CVEs published November 23, 2023
50 CVEs were published on November 23, 2023: 6 critical, 16 high.
- Published
- 50
- Critical
- 6
- High
- 16
- Medium
- 12
- Low
- 3
- Unrated
- 13
- Now in CISA KEV
- 0
- Fix available
- 3
Most affected products
- Pandora FMS
- 14
- Autodesk AutoCAD, Advance Steel and Civil
- 6
- BVRP Software SLmail
- 3
- Dell Command Configure
- 2
- Hikvision LocalServiceComponents
- 2
- IBM QRadar WinCollect Agent
- 2
- Apache Software Foundation Apache Storm · org.apache.storm:…
- 1
- Dell Command Monitor
- 1
- Dell OS Recovery Tool
- 1
- Email Marketing for WooCommerce by Omnisend
- 1
Critical 6
- CVE-2023-41807Linux Local Privilege Escalation Via GoTTY PagePandora FMS
- CVE-2023-3631SQLi in Medart Notification PanelMedart Health Services Medart Notification Panel
- CVE-2023-28812There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted meHikvision LocalServiceComponents
- CVE-2023-3377SQLi in Veribilim's VeribaseVeribilim Software Computer Veribase
- CVE-2023-29075A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write.Autodesk AutoCAD, Advance Steel and Civil
- CVE-2023-49208scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registr
High 16
- CVE-2023-5972Kernel: the nfta_inner_num and nfta_expr_name netlink attributes accessed without checking its presence in nft_inner.ckernel · Red Hat Enterprise Linux +1
- CVE-2023-41808Arbitrary File Read As Root Via GoTTY PagePandora FMS
- CVE-2023-41806Misassignment of privileges can cause DOS attackPandora FMS
- CVE-2023-41791Lack of Authorization and Stored XSS Via Translation AbusePandora FMS
- CVE-2023-41790Traversal Path on PHP filePandora FMS
- CVE-2023-41789Unauthenticated Admin Account Takeover Via XSSPandora FMS
- CVE-2023-41788Remote Code Execution via File UploaderPandora FMS
- CVE-2023-6118Path Traversal in Neutron IP CameraNeutron IP Camera
- CVE-2023-4677Unauthenticated Admin Account Takeover Via Cron Log File BackupsPandora FMS
- CVE-2023-4595Insertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmailBVRP Software SLmail
- CVE-2023-28813An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters,Hikvision LocalServiceComponents
- CVE-2023-44290 Dell Command | Monitor versions prior to 10.10.0, contain an improper access control vulnerability.Dell Command Monitor
- CVE-2023-28811There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models.Hikvision iDS-EXXHUH · Hikvision DS-EXXHGH +42
- CVE-2023-44289 Dell Command | Configure versions prior to 4.11.0, contain an improper access control vulnerability.Dell Command Configure
- CVE-2023-43086 Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability.Dell Command Configure
- CVE-2023-39253 Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability.Dell OS Recovery Tool
Medium, low and unrated 28
- CVE-2023-26279IBM QRadar WinCollect Agent improper output encodingIBM QRadar WinCollect Agent
- CVE-2021-39008IBM QRadar WinCollect Agent information disclosureIBM QRadar WinCollect Agent
- CVE-2023-47244WordPress Email Marketing for WooCommerce by Omnisend Plugin <= 1.13.8 is vulnerable to Sensitive Data ExposureEmail Marketing for WooCommerce by Omnisend
- CVE-2023-47529WordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data ExposureThemeIsle Cloud Templates & Patterns collection
- CVE-2023-41812Uploading executables via the file managerPandora FMS
- CVE-2023-41811Stored XSS Via Site News PagePandora FMS
- CVE-2023-41810Stored XSS Via Dashboard PanelPandora FMS
- CVE-2023-41792Lack of Authorization and Stored XSS Via SNMP Trap Editor PagePandora FMS
- CVE-2023-41787Arbitrary File ReadPandora FMS
- CVE-2023-41786Database backups availability by low-privileged usersPandora FMS
- CVE-2023-4594Cross-site Scripting in BVRP Software SLmailBVRP Software SLmail
- CVE-2023-4593Path Traversal in BVRP Software SLmailBVRP Software SLmail
- CVE-2023-4406XSS in KC Group's E-Commerce SoftwareKC Group E-Commerce Software
- CVE-2023-43123Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary filesApache Software Foundation Apache Storm · org.apache.storm:…
- CVE-2023-41140A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow.Autodesk AutoCAD, Advance Steel and Civil
- CVE-2023-41139A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer.Autodesk AutoCAD, Advance Steel and Civil
- CVE-2023-29076A maliciously crafted MODEL, SLDASM, SAT or CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 could cause memory corruption vuAutodesk AutoCAD, Advance Steel and Civil
- CVE-2023-29074A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write.Autodesk AutoCAD, Advance Steel and Civil
- CVE-2023-29073A maliciously crafted MODEL file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow.Autodesk AutoCAD, Advance Steel and Civil
- CVE-2023-47668WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data ExposureStellarWP Membership Plugin – Restrict Content
- CVE-2022-44010An issue was discovered in ClickHouse before 22.9.1.2603.
- CVE-2022-44011An issue was discovered in ClickHouse before 22.9.1.2603.
- CVE-2023-33202Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMPorg.bouncycastle:bcprov-ext-jdk16 · org.bouncycastle:bcp… +7
- CVE-2023-49210The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and aopenssl
- CVE-2023-49213The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP
- CVE-2023-49214Usedesk before 1.7.57 allows chat template injection.
- CVE-2023-49215Usedesk before 1.7.57 allows filter reflected XSS.
- CVE-2023-49216Usedesk before 1.7.57 allows profile stored XSS.