CVEs published December 9, 2023
24 CVEs were published on December 9, 2023: 1 critical, 3 high.
- Published
- 24
- Critical
- 1
- High
- 3
- Medium
- 6
- Low
- 1
- Unrated
- 13
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- IBM Informix Dynamic Server
- 3
- IBM API Connect
- 1
- linkding
- 1
- Micro Focus ArcSight Management Center
- 1
- pyinstaller
- 1
- Red Hat build of Quarkus · io.quarkus:quarkus-smallrye-grap…
- 1
- supsysticcom WordPress Flipbook by Supsystic
- 1
- uscnanbu Welcart e-Commerce
- 1
Critical 1
High 3
Medium, low and unrated 20
- CVE-2023-6646linkding cross site scriptinglinkding
- CVE-2023-6120Welcart e-Commerce <= 2.9.6 - Authenticated (Administrator+) Directory Traversaluscnanbu Welcart e-Commerce
- CVE-2023-5756Digital Publications by Supsystic <= 1.7.6 - Cross-Site Request Forgery via AJAX actionsupsysticcom WordPress Flipbook by Supsystic
- CVE-2023-47722IBM API Connect information disclosureIBM API Connect
- CVE-2023-28526IBM Informix Dynamic Server buffer overflowIBM Informix Dynamic Server
- CVE-2023-28527IBM Informix Dynamic Server buffer overflowIBM Informix Dynamic Server
- CVE-2020-25835Micro Focus ArcSight Management Center Remote VulnerabilityMicro Focus ArcSight Management Center
- CVE-2021-46899SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the application.
- CVE-2023-28868Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creatin
- CVE-2023-28869Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating system
- CVE-2023-28870Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files
- CVE-2023-28871Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by crea
- CVE-2023-28873An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor.
- CVE-2023-28874The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites.
- CVE-2023-47254An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands
- CVE-2023-47465An issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS) via the ctts_box_read function of file src/is
- CVE-2023-50428In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as cod
- CVE-2023-50429IzyBat Orange casiers before 20230803_1 allows getEnsemble.php ensemble SQL injection.
- CVE-2023-50430The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when e
- CVE-2023-50431sec_attest_info in drivers/accel/habanalabs/common/habanalabs_ioctl.c in the Linux kernel through 6.6.5 allows an information leak to user s