# CVEs published 2023-12-01

55 CVEs were published on December 1, 2023: 5 critical, 10 high. Days are UTC.

- [CVE-2023-6463](https://cve.now/CVE-2023-6463.md): SourceCodester User Registration and Login System add-user.php cross site scripting (CVSS 3.5, SourceCodester User Registration and Login System)
- [CVE-2023-49281](https://cve.now/CVE-2023-49281.md): Open Redirect in Login Function of Calendarinho (CVSS 4.7, Cainor Calendarinho)
- [CVE-2023-49276](https://cve.now/CVE-2023-49276.md): Attribute Injection leading to XSS(Cross-Site-Scripting) in uptime-kuma (CVSS 6.3, louislam uptime-kuma · uptime-kuma)
- [CVE-2023-48314](https://cve.now/CVE-2023-48314.md): Unescaped passing of the request URL in Collabora Online (CVSS 7.1, CollaboraOnline online)
- [CVE-2023-46746](https://cve.now/CVE-2023-46746.md): Authenticated PostHog users vulnerable to SSRF (CVSS 4.8, posthog)
- [CVE-2023-44381](https://cve.now/CVE-2023-44381.md): October CMS safe mode bypass using Page template injection (CVSS 4.9, octobercms october · october/system)
- [CVE-2023-44382](https://cve.now/CVE-2023-44382.md): October CMS safe mode bypass using Twig sandbox escape (CVSS 9.1, octobercms october · october/system)
- [CVE-2023-44402](https://cve.now/CVE-2023-44402.md): ASAR Integrity bypass via filetype confusion in electron (CVSS 6.1, electron)
- [CVE-2023-6462](https://cve.now/CVE-2023-6462.md): SourceCodester User Registration and Login System delete-user.php cross site scripting (CVSS 3.5, SourceCodester User Registration and Login System)
- [CVE-2023-46174](https://cve.now/CVE-2023-46174.md): IBM InfoSphere Information Server cross-site scripting (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2023-42019](https://cve.now/CVE-2023-42019.md): IBM InfoSphere Information Server information disclosure (CVSS 5.9, IBM InfoSphere Information Server)
- [CVE-2023-40699](https://cve.now/CVE-2023-40699.md): IBM InfoSphere Information Server denial of service (CVSS 7.5, IBM InfoSphere Information Server)
- [CVE-2023-42022](https://cve.now/CVE-2023-42022.md): IBM InfoSphere Information Server cross-site scripting (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2023-43021](https://cve.now/CVE-2023-43021.md): IBM InfoSphere Information Server information disclosure (CVSS 5.3, IBM InfoSphere Information Server)
- [CVE-2023-42009](https://cve.now/CVE-2023-42009.md): IBM InfoSphere Information Server cross-site scripting (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2023-49277](https://cve.now/CVE-2023-49277.md): Reflected Cross-site Scripting Vulnerability in dpaste (CVSS 8.3, DarrenOfficial dpaste · dpaste)
- [CVE-2023-43015](https://cve.now/CVE-2023-43015.md): IBM InfoSphere Information Server cross-site scripting (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2023-38268](https://cve.now/CVE-2023-38268.md): IBM InfoSphere Information Server cross-site request forgery (CVSS 4.3, IBM InfoSphere Information Server)
- [CVE-2023-26024](https://cve.now/CVE-2023-26024.md): IBM Planning Analytics on Cloud Pak for Data information disclosure (CVSS 6.5, IBM Planning Analytics on Cloud Pak for Data)
- [CVE-2023-42006](https://cve.now/CVE-2023-42006.md): IBM i information disclosure (CVSS 8.4, IBM i)
- [CVE-2023-4518](https://cve.now/CVE-2023-4518.md): A vulnerability exists in the input validation of the GOOSE messages where out of range values received and processed by the IED caused a (CVSS 6.5, Hitachi Energy Relion670)
- [CVE-2023-45168](https://cve.now/CVE-2023-45168.md): IBM AIX command execution (CVSS 8.4, IBM AIX)
- [CVE-2023-28896](https://cve.now/CVE-2023-28896.md): Weak encoding for password in UDS services (CVSS 3.3, JOYNEXT MIB3 Infotainment Unit)
- [CVE-2023-28895](https://cve.now/CVE-2023-28895.md): Hard-coded password for access to power controller chip memory (CVSS 3.5, JOYNEXT MIB3 Infotainment Unit)
- [CVE-2023-5636](https://cve.now/CVE-2023-5636.md): Malicious File Upload in ArslanSoft's Education Portal (CVSS 9.8, ArslanSoft Education Portal)
- [CVE-2023-5637](https://cve.now/CVE-2023-5637.md): Plaintext Storage of a Password in ArslanSoft's Education Portal (CVSS 7.5, ArslanSoft Education Portal)
- [CVE-2023-6461](https://cve.now/CVE-2023-6461.md): Cross-site Scripting (XSS) - Reflected in viliusle/minipaint (CVSS 8.6, viliusle/minipaint)
- [CVE-2023-5635](https://cve.now/CVE-2023-5635.md): User Enumeration in ArslanSoft's Education Portal (CVSS 7.5, ArslanSoft Education Portal)
- [CVE-2023-5634](https://cve.now/CVE-2023-5634.md): SQLi in ArslanSoft's Education Portal (CVSS 9.8, ArslanSoft Education Portal)
- [CVE-2023-6449](https://cve.now/CVE-2023-6449.md): Contact Form 7 \<= 5.8.3 - Authenticated (Editor+) Arbitrary File Upload (CVSS 6.6, rocklobsterinc Contact Form)
- [CVE-2023-5427](https://cve.now/CVE-2023-5427.md): Mali GPU Kernel Driver allows improper GPU processing operations (CVSS 7.8, Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1)
- [CVE-2023-3443](https://cve.now/CVE-2023-3443.md): Incorrect Authorization in GitLab (CVSS 3.1, GitLab)
- [CVE-2023-3964](https://cve.now/CVE-2023-3964.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2023-3949](https://cve.now/CVE-2023-3949.md): Insertion of Sensitive Information Into Sent Data in GitLab (CVSS 5.3, GitLab)
- [CVE-2023-4317](https://cve.now/CVE-2023-4317.md): Incorrect Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2023-4658](https://cve.now/CVE-2023-4658.md): Incorrect Authorization in GitLab (CVSS 3.1, GitLab)
- [CVE-2023-4912](https://cve.now/CVE-2023-4912.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 2.6, GitLab)
- [CVE-2023-5226](https://cve.now/CVE-2023-5226.md): Improper Control of Generation of Code ('Code Injection') in GitLab (CVSS 4.8, GitLab)
- [CVE-2023-6033](https://cve.now/CVE-2023-6033.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2023-5995](https://cve.now/CVE-2023-5995.md): Incorrect Authorization in GitLab (CVSS 4.4, GitLab)
- [CVE-2023-5915](https://cve.now/CVE-2023-5915.md): A vulnerability of Uncontrolled Resource Consumption has been identified in STARDOM provided by Yokogawa Electric Corporation. (no CVSS, Yokogawa Electric STARDOM)
- [CVE-2023-43089](https://cve.now/CVE-2023-43089.md): Dell Rugged Control Center, version prior to 4.7, contains insufficient protection for the Policy folder. (CVSS 4.4, Dell Rugged Control Center)
- [CVE-2023-43453](https://cve.now/CVE-2023-43453.md): An issue in TOTOLINK X6000R V9.4.0cu.652\_B20230116 and V9.4.0cu.852\_B20230719 allows a remote attacker to execute arbitrary code via the IP (no CVSS)
- [CVE-2023-43454](https://cve.now/CVE-2023-43454.md): An issue in TOTOLINK X6000R V9.4.0cu.652\_B20230116 and V9.4.0cu.852\_B20230719 allows a remote attacker to execute arbitrary code via the hos (no CVSS)
- [CVE-2023-43455](https://cve.now/CVE-2023-43455.md): An issue in TOTOLINK X6000R V9.4.0cu.652\_B20230116 and V9.4.0cu.852\_B20230719 allows a remote attacker to execute arbitrary code via the com (no CVSS)
- [CVE-2023-45252](https://cve.now/CVE-2023-45252.md): DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the s (no CVSS)
- [CVE-2023-45253](https://cve.now/CVE-2023-45253.md): An issue was discovered in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, allows attackers to manipulate files (no CVSS)
- [CVE-2023-48016](https://cve.now/CVE-2023-48016.md): Restaurant Table Booking System V1.0 is vulnerable to SQL Injection in rtbs/admin/index.php via the username parameter. (no CVSS)
- [CVE-2023-48801](https://cve.now/CVE-2023-48801.md): In TOTOLINK X6000R\_Firmware V9.4.0cu.852\_B20230719, the shttpd file sub\_415534 function obtains fields from the front-end, connects them thr (no CVSS)
- [CVE-2023-48813](https://cve.now/CVE-2023-48813.md): Senayan Library Management Systems (Slims) 9 Bulian v9.6.1 is vulnerable to SQL Injection via admin/modules/reporting/customs/fines\_report.p (no CVSS)
- [CVE-2023-48842](https://cve.now/CVE-2023-48842.md): D-Link Go-RT-AC750 revA\_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi. (CVSS 9.8)
- [CVE-2023-48886](https://cve.now/CVE-2023-48886.md): A deserialization vulnerability in NettyRpc v1.2 allows attackers to execute arbitrary commands via sending a crafted RPC request. (CVSS 9.8)
- [CVE-2023-48887](https://cve.now/CVE-2023-48887.md): A deserialization vulnerability in Jupiter v1.3.1 allows attackers to execute arbitrary commands via sending a crafted RPC request. (no CVSS, org.jupiter-rpc:jupiter-rpc)
- [CVE-2023-48893](https://cve.now/CVE-2023-48893.md): SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff\_act.php SQL Injection via startDate (no CVSS)
- [CVE-2023-49371](https://cve.now/CVE-2023-49371.md): RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit. (no CVSS, com.ruoyi:ruoyi)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.