CVEs published in December 2023
2,760 vulnerabilities, 382 critical, 9 exploited.
quickjsOSS-FuzzHeap-use-after-free in JS_NewObjectFromShapeNo score- hongliuliao ehttpehttp 1.0.6 before 17405b9 has a simple_log.cpp _log out-of-bounds-read during error logging for...7.5 High
- hongliuliao ehttpehttp 1.0.6 before 17405b9 has an epoll_socket.cpp read_func use-after-free. An attacker can make...7.5 High
- idurarapp idurarIDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted...5.4 Medium
- thirtybees bees blogThe beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because...6.1 Medium
- brave browserBrave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect...6.1 Medium
- outdoorbits little backup boxoutdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to...9.8 Critical
- logobeeLogoBee 0.2 allows updates.php?id= XSS.6.1 Medium
- unifiedremote unified remoteUnified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a...9.8 Critical
- totolink x2000r firmwareTOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the...9.8 Critical
- totolink x2000r firmwareTOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the...9.8 Critical
- totolink x2000r firmwareTOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the...9.8 Critical
- totolink x6000r firmwareTOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE)...9.8 Critical
- embras geosiap erpGrupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via...9.8 Critical
- mingsoft mcmsMingsoft MCMS SQL injection9.8 Critical
- layuiLayui cross-site scripting (XSS) vulnerability5.4 Medium
- testlinkTestLink through 1.9.20 allows type juggling for authentication bypass because === is not used.7.5 High
- jeecg bootJeecgBoot server-side template injection9.8 Critical
- jeecg bootJeecg Boot SQL Injection9.8 Critical
- jeecg bootJeecg Boot SQL injection vulnerability9.8 Critical
- scontain sconeAn issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. Lack...5.5 Medium
- fortanix confidential computing managerAn issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform...5.5 Medium
- fortanix confidential computing managerAn issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform...5.5 Medium
- scontain sconeImproper initialization of x87 and SSE floating-point configuration registers in the...7.8 High
- scontain sconeA lack of pointer-validation logic in the __scone_dispatch component of SCONE before v5.8.0 for...5.5 Medium
- 201206030 novel-plusNovel-Plus Friendly Link FriendLinkController.java cross site scripting2.4 Low
- misskeyMisskey vulnerable to improper authorization when accessing with third-party application9.1 Critical
- tj-actions verify-changed-filesGitHub Action tj-actions/verify-changed-files is vulnerable to command injection in output filenames7.7 High
- hailHail authentication can be bypassed by changing email address5.3 Medium
- microsoft python, python extension for visual studio code +1 moreVisual Studio Code Python Extension Remote Code Execution Vulnerability7.8 High
- senol sahin ai power: complete ai pack – powered by gpt-4, aipower +1 moreWordPress GPT3 AI Content Writer Plugin <= 1.8.2 is vulnerable to Sensitive Data Exposure5.3 Medium
- implecode ecommerce product catalog plugin for wordpress, ecommerce product catalog +1 moreWordPress eCommerce Product Catalog Plugin <= 3.3.26 is vulnerable to Sensitive Data Exposure5.3 Medium
- implecode product catalog simpleWordPress Product Catalog Simple Plugin <= 1.7.6 is vulnerable to Sensitive Data Exposure5.3 Medium
- codepeople calculated fields formWordPress Calculated Fields Form Plugin <= 1.2.28 is vulnerable to Open Redirection4.1 Medium
- gm information technologies mdo, gmbilisim multi-disciplinary design optimization +1 moreSQLi i GM Informatics MDO9.8 Critical
- digital ant e-commerce software, yaztekteknoloji e-commerce +1 moreSQLi in Yazteks E-Commerce Software9.8 Critical
- gophish admin panel, ween management panel +1 moreSQLi in Weens Admin Panel9.8 Critical
- apache openofficeApache OpenOffice: Macro URL arbitrary script execution8.8 High
- aam advanced access manager – restricted content, users & roles, enhanced security and more, vasyltech advanced access manager +1 moreWordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Open Redirection4.7 Medium
- unknown wp mail logWordPress WP Mail Log Plugin <= 1.1.2 is vulnerable to Arbitrary File Upload9.9 Critical
- dynamiapps frontend admin, shabti frontend admin by dynamiapps +1 moreWordPress Frontend Admin by DynamiApps Plugin <= 3.18.3 is vulnerable to Arbitrary File Upload10.0 Critical
- piotnet forms, piotnetdotcom piotnet forms +1 moreWordPress Piotnet Forms Plugin <= 1.0.25 is vulnerable to Arbitrary File Upload9.0 Critical
- joris van montfort jvm gutenberg rich text iconsWordPress JVM rich text icons Plugin <= 1.2.3 is vulnerable to Arbitrary File Upload9.9 Critical
- bertha ai, bertha.ai bertha ai. your ai co-pilot for wordpress and chrome +1 moreWordPress BERTHA AI Plugin <= 1.11.10.7 is vulnerable to Arbitrary File Upload10.0 Critical
- soft8soft verge3d, soft8soft llc verge3d publishing and e-commerce +1 moreWordPress Verge3D Plugin <= 4.5.2 is vulnerable to Arbitrary File Upload9.9 Critical
- jacques malgrange rencontre – dating site, boiteasite download rencontre - dating site +1 moreWordPress Rencontre – Dating Site Plugin <= 3.10.1 is vulnerable to Arbitrary File Upload10.0 Critical
- pixelemu terraclassifieds, terraclassifieds – simple classifieds plugin +1 moreWordPress TerraClassifieds Plugin <= 2.0.3 is vulnerable to Arbitrary File Upload10.0 Critical
- ioss wp mlm software plugin, wpmlmsoftware wp mlm unilevel +1 moreWordPress WP MLM Unilevel Plugin <= 4.0 is vulnerable to Arbitrary File Upload10.0 Critical
- dattateccom envíalosimple: email marketing y newsletters, donweb envialosimple\ +1 moreWordPress EnvíaloSimple Plugin <= 2.1 is vulnerable to PHP Object Injection9.6 Critical
- saleswonder webinarignition, saleswonder team webinar plugin: create live/evergreen/automated/instant webinars, stream & zoom meetings | webinarignition +1 moreWordPress WebinarIgnition Plugin <= 3.05.0 is vulnerable to PHP Object Injection9.9 Critical
- Show moreLoading…