Based Buffer Overflow (CVSS 9.8, Zavio IP Camera CF7500 · Zavio IP Camera CF7300 +9)
- [CVE-2023-43755](https://cve.now/CVE-2023-43755.md): Zavio IP Camera Stack-Based Buffer Overflow (CVSS 9.8, Zavio IP Camera CF7500 · Zavio IP Camera CF7300 +9)
- [CVE-2023-39435](https://cve.now/CVE-2023-39435.md): Zavio IP Camera Stack-Based Buffer Overflow (CVSS 8.8, Zavio IP Camera CF7500 · Zavio IP Camera CF7300 +9)
- [CVE-2023-4249](https://cve.now/CVE-2023-4249.md): Zavio IP Camera Stack-Based Buffer Overflow (CVSS 8.8, Zavio IP Camera CF7500 · Zavio IP Camera CF7300 +9)
- [CVE-2023-43577](https://cve.now/CVE-2023-43577.md): A buffer overflow was reported in the ReFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privilege (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-43576](https://cve.now/CVE-2023-43576.md): A buffer overflow was reported in the WMISwSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileg (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-43575](https://cve.now/CVE-2023-43575.md): A buffer overflow was reported in the UltraFunctionTable module in some Lenovo Desktop products that may allow a local attacker with elevate (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-43574](https://cve.now/CVE-2023-43574.md): A buffer over-read was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacke (CVSS 4.4, Lenovo Desktop BIOS)
- [CVE-2023-43573](https://cve.now/CVE-2023-43573.md): A buffer overflow was reported in the LEMALLDriversConnectedEventHook module in some Lenovo Desktop products that may allow a local attacker (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-43572](https://cve.now/CVE-2023-43572.md): A buffer over-read was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with eleva (CVSS 4.4, Lenovo Desktop BIOS)
- [CVE-2023-45079](https://cve.now/CVE-2023-45079.md): A memory leakage vulnerability was reported in the NvmramSmm SMM driver that may allow a local attacker with elevated privileges to write to (CVSS 6.7, Lenovo BIOS)
- [CVE-2023-45078](https://cve.now/CVE-2023-45078.md): A memory leakage vulnerability was reported in the DustFilterAlertSmm SMM driver that may allow a local attacker with elevated privileges to (CVSS 6.7, Lenovo BIOS)
- [CVE-2023-45077](https://cve.now/CVE-2023-45077.md): A memory leakage vulnerability was reported in the 534D0740 DXE driver that may allow a local attacker with elevated privileges to write to (CVSS 6.7, Lenovo BIOS)
- [CVE-2023-45076](https://cve.now/CVE-2023-45076.md): A memory leakage vulnerability was reported in the 534D0140 DXE driver that may allow a local attacker with elevated privileges to write to (CVSS 6.7, Lenovo BIOS)
- [CVE-2023-45075](https://cve.now/CVE-2023-45075.md): A memory leakage vulnerability was reported in the SWSMI\_Shadow DXE driver that may allow a local attacker with elevated privileges to write (CVSS 6.7, Lenovo BIOS)
- [CVE-2023-43581](https://cve.now/CVE-2023-43581.md): A buffer overflow was reported in the Update\_WMI module in some Lenovo Desktop products that may allow a local attacker with elevated privil (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-43580](https://cve.now/CVE-2023-43580.md): A buffer overflow was reported in the SmuV11DxeVMR module in some Lenovo Desktop products that may allow a local attacker with elevated priv (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-43579](https://cve.now/CVE-2023-43579.md): A buffer overflow was reported in the SmuV11Dxe driver in some Lenovo Desktop products that may allow a local attacker with elevated privile (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-43578](https://cve.now/CVE-2023-43578.md): A buffer overflow was reported in the SmiFlash module in some Lenovo Desktop products that may allow a local attacker with elevated privileg (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-43571](https://cve.now/CVE-2023-43571.md): A buffer overflow was reported in the BiosExtensionLoader module in some Lenovo Desktop products that may allow a local attacker with elevat (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-43570](https://cve.now/CVE-2023-43570.md): A potential vulnerability was reported in the SMI callback function of the OemSmi driver that may allow a local attacker with elevated perm (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-43569](https://cve.now/CVE-2023-43569.md): A buffer overflow was reported in the OemSmi module in some Lenovo Desktop products that may allow a local attacker with elevated privileges (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-43568](https://cve.now/CVE-2023-43568.md): A buffer over-read was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with ele (CVSS 4.4, Lenovo Desktop BIOS)
- [CVE-2023-43567](https://cve.now/CVE-2023-43567.md): A buffer overflow was reported in the LemSecureBootForceKey module in some Lenovo Desktop products that may allow a local attacker with elev (CVSS 6.7, Lenovo Desktop BIOS)
- [CVE-2023-5079](https://cve.now/CVE-2023-5079.md): Lenovo LeCloud App improper input validation allows attackers to access arbitrary components and arbitrary file downloads, which could resul (CVSS 7.5, Lenovo LeCloud Application)
- [CVE-2023-5078](https://cve.now/CVE-2023-5078.md): A vulnerability was reported in some ThinkPad BIOS that could allow a physical or local attacker with elevated privileges to tamper with BIO (CVSS 6.7, Lenovo ThinkPad BIOS)
- [CVE-2023-5075](https://cve.now/CVE-2023-5075.md): A buffer overflow was reported in the FmpSipoCapsuleDriver driver in the IdeaPad Duet 3-10IGL5 that may allow a local attacker with elevated (CVSS 6.7, Lenovo IdeaPad Duet 3-10IGL5)
- [CVE-2023-4891](https://cve.now/CVE-2023-4891.md): A potential use-after-free vulnerability was reported in the Lenovo View driver that could result in denial of service. (CVSS 5.5, Lenovo View Driver)
- [CVE-2023-4706](https://cve.now/CVE-2023-4706.md): A privilege escalation vulnerability was reported in Lenovo preloaded devices deployed using Microsoft AutoPilot under a standard user acco (CVSS 7.3, 1Lenovo Preload Directory)
- [CVE-2023-4632](https://cve.now/CVE-2023-4632.md): An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute cod (CVSS 7.8, Lenovo System Update)
- [CVE-2023-47113](https://cve.now/CVE-2023-47113.md): DLL Search Order Hijacking vulnerability in BleachBit for Windows (CVSS 7.3, bleachbit)
- [CVE-2023-47114](https://cve.now/CVE-2023-47114.md): Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages (CVSS 4.3, ethyca fides · ethyca-fides)
- [CVE-2023-47111](https://cve.now/CVE-2023-47111.md): ZITADEL race condition in lockout policy execution (CVSS 7.3, zitadel · github.com/zitadel/zitadel)
- [CVE-2023-47109](https://cve.now/CVE-2023-47109.md): PrestaShop blockreassurance BO User can remove any file from server when adding a and deleting a block (CVSS 5.5, PrestaShop blockreassurance · prestashop/blockreassurance)
- [CVE-2023-0392](https://cve.now/CVE-2023-0392.md): The LDAP Agent Update service with versions prior to 5.18 used an unquoted path, which could allow arbitrary code execution. (CVSS 3.9, Okta LDAP Agent)
- [CVE-2023-26221](https://cve.now/CVE-2023-26221.md): TIBCO Spotfire Insufficiently Protected Credential vulnerability (CVSS 5.0, TIBCO Software Spotfire Analyst · TIBCO Software Spotfir… +1)
- [CVE-2023-5996](https://cve.now/CVE-2023-5996.md): Use after free in WebAudio in Google Chrome prior to 119.0.6045.123 allowed a remote attacker to potentially exploit heap corruption via a c (no CVSS, Google Chrome)
- [CVE-2023-47231](https://cve.now/CVE-2023-47231.md): WordPress ShortCodes UI Plugin \<= 1.9.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Bainternet ShortCodes UI)
- [CVE-2023-47229](https://cve.now/CVE-2023-47229.md): WordPress Download Top 25 Social Icons Plugin \<= 3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Vyas Dipen Top 25 Social Icons)
- [CVE-2023-47228](https://cve.now/CVE-2023-47228.md): WordPress Layer Slider Plugin \<= 1.1.9.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Muneeb Layer Slider)
- [CVE-2023-47227](https://cve.now/CVE-2023-47227.md): WordPress Social Feed | All social media in one place Plugin \<= 1.5.4.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Web-Settler Social Feed | All social media in one place)
- [CVE-2023-47226](https://cve.now/CVE-2023-47226.md): WordPress Post Sliders & Post Grids Plugin \<= 1.0.20 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, I Thirteen Web Solution Post Sliders & Post Grids)
- [CVE-2023-47223](https://cve.now/CVE-2023-47223.md): WordPress Basic Interactive World Map Plugin \<= 2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WP Map Plugins Basic Interactive World Map)
- [CVE-2023-47190](https://cve.now/CVE-2023-47190.md): WordPress Apollo13 Framework Extensions Plugin \<= 1.9.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Apollo13Themes Apollo13 Framework Extensions)
- [CVE-2023-47181](https://cve.now/CVE-2023-47181.md): WordPress IdeaPush Plugin \<= 8.52 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Martin Gibson IdeaPush)
- [CVE-2023-3282](https://cve.now/CVE-2023-3282.md): Cortex XSOAR: Local Privilege Escalation (PE) Vulnerability in Cortex XSOAR Engine (CVSS 6.4, Palo Alto Networks Cortex XSOAR)
- [CVE-2023-5913](https://cve.now/CVE-2023-5913.md): A potential Privilege Escalation vulnerability in opentext Fortify ScanCentral DAST API. (CVSS 8.2, opentext Fortify ScanCentral DAST)
- [CVE-2023-5760](https://cve.now/CVE-2023-5760.md): Time-of-check to time-of-use (TOCTOU) bug leads to full local privilege escalation. (CVSS 8.2, Avast/Avg Antivirus)
- [CVE-2023-46643](https://cve.now/CVE-2023-46643.md): WordPress Download CloudNet360 Plugin \<= 3.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, GARY JEZORSKI CloudNet360)
- [CVE-2023-46642](https://cve.now/CVE-2023-46642.md): WordPress SAHU TikTok Pixel for E-Commerce Plugin \<= 1.2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, sahumedia SAHU TikTok Pixel for E-Commerce)
- [CVE-2023-46640](https://cve.now/CVE-2023-46640.md): WordPress Medialist Plugin \<= 1.3.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, D. Relton Medialist)
- [CVE-2023-46627](https://cve.now/CVE-2023-46627.md): WordPress WP Simple HTML Sitemap Plugin \<= 2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Ashish Ajani WordPress Simple HTML Sitemap)
- [CVE-2023-32298](https://cve.now/CVE-2023-32298.md): WordPress Simple User Listing Plugin \<= 1.9.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Kathy Darling Simple User Listing)
- [CVE-2023-5759](https://cve.now/CVE-2023-5759.md): Unauthenticated Remote Denial-of-Service via Buffer in Helix Core (CVSS 7.5, Helix Core)
- [CVE-2023-45319](https://cve.now/CVE-2023-45319.md): Unauthenticated Remote Denial-of-Service (Commit) in Helix Core (CVSS 7.5, Helix Core)
- [CVE-2023-45849](https://cve.now/CVE-2023-45849.md): Arbitrary Code Execution in Helix Core (CVSS 9.0, Helix Core)
- [CVE-2023-47107](https://cve.now/CVE-2023-47107.md): PILOS account takeover through password reset poisoning (CVSS 8.8, THM-Health PILOS)
- [CVE-2023-46626](https://cve.now/CVE-2023-46626.md): WordPress FLOWFACT WP Connector Plugin \<= 2.1.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, FLOWFACT WP Connector)
- [CVE-2023-35767](https://cve.now/CVE-2023-35767.md): Unauthenticated Remote Denial-of-Service via Shutdown Function in Helix Core (CVSS 7.5, Helix Core · Helix Swarm)
- [CVE-2023-45140](https://cve.now/CVE-2023-45140.md): Group-based JIT MFA bypass on scp and sftp in The Bastion (CVSS 4.8, ovh the-bastion)
- [CVE-2023-5136](https://cve.now/CVE-2023-5136.md): Incorrect Permission Assignment in the TopoGrafix DataPlugin for GPX (CVSS 5.5, NI TopoGrafix DataPlugin for GPX · NI DIAdem +2)
- [CVE-2023-46621](https://cve.now/CVE-2023-46621.md): WordPress User Avatar Plugin \<= 1.4.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar)
- [CVE-2023-46613](https://cve.now/CVE-2023-46613.md): WordPress Add to Calendar Button Plugin \< 1.5.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Jens Kuerschner Add to Calendar Button)
- [CVE-2023-6012](https://cve.now/CVE-2023-6012.md): Incorrect input data validation in Lanaccess ONSAFE MonitorHM Web Console (CVSS 8.3, Lanaccess ONSAFE MonitorHM)
- [CVE-2023-46759](https://cve.now/CVE-2023-46759.md): Permission control vulnerability in the call module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46758](https://cve.now/CVE-2023-46758.md): Permission management vulnerability in the multi-screen interaction module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46757](https://cve.now/CVE-2023-46757.md): The remote PIN module has a vulnerability that causes incorrect information storage locations.Successful exploitation of this vulnerability (no CVSS, Huawei HarmonyOS)
- [CVE-2023-46756](https://cve.now/CVE-2023-46756.md): Permission control vulnerability in the window management module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46755](https://cve.now/CVE-2023-46755.md): Vulnerability of input parameters being not strictly verified in the input. (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46764](https://cve.now/CVE-2023-46764.md): Unauthorized startup vulnerability of background apps. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46763](https://cve.now/CVE-2023-46763.md): Vulnerability of background app permission management in the framework module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46762](https://cve.now/CVE-2023-46762.md): Out-of-bounds write vulnerability in the kernel driver module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46761](https://cve.now/CVE-2023-46761.md): Out-of-bounds write vulnerability in the kernel driver module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46760](https://cve.now/CVE-2023-46760.md): Out-of-bounds write vulnerability in the kernel driver module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46767](https://cve.now/CVE-2023-46767.md): Out-of-bounds write vulnerability in the kernel driver module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46766](https://cve.now/CVE-2023-46766.md): Out-of-bounds write vulnerability in the kernel driver module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46765](https://cve.now/CVE-2023-46765.md): Vulnerability of uncaught exceptions in the NFC module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46774](https://cve.now/CVE-2023-46774.md): Vulnerability of uncaught exceptions in the NFC module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48613](https://cve.now/CVE-2022-48613.md): Race condition vulnerability in the kernel module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46772](https://cve.now/CVE-2023-46772.md): Vulnerability of parameters being out of the value range in the QMI service module. (CVSS 7.5, Huawei EMUI)
- [CVE-2023-46771](https://cve.now/CVE-2023-46771.md): Security vulnerability in the face unlock module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-44098](https://cve.now/CVE-2023-44098.md): Vulnerability of missing encryption in the card management module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-5978](https://cve.now/CVE-2023-5978.md): Incorrect libcap\_net limitation list manipulation (no CVSS, FreeBSD)
- [CVE-2023-5941](https://cve.now/CVE-2023-5941.md): libc stdio buffer overflow (no CVSS, FreeBSD)
- [CVE-2023-39913](https://cve.now/CVE-2023-39913.md): Apache UIMA Java SDK Core, Apache UIMA Java SDK CPE, Apache UIMA Java SDK Vinci adapter, Apache UIMA Java SDK tools: Potential untrusted code execution when deserializing certain binary CAS formats (CVSS 8.8, Apache Software Foundation Apache UIMA Java SDK Core · A… +3)
- [CVE-2023-41270](https://cve.now/CVE-2023-41270.md): Samsung Smart TV UE40D7000 WPS DoS attack (CVSS 3.5, Samsung TV UE40D7000)
- [CVE-2023-44115](https://cve.now/CVE-2023-44115.md): Vulnerability of improper permission control in the Booster module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46770](https://cve.now/CVE-2023-46770.md): Out-of-bounds vulnerability in the sensor module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46769](https://cve.now/CVE-2023-46769.md): Use-After-Free (UAF) vulnerability in the dubai module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46768](https://cve.now/CVE-2023-46768.md): Multi-thread vulnerability in the idmap module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-5801](https://cve.now/CVE-2023-5801.md): Vulnerability of identity verification being bypassed in the face unlock module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-4061](https://cve.now/CVE-2023-4061.md): Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor (CVSS 6.5, Red Hat JBoss Enterprise Application Platform · org.wildfly…)
- [CVE-2021-43609](https://cve.now/CVE-2021-43609.md): An issue was discovered in Spiceworks Help Desk Server before 1.3.3. (CVSS 9.9)
- [CVE-2023-29974](https://cve.now/CVE-2023-29974.md): An issue discovered in Pfsense CE version 2.6.0 allows attackers to compromise user accounts via weak password requirements. (CVSS 9.8)
- [CVE-2023-36667](https://cve.now/CVE-2023-36667.md): Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal. (CVSS 7.5)
- [CVE-2023-37790](https://cve.now/CVE-2023-37790.md): Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload fu (no CVSS)
- [CVE-2023-41111](https://cve.now/CVE-2023-41111.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem (Exynos 9810, 9610, 9820, 980, 850, (CVSS 7.1)
- [CVE-2023-41112](https://cve.now/CVE-2023-41112.md): An issue was discovered in Samsung Mobile Processor, Wearable Processor, Automotive Processor, and Modem (Exynos 9810, 9610, 9820, 980, 850, (CVSS 7.1)
- [CVE-2023-45857](https://cve.now/CVE-2023-45857.md): An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X- (no CVSS, axios)
- [CVE-2023-45875](https://cve.now/CVE-2023-45875.md): An issue was discovered in Couchbase Server 7.2.0. (no CVSS, couchbase)
- [CVE-2023-46362](https://cve.now/CVE-2023-46362.md): jbig2enc v0.28 was discovered to contain a heap-use-after-free via jbig2enc\_auto\_threshold\_using\_hash in src/jbig2enc.cc. (no CVSS)
- [CVE-2023-46363](https://cve.now/CVE-2023-46363.md): jbig2enc v0.28 was discovered to contain a SEGV via jbig2\_add\_page in src/jbig2enc.cc:512. (no CVSS)
- [CVE-2023-46483](https://cve.now/CVE-2023-46483.md): Cross Site Scripting vulnerability in timetec AWDMS v.2.0 allows an attacker to obtain sensitive information via a crafted payload to the re (CVSS 5.4)
- [CVE-2023-47379](https://cve.now/CVE-2023-47379.md): Microweber CMS version 2.0.1 is vulnerable to stored Cross Site Scripting (XSS) via the profile picture file upload functionality. (no CVSS, microweber/microweber)
- [CVE-2023-47397](https://cve.now/CVE-2023-47397.md): WeBid \<=1.2.2 is vulnerable to code injection via admin/categoriestrans.php. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.