# CVEs published 2023-12-09

24 CVEs were published on December 9, 2023: 1 critical, 3 high. Days are UTC.

- [CVE-2023-6646](https://cve.now/CVE-2023-6646.md): linkding cross site scripting (CVSS 3.5, linkding)
- [CVE-2023-6120](https://cve.now/CVE-2023-6120.md): Welcart e-Commerce \<= 2.9.6 - Authenticated (Administrator+) Directory Traversal (CVSS 4.1, uscnanbu Welcart e-Commerce)
- [CVE-2023-5756](https://cve.now/CVE-2023-5756.md): Digital Publications by Supsystic \<= 1.7.6 - Cross-Site Request Forgery via AJAX action (CVSS 5.4, supsysticcom WordPress Flipbook by Supsystic)
- [CVE-2023-47722](https://cve.now/CVE-2023-47722.md): IBM API Connect information disclosure (CVSS 6.2, IBM API Connect)
- [CVE-2023-28523](https://cve.now/CVE-2023-28523.md): IBM Informix Dynamic Server buffer overflow (CVSS 8.4, IBM Informix Dynamic Server)
- [CVE-2023-28526](https://cve.now/CVE-2023-28526.md): IBM Informix Dynamic Server buffer overflow (CVSS 6.2, IBM Informix Dynamic Server)
- [CVE-2023-28527](https://cve.now/CVE-2023-28527.md): IBM Informix Dynamic Server buffer overflow (CVSS 6.2, IBM Informix Dynamic Server)
- [CVE-2020-25835](https://cve.now/CVE-2020-25835.md): Micro Focus ArcSight Management Center Remote Vulnerability (CVSS 5.9, Micro Focus ArcSight Management Center)
- [CVE-2023-6394](https://cve.now/CVE-2023-6394.md): Quarkus: graphql operations over websockets bypass (CVSS 7.4, Red Hat build of Quarkus · io.quarkus:quarkus-smallrye-grap…)
- [CVE-2023-49797](https://cve.now/CVE-2023-49797.md): Local Privilege Escalation in pyinstaller on Windows (CVSS 8.8, pyinstaller)
- [CVE-2021-46899](https://cve.now/CVE-2021-46899.md): SyncTrayzor 1.1.29 enables CEF (Chromium Embedded Framework) remote debugging, allowing a local attacker to control the application. (no CVSS)
- [CVE-2023-28868](https://cve.now/CVE-2023-28868.md): Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to delete arbitrary files on the operating system by creatin (no CVSS)
- [CVE-2023-28869](https://cve.now/CVE-2023-28869.md): Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers read the contents of arbitrary files on the operating system (no CVSS)
- [CVE-2023-28870](https://cve.now/CVE-2023-28870.md): Insecure File Permissions in Support Assistant in NCP Secure Enterprise Client before 12.22 allow attackers to write to configuration files (no CVSS)
- [CVE-2023-28871](https://cve.now/CVE-2023-28871.md): Support Assistant in NCP Secure Enterprise Client before 12.22 allows attackers to read registry information of the operating system by crea (no CVSS)
- [CVE-2023-28873](https://cve.now/CVE-2023-28873.md): An XSS issue in wiki and discussion pages in Seafile 9.0.6 allows attackers to inject JavaScript into the Markdown editor. (no CVSS)
- [CVE-2023-28874](https://cve.now/CVE-2023-28874.md): The next parameter in the /accounts/login endpoint of Seafile 9.0.6 allows attackers to redirect users to arbitrary sites. (no CVSS)
- [CVE-2023-46932](https://cve.now/CVE-2023-46932.md): Heap Buffer Overflow vulnerability in GPAC version 2.3-DEV-rev617-g671976fcc-master, allows attackers to execute arbitrary code and cause a (CVSS 9.8)
- [CVE-2023-47254](https://cve.now/CVE-2023-47254.md): An OS Command Injection in the CLI interface on DrayTek Vigor167 version 5.2.2, allows remote attackers to execute arbitrary system commands (no CVSS)
- [CVE-2023-47465](https://cve.now/CVE-2023-47465.md): An issue in GPAC v.2.2.1 and before allows a local attacker to cause a denial of service (DoS) via the ctts\_box\_read function of file src/is (no CVSS)
- [CVE-2023-50428](https://cve.now/CVE-2023-50428.md): In Bitcoin Core through 26.0 and Bitcoin Knots before 25.1.knots20231115, datacarrier size limits can be bypassed by obfuscating data as cod (no CVSS)
- [CVE-2023-50429](https://cve.now/CVE-2023-50429.md): IzyBat Orange casiers before 20230803\_1 allows getEnsemble.php ensemble SQL injection. (no CVSS)
- [CVE-2023-50430](https://cve.now/CVE-2023-50430.md): The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol (SDCP) when e (no CVSS)
- [CVE-2023-50431](https://cve.now/CVE-2023-50431.md): sec\_attest\_info in drivers/accel/habanalabs/common/habanalabs\_ioctl.c in the Linux kernel through 6.6.5 allows an information leak to user s (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.