CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- curl, fedoraproject fedora, siemens ruggedcom rox mx5000 +14 more +16 moreThis flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back...6.5 Medium
- fxc ae1021 firmware, ae1021pe firmware, fxc inc. ae1021 +2 more +4 moreAn OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and...8.8 High
- pubnub c-core, kotlin, pubnub +1 more +3 morepubnub Insufficient Entropy vulnerability5.9 Medium
- atlassian companion, companion for mac +1 moreCertain versions of the Atlassian Companion App for MacOS were affected by a remote code...9.6 Critical
- atlassian assets discovery cloud, assets discovery data center, assets discovery data server +2 moreThis vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code...9.8 Critical
- atlassian confluence data center, confluence server +1 moreThis Template Injection vulnerability allows an authenticated attacker, including one with...9.0 Critical
pcapplusplusOSS-FuzzUse-of-uninitialized-value in std::__1::__stdoutbuf<char>::xsputnNo score- i13websolution email subscription popupEmail Subscription Popup <= 1.2.18 - Reflected Cross-Site Scripting6.1 Medium
- samsung escargotPossible stack overflow due to insufficient input validation5.3 Medium
- solarwinds serv-uHTML injection Vulnerability in Serv-U 15.45.0 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote...4.3 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreUse after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker...8.8 High
- google chrome, debian linux, fedoraproject fedora +2 moreUse after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote...8.8 High
- google chrome, debian linux, fedoraproject fedora +2 moreUse after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker...8.8 High
- broadcom fabric operating system, brocade switches +1 moreLicense forgery in Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software,6.4 Medium
- squid-cache squidSquid's URN Handling can lead to Buffer Overflow9.3 Critical
- daicuoA stored cross-site scripting (XSS) vulnerability in /admin.php of DaiCuo v2.5.15 allows...5.4 Medium
- rockoa xinhuxinhu xinhuoa 2.2.1 contains a File upload vulnerability.9.8 Critical
- totolink a3002ru firmwareTOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect...8.8 High
- ruijie rg-eg1000c firmware, rg-eg1000e firmware, rg-eg105g-e firmware +18 more +20 moreRuijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to...9.8 Critical
- netgate pfsense, pfsense plus +1 moreAn issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote...8.8 High
- artifex ghostscriptAn issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript...7.5 High
- myprestamodules orders \(csv\, excel\) export proIn the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for...7.5 High
- mypresta product tag icons proIn the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a...9.8 Critical
- go toolchain cmd/go, golang go +1 moreCommand 'go get' may unexpectedly fallback to insecure git in cmd/go7.5 High
- go standard library net/http/internal, golang go +1 moreDenial of service via chunk extensions in net/http5.3 Medium
- prolion cryptospikeThe login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the...9.8 Critical
- afian filerunA Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202...4.3 Medium
- afian filerunA Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to...5.4 Medium
github.com/canonical/lxdGoCanonical LXD documentation improvement to make clear restricted.devices.disk=allow without restricted.devices.disk.paths also allows shift=trueNo score- arista mosOn Arista MOS configuration of a BGP password will cause the password to be logged in clear text.5.9 Medium
microsoft/microsoft-graph-betaPackagistTest code in published microsoft-graph-beta package exposes phpinfo()5.3 Medium- microsoft graph, microsoftgraph msgraph-sdk-php-core +1 moreTest code in published microsoft-graph-core package exposes phpinfo()5.4 Medium
- microsoft graph, microsoftgraph msgraph-sdk-php +1 moreTest code in published microsoft-graph package exposes phpinfo()5.4 Medium
- espocrmServer-Side Request Forgery in espocrm5.3 Medium
- iterative pydrive2Unsafe YAML deserialization in PyDrive23.3 Low
- sonicwall sma100, sma 200 firmware, sma 210 firmware +3 more +5 moreImproper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated...8.8 High
- sonicwall sma100, sma100 appliances, sma 200 firmware +4 more +6 moreImproper neutralization of special elements in the SMA100 SSL-VPN management interface allows a...7.2 High
- unitronics visilogic, samba 3.5 firmware, samba 4.3 firmware +15 more +17 moreUnitronics VisiLogic uses a default administrative password9.8 Critical
- elastic elasticsearch, elasticsearch-hadoop +1 moreElasticsearch-hadoop Unsafe Deserialization6.0 Medium
- go standard library crypto/tls, golang go +1 moreBefore Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel7.5 High
- softiron hypercloudWhen compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT"3.2 Low
- softiron hypercloudMedia caddy removal and reinsertion without reboot may cause data loss7.0 High
- softiron hypercloudHyperCloud: "admin" and "serveradmin" users can be deleted4.2 Medium
- dell poweredge bios, poweredge c6620 firmware, poweredge hs5610 firmware +11 more +13 moreDell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain...3.6 Low
- dell poweredge bios, poweredge c6620 firmware, poweredge hs5610 firmware +11 more +13 moreDell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain...7.1 High
- cloudflare boring, tokio-boring +1 moreResource exhaustion via memory leak in tokio-boring5.3 Medium
- codesys control for beaglebone sl, control for empc-a/imx6 sl, control for iot2000 sl +10 more +12 moreOS Command Injection in multiple CODESYS products8.8 High
- etsi tetra standard, midnightblue tetra\ +1 moreDe-anonymization attack in TETRA4.3 Medium
- Show moreLoading…