CVEs published November 17, 2023
71 CVEs were published on November 17, 2023: 8 critical, 16 high.
- Published
- 71
- Critical
- 8
- High
- 16
- Medium
- 13
- Low
- 2
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 8
Most affected products
- Adobe After Effects
- 8
- Adobe ColdFusion
- 6
- Adobe RoboHelp
- 5
- NEC CLUSTERPRO X
- 5
- CubeCart Limited CubeCart
- 4
- librenms · librenms/librenms
- 3
- concrete5/concrete5
- 2
- Trellix ePolicy Orchestrator
- 2
- Adobe Animate
- 1
- Adobe Dimension
- 1
Critical 8
- CVE-2023-44351Adobe ColdFusion RCE Security VulnerabilityAdobe ColdFusion
- CVE-2023-44353ColdFusion WDDX Deserialization GadgetsAdobe ColdFusion
- CVE-2023-44350ColdFusion | Deserialization of Untrusted Data (CWE-502)Adobe ColdFusion
- CVE-2023-44324ZDI-CAN-21344: Adobe FrameMaker Publishing Server Authentication Bypass VulnerabilityAdobe Framemaker Publishing Server
- CVE-2023-47797Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote aLiferay Portal · com.liferay.portal:release.portal.bom
- CVE-2023-48031OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type.
- CVE-2023-48648Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions.concrete5/concrete5
- CVE-2023-48655An issue was discovered in MISP before 2.4.176.
High 16
- CVE-2023-48238JWT Algorithm Confusion in json-web-token libraryjoaquimserafim json-web-token · json-web-token
- CVE-2023-6179Incorrect Permission assignment to program executable foldersHoneywell ProWatch
- CVE-2023-26347CVE-2023-38205 issues | ColdFusion Admin Panel AccessAdobe ColdFusion
- CVE-2023-22275ZDI-CAN-21306: Adobe RoboHelp Server GetNewUserId SQL Injection Information Disclosure VulnerabilityAdobe RoboHelp
- CVE-2023-22272ZDI-CAN-21309: Adobe RoboHelp Server resolveDistinguishedName LDAP Injection Information Disclosure VulnerabilityAdobe RoboHelp
- CVE-2023-22274ZDI-CAN-21305: Adobe RoboHelp Server UpdateCommandStream XML External Entity Processing Information Disclosure VulnerabilityAdobe RoboHelp
- CVE-2023-22273ZDI-CAN-21307: Adobe RoboHelp Server OnPublishFile Directory Traversal Remote Code Execution VulnerabilityAdobe RoboHelp
- CVE-2023-47068ZDI-CAN-21702: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe After Effects
- CVE-2023-47066ZDI-CAN-21705: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe After Effects
- CVE-2023-47070ZDI-CAN-21708: Adobe After Effects MP4 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe After Effects
- CVE-2023-47073ZDI-CAN-21709: Adobe After Effects MP4 File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe After Effects
- CVE-2023-47069ZDI-CAN-21703: Adobe After Effects M4A File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe After Effects
- CVE-2023-47067ZDI-CAN-21706: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe After Effects
- CVE-2023-5444CSRF in ePO leading to privilege escalationTrellix ePolicy Orchestrator
- CVE-2023-41102An issue was discovered in the captive portal in OpenNDS before version 10.1.3.
- CVE-2023-45382In the module "SoNice Retour" (sonice_retour) up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal informa
Medium, low and unrated 47
- CVE-2023-46745Rate limiting Bypass on login page in libreNMSlibrenms · librenms/librenms
- CVE-2023-48294Broken Access control on Graphs Feature in LibreNMSlibrenms · librenms/librenms
- CVE-2023-48295Cross-site Scripting at Device groups Deletion feature in LibreNMSlibrenms · librenms/librenms
- CVE-2023-6188GetSimpleCMS theme-edit.php code injectionGetSimpleCMS
- CVE-2023-26364Denial of Service of regular expression in package @adobe/css-toolsAdobe Not a product · @adobe/css-tools
- CVE-2023-44355ColdFusion | Improper Input Validation (CWE-20)Adobe ColdFusion
- CVE-2023-44352Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last versionAdobe ColdFusion
- CVE-2023-22268ZDI-CAN-21308: Adobe RoboHelp Server getRHSGroupsForRoles SQL Injection Information Disclosure VulnerabilityAdobe RoboHelp
- CVE-2023-47071ZDI-CAN-21704: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe After Effects
- CVE-2023-47072ZDI-CAN-21790: Adobe After Effects MP4 File Uninitialized Variable Information Disclosure VulnerabilityAdobe After Effects
- CVE-2023-5445 An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL Trellix ePolicy Orchestrator
- CVE-2023-47757WordPress AWeber Plugin <= 7.3.9 is vulnerable to Broken Access ControlAWeber – Free Sign Up Form and Landing Page Builder Plugin…
- CVE-2023-44326ZDI-CAN-21866: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-44325ZDI-CAN-21666: Adobe Animate FLA File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Animate
- CVE-2023-39548CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleNEC CLUSTERPRO X
- CVE-2023-39547CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleNEC CLUSTERPRO X
- CVE-2023-39546CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleNEC CLUSTERPRO X
- CVE-2023-39545CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleNEC CLUSTERPRO X
- CVE-2023-39544CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleNEC CLUSTERPRO X
- CVE-2023-47675CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command.CubeCart Limited CubeCart
- CVE-2023-47283Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obtaCubeCart Limited CubeCart
- CVE-2023-42428Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to deleCubeCart Limited CubeCart
- CVE-2023-38130Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the syCubeCart Limited CubeCart
- CVE-2020-11447An issue was discovered on Bell HomeHub 3000 SG48222070 devices.
- CVE-2020-11448An issue was discovered on Bell HomeHub 3000 SG48222070 devices.
- CVE-2023-38313An issue was discovered in OpenNDS Captive Portal before 10.1.2.
- CVE-2023-38314An issue was discovered in OpenNDS Captive Portal before version 10.1.2.
- CVE-2023-38315An issue was discovered in OpenNDS Captive Portal before version 10.1.2.
- CVE-2023-38316An issue was discovered in OpenNDS Captive Portal before version 10.1.2.
- CVE-2023-38320An issue was discovered in OpenNDS Captive Portal before version 10.1.2.
- CVE-2023-38322An issue was discovered in OpenNDS Captive Portal before version 10.1.2.
- CVE-2023-38324An issue was discovered in OpenNDS before 10.1.2.
- CVE-2023-41101An issue was discovered in the captive portal in OpenNDS before version 10.1.3.
- CVE-2023-43177CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.
- CVE-2023-44796Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a cra
- CVE-2023-45387In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a
- CVE-2023-46402git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go.github.com/whilp/git-urls
- CVE-2023-48024Liblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void hash_destroy(hash_table_t *h) at hash.c
- CVE-2023-48025Liblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in unsigned get_length(lisp_cell_t * x) at eval.
- CVE-2023-48028kodbox 1.46.01 has a security flaw that enables user enumeration.
- CVE-2023-48029Corebos 8.0 and below is vulnerable to CSV Injection.
- CVE-2023-48185Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a craft
- CVE-2023-48649Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name.concrete5/concrete5
- CVE-2023-48656An issue was discovered in MISP before 2.4.176.
- CVE-2023-48657An issue was discovered in MISP before 2.4.176.
- CVE-2023-48658An issue was discovered in MISP before 2.4.176.
- CVE-2023-48659An issue was discovered in MISP before 2.4.176.