# CVEs published 2023-12-07

140 CVEs were published on December 7, 2023: 13 critical, 19 high. Days are UTC.

- [CVE-2023-5008](https://cve.now/CVE-2023-5008.md): Student Information System v1.0 - Unauthenticated SQL Injection (CVSS 9.8, Kashipara Group Student Information System)
- [CVE-2023-4122](https://cve.now/CVE-2023-4122.md): Student Information System v1.0 - Insecure File Upload (CVSS 9.9, Kashipara Group Student Information System)
- [CVE-2023-5058](https://cve.now/CVE-2023-5058.md): Improper Input Validation in the processing of user-supplied splash screen during system boot in Phoenix SecureCore™ Technology™ 4 potential (no CVSS, Phoenix SecureCore™ Technology™)
- [CVE-2023-6581](https://cve.now/CVE-2023-6581.md): D-Link DAR-7000 workidajax.php sql injection (CVSS 5.5, D-Link DAR-7000)
- [CVE-2023-6580](https://cve.now/CVE-2023-6580.md): D-Link DIR-846 QoS POST deserialization (CVSS 8.8, D-Link DIR-846)
- [CVE-2023-6579](https://cve.now/CVE-2023-6579.md): osCommerce POST Parameter shopping-cart sql injection (CVSS 7.3, osCommerce)
- [CVE-2023-6578](https://cve.now/CVE-2023-6578.md): Software AG WebMethods access control (CVSS 7.3, Software AG WebMethods)
- [CVE-2023-36880](https://cve.now/CVE-2023-36880.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 4.8, Microsoft Edge)
- [CVE-2023-38174](https://cve.now/CVE-2023-38174.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2023-35618](https://cve.now/CVE-2023-35618.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 9.6, Microsoft Edge)
- [CVE-2023-6577](https://cve.now/CVE-2023-6577.md): Byzoro PatrolFlow 2530Pro mailsendview.php path traversal (CVSS 4.3, Byzoro PatrolFlow 2530Pro)
- [CVE-2023-6576](https://cve.now/CVE-2023-6576.md): Byzoro S210 HTTP POST Request uploadfile.php unrestricted upload (CVSS 6.3, Byzoro S210)
- [CVE-2023-6575](https://cve.now/CVE-2023-6575.md): Byzoro S210 HTTP POST Request repair.php sql injection (CVSS 6.3, Byzoro S210)
- [CVE-2023-4486](https://cve.now/CVE-2023-4486.md): Uncontrolled Resource Consumption in Metasys and Facility Explorer (CVSS 7.5, Johnson Controls Metasys NAE55/SNE/SNC · Johnson Controls F…)
- [CVE-2023-6574](https://cve.now/CVE-2023-6574.md): Byzoro Smart S20 HTTP POST Request updateos.php unrestricted upload (CVSS 6.3, Byzoro Smart S20)
- [CVE-2023-6333](https://cve.now/CVE-2023-6333.md): Cross-site Scripting in ControlByWeb Relays (CVSS 7.5, ControlByWeb X-332-24I · ControlByWeb X-301-I +1)
- [CVE-2023-6588](https://cve.now/CVE-2023-6588.md): Offline mode is always enabled, even if permission disallows it, in Devolutions Server data source in Devolutions Workspace 2023.3.2.0 a (no CVSS, Devolutions Workspace)
- [CVE-2023-39171](https://cve.now/CVE-2023-39171.md): SENEC Storage Box V1,V2 and V3 accidentially expose a management interface (CVSS 7.2, SENEC Storage Box)
- [CVE-2023-39169](https://cve.now/CVE-2023-39169.md): SENEC: Storage Box V1,V2 and V3 using default credentials (CVSS 9.8, SENEC Storage Box)
- [CVE-2023-39167](https://cve.now/CVE-2023-39167.md): SENEC: Storage Box V1,V2 and V3 affected by improper access control vulnerability (CVSS 7.5, SENEC Storage Box)
- [CVE-2023-39172](https://cve.now/CVE-2023-39172.md): SENEC: Storage Box V1,V2 and V3 transmitting sensitive data unencrypted (CVSS 9.1, SENEC Storage Box)
- [CVE-2023-45762](https://cve.now/CVE-2023-45762.md): WordPress Responsive Column Widgets Plugin \<= 1.2.7 is vulnerable to Open Redirection (CVSS 4.7, Michael Uno (miunosoft) Responsive Column Widgets)
- [CVE-2023-47548](https://cve.now/CVE-2023-47548.md): WordPress Integrate Google Drive Plugin \<= 1.3.2 is vulnerable to Open Redirection (CVSS 4.7, SoftLab Integrate Google Drive – Browse, Upload, Download,…)
- [CVE-2023-47779](https://cve.now/CVE-2023-47779.md): WordPress Integration for Contact Form 7 and Constant Contact Plugin \<= 1.1.4 is vulnerable to Open Redirection (CVSS 4.7, CRM Perks Integration for Constant Contact and Contact Form…)
- [CVE-2023-48325](https://cve.now/CVE-2023-48325.md): WordPress Landing Page Builder Plugin \<= 1.5.1.5 is vulnerable to Open Redirection (CVSS 4.7, PluginOps Landing Page Builder – Lead Page – Optin Page – S…)
- [CVE-2023-35039](https://cve.now/CVE-2023-35039.md): WordPress Password Reset with Code for WordPress REST API Plugin \<= 0.0.15 is vulnerable to Broken Authentication (CVSS 9.8, Be Devious Web Development Password Reset with Code for Wor…)
- [CVE-2023-35909](https://cve.now/CVE-2023-35909.md): WordPress Ninja Forms Plugin \<= 3.6.25 is vulnerable to Denial of Service Attack (CVSS 5.3, Saturday Drive Ninja Forms Contact Form – The Drag and Drop…)
- [CVE-2022-45362](https://cve.now/CVE-2022-45362.md): WordPress Paytm Payment Gateway Plugin \<= 2.7.0 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 7.2, Paytm Payment Gateway)
- [CVE-2023-41804](https://cve.now/CVE-2023-41804.md): WordPress Starter Templates Plugin \<= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 7.1, Brainstorm Force Starter Templates — Elementor, WordPress &…)
- [CVE-2023-46641](https://cve.now/CVE-2023-46641.md): WordPress 12 Step Meeting List Plugin \<= 3.14.24 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.9, Code for Recovery 12 Step Meeting List)
- [CVE-2023-49746](https://cve.now/CVE-2023-49746.md): WordPress SpeedyCache Plugin \<= 1.1.2 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.9, Softaculous Team SpeedyCache – Cache, Optimization, Perform…)
- [CVE-2023-50164](https://cve.now/CVE-2023-50164.md): Apache Struts: File upload component had a directory traversal vulnerability (critical (no CVSS), Apache Software Foundation Apache Struts · org.apache.strut…)
- [CVE-2023-49225](https://cve.now/CVE-2023-49225.md): A cross-site-scripting vulnerability exists in Ruckus Access Point products (ZoneDirector, SmartZone, and AP Solo). (CVSS 6.1, CommScope ZoneDirector · CommScope SmartZone +35)
- [CVE-2023-6568](https://cve.now/CVE-2023-6568.md): Reflected XSS via Content-Type Header in mlflow/mlflow (CVSS 6.5, mlflow/mlflow · mlflow)
- [CVE-2023-28017](https://cve.now/CVE-2023-28017.md): HCL Connections is vulnerable to cross-site scripting (CVSS 5.4, HCL Software HCL Connections)
- [CVE-2023-5710](https://cve.now/CVE-2023-5710.md): System Dashboard \<= 2.8.7 - Missing Authorization to Information Disclosure (sd\_constants) (CVSS 4.3, qriouslad System Dashboard)
- [CVE-2023-5713](https://cve.now/CVE-2023-5713.md): System Dashboard \<= 2.8.7 - Missing Authorization to Information Disclosure (sd\_option\_value) (CVSS 4.3, qriouslad System Dashboard)
- [CVE-2023-5712](https://cve.now/CVE-2023-5712.md): System Dashboard \<= 2.8.7 - Missing Authorization to Information Disclosure (sd\_global\_value) (CVSS 4.3, qriouslad System Dashboard)
- [CVE-2023-5714](https://cve.now/CVE-2023-5714.md): System Dashboard \<= 2.8.7 - Missing Authorization to Information Disclosure (sd\_db\_specs) (CVSS 4.3, qriouslad System Dashboard)
- [CVE-2023-5761](https://cve.now/CVE-2023-5761.md): The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter (CVSS 9.8, rogierlankhorst Burst Statistics – Privacy-Friendly Analyti…)
- [CVE-2023-5711](https://cve.now/CVE-2023-5711.md): System Dashboard \<= 2.8.8 - Missing Authorization to Information Disclosure (sd\_php\_info) (CVSS 4.3, qriouslad System Dashboard)
- [CVE-2023-46218](https://cve.now/CVE-2023-46218.md): This flaw allows a malicious HTTP server to set "super cookies" in curl that are then passed back to more origins than what is otherwise all (CVSS 6.5, curl)
- [CVE-2023-6566](https://cve.now/CVE-2023-6566.md): Business Logic Errors in microweber/microweber (CVSS 5.9, microweber/microweber)
- [CVE-2023-33411](https://cve.now/CVE-2023-33411.md): A web server in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro X11 (no CVSS)
- [CVE-2023-33412](https://cve.now/CVE-2023-33412.md): The web interface in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation on Supermicro (no CVSS)
- [CVE-2023-33413](https://cve.now/CVE-2023-33413.md): The configuration functionality in the Intelligent Platform Management Interface (IPMI) baseboard management controller (BMC) implementation (no CVSS)
- [CVE-2023-39909](https://cve.now/CVE-2023-39909.md): Ericsson Network Manager before 23.2 mishandles Access Control and thus unauthenticated low-privilege users can access the NCM application. (no CVSS)
- [CVE-2023-40238](https://cve.now/CVE-2023-40238.md): A LogoFAIL issue was discovered in BmpDecoderDxe in Insyde InsydeH2O with kernel 5.2 before 05.28.47, 5.3 before 05.37.47, 5.4 before 05.45. (CVSS 5.5)
- [CVE-2023-40300](https://cve.now/CVE-2023-40300.md): NETSCOUT nGeniusPULSE 3.8 has a Hardcoded Cryptographic Key. (CVSS 9.8)
- [CVE-2023-40301](https://cve.now/CVE-2023-40301.md): NETSCOUT nGeniusPULSE 3.8 has a Command Injection Vulnerability. (CVSS 9.8)
- [CVE-2023-40302](https://cve.now/CVE-2023-40302.md): NETSCOUT nGeniusPULSE 3.8 has Weak File Permissions Vulnerability (no CVSS)
- [CVE-2023-41106](https://cve.now/CVE-2023-41106.md): An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.3. (no CVSS)
- [CVE-2023-41168](https://cve.now/CVE-2023-41168.md): NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 1 of 4). (no CVSS)
- [CVE-2023-41169](https://cve.now/CVE-2023-41169.md): NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 2 of 4). (no CVSS)
- [CVE-2023-41170](https://cve.now/CVE-2023-41170.md): NetScout nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting vulnerability. (no CVSS)
- [CVE-2023-41171](https://cve.now/CVE-2023-41171.md): NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 3 of 4). (no CVSS)
- [CVE-2023-41172](https://cve.now/CVE-2023-41172.md): NetScout nGeniusONE 6.3.4 build 2298 allows a Stored Cross-Site scripting vulnerability (issue 4 of 4). (no CVSS)
- [CVE-2023-41905](https://cve.now/CVE-2023-41905.md): NETSCOUT nGeniusONE 6.3.4 build 2298 allows a Reflected Cross-Site scripting (XSS) vulnerability by an authenticated user. (no CVSS)
- [CVE-2023-41913](https://cve.now/CVE-2023-41913.md): strongSwan before 5.9.12 has a buffer overflow and possible unauthenticated remote code execution via a DH public value that exceeds the int (CVSS 9.8)
- [CVE-2023-43102](https://cve.now/CVE-2023-43102.md): An issue was discovered in Zimbra Collaboration (ZCS) before 10.0.4. (no CVSS)
- [CVE-2023-43103](https://cve.now/CVE-2023-43103.md): An XSS issue was discovered in a web endpoint in Zimbra Collaboration (ZCS) before 10.0.4 via an unsanitized parameter. (no CVSS)
- [CVE-2023-43298](https://cve.now/CVE-2023-43298.md): An issue in SCOL Members Card mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel a (no CVSS)
- [CVE-2023-43299](https://cve.now/CVE-2023-43299.md): An issue in DA BUTCHERS mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access (no CVSS)
- [CVE-2023-43300](https://cve.now/CVE-2023-43300.md): An issue in urban\_project mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel acces (no CVSS)
- [CVE-2023-43301](https://cve.now/CVE-2023-43301.md): An issue in DARTS SHOP MAXIM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel ac (no CVSS)
- [CVE-2023-43302](https://cve.now/CVE-2023-43302.md): An issue in sanTas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access token (no CVSS)
- [CVE-2023-43303](https://cve.now/CVE-2023-43303.md): An issue in craftbeer bar canvas mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channe (no CVSS)
- [CVE-2023-43304](https://cve.now/CVE-2023-43304.md): An issue in PARK DANDAN mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access (CVSS 8.2)
- [CVE-2023-46307](https://cve.now/CVE-2023-46307.md): An issue was discovered in server.js in etcd-browser 87ae63d75260. (CVSS 7.5)
- [CVE-2023-46693](https://cve.now/CVE-2023-46693.md): Cross Site Scripting (XSS) vulnerability in FormaLMS before 4.0.5 allows attackers to run arbitrary code via title parameters. (no CVSS)
- [CVE-2023-46857](https://cve.now/CVE-2023-46857.md): Squidex before 7.9.0 allows XSS via an SVG document to the Upload Assets feature. (no CVSS)
- [CVE-2023-46871](https://cve.now/CVE-2023-46871.md): GPAC version 2.3-DEV-rev602-ged8424300-master in MP4Box contains a memory leak in NewSFDouble scenegraph/vrml\_tools.c:300. (no CVSS)
- [CVE-2023-46916](https://cve.now/CVE-2023-46916.md): Maxima Max Pro Power 1.0 486A devices allow BLE traffic replay. (no CVSS)
- [CVE-2023-46974](https://cve.now/CVE-2023-46974.md): Cross Site Scripting vulnerability in Best Courier Management System v.1.000 allows a remote attacker to execute arbitrary code via a crafte (no CVSS)
- [CVE-2023-47440](https://cve.now/CVE-2023-47440.md): Gladys Assistant v4.27.0 and prior is vulnerable to Directory Traversal. (no CVSS, gladys)
- [CVE-2023-48172](https://cve.now/CVE-2023-48172.md): A Cross Site Scripting (XSS) vulnerability in Shuttle Booking Software 2.0 allows a remote attacker to inject JavaScript via the name, descr (no CVSS)
- [CVE-2023-48205](https://cve.now/CVE-2023-48205.md): Jorani Leave Management System 1.0.2 allows a remote attacker to spoof a Host header associated with password reset emails. (no CVSS)
- [CVE-2023-48206](https://cve.now/CVE-2023-48206.md): A Cross Site Scripting (XSS) vulnerability in GaatiTrack Courier Management System 1.0 allows a remote attacker to inject JavaScript via the (CVSS 6.1)
- [CVE-2023-48207](https://cve.now/CVE-2023-48207.md): Availability Booking Calendar 5.0 allows CSV injection via the unique ID field in the Reservations list component. (no CVSS)
- [CVE-2023-48208](https://cve.now/CVE-2023-48208.md): A Cross Site Scripting vulnerability in Availability Booking Calendar 5.0 allows an attacker to inject JavaScript via the name, plugin\_sms\_a (no CVSS)
- [CVE-2023-48823](https://cve.now/CVE-2023-48823.md): A Blind SQL injection issue in ajax.php in GaatiTrack Courier Management System 1.0 allows an unauthenticated attacker to inject a payload v (no CVSS)
- [CVE-2023-48824](https://cve.now/CVE-2023-48824.md): BoidCMS 2.0.1 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the title, subtitle, footer, or keywords parameter in a (no CVSS)
- [CVE-2023-48825](https://cve.now/CVE-2023-48825.md): Availability Booking Calendar 5.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code. (no CVSS)
- [CVE-2023-48826](https://cve.now/CVE-2023-48826.md): Time Slots Booking Calendar 4.0 is vulnerable to CSV Injection via the unique ID field of the Reservations List. (no CVSS)
- [CVE-2023-48827](https://cve.now/CVE-2023-48827.md): Time Slots Booking Calendar 4.0 is vulnerable to Multiple HTML Injection issues via the name, plugin\_sms\_api\_key, plugin\_sms\_country\_code, c (no CVSS)
- [CVE-2023-48828](https://cve.now/CVE-2023-48828.md): Time Slots Booking Calendar 4.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin\_sms\_api\_key, plugin\_ (no CVSS)
- [CVE-2023-48830](https://cve.now/CVE-2023-48830.md): Shuttle Booking Software 2.0 is vulnerable to CSV Injection in the Languages section via an export. (no CVSS)
- [CVE-2023-48831](https://cve.now/CVE-2023-48831.md): A lack of rate limiting in pjActionAJaxSend in Availability Booking Calendar 5.0 allows attackers to cause resource exhaustion. (CVSS 7.5)
- [CVE-2023-48833](https://cve.now/CVE-2023-48833.md): A lack of rate limiting in pjActionAJaxSend in Time Slots Booking Calendar 4.0 allows attackers to cause resource exhaustion. (no CVSS)
- [CVE-2023-48834](https://cve.now/CVE-2023-48834.md): A lack of rate limiting in pjActionAjaxSend in Car Rental v3.0 allows attackers to cause resource exhaustion. (CVSS 7.5)
- [CVE-2023-48835](https://cve.now/CVE-2023-48835.md): Car Rental Script v3.0 is vulnerable to CSV Injection via a Language \> Labels \> Export action. (no CVSS)
- [CVE-2023-48836](https://cve.now/CVE-2023-48836.md): Car Rental Script 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin\_sms\_api\_key, plugin\_sms\_countr (no CVSS)
- [CVE-2023-48837](https://cve.now/CVE-2023-48837.md): Car Rental Script 3.0 is vulnerable to Multiple HTML Injection issues via SMS API Key or Default Country Code. (no CVSS)
- [CVE-2023-48838](https://cve.now/CVE-2023-48838.md): Appointment Scheduler 3.0 is vulnerable to Multiple HTML Injection issues via the SMS API Key or Default Country Code. (no CVSS)
- [CVE-2023-48839](https://cve.now/CVE-2023-48839.md): Appointment Scheduler 3.0 is vulnerable to Multiple Stored Cross-Site Scripting (XSS) issues via the name, plugin\_sms\_api\_key, plugin\_sms\_co (no CVSS)
- [CVE-2023-48840](https://cve.now/CVE-2023-48840.md): A lack of rate limiting in pjActionAjaxSend in Appointment Scheduler 3.0 allows attackers to cause resource exhaustion. (no CVSS)
- [CVE-2023-48841](https://cve.now/CVE-2023-48841.md): Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language \> Labels \> Export action. (CVSS 8.8)
- [CVE-2023-48860](https://cve.now/CVE-2023-48860.md): TOTOLINK N300RT version 3.2.4-B20180730.0906 has a post-authentication RCE due to incorrect access control, allows attackers can bypass fron (no CVSS)
- [CVE-2023-48861](https://cve.now/CVE-2023-48861.md): DLL hijacking vulnerability in TTplayer version 7.0.2, allows local attackers to escalate privileges and execute arbitrary code via urlmon.d (no CVSS)
- [CVE-2023-48958](https://cve.now/CVE-2023-48958.md): gpac 2.3-DEV-rev617-g671976fcc-master contains memory leaks in gf\_mpd\_resolve\_url media\_tools/mpd.c:4589. (no CVSS)
- [CVE-2023-49402](https://cve.now/CVE-2023-49402.md): Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function localMsg. (no CVSS)
- [CVE-2023-49403](https://cve.now/CVE-2023-49403.md): Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setFixTools. (no CVSS)
- [CVE-2023-49404](https://cve.now/CVE-2023-49404.md): Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formAdvancedSetListSet. (CVSS 9.8)
- [CVE-2023-49405](https://cve.now/CVE-2023-49405.md): Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function UploadCfg. (no CVSS)
- [CVE-2023-49406](https://cve.now/CVE-2023-49406.md): Tenda W30E V16.01.0.12(4843) was discovered to contain a Command Execution vulnerability via the function /goform/telnet. (no CVSS)
- [CVE-2023-49408](https://cve.now/CVE-2023-49408.md): Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the function set\_device\_name. (no CVSS)
- [CVE-2023-49409](https://cve.now/CVE-2023-49409.md): Tenda AX3 V16.03.12.11 was discovered to contain a Command Execution vulnerability via the function /goform/telnet. (no CVSS)
- [CVE-2023-49410](https://cve.now/CVE-2023-49410.md): Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function via the function set\_wan\_status. (no CVSS)
- [CVE-2023-49411](https://cve.now/CVE-2023-49411.md): Tenda W30E V16.01.0.12(4843) contains a stack overflow vulnerability via the function formDeleteMeshNode. (no CVSS)
- [CVE-2023-49424](https://cve.now/CVE-2023-49424.md): Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetVirtualServerCfg. (CVSS 8.8)
- [CVE-2023-49425](https://cve.now/CVE-2023-49425.md): Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the deviceList parameter at /goform/setMacFilterCfg . (no CVSS)
- [CVE-2023-49426](https://cve.now/CVE-2023-49426.md): Tenda AX12 V22.03.01.46 was discovered to contain a stack overflow via the list parameter at /goform/SetStaticRouteCfg. (no CVSS)
- [CVE-2023-49428](https://cve.now/CVE-2023-49428.md): Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName. (CVSS 8.8)
- [CVE-2023-49429](https://cve.now/CVE-2023-49429.md): Tenda AX9 V22.03.01.46 was discovered to contain a SQL command injection vulnerability in the 'setDeviceInfo' feature through the 'mac' para (no CVSS)
- [CVE-2023-49430](https://cve.now/CVE-2023-49430.md): Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetStaticRouteCfg. (no CVSS)
- [CVE-2023-49431](https://cve.now/CVE-2023-49431.md): Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'mac' parameter at /goform/SetOnlineDevName. (no CVSS)
- [CVE-2023-49432](https://cve.now/CVE-2023-49432.md): Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'deviceList' parameter at /goform/setMacFilterCfg. (no CVSS)
- [CVE-2023-49433](https://cve.now/CVE-2023-49433.md): Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetVirtualServerCfg. (no CVSS)
- [CVE-2023-49434](https://cve.now/CVE-2023-49434.md): Tenda AX9 V22.03.01.46 has been found to contain a stack overflow vulnerability in the 'list' parameter at /goform/SetNetControlList. (no CVSS)
- [CVE-2023-49435](https://cve.now/CVE-2023-49435.md): Tenda AX9 V22.03.01.46 is vulnerable to command injection. (no CVSS)
- [CVE-2023-49436](https://cve.now/CVE-2023-49436.md): Tenda AX9 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlList (no CVSS)
- [CVE-2023-49437](https://cve.now/CVE-2023-49437.md): Tenda AX12 V22.03.01.46 has been discovered to contain a command injection vulnerability in the 'list' parameter at /goform/SetNetControlLis (CVSS 9.8)
- [CVE-2023-49460](https://cve.now/CVE-2023-49460.md): libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::decode\_uncompressed\_image. (CVSS 8.8)
- [CVE-2023-49462](https://cve.now/CVE-2023-49462.md): libheif v1.17.5 was discovered to contain a segmentation violation via the component /libheif/exif.cc. (no CVSS)
- [CVE-2023-49463](https://cve.now/CVE-2023-49463.md): libheif v1.17.5 was discovered to contain a segmentation violation via the function find\_exif\_tag at /libheif/exif.cc. (no CVSS)
- [CVE-2023-49464](https://cve.now/CVE-2023-49464.md): libheif v1.17.5 was discovered to contain a segmentation violation via the function UncompressedImageCodec::get\_luma\_bits\_per\_pixel\_from\_con (no CVSS)
- [CVE-2023-49465](https://cve.now/CVE-2023-49465.md): Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive\_spatial\_luma\_vector\_prediction function at mot (no CVSS)
- [CVE-2023-49467](https://cve.now/CVE-2023-49467.md): Libde265 v1.0.14 was discovered to contain a heap-buffer-overflow vulnerability in the derive\_combined\_bipredictive\_merging\_candidates funct (no CVSS)
- [CVE-2023-49468](https://cve.now/CVE-2023-49468.md): Libde265 v1.0.14 was discovered to contain a global buffer overflow vulnerability in the read\_coding\_unit function at slice.cc. (CVSS 8.8)
- [CVE-2023-49492](https://cve.now/CVE-2023-49492.md): DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the imgstick parameter at selectimages. (CVSS 6.1)
- [CVE-2023-49493](https://cve.now/CVE-2023-49493.md): DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the v parameter at selectimages.php. (CVSS 6.1)
- [CVE-2023-49955](https://cve.now/CVE-2023-49955.md): An issue was discovered in Dalmann OCPP.Core before 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. (no CVSS)
- [CVE-2023-49956](https://cve.now/CVE-2023-49956.md): An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. (no CVSS)
- [CVE-2023-49957](https://cve.now/CVE-2023-49957.md): An issue was discovered in Dalmann OCPP.Core before 1.3.0 for OCPP (Open Charge Point Protocol) for electric vehicles. (no CVSS)
- [CVE-2023-49958](https://cve.now/CVE-2023-49958.md): An issue was discovered in Dalmann OCPP.Core through 1.2.0 for OCPP (Open Charge Point Protocol) for electric vehicles. (CVSS 7.5)
- [CVE-2023-49967](https://cve.now/CVE-2023-49967.md): Typecho v1.2.1 was discovered to be vulnerable to an XML Quadratic Blowup attack via the component /index.php/action/xmlrpc. (no CVSS)
- [CVE-2023-49999](https://cve.now/CVE-2023-49999.md): Tenda W30E V16.01.0.12(4843) was discovered to contain a command injection vulnerability via the function setUmountUSBPartition. (no CVSS)
- [CVE-2023-50000](https://cve.now/CVE-2023-50000.md): Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formResetMeshNode. (no CVSS)
- [CVE-2023-50001](https://cve.now/CVE-2023-50001.md): Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formUpgradeMeshOnline. (no CVSS)
- [CVE-2023-50002](https://cve.now/CVE-2023-50002.md): Tenda W30E V16.01.0.12(4843) was discovered to contain a stack overflow via the function formRebootMeshNode. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.