CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- concretecms concrete cmsConcrete CMS Cross Site Request Forgery (CSRF)4.3 Medium
- concretecms concrete cmsConcrete CMS Cross Site Request Forgery (CSRF) vulnerability4.3 Medium
- concretecms concrete cmsConcrete CMS Stored XSS in Layout Preset Name4.8 Medium
- sysaidIn SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete...4.3 Medium
- stormshield network securityAn issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4...7.5 High
- stormshield network securityAn issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39,...4.8 Medium
- pexip virtual meeting roomsIn Pexip VMR self-service portal before 3, the same SSH host key is used across different...5.3 Medium
- follettlearning solutions destinyA Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20...6.1 Medium
- sierrawireless aleosOpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote...7.5 High
- pexip infinityPexip Infinity before 32 allows Webapp1 XSS via preconfigured links.6.1 Medium
- blosc c-blosc2C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function...7.5 High
- blosc c-blosc2C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp...7.5 High
- blosc c-blosc2C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via...7.5 High
- blosc c-blosc2C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function...7.5 High
- iliasThe workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to...7.2 High
- iliasThe workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to...7.2 High
- stormshield network securityIn Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24...7.3 High
- pexip infinityPexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to...7.5 High
- sesami cash point \& transport optimizerAn issue was discovered in SESAMI planfocus CPTO (Cash Point & Transport Optimizer) 6.3.8.6 718....4.8 Medium
- pexip infinityPexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote...7.5 High
- jamfThere is broken access control during authentication in Jamf Pro Server before 10.46.1.9.8 Critical
- typo3Path Traversal in TYPO3 File Abstraction Layer Storages4.9 Medium
- ncp-e secure enterprise clientSupport Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL...8.8 High
- opencrxopenCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria...6.1 Medium
- nokia network functions manager for transportAn issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists...6.1 Medium
- nokia network functions manager for transportAn issue was discovered in NOKIA NFM-T R19.9. Multiple Reflected XSS vulnerabilities exist in the...6.1 Medium
- nokia network functions manager for transportAn issue was discovered in NOKIA NFM-T R19.9. An Absolute Path Traversal vulnerability exists...6.5 Medium
- nokia network functions manager for transportAn issue was discovered in NOKIA NFM-T R19.9. Relative Path Traversal can occur under /oms1350...6.5 Medium
- nokia network functions manager for transportIn NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the...8.8 High
- nokia network functions manager for transportIn Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials...6.5 Medium
- nokia network functions manager for transportIn NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of...8.8 High
- rws worldserverAn issue was discovered in RWS WorldServer before 11.7.3. Regular users can create users with the...9.8 Critical
- rws worldserverAn issue was discovered in RWS WorldServer before 11.7.3. An authenticated, remote attacker can...8.8 High
- rws worldserverAn issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects...9.8 Critical
- rws worldserverAn issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value...9.8 Critical
- kylinos kylin-system-updaterKylinSoft kylin-system-updater com.kylin.systemupgrade Service UpgradeStrategiesDbus.py os command injection5.3 Medium
- uniway uw-302vp, uniwayinfo uw-302vp firmware +1 moreUniway UW-302VP Admin Web Interface wlan_basic_set.cgi cross-site request forgery4.3 Medium
- barracuda networks inc. esg appliance, barracuda email security gateway 300 firmware, email security gateway 400 firmware +3 more +5 moreRemote Code Execution (RCE) Vulnerability9.8 Critical
- douglas wilson spreadsheet::parseexcel, debian linux, fedoraproject fedora +1 more +3 moreArbitrary Code Execution (ACE) Vulnerability7.8 High
- dreamer cms, iteachyou dreamer cms +1 moreDreamer CMS uploadFile unrestricted upload6.3 Medium
ntopngOSS-FuzzHeap-buffer-overflow in Flow::dissectMDNSNo score- openbsd openssh, fedoraproject fedora, redhat enterprise linux +1 more +3 moreOpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for...7.0 High
- exim, debian linux, fedoraproject extra packages for enterprise linux +1 more +3 moreExim through 4.97 allows SMTP smuggling in certain configurations. Remote attackers can use a...5.3 Medium
- sendmail, freebsd, redhat enterprise linux +2 moresendmail through at least 8.14.7 allows SMTP smuggling in certain configurations. Remote...5.3 Medium
- postfix, fedoraproject fedora, redhat enterprise linux +2 morePostfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions...5.3 Medium
- activeadmin active adminActiveAdmin CSV Injection leading to sensitive information disclosure9.8 Critical
- qt, debian linux +1 moreAn issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3...9.8 Critical
- sudo project sudo, fedora, red hat enterprise linux 6 +3 more +5 moreSudo: improper handling of ipa_hostname leads to privilege mismanagement6.6 Medium
- instipod duouniversalkeycloakauthenticatorAn information disclosure vulnerability exists in the challenge functionality of instipod...4.5 Medium
- deis workflow managerDeis Workflow Manager race condition4.6 Medium
- Show moreLoading…