CVE-2023-29492 - Novi Survey Insecure Deserialization Vulnerability

Novi Survey | Novi Survey

• Date Added:
• 2023-04-13

• Due Date:
• 2023-05-04

Vulnerability Name

Novi Survey Insecure Deserialization Vulnerability

Description

Novi Survey contains an insecure deserialization vulnerability that allows remote attackers to execute code on the server in the context of the service account.

Known To Be Used in Ransomware Campaigns?

Unknown

Action

Apply updates per vendor instructions.

Additional Notes

https://novisurvey.net/blog/novi-survey-security-advisory-apr-2023.aspx; https://nvd.nist.gov/vuln/detail/CVE-2023-29492

Top Security News

Critical RCE bug in Microsoft Outlook now exploited in attacks

Ivanti Patches Critical Flaws in Connect Secure and Policy Secure – Update Now

Magecart Attackers Abuse Google Ad Tool to Steal Data

FINALDRAFT Malware Exploits Microsoft Graph API for Espionage on Windows and Linux

Microsoft: Russian-Linked Hackers Using 'Device Code Phishing' to Hijack Accounts

The Hidden Security Gaps in Your SaaS Apps: Are You Doing Due Diligence?

Cybercriminals Exploit HTTP Headers for Credential Theft via Large-Scale Phishing Attacks

Newspaper Giant Lee Enterprises Reels From Cyberattack

Top Alert List

Content Security Policy (CSP) Header Not Set

CSP

MediumMissing Anti-clickjacking Header

MediumAbsence of Anti-CSRF Tokens

InformationalInformation Disclosure - Suspicious Comments

MediumContent Security Policy (CSP) Header Not Set

InformationalModern Web Application

LowCross-Domain JavaScript Source File Inclusion

InformationalRe-examine Cache-control Directives

LowX-Content-Type-Options Header Missing

Latest CVE List

CVE-2024-57727 SimpleHelp Path Traversal Vulnerability

CVE-2024-41710 Mitel SIP Phones Argument Injection Vulnerability

CVE-2025-24200 Apple iOS and iPadOS Incorrect Authorization Vulnerability

CVE-2025-21391 Microsoft Windows Storage Link Following Vulnerability

CVE-2025-21418 Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability

CVE-2024-40890 Zyxel DSL CPE OS Command Injection Vulnerability

CVE-2024-40891 Zyxel DSL CPE OS Command Injection Vulnerability

CVE-2025-0994 Trimble Cityworks Deserialization Vulnerability

CVE-2025-0411 7-Zip Mark of the Web Bypass Vulnerability

CVE-2022-23748 Dante Discovery Process Control Vulnerability

Top CWE List

CWE-693 Protection Mechanism Failure

HighCWE-200 Exposure of Sensitive Information to an Unauthorized Actor

MediumCWE-352 Cross-Site Request Forgery (CSRF)

CWE-1426 Improper Validation of Generative AI Output

CWE-201 Insertion of Sensitive Information Into Sent Data

HighCWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-1021 Improper Restriction of Rendered UI Layers or Frames

CWE-581 Object Model Violation: Just One of Equals and Hashcode Defined

CWE-284 Improper Access Control

CWE-359 Exposure of Private Personal Information to an Unauthorized Actor