# CVEs published 2023-12-03

9 CVEs were published on December 3, 2023: 0 critical, 1 high. Days are UTC.

- [CVE-2023-40692](https://cve.now/CVE-2023-40692.md): IBM Db2 denial of service (CVSS 5.9, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2022-4957](https://cve.now/CVE-2022-4957.md): librespeed speedtest stats.php cross site scripting (CVSS 3.5, librespeed speedtest)
- [CVE-2023-45178](https://cve.now/CVE-2023-45178.md): IBM Db2 denial of service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2020-36768](https://cve.now/CVE-2020-36768.md): rl-institut NESP2 database.py sql injection (CVSS 7.3, rl-institut NESP2)
- [CVE-2018-25094](https://cve.now/CVE-2018-25094.md): ระบบบัญชีออนไลน์ Online Accounting System image.php path traversal (CVSS 3.5, ระบบบัญชีออนไลน์ Online Accounting System)
- [CVE-2023-49926](https://cve.now/CVE-2023-49926.md): app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget. (no CVSS)
- [CVE-2023-49946](https://cve.now/CVE-2023-49946.md): In Forgejo before 1.20.5-1, certain endpoints do not check whether an object belongs to a repository for which permissions are being checked (no CVSS)
- [CVE-2023-49947](https://cve.now/CVE-2023-49947.md): Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication. (no CVSS)
- [CVE-2023-49948](https://cve.now/CVE-2023-49948.md): Forgejo before 1.20.5-1 allows remote attackers to test for the existence of private user accounts by appending .rss (or another extension) (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.