CVEs published November 13, 2023
81 CVEs were published on November 13, 2023: 1 critical, 25 high.
- Published
- 81
- Critical
- 1
- High
- 25
- Medium
- 38
- Low
- 4
- Unrated
- 13
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- kyverno · github.com/kyverno/kyverno
- 4
- Maiwei Safety Production Control Platform
- 3
- IBM CICS TX Advanced
- 2
- ICSSolution ICS Business Manager
- 2
- Aleksandr Guidrevitch WP Meteor Website Speed Optimization…
- 1
- Andy Moyle Church Admin
- 1
- Anton Bond Additional Order Filters for WooCommerce
- 1
- Bala Krishna, Sergey Yakovlev Category SEO Meta Tags
- 1
- BRANDbrilliance Post State Tags
- 1
- Cimatti Consulting WordPress Contact Forms by Cimatti
- 1
Critical 1
High 25
- CVE-2023-47665WordPress Plainview Protect Passwords Plugin <= 1.4 is vulnerable to Cross Site Scripting (XSS)edward_plainview Plainview Protect Passwords
- CVE-2023-47673WordPress Post Pay Counter Plugin <= 2.784 is vulnerable to Cross Site Scripting (XSS)Stefano Ottolenghi Post Pay Counter
- CVE-2023-47684WordPress Essential Grid Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)ThemePunch OHG Essential Grid
- CVE-2023-47690WordPress Additional Order Filters for WooCommerce Plugin <= 1.10 is vulnerable to Cross Site Scripting (XSS)Anton Bond Additional Order Filters for WooCommerce
- CVE-2023-47695WordPress Shortcodes Finder Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)Scribit Shortcodes Finder
- CVE-2023-47696WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)Gravity Master Product Enquiry for WooCommerce
- CVE-2023-47697WordPress WP Event Manager Plugin <= 3.1.39 is vulnerable to Cross Site Scripting (XSS)WP Event Manager – Events Calendar, Registrations, Sell Tic…
- CVE-2023-47117Object Relational Mapper Leak Vulnerability in Filtering Task in Label StudioHumanSignal label-studio · label-studio
- CVE-2023-47621Remote code execution via file uploads in guest-entries duncanmcclean guest-entries · duncanmcclean/guest-entries +1
- CVE-2023-31230WordPress Baidu Tongji generator Plugin <= 1.0.2 is vulnerable to Cross Site Request Forgery (CSRF)Haoqisir Baidu Tongji generator
- CVE-2023-35877WordPress Extra User Details Plugin <= 0.5 is vulnerable to Cross Site Request Forgery (CSRF)Vadym K. Extra User Details
- CVE-2023-39166WordPress tagDiv Composer Plugin < 4.4 is vulnerable to Cross Site Request Forgery (CSRF)tagDiv Composer
- CVE-2023-6099Shenzhen Youkate Industrial Facial Love Cloud Payment System Account SystemMng.ashx privileges managementShenzhen Youkate Industrial Facial Love Cloud Payment System
- CVE-2023-40335WordPress Cleverwise Daily Quotes Plugin <= 3.2 is vulnerable to Cross Site Scripting (XSS)Jeremy O'Connell Cleverwise Daily Quotes
- CVE-2023-46092WordPress Webmaster Tools Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)LionScripts.com Webmaster Tools
- CVE-2023-5747Command injection via wave install fileHanwha Vision Co. PNV-A6081R
- CVE-2023-5037Authenticated Command InjectionHanwha Vision Co. A-Series, Q-Series, PNM-series Camera
- CVE-2023-46201WordPress Auto Login New User After Registration Plugin <= 1.9.6 is vulnerable to Cross Site Request Forgery (CSRF)Jeff Sherk Auto Login New User After Registration
- CVE-2023-46634WordPress Custom My Account for Woocommerce Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)phoeniixx Custom My Account for Woocommerce
- CVE-2023-47516WordPress Category Post List Widget Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)Stark Digital Category Post List Widget
- CVE-2023-47652WordPress Auto Affiliate Links Plugin <= 6.4.2.4 is vulnerable to Cross Site Request Forgery (CSRF)Lucian Apostol Auto Affiliate Links
- CVE-2023-23800WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Server Side Request Forgery (SSRF)Vova Anokhin WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2023-35041WordPress Webpushr Plugin <= 4.34.0 is vulnerable to Cross Site Request Forgery (CSRF)Webpushr Web Push Notifications Web Push Notifications – We…
- CVE-2023-48058Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/run
- CVE-2023-48060Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/task/add
Medium, low and unrated 55
- CVE-2023-47657WordPress Direct Checkout – Quick View – Buy Now For WooCommerce Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)GrandPlugins Direct Checkout – Quick View – Buy Now For Woo…
- CVE-2023-47662WordPress Live Gold Price & Silver Price Charts Widgets Plugin <= 2.4 is vulnerable to Cross Site Scripting (XSS)GoldBroker.com Live Gold Price & Silver Price Charts Widgets
- CVE-2023-47680WordPress Qi Addons For Elementor Plugin <= 1.6.3 is vulnerable to Cross Site Scripting (XSS)Qode Interactive Qi Addons For Elementor
- CVE-2023-4603Star CloudPRNT for WooCommerce <= 2.0.3 - Reflected Cross-Site Scriptingfmahmood Star CloudPRNT for WooCommerce
- CVE-2023-47625Global Buffer Overflow leading to denial of service in PX4-AutopilotPX4-Autopilot
- CVE-2023-42813Denial of service from malicious manifest in kyvernokyverno · github.com/kyverno/kyverno
- CVE-2023-42814Denial of service from malicious image manifest in kyvernokyverno · github.com/kyverno/kyverno
- CVE-2023-42815Denial of service from malicious image manifest in kyvernokyverno · github.com/kyverno/kyverno
- CVE-2023-42816Denial of service from malicious signature in kyvernokyverno · github.com/kyverno/kyverno
- CVE-2023-6103Intelbras RX 1500 SSID WiFi.html cross site scriptingIntelbras RX
- CVE-2023-6102Maiwei Safety Production Control Platform unrestricted uploadMaiwei Safety Production Control Platform
- CVE-2023-32123WordPress The7 Theme <= 11.7.3 is vulnerable to Cross Site Request Forgery (CSRF)Dream-Theme The7
- CVE-2023-6101Maiwei Safety Production Control Platform Intelligent Monitoring ha.html information disclosureMaiwei Safety Production Control Platform
- CVE-2023-6100Maiwei Safety Production Control Platform GetItemList information disclosureMaiwei Safety Production Control Platform
- CVE-2023-6098Cross-site Scripting on ICSSolution ICS Business ManagerICSSolution ICS Business Manager
- CVE-2023-4775Advanced iFrame <= 2023.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodemdempfle Advanced iFrame
- CVE-2023-5741POWR <= 2.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodepowr Custom Form Builder, Contact Forms, Payment Forms, Sur…
- CVE-2022-45835WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)PhonePe Payment Solutions
- CVE-2023-23684WordPress WPGraphQL Plugin <= 1.14.5 is vulnerable to Server Side Request Forgery (SSRF)WPGraphQL · wp-graphql/wp-graphql
- CVE-2023-46207WordPress Motors – Car Dealer & Classified Ads Plugin <= 1.4.6 is vulnerable to Server Side Request Forgery (SSRF)StylemixThemes Motors – Car Dealer, Classifieds & Listing
- CVE-2023-41239WordPress PowerPress Podcasting Plugin <= 11.0.6 is vulnerable to Server Side Request Forgery (SSRF)PowerPress Podcasting plugin by Blubrry
- CVE-2023-37978WordPress HTTP Headers Plugin <= 1.18.11 is vulnerable to Server Side Request Forgery (SSRF)Dimitar Ivanov HTTP Headers
- CVE-2023-38515WordPress Church Admin Plugin <= 3.7.56 is vulnerable to Server Side Request Forgery (SSRF)Andy Moyle Church Admin
- CVE-2023-34013WordPress Poll Maker Plugin <= 4.6.2 is vulnerable to Server Side Request Forgery (SSRF)Poll Maker Team Poll Maker – Best WordPress Poll Plugin
- CVE-2023-47163Remarshal prior to v0.17.1 expands YAML alias nodes unlimitedly, hence Remarshal is vulnerable to Billion Laughs Attack.Remarshal-project Remarshal · remarshal
- CVE-2023-31219WordPress Download Monitor Plugin <= 4.8.1 is vulnerable to Server Side Request Forgery (SSRF)WPChill Download Monitor
- CVE-2023-38364IBM CICS TX Advanced cross-site scriptingIBM CICS TX Advanced
- CVE-2023-38363IBM CICS TX information disclosureIBM CICS TX Advanced
- CVE-2023-32583WordPress WP All Backup Plugin <= 2.4.3 is vulnerable to Cross Site Request Forgery (CSRF)Prashant Walke WP All Backup
- CVE-2023-32588WordPress Post State Tags Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)BRANDbrilliance Post State Tags
- CVE-2023-33207WordPress Stop Referrer Spam Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)Krzysztof Wielogórski Stop Referrer Spam
- CVE-2023-34378WordPress WP Hide Post Plugin <= 2.0.10 is vulnerable to Cross Site Request Forgery (CSRF)scriptburn.com WP Hide Post
- CVE-2023-34384WordPress Kebo Twitter Feed Plugin <= 1.5.12 is vulnerable to Cross Site Request Forgery (CSRF)Kebo Twitter Feed
- CVE-2023-47669WordPress Profile Builder Plugin <= 3.10.3 is vulnerable to Cross Site Request Forgery (CSRF)Cozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2023-46618WordPress Category SEO Meta Tags Plugin <= 2.5 is vulnerable to Cross Site Request Forgery (CSRF)Bala Krishna, Sergey Yakovlev Category SEO Meta Tags
- CVE-2023-46619WordPress Spider Facebook Plugin <= 1.0.15 is vulnerable to Cross Site Request Forgery (CSRF)WebDorado WDSocialWidgets
- CVE-2023-46620WordPress DeepL Pro API translation Plugin <= 2.3.9.1 is vulnerable to Cross Site Request Forgery (CSRF)Fluenx DeepL API translation plugin
- CVE-2023-46625WordPress Autolinks Manager Plugin <= 1.10.04 is vulnerable to Cross Site Request Forgery (CSRF)DAEXT Autolinks Manager
- CVE-2023-46629WordPress Remove Add to Cart WooCommerce Plugin <= 1.4.4 is vulnerable to Cross Site Request Forgery (CSRF)themelocation Remove Add to Cart WooCommerce
- CVE-2023-46636WordPress Custom Header Images Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)David Stöckl Custom Header Images
- CVE-2023-46638WordPress WCP OpenWeather Plugin <= 2.5.0 is vulnerable to Cross Site Request Forgery (CSRF)Webcodin WCP OpenWeather
- CVE-2023-47230WordPress Contact Forms by Cimatti Plugin <= 1.6.0 is vulnerable to Cross Site Request Forgery (CSRF)Cimatti Consulting WordPress Contact Forms by Cimatti
- CVE-2023-26543WordPress WP Meteor Page Speed Optimization Topping Plugin <= 3.1.4 is vulnerable to Cross Site Request Forgery (CSRF)Aleksandr Guidrevitch WP Meteor Website Speed Optimization…
- CVE-2023-46014SQL Injection vulnerability in hospitalLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'hemail'
- CVE-2023-46015Cross Site Scripting (XSS) vulnerability in index.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via 'msg' param
- CVE-2023-46016Cross Site Scripting (XSS) in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'search' parameter in t
- CVE-2023-46017SQL Injection vulnerability in receiverLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'remail'
- CVE-2023-46018SQL injection vulnerability in receiverReg.php in Code-Projects Blood Bank 1.0 \allows attackers to run arbitrary SQL commands via 'remail'
- CVE-2023-46019Cross Site Scripting (XSS) vulnerability in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'error' p
- CVE-2023-46020Cross Site Scripting (XSS) in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'rename', 're
- CVE-2023-46021SQL Injection vulnerability in cancel.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary commands via the 'reqid' paramet
- CVE-2023-47346Buffer Overflow vulnerability in free5gc 3.3.0, UPF 1.2.0, and SMF 1.2.0 allows attackers to cause a denial of service via crafted PFCP mess
- CVE-2023-47801An issue was discovered in Click Studios Passwordstate before 9811.
- CVE-2023-48063An issue was discovered in dreamer_cms 4.1.3.
- CVE-2023-48068DedeCMS v6.2 was discovered to contain a Cross-site Scripting (XSS) vulnerability via spec_add.php.