CVEs published December 5, 2023
129 CVEs were published on December 5, 2023: 7 critical, 56 high. 5 are now in CISA KEV.
- Published
- 129
- Critical
- 7
- High
- 56
- Medium
- 36
- Low
- 5
- Unrated
- 25
- Now in CISA KEV
- 5
- Fix available
- 27
Most affected products
- Qualcomm Snapdragon
- 38
- com.jfinal:jfinal
- 19
- Samsung Mobile Devices
- 15
- Buildroot
- 6
- azure-rtos usbx
- 5
- azure-rtos netxduo
- 4
- SoftIron HyperCloud
- 3
- Dell PowerEdge BIOS
- 2
- Dell PowerScale OneFS
- 2
- Samsung Mobile Galaxy Store
- 2
Critical 7
- CVE-2023-6448Unitronics VisiLogic uses a default administrative passwordUnitronics VisiLogic
- CVE-2023-6269Argument injection vulnerability in Atos Unify OpenScape Session Border Controller, Atos Unify OpenScape Branch and Atos Unify OpenScape BCFAtos Unify OpenScape Session Border Controller · Atos Un… +1
- CVE-2023-33083Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HostQualcomm Snapdragon
- CVE-2023-33082Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in WLAN HostQualcomm Snapdragon
- CVE-2023-33054Improper Authentication in GPS HLOS DriverQualcomm Snapdragon
- CVE-2023-48692Azure RTOS NetX Duo Remote Code Execution Vulnerabilityazure-rtos netxduo
- CVE-2023-48316Azure RTOS NetX Duo Remote Code Execution Vulnerabilityazure-rtos netxduo
High 56
- CVE-2023-44221Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administrSonicWall SMA100
- CVE-2023-45084Media caddy removal and reinsertion without reboot may cause data lossSoftIron HyperCloud
- CVE-2023-44297 Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability.Dell PowerEdge BIOS
- CVE-2023-6357OS Command Injection in multiple CODESYS productsCODESYS Control for BeagleBone SL · CODESYS Control for… +9
- CVE-2023-45842Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622Buildroot
- CVE-2023-45841Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622Buildroot
- CVE-2023-45840Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622Buildroot
- CVE-2023-45839Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622Buildroot
- CVE-2023-45838Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622Buildroot
- CVE-2023-43608A data integrity vulnerability exists in the BR_NO_CHECK_HASH_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847.Buildroot
- CVE-2023-41835Apache Struts: excessive disk usageApache Software Foundation Apache Struts · org.apache.strut…
- CVE-2023-5188WAGO Improper Input Validation in IEC61850 Server / TelecontrolWAGO Telecontrol Configurator · WagoAppRTU
- CVE-2023-39248 Dell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption (Denial of Service) vulnerability, whDell Networking OS10
- CVE-2023-44288 Dell PowerScale OneFS, 8.2.2.x through 9.6.0.x, contains an improper control of a resource through its lifetime vulnerability.Dell PowerScale OneFS
- CVE-2023-33107Integer Overflow or Wraparound in Graphics LinuxQualcomm Snapdragon
- CVE-2023-33106Use of Out-of-range Pointer Offset in GraphicsQualcomm Snapdragon
- CVE-2023-33098Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33097Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33092Buffer Copy Without Checking Size of Input in Bluetooth HOSTQualcomm Snapdragon
- CVE-2023-33089NULL Pointer Dereference in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33088NULL pointer dereference in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33087Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in CoreQualcomm Snapdragon
- CVE-2023-33081Buffer over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33080Buffer over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33079Use of Out-of-range Pointer Offset in AudioQualcomm Snapdragon
- CVE-2023-33071Improper Access Control in Automotive OS Platform AndroidQualcomm Snapdragon
- CVE-2023-33070Improper Authentication in Automotive OSQualcomm Snapdragon
- CVE-2023-33063Use After Free in DSP ServicesQualcomm Snapdragon
- CVE-2023-33053Improper Validation of Array Index in KernelQualcomm Snapdragon
- CVE-2023-33044Reachable Assertion in Data ModemQualcomm Snapdragon
- CVE-2023-33043Reachable Assertion in ModemQualcomm Snapdragon
- CVE-2023-33042Improper Input Validation in ModemQualcomm Snapdragon
- CVE-2023-33041Reachable assertion in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33022Integer Overflow to Buffer Overflow in HLOSQualcomm Snapdragon
- CVE-2023-33018Integer Overflow to Buffer Overflow in User Identity ModuleQualcomm Snapdragon
- CVE-2023-33017Buffer Copy Without Checking Size of Input in BootQualcomm Snapdragon
- CVE-2023-28588Integer Overflow or Wraparound in Bluetooth HostQualcomm Snapdragon
- CVE-2023-28587Improper Restriction of Operations within the Bounds of a Memory Buffer in BT ControllerQualcomm Snapdragon
- CVE-2023-28585Integer Overflow to Buffer Overflow in TZ Secure OSQualcomm Snapdragon
- CVE-2023-28551Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILSQualcomm Snapdragon
- CVE-2023-28550Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP PerformanceQualcomm Snapdragon
- CVE-2023-28546Buffer Copy Without Checking Size of Input in SPS ApplicationsQualcomm Snapdragon
- CVE-2023-42581Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to acSamsung Mobile Galaxy Store
- CVE-2023-42580Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to instSamsung Mobile Galaxy Store
- CVE-2023-42571Abuse of remote unlock in Find My Mobile prior to version 7.3.13.4 allows physical attacker to unlock the device remotely by resetting the SSamsung Mobile Find My Mobile
- CVE-2023-42568Improper access control vulnerability in SmartManagerCN prior to SMR Dec-2023 Release 1 allows local attackers to access arbitrary files witSamsung Mobile Devices
- CVE-2023-42567Improper size check vulnerability in softsimd prior to SMR Dec-2023 Release 1 allows stack-based buffer overflow.Samsung Mobile Devices
- CVE-2023-42566Out-of-bound write vulnerability in libsavsvc prior to SMR Dec-2023 Release 1 allows local attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-42565Improper input validation vulnerability in Smart Clip prior to SMR Dec-2023 Release 1 allows local attackers with shell privilege to executeSamsung Mobile Devices
- CVE-2023-42561Heap out-of-bounds write vulnerability in bootloader prior to SMR Dec-2023 Release 1 allows a physical attacker to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-42560Heap out-of-bounds write vulnerability in dec_mono_audb of libsavsac.so prior to SMR Dec-2023 Release 1 allows an attacker to execute arbitrSamsung Mobile Devices
- CVE-2023-48695Azure RTOS USBX Remote Code Execution Vulnerabilityazure-rtos usbx
- CVE-2023-48693Azure RTOS ThreadX Remote Code Execution Vulnerabilityazure-rtos threadx
- CVE-2023-48691Azure RTOS NetX Duo Remote Code Execution Vulnerabilityazure-rtos netxduo
- CVE-2023-48315Azure RTOS NetX Duo Remote Code Execution Vulnerabilityazure-rtos netxduo
- CVE-2023-37572Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permission
Medium, low and unrated 66
- CVE-2023-24547On Arista MOS configuration of a BGP password will cause the password to be logged in clear text.Arista Networks MOS
- CVE-2023-49283Test code in published microsoft-graph-core package exposes phpinfo()microsoftgraph msgraph-sdk-php-core · microsoft/microsoft-g…
- CVE-2023-49282Test code in published microsoft-graph package exposes phpinfo()microsoftgraph msgraph-sdk-php · microsoft/microsoft-graph
- CVE-2023-46736Server-Side Request Forgery in espocrmespocrm
- CVE-2023-49297Unsafe YAML deserialization in PyDrive2iterative PyDrive2 · pydrive2
- CVE-2023-5970Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external dSonicWall SMA100
- CVE-2023-46674Elasticsearch-hadoop Unsafe DeserializationElasticsearch-Hadoop · org.elasticsearch:elasticsearch-hado…
- CVE-2023-45287Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channelGo standard library crypto/tls · stdlib
- CVE-2023-45085When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT"SoftIron HyperCloud
- CVE-2023-45083HyperCloud: "admin" and "serveradmin" users can be deletedSoftIron HyperCloud
- CVE-2023-44298 Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability.Dell PowerEdge BIOS
- CVE-2023-6180Resource exhaustion via memory leak in tokio-boringCloudflare tokio-boring · tokio-boring
- CVE-2022-24403De-anonymization attack in TETRAETSI TETRA Standard
- CVE-2023-43628An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1~dev.GPSd
- CVE-2023-49070Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still presentApache Software Foundation Apache OFBiz
- CVE-2023-44295 Dell PowerScale OneFS versions 8.2.2.x through 9.6.0.x contains an improper control of a resource through its lifetime vulnerability.Dell PowerScale OneFS
- CVE-2023-33024Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in Radio Interface LayerQualcomm Snapdragon
- CVE-2023-28586Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OSQualcomm Snapdragon
- CVE-2023-28580Buffer Copy Without Checking Size of Input in WLAN HostQualcomm Snapdragon
- CVE-2023-28579Buffer Copy Without Checking Size of Input in WLAN HostQualcomm Snapdragon
- CVE-2023-22668Use After Free in AudioQualcomm Snapdragon
- CVE-2023-22383Use After Free in CameraQualcomm Snapdragon
- CVE-2023-21634Improper Restriction of Operations within the Bounds of a Memory Buffer in Radio Interface LayerQualcomm Snapdragon
- CVE-2023-42563Integer overflow vulnerability in landmarkCopyImageToNative of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 allSamsung Mobile Devices
- CVE-2023-42579Improper usage of insecure protocol (i.e.Samsung Mobile Samsung Keyboard
- CVE-2023-42578Improper handling of insufficient permissions or privileges vulnerability in Samsung Data Store prior to version 5.2.00.7 allows remote attaSamsung Mobile Samsung Data Store
- CVE-2023-42577Improper Access Control in Samsung Voice Recorder prior to versions 21.4.15.01 in Android 12 and Android 13, 21.4.50.17 in Android 14 allowsSamsung Mobile Samsung Voice Recorder
- CVE-2023-42576Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to iSamsung Mobile Samsung Pass
- CVE-2023-42575Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to iSamsung Mobile Samsung Pass
- CVE-2023-42574Improper access control vulnerablility in GameHomeCN prior to version 4.2.60.2 allows local attackers to launch arbitrary activity in GameHoSamsung Mobile GameHomeCN
- CVE-2023-42573PendingIntent hijacking vulnerability in Search Widget prior to version 3.4 in China models allows local attackers to access data.Samsung Mobile Search Widget
- CVE-2023-42572Implicit intent hijacking vulnerability in Samsung Account Web SDK prior to version 1.5.24 allows attacker to get sensitive information.Samsung Mobile Samsung Account Web SDK
- CVE-2023-42570Improper access control vulnerability in KnoxCustomManagerService prior to SMR Dec-2023 Release 1 allows attacker to access device SIM PIN.Samsung Mobile Devices
- CVE-2023-42569Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows attackers to read sandbox data of AR EmSamsung Mobile Devices
- CVE-2023-42564Improper access control in knoxcustom service prior to SMR Dec-2023 Release 1 allows attacker to send broadcast with system privilege.Samsung Mobile Devices
- CVE-2023-42562Integer overflow vulnerability in detectionFindFaceSupportMultiInstance of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 RSamsung Mobile Devices
- CVE-2023-42559Improper exception management vulnerability in Knox Guard prior to SMR Dec-2023 Release 1 allows Knox Guard lock bypass via changing system Samsung Mobile Devices
- CVE-2023-42558Out of bounds write vulnerability in HDCP in HAL prior to SMR Dec-2023 Release 1 allows attacker to perform code execution.Samsung Mobile Devices
- CVE-2023-42557Out-of-bound write vulnerability in libIfaaCa prior to SMR Dec-2023 Release 1 allows local system attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-42556Improper usage of implicit intent in Contacts prior to SMR Dec-2023 Release 1 allows attacker to get sensitive information.Samsung Mobile Devices
- CVE-2023-48698Azure RTOS USBX Remote Code Execution Vulnerabilityazure-rtos usbx
- CVE-2023-48697Azure RTOS USBX Remote Code Execution Vulnerabilityazure-rtos usbx
- CVE-2023-48696Azure RTOS USBX Remote Code Execution Vulnerabilityazure-rtos usbx
- CVE-2023-48694Azure RTOS USBX Remote Code Execution Vulnerabilityazure-rtos usbx
- CVE-2022-47531An issue was discovered in Ericsson Evolved Packet Gateway (EPG) versions 3.x before 3.25 and 2.x before 2.16, allows authenticated users to
- CVE-2023-43472An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API.mlflow
- CVE-2023-47304An issue was discovered in Vonage Box Telephone Adapter VDV23 version VDV21-3.2.11-0.5.1, allows local attackers to bypass UART authenticati
- CVE-2023-49372JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save.com.jfinal:jfinal
- CVE-2023-49373JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete.com.jfinal:jfinal
- CVE-2023-49374JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update.com.jfinal:jfinal
- CVE-2023-49375JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/update.com.jfinal:jfinal
- CVE-2023-49376JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete.com.jfinal:jfinal
- CVE-2023-49377JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update.com.jfinal:jfinal
- CVE-2023-49378JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save.com.jfinal:jfinal
- CVE-2023-49379JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend_link/save.com.jfinal:jfinal
- CVE-2023-49380JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend_link/delete.com.jfinal:jfinal
- CVE-2023-49381JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update.com.jfinal:jfinal
- CVE-2023-49382JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete.com.jfinal:jfinal
- CVE-2023-49383JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save.com.jfinal:jfinal
- CVE-2023-49395JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update.com.jfinal:jfinal
- CVE-2023-49396JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save.com.jfinal:jfinal
- CVE-2023-49397JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus.com.jfinal:jfinal
- CVE-2023-49398JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete.com.jfinal:jfinal
- CVE-2023-49446JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save.com.jfinal:jfinal
- CVE-2023-49447JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update.com.jfinal:jfinal
- CVE-2023-49448JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete.com.jfinal:jfinal