# CVEs published 2023-12-11

39 CVEs were published on December 11, 2023: 4 critical, 7 high. Days are UTC.

- [CVE-2023-49803](https://cve.now/CVE-2023-49803.md): @koa/cors has overly permissive origin policy (CVSS 8.6, koajs cors · @koa/cors)
- [CVE-2023-50245](https://cve.now/CVE-2023-50245.md): OpenEXR-viewer memory overflow vulnerability (CVSS 9.8, afichet openexr-viewer)
- [CVE-2023-49805](https://cve.now/CVE-2023-49805.md): Uptime Kuma Missing Origin Validation in WebSockets (CVSS 6.0, louislam uptime-kuma)
- [CVE-2023-49804](https://cve.now/CVE-2023-49804.md): Uptime Kuma Password Change Vulnerability (CVSS 6.7, louislam uptime-kuma · uptime-kuma)
- [CVE-2023-45292](https://cve.now/CVE-2023-45292.md): Captcha verification bypass in github.com/mojocn/base64Captcha (no CVSS, github.com/mojocn/base64Captcha)
- [CVE-2023-49802](https://cve.now/CVE-2023-49802.md): MantisBT LinkedCustomFields Cross-site Scripting vulnerability (CVSS 6.7, mantisbt-plugins LinkedCustomFields)
- [CVE-2023-49796](https://cve.now/CVE-2023-49796.md): MindsDB Arbitrary File Write vulnerability (CVSS 5.3, mindsdb)
- [CVE-2023-5955](https://cve.now/CVE-2023-5955.md): Contact Form Email \< 1.3.44 - Editor+ Stored Cross-Site Scripting (CVSS 6.1, Contact Form Email)
- [CVE-2023-5749](https://cve.now/CVE-2023-5749.md): EmbedPress \< 3.9.2 - Reflected XSS (no CVSS, EmbedPress)
- [CVE-2023-5757](https://cve.now/CVE-2023-5757.md): WP Crowdfunding \< 2.1.8 - Admin+ Stored XSS (no CVSS, WP Crowdfunding)
- [CVE-2023-5940](https://cve.now/CVE-2023-5940.md): WP Not Login Hide \<= 1.0 - Admin+ Stored XSS (no CVSS, WP Not Login Hide)
- [CVE-2023-5750](https://cve.now/CVE-2023-5750.md): EmbedPress \< 3.9.2 - Reflected XSS (no CVSS, EmbedPress)
- [CVE-2023-6035](https://cve.now/CVE-2023-6035.md): EazyDocs \< 2.3.4 - Subscriber + SQLi (no CVSS, EazyDocs)
- [CVE-2023-5907](https://cve.now/CVE-2023-5907.md): File Manager \< 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal (CVSS 6.5, File Manager)
- [CVE-2023-49795](https://cve.now/CVE-2023-49795.md): MindsDB Server-Side Request Forgery vulnerability (CVSS 6.5, mindsdb)
- [CVE-2023-48715](https://cve.now/CVE-2023-48715.md): Tuleap vulnerable to Cross-site Scripting on the edition page of a release (CVSS 5.4, Enalean tuleap)
- [CVE-2023-6679](https://cve.now/CVE-2023-6679.md): Kernel: null pointer dereference in dpll\_pin\_parent\_pin\_set() in drivers/dpll/dpll\_netlink.c (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2023-6538](https://cve.now/CVE-2023-6538.md): System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products is susceptible to unintended… (CVSS 7.6, Hitachi Vantara System Management Unit)
- [CVE-2023-6194](https://cve.now/CVE-2023-6194.md): In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD)… (CVSS 2.8, Eclipse Foundation Eclipse Memory Analyzer)
- [CVE-2023-6671](https://cve.now/CVE-2023-6671.md): Cross-Site Request Forgery on OPEN JOURNAL SYSTEMS (CVSS 6.3, OPEN JOURNAL SYSTEMS)
- [CVE-2023-6186](https://cve.now/CVE-2023-6186.md): Link targets allow arbitrary script execution (CVSS 8.3, The Document Foundation LibreOffice)
- [CVE-2023-6185](https://cve.now/CVE-2023-6185.md): Improper input validation enabling arbitrary Gstreamer pipeline injection (CVSS 8.3, The Document Foundation LibreOffice)
- [CVE-2023-5500](https://cve.now/CVE-2023-5500.md): Frauscher: FDS102 for FAdC/FAdCi remote code execution vulnerability (CVSS 8.8, Frauscher FDS102 for FAdC/FAdCi)
- [CVE-2023-6181](https://cve.now/CVE-2023-6181.md): An oversight in BCB handling of reboot reason that allows for persistent code execution (no CVSS, Google Android)
- [CVE-2023-48425](https://cve.now/CVE-2023-48425.md): U-Boot vulnerability resulting in persistent Code Execution (CVSS 9.8, Google Android)
- [CVE-2023-48424](https://cve.now/CVE-2023-48424.md): U-Boot shell vulnerability resulting in Privilege escalation in a production device (CVSS 9.8, Google Android)
- [CVE-2023-48417](https://cve.now/CVE-2023-48417.md): Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application (no CVSS, Google Android)
- [CVE-2023-6659](https://cve.now/CVE-2023-6659.md): Campcodes Web-Based Student Clearance System login.php sql injection (CVSS 6.3, Campcodes Web-Based Student Clearance System)
- [CVE-2020-12613](https://cve.now/CVE-2020-12613.md): An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. (no CVSS)
- [CVE-2021-3187](https://cve.now/CVE-2021-3187.md): An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. (CVSS 8.8)
- [CVE-2023-36646](https://cve.now/CVE-2023-36646.md): Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges… (no CVSS)
- [CVE-2023-49355](https://cve.now/CVE-2023-49355.md): decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " \[\]-1.2e-1111111111" input. (CVSS 7.5)
- [CVE-2023-49417](https://cve.now/CVE-2023-49417.md): TOTOLink A7000R V9.1.0u.6115\_B20201022 has a stack overflow vulnerability via setOpModeCfg. (CVSS 9.8)
- [CVE-2023-49418](https://cve.now/CVE-2023-49418.md): TOTOLink A7000R V9.1.0u.6115\_B20201022has a stack overflow vulnerability via setIpPortFilterRules. (no CVSS)
- [CVE-2023-49488](https://cve.now/CVE-2023-49488.md): A cross-site scripting (XSS) vulnerability in Openfiler ESA v2.99.1 allows attackers to execute arbitrary web scripts or HTML via… (no CVSS)
- [CVE-2023-49490](https://cve.now/CVE-2023-49490.md): XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php. (no CVSS)
- [CVE-2023-49494](https://cve.now/CVE-2023-49494.md): DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component… (no CVSS)
- [CVE-2023-49964](https://cve.now/CVE-2023-49964.md): An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. (no CVSS)
- [CVE-2023-50465](https://cve.now/CVE-2023-50465.md): A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2023-12-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.