CVE-2023-49322

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Certain WithSecure products allow a Denial of Service because there is an unpack handler crash that can lead to a scanning engine crash. This affects WithSecure Client Security 15, WithSecure Server Security 15, WithSecure Email and Server Security 15, WithSecure Elements Endpoint Protection 17 and later, WithSecure Client Security for Mac 15, WithSecure Elements Endpoint Protection for Mac 17 and later, WithSecure Linux Security 64 12.0, WithSecure Linux Protection 12.0, and WithSecure Atlant 1.0.35-1.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected software

No affected versions have been published.

Timeline

Published
Nov 27, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-493287.2On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve CVE-2023-493297.2Anomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject and execute operating system commands. This aCVE-2023-49335.3The WP Job Openings WordPress plugin before 3.4.3 does not block listing the contents of the directories where it stores attachments to job CVE-2023-493308.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while getting aggregate report data.CVE-2023-493318.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the aggregate reports search option.CVE-2023-493328.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while adding file shares.CVE-2023-493338.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection in the dashboard graph feature.CVE-2023-493348.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL Injection while exporting a full summary report.CVE-2023-493358.8Zoho ManageEngine ADAudit Plus versions below 7271 allows SQL injection while getting file server details.CVE-2023-493374.8Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name. (8.5 and earlier are unaffected.)CVE-2023-493387.5Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8CVE-2023-493396.5Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retri
CVE-2023-49322: High severity, CVSS 7.5 | Vulnix