# CVEs published 2023-12-05

129 CVEs were published on December 5, 2023: 7 critical, 56 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2023-24547](https://cve.now/CVE-2023-24547.md): On Arista MOS configuration of a BGP password will cause the password to be logged in clear text. (CVSS 5.9, Arista Networks MOS)
- [CVE-2023-49283](https://cve.now/CVE-2023-49283.md): Test code in published microsoft-graph-core package exposes phpinfo() (CVSS 5.4, microsoftgraph msgraph-sdk-php-core · microsoft/microsoft-g…)
- [CVE-2023-49282](https://cve.now/CVE-2023-49282.md): Test code in published microsoft-graph package exposes phpinfo() (CVSS 5.4, microsoftgraph msgraph-sdk-php · microsoft/microsoft-graph)
- [CVE-2023-46736](https://cve.now/CVE-2023-46736.md): Server-Side Request Forgery in espocrm (CVSS 5.3, espocrm)
- [CVE-2023-49297](https://cve.now/CVE-2023-49297.md): Unsafe YAML deserialization in PyDrive2 (CVSS 3.3, iterative PyDrive2 · pydrive2)
- [CVE-2023-5970](https://cve.now/CVE-2023-5970.md): Improper authentication in the SMA100 SSL-VPN virtual office portal allows a remote authenticated attacker to create an identical external d (no CVSS, SonicWall SMA100)
- [CVE-2023-44221](https://cve.now/CVE-2023-44221.md): Improper neutralization of special elements in the SMA100 SSL-VPN management interface allows a remote authenticated attacker with administr (CVSS 7.2, KEV, SonicWall SMA100)
- [CVE-2023-6448](https://cve.now/CVE-2023-6448.md): Unitronics VisiLogic uses a default administrative password (CVSS 9.8, KEV, Unitronics VisiLogic)
- [CVE-2023-46674](https://cve.now/CVE-2023-46674.md): Elasticsearch-hadoop Unsafe Deserialization (CVSS 6.0, Elasticsearch-Hadoop · org.elasticsearch:elasticsearch-hado…)
- [CVE-2023-45287](https://cve.now/CVE-2023-45287.md): Before Go 1.20, the RSA based key exchange methods in crypto/tls may exhibit a timing side channel (no CVSS, Go standard library crypto/tls · stdlib)
- [CVE-2023-45085](https://cve.now/CVE-2023-45085.md): When compute hosts are disabled and reenabled, they immediately transition to "ON", not "INIT" (CVSS 3.2, SoftIron HyperCloud)
- [CVE-2023-45084](https://cve.now/CVE-2023-45084.md): Media caddy removal and reinsertion without reboot may cause data loss (CVSS 7.0, SoftIron HyperCloud)
- [CVE-2023-45083](https://cve.now/CVE-2023-45083.md): HyperCloud: "admin" and "serveradmin" users can be deleted (CVSS 4.2, SoftIron HyperCloud)
- [CVE-2023-44298](https://cve.now/CVE-2023-44298.md): Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. (CVSS 3.6, Dell PowerEdge BIOS)
- [CVE-2023-44297](https://cve.now/CVE-2023-44297.md): Dell PowerEdge platforms 16G Intel E5 BIOS and Dell Precision BIOS, version 1.4.4, contain active debug code security vulnerability. (CVSS 7.1, Dell PowerEdge BIOS)
- [CVE-2023-6180](https://cve.now/CVE-2023-6180.md): Resource exhaustion via memory leak in tokio-boring (CVSS 5.3, Cloudflare tokio-boring · tokio-boring)
- [CVE-2023-6357](https://cve.now/CVE-2023-6357.md): OS Command Injection in multiple CODESYS products (CVSS 8.8, CODESYS Control for BeagleBone SL · CODESYS Control for… +9)
- [CVE-2022-24403](https://cve.now/CVE-2022-24403.md): De-anonymization attack in TETRA (CVSS 4.3, ETSI TETRA Standard)
- [CVE-2023-43628](https://cve.now/CVE-2023-43628.md): An integer underflow vulnerability exists in the NTRIP Stream Parsing functionality of GPSd 3.25.1~dev. (CVSS 5.9, GPSd)
- [CVE-2023-45842](https://cve.now/CVE-2023-45842.md): Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622 (CVSS 8.1, Buildroot)
- [CVE-2023-45841](https://cve.now/CVE-2023-45841.md): Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622 (CVSS 8.1, Buildroot)
- [CVE-2023-45840](https://cve.now/CVE-2023-45840.md): Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622 (CVSS 8.1, Buildroot)
- [CVE-2023-45839](https://cve.now/CVE-2023-45839.md): Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622 (CVSS 8.1, Buildroot)
- [CVE-2023-45838](https://cve.now/CVE-2023-45838.md): Multiple data integrity vulnerabilities exist in the package hash checking functionality of Buildroot 2023.08.1 and Buildroot dev commit 622 (CVSS 8.1, Buildroot)
- [CVE-2023-43608](https://cve.now/CVE-2023-43608.md): A data integrity vulnerability exists in the BR\_NO\_CHECK\_HASH\_FOR functionality of Buildroot 2023.08.1 and dev commit 622698d7847. (CVSS 8.1, Buildroot)
- [CVE-2023-41835](https://cve.now/CVE-2023-41835.md): Apache Struts: excessive disk usage (CVSS 7.5, Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2023-49070](https://cve.now/CVE-2023-49070.md): Pre-auth RCE in Apache Ofbiz 18.12.09 due to XML-RPC still present (no CVSS, Apache Software Foundation Apache OFBiz)
- [CVE-2023-6269](https://cve.now/CVE-2023-6269.md): Argument injection vulnerability in Atos Unify OpenScape Session Border Controller, Atos Unify OpenScape Branch and Atos Unify OpenScape BCF (CVSS 10.0, Atos Unify OpenScape Session Border Controller · Atos Un… +1)
- [CVE-2023-5188](https://cve.now/CVE-2023-5188.md): WAGO Improper Input Validation in IEC61850 Server / Telecontrol (CVSS 7.5, WAGO Telecontrol Configurator · WagoAppRTU)
- [CVE-2023-39248](https://cve.now/CVE-2023-39248.md): Dell OS10 Networking Switches running 10.5.2.x and above contain an Uncontrolled Resource Consumption (Denial of Service) vulnerability, wh (CVSS 7.5, Dell Networking OS10)
- [CVE-2023-44295](https://cve.now/CVE-2023-44295.md): Dell PowerScale OneFS versions 8.2.2.x through 9.6.0.x contains an improper control of a resource through its lifetime vulnerability. (CVSS 6.3, Dell PowerScale OneFS)
- [CVE-2023-44288](https://cve.now/CVE-2023-44288.md): Dell PowerScale OneFS, 8.2.2.x through 9.6.0.x, contains an improper control of a resource through its lifetime vulnerability. (CVSS 7.5, Dell PowerScale OneFS)
- [CVE-2023-33107](https://cve.now/CVE-2023-33107.md): Integer Overflow or Wraparound in Graphics Linux (CVSS 8.4, KEV, Qualcomm Snapdragon)
- [CVE-2023-33106](https://cve.now/CVE-2023-33106.md): Use of Out-of-range Pointer Offset in Graphics (CVSS 8.4, KEV, Qualcomm Snapdragon)
- [CVE-2023-33098](https://cve.now/CVE-2023-33098.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33097](https://cve.now/CVE-2023-33097.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33092](https://cve.now/CVE-2023-33092.md): Buffer Copy Without Checking Size of Input in Bluetooth HOST (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-33089](https://cve.now/CVE-2023-33089.md): NULL Pointer Dereference in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33088](https://cve.now/CVE-2023-33088.md): NULL pointer dereference in WLAN Firmware (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-33087](https://cve.now/CVE-2023-33087.md): Buffer Copy without Checking Size of Input (\`Classic Buffer Overflow\`) in Core (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-33083](https://cve.now/CVE-2023-33083.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in WLAN Host (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2023-33082](https://cve.now/CVE-2023-33082.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in WLAN Host (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2023-33081](https://cve.now/CVE-2023-33081.md): Buffer over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33080](https://cve.now/CVE-2023-33080.md): Buffer over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33079](https://cve.now/CVE-2023-33079.md): Use of Out-of-range Pointer Offset in Audio (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-33071](https://cve.now/CVE-2023-33071.md): Improper Access Control in Automotive OS Platform Android (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-33070](https://cve.now/CVE-2023-33070.md): Improper Authentication in Automotive OS (CVSS 7.1, Qualcomm Snapdragon)
- [CVE-2023-33063](https://cve.now/CVE-2023-33063.md): Use After Free in DSP Services (CVSS 7.8, KEV, Qualcomm Snapdragon)
- [CVE-2023-33054](https://cve.now/CVE-2023-33054.md): Improper Authentication in GPS HLOS Driver (CVSS 9.1, Qualcomm Snapdragon)
- [CVE-2023-33053](https://cve.now/CVE-2023-33053.md): Improper Validation of Array Index in Kernel (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-33044](https://cve.now/CVE-2023-33044.md): Reachable Assertion in Data Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33043](https://cve.now/CVE-2023-33043.md): Reachable Assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33042](https://cve.now/CVE-2023-33042.md): Improper Input Validation in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33041](https://cve.now/CVE-2023-33041.md): Reachable assertion in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33024](https://cve.now/CVE-2023-33024.md): Buffer Copy Without Checking Size of Input (\`Classic Buffer Overflow\`) in Radio Interface Layer (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-33022](https://cve.now/CVE-2023-33022.md): Integer Overflow to Buffer Overflow in HLOS (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-33018](https://cve.now/CVE-2023-33018.md): Integer Overflow to Buffer Overflow in User Identity Module (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-33017](https://cve.now/CVE-2023-33017.md): Buffer Copy Without Checking Size of Input in Boot (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28588](https://cve.now/CVE-2023-28588.md): Integer Overflow or Wraparound in Bluetooth Host (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-28587](https://cve.now/CVE-2023-28587.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in BT Controller (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28586](https://cve.now/CVE-2023-28586.md): Improper Restriction of Operation within the Bounds of a Memory Buffer in TZ Secure OS (CVSS 6.0, Qualcomm Snapdragon)
- [CVE-2023-28585](https://cve.now/CVE-2023-28585.md): Integer Overflow to Buffer Overflow in TZ Secure OS (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2023-28580](https://cve.now/CVE-2023-28580.md): Buffer Copy Without Checking Size of Input in WLAN Host (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-28579](https://cve.now/CVE-2023-28579.md): Buffer Copy Without Checking Size of Input in WLAN Host (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-28551](https://cve.now/CVE-2023-28551.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in UTILS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28550](https://cve.now/CVE-2023-28550.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in MPP Performance (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-28546](https://cve.now/CVE-2023-28546.md): Buffer Copy Without Checking Size of Input in SPS Applications (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-22668](https://cve.now/CVE-2023-22668.md): Use After Free in Audio (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-22383](https://cve.now/CVE-2023-22383.md): Use After Free in Camera (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-21634](https://cve.now/CVE-2023-21634.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in Radio Interface Layer (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2023-42563](https://cve.now/CVE-2023-42563.md): Integer overflow vulnerability in landmarkCopyImageToNative of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 Release 1 all (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-42581](https://cve.now/CVE-2023-42581.md): Improper URL validation from InstantPlay deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to ac (CVSS 7.5, Samsung Mobile Galaxy Store)
- [CVE-2023-42580](https://cve.now/CVE-2023-42580.md): Improper URL validation from MCSLaunch deeplink in Galaxy Store prior to version 4.5.64.4 allows attackers to execute JavaScript API to inst (CVSS 7.5, Samsung Mobile Galaxy Store)
- [CVE-2023-42579](https://cve.now/CVE-2023-42579.md): Improper usage of insecure protocol (i.e. (CVSS 6.5, Samsung Mobile Samsung Keyboard)
- [CVE-2023-42578](https://cve.now/CVE-2023-42578.md): Improper handling of insufficient permissions or privileges vulnerability in Samsung Data Store prior to version 5.2.00.7 allows remote atta (CVSS 6.5, Samsung Mobile Samsung Data Store)
- [CVE-2023-42577](https://cve.now/CVE-2023-42577.md): Improper Access Control in Samsung Voice Recorder prior to versions 21.4.15.01 in Android 12 and Android 13, 21.4.50.17 in Android 14 allows (CVSS 6.8, Samsung Mobile Samsung Voice Recorder)
- [CVE-2023-42576](https://cve.now/CVE-2023-42576.md): Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to i (CVSS 5.4, Samsung Mobile Samsung Pass)
- [CVE-2023-42575](https://cve.now/CVE-2023-42575.md): Improper Authentication vulnerability in Samsung Pass prior to version 4.3.00.17 allows physical attackers to bypass authentication due to i (CVSS 5.4, Samsung Mobile Samsung Pass)
- [CVE-2023-42574](https://cve.now/CVE-2023-42574.md): Improper access control vulnerablility in GameHomeCN prior to version 4.2.60.2 allows local attackers to launch arbitrary activity in GameHo (CVSS 5.1, Samsung Mobile GameHomeCN)
- [CVE-2023-42573](https://cve.now/CVE-2023-42573.md): PendingIntent hijacking vulnerability in Search Widget prior to version 3.4 in China models allows local attackers to access data. (CVSS 4.7, Samsung Mobile Search Widget)
- [CVE-2023-42572](https://cve.now/CVE-2023-42572.md): Implicit intent hijacking vulnerability in Samsung Account Web SDK prior to version 1.5.24 allows attacker to get sensitive information. (CVSS 3.3, Samsung Mobile Samsung Account Web SDK)
- [CVE-2023-42571](https://cve.now/CVE-2023-42571.md): Abuse of remote unlock in Find My Mobile prior to version 7.3.13.4 allows physical attacker to unlock the device remotely by resetting the S (CVSS 7.6, Samsung Mobile Find My Mobile)
- [CVE-2023-42570](https://cve.now/CVE-2023-42570.md): Improper access control vulnerability in KnoxCustomManagerService prior to SMR Dec-2023 Release 1 allows attacker to access device SIM PIN. (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2023-42569](https://cve.now/CVE-2023-42569.md): Improper authorization verification vulnerability in AR Emoji prior to SMR Dec-2023 Release 1 allows attackers to read sandbox data of AR Em (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2023-42568](https://cve.now/CVE-2023-42568.md): Improper access control vulnerability in SmartManagerCN prior to SMR Dec-2023 Release 1 allows local attackers to access arbitrary files wit (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2023-42567](https://cve.now/CVE-2023-42567.md): Improper size check vulnerability in softsimd prior to SMR Dec-2023 Release 1 allows stack-based buffer overflow. (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2023-42566](https://cve.now/CVE-2023-42566.md): Out-of-bound write vulnerability in libsavsvc prior to SMR Dec-2023 Release 1 allows local attackers to execute arbitrary code. (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2023-42565](https://cve.now/CVE-2023-42565.md): Improper input validation vulnerability in Smart Clip prior to SMR Dec-2023 Release 1 allows local attackers with shell privilege to execute (CVSS 7.3, Samsung Mobile Devices)
- [CVE-2023-42564](https://cve.now/CVE-2023-42564.md): Improper access control in knoxcustom service prior to SMR Dec-2023 Release 1 allows attacker to send broadcast with system privilege. (CVSS 6.6, Samsung Mobile Devices)
- [CVE-2023-42562](https://cve.now/CVE-2023-42562.md): Integer overflow vulnerability in detectionFindFaceSupportMultiInstance of libFacePreProcessingjni.camera.samsung.so prior to SMR Dec-2023 R (CVSS 6.7, Samsung Mobile Devices)
- [CVE-2023-42561](https://cve.now/CVE-2023-42561.md): Heap out-of-bounds write vulnerability in bootloader prior to SMR Dec-2023 Release 1 allows a physical attacker to execute arbitrary code. (CVSS 7.1, Samsung Mobile Devices)
- [CVE-2023-42560](https://cve.now/CVE-2023-42560.md): Heap out-of-bounds write vulnerability in dec\_mono\_audb of libsavsac.so prior to SMR Dec-2023 Release 1 allows an attacker to execute arbitr (CVSS 7.4, Samsung Mobile Devices)
- [CVE-2023-42559](https://cve.now/CVE-2023-42559.md): Improper exception management vulnerability in Knox Guard prior to SMR Dec-2023 Release 1 allows Knox Guard lock bypass via changing system (CVSS 4.9, Samsung Mobile Devices)
- [CVE-2023-42558](https://cve.now/CVE-2023-42558.md): Out of bounds write vulnerability in HDCP in HAL prior to SMR Dec-2023 Release 1 allows attacker to perform code execution. (CVSS 6.0, Samsung Mobile Devices)
- [CVE-2023-42557](https://cve.now/CVE-2023-42557.md): Out-of-bound write vulnerability in libIfaaCa prior to SMR Dec-2023 Release 1 allows local system attackers to execute arbitrary code. (CVSS 5.6, Samsung Mobile Devices)
- [CVE-2023-42556](https://cve.now/CVE-2023-42556.md): Improper usage of implicit intent in Contacts prior to SMR Dec-2023 Release 1 allows attacker to get sensitive information. (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2023-48698](https://cve.now/CVE-2023-48698.md): Azure RTOS USBX Remote Code Execution Vulnerability (CVSS 6.8, azure-rtos usbx)
- [CVE-2023-48697](https://cve.now/CVE-2023-48697.md): Azure RTOS USBX Remote Code Execution Vulnerability (CVSS 6.4, azure-rtos usbx)
- [CVE-2023-48696](https://cve.now/CVE-2023-48696.md): Azure RTOS USBX Remote Code Execution Vulnerability (CVSS 6.7, azure-rtos usbx)
- [CVE-2023-48695](https://cve.now/CVE-2023-48695.md): Azure RTOS USBX Remote Code Execution Vulnerability (CVSS 7.2, azure-rtos usbx)
- [CVE-2023-48694](https://cve.now/CVE-2023-48694.md): Azure RTOS USBX Remote Code Execution Vulnerability (CVSS 6.8, azure-rtos usbx)
- [CVE-2023-48693](https://cve.now/CVE-2023-48693.md): Azure RTOS ThreadX Remote Code Execution Vulnerability (CVSS 8.7, azure-rtos threadx)
- [CVE-2023-48692](https://cve.now/CVE-2023-48692.md): Azure RTOS NetX Duo Remote Code Execution Vulnerability (CVSS 9.1, azure-rtos netxduo)
- [CVE-2023-48691](https://cve.now/CVE-2023-48691.md): Azure RTOS NetX Duo Remote Code Execution Vulnerability (CVSS 8.1, azure-rtos netxduo)
- [CVE-2023-48316](https://cve.now/CVE-2023-48316.md): Azure RTOS NetX Duo Remote Code Execution Vulnerability (CVSS 9.8, azure-rtos netxduo)
- [CVE-2023-48315](https://cve.now/CVE-2023-48315.md): Azure RTOS NetX Duo Remote Code Execution Vulnerability (CVSS 8.8, azure-rtos netxduo)
- [CVE-2022-47531](https://cve.now/CVE-2022-47531.md): An issue was discovered in Ericsson Evolved Packet Gateway (EPG) versions 3.x before 3.25 and 2.x before 2.16, allows authenticated users to (no CVSS)
- [CVE-2023-37572](https://cve.now/CVE-2023-37572.md): Softing OPC Suite version 5.25 and before has Incorrect Access Control, allows attackers to obtain sensitive information via weak permission (CVSS 7.5)
- [CVE-2023-43472](https://cve.now/CVE-2023-43472.md): An issue in MLFlow versions 2.8.1 and before allows a remote attacker to obtain sensitive information via a crafted request to REST API. (no CVSS, mlflow)
- [CVE-2023-47304](https://cve.now/CVE-2023-47304.md): An issue was discovered in Vonage Box Telephone Adapter VDV23 version VDV21-3.2.11-0.5.1, allows local attackers to bypass UART authenticati (no CVSS)
- [CVE-2023-49372](https://cve.now/CVE-2023-49372.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/save. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49373](https://cve.now/CVE-2023-49373.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via /admin/slide/delete. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49374](https://cve.now/CVE-2023-49374.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/slide/update. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49375](https://cve.now/CVE-2023-49375.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend\_link/update. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49376](https://cve.now/CVE-2023-49376.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/delete. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49377](https://cve.now/CVE-2023-49377.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/update. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49378](https://cve.now/CVE-2023-49378.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/form/save. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49379](https://cve.now/CVE-2023-49379.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the component /admin/friend\_link/save. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49380](https://cve.now/CVE-2023-49380.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/friend\_link/delete. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49381](https://cve.now/CVE-2023-49381.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/update. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49382](https://cve.now/CVE-2023-49382.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/div/delete. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49383](https://cve.now/CVE-2023-49383.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/tag/save. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49395](https://cve.now/CVE-2023-49395.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/update. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49396](https://cve.now/CVE-2023-49396.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/save. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49397](https://cve.now/CVE-2023-49397.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/updateStatus. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49398](https://cve.now/CVE-2023-49398.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/category/delete. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49446](https://cve.now/CVE-2023-49446.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/save. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49447](https://cve.now/CVE-2023-49447.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via /admin/nav/update. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-49448](https://cve.now/CVE-2023-49448.md): JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via admin/nav/delete. (no CVSS, com.jfinal:jfinal)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.