CVEs published November 20, 2023
73 CVEs were published on November 20, 2023: 9 critical, 12 high.
- Published
- 73
- Critical
- 9
- High
- 12
- Medium
- 20
- Low
- 0
- Unrated
- 32
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- OpenHarmony
- 7
- WP Hotel Booking
- 3
- Audio Merchant
- 2
- Dev Blog
- 2
- INEA ME RTU
- 2
- LuxSoft LuxCal Web Calendar
- 2
- Seraphinite Accelerator
- 2
- Texas Instruments CC32XX · Texas Instruments SimpleLink… +3
- 2
- xwiki-contrib application-admintools · org.xwiki.contrib:xw…
- 2
- Apache Software Foundation Apache Derby · org.apache.derby:…
- 1
Critical 9
- CVE-2023-6144Dev Blog v1.0 - ATODev Blog
- CVE-2023-48310Ability to DoS the testing infrastructure by overwriting filesNC3-LU TestingPlatform
- CVE-2023-48292XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacksxwiki-contrib application-admintools · org.xwiki.contrib:xw…
- CVE-2023-48240XWiki Platform sends cookies to external images in rendered diff and is vulnerable to server side request forgeryxwiki-platform · org.xwiki.platform:xwiki-platform-diff-xml
- CVE-2023-29155INEA ME RTU Missing Authentication for Critical FunctionINEA ME RTU
- CVE-2023-35762OS Command Injection in INEA ME RTUINEA ME RTU
- CVE-2022-46337Apache Derby: LDAP injection vulnerability in authenticatorApache Software Foundation Apache Derby · org.apache.derby:…
- CVE-2023-46302Apache Submarine: Fix CVE-2022-1471 SnakeYaml unsafe deserializationApache Software Foundation Apache Submarine · apache-submar…
- CVE-2023-38823Buffer Overflow vulnerability in Tenda Ac19 v.1.0, AC18, AC9 v.1.0, AC6 v.2.0 and v.1.0 allows a remote attacker to execute arbitrary code v
High 12
- CVE-2021-22636Texas Instruments TI-RTOS Integer Overflow or WraparoundTexas Instruments CC32XX · Texas Instruments SimpleLink… +3
- CVE-2021-27429Texas Instruments TI-RTOS Integer Overflow or WraparoundTexas Instruments CC32XX · Texas Instruments SimpleLink… +3
- CVE-2023-48293XWiki Admin Tools Application CSRF with QueryOnXWiki allows arbitrary database queriesxwiki-contrib application-admintools · org.xwiki.contrib:xw…
- CVE-2023-48241XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest servicexwiki-platform · org.xwiki.platform:xwiki-platform-search-s…
- CVE-2023-48221wire-avs remote format string vulnerability wireapp wire-avs
- CVE-2023-6196Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File UploadAudio Merchant
- CVE-2023-5593The out-of-bounds write vulnerability in the Windows-based SecuExtender SSL VPN Client software version 4.0.4.0 could allow an authenticatedZyxel SecuExtender SSL VPN Client
- CVE-2023-43612Hiview has an improper preservation of permissions vulnerabilityOpenHarmony
- CVE-2023-3116Liteos-A has a incorrect default permissions vulnerabilityOpenHarmony
- CVE-2023-38885OpenSIS Classic Community Edition version 9.0 lacks cross-site request forgery (CSRF) protection throughout the whole app.
- CVE-2023-48110Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the urls parameter in the function saveParentControlInfo .
- CVE-2023-48111Tenda AX1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the function saveParentControlInfo .
Medium, low and unrated 52
- CVE-2023-6142Dev Blog v1.0 - Stored XSSDev Blog
- CVE-2023-6199Book Stack v23.10.2 - LFR via Blind SSRFBookStack
- CVE-2023-6178 An arbitrary file write vulnerability exists where an authenticated attacker with privileges on the managing application could alter NessusTenable Nessus Agent
- CVE-2023-6062Arbitrary File WriteTenable Nessus
- CVE-2023-5343Popup Box < 3.7.9 - Admin+ Stored XSSPopup box
- CVE-2023-5640Article Analytics <= 1.0 - Unauthenticated SQL injectionArticle analytics
- CVE-2023-5119Forminator and Forminator Pro < 1.27.0 - Admin+ Stored Cross-Site ScriptingForminator
- CVE-2023-5509myStickymenu < 2.6.5 - Subscriber+ Arbitrary Form Leads DeletionFloating Notification Bar, Sticky Menu on Scroll, Announcem…
- CVE-2023-5610Seraphinite Accelerator < 2.20.29 - Authenticated Arbitrary RedirectSeraphinite Accelerator
- CVE-2023-5651WP Hotel Booking < 2.0.8 - Subscriber+ Arbitrary Post DeletionWP Hotel Booking
- CVE-2023-5799WP Hotel Booking < 2.0.9 - Contributor+ Arbitrary Post DeletionWP Hotel Booking
- CVE-2023-5609Seraphinite Accelerator < 2.20.29 - Reflected XSSSeraphinite Accelerator
- CVE-2023-5652WP Hotel Booking < 2.0.8 - Unauthenticated SQLiWP Hotel Booking
- CVE-2023-4808WP Post Popup <= 3.7.3 - Admin+ Stored XSSWP Post Popup
- CVE-2023-4799Magic Embeds < 3.1.2 - Contributor+ Stored XSS via shortcodeMagic Embeds
- CVE-2023-4824WooHoo Newspaper Magazine Theme <= 2.5.3 - Settings Update via CSRFWoohoo
- CVE-2023-5140Bonus for Woo < 5.8.3 - Reflected Cross-Site ScriptingBonus for Woo
- CVE-2023-4970PubyDoc <= 2.0.6 - Admin+ Stored XSSPubyDoc
- CVE-2023-5340Five Star Restaurant Menu and Food Ordering < 2.4.11 - Unauthenticated PHP Object InjectionFive Star Restaurant Menu and Food Ordering
- CVE-2023-48309next-auth vulnerable to possible user mocking that bypasses basic authenticationnextauthjs next-auth · next-auth
- CVE-2023-48300Embed Privacy missing escaping for show_all attribute in opt-out shortcodeepiphyt embed-privacy
- CVE-2023-48223fast-jwt JWT Algorithm Confusionnearform fast-jwt · fast-jwt
- CVE-2023-48218Strapi Protected Populate Plugin leaking fields if the request fields where empty or only fields selected where not populatablestrapi-community strapi-plugin-protected-populate · strapi-…
- CVE-2023-36013PowerShell Information Disclosure VulnerabilityMicrosoft PowerShell
- CVE-2023-6197Audio Merchant <= 5.0.4 - Cross-Site Request Forgery to Settings Modifcation and Stored Cross-Site ScriptingAudio Merchant
- CVE-2023-47772WordPress Slider Revolution Plugin <= 6.6.14 is vulnerable to Cross Site Scripting (XSS)ThemePunch OHG Slider Revolution
- CVE-2023-47217Arkruntime has a buffer overflow vulnerabilityOpenHarmony
- CVE-2023-46100Cert manager has a use of uninitialized resource vulnerabilityOpenHarmony
- CVE-2023-42774Liteos-A has a incorrect default permissions vulnerabilityOpenHarmony
- CVE-2023-6045Arkruntime has a type confusion vulnerabilityOpenHarmony
- CVE-2023-46705Arkruntime has a type confusion vulnerabilityOpenHarmony
- CVE-2023-3379WAGO: Improper Privilege Management in web-based managementWAGO Compact Controller · WAGO PFC100 +5
- CVE-2023-47175Cross-site scripting vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite veLuxSoft LuxCal Web Calendar
- CVE-2023-46700SQL injection vulnerability in LuxCal Web Calendar prior to 5.2.4M (MySQL version) and LuxCal Web Calendar prior to 5.2.4L (SQLite version) LuxSoft LuxCal Web Calendar
- CVE-2023-38879The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulne
- CVE-2023-38880The Community Edition version 9.0 of OS4ED's openSIS Classic has a broken access control vulnerability in the database backup functionality.
- CVE-2023-38881A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers
- CVE-2023-38882A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers
- CVE-2023-38883A reflected cross-site scripting (XSS) vulnerability in the Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers
- CVE-2023-38884An Insecure Direct Object Reference (IDOR) vulnerability in the Community Edition version 9.0 of openSIS Classic allows an unauthenticated r
- CVE-2023-46470Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via craft
- CVE-2023-46471Cross Site Scripting vulnerability in Space Applications Services Yamcs v.5.8.6 allows a remote attacker to execute arbitrary code via the t
- CVE-2023-46990Deserialization of Untrusted Data in PublicCMS v.4.0.202302.e allows a remote attacker to execute arbitrary code via a crafted script to the
- CVE-2023-47172Certain WithSecure products allow Local Privilege Escalation.
- CVE-2023-47311An issue in Yamcs 5.8.6 allows attackers to send aribitrary telelcommands in a Command Stack via Clickjacking.
- CVE-2023-47417Cross Site Scripting (XSS) vulnerability in the component /shells/embedder.html of DZSlides after v2011.07.25 allows attackers to execute ar
- CVE-2023-48039GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leak in gf_mpd_parse_string media_tools/mpd.c:75.
- CVE-2023-48051An issue in /upydev/keygen.py in upydev v0.4.3 allows attackers to decrypt sensitive information via weak encryption padding.upydev
- CVE-2023-48090GPAC 2.3-DEV-rev617-g671976fcc-master is vulnerable to memory leaks in extract_attributes media_tools/m3u8.c:329.
- CVE-2023-48109Tenda AX1803 v1.0.0.1 was discovered to contain a heap overflow via the deviceId parameter in the function saveParentControlInfo .
- CVE-2023-48176An Insecure Permissions issue in WebsiteGuide v.0.2 allows a remote attacker to gain escalated privileges via crafted jwt (JSON web token).
- CVE-2023-48192An issue in TOTOlink A3700R v.9.1.2u.6134_B20201202 allows a local attacker to execute arbitrary code via the setTracerouteCfg function.