# CVEs published 2023-12-06

54 CVEs were published on December 6, 2023: 4 critical, 9 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-49096](https://cve.now/CVE-2023-49096.md): Argument Injection in FFmpeg codec parameters in Jellyfin (CVSS 7.7, jellyfin)
- [CVE-2023-6393](https://cve.now/CVE-2023-6393.md): Quarkus: potential invalid reuse of context when @cacheresult on a uni is used (CVSS 5.3, Red Hat build of Quarkus · io.quarkus:quarkus-cache)
- [CVE-2023-45285](https://cve.now/CVE-2023-45285.md): Command 'go get' may unexpectedly fallback to insecure git in cmd/go (no CVSS, Go toolchain cmd/go · toolchain)
- [CVE-2023-39326](https://cve.now/CVE-2023-39326.md): Denial of service via chunk extensions in net/http (no CVSS, Go standard library net/http/internal · stdlib)
- [CVE-2023-39538](https://cve.now/CVE-2023-39538.md): Failure when uploading a Logo image file (CVSS 7.5, AMI AptioV)
- [CVE-2023-39539](https://cve.now/CVE-2023-39539.md): Failure when uploading a Logo image file (CVSS 7.5, AMI AptioV)
- [CVE-2023-6288](https://cve.now/CVE-2023-6288.md): Code injection in Remote Desktop Manager 2023.3.9.3 and earlier on macOS allows an attacker to execute code via the DYLIB\_INSERT\_LIBRARIES e (no CVSS, Devolutions Remote Desktop Manager)
- [CVE-2023-32268](https://cve.now/CVE-2023-32268.md): Administrator equivalent Filr user can access proxy administrator credentials (CVSS 7.2, OpenText Filr)
- [CVE-2023-6273](https://cve.now/CVE-2023-6273.md): Permission management vulnerability in the module for disabling Sound Booster. (CVSS 5.3, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-49240](https://cve.now/CVE-2023-49240.md): Unauthorized access vulnerability in the launcher module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-49239](https://cve.now/CVE-2023-49239.md): Unauthorized access vulnerability in the card management module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-49246](https://cve.now/CVE-2023-49246.md): Unauthorized access vulnerability in the card management module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-49245](https://cve.now/CVE-2023-49245.md): Unauthorized access vulnerability in the Huawei Share module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-49244](https://cve.now/CVE-2023-49244.md): Permission management vulnerability in the multi-user module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-49243](https://cve.now/CVE-2023-49243.md): Vulnerability of unauthorized access to email attachments in the email module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-49242](https://cve.now/CVE-2023-49242.md): Free broadcast vulnerability in the running management module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-49241](https://cve.now/CVE-2023-49241.md): API permission control vulnerability in the network management module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-44113](https://cve.now/CVE-2023-44113.md): Vulnerability of missing permission verification for APIs in the Designed for Reliability (DFR) module. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-34439](https://cve.now/CVE-2023-34439.md): Pleasanter 1.3.47.0 and earlier contains a stored cross-site scripting vulnerability. (no CVSS, Implem Pleasanter)
- [CVE-2023-46688](https://cve.now/CVE-2023-46688.md): Open redirect vulnerability in Pleasanter 1.3.47.0 and earlier allows a remote unauthenticated attacker to redirect users to arbitrary web s (no CVSS, Implem Pleasanter)
- [CVE-2023-45210](https://cve.now/CVE-2023-45210.md): Pleasanter 1.3.47.0 and earlier contains an improper access control vulnerability, which may allow a remote authenticated attacker to view t (CVSS 4.3, Implem Pleasanter)
- [CVE-2023-44099](https://cve.now/CVE-2023-44099.md): Vulnerability of data verification errors in the kernel module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-49248](https://cve.now/CVE-2023-49248.md): Vulnerability of unauthorized file access in the Settings app. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-49247](https://cve.now/CVE-2023-49247.md): Permission verification vulnerability in distributed scenarios. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-46773](https://cve.now/CVE-2023-46773.md): Permission management vulnerability in the PMS module. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-6514](https://cve.now/CVE-2023-6514.md): The Bluetooth module of some Huawei Smart Screen products has an identity authentication bypass vulnerability. (CVSS 8.8, Huawei AJMD-370S)
- [CVE-2023-6459](https://cve.now/CVE-2023-6459.md): Public endpoint /metrics of Calls plugin reveals channel IDs (CVSS 5.3, Mattermost · github.com/mattermost/mattermost-server/v6 +1)
- [CVE-2023-6458](https://cve.now/CVE-2023-6458.md): Client side path traversal due to lack of route parameters validation (CVSS 7.1, Mattermost · github.com/mattermost/mattermost-server/v6 +2)
- [CVE-2023-49897](https://cve.now/CVE-2023-49897.md): An OS command injection vulnerability exists in AE1021PE firmware version 2.0.9 and earlier and AE1021 firmware version 2.0.9 and earlier. (CVSS 8.8, KEV, FXC AE1021PE · FXC AE1021)
- [CVE-2023-2861](https://cve.now/CVE-2023-2861.md): Qemu: 9pfs: improper access control on special files (CVSS 6.0, qemu)
- [CVE-2023-22522](https://cve.now/CVE-2023-22522.md): This Template Injection vulnerability allows an authenticated attacker, including one with anonymous access, to inject unsafe user input int (CVSS 9.0, Atlassian Confluence Data Center · Atlassian Confluence Ser…)
- [CVE-2023-26154](https://cve.now/CVE-2023-26154.md): Versions of the package pubnub before 7.4.0; all versions of the package com.pubnub:pubnub; versions of the package pubnub before 6.19.0; al (CVSS 5.9, pubnub · com.pubnub:pubnub +9)
- [CVE-2023-22523](https://cve.now/CVE-2023-22523.md): This vulnerability, if exploited, allows an attacker to perform privileged RCE (Remote Code Execution) on machines with the Assets Discovery (CVSS 9.8, Atlassian Assets Discovery Cloud · Atlassian Assets Discove…)
- [CVE-2023-22524](https://cve.now/CVE-2023-22524.md): Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. (CVSS 9.6, Atlassian Companion for Mac)
- [CVE-2023-6527](https://cve.now/CVE-2023-6527.md): Email Subscription Popup \<= 1.2.18 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 Email Subscription Popup)
- [CVE-2023-41268](https://cve.now/CVE-2023-41268.md): Possible stack overflow due to insufficient input validation (CVSS 5.3, Samsung Open Source Escargot)
- [CVE-2023-40053](https://cve.now/CVE-2023-40053.md): HTML injection Vulnerability in Serv-U 15.4 (CVSS 5.0, SolarWinds Serv-U)
- [CVE-2023-6512](https://cve.now/CVE-2023-6512.md): Inappropriate implementation in Web Browser UI in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially spoof the co (CVSS 6.5, Google Chrome)
- [CVE-2023-6511](https://cve.now/CVE-2023-6511.md): Inappropriate implementation in Autofill in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to bypass Autofill restrictions v (no CVSS, Google Chrome)
- [CVE-2023-6510](https://cve.now/CVE-2023-6510.md): Use after free in Media Capture in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in specific (no CVSS, Google Chrome)
- [CVE-2023-6509](https://cve.now/CVE-2023-6509.md): Use after free in Side Panel Search in Google Chrome prior to 120.0.6099.62 allowed a remote attacker who convinced a user to engage in spec (no CVSS, Google Chrome)
- [CVE-2023-6508](https://cve.now/CVE-2023-6508.md): Use after free in Media Stream in Google Chrome prior to 120.0.6099.62 allowed a remote attacker to potentially exploit heap corruption via (no CVSS, Google Chrome)
- [CVE-2021-27795](https://cve.now/CVE-2021-27795.md): License forgery in Brocade Fabric OS (FOS) hardware platforms running any version of Brocade Fabric OS software, (CVSS 6.4, Brocade Switches)
- [CVE-2023-28875](https://cve.now/CVE-2023-28875.md): A Stored XSS issue in shared files download terms in Filerun Update 20220202 allows attackers to inject JavaScript code that is executed whe (no CVSS)
- [CVE-2023-28876](https://cve.now/CVE-2023-28876.md): A Broken Access Control issue in comments to uploaded files in Filerun through Update 20220202 allows attackers to delete comments on files (no CVSS)
- [CVE-2023-36655](https://cve.now/CVE-2023-36655.md): The login REST API in ProLion CryptoSpike 3.0.15P2 (when LDAP or Active Directory is used as the users store) allows a remote blocked user t (CVSS 9.8)
- [CVE-2023-46353](https://cve.now/CVE-2023-46353.md): In the module "Product Tag Icons Pro" (ticons) before 1.8.4 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. (no CVSS)
- [CVE-2023-46354](https://cve.now/CVE-2023-46354.md): In the module "Orders (CSV, Excel) Export PRO" (ordersexport) \< 5.2.0 from MyPrestaModules for PrestaShop, a guest can download personal inf (no CVSS)
- [CVE-2023-46751](https://cve.now/CVE-2023-46751.md): An issue was discovered in the function gdev\_prn\_open\_printer\_seekable() in Artifex Ghostscript through 10.02.0 allows remote attackers to c (no CVSS)
- [CVE-2023-48123](https://cve.now/CVE-2023-48123.md): An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafte (no CVSS)
- [CVE-2023-48849](https://cve.now/CVE-2023-48849.md): Ruijie EG Series Routers version EG\_3.0(1)B11P216 and before allows unauthenticated attackers to remotely execute arbitrary code due to inco (no CVSS)
- [CVE-2023-48859](https://cve.now/CVE-2023-48859.md): TOTOLINK A3002RU version 2.0.0-B20190902.1958 has a post-authentication RCE due to incorrect access control, allows attackers to bypass fron (no CVSS)
- [CVE-2023-48930](https://cve.now/CVE-2023-48930.md): xinhu xinhuoa 2.2.1 contains a File upload vulnerability. (no CVSS)
- [CVE-2023-48940](https://cve.now/CVE-2023-48940.md): A stored cross-site scripting (XSS) vulnerability in /admin.php of DaiCuo v2.5.15 allows attackers to execute arbitrary web scripts or HTML (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.