CVEs published November 21, 2023
61 CVEs were published on November 21, 2023: 6 critical, 17 high. 2 are now in CISA KEV.
- Published
- 61
- Critical
- 6
- High
- 17
- Medium
- 17
- Low
- 7
- Unrated
- 14
- Now in CISA KEV
- 2
- Fix available
- 33
Most affected products
- nextcloud security-advisories
- 8
- Mozilla Firefox · Mozilla Thunderbird
- 7
- Axis Communications AB AXIS OS
- 4
- Mozilla Firefox
- 3
- Cisco Identity Services Engine Software
- 2
- Dassault Systèmes 3DSwymer
- 2
- Mitsubishi Electric GX Works2
- 2
- Mozilla Firefox for iOS
- 2
- Red Lion Controls ST-IPm-8460 · Red Lion Controls ST-IPm… +4
- 2
- Texas Instruments CC32XX · Texas Instruments SimpleLink… +3
- 2
Critical 6
- CVE-2023-6248Data leakage and arbitrary remote code execution in Syrus cloud devicesDigital Communications Technologies Syrus4 IoT Telematics G…
- CVE-2023-4149WAGO: OS Command Injection Vulnerability in Managed SwitchWAGO Industrial Managed Switch
- CVE-2023-42770Red Lion Controls Sixnet RTU Authentication Bypass Using An Alternative Path Or ChannelRed Lion Controls ST-IPm-8460 · Red Lion Controls ST-IPm… +4
- CVE-2023-40151Red Lion Controls Sixnet RTU Exposed Dangerous Method Or FunctionRed Lion Controls ST-IPm-8460 · Red Lion Controls ST-IPm… +4
- CVE-2023-49103An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.
- CVE-2023-49105An issue was discovered in ownCloud owncloud/core before 10.13.1.
High 17
- CVE-2023-48701Statamic CMS vulnerable to Cross-site Scripting via uploaded assetsstatamic cms · statamic/cms
- CVE-2023-48699fastbots Eval Injection vulnerabilityubertidavide fastbots · fastbots
- CVE-2023-48239Nextcloud Server users can make external storage mount points inaccessible for other usersnextcloud security-advisories
- CVE-2023-48228OAuth2: PKCE can be fully circumventedgoauthentik authentik
- CVE-2021-38405Siemens Solid Edge, JT2Go, and Teamcenter Visualization Improper Restriction of Operations within the Bounds of a Memory BufferSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2023-5055L2CAP: Possible Stack based buffer overflow in le_ecred_reconf_req()zephyrproject-rtos Zephyr
- CVE-2023-22516This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 8.1.0, 8.2.0, 9.0.0, 9.1.0, 9.2.0, and 9.3.0 of BambAtlassian Bamboo Data Center · Atlassian Bamboo Server
- CVE-2023-22521This High severity RCE (Remote Code Execution) vulnerability was introduced in version 3.4.6 of Crowd Data Center and Server.Atlassian Crowd Data Center · Atlassian Crowd Server
- CVE-2021-27504Texas Instruments FREERTOS Integer Overflow or WraparoundTexas Instruments CC32XX · Texas Instruments SimpleLink… +3
- CVE-2021-27502Texas Instruments TI-RTOS Integer Overflow or WraparoundTexas Instruments CC32XX · Texas Instruments SimpleLink… +3
- CVE-2023-6235Arbitrary code execution in Duet DisplayDuet Display for Windows 10+
- CVE-2023-5553During internal Axis Security Development Model (ASDM) threat-modelling, a flaw was found in the protection for device tampering (commonly kAxis Communications AB AXIS OS
- CVE-2023-21418Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API irissetup.cgi was vulnerable to path traversal attacks Axis Communications AB AXIS OS
- CVE-2023-21417Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API manageoverlayimage.cgi was vulnerable to path traversaAxis Communications AB AXIS OS
- CVE-2023-21416Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX API dynamicoverlay.cgi was vulnerable to a Denial-of-ServicAxis Communications AB AXIS OS
- CVE-2023-4424bt: hci: DoS and possible RCEzephyrproject-rtos Zephyr
- CVE-2023-49104An issue was discovered in ownCloud owncloud/oauth2 before 0.6.1, when Allow Subdomains is enabled.
Medium, low and unrated 38
- CVE-2023-48700Clear Text Credentials Exposed via Onboarding Tasknautobot-plugin-device-onboarding · nautobot-device-onboard…
- CVE-2023-48307Nextcloud Mail app vulnerable to Server-Side Request Forgerynextcloud security-advisories
- CVE-2023-48306Nextcloud Server DNS pin middleware can be tricked into DNS rebinding allowing SSRFnextcloud security-advisories
- CVE-2023-48305Nextcloud Server user_ldap app logs user passwords in the log file on level debugnextcloud security-advisories
- CVE-2023-48304Nextcloud Server vulnerable to attacker enabling/disabling birthday calendar for any usernextcloud security-advisories
- CVE-2023-48303Nextcloud Server admins can change authentication details of user configured external storagenextcloud security-advisories
- CVE-2023-48302Nextcloud Server vulnerable to Self XSS when pasting HTML into Text app with Ctrl+Shift+Vnextcloud security-advisories
- CVE-2023-48301Nextcloud Server HTML injection in search UI when selecting a circle with HTML in the display namenextcloud security-advisories
- CVE-2023-48299TorchServe ZipSlippytorch serve · torchserve
- CVE-2023-48230Cap'n Proto WebSocket message can cause crashcapnproto
- CVE-2023-6238Kernel: nvme: memory corruption via unprivileged user passthroughkernel · Red Hat Enterprise Linux +1
- CVE-2023-48226OpenReplay HTML Injection vulnerabilityopenreplay
- CVE-2023-47643SuiteCRM has Unauthenticated Graphql Introspection Enabledsalesagility SuiteCRM-Core
- CVE-2023-20274A vulnerability in the installer script of Cisco AppDynamics PHP Agent could allow an authenticated, local attacker to elevate privileges onCisco AppDynamics
- CVE-2023-20272A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to uplCisco Identity Services Engine Software
- CVE-2023-20208A vulnerability in the web-based management interface of Cisco ISE could allow an authenticated, remote attacker to conduct an XSS attack agCisco Identity Services Engine Software
- CVE-2023-20265A vulnerability in the web-based management interface of a small subset of Cisco IP Phones could allow an authenticated, remote attacker to Cisco IP Phones with Multiplatform Firmware · Cisco Session…
- CVE-2023-49061An attacker could have performed HTML template injection via Reader Mode and exfiltrated user information.Mozilla Firefox for iOS
- CVE-2023-49060An attacker could have accessed internal pages or data by ex-filtrating a security key from ReaderMode via the `referrerpolicy` attribute.Mozilla Firefox for iOS
- CVE-2023-6213Memory safety bugs present in Firefox 119.Mozilla Firefox
- CVE-2023-6212Memory safety bugs present in Firefox 119, Firefox ESR 115.4, and Thunderbird 115.4.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-6211If an attacker needed a user to load an insecure http: page and knew that user had enabled HTTPS-only mode, the attacker could have tricked Mozilla Firefox
- CVE-2023-6210When an https: web page created a pop-up from a "javascript:" URL, that pop-up was incorrectly allowed to load blockable content such as ifrMozilla Firefox
- CVE-2023-6209Relative URLs starting with three slashes were incorrectly parsed, and a path-traversal "/../" part in the path could be used to override thMozilla Firefox · Mozilla Thunderbird
- CVE-2023-6208When using X11, text selected by the page using the Selection API was erroneously copied into the primary selection, a temporary storage notMozilla Firefox · Mozilla Thunderbird
- CVE-2023-6207Ownership mismanagement led to a use-after-free in ReadableByteStreams This vulnerability affects Firefox < 120, Firefox ESR < 115.5.0, and Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-6206The black fade animation when exiting fullscreen is roughly the length of the anti-clickjacking delay on permission prompts.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-6205It was possible to cause the use of a MessagePort after it had already been freed, which could potentially have led to an exploitable crash.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-6204On some systems—depending on the graphics settings and drivers—it was possible to force an out-of-bounds read and leak memory data into the Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-28802Disable Zscaler using machine tunnel restartZscaler Client Connector
- CVE-2023-5598Stored Cross-site Scripting (XSS) vulnerabilities affecting 3DSwym in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023xDassault Systèmes 3DSwymer
- CVE-2023-5599Stored Cross-site Scripting (XSS) vulnerability affecting 3DDashboard in 3DSwymer from Release 3DEXPERIENCE R2022x through Release 3DEXPERIENCE R2023xDassault Systèmes 3DSwymer
- CVE-2023-5776Post Meta Data Manager <= 1.2.1 - Cross-Site Request Forgery to Post, Term, and User Meta Deletiongandhihitesh9 Post Meta Data Manager
- CVE-2023-5275Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition Mitsubishi Electric GX Works2
- CVE-2023-5274Improper Input Validation vulnerability in simulation function of GX Works2 allows an attacker to cause a denial-of-service (DoS) condition Mitsubishi Electric GX Works2
- CVE-2023-45886The BGP daemon (bgpd) in IP Infusion ZebOS through 7.10.6 allow remote attackers to cause a denial of service by sending crafted BGP update
- CVE-2023-46935eyoucms v1.6.4 is vulnerable Cross Site Scripting (XSS), which can lead to stealing sensitive information of logged-in users.
- CVE-2023-48124Cross Site Scripting in SUP Online Shopping v.1.0 allows a remote attacker to execute arbitrary code via the Name, Email and Address paramet