CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- w3c online-spellchecker-py, w3 spell checker +1 morew3c online-spellchecker-py spellchecker cross site scripting3.1 Low
- systemd project systemd, red hat cryostat 2, enterprise linux 8 +2 more +4 moreSystemd-resolved: unsigned name response in signed zone is not refused when dnssec=yes5.9 Medium
- kevinlangleyjr widget settings importer/exporter, porternovelli widget settings importer\/exporter +1 moreWidget Settings Importer/Exporter Plugin <= 1.5.3 - Unauthorized Widget Import to Stored Cross-Site Scripting7.4 High
- elegant themes diviDivi <= 4.23.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- moxa iologik e1200 series, iologik e1210 firmware, iologik e1211 firmware +8 more +10 moreioLogik E1200 Series: Weak Cryptographic Algorithm Vulnerability6.5 Medium
- moxa iologik e1200 series, iologik e1210 firmware, iologik e1211 firmware +8 more +10 moreioLogik E1200 Series: Cross-Site Request Forgery (CSRF) Vulnerability8.8 High
- backupbliss backup migration, inisev backupbliss – backup & migration with free cloud storage +1 moreBackup Migration <= 1.3.9 - Authenticated (Admin+) OS Command Injection via url7.2 High
- backupbliss backup migrationThe Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0...8.1 High
- backupbliss backup migration, inisev backupbliss – backup & migration with free cloud storage +1 moreBackup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion9.8 Critical
c-blosc2OSS-FuzzHeap-buffer-overflow in inflateNo score- amazon awslabs sandbox accounts for events, awslabs sandbox-accounts-for-events +1 moreSandbox Accounts for Events vulnerable to privilege escalation to read running events data7.8 High
- getsentry symbolicatorSSRF in symbolicator via invalid protocol4.3 Medium
- awslabs sandbox-accounts-for-events, amazon awslabs sandbox accounts for events +1 moresandbox-accounts-for-events security misconfiguration leads to budget exceed7.1 High
- apache hertzbeatUnauthorized access vulnerability on three interfaces7.5 High
- apache hertzbeatExpression Injection Vulnerability in Hertzbeat7.2 High
- engelsystemStored XSS in Overview and Output fields7.3 High
- dfir-iris iris, iris-web +1 moreImproper Neutralization of Alternate XSS Syntax in iris-web4.6 Medium
- dell cpg bios, precision 7865 tower firmware +1 moreDell Client BIOS contains a pre-boot direct memory access (DMA) vulnerability. An authenticated...7.2 High
- dell cpg bios, inspiron 7510 firmware, inspiron 7610 firmware +11 more +13 moreDell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high...6.7 Medium
- pymedusa medusaBlind SSRF in /home/testslack endpoint5.3 Medium
- pymedusa medusaBlind SSRF in `/home/testdiscord` endpoint5.3 Medium
- deepin reader, linuxdeepin developer-center +1 moreDeepin Reader RCE vulnerability due to a design flaw9.3 Critical
- nautobotNautobot missing object-level permissions enforcement when running Job Buttons3.5 Low
- cactiSQL Injection vulnerability when managing SNMP Notification Receivers8.8 High
- cactiCross-Site Scripting vulnerability when Import xml template file5.4 Medium
- nextcloud server, kiteworks security-advisories +1 moreBruteforce protection can be bypassed with misconfigured proxy5.3 Medium
- snowflake connector, snowflakedb snowflake-connector-net +1 moreSnowflake Connector .NET does not properly check the Certificate Revocation List (CRL)6.0 Medium
- nextcloud server, kiteworks security-advisories +1 moreWorkflows do not require password confirmation on API level5.4 Medium
- nextcloud, kiteworks security-advisories +1 moreApp PIN code can be bypassed in Nextcloud Files iOS4.3 Medium
- cactiCacti has incomplete fix for CVE-2023-395156.1 Medium
- cactiCacti SQL Injection vulnerability8.8 High
- ibm planning analyticsIBM Planning Analytics file upload8.0 High
- dell supportassist for home pcs, supportassist client consumer +1 moreDell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation...7.3 High
- ibm aixIBM AIX denial of service6.2 Medium
- clickhouse, clickhouse cloud +1 moreUnauthenticated heap buffer overflow in Gorrila codec decompression7.0 High
- apache hertzbeatPermission bypass due to incorrect configuration in github.com/dromara/hertzbeat7.5 High
- my-aac myaacslawkens MyAAC bugtracker.php cross site scripting3.5 Low
- code-projects point of sales and inventory management systemcode-projects Point of Sales and Inventory Management System checkout.php cross site scripting3.5 Low
bit-flagscrates.io`bit-flags` was removed from crates.io for malicious codeNo score- remyandrade school visitor log e-bookSourceCodester School Visitor Log e-Book log-book.php cross site scripting3.5 Low
- oretnom23 simple student attendance systemSourceCodester Simple Student Attendance System path traversal6.3 Medium
- carmelogarcia faculty management systemcode-projects Faculty Management System yearlevel.php cross site scripting3.5 Low
- carmelogarcia faculty management systemcode-projects Faculty Management System subjects.php cross site scripting2.4 Low
- phpgurukul online notes sharing systemPHPGurukul Online Notes Sharing System Contact Information profile.php access control4.3 Medium
- phpgurukul online notes sharing systemPHPGurukul Online Notes Sharing System add-notes.php unrestricted upload5.5 Medium
- phpgurukul online notes sharing systemPHPGurukul Online Notes Sharing System signup.php weak password3.1 Low
- phpgurukul online notes sharing systemPHPGurukul Online Notes Sharing System profile.php cross-site request forgery4.3 Medium
jqOSS-FuzzHeap-buffer-overflow in jv_string_vfmtNo scorelibssh2OSS-FuzzHeap-buffer-overflow in _libssh2_kex_agree_instrNo score- proftpdmake_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon...7.5 High
- Show moreLoading…