CVEs published November 22, 2023
168 CVEs were published on November 22, 2023: 6 critical, 33 high.
- Published
- 168
- Critical
- 6
- High
- 33
- Medium
- 96
- Low
- 5
- Unrated
- 28
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- UserPro - Community and User Profile WordPress Plugin
- 11
- Interactive Contact Form and Multi Step Form Builder with D…
- 10
- Elastic Kibana
- 3
- Fuji Electric Tellus Lite V-Simulator
- 3
- Autodesk Customer Portal
- 2
- Checkmk
- 2
- Cisco Secure Client
- 2
- DECE Software Geodi
- 2
- LayerSlider
- 2
- M-Files Server
- 2
Critical 6
- CVE-2023-2449UserPro <= 5.1.1 - Insecure Password Reset MechanismUserPro - Community and User Profile WordPress Plugin
- CVE-2023-2437UserPro <= 5.1.1 - Authentication Bypass to AdministratorUserPro - Community and User Profile WordPress Plugin
- CVE-2023-2889SQLi in Veon Computer's Service Tracking SoftwareVeon Computer Service Tracking Software
- CVE-2023-5047SQLi in DRDriveDRD Fleet Leasing DRDrive
- CVE-2023-37924Apache Submarine: SQL injection from unauthorized loginApache Software Foundation Apache Submarine · apache-submar…
- CVE-2023-45377In the module "Chronopost Official" (chronopost) for PrestaShop, a guest can perform SQL injection.
High 33
- CVE-2023-30581The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.jsoNodeJS Node
- CVE-2023-47790WordPress Pz-LinkCard Plugin <= 2.4.8 is vulnerable to Cross Site Request Forgery (CSRF)Poporon Pz-LinkCard
- CVE-2023-47773WordPress Permalinks Customizer Plugin <= 2.8.2 is vulnerable to Cross Site Scripting (XSS)YAS Global Team Permalinks Customizer
- CVE-2023-47768WordPress Footer Putter Plugin <= 1.17 is vulnerable to Cross Site Scripting (XSS)Russell Jamieson Footer Putter
- CVE-2023-47767WordPress Interactive World Map Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)Fla-shop.com Interactive World Map
- CVE-2023-47766WordPress Post Status Notifier Lite Plugin <= 1.11.0 is vulnerable to Cross Site Scripting (XSS)Timo Reith Post Status Notifier Lite
- CVE-2023-30496WordPress Bus Ticket Booking with Seat Reservation Plugin <= 5.2.5 is vulnerable to Cross Site Scripting (XSS)MagePeople Team WpBusTicketly
- CVE-2023-47785WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Request Forgery (CSRF)LayerSlider
- CVE-2023-47781WordPress Thrive Theme Builder Theme < 3.24.2 is vulnerable to Cross Site Request Forgery (CSRF)Thrive Themes Thrive Theme Builder
- CVE-2023-6263Server Spoofing Vulnerability in NxCloudNetwork Optix NxCloud
- CVE-2023-6157Livestatus injection in ajax_searchCheckmk
- CVE-2023-6156Livestatus injection in availability timelineCheckmk
- CVE-2023-43082 Dell Unity prior to 5.3 contains a 'man in the middle' vulnerability in the vmadapter component.Dell Unity
- CVE-2023-2497UserPro <= 5.1.0 - Cross-Site Request Forgery to PHP Object InjectionUserPro - Community and User Profile WordPress Plugin
- CVE-2023-6009UserPro <= 5.1.4 - Authenticated (Subscriber+) Privilege EscalationUserPro - Community and User Profile WordPress Plugin
- CVE-2023-5465Popup with fancybox <= 3.5 - Authenticated (Subscriber+) SQL Injection via Shortcodegopiplushotmailcom Popup with fancybox
- CVE-2023-2440UserPro <= 5.1.1 - Cross-Site Request Forgery to Privilege EscalationUserPro - Community and User Profile WordPress Plugin
- CVE-2023-6007UserPro <= 5.1.1 - Missing Authorization via multiple functionsUserPro - Community and User Profile WordPress Plugin
- CVE-2023-5466Wp anything slider <= 9.1 - Authenticated (Subscriber+) SQL Injection via Shortcodegopi_plus Wp anything slider
- CVE-2023-5815News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusioninfornweb Blog Designer Pack – Blog, Post Grid, Post Slider…
- CVE-2023-5822Drag and Drop Multiple File Upload - Contact Form 7 <= 1.3.7.3 - Unauthenticated Arbitrary File Uploadglenwpcoder Drag and Drop Multiple File Upload for Contact…
- CVE-2023-2841Advanced Local Pickup for WooCommerce <= 1.5.5 - Authenticated (Administrator+) SQL InjectionZorem Local Pickup
- CVE-2023-48705nautobot has XSS potential in custom links, job buttons, and computed fieldsnautobot
- CVE-2023-27451WordPress Instant Images Plugin <= 5.1.0.2 is vulnerable to Server Side Request Forgery (SSRF)Darren Cooney Instant Images
- CVE-2023-6252Path traversal vulnerability in Chameleon Power productsChameleon Power
- CVE-2023-5983Information Disclosure in Botanik Software Pharmacy AutomationBotanik Software Pharmacy Automation
- CVE-2023-3103Authentication Bypass by Spoofing in Unitree Robotics A1Unitree Robotics A1
- CVE-2023-5921Function Bypass in GeodiDECE Software Geodi
- CVE-2021-37942APM Java Agent Local Privilege EscalationElastic APM Java Agent · co.elastic.apm:apm-agent-parent +1
- CVE-2023-35127Fuji Electric Tellus Lite V-Simulator Stack-based Buffer OverflowFuji Electric Tellus Lite V-Simulator
- CVE-2023-40152Fuji Electric Tellus Lite V-Simulator Out-of-bounds WriteFuji Electric Tellus Lite V-Simulator
- CVE-2023-5299Fuji Electric Tellus Lite V-Simulator Improper Access ControlFuji Electric Tellus Lite V-Simulator
- CVE-2023-47016radare2 5.8.9 has an out-of-bounds read in r_bin_object_set_items in libr/bin/bobj.c, causing a crash in r_read_le32 in libr/include/r_endia
Medium, low and unrated 129
- CVE-2023-40002WordPress Booster for WooCommerce Plugin <= 7.1.1 is vulnerable to Sensitive Data ExposurePluggabl Booster for WooCommerce
- CVE-2023-23978WordPress WP Client Reports Plugin <= 1.0.16 is vulnerable to Sensitive Data ExposureSwitchWP WP Client Reports
- CVE-2023-47839WordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Cross Site Scripting (XSS)impleCode eCommerce Product Catalog Plugin for WordPress
- CVE-2023-47835WordPress ARI Stream Quiz Plugin <= 1.2.32 is vulnerable to Cross Site Scripting (XSS)ARI Soft ARI Stream Quiz – WordPress Quizzes Builder
- CVE-2023-47834WordPress Quiz And Survey Master Plugin <= 8.1.13 is vulnerable to Cross Site Scripting (XSS)ExpressTech Quiz And Survey Master
- CVE-2023-47833WordPress Theater for WordPress Plugin <= 0.18.3 is vulnerable to Cross Site Scripting (XSS)Jeroen Schmit Theater for WordPress
- CVE-2023-47831WordPress DrawIt (draw.io) Plugin <= 1.1.3 is vulnerable to Cross Site Scripting (XSS)assorted[chips] DrawIt
- CVE-2023-47829WordPress Quick Call Button Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)Codez Quick Call Button
- CVE-2023-47821WordPress Email Encoder Bundle Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)Jannis Thuemmig Email Encoder
- CVE-2023-47817WordPress Daily Prayer Time Plugin <= 2023.10.13 is vulnerable to Cross Site Scripting (XSS)mmrs151 Daily Prayer Time
- CVE-2023-47816WordPress Charitable Plugin <= 1.7.0.13 is vulnerable to Cross Site Scripting (XSS)Charitable Donations & Fundraising Team Donation Forms by C…
- CVE-2023-47815WordPress BP Profile Shortcodes Extra Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS)Venutius BP Profile Shortcodes Extra
- CVE-2023-47814WordPress BMI Calculator Plugin Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)Waterloo Plugins BMI Calculator Plugin
- CVE-2023-47813WordPress Better RSS Widget Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)grandslambert Better RSS Widget
- CVE-2023-47812WordPress Bamboo Columns Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)Bamboo Mcr Bamboo Columns
- CVE-2023-47811WordPress Anywhere Flash Embed Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)Suresh KUMAR Mukhiya Anywhere Flash Embed
- CVE-2023-47810WordPress Ajax Domain Checker Plugin <= 1.3.0 is vulnerable to Cross Site Scripting (XSS)Asdqwe Dev Ajax Domain Checker
- CVE-2023-47809WordPress Accordion Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)Themepoints Accordion
- CVE-2023-47808WordPress Add Widgets to Page Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)Christina Uechi Add Widgets to Page
- CVE-2023-47786WordPress LayerSlider Plugin <= 7.7.9 is vulnerable to Cross Site Scripting (XSS)LayerSlider
- CVE-2023-48706Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhitevim
- CVE-2023-47759WordPress Chaty plugin <= 3.1.2 - Cross Site Scripting (XSS) vulnerabilityPremio Chaty
- CVE-2023-6265DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversalDrayTek Vigor2960
- CVE-2023-47825WordPress WP EXtra Plugin <= 6.4 is vulnerable to Cross Site Request Forgery (CSRF)TienCOP WP EXtra
- CVE-2023-47824WordPress Legal Pages Plugin <= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF)wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDP…
- CVE-2023-47819WordPress Easy Call Now by ThikShare Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF)Dang Ngoc Binh Easy Call Now by ThikShare
- CVE-2023-25682IBM Sterling B2B Integrator information disclosureIBM Sterling B2B Integrator Standard Edition
- CVE-2023-39925WordPress Community by PeepSo Plugin <= 6.1.6.0 is vulnerable to Cross Site Request Forgery (CSRF)Download Community by PeepSo
- CVE-2023-47792WordPress Big File Uploads Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)Infinite Uploads Big File Uploads – Increase Maximum File U…
- CVE-2023-6264Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configureDevolutions Server
- CVE-2023-47791WordPress Leadster Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)Leadster
- CVE-2022-36777IBM Cloud Pak for Security information disclosureIBM Cloud Pak for Security · IBM QRadar Suite Software
- CVE-2023-47775WordPress wpDiscuz Plugin <= 7.6.11 is vulnerable to Cross Site Request Forgery (CSRF)gVectors Team Comments — wpDiscuz
- CVE-2023-47765WordPress CodeBard's Patron Button and Widgets for Patreon Plugin <= 2.1.9 is vulnerable to Cross Site Request Forgery (CSRF)CodeBard's Patron Button and Widgets for Patreon
- CVE-2023-47758WordPress Multi Step Form Plugin <= 1.7.11 is vulnerable to Cross Site Request Forgery (CSRF)Mondula Multi Step Form
- CVE-2023-47755WordPress WooCommerce Product Carousel Slider Plugin <= 3.3.5 is vulnerable to Cross Site Scripting (XSS)AazzTech WooCommerce Product Carousel Slider
- CVE-2023-25986WordPress PayGreen Plugin <= 4.10.2 is vulnerable to Cross Site Request Forgery (CSRF)WattIsIt PayGreen – Ancienne version
- CVE-2023-25987WordPress YouTube Channel Plugin <= 3.23.3 is vulnerable to Cross Site Request Forgery (CSRF)Aleksandar Urošević My YouTube Channel
- CVE-2023-20241Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local atCisco Secure Client
- CVE-2023-20240Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local atCisco Secure Client
- CVE-2023-20084A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpointCisco Secure Endpoint
- CVE-2023-5704CPO Shortcodes <= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpchill CPO Shortcodes
- CVE-2023-6008UserPro <= 5.1.1 - Cross-Site Request Forgery via multiple functionsUserPro - Community and User Profile WordPress Plugin
- CVE-2023-5385Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post DuplicationInteractive Contact Form and Multi Step Form Builder with D…
- CVE-2023-5715Website Optimization – Plerdy <= 1.3.2 - Authenticated (Admin+) Stored Cross-Site ScriptingWebsite Optimization – Plerdy
- CVE-2023-5708WP Post Columns <= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodesammyb WP Post Columns
- CVE-2023-5383Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post DuplicationInteractive Contact Form and Multi Step Form Builder with D…
- CVE-2023-5387Funnelforms Free <= 3.4 - Missing Authorization to Enable/Disable Dark ModeInteractive Contact Form and Multi Step Form Builder with D…
- CVE-2023-5163Weather Atlas Widget <= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeweatheratlas Weather Atlas Widget
- CVE-2023-5469Drop Shadow Boxes <= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodestevehenty Drop Shadow Boxes
- CVE-2023-5234Related Products for WooCommerce <= 3.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodepeachpay Related Products for WooCommerce
- CVE-2023-5416Funnelforms Free <= 3.4 - Missing Authorization to Category DeletionInteractive Contact Form and Multi Step Form Builder with D…
- CVE-2023-5314WP EXtra <= 6.2 - Missing Authorization to Arbitrary Email Sendingwpvncom WP EXtra – One Click Optimize
- CVE-2023-5664Garden Gnome Package <= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeggnomes Garden Gnome Package
- CVE-2023-5338Theme Blvd Shortcodes <= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodethemeblvd Theme Blvd Shortcodes
- CVE-2023-5411Funnelforms Free <= 3.4 - Missing Authorization to Post ModificationInteractive Contact Form and Multi Step Form Builder with D…
- CVE-2023-2438UserPro <= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro_save_userdataUserPro - Community and User Profile WordPress Plugin
- CVE-2023-2448UserPro <= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro_shortcode_templateUserPro - Community and User Profile WordPress Plugin
- CVE-2023-4726Ultimate Dashboard <= 3.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settingsdavidvongries Ultimate Dashboard – Custom WordPress Dashboa…
- CVE-2023-6164MainWP Dashboard <= 4.5.1.2 - Authenticated(Administrator+) CSS InjectionMainWP Dashboard: Self-hosted WordPress Management for Agen…
- CVE-2023-5382Funnelforms Free <= 3.4 - Cross-Site Request Forgery to Arbitrary Post DeletionInteractive Contact Form and Multi Step Form Builder with D…
- CVE-2023-5048WDContactFormBuilder <= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode10web WDContactFormBuilder
- CVE-2023-5415Funnelforms Free <= 3.4 - Missing Authorization to New Category CreationInteractive Contact Form and Multi Step Form Builder with D…
- CVE-2023-6160LifterLMS <= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletionchrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…
- CVE-2023-5419Funnelforms Free <= 3.4 - Missing Authorization to Test Email SendingInteractive Contact Form and Multi Step Form Builder with D…
- CVE-2023-5128TCD Google Maps <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodedesignplus TCD Google Maps
- CVE-2023-5662Sponsors <= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeibenic Sponsors
- CVE-2023-5386Funnelforms Free <= 3.4 - Missing Authorization to Arbitrary Post DeletionInteractive Contact Form and Multi Step Form Builder with D…
- CVE-2023-5742EasyRotator for WordPress <= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodedwusercom EasyRotator for WordPress – Slider Plugin
- CVE-2023-4686WP Customer Reviews <= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposurebompus WP Customer Reviews
- CVE-2023-5537Delete Usermetas <= 1.1.2 - Cross-Site Request Forgeryjose-lazo Delete Usermetas
- CVE-2023-5096HTML filter and csv-file search <= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodejonashjalmarsson HTML filter and csv-file search
- CVE-2023-5417Funnelforms Free <= 3.4 - Missing Authorization to Category UpdateInteractive Contact Form and Multi Step Form Builder with D…
- CVE-2023-5667Tab Ultimate <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodethemepoints Tab Ultimate
- CVE-2023-5706VK Blocks <= 1.63.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Blockvektor-inc VK Blocks
- CVE-2023-26542WordPress phpinfo() WP Plugin <= 4.0 is vulnerable to Cross Site Request Forgery (CSRF)Exeebit phpinfo() WP
- CVE-2023-26535WordPress Sheets To WP Table Live Sync Plugin <= 2.12.15 is vulnerable to Cross Site Request Forgery (CSRF)WPPOOL Sheets To WP Table Live Sync
- CVE-2023-26532WordPress Social Auto Poster Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)AccessPress Themes Social Auto Poster
- CVE-2023-27457WordPress Add Expires Headers & Optimized Minify Plugin <= 2.7 is vulnerable to Cross Site Request Forgery (CSRF)Passionate Brains Add Expires Headers & Optimized Minify
- CVE-2023-27458WordPress WpStream – Live Streaming, Video on Demand, Pay Per View Plugin <= 4.4.10 is vulnerable to Cross Site Request Forgery (CSRF)WpStream
- CVE-2023-27461WordPress When Last Login Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)Yoohoo Plugins When Last Login
- CVE-2023-27453WordPress LWS Tools Plugin <= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF)LWS Tools
- CVE-2023-27442WordPress Leyka Plugin <= 3.29.2 is vulnerable to Cross Site Request Forgery (CSRF)Teplitsa of social technologies Leyka
- CVE-2023-27444WordPress DecaLog Plugin <= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF)Pierre Lannoy / PerfOps One DecaLog
- CVE-2023-27446WordPress DeepL Pro API translation Plugin <= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF)Fluenx DeepL API translation plugin
- CVE-2023-27633WordPress Customify Plugin <= 2.10.4 is vulnerable to Cross Site Request Forgery (CSRF)Pixelgrade Customify – Intuitive Website Styling
- CVE-2023-28747WordPress CBX Currency Converter Plugin <= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF)codeboxr CBX Currency Converter
- CVE-2023-28749WordPress CM On Demand Search And Replace Plugin <= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF)CreativeMindsSolutions CM On Demand Search And Replace
- CVE-2023-43081 PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in ddfscon component.Dell PowerProtect Agent for File System
- CVE-2023-3104Missing Authentication for Critical Function in Unitree Robotics A1Unitree Robotics A1
- CVE-2023-6253Saved Uninstall Key in Digital Guardian Agent UninstallerFortra Digital Guardian Agent
- CVE-2023-6189Improper Permission Handling in M-Files ServerM-Files Server
- CVE-2023-6117M-Files REST API allows Denial of ServiceM-Files Server
- CVE-2023-46673It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when Elasticsearch · org.elasticsearch:elasticsearch
- CVE-2023-6011Stored XSS in GeodiDECE Software Geodi
- CVE-2023-2446UserPro <= 5.1.1 - Sensitive Information Disclosure via ShortcodeUserPro - Community and User Profile WordPress Plugin
- CVE-2023-2447UserPro <= 5.1.1 - Cross-Site Request Forgery to Sensitive Information ExposureUserPro - Community and User Profile WordPress Plugin
- CVE-2023-41146Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account.Autodesk Customer Portal
- CVE-2023-41145Autodesk users who no longer have an active license for an account can still access cases for that account.Autodesk Customer Portal
- CVE-2023-29069A maliciously crafted DLL file can be forced to install onto a non-default location, and attacker can overwrite parts of the product with maAutodesk Desktop Connector
- CVE-2022-35638IBM Sterling B2B Integrator cross-site request forgeryIBM Sterling B2B Integrator
- CVE-2021-37937Elasticsearch privilege escalationElasticsearch
- CVE-2021-22143Elastic APM .NET Agent information disclosureElastic APM .NET Agent · Elastic.Apm
- CVE-2021-22142Kibana Reporting vulnerabilitiesElastic Kibana
- CVE-2021-22151Kibana path traversal issueElastic Kibana
- CVE-2021-22150Kibana code execution issueElastic Kibana
- CVE-2023-43887Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num_tile_columns and num_tile_row parameters in the function pi
- CVE-2023-46357In the module "Cross Selling in Modal Cart" (motivationsale) < 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection.
- CVE-2023-46814A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows.
- CVE-2023-47014A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP with Source Code v.1.0 allows a local attacke
- CVE-2023-47250In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attack
- CVE-2023-47251In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows a
- CVE-2023-47312Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries.
- CVE-2023-47313Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal.
- CVE-2023-47314Headwind MDM Web panel 5.22.1 is vulnerable to cross-site scripting (XSS).
- CVE-2023-47315Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret.
- CVE-2023-47316Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control.
- CVE-2023-47350Cross-Site Request Forgery (CSRF) vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalateswiftyedit/swiftyedit
- CVE-2023-47380Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS).admidio/admidio
- CVE-2023-47392An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add
- CVE-2023-47393An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of other users and access s
- CVE-2023-47467Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file dirorg.jeecgframework.boot:jeecg-boot-common
- CVE-2023-48105An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of
- CVE-2023-48106Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_r
- CVE-2023-48107Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz_path_h
- CVE-2023-48161Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RG
- CVE-2023-48646Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings.
- CVE-2023-49102NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions.
- CVE-2023-49146DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressiorhukster/dom-sanitizer