CVEs published November 9, 2023
99 CVEs were published on November 9, 2023: 4 critical, 10 high.
- Published
- 99
- Critical
- 4
- High
- 10
- Medium
- 58
- Low
- 10
- Unrated
- 17
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- moodle · moodle/moodle
- 12
- Telit Cinterion BGS5 · Telit Cinterion EHS5 +8
- 4
- Tongda OA
- 3
- AppsAnywhere Client
- 2
- Microsoft Edge
- 2
- openmct
- 2
- SolarWinds Network Configuration Manager
- 2
- Alex Benfica Publish to Schedule
- 1
- Alex Raven WP Report Post
- 1
- Apache Software Foundation PyArrow · pyarrow
- 1
Critical 4
- CVE-2023-47110Any value can be changed in the configuration table by an employee having access to block reassurance module PrestaShop blockreassurance · prestashop/blockreassurance
- CVE-2023-43791Label Studio has Hardcoded Django `SECRET_KEY` that can be Abused to Forge Session TokensHumanSignal label-studio · label-studio
- CVE-2023-4612MFA bypass in Apereo CASApereo Foundation CAS
- CVE-2023-47248PyArrow, PyArrow: Arbitrary code execution when loading a malicious data fileApache Software Foundation PyArrow · pyarrow
High 10
- CVE-2023-36024Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2023-36014Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2023-4379Incorrect Authorization in GitLabGitLab
- CVE-2023-39198Kernel: qxl: race condition leading to use-after-free in qxl_mode_dumb_create()Red Hat Enterprise Linux
- CVE-2023-47610A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthenticTelit Cinterion EHS5 · Telit Cinterion EHS6 +1
- CVE-2023-46743The same file cannot be opened with different rightsxwikisas application-collabora
- CVE-2023-41137Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client andAppsAnywhere Client
- CVE-2023-40055SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution VulnerabilitySolarWinds Network Configuration Manager
- CVE-2023-40054SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution VulnerabilitySolarWinds Network Configuration Manager
- CVE-2023-41138The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user pAppsAnywhere Client
Medium, low and unrated 85
- CVE-2023-31086WordPress Simple Giveaways Plugin <= 2.46.0 is vulnerable to Cross Site Request Forgery (CSRF)Igor Benic Simple Giveaways – Grow your business, email lis…
- CVE-2023-31088WordPress Floating Action Button Plugin <=1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)Faraz Quazi Floating Action Button
- CVE-2023-31093WordPress Chronosly Events Calendar Plugin <= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF)Chronosly Events Calendar
- CVE-2018-8863Philips EncoreAnywhere Exposure of Sensitive Information to an Unauthorized ActorPhilips EncoreAnywhere
- CVE-2023-31235WordPress Participants Database Plugin <= 2.4.9 is vulnerable to Cross Site Request Forgery (CSRF)Roland Barker, xnau webdesign Participants Database
- CVE-2023-32092WordPress Community by PeepSo Plugin <= 6.0.9.0 is vulnerable to Cross Site Request Forgery (CSRF)Community by PeepSo – Social Network, Membership, Registrat…
- CVE-2023-32093WordPress TPG Redirect Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)Criss Swaim TPG Redirect
- CVE-2023-32125WordPress Multi Rating Plugin <= 5.0.6 is vulnerable to Cross Site Request Forgery (CSRF)Daniel Powney Multi Rating
- CVE-2023-32500WordPress WoodMart Theme <= 7.1.1 is vulnerable to Cross Site Request Forgery (CSRF)xtemos WoodMart - Multipurpose WooCommerce Theme
- CVE-2023-32501WordPress VikBooking Hotel Booking Engine & PMS Plugin <= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF)E4J s.r.l. VikBooking Hotel Booking Engine & PMS
- CVE-2023-32502WordPress Pro Mime Types Plugin <= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF)Sybre Waaijer Pro Mime Types – Manage file media types
- CVE-2023-5543Moodle: duplicating a bigbluebutton activity assigns the same meeting idmoodle
- CVE-2023-32512WordPress ShortPixel Adaptive Images Plugin <= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF)ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimiz…
- CVE-2023-32579WordPress Forget About Shortcode Buttons Plugin <= 2.1.2 is vulnerable to Broken Access ControlDesigns & Code Forget About Shortcode Buttons
- CVE-2023-32587WordPress WP Reactions Lite Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF)WP Reactions Lite
- CVE-2023-32592WordPress Sunny Search Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)Palasthotel by Edward Bock, Katharina Rompf Sunny Search
- CVE-2023-32594WordPress Hyphenator Plugin <= 5.1.5 is vulnerable to Cross Site Request Forgery (CSRF)Benedict B., Maciej Gryniuk Hyphenator
- CVE-2023-32602WordPress CALL ME NOW Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)LOKALYZE CALL ME NOW
- CVE-2023-32739WordPress WP Custom Cursors Plugin < 3.2 is vulnerable to Cross Site Request Forgery (CSRF)Web_Trendy WP Custom Cursors | WordPress Cursor Plugin
- CVE-2023-32744WordPress WooCommerce Product Recommendations Plugin < 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce Product Recommendations
- CVE-2023-32745WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce AutomateWoo
- CVE-2023-32794WordPress WooCommerce Product Add-ons Plugin <= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF)WooCommerce Product Add-Ons
- CVE-2023-34024WordPress WP Full Auto Tags Manager Plugin <= 2.2 is vulnerable to Cross Site Request Forgery (CSRF)Guillemant David WP Full Auto Tags Manager
- CVE-2023-34025WordPress LWS Hide Login Plugin <= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF)LWS Hide Login
- CVE-2023-34031WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Request Forgery (CSRF)Pascal Casier bbPress Toolkit
- CVE-2023-5954Vault Requests Triggering Policy Checks May Lead To Unbounded Memory ConsumptionHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-5551Moodle: forum summary report shows students from other groups when in separate groups modemoodle · moodle/moodle
- CVE-2023-5550Moodle: rce due to lfi risk in some misconfigured shared hosting environmentsmoodle · moodle/moodle
- CVE-2023-5549Moodle: insufficient capability checks when updating the parent of a course categorymoodle · moodle/moodle
- CVE-2023-5548Moodle: cache poisoning risk with endpoint revision numbersmoodle · moodle/moodle
- CVE-2023-5547Moodle: xss risk when previewing data in course upload toolmoodle · moodle/moodle
- CVE-2023-5546Moodle: stored xss in quiz grading report via user id numbermoodle · moodle/moodle
- CVE-2023-5545Moodle: auto-populated h5p author name causes a potential information leakmoodle · moodle/moodle
- CVE-2023-5544Moodle: stored xss and potential idor risk in wiki commentsmoodle · moodle/moodle
- CVE-2023-34033WordPress Ajax Pagination and Infinite Scroll Plugin <= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF)Malinky Ajax Pagination and Infinite Scroll
- CVE-2023-34169WordPress TS Webfonts for さくらのレンタルサーバ Plugin <= 3.1.2 is vulnerable to Broken Access ControlSAKURA Internet TS Webfonts for さくらのレンタルサーバ
- CVE-2023-5542Moodle: students can view other users in "only see own membership" groupsmoodle · moodle/moodle
- CVE-2023-34171WordPress WP Report Post Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)Alex Raven WP Report Post
- CVE-2023-5541Moodle: xss risk when using csv grade import methodmoodle · moodle/moodle
- CVE-2023-5540Moodle: authenticated remote code execution risk in imscpmoodle · moodle/moodle
- CVE-2023-34177WordPress WP-Cache.com Plugin <= 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF)Kenth Hagström WP-Cache.com
- CVE-2023-5539Moodle: authenticated remote code execution risk in lessonmoodle · moodle/moodle
- CVE-2023-34178WordPress Groundhogg Plugin <= 2.7.11 is vulnerable to Cross Site Request Forgery (CSRF)Groundhogg
- CVE-2023-34181WordPress WP-Cirrus Plugin <= 0.6.11 is vulnerable to Cross Site Request Forgery (CSRF)WP-Cirrus
- CVE-2023-34182WordPress LH Password Changer Plugin <= 1.55 is vulnerable to Cross Site Request Forgery (CSRF)Peter Shaw LH Password Changer
- CVE-2023-6054Tongda OA 2017 lock.php sql injectionTongda OA
- CVE-2023-6053Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-34371WordPress Download SpamReferrerBlock Plugin <= 2.22 is vulnerable to Cross Site Request Forgery (CSRF)Didier Sampaolo SpamReferrerBlock
- CVE-2023-47238WordPress Top 10 Plugin <= 3.3.2 is vulnerable to Cross Site Request Forgery (CSRF)Top 10 – WordPress Popular posts by WebberZone
- CVE-2023-47237WordPress WP Google My Business Auto Publish Plugin <= 3.7 is vulnerable to Cross Site Request Forgery (CSRF)Martin Gibson Auto Publish for Google My Business
- CVE-2023-46614WordPress WP Helper Premium Plugin <= 4.5.1 is vulnerable to Cross Site Request Forgery (CSRF)Mat Bao WP Helper Premium
- CVE-2023-34386WordPress WPC Smart Wishlist for WooCommerce Plugin <= 4.7.1 is vulnerable to Cross Site Request Forgery (CSRF)WPClever WPC Smart Wishlist for WooCommerce
- CVE-2023-31087WordPress JS Job Manager Plugin <=2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)JoomSky JS Job Manager
- CVE-2023-34002WordPress WP Inventory Manager Plugin <= 2.1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)WP Inventory Manager
- CVE-2023-25975WordPress Etsy Shop Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)Frédéric Sheedy Etsy Shop
- CVE-2023-45284Incorrect detection of reserved device names on Windows in path/filepathGo standard library path/filepath · stdlib
- CVE-2023-45283Insecure parsing of Windows paths with a \??\ prefix in path/filepathGo standard library path/filepath · Go standard library… +1
- CVE-2023-36688WordPress Simple Site Verify Plugin <= 1.0.7 is vulnerable to Cross Site Scripting (XSS)Michael Mann Simple Site Verify
- CVE-2023-25994WordPress Publish to Schedule Plugin <= 4.4.2 is vulnerable to Cross Site Request Forgery (CSRF)Alex Benfica Publish to Schedule
- CVE-2023-6039Kernel: use-after-free in drivers/net/usb/lan78xx.c in lan78xx_disconnectKernel · Red Hat Enterprise Linux +1
- CVE-2023-47615A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion ETelit Cinterion BGS5 · Telit Cinterion EHS5 +8
- CVE-2023-6052Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-47616A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8Telit Cinterion BGS5 · Telit Cinterion EHS5 +8
- CVE-2023-47612A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, TelitTelit Cinterion BGS5 · Telit Cinterion EHS5 +8
- CVE-2023-4218XXE in eclipse.platform / Eclipse IDEEclipse Foundation Eclipse IDE · Eclipse Foundation org.… +9
- CVE-2023-47613A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit CiTelit Cinterion BGS5 · Telit Cinterion EHS5 +8
- CVE-2023-26156Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary schromedriver
- CVE-2023-20902Timing attack risk in HarborHarbor Project · github.com/goharbor/harbor
- CVE-2023-29975An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification.
- CVE-2023-45884Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information openmct
- CVE-2023-45885Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new comopenmct
- CVE-2023-46492Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the
- CVE-2023-46894An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm.esptool
- CVE-2023-47363The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- CVE-2023-47364The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims
- CVE-2023-47365The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- CVE-2023-47366The leakage of channel access token in craft_members Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- CVE-2023-47367The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- CVE-2023-47368The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- CVE-2023-47369The leakage of channel access token in best_training_member Line 13.6.1 allows remote attackers to send malicious notifications.
- CVE-2023-47370The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- CVE-2023-47372The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- CVE-2023-47373The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims.
- CVE-2023-47488Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted scr
- CVE-2023-47489CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the