CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- forgejoForgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.7.5 High
- forgejoIn Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a...9.1 Critical
- misp-project mispapp/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget.6.1 Medium
- phpgurukul nipah virus testing management systemPHPGurukul Nipah Virus Testing Management System manage-phlebotomist.php cross-site request forgery4.3 Medium
- remyandrade online quiz systemSourceCodester Online Quiz System take-quiz.php cross site scripting3.5 Low
- phpemsPHPEMS Content Section api.cls.php cross site scripting2.4 Low
- thecosy icecmsThecosy IceCMS Comment Like improper enforcement of a single, unique action3.1 Low
- thecosy icecmsThecosy IceCMS User Comment planet cross site scripting3.5 Low
radare2OSS-FuzzHeap-buffer-overflow in r_bin_coff_new_bufNo scorespring-data-mongodbOSS-FuzzSecurity exception in org.springframework.expression.spel.ast.OpPlus.getValueInternalNo score- phpgurukul nipah virus testing management systemPHPGurukul Nipah Virus Testing Management System registered-user-testing.php cross site scripting4.3 Medium
- remyandrade user registration and login systemSourceCodester User Registration and Login System add-user.php sql injection6.3 Medium
- dell rugged control center, rugged control center (rcc) +1 moreDell Rugged Control Center, version prior to 4.7, contains an Improper Access Control...7.3 High
- dell rugged control center, rugged control center (rcc) +1 moreDell Rugged Control Center, version prior to 4.7, contains an improper access control...7.3 High
- choosemuse muse 2 firmwareInteraXon Muse 2 devices allow remote attackers to cause a denial of service (incorrect Muse App...6.5 Medium
birdcagecrates.ioEnvironment variables still accessible through /proc4.0 Medium- remyandrade user registration and login systemSourceCodester User Registration and Login System add-user.php cross site scripting3.5 Low
- cainor calendarinhoOpen Redirect in Login Function of Calendarinho4.7 Medium
- collaboraoffice collabora online, collaboraonline online +1 moreUnescaped passing of the request URL in Collabora Online7.1 High
- posthogAuthenticated PostHog users vulnerable to SSRF4.8 Medium
- electronASAR Integrity bypass via filetype confusion in electron6.1 Medium
- remyandrade user registration and login systemSourceCodester User Registration and Login System delete-user.php cross site scripting3.5 Low
- ibm infosphere information serverIBM InfoSphere Information Server cross-site scripting5.4 Medium
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure5.9 Medium
- ibm infosphere information serverIBM InfoSphere Information Server denial of service7.5 High
- ibm infosphere information serverIBM InfoSphere Information Server cross-site scripting5.4 Medium
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure5.3 Medium
- ibm infosphere information serverIBM InfoSphere Information Server cross-site scripting5.4 Medium
- ibm infosphere information serverIBM InfoSphere Information Server cross-site scripting5.4 Medium
fastapi-proxy-libPyPICookie leakage between different users in fastapi-proxy-lib7.5 Highorg.opensearch:opensearchMavenOpenSearch StackOverflow vulnerability6.5 Medium- darrennathanael dpasteReflected Cross-site Scripting Vulnerability in dpaste8.3 High
- ibm infosphere information serverIBM InfoSphere Information Server cross-site request forgery4.3 Medium
- ibm planning analytics on cloud pak for dataIBM Planning Analytics on Cloud Pak for Data information disclosure6.5 Medium
- ibm iIBM i information disclosure8.4 High
- hitachi energy relion670, hitachienergy relion 650 firmware, relion 670 firmware +1 more +3 moreA vulnerability exists in the input validation of the GOOSE messages where out of range values...6.5 Medium
- ibm aix, vios +1 moreIBM AIX command execution8.4 High
- joynext mib3 infotainment unit, preh mib3 firmware +1 moreWeak encoding for password in UDS services3.3 Low
- joynext mib3 infotainment unit, preh mib3 firmware +1 moreHard-coded password for access to power controller chip memory3.5 Low
- arslansoft education portalMalicious File Upload in ArslanSoft's Education Portal9.8 Critical
- arslansoft education portalPlaintext Storage of a Password in ArslanSoft's Education Portal7.5 High
- viliusle minipaint, viliusle/minipaint +1 moreCross-site Scripting (XSS) - Reflected in viliusle/minipaint8.6 High
- arslansoft education portalUser Enumeration in ArslanSoft's Education Portal7.5 High
- arslansoft education portalSQLi in ArslanSoft's Education Portal9.8 Critical
phpOSS-FuzzHeap-use-after-free in zend_reference_destroyNo scorepqc_kybercrates.iopqc_kyber KyberSlash: division timings depending on secrets7.4 High- rocklobster contact form 7Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload6.6 Medium
- arm 5th gen gpu architecture kernel driver, bifrost gpu kernel driver, valhall gpu kernel driver +1 more +3 moreMali GPU Kernel Driver allows improper GPU processing operations7.8 High
- gitlabIncorrect Authorization in GitLab3.1 Low
- gitlabIncorrect Authorization in GitLab4.3 Medium
- Show moreLoading…