CVEs published December 6, 2023
54 CVEs were published on December 6, 2023: 4 critical, 9 high. 1 is now in CISA KEV.
- Published
- 54
- Critical
- 4
- High
- 9
- Medium
- 11
- Low
- 0
- Unrated
- 30
- Now in CISA KEV
- 1
- Fix available
- 15
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 14
- Google Chrome
- 5
- Implem Pleasanter
- 3
- AMI AptioV
- 2
- Atlassian Assets Discovery Cloud · Atlassian Assets Discove…
- 1
- Atlassian Companion for Mac
- 1
- Atlassian Confluence Data Center · Atlassian Confluence Ser…
- 1
- Brocade Switches
- 1
- Devolutions Remote Desktop Manager
- 1
- FXC AE1021PE · FXC AE1021
- 1
Critical 4
- CVE-2023-22522This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input intAtlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2023-22523This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets DiscoveryAtlassian Assets Discovery Cloud · Atlassian Assets Discove…
- CVE-2023-22524Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability.Atlassian Companion for Mac
- CVE-2023-36655The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user t
High 9
- CVE-2023-49096Argument Injection in FFmpeg codec parameters in Jellyfinjellyfin
- CVE-2023-39538Failure when uploading a Logo image fileAMI AptioV
- CVE-2023-39539Failure when uploading a Logo image fileAMI AptioV
- CVE-2023-32268Administrator equivalent Filr user can access proxy administrator credentialsOpenText Filr
- CVE-2023-49246Unauthorized access vulnerability in the card management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-44113Vulnerability of missing permission verification for APIs in the Designed for Reliability (DFR) module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-6514 The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability.Huawei AJMD-370S
- CVE-2023-6458Client side path traversal due to lack of route parameters validationMattermost · github.com/mattermost/mattermost-server/v6 +2
- CVE-2023-49897An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier.FXC AE1021PE · FXC AE1021
Medium, low and unrated 41
- CVE-2023-6393Quarkus: potential invalid reuse of context when @cacheresult on a uni is usedRed Hat build of Quarkus · io.quarkus:quarkus-cache
- CVE-2023-45285Command 'go get' may unexpectedly fallback to insecure git in cmd/goGo toolchain cmd/go · toolchain
- CVE-2023-39326Denial of service via chunk extensions in net/httpGo standard library net/http/internal · stdlib
- CVE-2023-6288Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLIB_INSERT_LIBRARIES eDevolutions Remote Desktop Manager
- CVE-2023-6273Permission management vulnerability in the module for disabling Sound Booster.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-49240Unauthorized access vulnerability in the launcher module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-49239Unauthorized access vulnerability in the card management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-49245Unauthorized access vulnerability in the Huawei Share module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-49244Permission management vulnerability in the multi-user module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-49243Vulnerability of unauthorized access to email attachments in the email module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-49242Free broadcast vulnerability in the running management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-49241API permission control vulnerability in the network management module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-34439Pleasanter 1.3.47.0 and earlier contains a stored cross-site scripting vulnerability.Implem Pleasanter
- CVE-2023-46688Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web sImplem Pleasanter
- CVE-2023-45210Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view tImplem Pleasanter
- CVE-2023-44099Vulnerability of data verification errors in the kernel module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-49248Vulnerability of unauthorized file access in the Settings app.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-49247Permission verification vulnerability in distributed scenarios.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-46773Permission management vulnerability in the PMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-6459Public endpoint /metrics of Calls plugin reveals channel IDsMattermost · github.com/mattermost/mattermost-server/v6 +1
- CVE-2023-2861Qemu: 9pfs: improper access control on special filesqemu
- CVE-2023-26154Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; alpubnub · com.pubnub:pubnub +9
- CVE-2023-6527Email Subscription Popup <= 1.2.18 - Reflected Cross-Site Scriptingnik00726 Email Subscription Popup
- CVE-2023-41268Possible stack overflow due to insufficient input validationSamsung Open Source Escargot
- CVE-2023-40053HTML injection Vulnerability in Serv-U 15.4SolarWinds Serv-U
- CVE-2023-6512Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the coGoogle Chrome
- CVE-2023-6511Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to bypass Autofill restrictions vGoogle Chrome
- CVE-2023-6510Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specificGoogle Chrome
- CVE-2023-6509Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specGoogle Chrome
- CVE-2023-6508Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2021-27795License forgery in Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, Brocade Switches
- CVE-2023-28875A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed whe
- CVE-2023-28876A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files
- CVE-2023-46353In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection.
- CVE-2023-46354In the module "Orders (CSV, Excel) Export PRO" (ordersexport) < 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal inf
- CVE-2023-46751An issue was discovered in the function gdev_prn_open_printer_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to c
- CVE-2023-48123An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafte
- CVE-2023-48849Ruijie EG Series Routers version EG_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to inco
- CVE-2023-48859TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass fron
- CVE-2023-48930xinhu xinhuoa 2.2.1 contains a File upload vulnerability.
- CVE-2023-48940A stored cross-site scripting (XSS) vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML