CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- michaelschwarz ajax.net professional, ajax.net-professional +1 moreCross-site Scripting in Ajax.NET Professional6.3 Medium
- fishshell fish, fish-shell +1 moreCommand substitution output can trigger shell expansion in fish shell3.9 Low
- lestrrat-go jwxMalicious parameters can cause a denial of service in lestrrat-go/jwx5.3 Medium
- tj-actions branch-namesImproper Sanitization of Branch Name Leads to Arbitrary Code Injection9.3 Critical
github.com/edgelesssys/marblerunGoGo package github.com/edgelesssys/marblerun CLI commands susceptible to MITM attacksNo score- ecies goPossible private key restoration in go package github.com/ecies/go4.9 Medium
- delta electronics dopsoftDelta Electronics DOPSoft Stack-based Buffer Overflow7.8 High
- vitejs viteCross-site Scripting in `server.transformIndexHtml` via URL payload in vite6.1 Medium
- sierrawireless aleosImproper input leads to DoS8.3 High
- sierrawireless aleosUse of hardcoded certificate and private key8.1 High
- sierrawireless aleosUse of Hard-Coded Credentials8.1 High
- squid-cache squidDenial of Service in HTTP Message Processing in Squid8.6 High
- sierrawireless aleos, debian linux +1 moreImproper input leads to DoS7.5 High
- squid-cache squidDenial of Service in Helper Process management8.6 High
- sierrawireless aleosCross-site scripting vulnerability in ACEManager8.1 High
- sierrawireless aleosImproper input leads to DoS7.1 High
- squid-cache squidDenial of Service in HTTP Collapsed Forwarding in Squid8.6 High
- sierrawireless aleosImproper input leads to DoS7.5 High
- google androidIn loadMediaDataInBgForResumption of MediaDataManager.kt, there is a possible way to view another...5.5 Medium
- xwiki change request, xwiki-contrib application-changerequest +1 moreData leak of password hash through xwiki change request7.7 High
- ays-pro popup boxPopup box < 3.8.6 - Admin+ Stored XSS in Categories4.8 Medium
- bannersky bsk contact form 7 blacklistBSK Contact Form 7 Blacklist <= 1.0.1 - Reflected Cross-Site Scripting6.1 Medium
- unknown wp fastest cacheWP Fastest Cache < 1.2.2 - Unauthenticated SQL Injection7.5 High
- back2nature word balloonWord Balloon < 4.20.3 - Avatar Removal via CSRF6.5 Medium
- alphabpo easy newsletter signupsEasy Newsletter Signups <= 1.0.4 - Admin+ SQLi7.2 High
- funnelforms free, unknown interactive contact form and multi step form builder with drag & drop editor +1 moreFunnelforms Free < 3.4.2 - Form Deletion/Duplication via CSRF6.5 Medium
- unknown amp+ plus, amp-cloud amp plus +1 moreAMP+ Plus <= 3.0 - Reflected Cross Site Scripting6.1 Medium
- unknown uploading svg, webp and ico files, uploading svg\, webp and ico files project svg\, webp and ico files +1 moreUploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG5.4 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.9.5 - Reflected XSS6.1 Medium
- shooflysolutions simply excerptsSimply Excerpts <= 1.4 - Admin+ Stored XSS4.8 Medium
- filr project filrFilr – Secure document library < 1.2.3.6 - Author+ RCE via file upload with phar ext8.8 High
- ays-pro popup boxPopup box < 3.8.6 - Admin+ Stored XSS in Popup Settings4.8 Medium
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.9.5 - Subscriber+ Arbitrary File Upload8.8 High
- nanbu welcart e-commerce, welcart e-commerce +1 moreWelcart e-Commerce < 2.9.5 - Unauthenticated PHP Object Injection9.8 Critical
- najeebmedia frontend file manager pluginFrontend File Manager < 22.6 - Editor+ Arbitrary File Download6.5 Medium
- implecode ecommerce product catalog plugin for wordpress, ecommerce product catalog +1 moreeCommerce Product Catalog Plugin for WordPress < 3.3.26 - Products Deletion via CSRF6.5 Medium
- jupyter server, jupyter-server jupyter server +1 moreJupyter Server errors include tracebacks with path information3.5 Low
- traefikUncontrolled Resource Consumption in Traefik7.5 High
- traefikIncorrect processing of fragment in the URL leads to Authorization Bypass in Traefik4.8 Medium
- traefikDenial of service whith ACME HTTPChallenge in Traefik5.9 Medium
- hitachi energy rtu500 series, hitachienergy rtu520 firmware, rtu530 firmware +2 more +4 moreA vulnerability exists in the HCI IEC 60870-5-104 that affects the RTU500 series product versions...5.9 Medium
- hitachi energy rtu500, hitachienergy rtu520 firmware, rtu530 firmware +2 more +4 moreA vulnerability exists in the webserver that affects the RTU500 series product versions listed...6.0 Medium
- google nodejs-firestore, cloud firestore +1 moreInformation leak in nodejs-firestore4.0 Medium
- dell powerprotect data manager dm5500 appliance, powerprotect data manager dm5500 firmware +1 moreDell DM5500 5.14.0.0 and prior contain an improper authentication vulnerability. A remote...8.1 High
- dell powerprotect data manager dm5500 appliance, powerprotect data manager dm5500 firmware +1 moreDell DM5500 5.14.0.0 and prior contain a Reflected Cross-Site Scripting Vulnerability. A network...5.4 Medium
- dell powerprotect data manager dm5500 appliance, powerprotect data manager dm5500 firmware +1 moreDell DM5500 5.14.0.0, contain a Plain-text Password Storage Vulnerability in PPOE. A local...5.5 Medium
- qos logbackLogback "receiver" DOS vulnerability CVE-2023-6378 incomplete fix7.1 High
- dell powerprotect data manager dm5500 appliance, dm5500 firmware +1 moreDell DM5500 contains a path traversal vulnerability in PPOE Component. A remote attacker with...6.5 Medium
- dell powerprotect data manager dm5500 appliance, dm5500 firmware +1 moreDell DM5500 5.14.0.0, contains a Stack-based Buffer Overflow Vulnerability in PPOE. An...8.1 High
- dell powerprotect data manager dm5500 appliance, dm5500 firmware +1 moreDell DM5500 contains a privilege escalation vulnerability in PPOE Component. A remote attacker...8.8 High
- Show moreLoading…