CVEs published November 16, 2023
130 CVEs were published on November 16, 2023: 11 critical, 42 high.
- Published
- 130
- Critical
- 11
- High
- 42
- Medium
- 57
- Low
- 8
- Unrated
- 12
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- Adobe Acrobat Reader
- 17
- Adobe Audition
- 9
- Adobe InDesign Desktop
- 7
- vim
- 7
- Adobe Photoshop Desktop
- 6
- Adobe Premiere Pro
- 6
- Adobe Media Encoder
- 5
- Adobe Bridge
- 3
- h2oai/h2o-3
- 3
- mlflow/mlflow · mlflow
- 3
Critical 11
- CVE-2023-6014MLflow Authentication Bypassmlflow/mlflow · mlflow
- CVE-2023-6019Ray Command Injection in cpu_profile Parameterray-project/ray · ray
- CVE-2023-6013H2O Local File Includeh2oai/h2o-3
- CVE-2023-6038Local File Inclusion in h2oai/h2o-3h2oai/h2o-3 · ai.h2o:h2o-core
- CVE-2023-6016H2O Remote Code Execution via POJO Model Importh2oai/h2o-3
- CVE-2023-6015MLflow Arbitrary File Uploadmlflow/mlflow · mlflow
- CVE-2023-6018MLflow Arbitrary File Writemlflow/mlflow · mlflow
- CVE-2023-47213First Corporation's DVRs use a hard-coded password, which may allow a remote unauthenticated attacker to rewrite or obtain the configurationFirst Co. CFR-904E, CFR-908E, CFR-916E · First Co. CFR-4… +9
- CVE-2023-47674Missing authentication for critical function vulnerability in First Corporation's DVRs allows a remote unauthenticated attacker to rewrite oFirst Co. CFR-904E, CFR-908E, CFR-916E · First Co. CFR-4… +9
- CVE-2023-47003An issue in RedisGraph v.2.12.10 allows an attacker to execute arbitrary code and cause a denial of service via a crafted string in DataBloc
- CVE-2023-48078SQL Injection vulnerability in add.php in Simple CRUD Functionality v1.0 allows attackers to run arbitrary SQL commands via the 'title' para
High 42
- CVE-2023-48222Authenticated users can view or delete jobs they do not have authorization for in Rundeckrundeck · org.rundeck:rundeck
- CVE-2023-6020Ray Static File Local File Includeray-project/ray · ray
- CVE-2023-46214Remote code execution (RCE) in Splunk Enterprise through Insecure XML ParsingSplunk Enterprise · Splunk Cloud
- CVE-2023-32796WordPress WooCommerce Product Enquiry Plugin <= 2.3.4 is vulnerable to Cross Site Scripting (XSS)MingoCommerce WooCommerce Product Enquiry
- CVE-2023-34375WordPress Seo By 10Web Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)SEO by 10Web
- CVE-2023-39926WordPress Under Construction / Maintenance Mode from Acurax Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)Under Construction / Maintenance Mode from Acurax
- CVE-2023-28621WordPress Raise Mag Theme <= 1.0.7 and Wishful Blog theme <= 2.0.1 are vulnerable to Cross Site Scripting (XSS)Wishfulthemes Raise Mag · Wishfulthemes Wishful Blog
- CVE-2023-47508WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to Cross Site Scripting (XSS)Averta Master Slider Pro
- CVE-2023-47509WordPress Edit WooCommerce Templates Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)ioannup Edit WooCommerce Templates
- CVE-2023-47512WordPress Product Enquiry for WooCommerce Plugin <= 3.0 is vulnerable to Cross Site Scripting (XSS)Gravity Master Product Enquiry for WooCommerce
- CVE-2023-47514WordPress Star CloudPRNT for WooCommerce Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)lawrenceowen, gcubero, acunnningham, fmahmood Star CloudPRN…
- CVE-2023-47056ZDI-CAN-21763: Adobe Premiere Pro MP4 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Premiere Pro
- CVE-2023-47058ZDI-CAN-21766: Adobe Premiere Pro MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Premiere Pro
- CVE-2023-47059ZDI-CAN-21767: Adobe Premiere Pro MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Premiere Pro
- CVE-2023-47055ZDI-CAN-21765: Adobe Premiere Pro M4A File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Premiere Pro
- CVE-2023-47057ZDI-CAN-21764: Adobe Premiere Pro MP4 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Premiere Pro
- CVE-2023-6021Ray Log File Local File Includeray-project/ray · ray
- CVE-2023-6022Cross-Site Request Forgery (CSRF) in prefecthq/prefectprefecthq/prefect · prefect
- CVE-2023-6017H2O S3 Bucket Takeoverh2oai/h2o-3
- CVE-2023-6023ModelDB Local File Includevertaai/modeldb
- CVE-2023-26368Adobe InCopy Out-of-Bounds Read Vulnerability v1.0Adobe InCopy
- CVE-2023-47040ZDI-CAN-21698: Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Media Encoder
- CVE-2023-47042ZDI-CAN-21696: Adobe Media Encoder MP4 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Media Encoder
- CVE-2023-47041ZDI-CAN-21697: Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Media Encoder
- CVE-2023-47043ZDI-CAN-21699: Adobe Media Encoder MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Media Encoder
- CVE-2023-44330Adobe Photoshop 2023 CC 24.7 Memory Corruption Vulnerability III.Adobe Photoshop Desktop
- CVE-2023-44359ZDI-CAN-21936: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-44366ZDI-CAN-21928: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-44338ZDI-CAN-21493: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-44371ZDI-CAN-21998: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-44336TALOS-2023-1794 - Adobe Acrobat Reader Thermometer use-after-free vulnerabilityAdobe Acrobat Reader
- CVE-2023-44365ZDI-CAN-21931: Adobe Acrobat Reader DC Font Parsing Uninitialized Variable Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-44367ZDI-CAN-21929: Adobe Acrobat Reader DC Font Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-44337ZDI-CAN-21509: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-44372TALOS-2023-1842 - Adobe Acrobat Reader U3D page event use-after-free vulnerabilityAdobe Acrobat Reader
- CVE-2023-39259 Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability.Dell OS Recovery Tool
- CVE-2023-26031Privilege escalation in Apache Hadoop Yarn container-executor binary on Linux systemsApache Software Foundation Apache Hadoop · org.apache.hadoo…
- CVE-2023-32469 Dell Precision Tower BIOS contains an Improper Input Validation vulnerability.Dell Precision 5820 Tower, Dell Precision 7820 Tower, Dell…
- CVE-2023-44296 Dell ELab-Navigator, version 3.1.9 contains a hard-coded credential vulnerability.Dell Mobility - E-Lab Navigator
- CVE-2023-43275Cross-Site Request Forgery (CSRF) vulnerability in DedeCMS v5.7 in 110 backend management interface via /catalog_add.php, allows attackers t
- CVE-2023-48052Missing SSL certificate validation in HTTPie v3.2.2 allows attackers to eavesdrop on communications between the host and server via a man-inhttpie
- CVE-2023-48134nagayama_copabowl Line 13.6.1 is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor.
Medium, low and unrated 77
- CVE-2023-48231Use-After-Free in win_close() in vimvim
- CVE-2023-48232Floating point Exception in adjust_plines_for_skipcol() in vimvim
- CVE-2023-48233overflow with count for :s command in vimvim
- CVE-2023-48234overflow in nv_z_get_count in vimvim
- CVE-2023-48235overflow in ex address parsing in vimvim
- CVE-2023-48236overflow in get_number in vimvim
- CVE-2023-48237overflow in shift_line in vimvim
- CVE-2023-47686WordPress Arigato Autoresponder and Newsletter Plugin <= 2.7.2.2 is vulnerable to Cross Site Request Forgery (CSRF)Kiboko Labs Arigato Autoresponder and Newsletter
- CVE-2023-47687WordPress Woo Custom and Sequential Order Number Plugin <= 2.6.0 is vulnerable to Cross Site Request Forgery (CSRF)VJInfotech Woo Custom and Sequential Order Number
- CVE-2023-47688WordPress Youtube SpeedLoad Plugin <= 0.6.3 is vulnerable to Cross Site Request Forgery (CSRF)Alexufo Youtube SpeedLoad
- CVE-2023-47112Authenticated users can view job names and groups they do not have authorization to view in Rundeckrundeck · org.rundeck:rundeckapp
- CVE-2023-47642Stream description leaks to ex-subscribers in Zulipzulip
- CVE-2023-40314Cross-site scripting in bootstrap.jspThe OpenNMS Group Horizon · The OpenNMS Group Meridian +1
- CVE-2023-46213Cross-site Scripting (XSS) on “Show Syntax Highlighted” View in Search PageSplunk Enterprise · Splunk Cloud
- CVE-2023-32957WordPress Team Members Showcase Plugin <= 1.3.4 is vulnerable to Cross Site Scripting (XSS)Dazzlersoft Team Members Showcase
- CVE-2023-36008Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2023-36026Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2023-47239WordPress Easy PayPal Shopping Cart Plugin <= 1.1.10 is vulnerable to Cross Site Scripting (XSS)Scott Paterson Easy PayPal Shopping Cart
- CVE-2023-47240WordPress CBX Map for Google Map & OpenStreetMap Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS)Codeboxr CBX Map for Google Map & OpenStreetMap
- CVE-2023-47242WordPress ANAC XML Bandi di Gara Plugin <= 7.5 is vulnerable to Cross Site Scripting (XSS)Marco Milesi ANAC XML Bandi di Gara
- CVE-2023-47245WordPress ANAC XML Viewer Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)Marco Milesi ANAC XML Viewer
- CVE-2023-47511WordPress Pinyin Slugs Plugin <= 2.3.0 is vulnerable to Cross Site Scripting (XSS)SO WP Pinyin Slugs
- CVE-2023-6176Kernel: local dos vulnerability in scatterwalk_copychunksRed Hat Enterprise Linux
- CVE-2023-47060ZDI-CAN-21792: Adobe Premiere Pro MP4 File Uninitialized Variable Information Disclosure VulnerabilityAdobe Premiere Pro
- CVE-2023-47047ZDI-CAN-21685: Adobe Audition MP4 File Parsing Uninitialized Variable Remote Code Execution VulnerabilityAdobe Audition
- CVE-2023-47053ZDI-CAN-21689: Adobe Audition MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityAdobe Audition
- CVE-2023-47046ZDI-CAN-21684: Adobe Audition MP4 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Audition
- CVE-2023-47049ZDI-CAN-21690: Adobe Audition MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Audition
- CVE-2023-47048ZDI-CAN-21688: Adobe Audition MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Audition
- CVE-2023-47050ZDI-CAN-21686: Adobe Audition M4A File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Audition
- CVE-2023-47054ZDI-CAN-21782: Adobe Audition MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityAdobe Audition
- CVE-2023-47051ZDI-CAN-21683: Adobe Audition MP4 File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Audition
- CVE-2023-47052ZDI-CAN-21687: Adobe Audition MP4 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Audition
- CVE-2023-6121Kernel: nvme: info leak due to out-of-bounds read in nvmet_ctrl_find_getRed Hat Enterprise Linux
- CVE-2023-47044ZDI-CAN-21789: Adobe Media Encoder MP4 File Uninitialized Variable Information Disclosure VulnerabilityAdobe Media Encoder
- CVE-2023-44329ZDI-CAN-21798: Adobe Bridge MP4 File Parsing Uninitialized Variable Information Disclosure VulnerabilityAdobe Bridge
- CVE-2023-44328ZDI-CAN-21797: Adobe Bridge MP4 File Parsing Use-After-Free Information Disclosure VulnerabilityAdobe Bridge
- CVE-2023-44327ZDI-CAN-21793: Adobe Bridge MP4 File Uninitialized Variable Information Disclosure VulnerabilityAdobe Bridge
- CVE-2023-44332Adobe Photoshop 2023 CC 24.7 Memory Corruption Vulnerability II.Adobe Photoshop Desktop
- CVE-2023-44333Adobe Photoshop 2023 CC 24.7 Memory Corruption Vulnerability V.Adobe Photoshop Desktop
- CVE-2023-44331Adobe Photoshop 2023 CC 24.7 Memory Corruption Vulnerability IV.Adobe Photoshop Desktop
- CVE-2023-44335Adobe Photoshop 2023 CC 24.7 Memory Corruption Vulnerability I.Adobe Photoshop Desktop
- CVE-2023-44334Adobe Photoshop 2023 CC 24.7 Memory Corruption Vulnerability VI.Adobe Photoshop Desktop
- CVE-2023-4771Cross-Site Scripting vulnerability in CKSource CKEditorCKSource CKEditor · ckeditor4
- CVE-2023-6174Out-of-bounds Read in WiresharkWireshark Foundation Wireshark
- CVE-2023-44345Adobe InDesign CC 2023 Memory Corruption Vulnerability VII.Adobe InDesign Desktop
- CVE-2023-44344Adobe InDesign CC 2023 Memory Corruption Vulnerability V.Adobe InDesign Desktop
- CVE-2023-44341Adobe InDesign CC 2023 Memory Corruption Vulnerability IAdobe InDesign Desktop
- CVE-2023-44346Adobe InDesign CC 2023 Memory Corruption Vulnerability VIII.Adobe InDesign Desktop
- CVE-2023-44347Adobe InDesign CC 2023 Memory Corruption Vulnerability IX.Adobe InDesign Desktop
- CVE-2023-44343Adobe InDesign CC 2023 Memory Corruption Vulnerability III.Adobe InDesign Desktop
- CVE-2023-44342Adobe InDesign CC 2023 Memory Corruption Vulnerability II.Adobe InDesign Desktop
- CVE-2023-44357ZDI-CAN-21930: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-44348ZDI-CAN-21925: (bypass of VULN-24891) Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-44356ZDI-CAN-21956: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-44360ZDI-CAN-21882: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-44340ZDI-CAN-21424: Adobe Acrobat Reader DC PDF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-44361ZDI-CAN-22041: Adobe Acrobat Reader DC AcroForm Doc Object Use-After-Free Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-44358ZDI-CAN-21971: Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-44339ZDI-CAN-21422: Adobe Acrobat Reader DC AcroForm value Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-6119 An Improper Privilege Management vulnerability in Trellix GetSusp prior to version 5.0.0.27 allows a local, low privilege attacker to gain Trellix GetSusp
- CVE-2023-44292 Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module.Dell Repository Manager
- CVE-2023-44282 Dell Repository Manager, 3.4.3 and prior, contains an Improper Access Control vulnerability in its installation module.Dell Repository Manager
- CVE-2023-39246 Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server version prior to 11.8.1 contain an Insecure ODell Encryption, Dell Endpoint Security Suite Enterprise, D…
- CVE-2023-43752OS command injection vulnerability in WRC-X3000GS2-W v1.05 and earlier, WRC-X3000GS2-B v1.05 and earlier, and WRC-X3000GS2A-B v1.05 and earlELECOM CO. WRC-X3000GS2-W · ELECOM CO. WRC-X3000GS2-B +1
- CVE-2023-43757Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD.ELECOM CO. WRC-2533GHBK2-T · ELECOM CO. WRC-2533GHBK-I +32
- CVE-2021-35437SQL injection vulnerability in LMXCMS v.1.4 allows attacker to execute arbitrary code via the TagsAction.class.
- CVE-2023-47025An issue in Free5gc v.3.3.0 allows a local attacker to cause a denial of service via the free5gc-compose component.github.com/free5gc/free5gc
- CVE-2023-47263Certain WithSecure products allow a Denial of Service (DoS) in the antivirus engine when scanning a fuzzed PE32 file.
- CVE-2023-47264Certain WithSecure products have a buffer over-read whereby processing certain fuzz file types may cause a denial of service (DoS).
- CVE-2023-47335Insecure permissions in the setNFZEnable function of Autel Robotics EVO Nano drone v1.6.5 allows attackers to breach the geo-fence and fly i
- CVE-2023-47470Buffer Overflow vulnerability in Ffmpeg before github commit 4565747056a11356210ed8edcecb920105e40b60 allows a remote attacker to achieve an
- CVE-2023-47471Buffer Overflow vulnerability in strukturag libde265 v1.10.12 allows a local attacker to cause a denial of service via the slice_segment_hea
- CVE-2023-48053Archery v1.10.0 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption.
- CVE-2023-48054Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a malocalstack
- CVE-2023-48055SuperAGI v0.0.13 was discovered to use a hardcoded key for encryption operations.
- CVE-2023-48056PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption.pypinksign