CVEs published December 1, 2023
55 CVEs were published on December 1, 2023: 5 critical, 10 high.
- Published
- 55
- Critical
- 5
- High
- 10
- Medium
- 21
- Low
- 7
- Unrated
- 12
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- GitLab
- 9
- IBM InfoSphere Information Server
- 8
- ArslanSoft Education Portal
- 4
- JOYNEXT MIB3 Infotainment Unit
- 2
- octobercms october · october/system
- 2
- SourceCodester User Registration and Login System
- 2
- Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- 1
- Cainor Calendarinho
- 1
- CollaboraOnline online
- 1
- com.ruoyi:ruoyi
- 1
Critical 5
- CVE-2023-44382October CMS safe mode bypass using Twig sandbox escapeoctobercms october · october/system
- CVE-2023-5636Malicious File Upload in ArslanSoft's Education PortalArslanSoft Education Portal
- CVE-2023-5634SQLi in ArslanSoft's Education PortalArslanSoft Education Portal
- CVE-2023-48842D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi.
- CVE-2023-48886A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request.
High 10
- CVE-2023-48314Unescaped passing of the request URL in Collabora OnlineCollaboraOnline online
- CVE-2023-40699IBM InfoSphere Information Server denial of serviceIBM InfoSphere Information Server
- CVE-2023-49277Reflected Cross-site Scripting Vulnerability in dpasteDarrenOfficial dpaste · dpaste
- CVE-2023-42006IBM i information disclosureIBM i
- CVE-2023-45168IBM AIX command executionIBM AIX
- CVE-2023-5637Plaintext Storage of a Password in ArslanSoft's Education PortalArslanSoft Education Portal
- CVE-2023-6461Cross-site Scripting (XSS) - Reflected in viliusle/minipaintviliusle/minipaint
- CVE-2023-5635User Enumeration in ArslanSoft's Education PortalArslanSoft Education Portal
- CVE-2023-5427Mali GPU Kernel Driver allows improper GPU processing operationsArm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1
- CVE-2023-6033Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
Medium, low and unrated 40
- CVE-2023-6463SourceCodester User Registration and Login System add-user.php cross site scriptingSourceCodester User Registration and Login System
- CVE-2023-49281Open Redirect in Login Function of CalendarinhoCainor Calendarinho
- CVE-2023-49276Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kumalouislam uptime-kuma · uptime-kuma
- CVE-2023-46746Authenticated PostHog users vulnerable to SSRFposthog
- CVE-2023-44381October CMS safe mode bypass using Page template injectionoctobercms october · october/system
- CVE-2023-44402ASAR Integrity bypass via filetype confusion in electronelectron
- CVE-2023-6462SourceCodester User Registration and Login System delete-user.php cross site scriptingSourceCodester User Registration and Login System
- CVE-2023-46174IBM InfoSphere Information Server cross-site scriptingIBM InfoSphere Information Server
- CVE-2023-42019IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2023-42022IBM InfoSphere Information Server cross-site scriptingIBM InfoSphere Information Server
- CVE-2023-43021IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2023-42009IBM InfoSphere Information Server cross-site scriptingIBM InfoSphere Information Server
- CVE-2023-43015IBM InfoSphere Information Server cross-site scriptingIBM InfoSphere Information Server
- CVE-2023-38268IBM InfoSphere Information Server cross-site request forgeryIBM InfoSphere Information Server
- CVE-2023-26024IBM Planning Analytics on Cloud Pak for Data information disclosureIBM Planning Analytics on Cloud Pak for Data
- CVE-2023-4518A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a Hitachi Energy Relion670
- CVE-2023-28896Weak encoding for password in UDS servicesJOYNEXT MIB3 Infotainment Unit
- CVE-2023-28895Hard-coded password for access to power controller chip memoryJOYNEXT MIB3 Infotainment Unit
- CVE-2023-6449Contact Form 7 <= 5.8.3 - Authenticated (Editor+) Arbitrary File Uploadrocklobsterinc Contact Form
- CVE-2023-3443Incorrect Authorization in GitLabGitLab
- CVE-2023-3964Incorrect Authorization in GitLabGitLab
- CVE-2023-3949Insertion of Sensitive Information Into Sent Data in GitLabGitLab
- CVE-2023-4317Incorrect Authorization in GitLabGitLab
- CVE-2023-4658Incorrect Authorization in GitLabGitLab
- CVE-2023-4912Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2023-5226Improper Control of Generation of Code ('Code Injection') in GitLabGitLab
- CVE-2023-5995Incorrect Authorization in GitLabGitLab
- CVE-2023-5915A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation.Yokogawa Electric STARDOM
- CVE-2023-43089 Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder.Dell Rugged Control Center
- CVE-2023-43453An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the IP
- CVE-2023-43454An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the hos
- CVE-2023-43455An issue in TOTOLINK X6000R V9.4.0cu.652_B20230116 and V9.4.0cu.852_B20230719 allows a remote attacker to execute arbitrary code via the com
- CVE-2023-45252DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the s
- CVE-2023-45253An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files
- CVE-2023-48016Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter.
- CVE-2023-48801In TOTOLINK X6000R_Firmware V9.4.0cu.852_B20230719, the shttpd file sub_415534 function obtains fields from the front-end, connects them thr
- CVE-2023-48813Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines_report.p
- CVE-2023-48887A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request.org.jupiter-rpc:jupiter-rpc
- CVE-2023-48893SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate
- CVE-2023-49371RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.com.ruoyi:ruoyi