Skip to content
OpenAdvisories

Archive

November 2023

Vulnerabilities first published in this month (UTC), newest first.

← October 2023 2023 / November December 2023 →
  1. 1144
  2. 296
  3. 3108
  4. 48
  5. 57
  6. 6118
  7. 7163
  8. 8111
  9. 9100
  10. 1039
  11. 115
  12. 1236
  13. 1382
  14. 14339
  15. 1575
  16. 16131
  17. 1773
  18. 1844
  19. 191
  20. 2075
  21. 2162
  22. 22168
  23. 2350
  24. 2417
  25. 25 
  26. 269
  27. 2795
  28. 2872
  29. 2957
  30. 30205
All Critical High Medium Low Exploited only Public exploit

17 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-48022 Public exploit Scanner template EPSS 84%

    Ray has arbitrary code execution via jobs submission API

    Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictl…

    ray PyPI
  • Critical 9.8
    CVE-2023-6329 Public exploit Scanner template EPSS 65%

    Control iD iDSecure passwordCustom Authentication Bypass

    An authentication bypass vulnerability exists in Control iD iDSecure v4.7.32.0. The login routine used by iDS-Core.dll contains a "passwordCustom" option that allows an unauthenticated attacker to compute valid credentials that can be used to bypass authentic…

    Control iD iDSecure
  • Critical 9.8
    CVE-2023-2437 Public exploit Scanner template

    UserPro <= 5.1.1 - Authentication Bypass to Administrator

    The UserPro plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.1.1. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthe…

    Web / CMS
  • Critical 10.0
    CVE-2023-49103 Exploited Public exploit Scanner template EPSS 78%

    An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1. The graphapi app relie…

    KEV Nov 30, 2023
  • Critical 9.8
    CVE-2023-49105 Exploited Public exploit EPSS 43%

    An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file wi…

    KEV Aug 27, 2026
  • Critical 9.7
    CVE-2023-48292 Public exploit EPSS 23%

    XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks

    The XWiki Admin Tools Application provides tools to help the administration of XWiki. Starting in version 4.4 and prior to version 4.5.1, a cross site request forgery vulnerability in the admin tool for executing shell commands on the server allows an attacke…

    xwiki-contrib application-admintools org.xwiki.contrib:xwiki-application-admintools Maven
  • Critical 9.8
    CVE-2023-6019 Public exploit EPSS 75%

    Ray Command Injection in cpu_profile Parameter

    A command injection existed in Ray's cpu_profile URL parameter allowing attackers to execute os commands on the system running the ray dashboard remotely without authentication. The issue is fixed in version 2.8.1+. Ray maintainers' response can be found here…

    ray-project ray-project/ray ray PyPI
  • Critical 9.8
    CVE-2023-47246 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a …

    KEV Nov 13, 2023
  • Critical 9.8
    CVE-2023-47248 Public exploit Scanner template EPSS 13%

    PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file

    Deserialization of untrusted data in IPC and Parquet readers in PyArrow versions 0.14.0 to 14.0.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources (for example user-supplied in…

    Apache Software Foundation PyArrow pyarrow PyPI
  • Critical 9.9
    CVE-2021-43609 Public exploit

    An issue was discovered in Spiceworks Help Desk Server before 1.3.3. A Blind Boolean SQL injection vulnerability within…

  • Critical 9.1
    CVE-2023-46501 Public exploit

    An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view …

  • Critical 10.0
    CVE-2023-4699 Public exploit

    Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA products

    Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation MELSEC-F Series CPU modules, MELSEC iQ-F Series, MELSEC iQ-R series CPU modules, MELSEC iQ-R series, MELSEC iQ-L series, MELSEC Q series, MELSEC-L series, Mitsubishi…

    Mitsubishi Electric MELSEC-F Series FX3U-32MT/ES-A MELSEC-F Series FX3U-48MT/ESS MELSEC-F Series FX3U-48MR/DS ICS / OT
  • Critical 9.8
    CVE-2023-47253 Public exploit Scanner template EPSS 16%

    Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/reque…

  • Critical 9.9
    CVE-2023-46404 Public exploit

    PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping…

  • Critical 9.8
    CVE-2023-46954 Public exploit

    SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attack…

  • Critical 9.8
    CVE-2023-46980 Public exploit

    An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privil…

  • Critical 9.9
    CVE-2023-20048 Public exploit EPSS 21%

    A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authen…

    Cisco Cisco Firepower Management Center Network devices