CVEs published November 15, 2023
61 CVEs were published on November 15, 2023: 1 critical, 14 high. 1 is now in CISA KEV.
- Published
- 61
- Critical
- 1
- High
- 14
- Medium
- 17
- Low
- 2
- Unrated
- 27
- Now in CISA KEV
- 1
- Fix available
- 15
Most affected products
- wpvibes Addon Elements for Elementor
- 4
- com.xuxueli:xxl-job-admin
- 3
- FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS
- 3
- FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server
- 3
- AVEVA SystemPlatform · AVEVA Historian +12
- 2
- Google Chrome
- 2
- Schneider Electric EcoStruxure Power Monitoring Expert ·… +1
- 2
- Schneider Electric ION8650 · Schneider Electric ION8800
- 2
- ASUSTeK COMPUTER RT-AC87U
- 1
- Checkmk
- 1
Critical 1
High 14
- CVE-2023-48224Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fidesethyca fides · ethyca-fides
- CVE-2023-22818Multiple DLL Search Order hijacking Vulnerabilities in SanDisk Security Installer for Windows SanDisk Security Installer for Windows
- CVE-2023-47637SQL Injection in Admin Grid Filter API in Pimcorepimcore · pimcore/pimcore
- CVE-2023-33873AVEVA Operations Control Logger Execution with Unnecessary Privileges AVEVA SystemPlatform · AVEVA Historian +12
- CVE-2023-5720Quarkus: build env information disclosure via gradle plugingradle-plugin · io.quarkus:quarkus-project
- CVE-2023-5245Using MLeap for loading a saved model (zip archive) can lead to path traversal/arbitrary file creation and possibly remote code execution.ml.combust.mleap.mleap-tensorflow · ml.combust.mleap:mleap-…
- CVE-2023-34062In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using aReactor Netty · io.projectreactor.netty:reactor-netty-http
- CVE-2023-46672Logstash Insertion of Sensitive Information into Log FileElastic Logstash
- CVE-2023-47581Out-of-bounds read vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS
- CVE-2023-47580Multiple improper restriction of operations within the bounds of a memory buffer issues exist in TELLUS V4.0.17.0 and earlier and TELLUS LitFUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS
- CVE-2023-5986 A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scrSchneider Electric EcoStruxure Power Monitoring Expert ·… +1
- CVE-2023-5984 A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorizeSchneider Electric ION8650 · Schneider Electric ION8800
- CVE-2023-48011GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush_ref_samples function at /gpac/src/isome
- CVE-2023-48089xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save.com.xuxueli:xxl-job-admin
Medium, low and unrated 46
- CVE-2023-4690Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgerywpvibes Addon Elements for Elementor
- CVE-2023-5381Elementor Addon Elements <= 1.12.7 - Authenticated (Administrator+) Stored Cross-Site Scriptingwpvibes Addon Elements for Elementor
- CVE-2023-4723Elementor Addon Elements <= 1.12.7 - Missing Authorization to Sensitive Information Exposurewpvibes Addon Elements for Elementor
- CVE-2023-4689Elementor Addon Elements <= 1.12.7 - Cross-Site Request Forgerywpvibes Addon Elements for Elementor
- CVE-2023-6105ManageEngine Information Disclosure in Multiple ProductsManageEngine Service Desk Plus · ManageEngine Asset Expl… +1
- CVE-2023-41699Payara Platform: URL Redirection to untrusted site using FORM authenticationPayara Platform Payara Server, Micro and Embedded
- CVE-2023-30954Gotham Video Broken Authenticationcom.palantir.video:video-application-server
- CVE-2023-47636Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundlepimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…
- CVE-2023-48219Special characters in unescaped text nodes can trigger mXSS in TinyMCEtinymce · tinymce/tinymce
- CVE-2023-6112Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2023-5997Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruptiGoogle Chrome
- CVE-2023-34982AVEVA Operations Control Logger External Control of File Name or Path AVEVA SystemPlatform · AVEVA Historian +12
- CVE-2023-5676Eclipse OpenJ9 possible infinite busy hangEclipse Foundation OpenJ9
- CVE-2023-4602Namaste! LMS <= 2.6.1.1 - Reflected Cross-Site Scriptingprasunsen Namaste! LMS
- CVE-2023-23549DoS via long hostnamesCheckmk
- CVE-2023-4889Shareaholic <= 9.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeProfessional Social Sharing Buttons, Icons & Related Posts…
- CVE-2023-6133Forminator <= 1.27.0 - Authenticated (Administrator+) Arbitrary File Uploadwpmudev Forminator Forms – Contact Form, Payment Form & Cus…
- CVE-2023-47586Multiple heap-based buffer overflow vulnerabilities exist in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server
- CVE-2023-47585Out-of-bounds read vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server
- CVE-2023-47584Out-of-bounds write vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server
- CVE-2023-47583Multiple out-of-bounds read vulnerabilities exist in TELLUS Simulator V4.0.17.0 and earlier.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS Si…
- CVE-2023-47582Access of uninitialized pointer vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier.FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS
- CVE-2023-6032 A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file systeSchneider Electric Galaxy VS · Schneider Electric Galaxy VL
- CVE-2023-5987 A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability Schneider Electric EcoStruxure Power Monitoring Expert ·… +1
- CVE-2023-5985 A CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability exists that could cause compromise of a user’s browserSchneider Electric ION8650 · Schneider Electric ION8800
- CVE-2023-47678An improper access control vulnerability exists in RT-AC87U all versions.ASUSTeK COMPUTER RT-AC87U
- CVE-2023-40923MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and save_s
- CVE-2023-41442An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via
- CVE-2023-41597EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.
- CVE-2023-43979ETS Soft ybc_blog before v4.4.0 was discovered to contain a SQL injection vulnerability via the component Ybc_blogBlogModuleFrontController:
- CVE-2023-47308In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a gues
- CVE-2023-47309Nukium nkmgls before version 3.0.2 is vulnerable to Cross Site Scripting (XSS) via NkmGlsCheckoutModuleFrontController::displayAjaxSavePhone
- CVE-2023-47345Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message with malformed PFCP Hegithub.com/free5gc/free5gc
- CVE-2023-47347Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP messages whose Sequence Number
- CVE-2023-47444An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbit
- CVE-2023-47445Pre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in preschool/admin/ page.
- CVE-2023-47446Pre-School Enrollment version 1.0 is vulnerable to Cross Site Scripting (XSS) on the profile.php page via fullname parameter.
- CVE-2023-48013GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf_filterpacket_del function at /gpac/src/filter_core
- CVE-2023-48014GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc_parse_vps_extension function at /media_tools/
- CVE-2023-48087xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat.com.xuxueli:xxl-job-admin
- CVE-2023-48088xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage.com.xuxueli:xxl-job-admin
- CVE-2023-48197Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's coo
- CVE-2023-48198A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version <= 4.0.3 all
- CVE-2023-48199HTML Injection vulnerability in the 'manageApiKeys' component in Grocy <= 4.0.3 allows attackers to inject arbitrary HTML content without sc
- CVE-2023-48200Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via t
- CVE-2023-48204An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of t