CVEs published November 10, 2023
39 CVEs were published on November 10, 2023: 5 critical, 9 high. 1 is now in CISA KEV.
- Published
- 39
- Critical
- 5
- High
- 9
- Medium
- 18
- Low
- 4
- Unrated
- 3
- Now in CISA KEV
- 1
- Fix available
- 24
Most affected products
- discourse
- 6
- PHPGurukul Restaurant Table Booking System
- 3
- QNAP Systems QuMagie
- 3
- Telit Cinterion BGS5 · Telit Cinterion EHS5-E +16
- 2
- DigitalDruid.Net HOTELDRUID
- 1
- Free Software Foundation Grub-Legacy
- 1
- froxlor/froxlor
- 1
- getsentry sentry-javascript · @sentry/nextjs
- 1
- IBM AIX
- 1
- Johnson Controls Quantum HD Unity Compressor · Johnson C… +4
- 1
Critical 5
- CVE-2023-4804Quantum HD UnityJohnson Controls Quantum HD Unity Compressor · Johnson C… +4
- CVE-2023-47128piccolo SQL Injection via named transaction savepointspiccolo-orm piccolo · piccolo
- CVE-2023-46729Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpointgetsentry sentry-javascript · @sentry/nextjs
- CVE-2023-6069Improper Link Resolution Before File Access in froxlor/froxlorfroxlor/froxlor
- CVE-2023-47246In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we
High 9
- CVE-2023-36027Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2023-47129Statamic CMS remote code execution via front-end form uploadsstatamic cms · statamic/cms
- CVE-2023-47108DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metricsopen-telemetry opentelemetry-go-contrib · go.opentelemetry.…
- CVE-2023-4949Memory Corruption Vulnerability in Grub-Legacy's XFS ImplementationFree Software Foundation Grub-Legacy
- CVE-2023-47611A CWE-269: Improper Privilege Management vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, TTelit Cinterion BGS5 · Telit Cinterion EHS5-E +16
- CVE-2023-41285QuMagieQNAP Systems QuMagie
- CVE-2023-41284QuMagieQNAP Systems QuMagie
- CVE-2023-39295QuMagieQNAP Systems QuMagie
- CVE-2023-47120Discourse DoS through Onebox favicon URLdiscourse
Medium, low and unrated 25
- CVE-2023-47122Gitsign's Rekor public keys fetched from upstream API instead of local TUF client.sigstore gitsign · github.com/sigstore/gitsign
- CVE-2023-46735Symfony potential Cross-site Scripting in WebhookControllersymfony · symfony/webhook +1
- CVE-2023-46734Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filterssymfony · symfony/twig-bridge +1
- CVE-2023-46733Symfony possible session fixation vulnerabilitysymfony · symfony/security-http +1
- CVE-2023-47614A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8Telit Cinterion BGS5 · Telit Cinterion EHS5-E +16
- CVE-2023-6076PHPGurukul Restaurant Table Booking System Reservation Status booking-details.php information disclosurePHPGurukul Restaurant Table Booking System
- CVE-2023-47121Discourse SSRF vulnerability in Embeddingdiscourse
- CVE-2023-47119HTML injection in oneboxed linksdiscourse
- CVE-2023-6075PHPGurukul Restaurant Table Booking System Reservation Request index.php cross site scriptingPHPGurukul Restaurant Table Booking System
- CVE-2023-46130Bypassing height value allowed in some theme componentsdiscourse
- CVE-2023-23367QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-45816Unread bookmark reminder notifications that the user cannot access can be seendiscourse
- CVE-2023-45806Discourse vulnerable to DoS via Regexp Injection in Full Namediscourse
- CVE-2023-6074PHPGurukul Restaurant Table Booking System Booking Reservation check-status.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2023-29426WordPress Spreadshop Plugin Plugin <= 1.6.5 is vulnerable to Cross Site Request Forgery (CSRF)Robert Schulz (sprd.net AG) Spreadshop Plugin
- CVE-2023-29428WordPress Superb Social Media Share Buttons and Follow Buttons Plugin <= 1.1.3 is vulnerable to Broken Access ControlSuPlugins Superb Social Media Share Buttons and Follow Butt…
- CVE-2023-29440WordPress Simple Job Board Plugin <= 2.10.3 is vulnerable to Cross Site Request Forgery (CSRF)PressTigers Simple Job Board
- CVE-2023-30478WordPress Newsletters Plugin <= 4.8.8 is vulnerable to Cross Site Request Forgery (CSRF)Tribulant Newsletters
- CVE-2023-31077WordPress Export WP Page to Static HTML/CSS Plugin <= 2.1.9 is vulnerable to Cross Site Request Forgery (CSRF)ReCorp Export WP Page to Static HTML/CSS
- CVE-2023-31078WordPress WP BrowserUpdate Plugin <= 4.4.1 is vulnerable to Cross Site Request Forgery (CSRF)Marco Steinbrecher WP BrowserUpdate
- CVE-2023-47164Cross-site scripting vulnerability in HOTELDRUID 3.0.5 and earlier allows a remote unauthenticated attacker to execute an arbitrary script oDigitalDruid.Net HOTELDRUID
- CVE-2023-6073DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECUVolkswagen ID.3
- CVE-2023-45167IBM AIX denial of serviceIBM AIX
- CVE-2023-39796SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via
- CVE-2023-47800Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowin