CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- stellarwp the events calendarThe Events Calendar < 6.2.8.1 - Unauthenticated Arbitrary Password Protected Post Read7.5 High
- yiiframework yii2-authclientyii2-authclient vulnerable to possible timing attack on string comparison in OAuth1, OAuth2 and OpenID Connect implementation6.1 Medium
- getsentry sentry-javascript, sentry astro +1 moreSentry's Astro SDK vulnerable to ReDoS7.5 High
- yiiframework yii2-authclientThe Oauth2 PKCE implementation is vulnerable6.8 Medium
- resqueResque vulnerable to reflected cross site scripting through pathname6.3 Medium
- resqueResque vulnerable to reflected XSS in resque-web failed and queues lists6.3 Medium
- resqueResque vulnerable to reflected XSS in Queue Endpoint6.3 Medium
malojaserverPyPIMaloja error page XSS vulnerability5.4 MediumasyncsshPyPIAsyncSSH vulnerable to Prefix Truncation Attack (a.k.a. Terrapin Attack) against ChaCha20-Poly1305 and Encrypt-then-MAC5.9 Medium- ibm db2 mirror for i, i +1 moreIBM i information disclosure5.3 Medium
- cambium epmp force 300-25, cambiumnetworks epmp force 300-25 firmware +1 moreCode Injection vulnerability in Cambium ePMP Force 300-257.8 High
- svgator, svgator – add animated svg easily +1 moreWordPress SVGator – Add Animated SVG Easily Plugin <= 1.2.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- adfoxly – ad manager, adsense ads & ads.txt, wpfoxly adfoxly +1 moreWordPress AdFoxly – Ad Manager, AdSense Ads & Ads.txt Plugin <= 1.8.5 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- crocoblock jetelements for elementorWordPress JetElements For Elementor Plugin <= 2.6.13 is vulnerable to Cross Site Request Forgery (CSRF)6.3 Medium
- michael winkler teachpressWordPress teachPress Plugin <= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- tagbox – ugc galleries, social media widgets, user reviews & analytics, taggbox +1 moreWordPress Taggbox Plugin <= 3.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- saint systems disable user loginWordPress Disable User Login Plugin <= 1.3.7 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- automattic canada post shipping methodWordPress WooCommerce Canada Post Shipping Plugin <= 2.8.3 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- automattic woocommerce bookings, woocommerce bookings +1 moreWordPress WooCommerce Bookings Plugin <= 2.0.3 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- givewp, givewp – donation plugin and fundraising platform, stellarwp givewp – donation plugin and fundraising platform +2 moreWordPress GiveWP Plugin <= 2.25.1 is vulnerable to Server Side Request Forgery (SSRF)5.5 Medium
- allegroai allegroai/clearml-server, clear clearml server +1 moreCross-site Scripting (XSS) - Stored in allegroai/clearml-server5.4 Medium
- palscode multi currency for woocommerceWordPress Multi Currency For WooCommerce Plugin <= 1.5.5 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- quanticedge first order discount woocommerceWordPress First Order Discount Woocommerce Plugin <= 1.21 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- kevin ohashi wpperformancetesterWordPress WPPerformanceTester Plugin <= 2.0.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- paytr ödeme ve elektronik para kuruluşu a.ş. taksit tablosu – woocommerce, paytr taksit tablosu - woocommerce +1 moreWordPress PayTR Taksit Tablosu Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- ibm mq applianceIBM MQ Appliance information disclosure6.5 Medium
- infinispan, red hat data grid 8.4.6, redhat data grid +1 more +3 moreInfinispan: credentials returned from configuration as clear text7.2 High
- infinispan, red hat build of apache camel 4 for quarkus 3, build of apache camel for spring boot 4 +13 more +15 moreInfinispan: circular reference on marshalling leads to dos4.4 Medium
- redhat ansible automation platform, debian linux, red hat ansible automation platform 1.2 +6 more +8 moreAnsible: malicious role archive can cause ansible-galaxy to overwrite arbitrary files6.3 Medium
- red hat service interconnect 1 for rhel 9, redhat service interconnect +1 moreSkupper-operator: privelege escalation via config map6.8 Medium
- redhat satellite, red hat satellite 6.15 for rhel 8 +1 moreSatellite: arithmetic overflow in satellite7.6 High
- infinispan, red hat data grid 8.4.4, jboss enterprise application platform 6 +3 more +5 moreInfinispan: non-admins should not be able to get cache config via rest api4.3 Medium
- infinispan, red hat data grid 8.4.4, jboss enterprise application platform 6 +3 more +5 moreInfispan: rest bulk ops don't check permissions6.5 Medium
- openimageio, fedora extra packages for enterprise linux, fedora +2 moreOpenimageio: heap-buffer-overflow in file src/gif.imageio/gifinput.cpp7.5 High
- bosch camera firmware, cpp13 firmware, cpp14 firmware +4 more +6 moreAn information disclosure vulnerability was discovered in Bosch IP camera devices allowing an...5.3 Medium
- bosch onvif camera event driver tool, bis video engine, video management system +21 more +23 moreAn improper handling of a malformed API answer packets to API clients in Bosch BT software...5.9 Medium
- bosch monitor wall, monitorwall, video recording manager +5 more +7 moreAn improper handling of a malformed API request to an API server in Bosch BT software products...7.5 High
- bosch camera firmware, cpp13 firmware, cpp14 firmware +2 moreA command injection vulnerability exists in Bosch IP cameras that allows an authenticated user...7.2 High
- ejmahler transposetranspose: Buffer overflow due to integer overflow4.5 Medium
- dell networker virtual edition, emc networker +1 moreDell NetWorker Virtual Edition versions 19.8 and below contain the use of deprecated...5.3 Medium
- madebytribe caddy, tribe interactive caddy – smart side cart for woocommerce +1 moreWordPress Caddy Plugin <= 1.9.7 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- binarycarpenter menu bar cart icon for woocommerce by binary carpenter, menu bar cart icon for woocommerce +1 moreWordPress BC Menu Bar Cart Icon For WooCommerce By Binary Carpenter Plugin <= 1.49.3 is vulnerable to Cross Site Request Forgery (CSRF)6.5 Medium
- hiroaki miyashita custom post type page templateWordPress Custom Post Type Page Template Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- zabbix, zabbix zabbix-agent2 +1 moreCode injection in zabbix_agent2 smart.disk.get caused by smartctl plugin4.6 Medium
- zabbix, zabbix server +1 moreCode execution vulnerability in icmpping6.8 Medium
- zabbix, zabbix zabbix-agent +1 morePossible buffer overread from reading DNS responses3.9 Low
- zabbix frontend, zabbix, zabbix server +2 moreLeak of zbx_session cookie when using a scheduled report that includes a dashboard with a URL widget.9.6 Critical
- wso2 api manager, api manager analytics, api microgateway +7 more +9 moreWSO2 Registry Stored Cross Site Scripting (XSS) vulnerability4.8 Medium
- apache dorisApache Doris: Missing API authentication allowed DoS8.2 High
- aditaas allied digital integrated tool-as-a-serviceImproper Authentication Vulnerability in ADiTaaS9.1 Critical
- Show moreLoading…