CVEs published November 29, 2023
56 CVEs were published on November 29, 2023: 6 critical, 11 high. 1 is now in CISA KEV.
- Published
- 56
- Critical
- 6
- High
- 11
- Medium
- 5
- Low
- 0
- Unrated
- 34
- Now in CISA KEV
- 1
- Fix available
- 24
Most affected products
- Google Android
- 6
- Google Chrome
- 6
- Jenkins Project Jenkins MATLAB Plugin · org.jenkins-ci.plug…
- 3
- Jenkins Project Jenkins NeuVector Vulnerability Scanner Plu…
- 2
- NETGEAR ProSAFE Network Management System
- 2
- Progress Software MOVEit Transfer
- 2
- aio-libs aiohttp · aiohttp
- 1
- azukaar Cosmos-Server
- 1
- carrierwaveuploader carrierwave · carrierwave
- 1
- Jenkins Project Jenkins Google Compute Engine Plugin · org.…
- 1
Critical 6
- CVE-2023-49693NETGEAR ProSAFE Network Management System RCE via Unprotected Access to Java Debug Wire ProtocolNETGEAR ProSAFE Network Management System
- CVE-2022-42541Remote code executionGoogle Android
- CVE-2023-49079Misskey's missing signature validation allows arbitrary users to impersonate any remote user.misskey-dev misskey
- CVE-2023-6345Integer overflow in Skia in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2023-45481Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the firewallEn parameter in the function Set
- CVE-2023-46886Dreamer CMS before version 4.0.1 is vulnerable to Directory Traversal.
High 11
- CVE-2023-40458AceManager DOS Vulnerabilitysierrawireless ALEOS
- CVE-2023-49694NETGEAR ProSAFE Network Management System Privilege Escalation Via MySQL ServerNETGEAR ProSAFE Network Management System
- CVE-2023-49091Jwttoken in Cosmos server never expires after password changed and logging outazukaar Cosmos-Server
- CVE-2023-6218MOVEit Transfer Group Admin Privilege EscalationProgress Software MOVEit Transfer
- CVE-2023-6217MOVEit Transfer XSS via MOVEit GatewayProgress Software MOVEit Transfer
- CVE-2023-49673A cross-site request forgery (CSRF) vulnerability in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers to conJenkins Project Jenkins NeuVector Vulnerability Scanner Plu…
- CVE-2023-6378Logback "receiver" DOS vulnerability QOS.CH Sarl logback · ch.qos.logback:logback-classic +1
- CVE-2023-6347Use after free in Mojo in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2023-48945A stack overflow in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) via crafted SQL statements.
- CVE-2023-48951An issue in the box_equal function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running
- CVE-2023-48952An issue in the box_deserialize_reusing function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS)
Medium, low and unrated 39
- CVE-2022-42540Elevation of privilegeGoogle Android
- CVE-2022-42539Information disclosureGoogle Android
- CVE-2022-42538Elevation of privilegeGoogle Android
- CVE-2022-42537Remote code executionGoogle Android
- CVE-2022-42536Remote code executionGoogle Android
- CVE-2023-49082aiohttp's ClientSession is vulnerable to CRLF injection via methodaio-libs aiohttp · aiohttp
- CVE-2023-44383October CMS stored XSS by authenticated backend user with improper configurationoctobercms october · october/system
- CVE-2023-49083cryptography vulnerable to NULL-dereference when loading PKCS7 certificatespyca cryptography · cryptography
- CVE-2023-49090CarrierWave has a content-type allowlist bypass vulnerability, possibly leading to XSScarrierwaveuploader carrierwave · carrierwave
- CVE-2023-49674A missing permission check in Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier allows attackers with Overall/Read permission Jenkins Project Jenkins NeuVector Vulnerability Scanner Plu…
- CVE-2023-49656Jenkins MATLAB Plugin 2.11.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins Project Jenkins MATLAB Plugin · org.jenkins-ci.plug…
- CVE-2023-49655A cross-site request forgery (CSRF) vulnerability in Jenkins MATLAB Plugin 2.11.0 and earlier allows attackers to have Jenkins parse an XML Jenkins Project Jenkins MATLAB Plugin · org.jenkins-ci.plug…
- CVE-2023-49654Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins conJenkins Project Jenkins MATLAB Plugin · org.jenkins-ci.plug…
- CVE-2023-49653Jenkins Jira Plugin 3.11 and earlier does not set the appropriate context for credentials lookup, allowing attackers with Item/Configure perJenkins Project Jenkins Jira Plugin · org.jenkins-ci.plugin…
- CVE-2023-49652Incorrect permission checks in Jenkins Google Compute Engine Plugin 4.550.vb_327fca_3db_11 and earlier allow attackers with global Item/ConfJenkins Project Jenkins Google Compute Engine Plugin · org.…
- CVE-2023-40626[20231101] - Core - Exposure of environment variablesJoomla! Project Joomla! CMS
- CVE-2023-6351Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2023-6350Use after free in libavif in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2023-6346Use after free in WebAudio in Google Chrome prior to 119.0.6045.199 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2023-6348Type Confusion in Spellcheck in Google Chrome prior to 119.0.6045.199 allowed a remote attacker who had compromised the renderer process to Google Chrome
- CVE-2023-6070 A server-side request forgery vulnerability in ESM prior to version 11.6.8 allows a low privileged authenticated user to upload arbitrary cTrellix Enterprise Security Manager
- CVE-2023-23324Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain hardcoded credentials for the Administrator account.
- CVE-2023-23325Zumtobel Netlink CCD Onboard 3.74 - Firmware 3.80 was discovered to contain a command injection vulnerability via the NetHostname parameter.
- CVE-2023-24294Zumtobel Netlink CCD Onboard v3.74 - Firmware v3.80 was discovered to contain a buffer overflow via the component NetlinkWeb::Information::S
- CVE-2023-45479Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the list parameter in the function sub_49E09
- CVE-2023-45480Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the src parameter in the function sub_47D878
- CVE-2023-45482Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the urls parameter in the function get_paren
- CVE-2023-45483Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the time parameter in the function compare_p
- CVE-2023-45484Tenda AC10 version US_AC10V4.0si_V16.03.10.13_cn was discovered to contain a stack overflow via the shareSpeed parameter in the function fro
- CVE-2023-46887In Dreamer CMS before 4.0.1, the backend attachment management office has an Arbitrary File Download vulnerability.
- CVE-2023-47462Insecure Permissions vulnerability in GL.iNet AX1800 v.3.215 and before allows a remote attacker to execute arbitrary code via the file shar
- CVE-2023-48880A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a
- CVE-2023-48881A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a
- CVE-2023-48882A stored cross-site scripting (XSS) vulnerability in EyouCMS v1.6.4-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a
- CVE-2023-48946An issue in the box_mpy function of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a
- CVE-2023-48947An issue in the cha_cmp function of openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a
- CVE-2023-48948An issue in the box_div function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a
- CVE-2023-48949An issue in the box_add function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after running a
- CVE-2023-48950An issue in the box_col_len function in openlink virtuoso-opensource v7.2.11 allows attackers to cause a Denial of Service (DoS) after runni