# CVEs published 2023-11-22

168 CVEs were published on November 22, 2023: 6 critical, 33 high. Days are UTC.

- [CVE-2023-40002](https://cve.now/CVE-2023-40002.md): WordPress Booster for WooCommerce Plugin \<= 7.1.1 is vulnerable to Sensitive Data Exposure (CVSS 6.5, Pluggabl Booster for WooCommerce)
- [CVE-2023-23978](https://cve.now/CVE-2023-23978.md): WordPress WP Client Reports Plugin \<= 1.0.16 is vulnerable to Sensitive Data Exposure (CVSS 4.3, SwitchWP WP Client Reports)
- [CVE-2023-30581](https://cve.now/CVE-2023-30581.md): The use of \_\_proto\_\_ in process.mainModule.\_\_proto\_\_.require() can bypass the policy mechanism and require modules outside of the policy.jso (CVSS 7.5, NodeJS Node)
- [CVE-2023-47790](https://cve.now/CVE-2023-47790.md): WordPress Pz-LinkCard Plugin \<= 2.4.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, Poporon Pz-LinkCard)
- [CVE-2023-47839](https://cve.now/CVE-2023-47839.md): WordPress eCommerce Product Catalog Plugin \<= 3.3.26 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, impleCode eCommerce Product Catalog Plugin for WordPress)
- [CVE-2023-47835](https://cve.now/CVE-2023-47835.md): WordPress ARI Stream Quiz Plugin \<= 1.2.32 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, ARI Soft ARI Stream Quiz – WordPress Quizzes Builder)
- [CVE-2023-47834](https://cve.now/CVE-2023-47834.md): WordPress Quiz And Survey Master Plugin \<= 8.1.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, ExpressTech Quiz And Survey Master)
- [CVE-2023-47833](https://cve.now/CVE-2023-47833.md): WordPress Theater for WordPress Plugin \<= 0.18.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Jeroen Schmit Theater for WordPress)
- [CVE-2023-47831](https://cve.now/CVE-2023-47831.md): WordPress DrawIt (draw.io) Plugin \<= 1.1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, assorted\[chips\] DrawIt)
- [CVE-2023-47829](https://cve.now/CVE-2023-47829.md): WordPress Quick Call Button Plugin \<= 1.2.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Codez Quick Call Button)
- [CVE-2023-47821](https://cve.now/CVE-2023-47821.md): WordPress Email Encoder Bundle Plugin \<= 2.1.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Jannis Thuemmig Email Encoder)
- [CVE-2023-47817](https://cve.now/CVE-2023-47817.md): WordPress Daily Prayer Time Plugin \<= 2023.10.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, mmrs151 Daily Prayer Time)
- [CVE-2023-47816](https://cve.now/CVE-2023-47816.md): WordPress Charitable Plugin \<= 1.7.0.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Charitable Donations & Fundraising Team Donation Forms by C…)
- [CVE-2023-47815](https://cve.now/CVE-2023-47815.md): WordPress BP Profile Shortcodes Extra Plugin \<= 2.5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Venutius BP Profile Shortcodes Extra)
- [CVE-2023-47814](https://cve.now/CVE-2023-47814.md): WordPress BMI Calculator Plugin Plugin \<= 1.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Waterloo Plugins BMI Calculator Plugin)
- [CVE-2023-47813](https://cve.now/CVE-2023-47813.md): WordPress Better RSS Widget Plugin \<= 2.8.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, grandslambert Better RSS Widget)
- [CVE-2023-47812](https://cve.now/CVE-2023-47812.md): WordPress Bamboo Columns Plugin \<= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Bamboo Mcr Bamboo Columns)
- [CVE-2023-47811](https://cve.now/CVE-2023-47811.md): WordPress Anywhere Flash Embed Plugin \<= 1.0.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Suresh KUMAR Mukhiya Anywhere Flash Embed)
- [CVE-2023-47810](https://cve.now/CVE-2023-47810.md): WordPress Ajax Domain Checker Plugin \<= 1.3.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Asdqwe Dev Ajax Domain Checker)
- [CVE-2023-47809](https://cve.now/CVE-2023-47809.md): WordPress Accordion Plugin \<= 2.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Themepoints Accordion)
- [CVE-2023-47808](https://cve.now/CVE-2023-47808.md): WordPress Add Widgets to Page Plugin \<= 1.3.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Christina Uechi Add Widgets to Page)
- [CVE-2023-47786](https://cve.now/CVE-2023-47786.md): WordPress LayerSlider Plugin \<= 7.7.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, LayerSlider)
- [CVE-2023-47773](https://cve.now/CVE-2023-47773.md): WordPress Permalinks Customizer Plugin \<= 2.8.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, YAS Global Team Permalinks Customizer)
- [CVE-2023-48706](https://cve.now/CVE-2023-48706.md): Vim has heap-use-after-free at /src/charset.c:1770:12 in skipwhite (CVSS 3.6, vim)
- [CVE-2023-47768](https://cve.now/CVE-2023-47768.md): WordPress Footer Putter Plugin \<= 1.17 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Russell Jamieson Footer Putter)
- [CVE-2023-47767](https://cve.now/CVE-2023-47767.md): WordPress Interactive World Map Plugin \<= 3.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Fla-shop.com Interactive World Map)
- [CVE-2023-47766](https://cve.now/CVE-2023-47766.md): WordPress Post Status Notifier Lite Plugin \<= 1.11.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Timo Reith Post Status Notifier Lite)
- [CVE-2023-47759](https://cve.now/CVE-2023-47759.md): WordPress Chaty plugin \<= 3.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Premio Chaty)
- [CVE-2023-6265](https://cve.now/CVE-2023-6265.md): DrayTek Vigor2960 mainfunction.cgi dumpSyslog 'option' directory traversal (CVSS 6.5, DrayTek Vigor2960)
- [CVE-2023-30496](https://cve.now/CVE-2023-30496.md): WordPress Bus Ticket Booking with Seat Reservation Plugin \<= 5.2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, MagePeople Team WpBusTicketly)
- [CVE-2023-47825](https://cve.now/CVE-2023-47825.md): WordPress WP EXtra Plugin \<= 6.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, TienCOP WP EXtra)
- [CVE-2023-47824](https://cve.now/CVE-2023-47824.md): WordPress Legal Pages Plugin \<= 1.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, wpWax Legal Pages – Privacy Policy, Terms & Conditions, GDP…)
- [CVE-2023-47819](https://cve.now/CVE-2023-47819.md): WordPress Easy Call Now by ThikShare Plugin \<= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Dang Ngoc Binh Easy Call Now by ThikShare)
- [CVE-2023-25682](https://cve.now/CVE-2023-25682.md): IBM Sterling B2B Integrator information disclosure (CVSS 6.2, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2023-39925](https://cve.now/CVE-2023-39925.md): WordPress Community by PeepSo Plugin \<= 6.1.6.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Download Community by PeepSo)
- [CVE-2023-47792](https://cve.now/CVE-2023-47792.md): WordPress Big File Uploads Plugin \<= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Infinite Uploads Big File Uploads – Increase Maximum File U…)
- [CVE-2023-6264](https://cve.now/CVE-2023-6264.md): Information leak in Content-Security-Policy header in Devolutions Server 2023.3.7.0 allows an unauthenticated attacker to list the configure (no CVSS, Devolutions Server)
- [CVE-2023-47791](https://cve.now/CVE-2023-47791.md): WordPress Leadster Plugin \<= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Leadster)
- [CVE-2023-47785](https://cve.now/CVE-2023-47785.md): WordPress LayerSlider Plugin \<= 7.7.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, LayerSlider)
- [CVE-2022-36777](https://cve.now/CVE-2022-36777.md): IBM Cloud Pak for Security information disclosure (CVSS 4.3, IBM Cloud Pak for Security · IBM QRadar Suite Software)
- [CVE-2023-47781](https://cve.now/CVE-2023-47781.md): WordPress Thrive Theme Builder Theme \< 3.24.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8, Thrive Themes Thrive Theme Builder)
- [CVE-2023-47775](https://cve.now/CVE-2023-47775.md): WordPress wpDiscuz Plugin \<= 7.6.11 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, gVectors Team Comments — wpDiscuz)
- [CVE-2023-47765](https://cve.now/CVE-2023-47765.md): WordPress CodeBard's Patron Button and Widgets for Patreon Plugin \<= 2.1.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, CodeBard's Patron Button and Widgets for Patreon)
- [CVE-2023-47758](https://cve.now/CVE-2023-47758.md): WordPress Multi Step Form Plugin \<= 1.7.11 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Mondula Multi Step Form)
- [CVE-2023-47755](https://cve.now/CVE-2023-47755.md): WordPress WooCommerce Product Carousel Slider Plugin \<= 3.3.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, AazzTech WooCommerce Product Carousel Slider)
- [CVE-2023-6263](https://cve.now/CVE-2023-6263.md): Server Spoofing Vulnerability in NxCloud (CVSS 8.3, Network Optix NxCloud)
- [CVE-2023-25986](https://cve.now/CVE-2023-25986.md): WordPress PayGreen Plugin \<= 4.10.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WattIsIt PayGreen – Ancienne version)
- [CVE-2023-25987](https://cve.now/CVE-2023-25987.md): WordPress YouTube Channel Plugin \<= 3.23.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Aleksandar Urošević My YouTube Channel)
- [CVE-2023-20241](https://cve.now/CVE-2023-20241.md): Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local at (CVSS 5.5, Cisco Secure Client)
- [CVE-2023-20240](https://cve.now/CVE-2023-20240.md): Multiple vulnerabilities in Cisco Secure Client Software, formerly AnyConnect Secure Mobility Client, could allow an authenticated, local at (CVSS 5.5, Cisco Secure Client)
- [CVE-2023-20084](https://cve.now/CVE-2023-20084.md): A vulnerability in the endpoint software of Cisco Secure Endpoint for Windows could allow an authenticated, local attacker to evade endpoint (CVSS 5.0, Cisco Secure Endpoint)
- [CVE-2023-6157](https://cve.now/CVE-2023-6157.md): Livestatus injection in ajax\_search (CVSS 7.6, Checkmk)
- [CVE-2023-6156](https://cve.now/CVE-2023-6156.md): Livestatus injection in availability timeline (CVSS 7.6, Checkmk)
- [CVE-2023-43082](https://cve.now/CVE-2023-43082.md): Dell Unity prior to 5.3 contains a 'man in the middle' vulnerability in the vmadapter component. (CVSS 8.6, Dell Unity)
- [CVE-2023-2497](https://cve.now/CVE-2023-2497.md): UserPro \<= 5.1.0 - Cross-Site Request Forgery to PHP Object Injection (CVSS 8.8, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-5704](https://cve.now/CVE-2023-5704.md): CPO Shortcodes \<= 1.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpchill CPO Shortcodes)
- [CVE-2023-6008](https://cve.now/CVE-2023-6008.md): UserPro \<= 5.1.1 - Cross-Site Request Forgery via multiple functions (CVSS 6.3, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-6009](https://cve.now/CVE-2023-6009.md): UserPro \<= 5.1.4 - Authenticated (Subscriber+) Privilege Escalation (CVSS 8.8, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-5385](https://cve.now/CVE-2023-5385.md): Funnelforms Free \<= 3.4 - Missing Authorization to Arbitrary Post Duplication (CVSS 4.3, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2023-2449](https://cve.now/CVE-2023-2449.md): UserPro \<= 5.1.1 - Insecure Password Reset Mechanism (CVSS 9.8, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-5715](https://cve.now/CVE-2023-5715.md): Website Optimization – Plerdy \<= 1.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, Website Optimization – Plerdy)
- [CVE-2023-5708](https://cve.now/CVE-2023-5708.md): WP Post Columns \<= 2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, sammyb WP Post Columns)
- [CVE-2023-5383](https://cve.now/CVE-2023-5383.md): Funnelforms Free \<= 3.4 - Cross-Site Request Forgery to Arbitrary Post Duplication (CVSS 4.3, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2023-5387](https://cve.now/CVE-2023-5387.md): Funnelforms Free \<= 3.4 - Missing Authorization to Enable/Disable Dark Mode (CVSS 4.3, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2023-5465](https://cve.now/CVE-2023-5465.md): Popup with fancybox \<= 3.5 - Authenticated (Subscriber+) SQL Injection via Shortcode (CVSS 8.8, gopiplushotmailcom Popup with fancybox)
- [CVE-2023-5163](https://cve.now/CVE-2023-5163.md): Weather Atlas Widget \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, weatheratlas Weather Atlas Widget)
- [CVE-2023-5469](https://cve.now/CVE-2023-5469.md): Drop Shadow Boxes \<= 1.7.13 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, stevehenty Drop Shadow Boxes)
- [CVE-2023-2437](https://cve.now/CVE-2023-2437.md): UserPro \<= 5.1.1 - Authentication Bypass to Administrator (CVSS 9.8, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-5234](https://cve.now/CVE-2023-5234.md): Related Products for WooCommerce \<= 3.3.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, peachpay Related Products for WooCommerce)
- [CVE-2023-5416](https://cve.now/CVE-2023-5416.md): Funnelforms Free \<= 3.4 - Missing Authorization to Category Deletion (CVSS 4.3, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2023-5314](https://cve.now/CVE-2023-5314.md): WP EXtra \<= 6.2 - Missing Authorization to Arbitrary Email Sending (CVSS 4.3, wpvncom WP EXtra – One Click Optimize)
- [CVE-2023-5664](https://cve.now/CVE-2023-5664.md): Garden Gnome Package \<= 2.2.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ggnomes Garden Gnome Package)
- [CVE-2023-5338](https://cve.now/CVE-2023-5338.md): Theme Blvd Shortcodes \<= 1.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, themeblvd Theme Blvd Shortcodes)
- [CVE-2023-5411](https://cve.now/CVE-2023-5411.md): Funnelforms Free \<= 3.4 - Missing Authorization to Post Modification (CVSS 4.3, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2023-2438](https://cve.now/CVE-2023-2438.md): UserPro \<= 5.1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting via userpro\_save\_userdata (CVSS 6.1, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-2448](https://cve.now/CVE-2023-2448.md): UserPro \<= 5.1.4 - Missing Authorization to Arbitrary Shortcode Execution via userpro\_shortcode\_template (CVSS 6.5, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-4726](https://cve.now/CVE-2023-4726.md): Ultimate Dashboard \<= 3.7.7 - Authenticated (Administrator+) Stored Cross-Site Scripting via plugin settings (CVSS 4.4, davidvongries Ultimate Dashboard – Custom WordPress Dashboa…)
- [CVE-2023-6164](https://cve.now/CVE-2023-6164.md): MainWP Dashboard \<= 4.5.1.2 - Authenticated(Administrator+) CSS Injection (CVSS 2.2, MainWP Dashboard: Self-hosted WordPress Management for Agen…)
- [CVE-2023-2440](https://cve.now/CVE-2023-2440.md): UserPro \<= 5.1.1 - Cross-Site Request Forgery to Privilege Escalation (CVSS 8.8, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-5382](https://cve.now/CVE-2023-5382.md): Funnelforms Free \<= 3.4 - Cross-Site Request Forgery to Arbitrary Post Deletion (CVSS 6.5, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2023-5048](https://cve.now/CVE-2023-5048.md): WDContactFormBuilder \<= 1.0.72 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, 10web WDContactFormBuilder)
- [CVE-2023-5415](https://cve.now/CVE-2023-5415.md): Funnelforms Free \<= 3.4 - Missing Authorization to New Category Creation (CVSS 4.3, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2023-6160](https://cve.now/CVE-2023-6160.md): LifterLMS \<= 7.4.2 - Authenticated(Administrator+) Directory Traversal to Arbitrary CSV File Deletion (CVSS 3.3, chrisbadgett LifterLMS – WP LMS for eLearning, Online Cours…)
- [CVE-2023-6007](https://cve.now/CVE-2023-6007.md): UserPro \<= 5.1.1 - Missing Authorization via multiple functions (CVSS 7.3, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-5419](https://cve.now/CVE-2023-5419.md): Funnelforms Free \<= 3.4 - Missing Authorization to Test Email Sending (CVSS 4.3, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2023-5466](https://cve.now/CVE-2023-5466.md): Wp anything slider \<= 9.1 - Authenticated (Subscriber+) SQL Injection via Shortcode (CVSS 8.8, gopi\_plus Wp anything slider)
- [CVE-2023-5128](https://cve.now/CVE-2023-5128.md): TCD Google Maps \<= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, designplus TCD Google Maps)
- [CVE-2023-5662](https://cve.now/CVE-2023-5662.md): Sponsors \<= 3.5.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, ibenic Sponsors)
- [CVE-2023-5386](https://cve.now/CVE-2023-5386.md): Funnelforms Free \<= 3.4 - Missing Authorization to Arbitrary Post Deletion (CVSS 6.5, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2023-5742](https://cve.now/CVE-2023-5742.md): EasyRotator for WordPress \<= 1.0.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, dwusercom EasyRotator for WordPress – Slider Plugin)
- [CVE-2023-5815](https://cve.now/CVE-2023-5815.md): News & Blog Designer Pack – WordPress Blog Plugin \<= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion (CVSS 8.1, infornweb Blog Designer Pack – Blog, Post Grid, Post Slider…)
- [CVE-2023-4686](https://cve.now/CVE-2023-4686.md): WP Customer Reviews \<= 3.6.6 - Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3, bompus WP Customer Reviews)
- [CVE-2023-5537](https://cve.now/CVE-2023-5537.md): Delete Usermetas \<= 1.1.2 - Cross-Site Request Forgery (CVSS 4.3, jose-lazo Delete Usermetas)
- [CVE-2023-5822](https://cve.now/CVE-2023-5822.md): Drag and Drop Multiple File Upload - Contact Form 7 \<= 1.3.7.3 - Unauthenticated Arbitrary File Upload (CVSS 8.1, glenwpcoder Drag and Drop Multiple File Upload for Contact…)
- [CVE-2023-5096](https://cve.now/CVE-2023-5096.md): HTML filter and csv-file search \<= 2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, jonashjalmarsson HTML filter and csv-file search)
- [CVE-2023-5417](https://cve.now/CVE-2023-5417.md): Funnelforms Free \<= 3.4 - Missing Authorization to Category Update (CVSS 4.3, Interactive Contact Form and Multi Step Form Builder with D…)
- [CVE-2023-2841](https://cve.now/CVE-2023-2841.md): Advanced Local Pickup for WooCommerce \<= 1.5.5 - Authenticated (Administrator+) SQL Injection (CVSS 7.2, Zorem Local Pickup)
- [CVE-2023-5667](https://cve.now/CVE-2023-5667.md): Tab Ultimate \<= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, themepoints Tab Ultimate)
- [CVE-2023-5706](https://cve.now/CVE-2023-5706.md): VK Blocks \<= 1.63.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block (CVSS 6.4, vektor-inc VK Blocks)
- [CVE-2023-48705](https://cve.now/CVE-2023-48705.md): nautobot has XSS potential in custom links, job buttons, and computed fields (CVSS 7.1, nautobot)
- [CVE-2023-26542](https://cve.now/CVE-2023-26542.md): WordPress phpinfo() WP Plugin \<= 4.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Exeebit phpinfo() WP)
- [CVE-2023-26535](https://cve.now/CVE-2023-26535.md): WordPress Sheets To WP Table Live Sync Plugin \<= 2.12.15 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, WPPOOL Sheets To WP Table Live Sync)
- [CVE-2023-26532](https://cve.now/CVE-2023-26532.md): WordPress Social Auto Poster Plugin \<= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, AccessPress Themes Social Auto Poster)
- [CVE-2023-27457](https://cve.now/CVE-2023-27457.md): WordPress Add Expires Headers & Optimized Minify Plugin \<= 2.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Passionate Brains Add Expires Headers & Optimized Minify)
- [CVE-2023-27458](https://cve.now/CVE-2023-27458.md): WordPress WpStream – Live Streaming, Video on Demand, Pay Per View Plugin \<= 4.4.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WpStream)
- [CVE-2023-27461](https://cve.now/CVE-2023-27461.md): WordPress When Last Login Plugin \<= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Yoohoo Plugins When Last Login)
- [CVE-2023-27453](https://cve.now/CVE-2023-27453.md): WordPress LWS Tools Plugin \<= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, LWS Tools)
- [CVE-2023-27451](https://cve.now/CVE-2023-27451.md): WordPress Instant Images Plugin \<= 5.1.0.2 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 7.2, Darren Cooney Instant Images)
- [CVE-2023-6252](https://cve.now/CVE-2023-6252.md): Path traversal vulnerability in Chameleon Power products (CVSS 7.5, Chameleon Power)
- [CVE-2023-2889](https://cve.now/CVE-2023-2889.md): SQLi in Veon Computer's Service Tracking Software (CVSS 9.8, Veon Computer Service Tracking Software)
- [CVE-2023-27442](https://cve.now/CVE-2023-27442.md): WordPress Leyka Plugin \<= 3.29.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Teplitsa of social technologies Leyka)
- [CVE-2023-27444](https://cve.now/CVE-2023-27444.md): WordPress DecaLog Plugin \<= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Pierre Lannoy / PerfOps One DecaLog)
- [CVE-2023-27446](https://cve.now/CVE-2023-27446.md): WordPress DeepL Pro API translation Plugin \<= 2.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Fluenx DeepL API translation plugin)
- [CVE-2023-27633](https://cve.now/CVE-2023-27633.md): WordPress Customify Plugin \<= 2.10.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Pixelgrade Customify – Intuitive Website Styling)
- [CVE-2023-28747](https://cve.now/CVE-2023-28747.md): WordPress CBX Currency Converter Plugin \<= 3.0.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, codeboxr CBX Currency Converter)
- [CVE-2023-28749](https://cve.now/CVE-2023-28749.md): WordPress CM On Demand Search And Replace Plugin \<= 1.3.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, CreativeMindsSolutions CM On Demand Search And Replace)
- [CVE-2023-43081](https://cve.now/CVE-2023-43081.md): PowerProtect Agent for File System Version 19.14 and prior, contains an incorrect default permissions vulnerability in ddfscon component. (CVSS 4.0, Dell PowerProtect Agent for File System)
- [CVE-2023-3104](https://cve.now/CVE-2023-3104.md): Missing Authentication for Critical Function in Unitree Robotics A1 (CVSS 5.7, Unitree Robotics A1)
- [CVE-2023-5983](https://cve.now/CVE-2023-5983.md): Information Disclosure in Botanik Software Pharmacy Automation (CVSS 7.5, Botanik Software Pharmacy Automation)
- [CVE-2023-3103](https://cve.now/CVE-2023-3103.md): Authentication Bypass by Spoofing in Unitree Robotics A1 (CVSS 8.0, Unitree Robotics A1)
- [CVE-2023-6253](https://cve.now/CVE-2023-6253.md): Saved Uninstall Key in Digital Guardian Agent Uninstaller (no CVSS, Fortra Digital Guardian Agent)
- [CVE-2023-5047](https://cve.now/CVE-2023-5047.md): SQLi in DRDrive (CVSS 9.8, DRD Fleet Leasing DRDrive)
- [CVE-2023-6189](https://cve.now/CVE-2023-6189.md): Improper Permission Handling in M-Files Server (CVSS 4.3, M-Files Server)
- [CVE-2023-6117](https://cve.now/CVE-2023-6117.md): M-Files REST API allows Denial of Service (CVSS 5.7, M-Files Server)
- [CVE-2023-46673](https://cve.now/CVE-2023-46673.md): It was identified that malformed scripts used in the script processor of an Ingest Pipeline could cause an Elasticsearch node to crash when (CVSS 6.5, Elasticsearch · org.elasticsearch:elasticsearch)
- [CVE-2023-37924](https://cve.now/CVE-2023-37924.md): Apache Submarine: SQL injection from unauthorized login (critical (no CVSS), Apache Software Foundation Apache Submarine · apache-submar…)
- [CVE-2023-6011](https://cve.now/CVE-2023-6011.md): Stored XSS in Geodi (CVSS 5.4, DECE Software Geodi)
- [CVE-2023-5921](https://cve.now/CVE-2023-5921.md): Function Bypass in Geodi (CVSS 7.1, DECE Software Geodi)
- [CVE-2023-2446](https://cve.now/CVE-2023-2446.md): UserPro \<= 5.1.1 - Sensitive Information Disclosure via Shortcode (CVSS 6.5, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-2447](https://cve.now/CVE-2023-2447.md): UserPro \<= 5.1.1 - Cross-Site Request Forgery to Sensitive Information Exposure (CVSS 6.1, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-41146](https://cve.now/CVE-2023-41146.md): Autodesk Customer Support Portal allows cases created by users under an account to see cases created by other users on the same account. (no CVSS, Autodesk Customer Portal)
- [CVE-2023-41145](https://cve.now/CVE-2023-41145.md): Autodesk users who no longer have an active license for an account can still access cases for that account. (no CVSS, Autodesk Customer Portal)
- [CVE-2023-29069](https://cve.now/CVE-2023-29069.md): A maliciously crafted DLL file can be forced to install onto a non-default location, and attacker can overwrite parts of the product with ma (no CVSS, Autodesk Desktop Connector)
- [CVE-2022-35638](https://cve.now/CVE-2022-35638.md): IBM Sterling B2B Integrator cross-site request forgery (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2021-37937](https://cve.now/CVE-2021-37937.md): Elasticsearch privilege escalation (CVSS 5.9, Elasticsearch)
- [CVE-2021-37942](https://cve.now/CVE-2021-37942.md): APM Java Agent Local Privilege Escalation (CVSS 7.0, Elastic APM Java Agent · co.elastic.apm:apm-agent-parent +1)
- [CVE-2021-22143](https://cve.now/CVE-2021-22143.md): Elastic APM .NET Agent information disclosure (CVSS 2.1, Elastic APM .NET Agent · Elastic.Apm)
- [CVE-2021-22142](https://cve.now/CVE-2021-22142.md): Kibana Reporting vulnerabilities (CVSS 6.6, Elastic Kibana)
- [CVE-2023-35127](https://cve.now/CVE-2023-35127.md): Fuji Electric Tellus Lite V-Simulator Stack-based Buffer Overflow (CVSS 7.8, Fuji Electric Tellus Lite V-Simulator)
- [CVE-2023-40152](https://cve.now/CVE-2023-40152.md): Fuji Electric Tellus Lite V-Simulator Out-of-bounds Write (CVSS 7.8, Fuji Electric Tellus Lite V-Simulator)
- [CVE-2023-5299](https://cve.now/CVE-2023-5299.md): Fuji Electric Tellus Lite V-Simulator Improper Access Control (CVSS 7.3, Fuji Electric Tellus Lite V-Simulator)
- [CVE-2021-22151](https://cve.now/CVE-2021-22151.md): Kibana path traversal issue (CVSS 3.1, Elastic Kibana)
- [CVE-2021-22150](https://cve.now/CVE-2021-22150.md): Kibana code execution issue (CVSS 6.6, Elastic Kibana)
- [CVE-2023-43887](https://cve.now/CVE-2023-43887.md): Libde265 v1.0.12 was discovered to contain multiple buffer overflows via the num\_tile\_columns and num\_tile\_row parameters in the function pi (no CVSS)
- [CVE-2023-45377](https://cve.now/CVE-2023-45377.md): In the module "Chronopost Official" (chronopost) for PrestaShop, a guest can perform SQL injection. (CVSS 9.8)
- [CVE-2023-46357](https://cve.now/CVE-2023-46357.md): In the module "Cross Selling in Modal Cart" (motivationsale) \< 3.5.0 from MyPrestaModules for PrestaShop, a guest can perform SQL injection. (no CVSS)
- [CVE-2023-46814](https://cve.now/CVE-2023-46814.md): A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. (no CVSS)
- [CVE-2023-47014](https://cve.now/CVE-2023-47014.md): A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP with Source Code v.1.0 allows a local attacke (no CVSS)
- [CVE-2023-47016](https://cve.now/CVE-2023-47016.md): radare2 5.8.9 has an out-of-bounds read in r\_bin\_object\_set\_items in libr/bin/bobj.c, causing a crash in r\_read\_le32 in libr/include/r\_endia (CVSS 7.5)
- [CVE-2023-47250](https://cve.now/CVE-2023-47250.md): In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attack (no CVSS)
- [CVE-2023-47251](https://cve.now/CVE-2023-47251.md): In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, a Directory Traversal in the print function of the VNC service allows a (no CVSS)
- [CVE-2023-47312](https://cve.now/CVE-2023-47312.md): Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to Login Credential Leakage via Audit Entries. (no CVSS)
- [CVE-2023-47313](https://cve.now/CVE-2023-47313.md): Headwind MDM Web panel 5.22.1 is vulnerable to Directory Traversal. (no CVSS)
- [CVE-2023-47314](https://cve.now/CVE-2023-47314.md): Headwind MDM Web panel 5.22.1 is vulnerable to cross-site scripting (XSS). (no CVSS)
- [CVE-2023-47315](https://cve.now/CVE-2023-47315.md): Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control due to a hard-coded JWT Secret. (no CVSS)
- [CVE-2023-47316](https://cve.now/CVE-2023-47316.md): Headwind MDM Web panel 5.22.1 is vulnerable to Incorrect Access Control. (no CVSS)
- [CVE-2023-47350](https://cve.now/CVE-2023-47350.md): Cross-Site Request Forgery (CSRF) vulnerability in SwiftyEdit Content Management System prior to v1.2.0, allows remote attackers to escalate (no CVSS, swiftyedit/swiftyedit)
- [CVE-2023-47380](https://cve.now/CVE-2023-47380.md): Admidio v4.2.12 and below is vulnerable to Cross Site Scripting (XSS). (no CVSS, admidio/admidio)
- [CVE-2023-47392](https://cve.now/CVE-2023-47392.md): An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the carts of other users via sending a crafted add (no CVSS)
- [CVE-2023-47393](https://cve.now/CVE-2023-47393.md): An access control issue in Mercedes me IOS APP v1.34.0 and below allows attackers to view the maintenance orders of other users and access s (no CVSS)
- [CVE-2023-47467](https://cve.now/CVE-2023-47467.md): Directory Traversal vulnerability in jeecg-boot v.3.6.0 allows a remote privileged attacker to obtain sensitive information via the file dir (no CVSS, org.jeecgframework.boot:jeecg-boot-common)
- [CVE-2023-48105](https://cve.now/CVE-2023-48105.md): An heap overflow vulnerability was discovered in Bytecode alliance wasm-micro-runtime v.1.2.3 allows a remote attacker to cause a denial of (no CVSS)
- [CVE-2023-48106](https://cve.now/CVE-2023-48106.md): Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz\_path\_r (no CVSS)
- [CVE-2023-48107](https://cve.now/CVE-2023-48107.md): Buffer Overflow vulnerability in zlib-ng minizip-ng v.4.0.2 allows an attacker to execute arbitrary code via a crafted file to the mz\_path\_h (no CVSS)
- [CVE-2023-48161](https://cve.now/CVE-2023-48161.md): Buffer Overflow vulnerability in GifLib Project GifLib v.5.2.1 allows a local attacker to obtain sensitive information via the DumpSCreen2RG (no CVSS)
- [CVE-2023-48646](https://cve.now/CVE-2023-48646.md): Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings. (no CVSS)
- [CVE-2023-49102](https://cve.now/CVE-2023-49102.md): NZBGet 21.1 allows authenticated remote code execution because the unarchive programs (7za and unrar) preserve executable file permissions. (no CVSS)
- [CVE-2023-49146](https://cve.now/CVE-2023-49146.md): DOMSanitizer (aka dom-sanitizer) before 1.0.7 allows XSS via an SVG document because of mishandling of comments and greedy regular expressio (no CVSS, rhukster/dom-sanitizer)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.