# CVEs published 2023-11-10 39 CVEs were published on November 10, 2023: 5 critical, 9 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2023-4804](https://cve.now/CVE-2023-4804.md): Quantum HD Unity (CVSS 10.0, Johnson Controls Quantum HD Unity Compressor · Johnson C… +4) - [CVE-2023-47122](https://cve.now/CVE-2023-47122.md): Gitsign's Rekor public keys fetched from upstream API instead of local TUF client. (CVSS 4.2, sigstore gitsign · github.com/sigstore/gitsign) - [CVE-2023-36027](https://cve.now/CVE-2023-36027.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Edge) - [CVE-2023-47129](https://cve.now/CVE-2023-47129.md): Statamic CMS remote code execution via front-end form uploads (CVSS 8.4, statamic cms · statamic/cms) - [CVE-2023-47108](https://cve.now/CVE-2023-47108.md): DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics (CVSS 7.5, open-telemetry opentelemetry-go-contrib · go.opentelemetry.…) - [CVE-2023-47128](https://cve.now/CVE-2023-47128.md): piccolo SQL Injection via named transaction savepoints (CVSS 9.1, piccolo-orm piccolo · piccolo) - [CVE-2023-46735](https://cve.now/CVE-2023-46735.md): Symfony potential Cross-site Scripting in WebhookController (CVSS 6.1, symfony · symfony/webhook +1) - [CVE-2023-46734](https://cve.now/CVE-2023-46734.md): Symfony potential Cross-site Scripting vulnerabilities in CodeExtension filters (CVSS 6.1, symfony · symfony/twig-bridge +1) - [CVE-2023-46733](https://cve.now/CVE-2023-46733.md): Symfony possible session fixation vulnerability (CVSS 6.5, symfony · symfony/security-http +1) - [CVE-2023-4949](https://cve.now/CVE-2023-4949.md): Memory Corruption Vulnerability in Grub-Legacy's XFS Implementation (CVSS 8.1, Free Software Foundation Grub-Legacy) - [CVE-2023-47611](https://cve.now/CVE-2023-47611.md): A CWE-269: Improper Privilege Management vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8, Telit Cinterion PDS5/6/8, T (CVSS 7.8, Telit Cinterion BGS5 · Telit Cinterion EHS5-E +16) - [CVE-2023-41285](https://cve.now/CVE-2023-41285.md): QuMagie (CVSS 7.4, QNAP Systems QuMagie) - [CVE-2023-41284](https://cve.now/CVE-2023-41284.md): QuMagie (CVSS 7.4, QNAP Systems QuMagie) - [CVE-2023-39295](https://cve.now/CVE-2023-39295.md): QuMagie (CVSS 8.8, QNAP Systems QuMagie) - [CVE-2023-47614](https://cve.now/CVE-2023-47614.md): A CWE-200: Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Telit Cinterion BGS5, Telit Cinterion EHS5/6/8 (CVSS 3.3, Telit Cinterion BGS5 · Telit Cinterion EHS5-E +16) - [CVE-2023-6076](https://cve.now/CVE-2023-6076.md): PHPGurukul Restaurant Table Booking System Reservation Status booking-details.php information disclosure (CVSS 5.3, PHPGurukul Restaurant Table Booking System) - [CVE-2023-47121](https://cve.now/CVE-2023-47121.md): Discourse SSRF vulnerability in Embedding (CVSS 3.4, discourse) - [CVE-2023-47120](https://cve.now/CVE-2023-47120.md): Discourse DoS through Onebox favicon URL (CVSS 7.5, discourse) - [CVE-2023-47119](https://cve.now/CVE-2023-47119.md): HTML injection in oneboxed links (CVSS 5.3, discourse) - [CVE-2023-6075](https://cve.now/CVE-2023-6075.md): PHPGurukul Restaurant Table Booking System Reservation Request index.php cross site scripting (CVSS 3.5, PHPGurukul Restaurant Table Booking System) - [CVE-2023-46130](https://cve.now/CVE-2023-46130.md): Bypassing height value allowed in some theme components (CVSS 4.3, discourse) - [CVE-2023-23367](https://cve.now/CVE-2023-23367.md): QTS, QuTS hero, QuTScloud (CVSS 4.7, QNAP Systems QTS · QNAP Systems QuTS hero +1) - [CVE-2023-45816](https://cve.now/CVE-2023-45816.md): Unread bookmark reminder notifications that the user cannot access can be seen (CVSS 3.3, discourse) - [CVE-2023-45806](https://cve.now/CVE-2023-45806.md): Discourse vulnerable to DoS via Regexp Injection in Full Name (CVSS 4.3, discourse) - [CVE-2023-6074](https://cve.now/CVE-2023-6074.md): PHPGurukul Restaurant Table Booking System Booking Reservation check-status.php sql injection (CVSS 6.3, PHPGurukul Restaurant Table Booking System) - [CVE-2023-29426](https://cve.now/CVE-2023-29426.md): WordPress Spreadshop Plugin Plugin \<= 1.6.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Robert Schulz (sprd.net AG) Spreadshop Plugin) - [CVE-2023-29428](https://cve.now/CVE-2023-29428.md): WordPress Superb Social Media Share Buttons and Follow Buttons Plugin \<= 1.1.3 is vulnerable to Broken Access Control (CVSS 5.3, SuPlugins Superb Social Media Share Buttons and Follow Butt…) - [CVE-2023-29440](https://cve.now/CVE-2023-29440.md): WordPress Simple Job Board Plugin \<= 2.10.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, PressTigers Simple Job Board) - [CVE-2023-30478](https://cve.now/CVE-2023-30478.md): WordPress Newsletters Plugin \<= 4.8.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Tribulant Newsletters) - [CVE-2023-31077](https://cve.now/CVE-2023-31077.md): WordPress Export WP Page to Static HTML/CSS Plugin \<= 2.1.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, ReCorp Export WP Page to Static HTML/CSS) - [CVE-2023-31078](https://cve.now/CVE-2023-31078.md): WordPress WP BrowserUpdate Plugin \<= 4.4.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Marco Steinbrecher WP BrowserUpdate) - [CVE-2023-47164](https://cve.now/CVE-2023-47164.md): Cross-site scripting vulnerability in HOTELDRUID 3.0.5 and earlier allows a remote unauthenticated attacker to execute an arbitrary script o (no CVSS, DigitalDruid.Net HOTELDRUID) - [CVE-2023-6073](https://cve.now/CVE-2023-6073.md): DoS and Control of Volume Settings for VW ID.3 ICAS3 IVI ECU (CVSS 5.7, Volkswagen ID.3) - [CVE-2023-45167](https://cve.now/CVE-2023-45167.md): IBM AIX denial of service (CVSS 6.2, IBM AIX) - [CVE-2023-46729](https://cve.now/CVE-2023-46729.md): Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint (CVSS 9.3, getsentry sentry-javascript · @sentry/nextjs) - [CVE-2023-6069](https://cve.now/CVE-2023-6069.md): Improper Link Resolution Before File Access in froxlor/froxlor (CVSS 9.9, froxlor/froxlor) - [CVE-2023-39796](https://cve.now/CVE-2023-39796.md): SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via (no CVSS) - [CVE-2023-47246](https://cve.now/CVE-2023-47246.md): In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we (CVSS 9.8, KEV) - [CVE-2023-47800](https://cve.now/CVE-2023-47800.md): Natus NeuroWorks and SleepWorks before 8.4 GMA3 utilize a default password of xltek for the Microsoft SQL Server service sa account, allowin (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2023-11-10 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.