CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
- zhwnl chinese perpetual calendarAn issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any...7.5 High
- jizhicmsFile Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via...8.8 High
- seacmsA cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8...5.4 Medium
- gl.inet a1300, ar300m, ar750 +21 more +23 moreShell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6,...7.8 High
- zzcmsZZCMS 2023 has a file upload vulnerability in 3/E_bak5.1/upload/index.php, allowing attackers to...9.8 Critical
- textpatternThere is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8,...8.8 High
- shaarli project shaarliReflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to...6.1 Medium
- peplink balance two firmwareAn issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in...8.8 High
- peplink balance two firmwareAn issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the...4.3 Medium
- peplink balance two firmwareAn issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses...6.4 Medium
- innovadeluxe quick orderSQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0,...7.8 High
- seacmsSeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the...8.8 High
- tp-link tapoIncorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user...6.5 Medium
- sourcecodester medicine tracking system, oretnom23 medicine tracker system +1 moreSourceCodester Medicine Tracking System sql injection6.3 Medium
- libaom, aomedia, fedoraproject fedora +2 moreheap buffer overflow in libaom9.0 Critical
- revanced, revanced revanced-api +1 moreReVanced API vulnerable to Denial of Service due to lack of error caching7.5 High
- nexryai nexkeyExternal apps using tokens issued by administrators and moderators can call admin APIs8.9 High
- jamieblomerus unofficial mobile bankid integration, wp-mobile-bankid-integration +1 moreWP-Mobile-BankID-Integration WordPress Database Deserialization: Potential for Object Injection6.4 Medium
- advplyr audiobookshelfAudiobookshelf vulnerable to Blind SSRF in `Auth.js`4.3 Medium
- advplyr audiobookshelfAudiobookshelf vulnerable to Blind SSRF in `podcastUtils.js`4.3 Medium
- tj-actions changed-filestj-actions/changed-files command injection in output filenames7.3 High
- freeswitchFreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation7.5 High
- deepin deepin-compressor, linuxdeepin developer-center +1 moreZip Path Traversal in Deepin-Compressor9.3 Critical
- red hat eap 7.4.13, jboss enterprise application platform 7.4 for rhel 8, jboss enterprise application platform 7.4 for rhel 9 +2 more +4 moreEap-7: heap exhaustion via deserialization7.5 High
- datax-web project datax-webWeiYe-Jing datax-web HTTP POST Request killJob os command injection6.3 Medium
- go-gitMaliciously crafted Git server replies can cause DoS on go-git clients7.5 High
- ikcu university information management systemAuthenicated Path Traversal in İzmir Katip Çelebi University9.8 Critical
checkstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.exprNo scorentopngOSS-FuzzHeap-buffer-overflow in NetworkInterface::dissectPacketNo score- hyavijavahyavijava stack overflow vulnerability9.8 Critical
- hutoolhutool-core was discovered to contain a stack overflow via NumberUtil.toBigDecimal method7.5 High
- mvelmvel2 TimeOut error exists in the ParseTools.subCompileExpression method5.3 Medium
- hutoolhutool-core discovered to contain an infinite loop in the StrSplitter.splitByRegex function7.5 High
- json-path jayway jsonpathjson-path Out-of-bounds Write vulnerability5.3 Medium
- simplemobiletools simple dialerAn issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access...5.3 Medium
- xenomtechnologies phone dialer-voice call dialerAn issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker...7.5 High
- indibrowser indi browserAn issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access...9.8 Critical
- artistscope artisbrowserAn issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended...9.8 Critical
- vladymix tv browserThe com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is...9.8 Critical
- kamivision yi iotThe Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android...7.1 High
- fedirtsapana simple http server, simple http server plus +1 morePhlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka...6.3 Medium
- fedirtsapana simple http server plusPhlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android...4.6 Medium
- fedirtsapana tv broThe com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external...9.8 Critical
- sshenzhen tcl new technology co limited com.tcl.browser, tcl browser tv web - browsehere +1 moreAn issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65...9.8 Critical
- arris dg1670a firmware, dg860a firmware +1 moreArris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to...8.8 High
- jetmonsters hotel booking liteHotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion9.8 Critical
- bannersky bsk forms blacklistBSK Forms Blacklist < 3.7 - Admin+ Stored Cross-Site Scripting4.8 Medium
- awesomemotive duplicator, unknown duplicator pro +1 moreDuplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data Exposure7.5 High
- unknown bestwebsoft's like & share, bestwebsoft like \& share +1 moreBestWebSoft's Like & Share < 2.74 - Unauthenticated Password Protected Post Read7.5 High
- ays pro quiz makerQuiz Maker < 6.4.9.5 - Unauthenticated Email Address Disclosure5.3 Medium
- Show moreLoading…