CVEs published November 24, 2023
16 CVEs were published on November 24, 2023: 1 critical, 4 high.
- Published
- 16
- Critical
- 1
- High
- 4
- Medium
- 5
- Low
- 3
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- codeigniter4 shield · codeigniter4/shield
- 2
- Apache Software Foundation Apache DolphinScheduler · org… +1
- 1
- Byzoro Smart S80
- 1
- Checkmk
- 1
- cjvnjde google-translate-api-browser · google-translate-api…
- 1
- Dell RVTools
- 1
- github.com/layer5io/meshery
- 1
- projectcapsule capsule-proxy · github.com/projectcapsule… +1
- 1
- Red Hat Enterprise Linux
- 1
- robinbuschmann/sequelize-typescript · sequelize-typescript
- 1
Critical 1
High 4
- CVE-2023-6293Prototype Pollution in robinbuschmann/sequelize-typescriptrobinbuschmann/sequelize-typescript · sequelize-typescript
- CVE-2023-48712User authorization bug leading to privilege escalation in warpgatewarp-tech warpgate
- CVE-2023-44303 RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (RVToolsPasswordEncrypDell RVTools
- CVE-2023-49298OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file da
Medium, low and unrated 11
- CVE-2023-6277Libtiff: out-of-memory in tiffopen via a craft fileRed Hat Enterprise Linux
- CVE-2023-48707Cleartext Storage of Sensitive Information in codeigniter4/shieldcodeigniter4 shield · codeigniter4/shield
- CVE-2023-48708Insertion of Sensitive Information into Log in codeigniter4/shieldcodeigniter4 shield · codeigniter4/shield
- CVE-2023-48711Server-Side Request Forgery (SSRF) Vulnerability in google-translate-api-browsercjvnjde google-translate-api-browser · google-translate-api…
- CVE-2023-6276Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-6275TOTVS Fluig Platform mobileredir openApp.jsp cross site scriptingTOTVS Fluig Platform
- CVE-2023-6274Byzoro Smart S80 PHP File updatelib.php unrestricted uploadByzoro Smart S80
- CVE-2023-6251CSRF in delete_user_messageCheckmk
- CVE-2023-48796Apache dolphinscheduler sensitive information disclosureApache Software Foundation Apache DolphinScheduler · org… +1
- CVE-2023-33706SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIfr
- CVE-2023-46575A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and github.com/layer5io/meshery