CVEs published December 8, 2023
80 CVEs were published on December 8, 2023: 0 critical, 15 high. 1 is now in CISA KEV.
- Published
- 80
- Critical
- 0
- High
- 15
- Medium
- 18
- Low
- 6
- Unrated
- 41
- Now in CISA KEV
- 1
- Fix available
- 24
Most affected products
- Google Android
- 23
- @evershop/evershop
- 7
- SourceCodester Simple Student Attendance System
- 4
- com.jfinal:jfinal
- 3
- QNAP Systems QTS · QNAP Systems QuTS hero
- 3
- Tongda OA
- 3
- Typecho
- 3
- CollaboraOnline online
- 2
- johannschopplich nuxt-api-party · nuxt-api-party
- 2
- microweber/microweber
- 2
High 15
- CVE-2023-49799Server-Side Request Forgery in nuxt-api-partyjohannschopplich nuxt-api-party · nuxt-api-party
- CVE-2023-49800Denial of service by abusing `fetchOptions.retry` in nuxt-api-partyjohannschopplich nuxt-api-party · nuxt-api-party
- CVE-2023-6337Vault May be Vulnerable to a Denial of Service Through Memory Exhaustion When Handling Large HTTP RequestsHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-48311Any image allowed by defaultjupyterhub dockerspawner · dockerspawner
- CVE-2023-49782Cross-Site-Scripting vulnerability in error message passing in richdocumentscodeCollaboraOnline online
- CVE-2023-49788Improper handling of browser-side provided input in richdocuments path handlingCollaboraOnline online
- CVE-2023-6610Kernel: oob access in smb2_dump_detailLinux kernel · Red Hat Enterprise Linux +2
- CVE-2023-6606Kernel: out-of-bounds read vulnerability in smbcalcsizeRed Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- CVE-2023-47565Legacy VioStor NVRQNAP Systems VioStor NVR
- CVE-2023-48421In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/platform/pixel/pixel_gpu_slc.c, there is a possiblGoogle Android
- CVE-2023-48398In ProtocolNetAcBarringInfo::ProtocolNetAcBarringInfo() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bGoogle Android
- CVE-2023-6245Infinite decoding loop through specially crafted payloadInternet Computer Candid · candid
- CVE-2023-32460 Dell PowerEdge BIOS contains an improper privilege management security vulnerability.Dell PowerEdge Platform
- CVE-2023-26158All versions of the package mockjs are vulnerable to Prototype Pollution via the Util.extend function due to missing check if the attribute mockjs
- CVE-2023-43743A SQL injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 171
Medium, low and unrated 65
- CVE-2023-6560Kernel: io_uring out of boundary memory access in __io_uaddr_map()kernel · Red Hat Enterprise Linux +1
- CVE-2023-49798Duplicated execution of subcalls in OpenZeppelin Contractsopenzeppelin-contracts · @openzeppelin/contracts +1
- CVE-2023-34320arm: Guests can trigger a deadlock on Cortex-A77Xen
- CVE-2023-6507Groups not dropped before running subprocess when using empty 'extra_groups' parameterPython Software Foundation CPython
- CVE-2023-6622Kernel: null pointer dereference vulnerability in nft_dynset_init()Red Hat Enterprise Linux
- CVE-2023-6619SourceCodester Simple Student Attendance System class_form.php sql injectionSourceCodester Simple Student Attendance System
- CVE-2023-6618SourceCodester Simple Student Attendance System index.php file inclusionSourceCodester Simple Student Attendance System
- CVE-2023-6617SourceCodester Simple Student Attendance System attendance.php sql injectionSourceCodester Simple Student Attendance System
- CVE-2023-6616SourceCodester Simple Student Attendance System index.php cross site scriptingSourceCodester Simple Student Attendance System
- CVE-2023-6615Typecho manage-users.php information disclosureTypecho
- CVE-2023-32968QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-23372QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-32975QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-6614Typecho Page manage-pages.php backdoorTypecho
- CVE-2023-48423In dhcp4_SetPDNAddress of dhcp4_Main.c, there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2023-48422In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-48420there is a possible use after free due to a race condition.Google Android
- CVE-2023-48416In multiple locations, there is a possible null dereference due to a missing null check.Google Android
- CVE-2023-48415In Init of protocolembmsadapter.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-48414In the Pixel Camera Driver, there is a possible use after free due to a logic error in the code.Google Android
- CVE-2023-48413In Init of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-48412In private_handle_t of mali_gralloc_buffer.h, there is a possible information leak due to a logic error in the code.Google Android
- CVE-2023-48411In SignalStrengthAdapter::FillGsmSignalStrength() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing boundsGoogle Android
- CVE-2023-48410In cd_ParseMsg of cd_codec.c, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-48409In gpu_pixel_handle_buffer_liveness_update_ioctl of private/google-modules/gpu/mali_kbase/mali_kbase_core_linux.c, there is a possible out oGoogle Android
- CVE-2023-48408In ProtocolNetSimFileInfoAdapter() of protocolnetadapter.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-48407there is a possible DCK won't be deleted after factory reset due to a logic error in the code.Google Android
- CVE-2023-48406there is a possible permanent DoS or way for the modem to boot unverified firmware due to a logic error in the code.Google Android
- CVE-2023-48405there is a possible way for the secure world to write to NS memory due to a logic error in the code.Google Android
- CVE-2023-48404In ProtocolMiscCarrierConfigSimInfoIndAdapter of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds cheGoogle Android
- CVE-2023-48403In sms_DecodeCodedTpMsg of sms_PduCodec.c, there is a possible out of bounds read due to a heap buffer overflow.Google Android
- CVE-2023-48402In ppcfw_enable of ppcfw.c, there is a possible EoP due to a missing permission check.Google Android
- CVE-2023-48401In GetSizeOfEenlRecords of protocoladapter.cpp, there is a possible out of bounds read due to an incorrect bounds check.Google Android
- CVE-2023-48399In ProtocolMiscATCommandAdapter::Init() of protocolmiscadapter.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-48397In Init of protocolcalladapter.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-6613Typecho Logo options-theme.php cross site scriptingTypecho
- CVE-2023-6612Totolink X5000R cstecgi.cgi setWizardCfg os command injectionTotolink X5000R
- CVE-2023-6611Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-6609osCommerce all-products cross site scriptingosCommerce
- CVE-2023-6608Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-6146Stored XSS Vulnerability in QualysGuard VM/PC Qualysguard
- CVE-2023-6607Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-6599Missing Standardized Error Handling Mechanism in microweber/microwebermicroweber/microweber
- CVE-2023-43305An issue in studio kent mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access
- CVE-2023-43742An authentication bypass in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 patch 17161 an
- CVE-2023-43744An OS command injection vulnerability in Zultys MX-SE, MX-SE II, MX-E, MX-Virtual, MX250, and MX30 with firmware versions prior to 17.0.10 p
- CVE-2023-45866Bluetooth HID Hosts in BlueZ may permit an unauthenticated Peripheral role HID Device to initiate and establish an encrypted connection, and
- CVE-2023-46157File-Manager in MGT CloudPanel 2.0.0 through 2.3.2 allows the lowest privilege user to achieve OS command injection by changing file ownersh
- CVE-2023-46493Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via @evershop/evershop
- CVE-2023-46494Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via@evershop/evershop
- CVE-2023-46495Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via@evershop/evershop
- CVE-2023-46496Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via @evershop/evershop
- CVE-2023-46497Directory Traversal vulnerability in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information via @evershop/evershop
- CVE-2023-46498An issue in EverShop NPM versions before v.1.0.0-rc.8 allows a remote attacker to obtain sensitive information and execute arbitrary code vi@evershop/evershop
- CVE-2023-46499Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via@evershop/evershop
- CVE-2023-48122An issue in microweber v.2.0.1 and fixed in v.2.0.4 allows a remote attacker to obtain sensitive information via the HTTP GET method.microweber/microweber
- CVE-2023-48928Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Open Redirect.
- CVE-2023-48929Franklin Fueling Systems System Sentinel AnyWare (SSA) version 1.6.24.492 is vulnerable to Session Fixation.
- CVE-2023-49007In Netgear Orbi RBR750 firmware before V7.2.6.21, there is a stack-based buffer overflow in /usr/sbin/httpd.
- CVE-2023-49443DoraCMS v2.1.8 was discovered to re-use the same code for verification of valid usernames and passwords.
- CVE-2023-49444An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image fil
- CVE-2023-49484Dreamer CMS v4.1.3 was discovered to contain a cross-site scripting (XSS) vulnerability in the article management department.
- CVE-2023-49485JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the column management department.com.jfinal:jfinal
- CVE-2023-49486JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the model management department.com.jfinal:jfinal
- CVE-2023-49487JFinalCMS v5.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability in the navigation management department.com.jfinal:jfinal