Archive

November 2023

Vulnerabilities first published in this month (UTC), newest first.

← October 2023 2023 / November December 2023 →

All Critical High Medium Low Exploited only Public exploit

2,490 results · Feed

Medium 4.3

CVE-2023-49094

Symbolicator Server Side Request Forgery vulnerability

Symbolicator is a symbolication service for native stacktraces and minidumps with symbol server support. An attacker could make Symbolicator send arbitrary GET HTTP requests to internal IP addresses by using a specially crafted HTTP endpoint. The response cou…

getsentry symbolicator

Nov 30, 2023
High 8.1

CVE-2023-49097

ZITADEL vulnerable account takeover via malicious host header injection

ZITADEL is an identity infrastructure system. ZITADEL uses the notification triggering requests Forwarded or X-Forwarded-Host header to build the button link sent in emails for confirming a password reset with the emailed code. If this header is overwritten a…

zitadel zitadel github.com/zitadel/zitadel Go

Nov 30, 2023
High 7.8

CVE-2023-5247

Malicious Code Execution Vulnerability due to External Control of File Name or Path in multiple Mitsubishi Electric FA …

Mitsubishi Electric GX Works3 MELSOFT Navigator MELSOFT iQ AppPortal ICS / OT

Nov 30, 2023
Medium 4.3

CVE-2023-5772

Debug Log Manager <= 2.2.0 - Cross-Site Request Forgery

The Debug Log Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.2.1. This is due to missing or incorrect nonce validation on the clear_log() function. This makes it possible for unauthenticated at…

qriouslad Debug Log Manager – Conveniently Monitor and Inspect Errors Web / CMS

Nov 30, 2023
Critical 9.8

CVE-2023-4474 EPSS 30%

The improper neutralization of special elements in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C…

Zyxel NAS326 firmware NAS542 firmware Network devices

Nov 30, 2023
Critical 9.8

CVE-2023-4473 EPSS 41%

A command injection vulnerability in the web server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 fi…

Zyxel NAS326 firmware NAS542 firmware Network devices

Nov 30, 2023
High 8.8

CVE-2023-37928 EPSS 60%

A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZ…

Zyxel NAS326 firmware NAS542 firmware Network devices

Nov 30, 2023
High 8.8

CVE-2023-37927

The improper neutralization of special elements in the CGI program of the Zyxel NAS326 firmware version V5.21(AAZF.14)C…

Zyxel NAS326 firmware NAS542 firmware Network devices

Nov 30, 2023
Critical 9.8

CVE-2023-35138 EPSS 40%

A command injection vulnerability in the “show_zysync_server_contents” function of the Zyxel NAS326 firmware version V5…

Zyxel NAS326 firmware NAS542 firmware Network devices

Nov 30, 2023
High 7.5

CVE-2023-35137

An improper authentication vulnerability in the authentication module of the Zyxel NAS326 firmware version V5.21(AAZF.1…

Zyxel NAS326 firmware NAS542 firmware Network devices

Nov 30, 2023
Unscored —

CVE-2023-3741

An OS Command injection vulnerability in NEC Platforms DT900 and DT900S Series all versions allows an attacker to execu…

NEC Platforms ITK-8TCGX-1(BK)TEL ITK-6DG-1P(BK)TEL ITK-32LCGS-1A(BK) TEL

Nov 30, 2023
Unscored —

CVE-2023-48808

In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end throu…

Nov 30, 2023
Unscored —

CVE-2023-48805

In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end throu…

Nov 30, 2023
Unscored —

CVE-2023-48912

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/edit.

Nov 30, 2023
Unscored —

CVE-2023-48806

In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end throu…

Nov 30, 2023
Unscored —

CVE-2023-48894

Incorrect Access Control vulnerability in jshERP V3.3 allows attackers to obtain sensitive information via the doFilter…

Nov 30, 2023
Critical 9.8

CVE-2023-48802

In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end throu…

Nov 30, 2023
Unscored —

CVE-2023-48811

In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end throu…

Nov 30, 2023
Unscored —

CVE-2023-48913

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/dele…

Nov 30, 2023
Unscored —

CVE-2023-48804

In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end throu…

Nov 30, 2023
Unscored —

CVE-2023-48807

In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end throu…

Nov 30, 2023
Unscored —

CVE-2023-48914

Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/archives/add.

Nov 30, 2023
Unscored —

CVE-2023-48963

Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/wifiSSIDget.

Nov 30, 2023
Unscored —

CVE-2023-48810

In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end throu…

Nov 30, 2023
Unscored —

CVE-2023-48803

In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file, sub_4119A0 function obtains fields from the front-end throu…

Nov 30, 2023
Unscored —

CVE-2023-48964

Tenda i6 V1.0.0.8(3856) is vulnerable to Buffer Overflow via /goform/WifiMacFilterSet.

Nov 30, 2023
Unscored —

CVE-2023-48812

In TOTOLINK X6000R V9.4.0cu.852_B20230719, the shttpd file sub_4119A0 function obtains fields from the front-end throug…

Nov 30, 2023
Unscored —

CVE-2023-46383

LOYTEC electronics GmbH LINX Configurator (all versions) uses HTTP Basic Authentication, which transmits usernames and …

Nov 30, 2023
Unscored —

CVE-2023-46386

LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via registr…

Nov 30, 2023
Unscored —

CVE-2023-46388

LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Insecure Permissions via dpal_co…

Nov 30, 2023
Unscored —

CVE-2023-46384

LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. Cleartext storage of cr…

Nov 30, 2023
High 7.2

CVE-2023-46956

SQL injection vulnerability in Packers and Movers Management System v.1.0 allows a remote attacker to execute arbitrary…

Nov 30, 2023
Unscored —

CVE-2023-46387

LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via dpa…

Nov 30, 2023
Unscored —

CVE-2023-46389

LOYTEC electronics GmbH LINX-212 and LINX-151 devices (all versions) are vulnerable to Incorrect Access Control via reg…

Nov 30, 2023
Unscored —

CVE-2023-46385

LOYTEC electronics GmbH LINX Configurator (all versions) is vulnerable to Insecure Permissions. An admin credential is …

Nov 30, 2023
Unscored —

CVE-2023-46326

ZStack Cloud version 3.10.38 and before allows unauthenticated API access to the list of active job UUIDs and the sessi…

Nov 30, 2023
Unscored —

CVE-2023-47418

Remote Code Execution (RCE) vulnerability in o2oa version 8.1.2 and before, allows attackers to create a new interface …

Nov 30, 2023
Unscored —

CVE-2023-47454

An Untrusted search path vulnerability in NetEase CloudMusic 2.10.4 for Windows allows local users to gain escalated pr…

Nov 30, 2023
Critical 9.8

CVE-2023-47463

Insecure Permissions vulnerability in GL.iNet AX1800 version 4.0.0 before 4.5.0 allows a remote attacker to execute arb…

Nov 30, 2023
Unscored —

CVE-2023-47453

An Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain escalated privileges th…

Nov 30, 2023