CVEs published December 14, 2023
157 CVEs were published on December 14, 2023: 7 critical, 55 high. Browse them by severity, product and exploitation status.
- Published
- 157
- Critical
- 7
- High
- 55
- Medium
- 58
- Low
- 1
- Unrated
- 36
- Now in CISA KEV
- 0
- Fix available
- 35
Most affected products
- Dell PowerProtect DD
- 8
- Google Chrome
- 6
- Progress Software WhatsUp Gold
- 6
- Ubuntu Budgie Budgie Extras
- 6
- Dell vApp Manager
- 5
- com.jfinal:jfinal
- 4
- asterisk
- 3
- IBM i Access Client Solutions
- 3
- moonlight-stream moonlight-common-c
- 3
- ZTE MC801A · ZTE MC801A1
- 3
Critical 7
- CVE-2023-46141Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical ResourcePHOENIX CONTACT Automation Worx Software Suite · PHOENI… +11
- CVE-2023-0757Phoenix Contact ProConOS prone to Incorrect Permission Assignment for Critical ResourcePHOENIX CONTACT MULTIPROG · PHOENIX CONTACT ProConOS eCLR
- CVE-2023-6572Command Injection in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2023-6569External Control of File Name or Path in h2oai/h2o-3h2oai/h2o-3 · h2o
- CVE-2023-40630Extension - joomcode.com - Unauthenticated LFI/SSRF in JCDashboards component for Joomla 1.0.0-1.1.30joomcode.com JCDashboards component for Joomla
- CVE-2023-44709PlutoSVG commit 336c02997277a1888e6ccbbbe674551a0582e5c4 and before was discovered to contain an integer overflow via the component…
- CVE-2023-48085Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.
High 55
- CVE-2023-6707Use after free in CSS in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2023-6706Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI…Google Chrome
- CVE-2023-6705Use after free in WebRTC in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2023-6704Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2023-6703Use after free in Blink in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2023-6702Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a…Google Chrome
- CVE-2023-0248Kantech Gen1 ioSmart card readerSensormatic Electronics, a subsidiary of Johnson Controls i…
- CVE-2023-49786Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiationasterisk
- CVE-2023-37457Asterisk's PJSIP_HEADER dialplan function can overwrite memory/cause crash when using 'update'asterisk
- CVE-2023-6563Keycloak: offline session token dosRed Hat Single Sign-On 7.6 for RHEL · Red Hat RHEL-8 bas… +3
- CVE-2023-50269SQUID-2023:10 Denial of Service in HTTP Request parsingsquid-cache squid
- CVE-2023-42801Stack buffer overflow due to `strcpy` into fixed size buffer in `extractVersionQuadFromString`moonlight-stream moonlight-common-c
- CVE-2023-42800Buffer overflow due to use of `strcpy` in `performRtspHandshake`moonlight-stream moonlight-common-c
- CVE-2023-48771WordPress File Gallery Plugin <= 1.8.5.4 is vulnerable to Cross Site Scripting (XSS)Bruno "Aesqe" Babic File Gallery
- CVE-2023-42799Buffer overflow due to use of `strcpy` in `parseUrlAddrFromRtspUrlString`moonlight-stream moonlight-common-c
- CVE-2023-48767WordPress MyTube PlayList Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)Raghu Goriya MyTube PlayList
- CVE-2023-48756WordPress JetBlocks For Elementor Plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS)Crocoblock JetBlocks For Elementor
- CVE-2023-48671Dell vApp Manager, versions prior to 9.2.4.x contain an information disclosure vulnerability.Dell vApp Manager
- CVE-2023-48665Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability.Dell vApp Manager,
- CVE-2023-48664Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability.Dell vApp Manager
- CVE-2023-6595WhatsUp Gold Unauthenticated Access to an API EndpointProgress Software WhatsUp Gold
- CVE-2023-6367WhatsUp Gold Stored Cross-Site Scripting (XSS) via RolesProgress Software WhatsUp Gold
- CVE-2023-6366WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert CenterProgress Software WhatsUp Gold
- CVE-2023-6365WhatsUp Gold Stored Cross-Site Scripting (XSS) via Device GroupsProgress Software WhatsUp Gold
- CVE-2023-6364WhatsUp Gold Stored Cross-Site Scripting (XSS) via DashboardProgress Software WhatsUp Gold
Show all 55 entriesShow fewer entries
- CVE-2023-48663Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability.Dell vApp Manager
- CVE-2023-48662Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability.Dell vApp Manager
- CVE-2023-48660Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability.Dell vApp Manger
- CVE-2023-49813WordPress WP Photo Album Plus Plugin <= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS)J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus
- CVE-2023-49771WordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)Peter Raschendorfer Smart External Link Click Monitor [Link…
- CVE-2023-48668Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command injection…Dell PowerProtect DD
- CVE-2023-49766WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.2.0 is vulnerable to Cross Site Scripting (XSS)Themefic Ultimate Addons for Contact Form
- CVE-2023-48667Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in…Dell PowerProtect DD
- CVE-2023-44286Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting…Dell PowerProtect DD
- CVE-2023-44285Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability.Dell PowerProtect DD
- CVE-2023-49172WordPress BrainCert – HTML5 Virtual Classroom Plugin <= 1.30 is vulnerable to Cross Site Scripting (XSS)BrainCert – HTML5 Virtual Classroom
- CVE-2023-49171WordPress Innovs HR Plugin <= 1.0.3.4 is vulnerable to Cross Site Scripting (XSS)TheInnovs Innovs HR – Complete Human Resource Management Sy…
- CVE-2023-44277Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in…Dell PowerProtect DD
- CVE-2022-45365WordPress Stock Ticker Plugin <= 3.23.2 is vulnerable to Cross Site Scripting (XSS)Aleksandar Urošević Stock Ticker
- CVE-2023-49739WordPress PowerPack Pro for Elementor plugin <= 2.9.23 - Reflected Cross Site Scripting (XSS) vulnerabilityIdeaBox Creations PowerPack Pro for Elementor
- CVE-2023-49740WordPress Seraphinite Accelerator Plugin <= 2.20.28 is vulnerable to Cross Site Scripting (XSS)Seraphinite Solutions Seraphinite Accelerator
- CVE-2023-49827WordPress Soledad Theme <= 8.4.1 is vulnerable to Cross Site Scripting (XSS)PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCo…
- CVE-2023-46143Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLCPHOENIX CONTACT Automation Worx Software Suite · PHOENI… +11
- CVE-2023-46142PHOENIX CONTACT: Insufficient Read and Write Protection to Logic and Runtime Data in PLCnext ControlPHOENIX CONTACT AXC F · PHOENIX CONTACT BPC +3
- CVE-2023-5592Phoenix Contact: ProConOs prone to Download of Code Without Integrity CheckPHOENIX CONTACT MULTIPROG · PHOENIX CONTACT ProConOS eCLR
- CVE-2023-45185IBM i Access Client Solutions code executionIBM i Access Client Solutions
- CVE-2023-45182IBM i Access Client Solutions information disclosureIBM i Access Client Solutions
- CVE-2023-6570Server-Side Request Forgery (SSRF) in kubeflow/kubeflowkubeflow/kubeflow
- CVE-2023-25643Two Vulnerabilities in Some ZTE Mobile Internet ProductsZTE MC801A · ZTE MC801A1
- CVE-2023-5629A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through…Schneider Electric Trio Q-Series Ethernet Data Radio · S… +1
- CVE-2023-41719A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a…Ivanti Connect Secure
- CVE-2023-41720A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker with a foothold on an Ivanti Connect Secure…Ivanti Connect Secure
- CVE-2023-43042IBM Storage Virtualize information disclosureIBM Storage Virtualize
- CVE-2023-41151An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to…
- CVE-2023-50564An arbitrary file upload vulnerability in the component /inc/modules_install.php of Pluck-CMS v4.7.18 allows attackers to execute…
Medium, low and unrated 95
- CVE-2023-4489Z/IP Gateway Use of Uninitialized PRNG when Generating S0 Encryption Keysilabs.com Z/IP Gateway SDK
- CVE-2023-6134Keycloak: reflected xss via wildcard in oidc redirect_uriRed Hat build of Keycloak · Red Hat Single Sign-On +2
- CVE-2023-49347Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated.Ubuntu Budgie Budgie Extras
- CVE-2023-49346Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated.Ubuntu Budgie Budgie Extras
- CVE-2023-49345Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated.Ubuntu Budgie Budgie Extras
- CVE-2023-49344Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated.Ubuntu Budgie Budgie Extras
- CVE-2023-49343Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated.Ubuntu Budgie Budgie Extras
- CVE-2023-49342Temporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated.Ubuntu Budgie Budgie Extras
- CVE-2023-49294Asterisk Path Traversal vulnerabilityasterisk
- CVE-2023-4694Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when sending a SOAP message to the service on TCP port…HP OfficeJet Pro Printers
- CVE-2023-50713Speckle Server API Token Privilege Escalationspecklesystems speckle-server
- CVE-2023-50710Hono's named path parameters can be overridden in TrieRouterhonojs hono · hono
- CVE-2023-49157WordPress Multiple Post Passwords Plugin <= 1.1.1 is vulnerable to Cross Site Scripting (XSS)Andreas Münch Multiple Post Passwords
- CVE-2023-49152WordPress Credit Tracker Plugin <= 1.1.17 is vulnerable to Cross Site Scripting (XSS)Labs64 Credit Tracker
- CVE-2023-49151WordPress Google Calendar Events Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)Simple Calendar – Google Calendar Plugin
- CVE-2023-49150WordPress Crypto Converter Widget Plugin <= 1.8.1 is vulnerable to Cross Site Scripting (XSS)CurrencyRate.today Crypto Converter Widget
- CVE-2023-49149WordPress Currency Converter Calculator Plugin <= 1.3.1 is vulnerable to Cross Site Scripting (XSS)CurrencyRate.today Currency Converter Calculator
- CVE-2023-48780WordPress WP Catalogue Plugin <= 1.7.6 is vulnerable to Cross Site Scripting (XSS)EnigmaWeb WP Catalogue
- CVE-2023-48770WordPress Aparat Plugin <= 1.7.1 is vulnerable to Cross Site Scripting (XSS)Nima Saberi Aparat
- CVE-2023-5769A vulnerability exists in the webserver that affects the RTU500 series product versions listed below.Hitachi Energy RTU500
- CVE-2023-49860WordPress WP Project Manager Plugin <= 2.6.7 is vulnerable to Cross Site Scripting (XSS)weDevs WP Project Manager – Task, team, and project managem…
- CVE-2023-49842WordPress Rocket Maintenance Mode & Coming Soon Page Plugin <= 4.3 is vulnerable to Cross Site Scripting (XSS)wpexpertsio Rocket Maintenance Mode & Coming Soon Page
- CVE-2023-6368WhatsUp Gold Unauthenticated Access to an API EndpointProgress Software WhatsUp Gold
- CVE-2023-49841WordPress Optin Forms Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)FancyThemes Optin Forms – Simple List Building Plugin for W…
- CVE-2023-48661Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability.Dell vApp Manager
Show all 95 entriesShow fewer entries
- CVE-2023-49820WordPress Structured Content Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD)…
- CVE-2023-49770WordPress Smart External Link Click Monitor [Link Log] Plugin <= 5.0.2 is vulnerable to Cross Site Scripting (XSS)Peter Raschendorfer Smart External Link Click Monitor [Link…
- CVE-2023-49195WordPress Nested Pages Plugin <= 3.2.6 is vulnerable to Cross Site Scripting (XSS)Kyle Phillips Nested Pages
- CVE-2023-49173WordPress 10to8 Online Appointment Booking System Plugin <= 1.0.9 is vulnerable to Cross Site Scripting (XSS)10to8 Sign In Scheduling Online Appointment Booking System
- CVE-2023-44284Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability.Dell PowerProtect DD
- CVE-2023-44279Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability…Dell PowerProtect DD
- CVE-2023-44278Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a path traversal vulnerability.Dell PowerProtect DD
- CVE-2023-49168WordPress BP Better Messages Plugin <= 2.4.0 is vulnerable to Cross Site Scripting (XSS)WordPlus Better Messages – Live Chat for WordPress, BuddyPr…
- CVE-2023-49743WordPress Dashboard Widgets Suite Plugin <= 3.4.1 is vulnerable to Cross Site Scripting (XSS)Jeff Starr Dashboard Widgets Suite
- CVE-2023-49745WordPress Spiffy Calendar Plugin <= 4.9.5 is vulnerable to Cross Site Scripting (XSS)Spiffy Plugins Spiffy Calendar
- CVE-2023-49828WordPress WooCommerce Payments Plugin <= 6.4.2 is vulnerable to Cross Site Scripting (XSS)Automattic WooPayments – Fully Integrated Solution Built an…
- CVE-2023-49833WordPress Spectra Plugin <= 2.7.9 is vulnerable to Cross Site Scripting (XSS)Brainstorm Force Spectra – WordPress Gutenberg Blocks
- CVE-2023-49836WordPress Cookie Bar Plugin <= 2.0 is vulnerable to Cross Site Scripting (XSS)Brontobytes Cookie Bar
- CVE-2023-6545Beckhoff: Open redirect in TwinCAT/BSD package authelia-bhfBeckhoff authelia-bhf of TwinCAT/BSD
- CVE-2023-46144PHOENIX CONTACT: PLCnext Control prone to download of code without integrity checkPHOENIX CONTACT AXC F · PHOENIX CONTACT BPC +3
- CVE-2023-49846WordPress Author Avatars List/Block Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)Paul Bearne Author Avatars List/Block
- CVE-2023-49847WordPress Annual Archive Plugin <= 1.6.0 is vulnerable to Cross Site Scripting (XSS)Twinpictures Annual Archive
- CVE-2023-50368WordPress Shortcodes and extra features for Phlox theme Plugin <= 2.15.2 is vulnerable to Cross Site Scripting (XSS)Averta Shortcodes and extra features for Phlox theme
- CVE-2023-50369WordPress Alma – Pay in installments or later for WooCommerce Plugin <= 5.1.3 is vulnerable to Cross Site Scripting (XSS)Alma – Pay in installments or later for WooCommerce
- CVE-2023-50370WordPress Livemesh Addons for WPBakery Page Builder Plugin <= 3.5 is vulnerable to Cross Site Scripting (XSS)WPBakery Page Builder Addons by Livemesh
- CVE-2023-48676Sensitive information disclosure and manipulation due to missing authorization.Acronis Cyber Protect Cloud Agent
- CVE-2023-48631Denial of Service of regular expression in package @adobe/css-toolsAdobe Not a product · @adobe/css-tools
- CVE-2023-6571Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflowkubeflow/kubeflow
- CVE-2023-50371WordPress Advanced Page Visit Counter Plugin <= 8.0.6 is vulnerable to Cross Site Scripting (XSS)Advanced Page Visit Counter – Most Wanted Analytics Plugin…
- CVE-2023-40627Extension - MLWebTechnologies - Reflected XSS in LivingWord component for Joomla 1.0.0-3.0.0https://github.com/MLWebTechnologies LivingWord component f…
- CVE-2023-40659Extension - joomboost.com - Reflected XSS in Easy Quick Contact module for Joomla 1.0.0-1.3.0joomboost.com Easy Quick Contact module for Joomla
- CVE-2023-40658Extension - deconf.net - Reflected XSS in Clicky Analytics Dashboard module for Joomla 1.0.0-1.3.1deconf.net Clicky Analytics Dashboard module for Joomla
- CVE-2023-40628Extension - Extplorer.net - Reflected XSS in Extplorer component for Joomla 1.0.0-2.1.15Extplorer.net Extplorer component for Joomla
- CVE-2023-40629Extension - king-products.net - SQLi vulnerability in LMS Lite component for Joomla 1.0.0-3.3.0.1king-products.net LMS Lite component for Joomla
- CVE-2023-49708Extension - joomstar.com - SQLi vulnerability in Starshop component for Joomla 1.0.0-1.0.9Joomstar.com Starshop component for Joomla
- CVE-2023-40656Extension - plasma-web.ru - Reflected XSS in Quickform component for Joomla 1.0.0-3.3.01plasma-web.ru Quickform component for Joomla
- CVE-2023-49707Extension - joomlart.com - SQLi vulnerability in S5 Register module for Joomla 1.0.0-3.0.0joomlart.com S5 Register module for Joomla
- CVE-2023-40657Extension - artio.net - Reflected XSS in Joomdoc component for Joomla 1.0.0-4.0.5artio.net Joomdoc component for Joomla
- CVE-2023-40655Extension - mooj.org - Reflected XSS in Proforms Basic component for Joomla <= 1.6.0mooj.org Proforms Basic component for Joomla
- CVE-2023-46750Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro.Apache Software Foundation org.apache.shiro:shiro-web · org…
- CVE-2023-25644Denial of Service Vulnerability in Some ZTE Mobile Internet ProductsZTE MC801A · ZTE MC801A1
- CVE-2023-1904In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of…Octopus Deploy Octopus Server
- CVE-2023-25642Two Vulnerabilities in Some ZTE Mobile Internet ProductsZTE MC801A · ZTE MC801A1
- CVE-2023-25651SQL Injection Vulnerability in Some ZTE Mobile Internet ProductsZTE Mobile Internet Products
- CVE-2023-25650Arbitrary File Download Vulnerability in ZTE ZXCLOUD iRAIZTE ZXCLOUD iRAI
- CVE-2023-25648Weak Folder Permission Vulnerability in ZTE ZXCLOUD iRAIZTE ZXCLOUD iRAI
- CVE-2023-6407A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary…Schneider Electric Easy UPS Online Monitoring Software
- CVE-2023-5630A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted…Schneider Electric Trio Q-Series Ethernet Data Radio · S… +1
- CVE-2023-45184IBM i Access Client SolutionsIBM i Access Client Solutions
- CVE-2022-43843IBM Spectrum Scale information disclosureIBM Spectrum Scale
- CVE-2023-31546Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature.
- CVE-2023-45894The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a…
- CVE-2023-46348SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive…
- CVE-2023-47261Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request…
- CVE-2023-48049A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website_search_blog) v.
- CVE-2023-48084Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool.
- CVE-2023-48925SQL injection vulnerability in Buy Addons bavideotab before version 1.0.6, allows attackers to escalate privileges and obtain sensitive…
- CVE-2023-49933An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x.
- CVE-2023-49934An issue was discovered in SchedMD Slurm 23.11.x.
- CVE-2023-49935An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x.
- CVE-2023-49936An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x.
- CVE-2023-49937An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x.
- CVE-2023-49938An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x.
- CVE-2023-50011PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field.
- CVE-2023-50017Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup
- CVE-2023-50073EmpireCMS v7.5 was discovered to contain a SQL injection vulnerability via the ftppassword parameter at SetEnews.php.
- CVE-2023-50100JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing.com.jfinal:jfinal
- CVE-2023-50101JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing.com.jfinal:jfinal
- CVE-2023-50102JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS).com.jfinal:jfinal
- CVE-2023-50137JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office.com.jfinal:jfinal
- CVE-2023-50471cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_InsertItemInArray at cJSON.c.
- CVE-2023-50472cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON_SetValuestring at cJSON.c.
- CVE-2023-50563Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS_Function.php.
- CVE-2023-50565A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web…
- CVE-2023-50566A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via…