CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- dfirkuiper kuiperDFIRKuiper TAR Archive case_management.py unzip_file path traversal3.1 Low
- codelyfe stupid simple cmscodelyfe Stupid Simple CMS Deletion Interface delete.php improper authentication5.4 Medium
jqOSS-FuzzStack-buffer-overflow in decNaNsNo scoreicuOSS-FuzzStack-buffer-overflow in icu_75::TZDBTimeZoneNames::getMetaZoneNamesNo scorejavaparserOSS-FuzzSecurity exception in com.github.javaparser.CommentsInserter.insertCommentsNo scoreapache-commons-langOSS-FuzzSecurity exception in java.base/java.lang.reflect.Array.newArrayNo scorephpOSS-FuzzUNKNOWN WRITE in zeroNo scorebinutilsOSS-FuzzHeap-use-after-free in memory_bcloseNo scorelibavcOSS-FuzzUNKNOWN READ in ih264d_filter_boundary_left_nonmbaffNo score- lfprojects mlflow, mlflow mlflow/mlflow +1 morePath Traversal: '\..\filename' in mlflow/mlflow7.5 High
- totolink a7100ru, a7100ru firmware +1 moreTotolink A7100RU HTTP POST Request main buffer overflow9.8 Critical
spipDebianspip - security updateNo score- openbsd openssh, debian linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +3 more +5 moreIn ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has...6.5 Medium
- openbsd openssh, debian linux, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +5 more +7 moreIn ssh-agent in OpenSSH before 9.6, certain destination constraints can be incompletely applied....5.5 Medium
- cryptopp crypto\+\+ModularSquareRoot in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of...7.5 High
- cryptopp crypto\+\+gf2n.cpp in Crypto++ (aka cryptopp) through 8.9.0 allows attackers to cause a denial of service ...7.5 High
- cryptopp crypto\+\+Crypto++ (aka cryptopp) through 8.9.0 has a Marvin side channel during decryption with PKCS#1 v1...5.9 Medium
- 9bis kitty, apache sshd, sshj +68 more +70 morePrefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin5.9 Medium
- jahastech nxfilterJahastech NxFilter Bind Request ldap injection4.3 Medium
- gitlabImproper User Management in GitLab4.9 Medium
- jahastech nxfilterJahastech NxFilter config,admin.jsp cross-site request forgery4.3 Medium
- netentsec application security gateway, ns-asg application security gateway +1 moreNetentsec NS-ASG Application Security Gateway sql injection7.3 High
- codelyfe stupid simple cmscodelyfe Stupid Simple CMS upload.php unrestricted upload5.5 Medium
- hp system management homepage, hpe system management homepage (smh) +1 moreHP-UX System Management Homepage, Disclosure of Information7.2 High
- codelyfe stupid simple cmscodelyfe Stupid Simple CMS HTTP POST Request handle-command.php os command injection7.3 High
- rmountjoy92 dashmachinermountjoy92 DashMachine delete_file path traversal4.6 Medium
- rmountjoy92 dashmachinermountjoy92 DashMachine Config save_config code injection4.3 Medium
- realmag777 fox – currency switcher professional for woocommerce, pluginus fox - currency switcher professional for woocommerce +1 moreWordPress WOOCS – WooCommerce Currency Switcher Plugin <= 1.4.1.4 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- pixelyoursite product catalog feed by pixelyoursite, product catalog feed +1 moreWordPress Product Catalog Feed by PixelYourSite Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- mayuri k best courier management systemSourceCodester Best Courier Management System manage_user.php sql injection5.5 Medium
- innovative solutions fix my feed rss repairWordPress Fix My Feed RSS Repair Plugin <= 1.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- denis kobozev csv importerWordPress CSV Importer Plugin <= 0.3.8 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- oretnom23 simple image stack websiteSourceCodester Simple Image Stack Website cross site scripting3.5 Low
- prince integrate google driveWordPress Integrate Google Drive Plugin <= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- ciprian popescu block for font awesomeWordPress Block for Font Awesome Plugin <= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- webbjocke simple wp sitemapWordPress Simple Wp Sitemap Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- hikvision intercom broadcasting system, intercom broadcast system +1 moreHikvision Intercom Broadcasting System ping.php os command injection6.3 Medium
- hikvision intercom broadcasting system, intercom broadcast system +1 moreHikvision Intercom Broadcasting System Log File system.html information disclosure4.3 Medium
- hikvision intercom broadcasting system, intercom broadcast system +1 moreHikvision Intercom Broadcasting System exportrecord.php path traversal4.3 Medium
- peazipPeaZip Library dragdropfilesdll.dll uncontrolled search path5.3 Medium
- phz76 rtspserverPHZ76 RtspServer RtspMesaage.cpp ParseRequestLine stack-based overflow6.3 Medium
- forestblog project forestblogsaysky ForestBlog Image Upload img unrestricted upload6.3 Medium
binutilsOSS-FuzzHeap-use-after-free in memory_bstatNo scorelibxml2OSS-FuzzHeap-use-after-free in htmlParseDocumentNo score- wang.market wangmarketxnx3 wangmarket Role Management Page code injection4.7 Medium
- redpandaRedpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the...9.8 Critical
- starnight micro http serverIn MicroHttpServer (aka Micro HTTP Server) through 4398570, _ReadStaticFiles in lib/middleware.c...9.8 Critical
- tongda oa 2017, tongda2000 tongda office anywhere +1 moreTongda OA 2017 delete.php sql injection5.5 Medium
- inc2734 mw wp formMW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion7.5 High
- collabora kodexplorerkalcaddle KodExplorer app.php index server-side request forgery6.3 Medium
- Show moreLoading…