CVEs published December 11, 2023
39 CVEs were published on December 11, 2023: 4 critical, 7 high.
- Published
- 39
- Critical
- 4
- High
- 7
- Medium
- 11
- Low
- 1
- Unrated
- 16
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- Google Android
- 4
- EmbedPress
- 2
- mindsdb
- 2
- The Document Foundation LibreOffice
- 2
- afichet openexr-viewer
- 1
- Campcodes Web-Based Student Clearance System
- 1
- Contact Form Email
- 1
- EazyDocs
- 1
- Eclipse Foundation Eclipse Memory Analyzer
- 1
- Enalean tuleap
- 1
Critical 4
- CVE-2023-50245OpenEXR-viewer memory overflow vulnerabilityafichet openexr-viewer
- CVE-2023-48425U-Boot vulnerability resulting in persistent Code Execution Google Android
- CVE-2023-48424U-Boot shell vulnerability resulting in Privilege escalation in a production deviceGoogle Android
- CVE-2023-49417TOTOLink A7000R V9.1.0u.6115_B20201022 has a stack overflow vulnerability via setOpModeCfg.
High 7
- CVE-2023-49803@koa/cors has overly permissive origin policykoajs cors · @koa/cors
- CVE-2023-6538System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products is susceptible to unintended information disclosure via unprivileged access to SMU configuration backup data.Hitachi Vantara System Management Unit
- CVE-2023-6186Link targets allow arbitrary script executionThe Document Foundation LibreOffice
- CVE-2023-6185Improper input validation enabling arbitrary Gstreamer pipeline injectionThe Document Foundation LibreOffice
- CVE-2023-5500Frauscher: FDS102 for FAdC/FAdCi remote code execution vulnerabilityFrauscher FDS102 for FAdC/FAdCi
- CVE-2021-3187An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7.
- CVE-2023-49355decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " []-1.2e-1111111111" input.
Medium, low and unrated 28
- CVE-2023-49805Uptime Kuma Missing Origin Validation in WebSocketslouislam uptime-kuma
- CVE-2023-49804Uptime Kuma Password Change Vulnerabilitylouislam uptime-kuma · uptime-kuma
- CVE-2023-45292Captcha verification bypass in github.com/mojocn/base64Captchagithub.com/mojocn/base64Captcha
- CVE-2023-49802MantisBT LinkedCustomFields Cross-site Scripting vulnerabilitymantisbt-plugins LinkedCustomFields
- CVE-2023-49796MindsDB Arbitrary File Write vulnerabilitymindsdb
- CVE-2023-5955Contact Form Email < 1.3.44 - Editor+ Stored Cross-Site ScriptingContact Form Email
- CVE-2023-5749EmbedPress < 3.9.2 - Reflected XSSEmbedPress
- CVE-2023-5757WP Crowdfunding < 2.1.8 - Admin+ Stored XSSWP Crowdfunding
- CVE-2023-5940WP Not Login Hide <= 1.0 - Admin+ Stored XSSWP Not Login Hide
- CVE-2023-5750EmbedPress < 3.9.2 - Reflected XSSEmbedPress
- CVE-2023-6035EazyDocs < 2.3.4 - Subscriber + SQLiEazyDocs
- CVE-2023-5907File Manager < 6.3 - Admin+ Arbitrary OS File/Folder Access + Path TraversalFile Manager
- CVE-2023-49795MindsDB Server-Side Request Forgery vulnerabilitymindsdb
- CVE-2023-48715Tuleap vulnerable to Cross-site Scripting on the edition page of a releaseEnalean tuleap
- CVE-2023-6679Kernel: null pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.cRed Hat Enterprise Linux
- CVE-2023-6194In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) rEclipse Foundation Eclipse Memory Analyzer
- CVE-2023-6671Cross-Site Request Forgery on OPEN JOURNAL SYSTEMSOPEN JOURNAL SYSTEMS
- CVE-2023-6181An oversight in BCB handling of reboot reason that allows for persistent code executionGoogle Android
- CVE-2023-48417Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity ApplicationGoogle Android
- CVE-2023-6659Campcodes Web-Based Student Clearance System login.php sql injectionCampcodes Web-Based Student Clearance System
- CVE-2020-12613An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6.
- CVE-2023-36646Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges to
- CVE-2023-49418TOTOLink A7000R V9.1.0u.6115_B20201022has a stack overflow vulnerability via setIpPortFilterRules.
- CVE-2023-49488A cross-site scripting (XSS) vulnerability in Openfiler ESA v2.99.1 allows attackers to execute arbitrary web scripts or HTML via injecting
- CVE-2023-49490XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php.
- CVE-2023-49494DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select_media_post_wangEdi
- CVE-2023-49964An issue was discovered in Hyland Alfresco Community Edition through 7.2.0.
- CVE-2023-50465A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated use