# CVEs published 2023-11-24

16 CVEs were published on November 24, 2023: 1 critical, 4 high. Days are UTC.

- [CVE-2023-6293](https://cve.now/CVE-2023-6293.md): Prototype Pollution in robinbuschmann/sequelize-typescript (CVSS 7.5, robinbuschmann/sequelize-typescript · sequelize-typescript)
- [CVE-2023-6277](https://cve.now/CVE-2023-6277.md): Libtiff: out-of-memory in tiffopen via a craft file (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2023-48707](https://cve.now/CVE-2023-48707.md): Cleartext Storage of Sensitive Information in codeigniter4/shield (CVSS 5.0, codeigniter4 shield · codeigniter4/shield)
- [CVE-2023-48708](https://cve.now/CVE-2023-48708.md): Insertion of Sensitive Information into Log in codeigniter4/shield (CVSS 5.0, codeigniter4 shield · codeigniter4/shield)
- [CVE-2023-48312](https://cve.now/CVE-2023-48312.md): Authentication bypass using an empty token in capsule-proxy (CVSS 9.8, projectcapsule capsule-proxy · github.com/projectcapsule… +1)
- [CVE-2023-48711](https://cve.now/CVE-2023-48711.md): Server-Side Request Forgery (SSRF) Vulnerability in google-translate-api-browser (CVSS 3.7, cjvnjde google-translate-api-browser · google-translate-api…)
- [CVE-2023-48712](https://cve.now/CVE-2023-48712.md): User authorization bug leading to privilege escalation in warpgate (CVSS 7.1, warp-tech warpgate)
- [CVE-2023-6276](https://cve.now/CVE-2023-6276.md): Tongda OA 2017 delete.php sql injection (CVSS 6.3, Tongda OA)
- [CVE-2023-6275](https://cve.now/CVE-2023-6275.md): TOTVS Fluig Platform mobileredir openApp.jsp cross site scripting (CVSS 3.5, TOTVS Fluig Platform)
- [CVE-2023-6274](https://cve.now/CVE-2023-6274.md): Byzoro Smart S80 PHP File updatelib.php unrestricted upload (CVSS 6.3, Byzoro Smart S80)
- [CVE-2023-6251](https://cve.now/CVE-2023-6251.md): CSRF in delete\_user\_message (CVSS 3.5, Checkmk)
- [CVE-2023-48796](https://cve.now/CVE-2023-48796.md): Apache dolphinscheduler sensitive information disclosure (no CVSS, Apache Software Foundation Apache DolphinScheduler · org… +1)
- [CVE-2023-44303](https://cve.now/CVE-2023-44303.md): RVTools, Version 3.9.2 and above, contain a sensitive data exposure vulnerability in the password encryption utility (RVToolsPasswordEncryp (CVSS 7.5, Dell RVTools)
- [CVE-2023-33706](https://cve.now/CVE-2023-33706.md): SysAid before 23.2.15 allows Indirect Object Reference (IDOR) attacks to read ticket data via a modified sid parameter to EmailHtmlSourceIfr (no CVSS)
- [CVE-2023-46575](https://cve.now/CVE-2023-46575.md): A SQL injection vulnerability exists in Meshery prior to version v0.6.179, enabling a remote attacker to retrieve sensitive information and (no CVSS, github.com/layer5io/meshery)
- [CVE-2023-49298](https://cve.now/CVE-2023-49298.md): OpenZFS through 2.1.13 and 2.2.x through 2.2.1, in certain scenarios involving applications that try to rely on efficient copying of file da (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-11-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.