Skip to content
Noroxi
By publication date

Exploited and new serious CVEs: November 2023

139 records · 11 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2023-4197
    46Plan

    Dolibarr ERP CRM (<= 18.0.1) Improper Input Sanitization Authenticated RCE

    HighCVSS 8.8Proof of conceptEPSS 36%

    dolibarr · dolibarr erp\/crmNov 1, 2023

  • CVE-2023-1718
    39Monitor

    Bitrix24 Denial-of-Service (DoS) via Improper File Stream Access

    HighCVSS 7.5Proof of conceptEPSS 28%

    bitrix24 · bitrix24Nov 1, 2023

  • CVE-2023-20048
    45Plan

    A vulnerability in the web services interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attac

    CriticalCVSS 9.9Proof of conceptEPSS 20%

    cisco · secure firewall management centerNov 1, 2023

  • CVE-2023-46695
    46Plan

    An issue was discovered in Django 3.2 before 3.2.23, 4.1 before 4.1.13, and 4.2 before 4.2.7.

    HighCVSS 7.5No exploitEPSS 53%

    djangoproject · djangoNov 2, 2023

  • CVE-2023-31102
    47Plan

    Ppmd7.c in 7-Zip before 23.00 allows an integer underflow and invalid read operation via a crafted 7Z archive.

    HighCVSS 7.8No exploitEPSS 53%

    7-zip · 7-zipNov 3, 2023

  • CVE-2023-34259
    37Monitor

    Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow /wlmdeu%2f%2e%2e%2f%2e%2e directory traversal to read arbitrary files on the

    MediumCVSS 4.9Proof of conceptEPSS 60%

    kyocera · d-copia253mf plus firmwareNov 3, 2023

  • CVE-2023-34260
    53Plan

    Kyocera TASKalfa 4053ci printers through 2VG_S000.002.561 allow a denial of service (service outage) via /wlmdeu%2f%2e%2e%2f%2e%2e followed

    HighCVSS 7.5No exploitEPSS 75%

    kyocera · d-copia253mf plus firmwareNov 3, 2023

  • CVE-2023-46847
    54Plan

    Squid: denial of service in http digest authentication

    HighCVSS 7.5No exploitEPSS 78%

    squid-cache · squidNov 3, 2023

  • CVE-2023-46848
    33Monitor

    Squid: denial of service in ftp

    HighCVSS 7.5No exploitEPSS 11%

    squid-cache · squidNov 3, 2023

  • CVE-2023-23368
    44Plan

    QTS, QuTS hero, QuTScloud

    CriticalCVSS 9.8No exploitEPSS 17%

    qnap · qtsNov 3, 2023

  • CVE-2023-23369
    43Plan

    QTS, Multimedia Console, and Media Streaming add-on

    CriticalCVSS 9.8No exploitEPSS 14%

    qnap · qtsNov 3, 2023

  • CVE-2023-47253
    44Plan

    Qualitor through 8.20 allows remote attackers to execute arbitrary code via PHP code in the html/ad/adpesquisasql/request/processVariavel.ph

    CriticalCVSS 9.8Proof of conceptEPSS 16%

    qualitor · qualitorNov 6, 2023

  • CVE-2023-46731
    66This week

    Remote code execution through the section parameter in Administration as guest in XWiki Platform

    CriticalCVSS 9.8No exploitEPSS 89%

    xwiki · xwikiNov 6, 2023

  • CVE-2023-5777
    39Monitor

    Weintek EasyBuilder Pro Use of Hard-coded Credentials

    CriticalCVSS 9.8No exploitEPSS 0%

    weintek · easybuilder proNov 6, 2023

  • CVE-2023-38547
    45Plan

    A vulnerability in Veeam ONE allows an unauthenticated user to gain information about the SQL server connection Veeam ONE uses to access its

    CriticalCVSS 9.8No exploitEPSS 20%

    veeam · oneNov 7, 2023

  • CVE-2023-38548
    20Monitor

    A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of

    MediumCVSS 4.3No exploitEPSS 11%

    veeam · oneNov 7, 2023

  • CVE-2023-38549
    27Monitor

    A vulnerability in Veeam ONE allows an unprivileged user who has access to the Veeam ONE Web Client the ability to acquire the NTLM hash of

    MediumCVSS 5.4No exploitEPSS 19%

    veeam · oneNov 7, 2023

  • CVE-2023-41723
    21Monitor

    A vulnerability in Veeam ONE allows a user with the Veeam ONE Read-Only User role to view the Dashboard Schedule.

    MediumCVSS 4.3No exploitEPSS 12%

    veeam · oneNov 7, 2023

  • CVE-2023-41425
    60This week

    Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted scrip

    MediumCVSS 6.1WeaponizedEPSS 65%

    wondercms · wondercmsNov 7, 2023

  • CVE-2023-3959
    54Plan

    Zavio IP Camera Stack-Based Buffer Overflow

    CriticalCVSS 9.8No exploitEPSS 48%

    zavio · cf7500 firmwareNov 8, 2023

  • CVE-2023-4249
    43Plan

    Zavio IP Camera Stack-Based Buffer Overflow

    CriticalCVSS 9.8No exploitEPSS 12%

    zavio · cf7500 firmwareNov 8, 2023

  • CVE-2023-47248
    43Plan

    PyArrow, PyArrow: Arbitrary code execution when loading a malicious data file

    CriticalCVSS 9.8Proof of conceptEPSS 13%

    apache · pyarrowNov 9, 2023

  • CVE-2023-47246
    99Now

    In SysAid On-Premise before 23.3.36, a path traversal vulnerability leads to code execution after an attacker writes a file to the Tomcat we

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    sysaid · sysaidNov 10, 2023

  • CVE-2022-45835
    41Plan

    WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)

    HighCVSS 7.5Proof of conceptEPSS 37%

    phonepe · phonepeNov 12, 2023

  • CVE-2023-47117
    31Monitor

    Object Relational Mapper Leak Vulnerability in Filtering Task in Label Studio

    HighCVSS 7.5Proof of conceptEPSS 4%

    humansignal · label studioNov 13, 2023

  • CVE-2023-46014
    22Monitor

    SQL Injection vulnerability in hospitalLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'hemail'

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46015
    24Monitor

    Cross Site Scripting (XSS) vulnerability in index.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via 'msg' param

    MediumCVSS 6.1Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46016
    24Monitor

    Cross Site Scripting (XSS) in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'search' parameter in t

    MediumCVSS 6.1Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46017
    22Monitor

    SQL Injection vulnerability in receiverLogin.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via 'remail'

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46018
    22Monitor

    SQL injection vulnerability in receiverReg.php in Code-Projects Blood Bank 1.0 \allows attackers to run arbitrary SQL commands via 'remail'

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46019
    24Monitor

    Cross Site Scripting (XSS) vulnerability in abs.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'error' p

    MediumCVSS 6.1Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46020
    24Monitor

    Cross Site Scripting (XSS) in updateprofile.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary code via the 'rename', 're

    MediumCVSS 6.1Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-46021
    22Monitor

    SQL Injection vulnerability in cancel.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary commands via the 'reqid' paramet

    MediumCVSS 5.5Proof of conceptEPSS 0%

    code-projects · blood bankNov 13, 2023

  • CVE-2023-47684
    24Monitor

    WordPress Essential Grid Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 0%

    themepunch · essential gridNov 13, 2023

  • CVE-2023-42325
    38Monitor

    Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the sta

    MediumCVSS 5.4No exploitEPSS 57%

    netgate · pfsenseNov 14, 2023

  • CVE-2023-42327
    38Monitor

    Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the get

    MediumCVSS 5.4No exploitEPSS 55%

    netgate · pfsenseNov 14, 2023

  • CVE-2023-42326
    54Plan

    An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php

    HighCVSS 8.8Proof of conceptEPSS 64%

    netgate · pfsenseNov 14, 2023

  • CVE-2023-45878
    58Plan

    GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write because rubrics_visualise_saveAjax.phps does not require authenticati

    CriticalCVSS 9.8Proof of conceptEPSS 63%

    gibbonedu · gibbonNov 14, 2023

  • CVE-2023-34991
    48Plan

    A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and

    CriticalCVSS 9.8No exploitEPSS 28%

    fortinet · fortiwlmNov 14, 2023

  • CVE-2023-36017
    43Plan

    Windows Scripting Engine Memory Corruption Vulnerability

    HighCVSS 8.8No exploitEPSS 25%

    microsoft · windows 10 1507Nov 14, 2023

  • CVE-2023-36025
    91Now

    Windows SmartScreen Security Feature Bypass Vulnerability

    HighCVSS 8.8KEVWeaponizedEPSS 88%

    microsoft · windows 10 1507Nov 14, 2023

  • CVE-2023-36033
    64This week

    Windows DWM Core Library Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 10%

    microsoft · windows 10 1809Nov 14, 2023

  • CVE-2023-36035
    58Plan

    Microsoft Exchange Server Spoofing Vulnerability

    HighCVSS 8.0No exploitEPSS 86%

    microsoft · exchange serverNov 14, 2023

  • CVE-2023-36036
    66This week

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 16%

    microsoft · windows 10 1507Nov 14, 2023

  • CVE-2023-36039
    54Plan

    Microsoft Exchange Server Spoofing Vulnerability

    HighCVSS 8.0No exploitEPSS 72%

    microsoft · exchange serverNov 14, 2023

  • CVE-2023-36041
    48Plan

    Microsoft Excel Remote Code Execution Vulnerability

    HighCVSS 7.8No exploitEPSS 56%

    microsoft · 365 appsNov 14, 2023

  • CVE-2023-36050
    44Plan

    Microsoft Exchange Server Spoofing Vulnerability

    HighCVSS 8.0No exploitEPSS 39%

    microsoft · exchange serverNov 14, 2023

  • CVE-2023-36052
    40Plan

    Azure CLI REST Command Information Disclosure Vulnerability

    HighCVSS 8.6No exploitEPSS 21%

    microsoft · azure command-line interfaceNov 14, 2023

  • CVE-2023-36397
    44Plan

    Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

    CriticalCVSS 9.8No exploitEPSS 17%

    microsoft · windows 10 1507Nov 14, 2023

  • CVE-2023-36407
    32Monitor

    Windows Hyper-V Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 1%

    microsoft · windows 11 21h2Nov 14, 2023

  • CVE-2023-36413
    35Monitor

    Microsoft Office Security Feature Bypass Vulnerability

    MediumCVSS 6.5No exploitEPSS 29%

    microsoft · 365 appsNov 14, 2023

  • CVE-2023-36424
    65This week

    Windows Common Log File System Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 12%

    microsoft · windows 10 1507Nov 14, 2023

  • CVE-2023-36427
    28Monitor

    Windows Hyper-V Elevation of Privilege Vulnerability

    HighCVSS 7.0Proof of conceptEPSS 1%

    microsoft · windows 10 1809Nov 14, 2023

  • CVE-2023-23583
    31Monitor

    Sequence of processor instructions leads to unexpected behavior for some Intel(R) Processors may allow an authenticated user to potentially

    HighCVSS 7.8Proof of conceptEPSS 1%

    intel · core i3-10100y firmwareNov 14, 2023

  • CVE-2023-31320
    30Monitor

    Improper input validation in the AMD RadeonTM Graphics display driver may allow an attacker to corrupt the display potentially resulting in

    HighCVSS 7.5Proof of conceptEPSS 1%

    amd · radeon softwareNov 14, 2023

  • CVE-2023-47125
    24Monitor

    By-passing Cross-Site Scripting Protection in HTML Sanitizer

    MediumCVSS 6.1Proof of conceptEPSS 0%

    typo3 · html sanitizerNov 14, 2023

  • CVE-2023-46022
    31Monitor

    SQL Injection vulnerability in delete.php in Code-Projects Blood Bank 1.0 allows attackers to run arbitrary SQL commands via the 'bid' param

    HighCVSS 7.8Proof of conceptEPSS 0%

    code-projects · blood bankNov 14, 2023

  • CVE-2023-46023
    26Monitor

    SQL injection vulnerability in addTask.php in Code-Projects Simple Task List 1.0 allows attackers to obtain sensitive information via the 's

    MediumCVSS 6.5Proof of conceptEPSS 0%

    code-projects · simple task listNov 14, 2023

  • CVE-2023-46024
    30Monitor

    SQL Injection vulnerability in index.php in phpgurukul Teacher Subject Allocation Management System 1.0 allows attackers to run arbitrary SQ

    HighCVSS 7.5Proof of conceptEPSS 1%

    phpgurukul · teacher subject allocation management systemNov 14, 2023

  • CVE-2023-46580
    21Monitor

    Cross-Site Scripting (XSS) vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of

    MediumCVSS 5.4Proof of conceptEPSS 0%

    code-projects · inventory managementNov 14, 2023

  • CVE-2023-35080
    31Monitor

    A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploi

    HighCVSS 7.8Proof of conceptEPSS 0%

    ivanti · secure access clientNov 14, 2023

  • CVE-2023-41597
    24Monitor

    EyouCms v1.6.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /admin/twitter.php?active_t.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    eyoucms · eyoucmsNov 15, 2023

  • CVE-2023-6112
    42Plan

    Use after free in Navigation in Google Chrome prior to 119.0.6045.159 allowed a remote attacker to potentially exploit heap corruption via a

    HighCVSS 8.8No exploitEPSS 24%

    google · chromeNov 15, 2023

  • CVE-2023-48365
    83Now

    Qlik Sense Enterprise for Windows before August 2023 Patch 2 allows unauthenticated remote code execution, aka QB-21683.

    CriticalCVSS 9.9KEVWeaponizedEPSS 47%

    qlik · qlik senseNov 15, 2023

  • CVE-2023-43757
    26Monitor

    Inadequate encryption strength vulnerability in multiple routers provided by ELECOM CO.,LTD.

    MediumCVSS 6.5Proof of conceptEPSS 0%

    elecom · wrc-2533ghbk2-t firmwareNov 16, 2023

  • CVE-2023-6016
    48Plan

    H2O Remote Code Execution via POJO Model Import

    CriticalCVSS 9.8No exploitEPSS 30%

    h2o · h2oNov 16, 2023

  • CVE-2023-6018
    53Plan

    MLflow Arbitrary File Write

    CriticalCVSS 9.8Proof of conceptEPSS 47%

    lfprojects · mlflowNov 16, 2023

  • CVE-2023-6023
    31Monitor

    ModelDB Local File Include

    HighCVSS 7.5Proof of conceptEPSS 2%

    vertaai · modeldbNov 16, 2023

  • CVE-2023-6019
    61This week

    Ray Command Injection in cpu_profile Parameter

    CriticalCVSS 9.8WeaponizedEPSS 74%

    ray project · rayNov 16, 2023

  • CVE-2023-6021
    41Plan

    Ray Log File Local File Include

    HighCVSS 7.5Proof of conceptEPSS 37%

    ray project · rayNov 16, 2023

  • CVE-2023-6038
    31Monitor

    Local File Inclusion in h2oai/h2o-3

    HighCVSS 7.5Proof of conceptEPSS 4%

    h2o · h2oNov 16, 2023

  • CVE-2023-46214
    62This week

    Remote code execution (RCE) in Splunk Enterprise through Insecure XML Parsing

    HighCVSS 8.8WeaponizedEPSS 89%

    splunk · cloudNov 16, 2023

  • CVE-2023-6020
    60This week

    Ray Static File Local File Include

    HighCVSS 7.5WeaponizedEPSS 14%

    ray project · rayNov 16, 2023

  • CVE-2023-26347
    33Monitor

    CVE-2023-38205 issues | ColdFusion Admin Panel Access

    HighCVSS 7.5Proof of conceptEPSS 10%

    adobe · coldfusionNov 17, 2023

  • CVE-2023-44350
    58Plan

    ColdFusion | Deserialization of Untrusted Data (CWE-502)

    CriticalCVSS 9.8No exploitEPSS 64%

    adobe · coldfusionNov 17, 2023

  • CVE-2023-44351
    54Plan

    Adobe ColdFusion RCE Security Vulnerability

    CriticalCVSS 9.8No exploitEPSS 50%

    adobe · coldfusionNov 17, 2023

  • CVE-2023-44352
    49Plan

    Unauthenticate Reflected XSS on Adobe Coldfusion 2018 - 2021 - 2023 last version

    MediumCVSS 6.1Proof of conceptEPSS 84%

    adobe · coldfusionNov 17, 2023

  • CVE-2023-44353
    63This week

    ColdFusion WDDX Deserialization Gadgets

    CriticalCVSS 9.8Proof of conceptEPSS 80%

    adobe · coldfusionNov 17, 2023

  • CVE-2023-44355
    31Monitor

    ColdFusion | Improper Input Validation (CWE-20)

    MediumCVSS 4.3No exploitEPSS 47%

    adobe · coldfusionNov 17, 2023

  • CVE-2023-43177
    64This week

    CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.

    CriticalCVSS 9.8WeaponizedEPSS 81%

    crushftp · crushftpNov 17, 2023

  • CVE-2023-6187
    50Plan

    Paid Memberships Pro <= 2.12.3 - Authenticated (Subscriber+) Arbitrary File Upload

    HighCVSS 8.8No exploitEPSS 51%

    strangerstudios · paid memberships proNov 17, 2023

  • CVE-2023-48223
    23Monitor

    fast-jwt JWT Algorithm Confusion

    MediumCVSS 5.9Proof of conceptEPSS 0%

    nearform · fast-jwtNov 20, 2023

  • CVE-2023-48241
    52Plan

    XWiki exposed whole content of all documents of all wikis to anybody with view right on Solr suggest service

    HighCVSS 7.5Proof of conceptEPSS 72%

    xwiki · xwikiNov 20, 2023

  • CVE-2023-48292
    42Plan

    XWiki Admin Tools Application Run Shell Command allows CSRF RCE attacks

    HighCVSS 8.8Proof of conceptEPSS 22%

    xwiki · admin toolsNov 20, 2023

  • CVE-2023-38879
    31Monitor

    The Community Edition version 9.0 of OS4ED's openSIS Classic allows remote attackers to read arbitrary files via a directory traversal vulne

    HighCVSS 7.5Proof of conceptEPSS 3%

    os4ed · opensisNov 20, 2023

  • CVE-2023-5652
    58Plan

    WP Hotel Booking < 2.0.8 - Unauthenticated SQLi

    CriticalCVSS 9.8Proof of conceptEPSS 63%

    thimpress · wp hotel bookingNov 20, 2023

  • CVE-2023-6199
    26Monitor

    Book Stack v23.10.2 - LFR via Blind SSRF

    MediumCVSS 6.5Proof of conceptEPSS 1%

    bookstackapp · bookstackNov 20, 2023

  • CVE-2023-47643
    22Monitor

    SuiteCRM has Unauthenticated Graphql Introspection Enabled

    MediumCVSS 5.3Proof of conceptEPSS 3%

    salesagility · suitecrmNov 21, 2023

  • CVE-2023-49103
    83Now

    An issue was discovered in ownCloud owncloud/graphapi 0.2.x before 0.2.1 and 0.3.x before 0.3.1.

    HighCVSS 7.5KEVWeaponizedEPSS 77%

    owncloud · graph apiNov 21, 2023

  • CVE-2023-49105
    82Now

    An issue was discovered in ownCloud owncloud/core before 10.13.1.

    CriticalCVSS 9.8KEVWeaponizedEPSS 43%

    owncloud · owncloud serverNov 21, 2023

  • CVE-2023-2437
    34Monitor

    UserPro <= 5.1.1 - Authentication Bypass to Administrator

    HighCVSS 8.1Proof of conceptEPSS 6%

    userproplugin · userproNov 22, 2023

  • CVE-2023-5815
    41Plan

    News & Blog Designer Pack – WordPress Blog Plugin <= 3.4.1 - Unauthenticated Remote Code Execution via Local File Inclusion

    CriticalCVSS 9.8Proof of conceptEPSS 5%

    infornweb · news \& blog designer packNov 22, 2023

  • CVE-2023-47014
    26Monitor

    A Cross-Site Request Forgery (CSRF) vulnerability in Sourcecodester Sticky Notes App Using PHP with Source Code v.1.0 allows a local attacke

    MediumCVSS 6.5Proof of conceptEPSS 0%

    remyandrade · sticky notes appNov 22, 2023

  • CVE-2023-47250
    35Monitor

    In mprivacy-tools before 2.0.406g in m-privacy TightGate-Pro Server, broken Access Control on X11 server sockets allows authenticated attack

    HighCVSS 8.8Proof of conceptEPSS 1%

    m-privacy · mprivacy-toolsNov 22, 2023

  • CVE-2023-48646
    53Plan

    Zoho ManageEngine RecoveryManager Plus before 6070 allows admin users to execute arbitrary commands via proxy settings.

    HighCVSS 7.2No exploitEPSS 82%

    zohocorp · manageengine recoverymanager plusNov 22, 2023

  • CVE-2023-47668
    30Monitor

    WordPress Restrict Content Plugin <= 3.2.7 is vulnerable to Sensitive Data Exposure

    HighCVSS 7.5Proof of conceptEPSS 1%

    liquidweb · restrict contentNov 22, 2023

  • CVE-2023-41807
    35Monitor

    Linux Local Privilege Escalation Via GoTTY Page

    HighCVSS 8.8No exploitEPSS 0%

    artica · pandora fmsNov 23, 2023

  • CVE-2023-47529
    30Monitor

    WordPress Cloud Templates & Patterns collection Plugin <= 1.2.2 is vulnerable to Sensitive Data Exposure

    HighCVSS 7.5Proof of conceptEPSS 0%

    themeisle · cloud templates \& patterns collectionNov 23, 2023

  • CVE-2023-6275
    25Monitor

    TOTVS Fluig Platform mobileredir openApp.jsp cross site scripting

    MediumCVSS 6.1Proof of conceptEPSS 2%

    totvs · fluigNov 24, 2023

  • CVE-2023-4590
    39Monitor

    Buffer Overflow vulnerability in Frhed

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    kimmov · frhedNov 27, 2023