CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- surrealdbSurrealDB before 1.0.1 Insecure Default Table Permissions8.7 High
@spscommerce/ds-reactnpmCross-site Scripting in @spscommerce/ds-reactNo score- home-assistant core, home-assistant +1 moreUser accounts disclosed to unauthenticated actors on the LAN4.3 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability4.3 Medium
libbpfOSS-FuzzUNKNOWN READ in init_struct_ops_mapsNo scorepcapplusplusOSS-FuzzHeap-use-after-free in pcpp::TLVRecordReader<pcpp::DhcpOption>::getTLVRecordNo scorelibavcOSS-FuzzCheck failed in CheckUnwindNo score- microweber, microweber microweber/microweber +1 moreBusiness Logic Errors in microweber/microweber6.0 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 morePath Traversal: '\..\filename' in mlflow/mlflow8.1 High
libxml2OSS-FuzzHeap-use-after-free in htmlCurrentCharNo score- misp-project mispapp/Controller/AuditLogsController.php in MISP before 2.4.182 mishandles ACLs for audit logs.9.8 Critical
- mjdm majordomoMajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell...9.8 Critical
- szlbt lbt-t300-t310 firmwareShenzhen Libituo Technology Co., Ltd LBT-T300-T310 v2.2.2.6 was discovered to contain a buffer...9.8 Critical
- netgear wnr2000 firmwareA Command Injection vulnerability exists in NETGEAR WNR2000v4 version 1.0.0.70. When using HTTP...9.8 Critical
- camsbiometrics zkteco\, essl\, cams biometrics integration module, odoo biometric attendance +1 moreSQL injection vulnerability in Cams Biometrics Zkteco, eSSL, Cams Biometrics Integration Module...9.8 Critical
- lockss classic lockss daemonlockss-daemon (aka Classic LOCKSS Daemon) before 1.77.3 performs post-Unicode normalization,...5.3 Medium
- gmarczynski dynamic progress barA SQL injection vulnerability in Grzegorz Marczynski Dynamic Progress Bar (aka web_progress) v....9.8 Critical
- silabs.com z/ip gateway sdk, silabs z\/ip gateway sdk +1 moreZ/IP Gateway Use of Uninitialized PRNG when Generating S0 Encryption Key6.4 Medium
- redhat keycloak, red hat build of keycloak 22, build of keycloak 22.0.7 +10 more +12 moreKeycloak: reflected xss via wildcard in oidc redirect_uri4.6 Medium
- johnsoncontrols iosmart gen 1 firmware, sensormatic electronics, a subsidiary of johnson controls, inc. iosmart gen1 +1 moreKantech Gen1 ioSmart card reader7.5 High
- asterisk, sangoma certified asterisk +1 moreAsterisk susceptible to Denial of Service via DTLS Hello packets during call initiation7.5 High
- asterisk, sangoma certified asterisk +1 moreAsterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'7.5 High
- asterisk, sangoma certified asterisk +1 moreAsterisk Path Traversal vulnerability4.9 Medium
- hp inc. officejet pro printers, hp officejet pro 8730 d9l19a firmware, officejet pro 8730 j7a28a firmware +10 more +12 moreCertain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when sending...7.5 High
- specklesystems speckle server, speckle-server +1 moreSpeckle Server API Token Privilege Escalation6.5 Medium
- redhat keycloak, red hat build of keycloak, single sign-on 7.6 for rhel 7 +8 more +10 moreKeycloak: offline session token dos7.7 High
- honoHono's named path parameters can be overridden in TrieRouter4.2 Medium
- andreas münch multiple post passwordsWordPress Multiple Post Passwords Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- labs64 credit trackerWordPress Credit Tracker Plugin <= 1.1.17 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- simple calendar – google calendar plugin, simplecalendar simple calendar – google calendar plugin, sureswiftcapital simple calendar +2 moreWordPress Google Calendar Events Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- squid-cache squidSQUID-2023:10 Denial of Service in HTTP Request parsing8.6 High
- currencyrate.today crypto converter widgetWordPress Crypto Converter Widget Plugin <= 1.8.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- moonlight-stream moonlight, moonlight-common-c, moonlight embedded +5 more +7 moreStack buffer overflow due to `strcpy` into fixed size buffer in `extractVersionQuadFromString`7.6 High
- currencyrate.today currency converter calculatorWordPress Currency Converter Calculator Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- moonlight-stream moonlight, moonlight-common-c, moonlight embedded +4 more +6 moreBuffer overflow due to use of `strcpy` in `performRtspHandshake`8.8 High
- enigmaweb wp catalogueWordPress WP Catalogue Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- bruno "aesqe" babic file galleryWordPress File Gallery Plugin <= 1.8.5.4 is vulnerable to Cross Site Scripting (XSS)7.1 High
- nima saberi aparatWordPress Aparat Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- moonlight-stream moonlight, moonlight-common-c, moonlight embedded +4 more +6 moreBuffer overflow due to use of `strcpy` in `parseUrlAddrFromRtspUrlString`8.8 High
- raghu goriya mytube playlistWordPress MyTube PlayList Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)7.1 High
- crocoblock jetblocks for elementorWordPress JetBlocks For Elementor Plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS)7.1 High
- hitachi energy rtu500, hitachienergy rtu520 firmware, rtu530 firmware +2 more +4 moreA vulnerability exists in the webserver that affects the RTU500 series product versions listed...5.4 Medium
- wedevs wp project manager – task, team, and project management plugin featuring kanban board and gantt charts, wp project manager +1 moreWordPress WP Project Manager Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- wpexpertsio rocket maintenance mode & coming soon page, wpexperts rocket maintenance mode \& coming soon page +1 moreWordPress Rocket Maintenance Mode & Coming Soon Page Plugin <= 4.3 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- dell vapp manager, powermax os, solutions enabler virtual appliance +1 more +3 moreDell vApp Manager, versions prior to 9.2.4.x contain an information disclosure vulnerability. A...7.5 High
- dell vapp manager,, powermax os, solutions enabler virtual appliance +1 more +3 moreDell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote...7.2 High
- dell vapp manager, powermax os, solutions enabler virtual appliance +1 more +3 moreDell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. A remote...7.2 High
- progress whatsup goldWhatsUp Gold Unauthenticated Access to an API Endpoint5.9 Medium
- progress whatsup goldWhatsUp Gold Unauthenticated Access to an API Endpoint7.5 High
- progress whatsup goldWhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles7.6 High
- Show moreLoading…