# CVEs published 2023-11-15

61 CVEs were published on November 15, 2023: 1 critical, 14 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-4690](https://cve.now/CVE-2023-4690.md): Elementor Addon Elements \<= 1.12.7 - Cross-Site Request Forgery (CVSS 5.4, wpvibes Addon Elements for Elementor)
- [CVE-2023-5381](https://cve.now/CVE-2023-5381.md): Elementor Addon Elements \<= 1.12.7 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, wpvibes Addon Elements for Elementor)
- [CVE-2023-4723](https://cve.now/CVE-2023-4723.md): Elementor Addon Elements \<= 1.12.7 - Missing Authorization to Sensitive Information Exposure (CVSS 5.3, wpvibes Addon Elements for Elementor)
- [CVE-2023-4689](https://cve.now/CVE-2023-4689.md): Elementor Addon Elements \<= 1.12.7 - Cross-Site Request Forgery (CVSS 5.4, wpvibes Addon Elements for Elementor)
- [CVE-2023-6105](https://cve.now/CVE-2023-6105.md): ManageEngine Information Disclosure in Multiple Products (CVSS 5.5, ManageEngine Service Desk Plus · ManageEngine Asset Expl… +1)
- [CVE-2023-48224](https://cve.now/CVE-2023-48224.md): Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides (CVSS 8.2, ethyca fides · ethyca-fides)
- [CVE-2023-22818](https://cve.now/CVE-2023-22818.md): Multiple DLL Search Order hijacking Vulnerabilities in SanDisk Security Installer for Windows (CVSS 7.3, SanDisk Security Installer for Windows)
- [CVE-2023-41699](https://cve.now/CVE-2023-41699.md): Payara Platform: URL Redirection to untrusted site using FORM authentication (CVSS 6.1, Payara Platform Payara Server, Micro and Embedded)
- [CVE-2023-30954](https://cve.now/CVE-2023-30954.md): Gotham Video Broken Authentication (CVSS 2.7, com.palantir.video:video-application-server)
- [CVE-2023-47636](https://cve.now/CVE-2023-47636.md): Full Path Disclosure via re-export document in pimcore/admin-ui-classic-bundle (CVSS 5.3, pimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…)
- [CVE-2023-47637](https://cve.now/CVE-2023-47637.md): SQL Injection in Admin Grid Filter API in Pimcore (CVSS 8.8, pimcore · pimcore/pimcore)
- [CVE-2023-48219](https://cve.now/CVE-2023-48219.md): Special characters in unescaped text nodes can trigger mXSS in TinyMCE (CVSS 6.1, tinymce · tinymce/tinymce)
- [CVE-2023-6112](https://cve.now/CVE-2023-6112.md): Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a (no CVSS, Google Chrome)
- [CVE-2023-5997](https://cve.now/CVE-2023-5997.md): Use after free in Garbage Collection in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corrupti (no CVSS, Google Chrome)
- [CVE-2023-34982](https://cve.now/CVE-2023-34982.md): AVEVA Operations Control Logger External Control of File Name or Path (CVSS 5.5, AVEVA SystemPlatform · AVEVA Historian +12)
- [CVE-2023-33873](https://cve.now/CVE-2023-33873.md): AVEVA Operations Control Logger Execution with Unnecessary Privileges (CVSS 7.8, AVEVA SystemPlatform · AVEVA Historian +12)
- [CVE-2023-5676](https://cve.now/CVE-2023-5676.md): Eclipse OpenJ9 possible infinite busy hang (CVSS 4.1, Eclipse Foundation OpenJ9)
- [CVE-2023-5720](https://cve.now/CVE-2023-5720.md): Quarkus: build env information disclosure via gradle plugin (CVSS 7.7, gradle-plugin · io.quarkus:quarkus-project)
- [CVE-2023-5245](https://cve.now/CVE-2023-5245.md): Using MLeap for loading a saved model (zip archive) can lead to path traversal/arbitrary file creation and possibly remote code execution. (CVSS 7.5, ml.combust.mleap.mleap-tensorflow · ml.combust.mleap:mleap-…)
- [CVE-2023-4602](https://cve.now/CVE-2023-4602.md): Namaste! LMS \<= 2.6.1.1 - Reflected Cross-Site Scripting (CVSS 6.1, prasunsen Namaste! LMS)
- [CVE-2023-23549](https://cve.now/CVE-2023-23549.md): DoS via long hostnames (CVSS 2.7, Checkmk)
- [CVE-2023-34062](https://cve.now/CVE-2023-34062.md): In Reactor Netty HTTP Server, versions 1.1.x prior to 1.1.13 and versions 1.0.x prior to 1.0.39, a malicious user can send a request using a (CVSS 7.5, Reactor Netty · io.projectreactor.netty:reactor-netty-http)
- [CVE-2023-46672](https://cve.now/CVE-2023-46672.md): Logstash Insertion of Sensitive Information into Log File (CVSS 8.4, Elastic Logstash)
- [CVE-2023-4889](https://cve.now/CVE-2023-4889.md): Shareaholic \<= 9.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, Professional Social Sharing Buttons, Icons & Related Posts…)
- [CVE-2023-6133](https://cve.now/CVE-2023-6133.md): Forminator \<= 1.27.0 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 6.6, wpmudev Forminator Forms – Contact Form, Payment Form & Cus…)
- [CVE-2023-47586](https://cve.now/CVE-2023-47586.md): Multiple heap-based buffer overflow vulnerabilities exist in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. (no CVSS, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server)
- [CVE-2023-47585](https://cve.now/CVE-2023-47585.md): Out-of-bounds read vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. (no CVSS, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server)
- [CVE-2023-47584](https://cve.now/CVE-2023-47584.md): Out-of-bounds write vulnerability exists in V-Server V4.0.18.0 and earlier and V-Server Lite V4.0.18.0 and earlier. (no CVSS, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server)
- [CVE-2023-47583](https://cve.now/CVE-2023-47583.md): Multiple out-of-bounds read vulnerabilities exist in TELLUS Simulator V4.0.17.0 and earlier. (no CVSS, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS Si…)
- [CVE-2023-47582](https://cve.now/CVE-2023-47582.md): Access of uninitialized pointer vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. (no CVSS, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS)
- [CVE-2023-47581](https://cve.now/CVE-2023-47581.md): Out-of-bounds read vulnerability exists in TELLUS V4.0.17.0 and earlier and TELLUS Lite V4.0.17.0 and earlier. (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS)
- [CVE-2023-47580](https://cve.now/CVE-2023-47580.md): Multiple improper restriction of operations within the bounds of a memory buffer issues exist in TELLUS V4.0.17.0 and earlier and TELLUS Lit (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. TELLUS)
- [CVE-2023-6032](https://cve.now/CVE-2023-6032.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause a file syste (CVSS 5.3, Schneider Electric Galaxy VS · Schneider Electric Galaxy VL)
- [CVE-2023-5987](https://cve.now/CVE-2023-5987.md): A CWE-79 Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) vulnerability that could cause a vulnerability (CVSS 6.1, Schneider Electric EcoStruxure Power Monitoring Expert ·… +1)
- [CVE-2023-5986](https://cve.now/CVE-2023-5986.md): A CWE-601 URL Redirection to Untrusted Site vulnerability exists that could cause an openredirect vulnerability leading to a cross site scr (CVSS 8.2, Schneider Electric EcoStruxure Power Monitoring Expert ·… +1)
- [CVE-2023-5985](https://cve.now/CVE-2023-5985.md): A CWE-79 Improper Neutralization of Input During Web Page Generation vulnerability exists that could cause compromise of a user’s browser (CVSS 4.8, Schneider Electric ION8650 · Schneider Electric ION8800)
- [CVE-2023-5984](https://cve.now/CVE-2023-5984.md): A CWE-494 Download of Code Without Integrity Check vulnerability exists that could allow modified firmware to be uploaded when an authorize (CVSS 7.2, Schneider Electric ION8650 · Schneider Electric ION8800)
- [CVE-2023-47678](https://cve.now/CVE-2023-47678.md): An improper access control vulnerability exists in RT-AC87U all versions. (no CVSS, ASUSTeK COMPUTER RT-AC87U)
- [CVE-2023-40923](https://cve.now/CVE-2023-40923.md): MyPrestaModules ordersexport before v5.0 was discovered to contain multiple SQL injection vulnerabilities at send.php via the key and save\_s (no CVSS)
- [CVE-2023-41442](https://cve.now/CVE-2023-41442.md): An issue in Kloudq Technologies Limited Tor Equip 1.0, Tor Loco Mini 1.0 through 3.1 allows a remote attacker to execute arbitrary code via (no CVSS)
- [CVE-2023-41597](https://cve.now/CVE-2023-41597.md): EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active\_t. (no CVSS)
- [CVE-2023-43979](https://cve.now/CVE-2023-43979.md): ETS Soft ybc\_blog before v4.4.0 was discovered to contain a SQL injection vulnerability via the component Ybc\_blogBlogModuleFrontController: (no CVSS)
- [CVE-2023-47308](https://cve.now/CVE-2023-47308.md): In the module "Newsletter Popup PRO with Voucher/Coupon code" (newsletterpop) before version 2.6.1 from Active Design for PrestaShop, a gues (no CVSS)
- [CVE-2023-47309](https://cve.now/CVE-2023-47309.md): Nukium nkmgls before version 3.0.2 is vulnerable to Cross Site Scripting (XSS) via NkmGlsCheckoutModuleFrontController::displayAjaxSavePhone (no CVSS)
- [CVE-2023-47345](https://cve.now/CVE-2023-47345.md): Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP message with malformed PFCP He (no CVSS, github.com/free5gc/free5gc)
- [CVE-2023-47347](https://cve.now/CVE-2023-47347.md): Buffer Overflow vulnerability in free5gc 3.3.0 allows attackers to cause a denial of service via crafted PFCP messages whose Sequence Number (no CVSS)
- [CVE-2023-47444](https://cve.now/CVE-2023-47444.md): An issue discovered in OpenCart 4.0.0.0 to 4.0.2.3 allows authenticated backend users having common/security write privilege can write arbit (no CVSS)
- [CVE-2023-47445](https://cve.now/CVE-2023-47445.md): Pre-School Enrollment version 1.0 is vulnerable to SQL Injection via the username parameter in preschool/admin/ page. (no CVSS)
- [CVE-2023-47446](https://cve.now/CVE-2023-47446.md): Pre-School Enrollment version 1.0 is vulnerable to Cross Site Scripting (XSS) on the profile.php page via fullname parameter. (no CVSS)
- [CVE-2023-48011](https://cve.now/CVE-2023-48011.md): GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a heap-use-after-free via the flush\_ref\_samples function at /gpac/src/isome (CVSS 7.8)
- [CVE-2023-48013](https://cve.now/CVE-2023-48013.md): GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a double free via the gf\_filterpacket\_del function at /gpac/src/filter\_core (no CVSS)
- [CVE-2023-48014](https://cve.now/CVE-2023-48014.md): GPAC v2.3-DEV-rev566-g50c2ab06f-master was discovered to contain a stack overflow via the hevc\_parse\_vps\_extension function at /media\_tools/ (no CVSS)
- [CVE-2023-48087](https://cve.now/CVE-2023-48087.md): xxl-job-admin 2.4.0 is vulnerable to Insecure Permissions via /xxl-job-admin/joblog/clearLog and /xxl-job-admin/joblog/logDetailCat. (no CVSS, com.xuxueli:xxl-job-admin)
- [CVE-2023-48088](https://cve.now/CVE-2023-48088.md): xxl-job-admin 2.4.0 is vulnerable to Cross Site Scripting (XSS) via /xxl-job-admin/joblog/logDetailPage. (no CVSS, com.xuxueli:xxl-job-admin)
- [CVE-2023-48089](https://cve.now/CVE-2023-48089.md): xxl-job-admin 2.4.0 is vulnerable to Remote Code Execution (RCE) via /xxl-job-admin/jobcode/save. (CVSS 8.8, com.xuxueli:xxl-job-admin)
- [CVE-2023-48197](https://cve.now/CVE-2023-48197.md): Cross-Site Scripting (XSS) vulnerability in the ‘manageApiKeys’ component of Grocy 4.0.3 and earlier allows attackers to obtain victim's coo (CVSS 5.4)
- [CVE-2023-48198](https://cve.now/CVE-2023-48198.md): A Cross-Site Scripting (XSS) vulnerability in the 'product description' component within '/api/stock/products' of Grocy version \<= 4.0.3 all (no CVSS)
- [CVE-2023-48199](https://cve.now/CVE-2023-48199.md): HTML Injection vulnerability in the 'manageApiKeys' component in Grocy \<= 4.0.3 allows attackers to inject arbitrary HTML content without sc (no CVSS)
- [CVE-2023-48200](https://cve.now/CVE-2023-48200.md): Cross Site Scripting vulnerability in Grocy v.4.0.3 allows a local attacker to execute arbitrary code and obtain sensitive information via t (no CVSS)
- [CVE-2023-48204](https://cve.now/CVE-2023-48204.md): An issue in PublicCMS v.4.0.202302.e allows a remote attacker to obtain sensitive information via the appToken and Parameters parameter of t (no CVSS)
- [CVE-2023-48365](https://cve.now/CVE-2023-48365.md): Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683. (CVSS 9.6, KEV)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.