# CVEs published 2023-11-14

337 CVEs were published on November 14, 2023: 18 critical, 117 high. 4 are now in CISA KEV. Days are UTC.

- [CVE-2023-46121](https://cve.now/CVE-2023-46121.md): Generic Extractor MITM Vulnerability in yt-dlp (CVSS 5.0, yt-dlp)
- [CVE-2023-39337](https://cve.now/CVE-2023-39337.md): A security vulnerability in EPMM Versions 11.10, 11.9 and 11.8 older allows a threat actor with knowledge of an enrolled device identifier t (no CVSS, Ivanti EPMM)
- [CVE-2023-41718](https://cve.now/CVE-2023-41718.md): When a particular process flow is initiated, an attacker may be able to gain unauthorized elevated privileges on the affected system when ha (CVSS 7.8, Ivanti Secure Access)
- [CVE-2023-39335](https://cve.now/CVE-2023-39335.md): A security vulnerability has been identified in EPMM Versions 11.10, 11.9 and 11.8 and older allowing an unauthenticated threat actor to imp (no CVSS, Ivanti EPMM)
- [CVE-2023-35080](https://cve.now/CVE-2023-35080.md): A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploi (CVSS 8.8, Ivanti Secure Access Client)
- [CVE-2023-38544](https://cve.now/CVE-2023-38544.md): A logged in user can modify specific files that may lead to unauthorized changes in system-wide configuration settings. (CVSS 5.3, Ivanti Secure Access Linux)
- [CVE-2023-38043](https://cve.now/CVE-2023-38043.md): A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker (CVSS 8.8, Ivanti Secure Access Client Windows)
- [CVE-2023-38543](https://cve.now/CVE-2023-38543.md): A vulnerability exists on all versions of the Ivanti Secure Access Client below 22.6R1.1, which could allow a locally authenticated attacker (CVSS 8.8, Ivanti Secure Access Client Windows)
- [CVE-2023-31100](https://cve.now/CVE-2023-31100.md): Improper Access Control in SMI handler vulnerability in Phoenix SecureCore™ Technology™ 4 allows SPI flash modification. (CVSS 8.4, Phoenix SecureCore™ Technology™)
- [CVE-2023-43591](https://cve.now/CVE-2023-43591.md): Improper privilege management in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of pri (CVSS 7.8, Zoom Video Communications Zoom Rooms for macOS)
- [CVE-2023-43590](https://cve.now/CVE-2023-43590.md): Link following in Zoom Rooms for macOS before version 5.16.0 may allow an authenticated user to conduct an escalation of privilege via loca (CVSS 7.8, Zoom Video Communications Zoom Rooms for macOS)
- [CVE-2023-43582](https://cve.now/CVE-2023-43582.md): Improper authorization in some Zoom clients may allow an authorized user to conduct an escalation of privilege via network access. (CVSS 5.5, Zoom Video Communications Zoom Clients)
- [CVE-2023-43588](https://cve.now/CVE-2023-43588.md): Insufficient control flow management in some Zoom clients may allow an authenticated user to conduct an information disclosure via network a (CVSS 3.5, Zoom Video Communications Zoom Clients)
- [CVE-2023-39199](https://cve.now/CVE-2023-39199.md): Cryptographic issues with In-Meeting Chat for some Zoom clients may allow a privileged user to conduct an information disclosure via network (CVSS 4.9, Zoom Video Communications Zoom Clients)
- [CVE-2023-39206](https://cve.now/CVE-2023-39206.md): Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. (CVSS 3.7, Zoom Video Communications Zoom Clients)
- [CVE-2023-45627](https://cve.now/CVE-2023-45627.md): An authenticated Denial-of-Service (DoS) vulnerability exists in the CLI service. (CVSS 4.3, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45626](https://cve.now/CVE-2023-45626.md): An authenticated vulnerability has been identified allowing an attacker to effectively establish highly privileged persistent arbitrary code (CVSS 5.5, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45625](https://cve.now/CVE-2023-45625.md): Multiple authenticated command injection vulnerabilities exist in the command line interface. (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45624](https://cve.now/CVE-2023-45624.md): An unauthenticated Denial-of-Service (DoS) vulnerability exists in the soft ap daemon accessed via the PAPI protocol. (CVSS 7.5, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-5189](https://cve.now/CVE-2023-5189.md): Hub: insecure galaxy-importer tarfile extraction (CVSS 6.3, Red Hat Ansible Automation Platform 2.4 for RHEL · Red H… +2)
- [CVE-2023-45623](https://cve.now/CVE-2023-45623.md): Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the Wi-Fi Uplink service accessed via the PAPI protocol. (CVSS 7.5, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45622](https://cve.now/CVE-2023-45622.md): Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the BLE daemon service accessed via the PAPI protocol. (CVSS 7.5, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45621](https://cve.now/CVE-2023-45621.md): Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. (CVSS 7.5, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45620](https://cve.now/CVE-2023-45620.md): Unauthenticated Denial-of-Service (DoS) vulnerabilities exist in the CLI service accessed via the PAPI protocol. (CVSS 7.5, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45619](https://cve.now/CVE-2023-45619.md): There is an arbitrary file deletion vulnerability in the RSSI service accessed by PAPI (Aruba's access point management protocol). (CVSS 8.2, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45618](https://cve.now/CVE-2023-45618.md): There are arbitrary file deletion vulnerabilities in the AirWave client service accessed by PAPI (Aruba's access point management protocol). (CVSS 8.2, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45617](https://cve.now/CVE-2023-45617.md): There are arbitrary file deletion vulnerabilities in the CLI service accessed by PAPI (Aruba's access point management protocol). (CVSS 8.2, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45616](https://cve.now/CVE-2023-45616.md): There is a buffer overflow vulnerability in the underlying AirWave client service that could lead to unauthenticated remote code execution b (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45615](https://cve.now/CVE-2023-45615.md): There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-45614](https://cve.now/CVE-2023-45614.md): There are buffer overflow vulnerabilities in the underlying CLI service that could lead to unauthenticated remote code execution by sending (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Access Points: 100 S…)
- [CVE-2023-39205](https://cve.now/CVE-2023-39205.md): Improper conditions check in Zoom Team Chat for Zoom clients may allow an authenticated user to conduct a denial of service via network acce (CVSS 4.3, Zoom Video Communications Zoom Clients)
- [CVE-2023-39204](https://cve.now/CVE-2023-39204.md): Buffer overflow in some Zoom clients may allow an unauthenticated user to conduct a denial of service via network access. (CVSS 4.3, Zoom Video Communications Zoom Clients)
- [CVE-2023-39203](https://cve.now/CVE-2023-39203.md): Uncontrolled resource consumption in Zoom Team Chat for Zoom Desktop Client for Windows and Zoom VDI Client may allow an unauthenticated use (CVSS 4.3, Zoom Video Communications Zoom Rooms Client for Windows and…)
- [CVE-2023-39202](https://cve.now/CVE-2023-39202.md): Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via lo (CVSS 3.1, Zoom Video Communications Zoom Rooms Client for Windows and…)
- [CVE-2023-47517](https://cve.now/CVE-2023-47517.md): WordPress SendPress Newsletters Plugin \<= 1.23.11.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, SendPress Newsletters)
- [CVE-2023-47518](https://cve.now/CVE-2023-47518.md): WordPress Restrict Categories Plugin \<= 2.6.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Matthew Muro Restrict Categories)
- [CVE-2023-47520](https://cve.now/CVE-2023-47520.md): WordPress Responsive Column Widgets Plugin \<= 1.2.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Michael Uno (miunosoft) Responsive Column Widgets)
- [CVE-2023-48217](https://cve.now/CVE-2023-48217.md): Remote code execution via form uploads in statamic/cms (CVSS 8.8, statamic cms · statamic/cms)
- [CVE-2023-47522](https://cve.now/CVE-2023-47522.md): WordPress Photo Feed Plugin \<= 2.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Photo Feed)
- [CVE-2023-36038](https://cve.now/CVE-2023-36038.md): ASP.NET Core Denial of Service Vulnerability (CVSS 8.2, Microsoft ASP.NET Core · Microsoft Visual Studio +1)
- [CVE-2023-36558](https://cve.now/CVE-2023-36558.md): ASP.NET Core Security Feature Bypass Vulnerability (CVSS 6.2, Microsoft .NET · Microsoft ASP.NET Core +2)
- [CVE-2023-47524](https://cve.now/CVE-2023-47524.md): WordPress CodeBard's Patron Button and Widgets for Patreon Plugin \<= 2.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, CodeBard's Patron Button and Widgets for Patreon)
- [CVE-2023-39537](https://cve.now/CVE-2023-39537.md): Improper input validation in BIOS TCG2 (CVSS 7.5, AMI AptioV)
- [CVE-2023-39536](https://cve.now/CVE-2023-39536.md): Improper input validation in BIOS OFBD (CVSS 7.5, AMI AptioV)
- [CVE-2023-39535](https://cve.now/CVE-2023-39535.md): Improper input validation in BIOS (CVSS 7.5, AMI AptioV)
- [CVE-2023-47528](https://cve.now/CVE-2023-47528.md): WordPress WP Edit Username Plugin \<= 1.0.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Sajjad Hossain Sagor WP Edit Username)
- [CVE-2023-47532](https://cve.now/CVE-2023-47532.md): WordPress WP Crowdfunding Plugin \<= 2.1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.8, Themeum WP Crowdfunding)
- [CVE-2023-47533](https://cve.now/CVE-2023-47533.md): WordPress Countdown and CountUp, WooCommerce Sales Timer Plugin \<= 1.8.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, wpdevart Countdown and CountUp, WooCommerce Sales Timer)
- [CVE-2023-47631](https://cve.now/CVE-2023-47631.md): vantage6 Node accepts non-whitelisted algorithms from malicious server (CVSS 7.2, vantage6 · vantage6-server +1)
- [CVE-2023-47544](https://cve.now/CVE-2023-47544.md): WordPress Atarim Plugin \<= 3.12 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Visual Website Collaboration, Feedback & Project Management…)
- [CVE-2023-47630](https://cve.now/CVE-2023-47630.md): Attacker can cause Kyverno user to unintentionally consume insecure image (CVSS 7.1, kyverno · github.com/kyverno/kyverno)
- [CVE-2023-47545](https://cve.now/CVE-2023-47545.md): WordPress Forms for Mailchimp by Optin Cat Plugin \<= 2.5.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Fatcat Apps Forms for Mailchimp by Optin Cat – Grow Your Ma…)
- [CVE-2023-47640](https://cve.now/CVE-2023-47640.md): Insecure Use of HMAC-SHA1 For Session Signing in datahub (CVSS 6.4, datahub-project datahub)
- [CVE-2023-47546](https://cve.now/CVE-2023-47546.md): WordPress OneClick Chat to Order Plugin \<= 1.0.4.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Walter Pinem OneClick Chat to Order)
- [CVE-2023-47627](https://cve.now/CVE-2023-47627.md): Request smuggling in aiohttp (CVSS 5.3, aio-libs aiohttp · aiohttp)
- [CVE-2023-47547](https://cve.now/CVE-2023-47547.md): WordPress Products, Order & Customers Export for WooCommerce Plugin \<= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WPFactory Products, Order & Customers Export for WooCommerce)
- [CVE-2023-47641](https://cve.now/CVE-2023-47641.md): Inconsistent interpretation of \`Content-Length\` vs. \`Transfer-Encoding\` in aiohttp (CVSS 3.4, aio-libs aiohttp · aiohttp)
- [CVE-2023-47549](https://cve.now/CVE-2023-47549.md): WordPress EazyDocs Plugin \<= 2.3.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.8, spider-themes EazyDocs – Most Powerful Knowledge base, wiki…)
- [CVE-2023-5528](https://cve.now/CVE-2023-5528.md): Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation (CVSS 7.2, Kubernetes kubelet · k8s.io/kubernetes)
- [CVE-2023-47130](https://cve.now/CVE-2023-47130.md): Unsafe deserialization of user data in yiisoft/yii (CVSS 8.1, yiisoft yii · yiisoft/yii)
- [CVE-2023-46132](https://cve.now/CVE-2023-46132.md): Crosslinking transaction attack in hyperledger/fabric (CVSS 7.1, hyperledger fabric · github.com/hyperledger/fabric)
- [CVE-2023-34060](https://cve.now/CVE-2023-34060.md): VMware Cloud Director Appliance contains an authentication bypass vulnerability in case VMware Cloud Director Appliance was upgraded to 10.5 (no CVSS, VMware Cloud Director Appliance)
- [CVE-2023-36049](https://cve.now/CVE-2023-36049.md): .NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability (CVSS 7.6, Microsoft Visual Studio · Microsoft .NET +1)
- [CVE-2023-36007](https://cve.now/CVE-2023-36007.md): Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability (CVSS 7.6, Microsoft Send Customer Voice survey from Dynamics 365 app)
- [CVE-2023-36437](https://cve.now/CVE-2023-36437.md): Azure DevOps Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Azure Pipelines Agent)
- [CVE-2023-47125](https://cve.now/CVE-2023-47125.md): By-passing Cross-Site Scripting Protection in HTML Sanitizer (CVSS 4.7, TYPO3 html-sanitizer · typo3/html-sanitizer)
- [CVE-2023-47550](https://cve.now/CVE-2023-47550.md): WordPress Donations Made Easy – Smart Donations Plugin \<= 4.0.12 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, RedNao Donations Made Easy – Smart Donations)
- [CVE-2023-47126](https://cve.now/CVE-2023-47126.md): Information Disclosure in Install Tool in typo3/cms-install (CVSS 3.7, typo3 · typo3/cms-install)
- [CVE-2023-47554](https://cve.now/CVE-2023-47554.md): WordPress Actueel Financieel Nieuws – Denk Internet Solutions Plugin \<= 5.1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, DenK BV Actueel Financieel Nieuws – Denk Internet Solutions)
- [CVE-2023-47646](https://cve.now/CVE-2023-47646.md): WordPress Recently viewed and most viewed products Plugin \<= 1.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, CedCommerce Recently viewed and most viewed products)
- [CVE-2023-26222](https://cve.now/CVE-2023-26222.md): TIBCO EBX Cross-site Scripting (XXS) Vulnerability (CVSS 8.7, TIBCO Software TIBCO EBX · TIBCO Software TIBCO Product and…)
- [CVE-2023-47127](https://cve.now/CVE-2023-47127.md): Weak Authentication in Session Handling in typo3/cms-core (CVSS 4.2, typo3 · typo3/cms-core)
- [CVE-2023-28741](https://cve.now/CVE-2023-28741.md): Buffer overflow in some Intel(R) QAT drivers for Windows - HW Version 1.0 before version 1.10 may allow an authenticated user to potentially (CVSS 7.9, Intel(R) QAT drivers for Windows - HW)
- [CVE-2023-22313](https://cve.now/CVE-2023-22313.md): Improper buffer restrictions in some Intel(R) QAT Library software before version 22.07.1 may allow a privileged user to potentially enable (CVSS 2.3, Intel(R) QAT Library software)
- [CVE-2023-28740](https://cve.now/CVE-2023-28740.md): Uncontrolled search path element in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated u (CVSS 6.7, Intel(R) QAT drivers for Windows - HW)
- [CVE-2023-28378](https://cve.now/CVE-2023-28378.md): Improper authorization in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated user to pot (CVSS 6.7, Intel(R) QAT drivers for Windows - HW)
- [CVE-2023-28388](https://cve.now/CVE-2023-28388.md): Uncontrolled search path element in some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenticated user to (CVSS 6.7, Intel(R) Chipset Device Software)
- [CVE-2023-29504](https://cve.now/CVE-2023-29504.md): Uncontrolled search path element in some Intel(R) RealSense(TM) Dynamic Calibration software before version 2.13.1.0 may allow an authentica (CVSS 6.7, Intel(R) RealSense(TM) Dynamic Calibration software)
- [CVE-2023-27513](https://cve.now/CVE-2023-27513.md): Uncontrolled search path element in some Intel(R) Server Information Retrieval Utility software before version 16.0.9 may allow an authentic (CVSS 6.7, Intel(R) Server Information Retrieval Utility software)
- [CVE-2022-29510](https://cve.now/CVE-2022-29510.md): Improper buffer restrictions in some Intel(R) Server Board M10JNP2SB BIOS firmware before version 7.219 may allow a privileged user to poten (CVSS 7.5, Intel(R) Server Board M10JNP2SB BIOS firmware)
- [CVE-2022-24379](https://cve.now/CVE-2022-24379.md): Improper input validation in some Intel(R) Server System M70KLP Family BIOS firmware before version 01.04.0029 may allow a privileged user t (CVSS 7.5, Intel(R) Server System M70KLP Family BIOS firmware)
- [CVE-2022-29262](https://cve.now/CVE-2022-29262.md): Improper buffer restrictions in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of pri (CVSS 7.9, Intel(R) Server Board BIOS firmware)
- [CVE-2022-33945](https://cve.now/CVE-2022-33945.md): Improper input validation in some Intel(R) Server board and Intel(R) Server System BIOS firmware may allow a privileged user to potentially (CVSS 8.2, Intel(R) Server board and Intel(R) Server System BIOS firmw…)
- [CVE-2023-34431](https://cve.now/CVE-2023-34431.md): Improper input validation in some Intel(R) Server Board BIOS firmware may allow a privileged user to potentially enable escalation of privil (CVSS 8.2, Intel(R) Server Board BIOS firmware)
- [CVE-2023-22329](https://cve.now/CVE-2023-22329.md): Improper input validation in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable denial of (CVSS 2.6, Intel(R) Processors)
- [CVE-2023-25756](https://cve.now/CVE-2023-25756.md): Out-of-bounds read in the BIOS firmware for some Intel(R) Processors may allow an authenticated user to potentially enable escalation of pri (CVSS 4.6, Intel(R) Processors)
- [CVE-2023-40540](https://cve.now/CVE-2023-40540.md): Non-Transparent Sharing of Microarchitectural Resources in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable (CVSS 4.1, Intel(R) NUC BIOS firmware)
- [CVE-2023-40220](https://cve.now/CVE-2023-40220.md): Improper buffer restrictions in some Intel(R) NUC BIOS firmware may allow a privileged user to potentially enable information disclosure via (CVSS 5.3, Intel(R) NUC BIOS firmware)
- [CVE-2023-27383](https://cve.now/CVE-2023-27383.md): Protection mechanism failure in some Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library software before version 2021.9 may allow a p (CVSS 6.8, Intel(R) oneAPI HPC Toolkit 2023.1 and Intel(R)MPI Library…)
- [CVE-2023-24592](https://cve.now/CVE-2023-24592.md): Path traversal in the some Intel(R) oneAPI Toolkits and Component software before version 2023.1 may allow authenticated user to potentially (CVSS 7.3, Intel(R) oneAPI Toolkits and Component software)
- [CVE-2022-38786](https://cve.now/CVE-2022-38786.md): Improper access control in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentia (CVSS 6.7, Intel Battery Life Diagnostic Tool software)
- [CVE-2023-32662](https://cve.now/CVE-2023-32662.md): Improper authorization in some Intel Battery Life Diagnostic Tool installation software before version 2.2.1 may allow a privilaged user to (CVSS 6.7, Intel Battery Life Diagnostic Tool installation software)
- [CVE-2023-34430](https://cve.now/CVE-2023-34430.md): Uncontrolled search path in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potenti (CVSS 6.7, Intel Battery Life Diagnostic Tool software)
- [CVE-2023-38411](https://cve.now/CVE-2023-38411.md): Improper access control in the Intel Smart Campus android application before version 9.4 may allow an authenticated user to potentially enab (CVSS 3.9, Intel Smart Campus android application)
- [CVE-2023-29161](https://cve.now/CVE-2023-29161.md): Uncontrolled search path in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalati (CVSS 6.7, Intel(R) OFU software)
- [CVE-2023-29157](https://cve.now/CVE-2023-29157.md): Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalatio (CVSS 8.4, Intel(R) OFU software)
- [CVE-2023-32204](https://cve.now/CVE-2023-32204.md): Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalatio (CVSS 8.8, Intel(R) OFU software)
- [CVE-2023-31203](https://cve.now/CVE-2023-31203.md): Improper input validation in some OpenVINO Model Server software before version 2022.3 for Intel Distribution of OpenVINO toolkit may allow (CVSS 4.3, OpenVINO Model Server software)
- [CVE-2023-25080](https://cve.now/CVE-2023-25080.md): Protection mechanism failure in some Intel(R) Distribution of OpenVINO toolkit software before version 2023.0.0 may allow an authenticated u (CVSS 5.3, Intel(R) Distribution of OpenVINO toolkit software)
- [CVE-2023-31273](https://cve.now/CVE-2023-31273.md): Protection mechanism failure in some Intel DCM software before version 5.2 may allow an unauthenticated user to potentially enable escalatio (CVSS 10.0, Intel DCM software)
- [CVE-2023-33872](https://cve.now/CVE-2023-33872.md): Improper access control in the Intel Support android application all verions may allow an authenticated user to potentially enable informati (CVSS 5.5, Intel Support android application)
- [CVE-2023-24588](https://cve.now/CVE-2023-24588.md): Exposure of sensitive information to an unauthorized actor in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticate (CVSS 5.9, Intel(R) Optane(TM) SSD products)
- [CVE-2023-27306](https://cve.now/CVE-2023-27306.md): Improper Initialization in firmware for some Intel(R) Optane(TM) SSD products may allow an authenticated user to potentially enable denial o (CVSS 6.5, Intel(R) Optane(TM) SSD products)
- [CVE-2023-27879](https://cve.now/CVE-2023-27879.md): Improper access control in firmware for some Intel(R) Optane(TM) SSD products may allow an unauthenticated user to potentially enable inform (CVSS 6.8, Intel(R) Optane(TM) SSD products)
- [CVE-2023-27519](https://cve.now/CVE-2023-27519.md): Improper input validation in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable escalation (CVSS 6.9, Intel(R) Optane(TM) SSD products)
- [CVE-2023-24587](https://cve.now/CVE-2023-24587.md): Insufficient control flow management in firmware for some Intel(R) Optane(TM) SSD products may allow a privileged user to potentially enable (CVSS 6.9, Intel(R) Optane(TM) SSD products)
- [CVE-2023-28376](https://cve.now/CVE-2023-28376.md): Out-of-bounds read in the firmware for some Intel(R) E810 Ethernet Controllers and Adapters before version 1.7.1 may allow an unauthenticate (CVSS 6.5, Intel(R) E810 Ethernet Controllers and Adapters)
- [CVE-2023-32641](https://cve.now/CVE-2023-32641.md): Improper input validation in firmware for Intel(R) QAT before version QAT20.L.1.0.40-00004 may allow escalation of privilege and denial of s (CVSS 7.3, Intel(R) QAT)
- [CVE-2023-22327](https://cve.now/CVE-2023-22327.md): Out-of-bounds write in firmware for some Intel(R) FPGA products before version 2.8.1 may allow a privileged user to potentially enable infor (CVSS 6.0, Intel(R) FPGA products)
- [CVE-2023-28723](https://cve.now/CVE-2023-28723.md): Exposure of sensitive information to an unauthorized actor in some Intel(R) Aptio\* V UEFI Firmware Integrator Tools may allow an authenticat (CVSS 3.3, Intel(R) Aptio\* V UEFI Firmware Integrator Tools)
- [CVE-2023-25949](https://cve.now/CVE-2023-25949.md): Uncontrolled resource consumption in some Intel(R) Aptio\* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially en (CVSS 5.5, Intel(R) Aptio\* V UEFI Firmware Integrator Tools)
- [CVE-2023-22305](https://cve.now/CVE-2023-22305.md): Integer overflow in some Intel(R) Aptio\* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable denial of se (CVSS 6.5, Intel(R) Aptio\* V UEFI Firmware Integrator Tools)
- [CVE-2023-26589](https://cve.now/CVE-2023-26589.md): Use after free in some Intel(R) Aptio\* V UEFI Firmware Integrator Tools may allowed an authenticated user to potentially enable denial of se (CVSS 6.5, Intel(R) Aptio\* V UEFI Firmware Integrator Tools)
- [CVE-2023-22310](https://cve.now/CVE-2023-22310.md): Race condition in some Intel(R) Aptio\* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable denial of serv (CVSS 6.5, Intel(R) Aptio\* V UEFI Firmware Integrator Tools)
- [CVE-2023-32655](https://cve.now/CVE-2023-32655.md): Path transversal in some Intel(R) NUC Kits & Mini PCs - NUC8i7HVK & NUC8HNK USB Type C power delivery controller installatio software before (CVSS 6.7, Intel(R) NUC Kits & Mini PCs - NUC8i7HVK & NUC8HNK USB Type…)
- [CVE-2023-32278](https://cve.now/CVE-2023-32278.md): Path transversal in some Intel(R) NUC Uniwill Service Driver for Intel(R) NUC M15 Laptop Kits - LAPRC510 & LAPRC710 Uniwill Service Driver i (CVSS 6.7, Intel(R) NUC Uniwill Service Driver for Intel(R) NUC M15 La…)
- [CVE-2023-28377](https://cve.now/CVE-2023-28377.md): Improper authentication in some Intel(R) NUC Kit NUC11PH USB firmware installation software before version 1.1 for Windows may allow an auth (CVSS 6.7, Intel(R) NUC Kit NUC11PH USB firmware installation software)
- [CVE-2023-33878](https://cve.now/CVE-2023-33878.md): Path transversal in some Intel(R) NUC P14E Laptop Element Audio Install Package software before version 156 for Windows may allow an authent (CVSS 6.7, Intel(R) NUC P14E Laptop Element Audio Install Package soft…)
- [CVE-2023-32660](https://cve.now/CVE-2023-32660.md): Uncontrolled search path in some Intel(R) NUC Kit NUC6i7KYK Thunderbolt(TM) 3 Firmware Update Tool installation software before version 46 m (CVSS 6.7, Intel(R) NUC Kit NUC6i7KYK Thunderbolt(TM) 3 Firmware Updat…)
- [CVE-2023-33874](https://cve.now/CVE-2023-33874.md): Uncontrolled search path in some Intel(R) NUC 12 Pro Kits & Mini PCs - NUC12WS Intel(R) HID Event Filter Driver installation software before (CVSS 6.7, Intel(R) NUC 12 Pro Kits & Mini PCs - NUC12WS Intel(R) HID…)
- [CVE-2023-32658](https://cve.now/CVE-2023-32658.md): Unquoted search path in some Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software before version 1.79.1.1 may a (CVSS 6.7, Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmwar…)
- [CVE-2022-41700](https://cve.now/CVE-2022-41700.md): Insecure inherited permissions in some Intel(R) NUC Pro Software Suite installation software before version 2.0.0.9 may allow an authenticat (CVSS 6.7, Intel(R) NUC Pro Software Suite installation software)
- [CVE-2022-27229](https://cve.now/CVE-2022-27229.md): Path transversal in some Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software before version 1.79.1.1 may allow (CVSS 6.7, Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmwar…)
- [CVE-2022-33898](https://cve.now/CVE-2022-33898.md): Insecure inherited permissions in some Intel(R) NUC Watchdog Timer installation software before version 2.0.21.0 may allow an authenticated (CVSS 6.7, Intel(R) NUC Watchdog Timer installation software)
- [CVE-2023-32661](https://cve.now/CVE-2023-32661.md): Improper authentication in some Intel(R) NUC Kits NUC7PJYH and NUC7CJYH Realtek\* SD Card Reader Driver installation software before version (CVSS 6.7, Intel(R) NUC Kits NUC7PJYH and NUC7CJYH Realtek\* SD Card Re…)
- [CVE-2022-36374](https://cve.now/CVE-2022-36374.md): Improper access control in some Intel(R) Aptio\* V UEFI Firmware Integrator Tools before version iDmi Windows 5.27.03.0003 may allow a privil (CVSS 7.5, Intel(R) Aptio\* V UEFI Firmware Integrator Tools)
- [CVE-2023-28397](https://cve.now/CVE-2023-28397.md): Improper access control in some Intel(R) Aptio\* V UEFI Firmware Integrator Tools may allow an authenticated to potentially enable escalation (CVSS 7.8, Intel(R) Aptio\* V UEFI Firmware Integrator Tools)
- [CVE-2022-36396](https://cve.now/CVE-2022-36396.md): Improper access control in some Intel(R) Aptio\* V UEFI Firmware Integrator Tools before version iDmiEdit-Linux-5.27.06.0017 may allow a priv (CVSS 8.2, Intel(R) Aptio\* V UEFI Firmware Integrator Tools)
- [CVE-2023-28737](https://cve.now/CVE-2023-28737.md): Improper initialization in some Intel(R) Aptio\* V UEFI Firmware Integrator Tools may allow an authenticated user to potentially enable escal (CVSS 8.8, Intel(R) Aptio\* V UEFI Firmware Integrator Tools)
- [CVE-2023-32283](https://cve.now/CVE-2023-32283.md): Insertion of sensitive information into log file in some Intel(R) On Demand software before versions 1.16.2, 2.1.1, 3.1.0 may allow an authe (CVSS 5.5, Intel(R) On Demand software)
- [CVE-2023-34997](https://cve.now/CVE-2023-34997.md): Insecure inherited permissions in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an auth (CVSS 6.7, Intel Server Configuration Utility software)
- [CVE-2023-25075](https://cve.now/CVE-2023-25075.md): Unquoted search path in the installer for some Intel Server Configuration Utility software before version 16.0.9 may allow an authenticated (CVSS 6.7, Intel Server Configuration Utility software)
- [CVE-2023-32279](https://cve.now/CVE-2023-32279.md): Improper access control in user mode driver for some Intel(R) Connectivity Performance Suite before version 2.1123.214.2 may allow unauthent (CVSS 7.5, Intel(R) Connectivity Performance Suite)
- [CVE-2022-46298](https://cve.now/CVE-2022-46298.md): Incomplete cleanup for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access. (CVSS 1.9, Intel Unison software)
- [CVE-2022-41659](https://cve.now/CVE-2022-41659.md): Improper access control for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access. (CVSS 1.9, Intel Unison software)
- [CVE-2022-46301](https://cve.now/CVE-2022-46301.md): Improper Initialization for some Intel Unison software may allow a privileged user to potentially enable denial of service via local access. (CVSS 1.9, Intel Unison software)
- [CVE-2022-46646](https://cve.now/CVE-2022-46646.md): Exposure of sensitive information to an unauthorized actor for some Intel Unison software may allow an authenticated user to potentially ena (CVSS 2.2, Intel Unison software)
- [CVE-2022-45469](https://cve.now/CVE-2022-45469.md): Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via l (CVSS 2.2, Intel Unison software)
- [CVE-2022-46647](https://cve.now/CVE-2022-46647.md): Insertion of sensitive information into log file for some Intel Unison software may allow an authenticated user to potentially enable inform (CVSS 2.5, Intel Unison software)
- [CVE-2022-46299](https://cve.now/CVE-2022-46299.md): Insufficient control flow management for some Intel Unison software may allow an authenticated user to potentially enable information disclo (CVSS 3.3, Intel Unison software)
- [CVE-2022-43477](https://cve.now/CVE-2022-43477.md): Incomplete cleanup for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via local acc (CVSS 3.3, Intel Unison software)
- [CVE-2022-43666](https://cve.now/CVE-2022-43666.md): Exposure of sensitive system information due to uncleared debug information for some Intel Unison software may allow an authenticated user t (CVSS 3.3, Intel Unison software)
- [CVE-2022-45109](https://cve.now/CVE-2022-45109.md): Improper initialization for some Intel Unison software may allow an authenticated user to potentially enable information disclosure via loca (CVSS 3.3, Intel Unison software)
- [CVE-2023-39411](https://cve.now/CVE-2023-39411.md): Improper input validationation for some Intel Unison software may allow a privileged user to potentially enable denial of service via local (CVSS 5.0, Intel Unison software)
- [CVE-2023-39228](https://cve.now/CVE-2023-39228.md): Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network (CVSS 5.3, Intel Unison software)
- [CVE-2023-38570](https://cve.now/CVE-2023-38570.md): Access of memory location after end of buffer for some Intel Unison software may allow an authenticated user to potentially enable escalatio (CVSS 5.3, Intel Unison software)
- [CVE-2023-39412](https://cve.now/CVE-2023-39412.md): Cross-site request forgery in some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via n (CVSS 5.4, Intel Unison software)
- [CVE-2023-39221](https://cve.now/CVE-2023-39221.md): Improper access control for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via net (CVSS 5.4, Intel Unison software)
- [CVE-2023-22663](https://cve.now/CVE-2023-22663.md): Improper authentication for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via net (CVSS 5.9, Intel Unison software)
- [CVE-2023-22448](https://cve.now/CVE-2023-22448.md): Improper access control for some Intel Unison software may allow a privileged user to potentially enable escalation of privilege via network (CVSS 5.9, Intel Unison software)
- [CVE-2023-38131](https://cve.now/CVE-2023-38131.md): Improper input validationation for some Intel Unison software may allow an authenticated user to potentially enable denial of service via ne (CVSS 6.5, Intel Unison software)
- [CVE-2023-22290](https://cve.now/CVE-2023-22290.md): Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable denial of service via network access (CVSS 6.5, Intel Unison software)
- [CVE-2023-22292](https://cve.now/CVE-2023-22292.md): Uncaught exception for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via local ac (CVSS 7.3, Intel Unison software)
- [CVE-2023-22285](https://cve.now/CVE-2023-22285.md): Improper access control for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via network (CVSS 7.5, Intel Unison software)
- [CVE-2023-22337](https://cve.now/CVE-2023-22337.md): Improper input validation for some Intel Unison software may allow an unauthenticated user to potentially enable denial of service via netwo (CVSS 7.5, Intel Unison software)
- [CVE-2023-36860](https://cve.now/CVE-2023-36860.md): Improper input validation for some Intel Unison software may allow an authenticated user to potentially enable escalation of privilege via n (CVSS 7.6, Intel Unison software)
- [CVE-2022-41689](https://cve.now/CVE-2022-41689.md): Improper access control in some Intel In-Band Manageability software before version 3.0.14 may allow an authenticated user to potentially en (CVSS 7.3, Intel In-Band Manageability software)
- [CVE-2023-23583](https://cve.now/CVE-2023-23583.md): Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially (CVSS 8.8, Intel(R) Processors)
- [CVE-2023-28404](https://cve.now/CVE-2023-28404.md): Out-of-bounds read in the Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows drivers before version 31.0.101.4255 may allow an authenti (CVSS 3.8, Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows dri…)
- [CVE-2023-28401](https://cve.now/CVE-2023-28401.md): Out-of-bounds write in some Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows drivers before version 31.0.101.4255 may allow authentic (CVSS 5.2, Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows dri…)
- [CVE-2023-25071](https://cve.now/CVE-2023-25071.md): NULL pointer dereference in some Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows Drviers before version 31.0.101.4255 may allow auth (CVSS 5.6, Intel(R) Arc(TM) & Iris(R) Xe Graphics - WHQL - Windows Drv…)
- [CVE-2022-42879](https://cve.now/CVE-2022-42879.md): NULL pointer dereference in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to potentially (CVSS 6.1, Intel(R) Arc(TM) Control software)
- [CVE-2023-25952](https://cve.now/CVE-2023-25952.md): Out-of-bounds write in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to potentially enab (CVSS 6.1, Intel(R) Arc(TM) Control software)
- [CVE-2023-27305](https://cve.now/CVE-2023-27305.md): Incorrect default permissions in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to potent (CVSS 6.7, Intel(R) Arc(TM) Control software)
- [CVE-2023-29165](https://cve.now/CVE-2023-29165.md): Unquoted search path or element in some Intel(R) Arc(TM) Control software before version 1.73.5335.2 may allow an authenticated user to pote (CVSS 6.7, Intel(R) Arc(TM) Control software)
- [CVE-2023-34350](https://cve.now/CVE-2023-34350.md): Uncontrolled search path element in some Intel(R) XTU software before version 7.12.0.15 may allow an authenticated user to potentially enabl (CVSS 6.7, Intel(R) XTU software)
- [CVE-2023-34314](https://cve.now/CVE-2023-34314.md): Insecure inherited permissions in some Intel(R) Simics Simulator software before version 1.7.2 may allow an authenticated user to potentiall (CVSS 6.7, Intel(R) Simics Simulator software)
- [CVE-2023-32638](https://cve.now/CVE-2023-32638.md): Incorrect default permissions in some Intel Arc RGB Controller software before version 1.06 may allow an authenticated user to potentially e (CVSS 6.7, Intel Arc RGB Controller software)
- [CVE-2023-39230](https://cve.now/CVE-2023-39230.md): Insecure inherited permissions in some Intel Rapid Storage Technology software before version 16.8.5.1014.9 may allow an authenticated user (CVSS 6.7, Intel Rapid Storage Technology software)
- [CVE-2023-20596](https://cve.now/CVE-2023-20596.md): Improper input validation in the SMM Supervisor may allow an attacker with a compromised SMI handler to gain Ring0 access potentially leadin (no CVSS, AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Gr… +5)
- [CVE-2023-20571](https://cve.now/CVE-2023-20571.md): A race condition in System Management Mode (SMM) code may allow an attacker using a compromised user space to leverage CVE-2018-8897 potenti (no CVSS, AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Gr… +6)
- [CVE-2023-20565](https://cve.now/CVE-2023-20565.md): Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local (no CVSS, AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Gr… +6)
- [CVE-2023-20563](https://cve.now/CVE-2023-20563.md): Insufficient protections in System Management Mode (SMM) code may allow an attacker to potentially enable escalation of privilege via local (CVSS 7.8, AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Gr… +9)
- [CVE-2022-23821](https://cve.now/CVE-2022-23821.md): Improper access control in System Management Mode (SMM) may allow an attacker to write to SPI ROM potentially leading to arbitrary code exec (no CVSS, AMD Ryzen™ 3000 Series Desktop Processors “Matisse” · A… +19)
- [CVE-2021-46758](https://cve.now/CVE-2021-46758.md): Insufficient validation of SPI flash addresses in the ASP (AMD Secure Processor) bootloader may allow an attacker to read data in memory map (no CVSS, AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ Gr… +7)
- [CVE-2023-20592](https://cve.now/CVE-2023-20592.md): Improper or unexpected behavior of the INVD instruction in some AMD CPUs may allow an attacker with a malicious hypervisor to affect cache l (no CVSS, 1st Gen AMD EPYC™ Processors · 2nd Gen AMD EPYC™ Process… +1)
- [CVE-2023-20566](https://cve.now/CVE-2023-20566.md): Improper address validation in ASP with SNP enabled may potentially allow an attacker to compromise guest memory integrity. (CVSS 5.3, 3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Process… +1)
- [CVE-2023-20519](https://cve.now/CVE-2023-20519.md): A Use-After-Free vulnerability in the management of an SNP guest context page may allow a malicious hypervisor to masquerade as the guest's (no CVSS, 3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Processors)
- [CVE-2022-23830](https://cve.now/CVE-2022-23830.md): SMM configuration may not be immutable, as intended, when SNP is enabled resulting in a potential limited loss of guest memory integrity. (CVSS 1.9, 3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPY™ Processo… +1)
- [CVE-2021-26345](https://cve.now/CVE-2021-26345.md): Failure to validate the value in APCB may allow a privileged attacker to tamper with the APCB token to force an out-of-bounds memory read po (CVSS 1.9, 2nd Gen AMD EPYC™ Processors · 3rd Gen AMD EPYC™ Process… +2)
- [CVE-2023-47653](https://cve.now/CVE-2023-47653.md): WordPress TWB Woocommerce Reviews Plugin \<= 1.7.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Abu Bakar TWB Woocommerce Reviews)
- [CVE-2023-20533](https://cve.now/CVE-2023-20533.md): Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, po (CVSS 6.1, AMD Ryzen™ 3000 series Desktop Processors “Matisse" · AM… +8)
- [CVE-2023-20526](https://cve.now/CVE-2023-20526.md): Insufficient input validation in the ASP Bootloader may enable a privileged attacker with physical access to expose the contents of ASP memo (CVSS 1.9, AMD Ryzen™ Threadripper™ 2000 Series Processors “Colfax”… +3)
- [CVE-2023-20521](https://cve.now/CVE-2023-20521.md): TOCTOU in the ASP Bootloader may allow an attacker with physical access to tamper with SPI ROM records after memory content verification, po (CVSS 3.3, AMD Athlon™ 3000 Series Desktop Processors with Radeon™… +10)
- [CVE-2022-23820](https://cve.now/CVE-2022-23820.md): Failure to validate the AMD SMM communication buffer may allow an attacker to corrupt the SMRAM potentially leading to arbitrary code execut (CVSS 7.5, AMD Ryzen™ 3000 series Desktop Processors “Matisse" · A… +17)
- [CVE-2021-46774](https://cve.now/CVE-2021-46774.md): Insufficient DRAM address validation in System Management Unit (SMU) may allow an attacker to read/write from/to an invalid DRAM address, po (CVSS 6.7, AMD Ryzen™ 3000 series Desktop Processors “Matisse" · AM… +9)
- [CVE-2021-46766](https://cve.now/CVE-2021-46766.md): Improper clearing of sensitive data in the ASP Bootloader may expose secret keys to a privileged attacker accessing ASP SRAM, potentially le (CVSS 2.5, AMD Ryzen™ Threadripper™ PRO 3000WX Series Processors “… +1)
- [CVE-2023-31320](https://cve.now/CVE-2023-31320.md): Improper input validation in the AMD RadeonTM Graphics display driver may allow an attacker to corrupt the display potentially resulting in (no CVSS, AMD Radeon™ RX 5000/6000/7000 Series Graphics Cards · AM… +2)
- [CVE-2023-20568](https://cve.now/CVE-2023-20568.md): Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch Rade (no CVSS, AMD Radeon™ RX 5000/6000/7000 Series Graphics Cards · AM… +2)
- [CVE-2023-20567](https://cve.now/CVE-2023-20567.md): Improper signature verification of RadeonTM RX Vega M Graphics driver for Windows may allow an attacker with admin privileges to launch AMDS (no CVSS, AMD Radeon™ RX 5000/6000/7000 Series Graphics Cards · AM… +2)
- [CVE-2021-46748](https://cve.now/CVE-2021-46748.md): Insufficient bounds checking in the ASP (AMD Secure Processor) may allow an attacker to access memory outside the bounds of what is permissi (no CVSS, AMD Radeon™ RX 5000/6000/7000 Series Graphics Cards · AM… +2)
- [CVE-2023-47654](https://cve.now/CVE-2023-47654.md): WordPress BZScore – Live Score Plugin \<= 1.03 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, livescore.bz BZScore – Live Score)
- [CVE-2023-47656](https://cve.now/CVE-2023-47656.md): WordPress ANAC XML Bandi di Gara Plugin \<= 7.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Marco Milesi ANAC XML Bandi di Gara)
- [CVE-2023-47658](https://cve.now/CVE-2023-47658.md): WordPress Extra Product Options for WooCommerce Plugin \<= 3.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, actpro Extra Product Options for WooCommerce)
- [CVE-2023-32701](https://cve.now/CVE-2023-32701.md): Vulnerability in Networking Stack Impacts QNX Software Development Platform (SDP) (CVSS 7.1, BlackBerry QNX Software Development Platform)
- [CVE-2022-40681](https://cve.now/CVE-2022-40681.md): A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacke (CVSS 7.1, Fortinet FortiClientWindows)
- [CVE-2023-25603](https://cve.now/CVE-2023-25603.md): A permissive cross-domain policy with untrusted domains vulnerability in Fortinet FortiADC 7.1.0 - 7.1.1, FortiDDoS-F 6.3.0 - 6.3.4 and 6.4. (CVSS 5.4, Fortinet FortiDDoS-F · Fortinet FortiADC)
- [CVE-2023-40719](https://cve.now/CVE-2023-40719.md): A use of hard-coded credentials vulnerability in Fortinet FortiAnalyzer and FortiManager 7.0.0 - 7.0.8, 7.2.0 - 7.2.3 and 7.4.0 allows an at (CVSS 4.1, Fortinet FortiAnalyzer · Fortinet FortiManager)
- [CVE-2023-29177](https://cve.now/CVE-2023-29177.md): Multiple buffer copy without checking size of input ('classic buffer overflow') vulnerabilities \[CWE-120\] in FortiADC version 7.2.0 and befo (CVSS 6.2, Fortinet FortiDDoS-F · Fortinet FortiADC)
- [CVE-2023-36633](https://cve.now/CVE-2023-36633.md): An improper authorization vulnerability \[CWE-285\] in FortiMail webmail version 7.2.0 through 7.2.2 and before 7.0.5 allows an authenticated (CVSS 5.3, Fortinet FortiMail)
- [CVE-2023-34991](https://cve.now/CVE-2023-34991.md): A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and (CVSS 9.3, Fortinet FortiWLM)
- [CVE-2023-33304](https://cve.now/CVE-2023-33304.md): A use of hard-coded credentials vulnerability in Fortinet FortiClient Windows 7.0.0 - 7.0.9 and 7.2.0 - 7.2.1 allows an attacker to bypass s (CVSS 4.4, Fortinet FortiClientWindows)
- [CVE-2023-44248](https://cve.now/CVE-2023-44248.md): An improper access control vulnerability \[CWE-284\] in FortiEDRCollectorWindows version 5.2.0.4549 and below, 5.0.3.1007 and below, 4.0 all m (CVSS 4.0, Fortinet FortiEDR CollectorWindows)
- [CVE-2023-26205](https://cve.now/CVE-2023-26205.md): An improper access control vulnerability \[CWE-284\] in FortiADC automation feature 7.1.0 through 7.1.2, 7.0 all versions, 6.2 all versions, 6 (CVSS 7.9, Fortinet FortiADC)
- [CVE-2023-45585](https://cve.now/CVE-2023-45585.md): An insertion of sensitive information into log file vulnerability \[CWE-532\] in FortiSIEM version 7.0.0, version 6.7.6 and below, version 6. (CVSS 2.1, Fortinet FortiSIEM)
- [CVE-2023-41676](https://cve.now/CVE-2023-41676.md): An exposure of sensitive information to an unauthorized actor \[CWE-200\] in FortiSIEM version 7.0.0 and before 6.7.5 may allow an attacker w (CVSS 4.2, Fortinet FortiSIEM)
- [CVE-2023-45582](https://cve.now/CVE-2023-45582.md): An improper restriction of excessive authentication attempts vulnerability \[CWE-307\] in FortiMail webmail version 7.2.0 through 7.2.4, 7.0.0 (CVSS 5.3, Fortinet FortiMail)
- [CVE-2023-36553](https://cve.now/CVE-2023-36553.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiSIEM version 5.4.0 and 5.3.0 t (CVSS 9.3, Fortinet FortiSIEM)
- [CVE-2023-28002](https://cve.now/CVE-2023-28002.md): An improper validation of integrity check value vulnerability \[CWE-354\] in FortiOS 7.2.0 through 7.2.3, 7.0.0 through 7.0.12, 6.4 all versio (CVSS 5.8, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2023-36641](https://cve.now/CVE-2023-36641.md): A numeric truncation error vulnerability in Fortinet FortiOS 7.4.0, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, FortiOS 6.4 a (CVSS 6.2, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2023-41840](https://cve.now/CVE-2023-41840.md): A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a malicious (CVSS 7.4, Fortinet FortiClientWindows)
- [CVE-2023-42783](https://cve.now/CVE-2023-42783.md): A relative path traversal in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 and 8.4.2 through 8.4.0 and 8.3.2 through (CVSS 7.3, Fortinet FortiWLM)
- [CVE-2023-36018](https://cve.now/CVE-2023-36018.md): Visual Studio Code Jupyter Extension Spoofing Vulnerability (CVSS 7.8, Microsoft Jupyter Extension for Visual Studio Code)
- [CVE-2023-36016](https://cve.now/CVE-2023-36016.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 6.2, Microsoft Dynamics 365 (on-premises))
- [CVE-2023-36025](https://cve.now/CVE-2023-36025.md): Windows SmartScreen Security Feature Bypass Vulnerability (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2023-36021](https://cve.now/CVE-2023-36021.md): Microsoft On-Prem Data Gateway Security Feature Bypass Vulnerability (CVSS 8.0, Microsoft On-Prem Data Gateway)
- [CVE-2023-36033](https://cve.now/CVE-2023-36033.md): Windows DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2023-36031](https://cve.now/CVE-2023-36031.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2023-36030](https://cve.now/CVE-2023-36030.md): Microsoft Dynamics 365 Sales Spoofing Vulnerability (CVSS 6.1, Microsoft Dynamics 365 (on-premises))
- [CVE-2023-36028](https://cve.now/CVE-2023-36028.md): Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2023-36035](https://cve.now/CVE-2023-36035.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2023-36037](https://cve.now/CVE-2023-36037.md): Microsoft Excel Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2023-36045](https://cve.now/CVE-2023-36045.md): Microsoft Office Graphics Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2023-36042](https://cve.now/CVE-2023-36042.md): Visual Studio Denial of Service Vulnerability (CVSS 6.2, Microsoft Visual Studio · Microsoft .NET Framework 3.5 AND)
- [CVE-2023-36041](https://cve.now/CVE-2023-36041.md): Microsoft Excel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +1)
- [CVE-2023-36039](https://cve.now/CVE-2023-36039.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2023-36050](https://cve.now/CVE-2023-36050.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 8.0, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2023-36047](https://cve.now/CVE-2023-36047.md): Windows Authentication Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36046](https://cve.now/CVE-2023-36046.md): Windows Authentication Denial of Service Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2023-36392](https://cve.now/CVE-2023-36392.md): DHCP Server Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2023-36393](https://cve.now/CVE-2023-36393.md): Windows User Interface Application Core Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36394](https://cve.now/CVE-2023-36394.md): Windows Search Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-36395](https://cve.now/CVE-2023-36395.md): Windows Deployment Services Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2023-36396](https://cve.now/CVE-2023-36396.md): Windows Compressed Folder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36397](https://cve.now/CVE-2023-36397.md): Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows)
- [CVE-2023-36398](https://cve.now/CVE-2023-36398.md): Windows NTFS Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2023-36399](https://cve.now/CVE-2023-36399.md): Windows Storage Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows Server 2022, 23H2 Edition · Microsoft… +1)
- [CVE-2023-36400](https://cve.now/CVE-2023-36400.md): Windows HMAC Key Derivation Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-36401](https://cve.now/CVE-2023-36401.md): Microsoft Remote Registry Service Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows)
- [CVE-2023-36402](https://cve.now/CVE-2023-36402.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-36403](https://cve.now/CVE-2023-36403.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-36404](https://cve.now/CVE-2023-36404.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-36405](https://cve.now/CVE-2023-36405.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-36406](https://cve.now/CVE-2023-36406.md): Windows Hyper-V Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-36407](https://cve.now/CVE-2023-36407.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-36408](https://cve.now/CVE-2023-36408.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36439](https://cve.now/CVE-2023-36439.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2023-38177](https://cve.now/CVE-2023-38177.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 6.1, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2023-36017](https://cve.now/CVE-2023-36017.md): Windows Scripting Engine Memory Corruption Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-36036](https://cve.now/CVE-2023-36036.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2023-36043](https://cve.now/CVE-2023-36043.md): Open Management Infrastructure Information Disclosure Vulnerability (CVSS 6.5, Microsoft System Center Operations Manager (SCOM))
- [CVE-2023-36052](https://cve.now/CVE-2023-36052.md): Azure CLI REST Command Information Disclosure Vulnerability (CVSS 8.6, Microsoft Azure App Service · Microsoft Azure Function A… +1)
- [CVE-2023-36410](https://cve.now/CVE-2023-36410.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2023-36413](https://cve.now/CVE-2023-36413.md): Microsoft Office Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2023-36422](https://cve.now/CVE-2023-36422.md): Microsoft Windows Defender Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Defender Antimalware Platform)
- [CVE-2023-36423](https://cve.now/CVE-2023-36423.md): Microsoft Remote Registry Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-36424](https://cve.now/CVE-2023-36424.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2023-36425](https://cve.now/CVE-2023-36425.md): Windows Distributed File System (DFS) Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2023-36427](https://cve.now/CVE-2023-36427.md): Windows Hyper-V Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-36428](https://cve.now/CVE-2023-36428.md): Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-36560](https://cve.now/CVE-2023-36560.md): ASP.NET Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framework)
- [CVE-2023-36705](https://cve.now/CVE-2023-36705.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36719](https://cve.now/CVE-2023-36719.md): Microsoft Speech Application Programming Interface (SAPI) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-38151](https://cve.now/CVE-2023-38151.md): Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Host Integration Server)
- [CVE-2023-47659](https://cve.now/CVE-2023-47659.md): WordPress Lava Directory Manager Plugin \<= 1.1.34 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Lavacode Lava Directory Manager)
- [CVE-2023-47660](https://cve.now/CVE-2023-47660.md): WordPress Product Visibility by Country for WooCommerce Plugin \<= 1.4.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WP Wham Product Visibility by Country for WooCommerce)
- [CVE-2023-6131](https://cve.now/CVE-2023-6131.md): Code Injection in salesagility/suitecrm (CVSS 7.2, salesagility/suitecrm)
- [CVE-2023-6130](https://cve.now/CVE-2023-6130.md): Path Traversal: '\\..\\filename' in salesagility/suitecrm (CVSS 7.5, salesagility/suitecrm)
- [CVE-2023-6128](https://cve.now/CVE-2023-6128.md): Cross-site Scripting (XSS) - Reflected in salesagility/suitecrm (CVSS 6.8, salesagility/suitecrm)
- [CVE-2023-6127](https://cve.now/CVE-2023-6127.md): Unrestricted Upload of File with Dangerous Type in salesagility/suitecrm (CVSS 5.4, salesagility/suitecrm)
- [CVE-2023-6126](https://cve.now/CVE-2023-6126.md): Code Injection in salesagility/suitecrm (CVSS 4.3, salesagility/suitecrm)
- [CVE-2023-6125](https://cve.now/CVE-2023-6125.md): Code Injection in salesagility/suitecrm (CVSS 5.4, salesagility/suitecrm)
- [CVE-2023-6124](https://cve.now/CVE-2023-6124.md): Server-Side Request Forgery (SSRF) in salesagility/suitecrm (CVSS 5.0, salesagility/suitecrm)
- [CVE-2023-6111](https://cve.now/CVE-2023-6111.md): Use-after-free in Linux kernel's netfilter: nf\_tables component (CVSS 7.8, Linux Kernel)
- [CVE-2023-46601](https://cve.now/CVE-2023-46601.md): A vulnerability has been identified in COMOS (All versions). (CVSS 9.6, Siemens COMOS)
- [CVE-2023-46590](https://cve.now/CVE-2023-46590.md): A vulnerability has been identified in Siemens OPC UA Modelling Editor (SiOME) (All versions \< V2.8). (CVSS 7.5, Siemens OPC UA Modelling Editor)
- [CVE-2023-46099](https://cve.now/CVE-2023-46099.md): A vulnerability has been identified in SIMATIC PCS neo (All versions \< V4.1). (CVSS 5.4, Siemens SIMATIC PCS neo)
- [CVE-2023-46098](https://cve.now/CVE-2023-46098.md): A vulnerability has been identified in SIMATIC PCS neo (All versions \< V4.1). (CVSS 8.0, Siemens SIMATIC PCS neo)
- [CVE-2023-46097](https://cve.now/CVE-2023-46097.md): A vulnerability has been identified in SIMATIC PCS neo (All versions \< V4.1). (CVSS 6.3, Siemens SIMATIC PCS neo)
- [CVE-2023-46096](https://cve.now/CVE-2023-46096.md): A vulnerability has been identified in SIMATIC PCS neo (All versions \< V4.1). (CVSS 6.5, Siemens SIMATIC PCS neo)
- [CVE-2023-45794](https://cve.now/CVE-2023-45794.md): A vulnerability has been identified in Mendix Applications using Mendix 10 (All versions \< V10.4.0), Mendix Applications using Mendix 7 (All (CVSS 6.8, Siemens Mendix Applications using Mendix)
- [CVE-2023-44374](https://cve.now/CVE-2023-44374.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 6.5, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +18)
- [CVE-2023-44373](https://cve.now/CVE-2023-44373.md): Affected devices do not properly sanitize an input field. (CVSS 9.1, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +36)
- [CVE-2023-44322](https://cve.now/CVE-2023-44322.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 3.7, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +18)
- [CVE-2023-44321](https://cve.now/CVE-2023-44321.md): Affected devices do not properly validate the length of inputs when performing certain configuration changes in the web interface allowing a (CVSS 2.7, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +50)
- [CVE-2023-44320](https://cve.now/CVE-2023-44320.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V7.2.2), RUGGEDCOM RM1224 LTE(4G) NA (CVSS 4.3, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +18)
- [CVE-2023-44319](https://cve.now/CVE-2023-44319.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 4.9, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +18)
- [CVE-2023-44318](https://cve.now/CVE-2023-44318.md): Affected devices use a hardcoded key to obfuscate the configuration backup that an administrator can export from the device. (CVSS 4.9, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +50)
- [CVE-2023-44317](https://cve.now/CVE-2023-44317.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V7.2.2), RUGGEDCOM RM1224 LTE(4G) NA (CVSS 7.2, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +18)
- [CVE-2023-43505](https://cve.now/CVE-2023-43505.md): A vulnerability has been identified in COMOS (All versions). (CVSS 9.6, Siemens COMOS)
- [CVE-2023-43504](https://cve.now/CVE-2023-43504.md): A vulnerability has been identified in COMOS (All versions \< V10.4.4). (CVSS 9.6, Siemens COMOS)
- [CVE-2023-43503](https://cve.now/CVE-2023-43503.md): A vulnerability has been identified in COMOS (All versions \< V10.4.4). (CVSS 3.5, Siemens COMOS)
- [CVE-2023-24585](https://cve.now/CVE-2023-24585.md): An out-of-bounds write vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 7.7, Silicon Labs Gecko Platform · Weston Embedded Cesium NET +1)
- [CVE-2023-25181](https://cve.now/CVE-2023-25181.md): A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 9.0, Silicon Labs Gecko Platform · Weston Embedded Cesium NET +1)
- [CVE-2023-28391](https://cve.now/CVE-2023-28391.md): A memory corruption vulnerability exists in the HTTP Server header parsing functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 9.0, Silicon Labs Gecko Platform · Weston Embedded Cesium NET +1)
- [CVE-2023-27882](https://cve.now/CVE-2023-27882.md): A heap-based buffer overflow vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 9.0, Silicon Labs Gecko Platform · Weston Embedded Cesium NET +1)
- [CVE-2023-28379](https://cve.now/CVE-2023-28379.md): A memory corruption vulnerability exists in the HTTP Server form boundary functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 9.0, Silicon Labs Gecko Platform · Weston Embedded Cesium NET +1)
- [CVE-2023-31247](https://cve.now/CVE-2023-31247.md): A memory corruption vulnerability exists in the HTTP Server Host header parsing functionality of Weston Embedded uC-HTTP v3.01.01. (CVSS 9.0, Silicon Labs Gecko Platform · Weston Embedded Cesium NET +1)
- [CVE-2023-6109](https://cve.now/CVE-2023-6109.md): YOP Poll \<= 6.5.26 - Race Condition to Vote Manipulation (CVSS 5.3, yourownprogrammer YOP Poll)
- [CVE-2023-47609](https://cve.now/CVE-2023-47609.md): SQL injection vulnerability in OSS Calendar versions prior to v.2.0.3 allows a remote authenticated attacker to execute arbitrary code or ob (no CVSS, Thinkingreed OSS Calendar)
- [CVE-2023-6006](https://cve.now/CVE-2023-6006.md): Privilege Escalation Vulnerability (CVSS 7.8, PaperCut NG, PaperCut MF)
- [CVE-2023-42480](https://cve.now/CVE-2023-42480.md): Information Disclosure in NetWeaver AS Java Logon (CVSS 5.3, SAP\_SE NetWeaver AS Java)
- [CVE-2023-41366](https://cve.now/CVE-2023-41366.md): Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform (CVSS 5.3, SAP\_SE SAP NetWeaver Application Server ABAP and ABAP Platf…)
- [CVE-2023-31403](https://cve.now/CVE-2023-31403.md): Improper Access Control vulnerability in SAP Business One product installation (CVSS 9.6, SAP\_SE SAP Business One)
- [CVE-2023-47628](https://cve.now/CVE-2023-47628.md): Session Expiration Misconfiguration in datahub (CVSS 4.2, datahub-project datahub)
- [CVE-2023-47629](https://cve.now/CVE-2023-47629.md): Privilege escalation through email sign-up in datahub (CVSS 7.1, datahub-project datahub)
- [CVE-2022-45781](https://cve.now/CVE-2022-45781.md): Buffer Overflow vulnerability in Tenda AX1803 v1.0.0.1\_2994 and earlier allows attackers to run arbitrary code via /goform/SetOnlineDevName. (CVSS 8.8)
- [CVE-2023-31754](https://cve.now/CVE-2023-31754.md): Optimizely CMS UI before v12.16.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Admin panel. (no CVSS)
- [CVE-2023-41570](https://cve.now/CVE-2023-41570.md): MikroTik RouterOS v7.1 to 7.11 was discovered to contain incorrect access control mechanisms in place for the Rest API. (no CVSS)
- [CVE-2023-42325](https://cve.now/CVE-2023-42325.md): Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the sta (no CVSS)
- [CVE-2023-42326](https://cve.now/CVE-2023-42326.md): An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces\_gif\_edit.php (no CVSS)
- [CVE-2023-42327](https://cve.now/CVE-2023-42327.md): Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the get (no CVSS)
- [CVE-2023-43900](https://cve.now/CVE-2023-43900.md): Insecure Direct Object References (IDOR) in eMudhra emSigner v2.8.7 allow authenticated attackers to gain unauthorized access to application (CVSS 6.5)
- [CVE-2023-43901](https://cve.now/CVE-2023-43901.md): Incorrect access control in the AdHoc User creation form of eMudhra emSigner v2.8.7 allows unauthenticated attackers to arbitrarily modify u (CVSS 5.4)
- [CVE-2023-43902](https://cve.now/CVE-2023-43902.md): Incorrect access control in the Forgot Your Password function of eMudhra emSigner v2.8.7 allows unauthenticated attackers to access accounts (CVSS 8.8)
- [CVE-2023-45558](https://cve.now/CVE-2023-45558.md): An issue in Golden v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. (CVSS 7.5)
- [CVE-2023-45560](https://cve.now/CVE-2023-45560.md): An issue in Yasukawa memberscard v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. (no CVSS)
- [CVE-2023-45684](https://cve.now/CVE-2023-45684.md): Northern.tech CFEngine Enterprise before 3.21.3 allows SQL Injection. (no CVSS)
- [CVE-2023-45878](https://cve.now/CVE-2023-45878.md): GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics\_visualise\_saveAjax.phps does not require authenticati (no CVSS)
- [CVE-2023-45879](https://cve.now/CVE-2023-45879.md): GibbonEdu Gibbon version 25.0.0 allows HTML Injection via an IFRAME element to the Messager component. (no CVSS)
- [CVE-2023-45880](https://cve.now/CVE-2023-45880.md): GibbonEdu Gibbon through version 25.0.0 allows Directory Traversal via the report template builder. (no CVSS)
- [CVE-2023-45881](https://cve.now/CVE-2023-45881.md): GibbonEdu Gibbon through version 25.0.0 allows /modules/Planner/resources\_addQuick\_ajaxProcess.php file upload with resultant XSS. (no CVSS)
- [CVE-2023-46022](https://cve.now/CVE-2023-46022.md): SQL Injection vulnerability in delete.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via the 'bid' param (no CVSS)
- [CVE-2023-46023](https://cve.now/CVE-2023-46023.md): SQL injection vulnerability in addTask.php in Code-Projects Simple Task List 1.0 allows attackers to obtain sensitive information via the 's (no CVSS)
- [CVE-2023-46024](https://cve.now/CVE-2023-46024.md): SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary SQ (no CVSS)
- [CVE-2023-46025](https://cve.now/CVE-2023-46025.md): SQL Injection vulnerability in teacher-info.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to obtain se (no CVSS)
- [CVE-2023-46026](https://cve.now/CVE-2023-46026.md): Cross Site Scripting (XSS) vulnerability in profile.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to r (no CVSS)
- [CVE-2023-46445](https://cve.now/CVE-2023-46445.md): An issue in AsyncSSH before 2.14.1 allows attackers to control the extension info message (RFC 8308) via a man-in-the-middle attack, aka a " (CVSS 5.9, asyncssh)
- [CVE-2023-46446](https://cve.now/CVE-2023-46446.md): An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shel (CVSS 6.8, asyncssh)
- [CVE-2023-46580](https://cve.now/CVE-2023-46580.md): Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of (no CVSS)
- [CVE-2023-46581](https://cve.now/CVE-2023-46581.md): SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary code via the name, uname and email pa (no CVSS)
- [CVE-2023-46582](https://cve.now/CVE-2023-46582.md): SQL injection vulnerability in Inventory Management v.1.0 allows a local attacker to execute arbitrary SQL commands via the id paramter in t (no CVSS)
- [CVE-2023-47262](https://cve.now/CVE-2023-47262.md): The startup process and device configurations of the Abbott ID NOW device, before v7.1, can be interrupted and/or modified via physical acce (no CVSS)
- [CVE-2023-47384](https://cve.now/CVE-2023-47384.md): MP4Box GPAC v2.3-DEV-rev617-g671976fcc-master was discovered to contain a memory leak in the function gf\_isom\_add\_chapter at /isomedia/isom\_ (CVSS 5.5)
- [CVE-2023-48020](https://cve.now/CVE-2023-48020.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/changeStatus. (no CVSS)
- [CVE-2023-48021](https://cve.now/CVE-2023-48021.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/task/update. (no CVSS)
- [CVE-2023-48094](https://cve.now/CVE-2023-48094.md): A cross-site scripting (XSS) vulnerability in CesiumJS v1.111 allows attackers to execute arbitrary code in the context of the victim's brow (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.