CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- gradio-app gradio-app/gradio, gradio project gradio +1 moreCommand Injection in gradio-app/gradio9.6 Critical
- kubeflow, kubeflow kubeflow/kubeflow +1 moreCross-site Scripting (XSS) - Reflected in kubeflow/kubeflow5.4 Medium
- kubeflow, kubeflow kubeflow/kubeflow +1 moreServer-Side Request Forgery (SSRF) in kubeflow/kubeflow7.7 High
- h2o, h2oai h2oai/h2o-3 +1 moreExternal Control of File Name or Path in h2oai/h2o-39.3 Critical
- page visit counter advanced page visit counter – most wanted analytics plugin for wordpress, pagevisitcounter advanced page visit counter +1 moreWordPress Advanced Page Visit Counter Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
zerocopycrates.ioRef methods into_ref, into_mut, into_slice, and into_slice_mut are unsound when used with cell::Ref or cell::RefMutNo score- https://github.com/mlwebtechnologies livingword component for joomla, mlwebtechnologies livingword +1 moreExtension - MLWebTechnologies - Reflected XSS in LivingWord component for Joomla 1.0.0-3.0.06.1 Medium
- joomboost easy quick contact, joomboost.com easy quick contact module for joomla +1 moreExtension - joomboost.com - Reflected XSS in Easy Quick Contact module for Joomla 1.0.0-1.3.06.1 Medium
- deconf clicky analytics dashboard, deconf.net clicky analytics dashboard module for joomla +1 moreExtension - deconf.net - Reflected XSS in Clicky Analytics Dashboard module for Joomla 1.0.0-1.3.16.1 Medium
- king-products.net lms lite component for joomla, king-products lms king lite +1 moreExtension - king-products.net - SQLi vulnerability in LMS Lite component for Joomla 1.0.0-3.3.0.19.8 Critical
- extplorer, extplorer.net extplorer component for joomla +1 moreExtension - Extplorer.net - Reflected XSS in Extplorer component for Joomla 1.0.0-2.1.156.1 Medium
- joomstar starshop, joomstar.com starshop component for joomla +1 moreExtension - joomstar.com - SQLi vulnerability in Starshop component for Joomla 1.0.0-1.0.99.8 Critical
- joomlart s5 register, joomlart.com s5 register module for joomla +1 moreExtension - joomlart.com - SQLi vulnerability in S5 Register module for Joomla 1.0.0-3.0.09.8 Critical
- plasma-web quickform, plasma-web.ru quickform component for joomla +1 moreExtension - plasma-web.ru - Reflected XSS in Quickform component for Joomla 1.0.0-3.3.016.1 Medium
- artio joomdoc, artio.net joomdoc component for joomla +1 moreExtension - artio.net - Reflected XSS in Joomdoc component for Joomla 1.0.0-4.0.56.1 Medium
- mooj proforms, mooj.org proforms basic component for joomla +1 moreExtension - mooj.org - Reflected XSS in Proforms Basic component for Joomla <= 1.6.06.1 Medium
- joomcode jcdashboard, joomcode.com jcdashboards component for joomla +1 moreExtension - joomcode.com - Unauthenticated LFI/SSRF in JCDashboards component for Joomla 1.0.0-1.1.309.8 Critical
- apache shiroApache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.6.1 Medium
- zte mc801a, mc801a1, mc801a1 firmware +1 more +3 moreDenial of Service Vulnerability in Some ZTE Mobile Internet Products6.5 Medium
- octopus serverIn affected versions of Octopus Server it is possible for the OpenID client secret to be logged...4.2 Medium
- zte mc801a, mc801a1, mc801a1 firmware +1 more +3 moreTwo Vulnerabilities in Some ZTE Mobile Internet Products8.4 High
- zte mc801a, mc801a1, mc801a1 firmware +1 more +3 moreTwo Vulnerabilities in Some ZTE Mobile Internet Products5.9 Medium
- zte mobile internet products, mf286r firmware, mf833u1 firmware +2 moreSQL Injection Vulnerability in Some ZTE Mobile Internet Products4.3 Medium
- zte zxcloud iraiArbitrary File Download Vulnerability in ZTE ZXCLOUD iRAI6.5 Medium
- zte zxcloud iraiWeak Folder Permission Vulnerability in ZTE ZXCLOUD iRAI6.5 Medium
- couchbase server, cryptography.io cryptography, red hat ansible automation platform 2 +8 more +10 morePython-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-256597.5 High
- schneider electric easy ups online monitoring softwareA CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')...5.3 Medium
- schneider electric trio e-series ethernet data radio, trio j-series ethernet data radio, trio q-series ethernet data radio +16 more +18 moreA CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a...6.5 Medium
- schneider electric trio e-series ethernet data radio, trio j-series ethernet data radio, trio q-series ethernet data radio +16 more +18 moreA CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could...8.2 High
- ivanti connect secureA vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker...7.0 High
- ivanti connect secureA vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker...7.2 High
- ibm i access client solutionsIBM i Access Client Solutions6.2 Medium
- ibm storage virtualizeIBM Storage Virtualize information disclosure7.5 High
- ibm spectrum scaleIBM Spectrum Scale information disclosure5.9 Medium
phpOSS-FuzzGlobal-buffer-overflow in pcre_get_compiled_regex_cache_exNo scorelibxml2OSS-FuzzGlobal-buffer-overflow in xmlDictLookupInternalNo scorejackson-dataformats-textOSS-FuzzSecurity exception in com.fasterxml.jackson.core.JsonParser.currentNameNo scorephpOSS-FuzzGlobal-buffer-overflow in pcre_get_compiled_regex_cache_exNo scorebinutilsOSS-FuzzHeap-buffer-overflow in loongarch_split_args_by_commaNo scorelibrawOSS-FuzzGlobal-buffer-overflow in libraw_tagtype_dataunit_bytesNo scorelibavcOSS-FuzzHeap-buffer-overflow in ih264d_compute_bs_non_mbaffNo score- eyoucmsA stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to...5.4 Medium
- rpcmsA cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5...5.4 Medium
- pluck-cms pluckAn arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4...8.8 High
- sem-cms semcmsSemcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at...9.8 Critical
- davegamble cjsoncJSON v1.7.16 was discovered to contain a segmentation violation via the function...7.5 High
- davegamble cjsoncJSON v1.7.16 was discovered to contain a segmentation violation via the function...7.5 High
- jfinalcms project jfinalcmsCross-site Scripting in JFinalcms5.4 Medium
- jfinalcms project jfinalcmsCross-site Scripting in JFinalcms5.4 Medium
- jfinalcms project jfinalcmsCross-site Scripting in JFinalcms5.4 Medium
- Show moreLoading…