# CVEs published 2023-11-23

50 CVEs were published on November 23, 2023: 6 critical, 16 high. Days are UTC.

- [CVE-2023-26279](https://cve.now/CVE-2023-26279.md): IBM QRadar WinCollect Agent improper output encoding (CVSS 3.3, IBM QRadar WinCollect Agent)
- [CVE-2021-39008](https://cve.now/CVE-2021-39008.md): IBM QRadar WinCollect Agent information disclosure (CVSS 2.7, IBM QRadar WinCollect Agent)
- [CVE-2023-47244](https://cve.now/CVE-2023-47244.md): WordPress Email Marketing for WooCommerce by Omnisend Plugin \<= 1.13.8 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Email Marketing for WooCommerce by Omnisend)
- [CVE-2023-47529](https://cve.now/CVE-2023-47529.md): WordPress Cloud Templates & Patterns collection Plugin \<= 1.2.2 is vulnerable to Sensitive Data Exposure (CVSS 5.3, ThemeIsle Cloud Templates & Patterns collection)
- [CVE-2023-5972](https://cve.now/CVE-2023-5972.md): Kernel: the nfta\_inner\_num and nfta\_expr\_name netlink attributes accessed without checking its presence in nft\_inner.c (CVSS 7.0, kernel · Red Hat Enterprise Linux +1)
- [CVE-2023-41812](https://cve.now/CVE-2023-41812.md): Uploading executables via the file manager (CVSS 5.7, Pandora FMS)
- [CVE-2023-41811](https://cve.now/CVE-2023-41811.md): Stored XSS Via Site News Page (CVSS 5.3, Pandora FMS)
- [CVE-2023-41810](https://cve.now/CVE-2023-41810.md): Stored XSS Via Dashboard Panel (CVSS 4.0, Pandora FMS)
- [CVE-2023-41808](https://cve.now/CVE-2023-41808.md): Arbitrary File Read As Root Via GoTTY Page (CVSS 8.5, Pandora FMS)
- [CVE-2023-41807](https://cve.now/CVE-2023-41807.md): Linux Local Privilege Escalation Via GoTTY Page (CVSS 9.1, Pandora FMS)
- [CVE-2023-41806](https://cve.now/CVE-2023-41806.md): Misassignment of privileges can cause DOS attack (CVSS 8.2, Pandora FMS)
- [CVE-2023-41792](https://cve.now/CVE-2023-41792.md): Lack of Authorization and Stored XSS Via SNMP Trap Editor Page (CVSS 5.9, Pandora FMS)
- [CVE-2023-41791](https://cve.now/CVE-2023-41791.md): Lack of Authorization and Stored XSS Via Translation Abuse (CVSS 8.4, Pandora FMS)
- [CVE-2023-41790](https://cve.now/CVE-2023-41790.md): Traversal Path on PHP file (CVSS 7.6, Pandora FMS)
- [CVE-2023-41789](https://cve.now/CVE-2023-41789.md): Unauthenticated Admin Account Takeover Via XSS (CVSS 7.6, Pandora FMS)
- [CVE-2023-41788](https://cve.now/CVE-2023-41788.md): Remote Code Execution via File Uploader (CVSS 7.6, Pandora FMS)
- [CVE-2023-41787](https://cve.now/CVE-2023-41787.md): Arbitrary File Read (CVSS 6.0, Pandora FMS)
- [CVE-2023-41786](https://cve.now/CVE-2023-41786.md): Database backups availability by low-privileged users (CVSS 6.8, Pandora FMS)
- [CVE-2023-6118](https://cve.now/CVE-2023-6118.md): Path Traversal in Neutron IP Camera (CVSS 7.5, Neutron IP Camera)
- [CVE-2023-4677](https://cve.now/CVE-2023-4677.md): Unauthenticated Admin Account Takeover Via Cron Log File Backups (CVSS 7.0, Pandora FMS)
- [CVE-2023-4595](https://cve.now/CVE-2023-4595.md): Insertion of Sensitive Information into Externally-Accessible File or Directory in BVRP Software SLmail (CVSS 7.5, BVRP Software SLmail)
- [CVE-2023-4594](https://cve.now/CVE-2023-4594.md): Cross-site Scripting in BVRP Software SLmail (CVSS 6.1, BVRP Software SLmail)
- [CVE-2023-4593](https://cve.now/CVE-2023-4593.md): Path Traversal in BVRP Software SLmail (CVSS 6.5, BVRP Software SLmail)
- [CVE-2023-4406](https://cve.now/CVE-2023-4406.md): XSS in KC Group's E-Commerce Software (CVSS 6.1, KC Group E-Commerce Software)
- [CVE-2023-43123](https://cve.now/CVE-2023-43123.md): Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files (low (no CVSS), Apache Software Foundation Apache Storm · org.apache.storm:…)
- [CVE-2023-3631](https://cve.now/CVE-2023-3631.md): SQLi in Medart Notification Panel (CVSS 9.8, Medart Health Services Medart Notification Panel)
- [CVE-2023-28813](https://cve.now/CVE-2023-28813.md): An attacker could exploit a vulnerability by sending crafted messages to computers installed with this plug-in to modify plug-in parameters, (CVSS 8.1, Hikvision LocalServiceComponents)
- [CVE-2023-28812](https://cve.now/CVE-2023-28812.md): There is a buffer overflow vulnerability in a web browser plug-in could allow an attacker to exploit the vulnerability by sending crafted me (CVSS 9.1, Hikvision LocalServiceComponents)
- [CVE-2023-3377](https://cve.now/CVE-2023-3377.md): SQLi in Veribilim's Veribase (CVSS 9.8, Veribilim Software Computer Veribase)
- [CVE-2023-44290](https://cve.now/CVE-2023-44290.md): Dell Command | Monitor versions prior to 10.10.0, contain an improper access control vulnerability. (CVSS 7.3, Dell Command Monitor)
- [CVE-2023-28811](https://cve.now/CVE-2023-28811.md): There is a buffer overflow in the password recovery feature of Hikvision NVR/DVR models. (CVSS 7.4, Hikvision iDS-EXXHUH · Hikvision DS-EXXHGH +42)
- [CVE-2023-44289](https://cve.now/CVE-2023-44289.md): Dell Command | Configure versions prior to 4.11.0, contain an improper access control vulnerability. (CVSS 7.3, Dell Command Configure)
- [CVE-2023-43086](https://cve.now/CVE-2023-43086.md): Dell Command | Configure, versions prior to 4.11.0, contains an improper access control vulnerability. (CVSS 7.3, Dell Command Configure)
- [CVE-2023-39253](https://cve.now/CVE-2023-39253.md): Dell OS Recovery Tool, versions 2.2.4013, 2.3.7012.0, and 2.3.7515.0 contain an Improper Access Control Vulnerability. (CVSS 7.3, Dell OS Recovery Tool)
- [CVE-2023-41140](https://cve.now/CVE-2023-41140.md): A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. (no CVSS, Autodesk AutoCAD, Advance Steel and Civil)
- [CVE-2023-41139](https://cve.now/CVE-2023-41139.md): A maliciously crafted STP file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to dereference an untrusted pointer. (no CVSS, Autodesk AutoCAD, Advance Steel and Civil)
- [CVE-2023-29076](https://cve.now/CVE-2023-29076.md): A maliciously crafted MODEL, SLDASM, SAT or CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 could cause memory corruption vu (no CVSS, Autodesk AutoCAD, Advance Steel and Civil)
- [CVE-2023-29075](https://cve.now/CVE-2023-29075.md): A maliciously crafted PRT file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. (CVSS 9.8, Autodesk AutoCAD, Advance Steel and Civil)
- [CVE-2023-29074](https://cve.now/CVE-2023-29074.md): A maliciously crafted CATPART file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause an Out-Of-Bounds Write. (no CVSS, Autodesk AutoCAD, Advance Steel and Civil)
- [CVE-2023-29073](https://cve.now/CVE-2023-29073.md): A maliciously crafted MODEL file when parsed through Autodesk AutoCAD 2024 and 2023 can be used to cause a Heap-Based Buffer Overflow. (no CVSS, Autodesk AutoCAD, Advance Steel and Civil)
- [CVE-2023-47668](https://cve.now/CVE-2023-47668.md): WordPress Restrict Content Plugin \<= 3.2.7 is vulnerable to Sensitive Data Exposure (CVSS 5.3, StellarWP Membership Plugin – Restrict Content)
- [CVE-2022-44010](https://cve.now/CVE-2022-44010.md): An issue was discovered in ClickHouse before 22.9.1.2603. (no CVSS)
- [CVE-2022-44011](https://cve.now/CVE-2022-44011.md): An issue was discovered in ClickHouse before 22.9.1.2603. (no CVSS)
- [CVE-2023-33202](https://cve.now/CVE-2023-33202.md): Bouncy Castle for Java before 1.73 contains a potential Denial of Service (DoS) issue within the Bouncy Castle org.bouncycastle.openssl.PEMP (no CVSS, org.bouncycastle:bcprov-ext-jdk16 · org.bouncycastle:bcp… +7)
- [CVE-2023-49208](https://cve.now/CVE-2023-49208.md): scheme/webauthn.c in Glewlwyd SSO server before 2.7.6 has a possible buffer overflow during FIDO2 credentials validation in webauthn registr (CVSS 9.8)
- [CVE-2023-49210](https://cve.now/CVE-2023-49210.md): The openssl (aka node-openssl) NPM package through 2.0.0 was characterized as "a nonsense wrapper with no real purpose" by its author, and a (no CVSS, openssl)
- [CVE-2023-49213](https://cve.now/CVE-2023-49213.md): The API endpoints in Ironman PowerShell Universal 3.0.0 through 4.2.0 allow remote attackers to execute arbitrary commands via crafted HTTP (no CVSS)
- [CVE-2023-49214](https://cve.now/CVE-2023-49214.md): Usedesk before 1.7.57 allows chat template injection. (no CVSS)
- [CVE-2023-49215](https://cve.now/CVE-2023-49215.md): Usedesk before 1.7.57 allows filter reflected XSS. (no CVSS)
- [CVE-2023-49216](https://cve.now/CVE-2023-49216.md): Usedesk before 1.7.57 allows profile stored XSS. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.