CVE-2023-32193

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

A vulnerability has been identified in which unauthenticated cross-site scripting (XSS) in Norman's public API endpoint can be exploited. This can lead to an attacker exploiting the vulnerability to trigger JavaScript code and execute commands remotely.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-80

Affected software

No affected versions have been published.

Timeline

Published: Oct 16, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2023

CVE-2023-321947.2A vulnerability has been identified when granting a create or * global role for a resource type of "namespaces"; no matter the API group, th CVE-2023-321966.6A vulnerability has been identified whereby privilege escalation checks are not properly enforced for RoleTemplateobjects when external=true CVE-2023-321976.6A Improper Privilege Management vulnerability in SUSE rancher in RoleTemplateobjects when external=true is set can lead to privilege escalat CVE-2023-321988.0A vulnerability has been identified in Steve where by default it was using an insecure option that did not validate the certificate presente CVE-2023-321994.3A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or t CVE-2023-32205.5An issue was discovered in the Linux kernel through 6.1-rc8. dpu_crtc_atomic_check in drivers/gpu/drm/msm/disp/dpu1/dpu_crtc.c lacks check o CVE-2023-322008.8There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execut CVE-2023-322017.8Stack-based buffer overflow vulnerability exists in TELLUS v4.0.15.0 and TELLUS Lite v4.0.15.0. Opening a specially crafted SIM2 file may le CVE-2023-322028.8Walchem Intuition 9 firmware versions prior to v4.21 are vulnerable to improper authentication. Login credentials are stored in a format tha CVE-2023-322037.8Horner Automation Cscape lacks proper validation of user-supplied data when parsing project files (e.g., HMI). This could lead to an out-of-CVE-2023-322047.8Improper access control in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalatio CVE-2023-322054.3In multiple cases browser prompts could have been obscured by popups controlled by content. These could have led to potential user confusion