CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- izybat orange casiersIzyBat Orange casiers before 20230803_1 allows getEnsemble.php ensemble SQL injection.9.1 Critical
- bitcoin core, bitcoinknots bitcoin knots +1 moreIn Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits...5.3 Medium
- gpacAn issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS)...5.5 Medium
- draytek vigor167 firmwareAn OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote...9.8 Critical
- gpacHeap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows...9.8 Critical
- seafileThe next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect...6.1 Medium
- seafileAn XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript...5.4 Medium
- ncp-e secure enterprise clientSupport Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry...4.3 Medium
- ncp-e secure enterprise clientInsecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow...6.5 Medium
- ncp-e secure enterprise clientSupport Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents...6.5 Medium
- ncp-e secure enterprise clientSupport Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete...8.1 High
- antonymale synctrayzorSyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local...7.8 High
- johannschopplich nuxt-api-party, nuxt api party +1 moreServer-Side Request Forgery in nuxt-api-party7.5 High
- johannschopplich nuxt-api-party, nuxt api party +1 moreDenial of service by abusing `fetchOptions.retry` in nuxt-api-party7.5 High
- openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 moreDuplicated execution of subcalls in OpenZeppelin Contracts5.9 Medium
knative.dev/eventing-gitlabGoeventing-gitlab vulnerable to denial of service, caused by improper enforcement of the timeout on individual read operationsNo score- hashicorp vault, vault enterprise +1 moreVault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP Requests7.5 High
- arm cortex-a77 firmware, xen +1 morearm: Guests can trigger a deadlock on Cortex-A775.5 Medium
- github.com/mojocn/base64captcha, mojotv base64captcha +1 moreCaptcha verification bypass in github.com/mojocn/base64Captcha5.3 Medium
- collaboraoffice richdocumentscode, collaboraonline online +1 moreCross-Site-Scripting vulnerability in error message passing in richdocumentscode7.1 High
- collaboraoffice richdocumentscode, collaboraonline online +1 moreImproper handling of browser-side provided input in richdocuments path handling7.2 High
- python cpython, python +1 moreGroups not dropped before running subprocess when using empty 'extra_groups' parameter6.1 Medium
- linux kernel, fedoraproject fedora, red hat enterprise linux 6 +4 more +6 moreKernel: null pointer dereference vulnerability in nft_dynset_init()5.5 Medium
- oretnom23 simple student attendance systemSourceCodester Simple Student Attendance System class_form.php sql injection5.5 Medium
- oretnom23 simple student attendance systemSourceCodester Simple Student Attendance System index.php file inclusion5.5 Medium
- oretnom23 simple student attendance systemSourceCodester Simple Student Attendance System attendance.php sql injection5.5 Medium
- linux kernel, red hat enterprise linux 6, enterprise linux 7 +8 more +10 moreKernel: oob access in smb2_dump_detail7.1 High
- linux kernel, red hat enterprise linux 6, enterprise linux 7 +15 more +17 moreKernel: out-of-bounds read vulnerability in smbcalcsize7.1 High
- oretnom23 simple student attendance systemSourceCodester Simple Student Attendance System index.php cross site scripting3.5 Low
- typechoTypecho manage-users.php information disclosure3.5 Low
- qnap qts, quts hero +1 moreQTS, QuTS hero4.5 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero6.5 Medium
- qnap qts, quts hero +1 moreQTS, QuTS hero4.9 Medium
- qnap qvr firmware, viostor nvr +1 moreLegacy VioStor NVR8.0 High
- typechoTypecho Page manage-pages.php backdoor2.7 Low
dbt-corePyPIdbt-core's secret env vars written to package-lock.json in plaintext3.2 Low- typechoTypecho Logo options-theme.php cross site scripting2.4 Low
- totolink x5000r, x5000r firmware +1 moreTotolink X5000R cstecgi.cgi setWizardCfg os command injection5.5 Medium
- openmage magento-ltsOpenMage magento-lts before 20.2.0 Stored XSS via TinyMCE WYSIWYG Editor8.3 High
- tongda oa 2017, tongda2000 tongda oa, tongda office anywhere +2 moreTongda OA 2017 delete.php sql injection5.5 Medium
- jupyter dockerspawnerAny image allowed by default8.0 High
- oscommerceosCommerce all-products cross site scripting3.5 Low
- tongda oa 2017, tongda2000 tongda oa, tongda office anywhere +2 moreTongda OA 2017 delete.php sql injection5.5 Medium
- qualys qualysguard, private cloud platform +1 moreStored XSS Vulnerability in QualysGuard VM/PC5.7 Medium
- tongda oa 2017, tongda2000 tongda office anywhere +1 moreTongda OA 2017 delete.php sql injection5.5 Medium
- dfinity candidInfinite decoding loop through specially crafted payload7.5 High
- dell dss 8440 firmware, emc nx440 firmware, emc storage nx3240 firmware +124 more +126 moreDell PowerEdge BIOS contains an improper privilege management security vulnerability. An...8.8 High
- mockjs mock.jsmockjs vulnerable to Prototype Pollution via the Util.extend function8.2 High
jqOSS-FuzzStack-buffer-overflow in decNaNsNo scorelibredwgOSS-FuzzHeap-buffer-overflow in dwg_free_objectNo score- Show moreLoading…