# CVEs published 2023-11-09

99 CVEs were published on November 9, 2023: 4 critical, 10 high. Days are UTC.

- [CVE-2023-36024](https://cve.now/CVE-2023-36024.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Edge)
- [CVE-2023-36014](https://cve.now/CVE-2023-36014.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Edge)
- [CVE-2023-31086](https://cve.now/CVE-2023-31086.md): WordPress Simple Giveaways Plugin \<= 2.46.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Igor Benic Simple Giveaways – Grow your business, email lis…)
- [CVE-2023-31088](https://cve.now/CVE-2023-31088.md): WordPress Floating Action Button Plugin \<=1.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Faraz Quazi Floating Action Button)
- [CVE-2023-31093](https://cve.now/CVE-2023-31093.md): WordPress Chronosly Events Calendar Plugin \<= 2.6.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Chronosly Events Calendar)
- [CVE-2018-8863](https://cve.now/CVE-2018-8863.md): Philips EncoreAnywhere Exposure of Sensitive Information to an Unauthorized Actor (CVSS 5.9, Philips EncoreAnywhere)
- [CVE-2023-31235](https://cve.now/CVE-2023-31235.md): WordPress Participants Database Plugin \<= 2.4.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Roland Barker, xnau webdesign Participants Database)
- [CVE-2023-32092](https://cve.now/CVE-2023-32092.md): WordPress Community by PeepSo Plugin \<= 6.0.9.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Community by PeepSo – Social Network, Membership, Registrat…)
- [CVE-2023-32093](https://cve.now/CVE-2023-32093.md): WordPress TPG Redirect Plugin \<= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Criss Swaim TPG Redirect)
- [CVE-2023-32125](https://cve.now/CVE-2023-32125.md): WordPress Multi Rating Plugin \<= 5.0.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Daniel Powney Multi Rating)
- [CVE-2023-32500](https://cve.now/CVE-2023-32500.md): WordPress WoodMart Theme \<= 7.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, xtemos WoodMart - Multipurpose WooCommerce Theme)
- [CVE-2023-32501](https://cve.now/CVE-2023-32501.md): WordPress VikBooking Hotel Booking Engine & PMS Plugin \<= 1.6.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, E4J s.r.l. VikBooking Hotel Booking Engine & PMS)
- [CVE-2023-32502](https://cve.now/CVE-2023-32502.md): WordPress Pro Mime Types Plugin \<= 1.0.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Sybre Waaijer Pro Mime Types – Manage file media types)
- [CVE-2023-5543](https://cve.now/CVE-2023-5543.md): Moodle: duplicating a bigbluebutton activity assigns the same meeting id (CVSS 3.3, moodle)
- [CVE-2023-32512](https://cve.now/CVE-2023-32512.md): WordPress ShortPixel Adaptive Images Plugin \<= 3.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimiz…)
- [CVE-2023-32579](https://cve.now/CVE-2023-32579.md): WordPress Forget About Shortcode Buttons Plugin \<= 2.1.2 is vulnerable to Broken Access Control (CVSS 5.3, Designs & Code Forget About Shortcode Buttons)
- [CVE-2023-32587](https://cve.now/CVE-2023-32587.md): WordPress WP Reactions Lite Plugin \<= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WP Reactions Lite)
- [CVE-2023-32592](https://cve.now/CVE-2023-32592.md): WordPress Sunny Search Plugin \<= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Palasthotel by Edward Bock, Katharina Rompf Sunny Search)
- [CVE-2023-32594](https://cve.now/CVE-2023-32594.md): WordPress Hyphenator Plugin \<= 5.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Benedict B., Maciej Gryniuk Hyphenator)
- [CVE-2023-4379](https://cve.now/CVE-2023-4379.md): Incorrect Authorization in GitLab (CVSS 8.1, GitLab)
- [CVE-2023-32602](https://cve.now/CVE-2023-32602.md): WordPress CALL ME NOW Plugin \<= 3.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, LOKALYZE CALL ME NOW)
- [CVE-2023-32739](https://cve.now/CVE-2023-32739.md): WordPress WP Custom Cursors Plugin \< 3.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Web\_Trendy WP Custom Cursors | WordPress Cursor Plugin)
- [CVE-2023-32744](https://cve.now/CVE-2023-32744.md): WordPress WooCommerce Product Recommendations Plugin \< 2.3.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WooCommerce Product Recommendations)
- [CVE-2023-32745](https://cve.now/CVE-2023-32745.md): WordPress AutomateWoo Plugin \<= 5.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WooCommerce AutomateWoo)
- [CVE-2023-32794](https://cve.now/CVE-2023-32794.md): WordPress WooCommerce Product Add-ons Plugin \<= 6.1.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WooCommerce Product Add-Ons)
- [CVE-2023-34024](https://cve.now/CVE-2023-34024.md): WordPress WP Full Auto Tags Manager Plugin \<= 2.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Guillemant David WP Full Auto Tags Manager)
- [CVE-2023-34025](https://cve.now/CVE-2023-34025.md): WordPress LWS Hide Login Plugin \<= 2.1.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, LWS Hide Login)
- [CVE-2023-34031](https://cve.now/CVE-2023-34031.md): WordPress bbPress Toolkit Plugin \<= 1.0.12 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Pascal Casier bbPress Toolkit)
- [CVE-2023-5954](https://cve.now/CVE-2023-5954.md): Vault Requests Triggering Policy Checks May Lead To Unbounded Memory Consumption (CVSS 5.9, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2023-5551](https://cve.now/CVE-2023-5551.md): Moodle: forum summary report shows students from other groups when in separate groups mode (CVSS 3.3, moodle · moodle/moodle)
- [CVE-2023-5550](https://cve.now/CVE-2023-5550.md): Moodle: rce due to lfi risk in some misconfigured shared hosting environments (CVSS 6.5, moodle · moodle/moodle)
- [CVE-2023-5549](https://cve.now/CVE-2023-5549.md): Moodle: insufficient capability checks when updating the parent of a course category (CVSS 3.3, moodle · moodle/moodle)
- [CVE-2023-5548](https://cve.now/CVE-2023-5548.md): Moodle: cache poisoning risk with endpoint revision numbers (CVSS 3.3, moodle · moodle/moodle)
- [CVE-2023-5547](https://cve.now/CVE-2023-5547.md): Moodle: xss risk when previewing data in course upload tool (CVSS 3.3, moodle · moodle/moodle)
- [CVE-2023-5546](https://cve.now/CVE-2023-5546.md): Moodle: stored xss in quiz grading report via user id number (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2023-5545](https://cve.now/CVE-2023-5545.md): Moodle: auto-populated h5p author name causes a potential information leak (CVSS 3.3, moodle · moodle/moodle)
- [CVE-2023-5544](https://cve.now/CVE-2023-5544.md): Moodle: stored xss and potential idor risk in wiki comments (CVSS 6.5, moodle · moodle/moodle)
- [CVE-2023-34033](https://cve.now/CVE-2023-34033.md): WordPress Ajax Pagination and Infinite Scroll Plugin \<= 2.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Malinky Ajax Pagination and Infinite Scroll)
- [CVE-2023-34169](https://cve.now/CVE-2023-34169.md): WordPress TS Webfonts for さくらのレンタルサーバ Plugin \<= 3.1.2 is vulnerable to Broken Access Control (CVSS 6.5, SAKURA Internet TS Webfonts for さくらのレンタルサーバ)
- [CVE-2023-5542](https://cve.now/CVE-2023-5542.md): Moodle: students can view other users in "only see own membership" groups (CVSS 3.3, moodle · moodle/moodle)
- [CVE-2023-34171](https://cve.now/CVE-2023-34171.md): WordPress WP Report Post Plugin \<= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Alex Raven WP Report Post)
- [CVE-2023-5541](https://cve.now/CVE-2023-5541.md): Moodle: xss risk when using csv grade import method (CVSS 3.3, moodle · moodle/moodle)
- [CVE-2023-5540](https://cve.now/CVE-2023-5540.md): Moodle: authenticated remote code execution risk in imscp (CVSS 4.7, moodle · moodle/moodle)
- [CVE-2023-39198](https://cve.now/CVE-2023-39198.md): Kernel: qxl: race condition leading to use-after-free in qxl\_mode\_dumb\_create() (CVSS 7.5, Red Hat Enterprise Linux)
- [CVE-2023-34177](https://cve.now/CVE-2023-34177.md): WordPress WP-Cache.com Plugin \<= 1.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Kenth Hagström WP-Cache.com)
- [CVE-2023-5539](https://cve.now/CVE-2023-5539.md): Moodle: authenticated remote code execution risk in lesson (CVSS 4.7, moodle · moodle/moodle)
- [CVE-2023-34178](https://cve.now/CVE-2023-34178.md): WordPress Groundhogg Plugin \<= 2.7.11 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Groundhogg)
- [CVE-2023-34181](https://cve.now/CVE-2023-34181.md): WordPress WP-Cirrus Plugin \<= 0.6.11 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WP-Cirrus)
- [CVE-2023-34182](https://cve.now/CVE-2023-34182.md): WordPress LH Password Changer Plugin \<= 1.55 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Peter Shaw LH Password Changer)
- [CVE-2023-6054](https://cve.now/CVE-2023-6054.md): Tongda OA 2017 lock.php sql injection (CVSS 5.5, Tongda OA)
- [CVE-2023-6053](https://cve.now/CVE-2023-6053.md): Tongda OA 2017 delete.php sql injection (CVSS 6.3, Tongda OA)
- [CVE-2023-34371](https://cve.now/CVE-2023-34371.md): WordPress Download SpamReferrerBlock Plugin \<= 2.22 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Didier Sampaolo SpamReferrerBlock)
- [CVE-2023-47238](https://cve.now/CVE-2023-47238.md): WordPress Top 10 Plugin \<= 3.3.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Top 10 – WordPress Popular posts by WebberZone)
- [CVE-2023-47237](https://cve.now/CVE-2023-47237.md): WordPress WP Google My Business Auto Publish Plugin \<= 3.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Martin Gibson Auto Publish for Google My Business)
- [CVE-2023-46614](https://cve.now/CVE-2023-46614.md): WordPress WP Helper Premium Plugin \<= 4.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Mat Bao WP Helper Premium)
- [CVE-2023-34386](https://cve.now/CVE-2023-34386.md): WordPress WPC Smart Wishlist for WooCommerce Plugin \<= 4.7.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WPClever WPC Smart Wishlist for WooCommerce)
- [CVE-2023-31087](https://cve.now/CVE-2023-31087.md): WordPress JS Job Manager Plugin \<=2.0.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, JoomSky JS Job Manager)
- [CVE-2023-34002](https://cve.now/CVE-2023-34002.md): WordPress WP Inventory Manager Plugin \<= 2.1.0.13 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WP Inventory Manager)
- [CVE-2023-25975](https://cve.now/CVE-2023-25975.md): WordPress Etsy Shop Plugin \<= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Frédéric Sheedy Etsy Shop)
- [CVE-2023-47610](https://cve.now/CVE-2023-47610.md): A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists in Telit Cinterion EHS5/6/8 that could allow a remote unauthentic (CVSS 8.1, Telit Cinterion EHS5 · Telit Cinterion EHS6 +1)
- [CVE-2023-45284](https://cve.now/CVE-2023-45284.md): Incorrect detection of reserved device names on Windows in path/filepath (CVSS 5.3, Go standard library path/filepath · stdlib)
- [CVE-2023-45283](https://cve.now/CVE-2023-45283.md): Insecure parsing of Windows paths with a \\??\\ prefix in path/filepath (no CVSS, Go standard library path/filepath · Go standard library… +1)
- [CVE-2023-36688](https://cve.now/CVE-2023-36688.md): WordPress Simple Site Verify Plugin \<= 1.0.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.3, Michael Mann Simple Site Verify)
- [CVE-2023-25994](https://cve.now/CVE-2023-25994.md): WordPress Publish to Schedule Plugin \<= 4.4.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Alex Benfica Publish to Schedule)
- [CVE-2023-46743](https://cve.now/CVE-2023-46743.md): The same file cannot be opened with different rights (CVSS 7.4, xwikisas application-collabora)
- [CVE-2023-47110](https://cve.now/CVE-2023-47110.md): Any value can be changed in the configuration table by an employee having access to block reassurance module (CVSS 9.1, PrestaShop blockreassurance · prestashop/blockreassurance)
- [CVE-2023-6039](https://cve.now/CVE-2023-6039.md): Kernel: use-after-free in drivers/net/usb/lan78xx.c in lan78xx\_disconnect (CVSS 5.5, Kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-41137](https://cve.now/CVE-2023-41137.md): Symmetric encryption used to protect messages between the AppsAnywhere server and client can be broken by reverse engineering the client and (CVSS 8.0, AppsAnywhere Client)
- [CVE-2023-40055](https://cve.now/CVE-2023-40055.md): SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability (CVSS 8.0, SolarWinds Network Configuration Manager)
- [CVE-2023-40054](https://cve.now/CVE-2023-40054.md): SolarWinds Network Configuration Manager Directory Traversal Remote Code Execution Vulnerability (CVSS 8.0, SolarWinds Network Configuration Manager)
- [CVE-2023-41138](https://cve.now/CVE-2023-41138.md): The AppsAnywhere macOS client-privileged helper can be tricked into executing arbitrary commands with elevated permissions by a local user p (CVSS 7.5, AppsAnywhere Client)
- [CVE-2023-43791](https://cve.now/CVE-2023-43791.md): Label Studio has Hardcoded Django \`SECRET\_KEY\` that can be Abused to Forge Session Tokens (CVSS 9.8, HumanSignal label-studio · label-studio)
- [CVE-2023-4612](https://cve.now/CVE-2023-4612.md): MFA bypass in Apereo CAS (CVSS 9.8, Apereo Foundation CAS)
- [CVE-2023-47615](https://cve.now/CVE-2023-47615.md): A CWE-526: Exposure of Sensitive Information Through Environmental Variables vulnerability exists in Telit Cinterion BGS5, Telit Cinterion E (CVSS 3.3, Telit Cinterion BGS5 · Telit Cinterion EHS5 +8)
- [CVE-2023-6052](https://cve.now/CVE-2023-6052.md): Tongda OA 2017 delete.php sql injection (CVSS 6.3, Tongda OA)
- [CVE-2023-47616](https://cve.now/CVE-2023-47616.md): A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8 (CVSS 2.4, Telit Cinterion BGS5 · Telit Cinterion EHS5 +8)
- [CVE-2023-47612](https://cve.now/CVE-2023-47612.md): A CWE-552: Files or Directories Accessible to External Parties vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit (CVSS 6.8, Telit Cinterion BGS5 · Telit Cinterion EHS5 +8)
- [CVE-2023-4218](https://cve.now/CVE-2023-4218.md): XXE in eclipse.platform / Eclipse IDE (CVSS 5.0, Eclipse Foundation Eclipse IDE · Eclipse Foundation org.… +9)
- [CVE-2023-47248](https://cve.now/CVE-2023-47248.md): PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file (critical (no CVSS), Apache Software Foundation PyArrow · pyarrow)
- [CVE-2023-47613](https://cve.now/CVE-2023-47613.md): A CWE-23: Relative Path Traversal vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, Telit Ci (CVSS 4.4, Telit Cinterion BGS5 · Telit Cinterion EHS5 +8)
- [CVE-2023-26156](https://cve.now/CVE-2023-26156.md): Versions of the package chromedriver before 119.0.1 are vulnerable to Command Injection when setting the chromedriver.path to an arbitrary s (CVSS 5.6, chromedriver)
- [CVE-2023-20902](https://cve.now/CVE-2023-20902.md): Timing attack risk in Harbor (CVSS 5.9, Harbor Project · github.com/goharbor/harbor)
- [CVE-2023-29975](https://cve.now/CVE-2023-29975.md): An issue discovered in Pfsense CE version 2.6.0 allows attackers to change the password of any user without verification. (no CVSS)
- [CVE-2023-45884](https://cve.now/CVE-2023-45884.md): Cross Site Request Forgery (CSRF) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to view sensitive information (no CVSS, openmct)
- [CVE-2023-45885](https://cve.now/CVE-2023-45885.md): Cross Site Scripting (XSS) vulnerability in NASA Open MCT (aka openmct) through 3.1.0 allows attackers to run arbitrary code via the new com (no CVSS, openmct)
- [CVE-2023-46492](https://cve.now/CVE-2023-46492.md): Cross Site Scripting vulnerability in MLDB.ai v.2017.04.17.0 allows a remote attacker to execute arbitrary code via a crafted payload to the (no CVSS)
- [CVE-2023-46894](https://cve.now/CVE-2023-46894.md): An issue discovered in esptool 4.6.2 allows attackers to view sensitive information via weak cryptographic algorithm. (no CVSS, esptool)
- [CVE-2023-47363](https://cve.now/CVE-2023-47363.md): The leakage of channel access token in F.B.P members Line 13.6.1 allows remote attackers to send malicious notifications to victims. (no CVSS)
- [CVE-2023-47364](https://cve.now/CVE-2023-47364.md): The leakage of channel access token in nagaoka taxi Line 13.6.1 allows remote attackers to send malicious notifications to victims (no CVSS)
- [CVE-2023-47365](https://cve.now/CVE-2023-47365.md): The leakage of channel access token in Lil.OFF-PRICE STORE Line 13.6.1 allows remote attackers to send malicious notifications to victims. (no CVSS)
- [CVE-2023-47366](https://cve.now/CVE-2023-47366.md): The leakage of channel access token in craft\_members Line 13.6.1 allows remote attackers to send malicious notifications to victims. (no CVSS)
- [CVE-2023-47367](https://cve.now/CVE-2023-47367.md): The leakage of channel access token in platinum clinic Line 13.6.1 allows remote attackers to send malicious notifications to victims. (no CVSS)
- [CVE-2023-47368](https://cve.now/CVE-2023-47368.md): The leakage of channel access token in taketorinoyu Line 13.6.1 allows remote attackers to send malicious notifications to victims. (no CVSS)
- [CVE-2023-47369](https://cve.now/CVE-2023-47369.md): The leakage of channel access token in best\_training\_member Line 13.6.1 allows remote attackers to send malicious notifications. (no CVSS)
- [CVE-2023-47370](https://cve.now/CVE-2023-47370.md): The leakage of channel access token in bluetrick Line 13.6.1 allows remote attackers to send malicious notifications to victims. (no CVSS)
- [CVE-2023-47372](https://cve.now/CVE-2023-47372.md): The leakage of channel access token in UPDATESALON C-LOUNGE Line 13.6.1 allows remote attackers to send malicious notifications to victims. (no CVSS)
- [CVE-2023-47373](https://cve.now/CVE-2023-47373.md): The leakage of channel access token in DRAGON FAMILY Line 13.6.1 allows remote attackers to send malicious notifications to victims. (no CVSS)
- [CVE-2023-47488](https://cve.now/CVE-2023-47488.md): Cross Site Scripting vulnerability in Combodo iTop v.3.1.0-2-11973 allows a local attacker to obtain sensitive information via a crafted scr (CVSS 6.1)
- [CVE-2023-47489](https://cve.now/CVE-2023-47489.md): CSV injection in export as csv in Combodo iTop v.3.1.0-2-11973 allows a local attacker to execute arbitrary code via a crafted script to the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.