Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: November 2023

169 records · 11 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2023-4197
    46Plan

    Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE

    HighCVSS 8.8Proof of conceptEPSS 35%

    dolibarr · dolibarr erp\/crmNov 1, 2023

  • CVE-2023-1718
    37Monitor

    Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access

    HighCVSS 7.5Proof of conceptEPSS 24%

    bitrix24 · bitrix24Nov 1, 2023

  • CVE-2023-1719
    40Plan

    Bitrix24 Insecure Global Variable Extraction

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    bitrix24 · bitrix24Nov 1, 2023

  • CVE-2023-20048
    44Plan

    A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attac

    CriticalCVSS 9.9Proof of conceptEPSS 15%

    cisco · secure firewall management centerNov 1, 2023

  • CVE-2023-5178
    38Monitor

    Kernel: use after free in nvmet_tcp_free_crypto in nvme

    HighCVSS 8.8Proof of conceptEPSS 9%

    linux · linux kernelNov 1, 2023

  • CVE-2023-46695
    45Plan

    An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.

    HighCVSS 7.5No exploitEPSS 49%

    djangoproject · djangoNov 2, 2023

  • CVE-2023-46954
    39Monitor

    SQL Injection vulnerability in Relativity ODA LLC RelativityOne v.12.1.537.3 Patch 2 and earlier allows a remote attacker to execute arbitra

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    relativity · relativityoneNov 2, 2023

  • CVE-2023-31102
    48Plan

    Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.

    HighCVSS 7.8No exploitEPSS 55%

    7-zip · 7-zipNov 3, 2023

  • CVE-2023-34259
    37Monitor

    Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the

    MediumCVSS 4.9Proof of conceptEPSS 60%

    kyocera · d-copia253mf plus firmwareNov 3, 2023

  • CVE-2023-34260
    52Plan

    Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed

    HighCVSS 7.5No exploitEPSS 73%

    kyocera · d-copia253mf plus firmwareNov 3, 2023

  • CVE-2023-46847
    54Plan

    Squid: denial of service in http digest authentication

    HighCVSS 7.5No exploitEPSS 78%

    squid-cache · squidNov 3, 2023

  • CVE-2023-46848
    33Monitor

    Squid: denial of service in ftp

    HighCVSS 7.5No exploitEPSS 10%

    squid-cache · squidNov 3, 2023

  • CVE-2023-3277
    40Plan

    MStore API <= 4.10.7 - Unauthorized Account Access and Privilege Escalation

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    inspireui · mstore apiNov 3, 2023

  • CVE-2023-41652
    39Monitor

    WordPress RSVPMarker Plugin <= 10.6.6 is vulnerable to SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    carrcommunications · rsvpmakerNov 3, 2023

  • CVE-2022-45805
    40Plan

    WordPress Paytm Payment Gateway Plugin <= 2.7.3 is vulnerable to SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    paytm · payment gatewayNov 3, 2023

  • CVE-2023-46404
    40Plan

    PCRS <= 3.11 (d0de1e) “Questions” page and “Code editor” page are vulnerable to remote code execution (RCE) by escaping Python sandboxing.

    CriticalCVSS 9.9Proof of conceptEPSS 1%

    utoronto · pcrsNov 3, 2023

  • CVE-2023-46980
    39Monitor

    An issue in Best Courier Management System v.1.0 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted sc

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    mayurik · best courier management systemNov 3, 2023

  • CVE-2023-23368
    45Plan

    QTS, QuTS hero, QuTScloud

    CriticalCVSS 9.8No exploitEPSS 18%

    qnap · qtsNov 3, 2023

  • CVE-2023-23369
    43Plan

    QTS, Multimedia Console, and Media Streaming add-on

    CriticalCVSS 9.8No exploitEPSS 14%

    qnap · qtsNov 3, 2023

  • CVE-2022-3172
    33Monitor

    Kubernetes - API server - Aggregated API server can cause clients to be redirected (SSRF)

    HighCVSS 8.2Proof of conceptEPSS 2%

    kubernetes · apiserverNov 3, 2023

  • CVE-2022-44569
    31Monitor

    A locally authenticated attacker with low privileges can bypass authentication due to insecure inter-process communication.

    HighCVSS 7.8Proof of conceptEPSS 0%

    ivanti · automationNov 3, 2023

  • CVE-2023-47253
    43Plan

    Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.ph

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    qualitor · qualitorNov 6, 2023

  • CVE-2023-4699
    36Monitor

    Arbitrary Command Execution Vulnerability in Mitsubishi Electric proprietary protocol communication of multiple FA products

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    mitsubishielectric · fx3u-32mt\/es firmwareNov 6, 2023

  • CVE-2023-45657
    39Monitor

    WordPress Nexter Theme <= 2.0.3 is vulnerable to SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    posimyth · nexterNov 6, 2023

  • CVE-2023-5968
    19Monitor

    Password hash in response body after username update

    MediumCVSS 4.9Proof of conceptEPSS 0%

    mattermost · mattermostNov 6, 2023

  • CVE-2023-45827
    39Monitor

    Prototype Pollution vulnerability in @clickbar/dot-diver

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    clickbar · dot-diverNov 6, 2023

  • CVE-2023-46731
    66This week

    Remote code execution through the section parameter in Administration as guest in XWiki Platform

    CriticalCVSS 9.8No exploitEPSS 88%

    xwiki · xwikiNov 6, 2023

  • CVE-2023-46732
    25Monitor

    Reflected Cross-site scripting through revision parameter in content menu in XWiki Platform

    MediumCVSS 6.1Proof of conceptEPSS 2%

    xwiki · xwikiNov 6, 2023

  • CVE-2023-5777
    39Monitor

    Weintek EasyBuilder Pro Use of Hard-coded Credentials

    CriticalCVSS 9.8No exploitEPSS 0%

    weintek · easybuilder proNov 6, 2023

  • CVE-2023-46998
    24Monitor

    Cross Site Scripting vulnerability in BootBox Bootbox.js v.3.2 through 6.0 allows a remote attacker to execute arbitrary code via a crafted

    MediumCVSS 6.1Proof of conceptEPSS 1%

    bootboxjs · bootboxNov 7, 2023

  • CVE-2023-47102
    21Monitor

    UrBackup Server 2.5.31 allows brute-force enumeration of user accounts because a failure message confirms that a username is not valid.

    MediumCVSS 5.3Proof of conceptEPSS 0%

    urbackup · urbackup serverNov 7, 2023

  • CVE-2023-38547
    45Plan

    A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its

    CriticalCVSS 9.8No exploitEPSS 18%

    veeam · oneNov 7, 2023

  • CVE-2023-38548
    21Monitor

    A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of

    MediumCVSS 4.3No exploitEPSS 11%

    veeam · oneNov 7, 2023

  • CVE-2023-38549
    27Monitor

    A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of

    MediumCVSS 5.4No exploitEPSS 19%

    veeam · oneNov 7, 2023

  • CVE-2023-41723
    21Monitor

    A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule.

    MediumCVSS 4.3No exploitEPSS 12%

    veeam · oneNov 7, 2023

  • CVE-2023-42283
    39Monitor

    Blind SQL injection in api_id parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL query

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    tyk · tykNov 7, 2023

  • CVE-2023-42284
    39Monitor

    Blind SQL injection in api_version parameter in Tyk Gateway version 5.0.3 allows attacker to access and dump the database via a crafted SQL

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    tyk · tykNov 7, 2023

  • CVE-2023-4842
    21Monitor

    Social Sharing Plugin - Social Warfare <= 4.4.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    MediumCVSS 5.4Proof of conceptEPSS 0%

    warfareplugins · social warfareNov 7, 2023

  • CVE-2023-41425
    60This week

    Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted scrip

    MediumCVSS 6.1WeaponizedEPSS 54%

    wondercms · wondercmsNov 7, 2023

  • CVE-2023-46501
    36Monitor

    An issue in BoltWire v.6.03 allows a remote attacker to obtain sensitive information via a crafted payload to the view and change admin pass

    CriticalCVSS 9.1Proof of conceptEPSS 1%

    boltwire · boltwireNov 7, 2023

  • CVE-2023-45857
    26Monitor

    An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-

    MediumCVSS 6.5Proof of conceptEPSS 0%

    axios · axiosNov 8, 2023

  • CVE-2023-3959
    54Plan

    Zavio IP Camera Stack-Based Buffer Overflow

    CriticalCVSS 9.8No exploitEPSS 48%

    zavio · cf7500 firmwareNov 8, 2023

  • CVE-2023-4249
    43Plan

    Zavio IP Camera Stack-Based Buffer Overflow

    CriticalCVSS 9.8No exploitEPSS 12%

    zavio · cf7500 firmwareNov 8, 2023

  • CVE-2021-43609
    36Monitor

    An issue was discovered in Spiceworks Help Desk Server before 1.3.3.

    HighCVSS 8.8Proof of conceptEPSS 2%

    spiceworks · help desk serverNov 8, 2023

  • CVE-2023-37790
    21Monitor

    Jaspersoft Clarity PPM version 14.3.0.298 was discovered to contain an arbitrary file upload vulnerability via the Profile Picture Upload fu

    MediumCVSS 5.4Proof of conceptEPSS 0%

    broadcom · clarityNov 8, 2023

  • CVE-2023-47248
    43Plan

    PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    apache · pyarrowNov 9, 2023

  • CVE-2023-5546
    21Monitor

    Moodle: stored xss in quiz grading report via user id number

    MediumCVSS 5.4Proof of conceptEPSS 1%

    moodle · moodleNov 9, 2023

  • CVE-2023-39796
    41Plan

    SQL injection vulnerability in the miniform module in WBCE CMS v.1.6.0 allows remote unauthenticated attacker to execute arbitrary code via

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    wbce · wbce cmsNov 10, 2023

  • CVE-2023-47246
    99Now

    In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    sysaid · sysaidNov 10, 2023

  • CVE-2023-45806
    21Monitor

    Discourse vulnerable to DoS via Regexp Injection in Full Name

    MediumCVSS 5.4Proof of conceptEPSS 0%

    discourse · discourseNov 10, 2023

  • CVE-2023-47119
    24Monitor

    HTML injection in oneboxed links

    MediumCVSS 6.1Proof of conceptEPSS 0%

    discourse · discourseNov 10, 2023

  • CVE-2023-47108
    31Monitor

    DoS vulnerability in otelgrpc (uncontrolled resource consumption) due to unbound cardinality metrics

    HighCVSS 7.5Proof of conceptEPSS 2%

    opentelemetry · opentelemetryNov 10, 2023

  • CVE-2023-47129
    39Monitor

    Statamic CMS remote code execution via front-end form uploads

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    statamic · statamicNov 10, 2023

  • CVE-2022-45835
    41Plan

    WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)

    HighCVSS 7.5Proof of conceptEPSS 37%

    phonepe · phonepeNov 12, 2023

  • CVE-2023-47117
    31Monitor

    Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio

    HighCVSS 7.5Proof of conceptEPSS 4%

    humansignal · label studioNov 13, 2023

  • CVE-2023-46014
    22Monitor

    SQL Injection vulnerability in hospitalLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'hemail'

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46015
    24Monitor

    Cross Site Scripting (XSS) vulnerability in index.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via 'msg' param

    MediumCVSS 6.1Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46016
    24Monitor

    Cross Site Scripting (XSS) in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'search' parameter in t

    MediumCVSS 6.1Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46017
    22Monitor

    SQL Injection vulnerability in receiverLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'remail'

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46018
    22Monitor

    SQL injection vulnerability in receiverReg.php in Code-Projects Blood Bank 1.0 \allows attackers to run arbitrary SQL commands via 'remail'

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46019
    24Monitor

    Cross Site Scripting (XSS) vulnerability in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'error' p

    MediumCVSS 6.1Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46020
    24Monitor

    Cross Site Scripting (XSS) in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'rename', 're

    MediumCVSS 6.1Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46021
    22Monitor

    SQL Injection vulnerability in cancel.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary commands via the 'reqid' paramet

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-47684
    24Monitor

    WordPress Essential Grid Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 0%

    themepunch · essential gridNov 13, 2023

  • CVE-2023-42325
    38Monitor

    Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the sta

    MediumCVSS 5.4No exploitEPSS 57%

    netgate · pfsenseNov 14, 2023

  • CVE-2023-42327
    38Monitor

    Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the get

    MediumCVSS 5.4No exploitEPSS 55%

    netgate · pfsenseNov 14, 2023

  • CVE-2023-42326
    54Plan

    An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php

    HighCVSS 8.8Proof of conceptEPSS 64%

    netgate · pfsenseNov 14, 2023

  • CVE-2023-45878
    58Plan

    GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authenticati

    CriticalCVSS 9.8Proof of conceptEPSS 63%

    gibbonedu · gibbonNov 14, 2023

  • CVE-2023-34991
    48Plan

    A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and

    CriticalCVSS 9.8No exploitEPSS 28%

    fortinet · fortiwlmNov 14, 2023

  • CVE-2023-36017
    43Plan

    Windows Scripting Engine Memory Corruption Vulnerability

    HighCVSS 8.8No exploitEPSS 25%

    microsoft · windows 10 1507Nov 14, 2023

  • CVE-2023-36025
    91Now

    Windows SmartScreen Security Feature Bypass Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 88%

    microsoft · windows 10 1507Nov 14, 2023

  • CVE-2023-36033
    64This week

    Windows DWM Core Library Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 10%

    microsoft · windows 10 1809Nov 14, 2023

  • CVE-2023-36035
    58Plan

    Microsoft Exchange Server Spoofing Vulnerability

    HighCVSS 8.0No exploitEPSS 86%

    microsoft · exchange serverNov 14, 2023

  • CVE-2023-36036
    66This week

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 16%

    microsoft · windows 10 1507Nov 14, 2023

  • CVE-2023-36039
    54Plan

    Microsoft Exchange Server Spoofing Vulnerability

    HighCVSS 8.0No exploitEPSS 72%

    microsoft · exchange serverNov 14, 2023

  • CVE-2023-36041
    48Plan

    Microsoft Excel Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 56%

    microsoft · 365 appsNov 14, 2023

  • CVE-2023-36050
    44Plan

    Microsoft Exchange Server Spoofing Vulnerability

    HighCVSS 8.0No exploitEPSS 39%

    microsoft · exchange serverNov 14, 2023

  • CVE-2023-36052
    40Plan

    Azure CLI REST Command Information Disclosure Vulnerability

    HighCVSS 8.6No exploitEPSS 21%

    microsoft · azure command-line interfaceNov 14, 2023

  • CVE-2023-36397
    44Plan

    Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 17%

    microsoft · windows 10 1507Nov 14, 2023

  • CVE-2023-36407
    32Monitor

    Windows Hyper-V Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 1%

    microsoft · windows 11 21h2Nov 14, 2023

  • CVE-2023-36413
    35Monitor

    Microsoft Office Security Feature Bypass Vulnerability

    MediumCVSS 6.5No exploitEPSS 29%

    microsoft · 365 appsNov 14, 2023

  • CVE-2023-36424
    65This week

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 12%

    microsoft · windows 10 1507Nov 14, 2023

  • CVE-2023-36427
    28Monitor

    Windows Hyper-V Elevation of Privilege Vulnerability

    HighCVSS 7.0Proof of conceptEPSS 1%

    microsoft · windows 10 1809Nov 14, 2023

  • CVE-2023-23583
    31Monitor

    Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially

    HighCVSS 7.8Proof of conceptEPSS 1%

    intel · core i3-10100y firmwareNov 14, 2023

  • CVE-2023-31320
    30Monitor

    Improper input validation in the AMD RadeonTM Graphics display driver may allow an attacker to corrupt the display potentially resulting in

    HighCVSS 7.5Proof of conceptEPSS 1%

    amd · radeon softwareNov 14, 2023

  • CVE-2023-47125
    24Monitor

    By-passing Cross-Site Scripting Protection in HTML Sanitizer

    MediumCVSS 6.1Proof of conceptEPSS 0%

    typo3 · html sanitizerNov 14, 2023

  • CVE-2023-46022
    31Monitor

    SQL Injection vulnerability in delete.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via the 'bid' param

    HighCVSS 7.8Proof of conceptEPSS 0%

    code-projects · blood bankNov 14, 2023

  • CVE-2023-46023
    26Monitor

    SQL injection vulnerability in addTask.php in Code-Projects Simple Task List 1.0 allows attackers to obtain sensitive information via the 's

    MediumCVSS 6.5Proof of conceptEPSS 0%

    code-projects · simple task listNov 14, 2023

  • CVE-2023-46024
    30Monitor

    SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary SQ

    HighCVSS 7.5Proof of conceptEPSS 1%

    phpgurukul · teacher subject allocation management systemNov 14, 2023

  • CVE-2023-46580
    21Monitor

    Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of

    MediumCVSS 5.4Proof of conceptEPSS 0%

    code-projects · inventory managementNov 14, 2023

  • CVE-2023-35080
    31Monitor

    A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploi

    HighCVSS 7.8Proof of conceptEPSS 0%

    ivanti · secure access clientNov 14, 2023

  • CVE-2023-41597
    24Monitor

    EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    eyoucms · eyoucmsNov 15, 2023

  • CVE-2023-6112
    42Plan

    Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a

    HighCVSS 8.8No exploitEPSS 24%

    google · chromeNov 15, 2023

  • CVE-2023-48365
    83Now

    Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683.

    CriticalCVSS 9.9KEVWeaponizedEPSS 47%

    qlik · qlik senseNov 15, 2023

  • CVE-2023-43757
    26Monitor

    Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    elecom · wrc-2533ghbk2-t firmwareNov 16, 2023

  • CVE-2023-6016
    48Plan

    H2O Remote Code Execution via POJO Model Import

    CriticalCVSS 9.8No exploitEPSS 30%

    h2o · h2oNov 16, 2023

  • CVE-2023-6018
    53Plan

    MLflow Arbitrary File Write

    CriticalCVSS 9.8Proof of conceptEPSS 47%

    lfprojects · mlflowNov 16, 2023

  • CVE-2023-6023
    31Monitor

    ModelDB Local File Include

    HighCVSS 7.5Proof of conceptEPSS 2%

    vertaai · modeldbNov 16, 2023

  • CVE-2023-6019
    61This week

    Ray Command Injection in cpu_profile Parameter

    CriticalCVSS 9.8WeaponizedEPSS 74%

    ray project · rayNov 16, 2023

  • CVE-2023-6021
    41Plan

    Ray Log File Local File Include

    HighCVSS 7.5Proof of conceptEPSS 37%

    ray project · rayNov 16, 2023