CVE-2023-29492

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account. This does not provide access to stored survey or response data.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-94

Affected software

No affected versions have been published.

Timeline

Published: Apr 11, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Apr 13, 2023
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-294946.7Improper input validation in BIOS firmware for some Intel(R) NUCs may allow a privileged user to potentially enable escalation of privilege CVE-2023-294957.8Improper input validation for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalatio CVE-2023-294973.3A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14. An app may be able to acces CVE-2023-294985.5Improper restriction of XML external entity reference (XXE) vulnerability exists in FRENIC RHC Loader v1.1.0.3 and earlier. If a user opens CVE-2023-294997.5A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of se CVE-2023-29508.1Improper Authorization in GitHub repository openemr/openemr prior to 7.0.1.CVE-2023-295004.4Exposure of sensitive information to an unauthorized actor in BIOS firmware for some Intel(R) NUCs may allow a privilege user to potentially CVE-2023-295014.8Jiyu Kukan Toku-Toku coupon App for iOS versions 3.5.0 and earlier, and Jiyu Kukan Toku-Toku coupon App for Android versions 3.5.0 and earli CVE-2023-295024.3Before importing a project into Vuforia, a user could modify the “resourceDirectory” attribute in the appConfig.json file to be a differen CVE-2023-295037.8The affected application lacks proper validation of user-supplied data when parsing project files (e.g., CSP). This could lead to a stack-ba CVE-2023-295047.8Uncontrolled search path element in some Intel(R) RealSense(TM) Dynamic Calibration software before version 2.13.1.0 may allow an authentica CVE-2023-295058.8An issue was discovered in Zoho ManageEngine Network Configuration Manager 12.6.165. The WebSocket endpoint allows Cross-site WebSocket hija