# CVEs published 2023-11-17

71 CVEs were published on November 17, 2023: 8 critical, 16 high. Days are UTC.

- [CVE-2023-46745](https://cve.now/CVE-2023-46745.md): Rate limiting Bypass on login page in libreNMS (CVSS 5.3, librenms · librenms/librenms)
- [CVE-2023-48238](https://cve.now/CVE-2023-48238.md): JWT Algorithm Confusion in json-web-token library (CVSS 7.5, joaquimserafim json-web-token · json-web-token)
- [CVE-2023-48294](https://cve.now/CVE-2023-48294.md): Broken Access control on Graphs Feature in LibreNMS (CVSS 4.3, librenms · librenms/librenms)
- [CVE-2023-48295](https://cve.now/CVE-2023-48295.md): Cross-site Scripting at Device groups Deletion feature in LibreNMS (CVSS 6.3, librenms · librenms/librenms)
- [CVE-2023-6188](https://cve.now/CVE-2023-6188.md): GetSimpleCMS theme-edit.php code injection (CVSS 4.7, GetSimpleCMS)
- [CVE-2023-6179](https://cve.now/CVE-2023-6179.md): Incorrect Permission assignment to program executable folders (CVSS 7.8, Honeywell ProWatch)
- [CVE-2023-26364](https://cve.now/CVE-2023-26364.md): Denial of Service of regular expression in package @adobe/css-tools (CVSS 5.3, Adobe Not a product · @adobe/css-tools)
- [CVE-2023-44351](https://cve.now/CVE-2023-44351.md): Adobe ColdFusion RCE Security Vulnerability (CVSS 9.8, Adobe ColdFusion)
- [CVE-2023-44355](https://cve.now/CVE-2023-44355.md): ColdFusion | Improper Input Validation (CWE-20) (CVSS 4.3, Adobe ColdFusion)
- [CVE-2023-26347](https://cve.now/CVE-2023-26347.md): CVE-2023-38205 issues | ColdFusion Admin Panel Access (CVSS 7.5, Adobe ColdFusion)
- [CVE-2023-44352](https://cve.now/CVE-2023-44352.md): Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version (CVSS 6.1, Adobe ColdFusion)
- [CVE-2023-44353](https://cve.now/CVE-2023-44353.md): ColdFusion WDDX Deserialization Gadgets (CVSS 9.8, Adobe ColdFusion)
- [CVE-2023-44350](https://cve.now/CVE-2023-44350.md): ColdFusion | Deserialization of Untrusted Data (CWE-502) (CVSS 9.8, Adobe ColdFusion)
- [CVE-2023-22275](https://cve.now/CVE-2023-22275.md): ZDI-CAN-21306: Adobe RoboHelp Server GetNewUserId SQL Injection Information Disclosure Vulnerability (CVSS 7.5, Adobe RoboHelp)
- [CVE-2023-22272](https://cve.now/CVE-2023-22272.md): ZDI-CAN-21309: Adobe RoboHelp Server resolveDistinguishedName LDAP Injection Information Disclosure Vulnerability (CVSS 7.5, Adobe RoboHelp)
- [CVE-2023-22268](https://cve.now/CVE-2023-22268.md): ZDI-CAN-21308: Adobe RoboHelp Server getRHSGroupsForRoles SQL Injection Information Disclosure Vulnerability (CVSS 6.5, Adobe RoboHelp)
- [CVE-2023-22274](https://cve.now/CVE-2023-22274.md): ZDI-CAN-21305: Adobe RoboHelp Server UpdateCommandStream XML External Entity Processing Information Disclosure Vulnerability (CVSS 7.5, Adobe RoboHelp)
- [CVE-2023-22273](https://cve.now/CVE-2023-22273.md): ZDI-CAN-21307: Adobe RoboHelp Server OnPublishFile Directory Traversal Remote Code Execution Vulnerability (CVSS 7.2, Adobe RoboHelp)
- [CVE-2023-44324](https://cve.now/CVE-2023-44324.md): ZDI-CAN-21344: Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability (CVSS 9.8, Adobe Framemaker Publishing Server)
- [CVE-2023-47068](https://cve.now/CVE-2023-47068.md): ZDI-CAN-21702: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-47071](https://cve.now/CVE-2023-47071.md): ZDI-CAN-21704: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe After Effects)
- [CVE-2023-47072](https://cve.now/CVE-2023-47072.md): ZDI-CAN-21790: Adobe After Effects MP4 File Uninitialized Variable Information Disclosure Vulnerability (CVSS 3.3, Adobe After Effects)
- [CVE-2023-47066](https://cve.now/CVE-2023-47066.md): ZDI-CAN-21705: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-47070](https://cve.now/CVE-2023-47070.md): ZDI-CAN-21708: Adobe After Effects MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-47073](https://cve.now/CVE-2023-47073.md): ZDI-CAN-21709: Adobe After Effects MP4 File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-47069](https://cve.now/CVE-2023-47069.md): ZDI-CAN-21703: Adobe After Effects M4A File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-47067](https://cve.now/CVE-2023-47067.md): ZDI-CAN-21706: Adobe After Effects MP4 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-5445](https://cve.now/CVE-2023-5445.md): An open redirect vulnerability in ePolicy Orchestrator prior to 5.10.0 CP1 Update 2, allows a remote low privileged user to modify the URL (CVSS 5.4, Trellix ePolicy Orchestrator)
- [CVE-2023-5444](https://cve.now/CVE-2023-5444.md): CSRF in ePO leading to privilege escalation (CVSS 8.0, Trellix ePolicy Orchestrator)
- [CVE-2023-47757](https://cve.now/CVE-2023-47757.md): WordPress AWeber Plugin \<= 7.3.9 is vulnerable to Broken Access Control (CVSS 4.3, AWeber – Free Sign Up Form and Landing Page Builder Plugin…)
- [CVE-2023-44326](https://cve.now/CVE-2023-44326.md): ZDI-CAN-21866: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-44325](https://cve.now/CVE-2023-44325.md): ZDI-CAN-21666: Adobe Animate FLA File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Animate)
- [CVE-2023-47797](https://cve.now/CVE-2023-47797.md): Reflected cross-site scripting (XSS) vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote a (CVSS 9.6, Liferay Portal · com.liferay.portal:release.portal.bom)
- [CVE-2023-39548](https://cve.now/CVE-2023-39548.md): CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X Single (no CVSS, NEC CLUSTERPRO X)
- [CVE-2023-39547](https://cve.now/CVE-2023-39547.md): CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X Single (no CVSS, NEC CLUSTERPRO X)
- [CVE-2023-39546](https://cve.now/CVE-2023-39546.md): CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X Single (no CVSS, NEC CLUSTERPRO X)
- [CVE-2023-39545](https://cve.now/CVE-2023-39545.md): CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X Single (no CVSS, NEC CLUSTERPRO X)
- [CVE-2023-39544](https://cve.now/CVE-2023-39544.md): CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X Single (no CVSS, NEC CLUSTERPRO X)
- [CVE-2023-47675](https://cve.now/CVE-2023-47675.md): CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to execute an arbitrary OS command. (no CVSS, CubeCart Limited CubeCart)
- [CVE-2023-47283](https://cve.now/CVE-2023-47283.md): Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to obta (no CVSS, CubeCart Limited CubeCart)
- [CVE-2023-42428](https://cve.now/CVE-2023-42428.md): Directory traversal vulnerability in CubeCart prior to 6.5.3 allows a remote authenticated attacker with an administrative privilege to dele (no CVSS, CubeCart Limited CubeCart)
- [CVE-2023-38130](https://cve.now/CVE-2023-38130.md): Cross-site request forgery (CSRF) vulnerability in CubeCart prior to 6.5.3 allows a remote unauthenticated attacker to delete data in the sy (no CVSS, CubeCart Limited CubeCart)
- [CVE-2020-11447](https://cve.now/CVE-2020-11447.md): An issue was discovered on Bell HomeHub 3000 SG48222070 devices. (no CVSS)
- [CVE-2020-11448](https://cve.now/CVE-2020-11448.md): An issue was discovered on Bell HomeHub 3000 SG48222070 devices. (no CVSS)
- [CVE-2023-38313](https://cve.now/CVE-2023-38313.md): An issue was discovered in OpenNDS Captive Portal before 10.1.2. (no CVSS)
- [CVE-2023-38314](https://cve.now/CVE-2023-38314.md): An issue was discovered in OpenNDS Captive Portal before version 10.1.2. (no CVSS)
- [CVE-2023-38315](https://cve.now/CVE-2023-38315.md): An issue was discovered in OpenNDS Captive Portal before version 10.1.2. (no CVSS)
- [CVE-2023-38316](https://cve.now/CVE-2023-38316.md): An issue was discovered in OpenNDS Captive Portal before version 10.1.2. (no CVSS)
- [CVE-2023-38320](https://cve.now/CVE-2023-38320.md): An issue was discovered in OpenNDS Captive Portal before version 10.1.2. (no CVSS)
- [CVE-2023-38322](https://cve.now/CVE-2023-38322.md): An issue was discovered in OpenNDS Captive Portal before version 10.1.2. (no CVSS)
- [CVE-2023-38324](https://cve.now/CVE-2023-38324.md): An issue was discovered in OpenNDS before 10.1.2. (no CVSS)
- [CVE-2023-41101](https://cve.now/CVE-2023-41101.md): An issue was discovered in the captive portal in OpenNDS before version 10.1.3. (no CVSS)
- [CVE-2023-41102](https://cve.now/CVE-2023-41102.md): An issue was discovered in the captive portal in OpenNDS before version 10.1.3. (CVSS 7.5)
- [CVE-2023-43177](https://cve.now/CVE-2023-43177.md): CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. (no CVSS)
- [CVE-2023-44796](https://cve.now/CVE-2023-44796.md): Cross Site Scripting (XSS) vulnerability in LimeSurvey before version 6.2.9-230925 allows a remote attacker to escalate privileges via a cra (no CVSS)
- [CVE-2023-45382](https://cve.now/CVE-2023-45382.md): In the module "SoNice Retour" (sonice\_retour) up to version 2.1.0 from Common-Services for PrestaShop, a guest can download personal informa (CVSS 7.5)
- [CVE-2023-45387](https://cve.now/CVE-2023-45387.md): In the module "Product Catalog (CSV, Excel, XML) Export PRO" (exportproducts) in versions up to 5.0.0 from MyPrestaModules for PrestaShop, a (no CVSS)
- [CVE-2023-46402](https://cve.now/CVE-2023-46402.md): git-urls 1.0.0 allows ReDOS (Regular Expression Denial of Service) in urls.go. (no CVSS, github.com/whilp/git-urls)
- [CVE-2023-48024](https://cve.now/CVE-2023-48024.md): Liblisp through commit 4c65969 was discovered to contain a use-after-free vulnerability in void hash\_destroy(hash\_table\_t \*h) at hash.c (no CVSS)
- [CVE-2023-48025](https://cve.now/CVE-2023-48025.md): Liblisp through commit 4c65969 was discovered to contain a out-of-bounds-read vulnerability in unsigned get\_length(lisp\_cell\_t \* x) at eval. (no CVSS)
- [CVE-2023-48028](https://cve.now/CVE-2023-48028.md): kodbox 1.46.01 has a security flaw that enables user enumeration. (no CVSS)
- [CVE-2023-48029](https://cve.now/CVE-2023-48029.md): Corebos 8.0 and below is vulnerable to CSV Injection. (no CVSS)
- [CVE-2023-48031](https://cve.now/CVE-2023-48031.md): OpenSupports v4.11.0 is vulnerable to Unrestricted Upload of File with Dangerous Type. (CVSS 9.8)
- [CVE-2023-48185](https://cve.now/CVE-2023-48185.md): Directory Traversal vulnerability in TerraMaster v.s1.0 through v.2.295 allows a remote attacker to obtain sensitive information via a craft (no CVSS)
- [CVE-2023-48648](https://cve.now/CVE-2023-48648.md): Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows unauthorized access because directories can be created with insecure permissions. (CVSS 9.8, concrete5/concrete5)
- [CVE-2023-48649](https://cve.now/CVE-2023-48649.md): Concrete CMS before 8.5.13 and 9.x before 9.2.2 allows stored XSS on the Admin page via an uploaded file name. (CVSS 3.5, concrete5/concrete5)
- [CVE-2023-48655](https://cve.now/CVE-2023-48655.md): An issue was discovered in MISP before 2.4.176. (CVSS 9.8)
- [CVE-2023-48656](https://cve.now/CVE-2023-48656.md): An issue was discovered in MISP before 2.4.176. (no CVSS)
- [CVE-2023-48657](https://cve.now/CVE-2023-48657.md): An issue was discovered in MISP before 2.4.176. (no CVSS)
- [CVE-2023-48658](https://cve.now/CVE-2023-48658.md): An issue was discovered in MISP before 2.4.176. (no CVSS)
- [CVE-2023-48659](https://cve.now/CVE-2023-48659.md): An issue was discovered in MISP before 2.4.176. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.