CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- j.n. breetvelt a.k.a. opajaap wp photo album plusWordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR)5.3 Medium
- wc vendors – woocommerce multi-vendor, woocommerce marketplace, product vendors, wcvendors woocommerce multi-vendor\, woocommerce marketplace\, product vendors +1 moreWordPress WC Vendors Marketplace Plugin <= 2.4.7 is vulnerable to SQL Injection7.6 High
- p-themes porto theme - functionality, porto theme - functionality, portotheme functionality +2 moreWordPress Porto Theme - Functionality Plugin < 2.12.1 is vulnerable to SQL Injection9.3 Critical
- quantumcloud ai chatbot, wpbot +1 moreWordPress ChatBot Plugin <= 4.7.8 is vulnerable to SQL Injection7.6 High
- guardgiant, guardgiant wordpress brute force protection – stop brute force attacks +1 moreWordPress WordPress Brute Force Protection – Stop Brute Force Attacks Plugin <= 2.2.5 is vulnerable to SQL Injection7.6 High
- spoonthemes couponis, couponis - affiliate & submitting coupons wordpress theme +1 moreWordPress Couponis Demo Plugin < 2.2 is vulnerable to SQL Injection9.3 Critical
- sigmaplugin advanced database cleanerWordPress Advanced Database Cleaner Plugin <= 3.1.2 is vulnerable to SQL Injection7.6 High
- magazine3 core web vitals & pagespeed booster, core web vitals \& pagespeed booster +1 moreWordPress Core Web Vitals & PageSpeed Booster Plugin <= 1.0.12 is vulnerable to Open Redirection4.7 Medium
- crm perks integration for salesforce and contact form 7, wpforms, elementor, ninja forms, crmperks integration for salesforce and contact form 7\, wpforms\, elementor\, ninja forms +1 moreWordPress Integration for Contact Form 7 and Salesforce Plugin <= 1.3.3 is vulnerable to Open Redirection4.7 Medium
- crm perks integration for woocommerce and quickbooksWordPress Integration for WooCommerce and QuickBooks Plugin <= 1.2.3 is vulnerable to Open Redirection4.7 Medium
- crm perks integration for woocommerce and zoho crm, books, invoice, inventory, bigin, crmperks integration for woocommerce and zoho crm\, books\, invoice\, inventory\, bigin +1 moreWordPress Integration for WooCommerce and Zoho CRM Plugin < 1.3.7 is vulnerable to Open Redirection4.7 Medium
- doofinder, doofinder wp & woocommerce search +1 moreWordPress Doofinder for WooCommerce Plugin <= 1.5.49 is vulnerable to Open Redirection4.7 Medium
- swapnil v. patil login and logout redirectWordPress Login and Logout Redirect Plugin <= 2.0.3 is vulnerable to Open Redirection4.7 Medium
- apache guacamoleApache Guacamole: Integer overflow in handling of VNC image buffers7.5 High
- servit affiliate-toolkit, servit software solutions affiliate-toolkit – wordpress affiliate plugin +1 moreWordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin <= 3.3.9 is vulnerable to Open Redirection4.7 Medium
- rajarora795 recently viewed productsWordPress Recently Viewed Products Plugin <= 1.0.0 is vulnerable to PHP Object Injection8.3 High
- dokan, wedevs dokan – best woocommerce multivendor marketplace solution – build your own amazon, ebay, etsy +1 moreWordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection4.4 Medium
- themesflat addons for elementorWordPress Themesflat Addons For Elementor Plugin <= 2.0.0 is vulnerable to PHP Object Injection8.3 High
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...7.5 High
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...7.5 High
- ivanti avalancheAn attacker can send a specially crafted request which could lead to leakage of sensitive data or...7.3 High
- ivanti avalancheAn unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or...6.5 Medium
- ivanti avalancheAn unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4...7.2 High
- ivanti avalancheAn unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4...7.2 High
- ivanti avalancheAn unauthenticated attacked could send a specifically crafted web request causing a Server-Side...7.5 High
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...7.5 High
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalancheAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalanche, wavelink +1 moreAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalanche, wavelink +1 moreAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalanche, wavelink +1 moreAn attacker sending specially crafted data packets to the Mobile Device Server can cause memory...9.8 Critical
- ivanti avalancheAn attacker can send a specially crafted request which could lead to leakage of sensitive data or...7.3 High
- hewlett packard enterprise (hpe) hpe integrated lights-out 5 (ilo 5), hpe integrated lights-out 6 (ilo 6),, hpe integrated lights-out 5 firmware, integrated lights-out 6 firmware +2 moreA potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and...7.5 High
- gamipress, gamipress – the #1 gamification plugin to reward points, achievements, badges & ranks in wordpress, rubengc gamipress – the #1 gamification plugin to reward points, achievements, badges & ranks in wordpress +2 moreWordPress GamiPress Plugin <= 2.5.6 is vulnerable to Broken Access Control5.4 Medium
- jordy meow media file renamer: rename files (manual, auto & ai), meowapps media file renamer - auto \& manual rename +1 moreWordPress Media File Renamer Plugin <= 5.6.9 is vulnerable to Sensitive Data Exposure6.5 Medium
- aruba hispeed cache, aruba.it aruba hispeed cache +1 moreWordPress Aruba HiSpeed Cache Plugin <= 2.0.6 is vulnerable to Sensitive Data Exposure5.3 Medium
- paxton net2When installing the Net2 software a root certificate is installed into the trusted store. A...8.1 High
- 52north wpsXML External Entity Reference on 52North WPS7.2 High
- hitachi energy rtu500 series cmu firmware, hitachienergy rtu500 firmware +1 moreVulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500...5.9 Medium
- imou life app, imoulife imou life +1 moreSession Hijacking on Imou Life app8.1 High
- hitachi energy rtu500 scripting interfaceA vulnerability exists in the component RTU500 Scripting interface. When a client connects to a...7.4 High
- debian linux, linux kernel, siemens ruggedcom rst2428p +6 more +8 moreUse-after-free in Linux kernel's ipv4: igmp component7.8 High
- Show moreLoading…