CVEs published December 11, 2023
39 CVEs were published on December 11, 2023: 4 critical, 7 high. Browse them by severity, product and exploitation status.
- Published
- 39
- Critical
- 4
- High
- 7
- Medium
- 11
- Low
- 1
- Unrated
- 16
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- Google Android
- 4
- EmbedPress
- 2
- mindsdb
- 2
- The Document Foundation LibreOffice
- 2
- afichet openexr-viewer
- 1
- Campcodes Web-Based Student Clearance System
- 1
- Contact Form Email
- 1
- EazyDocs
- 1
- Eclipse Foundation Eclipse Memory Analyzer
- 1
- Enalean tuleap
- 1
Critical 4
- CVE-2023-50245OpenEXR-viewer memory overflow vulnerabilityafichet openexr-viewer
- CVE-2023-48425U-Boot vulnerability resulting in persistent Code ExecutionGoogle Android
- CVE-2023-48424U-Boot shell vulnerability resulting in Privilege escalation in a production deviceGoogle Android
- CVE-2023-49417TOTOLink A7000R V9.1.0u.6115_B20201022 has a stack overflow vulnerability via setOpModeCfg.
High 7
- CVE-2023-49803@koa/cors has overly permissive origin policykoajs cors · @koa/cors
- CVE-2023-6538System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products is susceptible to unintended…Hitachi Vantara System Management Unit
- CVE-2023-6186Link targets allow arbitrary script executionThe Document Foundation LibreOffice
- CVE-2023-6185Improper input validation enabling arbitrary Gstreamer pipeline injectionThe Document Foundation LibreOffice
- CVE-2023-5500Frauscher: FDS102 for FAdC/FAdCi remote code execution vulnerabilityFrauscher FDS102 for FAdC/FAdCi
- CVE-2021-3187An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7.
- CVE-2023-49355decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input.
Medium, low and unrated 28
- CVE-2023-49805Uptime Kuma Missing Origin Validation in WebSocketslouislam uptime-kuma
- CVE-2023-49804Uptime Kuma Password Change Vulnerabilitylouislam uptime-kuma · uptime-kuma
- CVE-2023-45292Captcha verification bypass in github.com/mojocn/base64Captchagithub.com/mojocn/base64Captcha
- CVE-2023-49802MantisBT LinkedCustomFields Cross-site Scripting vulnerabilitymantisbt-plugins LinkedCustomFields
- CVE-2023-49796MindsDB Arbitrary File Write vulnerabilitymindsdb
- CVE-2023-5955Contact Form Email < 1.3.44 - Editor+ Stored Cross-Site ScriptingContact Form Email
- CVE-2023-5749EmbedPress < 3.9.2 - Reflected XSSEmbedPress
- CVE-2023-5757WP Crowdfunding < 2.1.8 - Admin+ Stored XSSWP Crowdfunding
- CVE-2023-5940WP Not Login Hide <= 1.0 - Admin+ Stored XSSWP Not Login Hide
- CVE-2023-5750EmbedPress < 3.9.2 - Reflected XSSEmbedPress
- CVE-2023-6035EazyDocs < 2.3.4 - Subscriber + SQLiEazyDocs
- CVE-2023-5907File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path TraversalFile Manager
- CVE-2023-49795MindsDB Server-Side Request Forgery vulnerabilitymindsdb
- CVE-2023-48715Tuleap vulnerable to Cross-site Scripting on the edition page of a releaseEnalean tuleap
- CVE-2023-6679Kernel: null pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.cRed Hat Enterprise Linux
- CVE-2023-6194In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD)…Eclipse Foundation Eclipse Memory Analyzer
- CVE-2023-6671Cross-Site Request Forgery on OPEN JOURNAL SYSTEMSOPEN JOURNAL SYSTEMS
- CVE-2023-6181An oversight in BCB handling of reboot reason that allows for persistent code executionGoogle Android
- CVE-2023-48417Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity ApplicationGoogle Android
- CVE-2023-6659Campcodes Web-Based Student Clearance System login.php sql injectionCampcodes Web-Based Student Clearance System
- CVE-2020-12613An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6.
- CVE-2023-36646Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges…
- CVE-2023-49418TOTOLink A7000R V9.1.0u.6115_B20201022has a stack overflow vulnerability via setIpPortFilterRules.
- CVE-2023-49488A cross-site scripting (XSS) vulnerability in Openfiler ESA v2.99.1 allows attackers to execute arbitrary web scripts or HTML via…
- CVE-2023-49490XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php.
Show all 28 entriesShow fewer entries
- CVE-2023-49494DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component…
- CVE-2023-49964An issue was discovered in Hyland Alfresco Community Edition through 7.2.0.
- CVE-2023-50465A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated…