CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- collabora kodexplorerkalcaddle KodExplorer app.php server-side request forgery6.3 Medium
- collabora kodexplorerkalcaddle KodExplorer ZIP Archive app.php unzipList code injection6.3 Medium
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreCross-site Scripting (XSS) - Stored in thorsten/phpmyfaq5.4 Medium
- phpmyfaq, thorsten thorsten/phpmyfaq +1 moreCross-site Scripting (XSS) - Stored in thorsten/phpmyfaq5.4 Medium
- collabora kodexplorerkalcaddle KodExplorer API Endpoint unrestricted upload6.3 Medium
- kalcaddle kodboxkalcaddle kodbox app.php cover server-side request forgery7.3 High
- kalcaddle kodboxkalcaddle kodbox index.class.php check command injection7.3 High
- ivanti connect secureA vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker...7.5 High
libavcOSS-FuzzHeap-buffer-overflow in isvcd_start_of_picNo scorelibavcOSS-FuzzHeap-buffer-overflow in ih264d_format_convertNo scorelibavcOSS-FuzzHeap-buffer-overflow in ih264d_format_convertNo score- unrealircdA buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an...7.5 High
- insyde insydeh2oTOCTOU race-condition vulnerability in Insyde InsydeH2O with Kernel 5.2 before version 05.27.29,...4.7 Medium
- aveva edgePath traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and...7.5 High
- aveva edgeAn issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions...9.8 Critical
- aveva edgeAn issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior....5.3 Medium
- uffizio gps trackerA Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions. The web server...9.8 Critical
- uffizio gps trackerAn Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker...6.1 Medium
- uffizio gps trackerAn improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead...7.5 High
- activeadminPotential CSV export data leak6.5 Medium
- owasp dependency-checkDependencyCheck Debug Mode Logging of NVD API Key5.3 Medium
- netapp ontap, ontap 9 +1 moreInformation Disclosure Vulnerability in ONTAP 94.3 Medium
- hcl software connectionsHCL Connections is vulnerable to sensitive information disclosure3.5 Low
- octokit app, octokit, octokit webhooks +2 more +4 moreUnauthenticated Denial of Service in the octokit/webhooks library5.4 Medium
- bazarrBazarr Blind Server-Side Request Forgery (SSRF) in the /test/<protocol>/ endpoint5.3 Medium
- bazarrBazarr Arbitrary file read in /api/swaggerui/static endpoint7.5 High
- bazarrBazarr Arbitrary file read in /system/backup/download/ endpoint7.5 High
- silabs gecko software development kit, silabs.com gsdk +1 moreUnvalidated input in Silicon Labs PSA Attestation service leads to secure memory access from non-secure memory9.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform remote code execution/programming rights with configuration section from any user account10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform XSS/CSRF Remote Code Execution in XWiki.ConfigurableClass9.7 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform RCE from account through SearchAdmin10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Solr search discloses password hashes of all users7.5 High
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform Solr search discloses email addresses of users5.3 Medium
- silabs.com gecko sdk, silabs z-wave software development kit +1 moreZ-Wave Denial of Service caused by Stream of Packets5.7 Medium
- gitlabImproper Validation of Specified Type of Input in GitLab4.3 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabImproper Control of Generation of Code ('Code Injection') in GitLab4.8 Medium
- gitlabImproper Control of Generation of Code ('Code Injection') in GitLab5.7 Medium
- gitlabImproper Certificate Validation in GitLab7.4 High
- brainstormforce suretriggers – connect all your plugins, apps, tools & automate everything!, suretriggers, suretriggers – connect all your plugins, apps, tools & automate everything! +2 moreWordPress SureTriggers Plugin <= 1.0.23 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- gift up gift cards for wordpress and woocommerce, gift up! up gift cards for wordpress and woocommerce, giftup gift up gift cards for wordpress and woocommerce +2 moreWordPress Gift Up Gift Cards for WordPress and WooCommerce Plugin <= 2.21.3 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- apasionados dofollow case by caseWordPress DoFollow Case by Case Plugin <= 3.4.2 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- elegant digital solutions commentluvWordPress CommentLuv Plugin <= 3.0.4 is vulnerable to Server Side Request Forgery (SSRF)7.2 High
- gitlabIncorrect Authorization in GitLab2.0 Low
- themeum tutor lms – elearning and online course solution, tutor lms +1 moreWordPress Tutor LMS Plugin <= 2.2.4 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- bold-themes bold page builderWordPress Bold Page Builder Plugin <= 4.6.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- biteship, biteship biteship: plugin ongkos kirim kurir instant, reguler, kargo +1 moreWordPress Biteship Plugin <= 2.2.24 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- webfactory ltd guest authorWordPress Guest Author Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- supsystic gdpr cookie consent by supsystic, gdpr cookie consent +1 moreWordPress GDPR Cookie Consent by Supsystic Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- chandra shekhar sahu site offline or coming soon or maintenance mode, freehtmldesigns site offline +1 moreWordPress Site Offline Plugin <= 1.5.6 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- Show moreLoading…