# CVEs published 2023-12-11

39 CVEs were published on December 11, 2023: 4 critical, 7 high. Days are UTC.

- [CVE-2023-49803](https://cve.now/CVE-2023-49803.md): @koa/cors has overly permissive origin policy (CVSS 8.6, koajs cors · @koa/cors)
- [CVE-2023-50245](https://cve.now/CVE-2023-50245.md): OpenEXR-viewer memory overflow vulnerability (CVSS 9.8, afichet openexr-viewer)
- [CVE-2023-49805](https://cve.now/CVE-2023-49805.md): Uptime Kuma Missing Origin Validation in WebSockets (CVSS 6.0, louislam uptime-kuma)
- [CVE-2023-49804](https://cve.now/CVE-2023-49804.md): Uptime Kuma Password Change Vulnerability (CVSS 6.7, louislam uptime-kuma · uptime-kuma)
- [CVE-2023-45292](https://cve.now/CVE-2023-45292.md): Captcha verification bypass in github.com/mojocn/base64Captcha (no CVSS, github.com/mojocn/base64Captcha)
- [CVE-2023-49802](https://cve.now/CVE-2023-49802.md): MantisBT LinkedCustomFields Cross-site Scripting vulnerability (CVSS 6.7, mantisbt-plugins LinkedCustomFields)
- [CVE-2023-49796](https://cve.now/CVE-2023-49796.md): MindsDB Arbitrary File Write vulnerability (CVSS 5.3, mindsdb)
- [CVE-2023-5955](https://cve.now/CVE-2023-5955.md): Contact Form Email \< 1.3.44 - Editor+ Stored Cross-Site Scripting (CVSS 6.1, Contact Form Email)
- [CVE-2023-5749](https://cve.now/CVE-2023-5749.md): EmbedPress \< 3.9.2 - Reflected XSS (no CVSS, EmbedPress)
- [CVE-2023-5757](https://cve.now/CVE-2023-5757.md): WP Crowdfunding \< 2.1.8 - Admin+ Stored XSS (no CVSS, WP Crowdfunding)
- [CVE-2023-5940](https://cve.now/CVE-2023-5940.md): WP Not Login Hide \<= 1.0 - Admin+ Stored XSS (no CVSS, WP Not Login Hide)
- [CVE-2023-5750](https://cve.now/CVE-2023-5750.md): EmbedPress \< 3.9.2 - Reflected XSS (no CVSS, EmbedPress)
- [CVE-2023-6035](https://cve.now/CVE-2023-6035.md): EazyDocs \< 2.3.4 - Subscriber + SQLi (no CVSS, EazyDocs)
- [CVE-2023-5907](https://cve.now/CVE-2023-5907.md): File Manager \< 6.3 - Admin+ Arbitrary OS File/Folder Access + Path Traversal (CVSS 6.5, File Manager)
- [CVE-2023-49795](https://cve.now/CVE-2023-49795.md): MindsDB Server-Side Request Forgery vulnerability (CVSS 6.5, mindsdb)
- [CVE-2023-48715](https://cve.now/CVE-2023-48715.md): Tuleap vulnerable to Cross-site Scripting on the edition page of a release (CVSS 5.4, Enalean tuleap)
- [CVE-2023-6679](https://cve.now/CVE-2023-6679.md): Kernel: null pointer dereference in dpll\_pin\_parent\_pin\_set() in drivers/dpll/dpll\_netlink.c (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2023-6538](https://cve.now/CVE-2023-6538.md): System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products is susceptible to unintended information disclosure via unprivileged access to SMU configuration backup data. (CVSS 7.6, Hitachi Vantara System Management Unit)
- [CVE-2023-6194](https://cve.now/CVE-2023-6194.md): In Eclipse Memory Analyzer versions 0.7 to 1.14.0, report definition XML files are not filtered to prohibit document type definition (DTD) r (CVSS 2.8, Eclipse Foundation Eclipse Memory Analyzer)
- [CVE-2023-6671](https://cve.now/CVE-2023-6671.md): Cross-Site Request Forgery on OPEN JOURNAL SYSTEMS (CVSS 6.3, OPEN JOURNAL SYSTEMS)
- [CVE-2023-6186](https://cve.now/CVE-2023-6186.md): Link targets allow arbitrary script execution (CVSS 8.3, The Document Foundation LibreOffice)
- [CVE-2023-6185](https://cve.now/CVE-2023-6185.md): Improper input validation enabling arbitrary Gstreamer pipeline injection (CVSS 8.3, The Document Foundation LibreOffice)
- [CVE-2023-5500](https://cve.now/CVE-2023-5500.md): Frauscher: FDS102 for FAdC/FAdCi remote code execution vulnerability (CVSS 8.8, Frauscher FDS102 for FAdC/FAdCi)
- [CVE-2023-6181](https://cve.now/CVE-2023-6181.md): An oversight in BCB handling of reboot reason that allows for persistent code execution (no CVSS, Google Android)
- [CVE-2023-48425](https://cve.now/CVE-2023-48425.md): U-Boot vulnerability resulting in persistent Code Execution (CVSS 9.8, Google Android)
- [CVE-2023-48424](https://cve.now/CVE-2023-48424.md): U-Boot shell vulnerability resulting in Privilege escalation in a production device (CVSS 9.8, Google Android)
- [CVE-2023-48417](https://cve.now/CVE-2023-48417.md): Missing Permission checks resulting in unauthorized access and Manipulation in KeyChainActivity Application (no CVSS, Google Android)
- [CVE-2023-6659](https://cve.now/CVE-2023-6659.md): Campcodes Web-Based Student Clearance System login.php sql injection (CVSS 6.3, Campcodes Web-Based Student Clearance System)
- [CVE-2020-12613](https://cve.now/CVE-2020-12613.md): An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. (no CVSS)
- [CVE-2021-3187](https://cve.now/CVE-2021-3187.md): An issue was discovered in BeyondTrust Privilege Management for Mac before 5.7. (CVSS 8.8)
- [CVE-2023-36646](https://cve.now/CVE-2023-36646.md): Incorrect user role checking in multiple REST API endpoints in ProLion CryptoSpike 3.0.15P2 allows a remote attacker with low privileges to (no CVSS)
- [CVE-2023-49355](https://cve.now/CVE-2023-49355.md): decToString in decNumber/decNumber.c in jq 88f01a7 has a one-byte out-of-bounds write via the " \[\]-1.2e-1111111111" input. (CVSS 7.5)
- [CVE-2023-49417](https://cve.now/CVE-2023-49417.md): TOTOLink A7000R V9.1.0u.6115\_B20201022 has a stack overflow vulnerability via setOpModeCfg. (CVSS 9.8)
- [CVE-2023-49418](https://cve.now/CVE-2023-49418.md): TOTOLink A7000R V9.1.0u.6115\_B20201022has a stack overflow vulnerability via setIpPortFilterRules. (no CVSS)
- [CVE-2023-49488](https://cve.now/CVE-2023-49488.md): A cross-site scripting (XSS) vulnerability in Openfiler ESA v2.99.1 allows attackers to execute arbitrary web scripts or HTML via injecting (no CVSS)
- [CVE-2023-49490](https://cve.now/CVE-2023-49490.md): XunRuiCMS v4.5.5 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin.php. (no CVSS)
- [CVE-2023-49494](https://cve.now/CVE-2023-49494.md): DedeCMS v5.7.111 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component select\_media\_post\_wangEdi (no CVSS)
- [CVE-2023-49964](https://cve.now/CVE-2023-49964.md): An issue was discovered in Hyland Alfresco Community Edition through 7.2.0. (no CVSS)
- [CVE-2023-50465](https://cve.now/CVE-2023-50465.md): A stored cross-site scripting (XSS) vulnerability exists in Monica (aka MonicaHQ) 4.0.0 via an SVG document uploaded by an authenticated use (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.