CVEs published December 12, 2023
190 CVEs were published on December 12, 2023: 7 critical, 62 high.
- Published
- 190
- Critical
- 7
- High
- 62
- Medium
- 51
- Low
- 11
- Unrated
- 59
- Now in CISA KEV
- 0
- Fix available
- 109
Most affected products
- Apple macOS
- 21
- Microsoft Windows
- 20
- Mattermost
- 8
- Umbraco-CMS · Umbraco.CMS
- 8
- Siemens Opcenter Execution Foundation · Siemens Opcenter… +3
- 5
- Siemens SINEC INS
- 5
- JTEKT ELECTRONICS GC-A22W-CW · JTEKT ELECTRONICS GC-A24W… +8
- 4
- Microsoft Windows Server
- 4
- Apple iOS and iPadOS
- 2
- Apple iOS and iPadOS · Apple macOS
- 2
Critical 7
- CVE-2023-36019Microsoft Power Platform Connector Spoofing VulnerabilityMicrosoft Power Platform · Microsoft Azure Logic Apps
- CVE-2023-6709Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2023-50424Escalation of Privileges in SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go)SAP_SE github.com/sap/cloud-security-client-go · github.… +3
- CVE-2023-50423Escalation of Privileges in SAP BTP Security Services Integration Library ([Python] cloud-pysec)SAP_SE sap-xssec · sap-xssec
- CVE-2023-50422Escalation of Privileges in SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library)SAP_SE cloud-security-services-integration-library · git… +3
- CVE-2023-49583Escalation of Privileges in SAP BTP Security Services Integration Library ([Node.js] @sap/xssec)SAP_SE @sap/xssec · @sap/xssec
- CVE-2023-43364main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.searchor
High 62
- CVE-2023-3517Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection')Hitachi Vantara Pentaho Data Integration & Analytics
- CVE-2023-5764Ansible: template injectionRed Hat Ansible Automation Platform 2.4 for RHEL · ansible-…
- CVE-2023-5379Undertow: ajp request closes connection exceeding maxrequestsizeRed Hat JBoss Enterprise Application Platform 7.1 EUS f… +10
- CVE-2023-50252php-svg-lib unsafe attributes merge when parsing `use` tagdompdf php-svg-lib
- CVE-2023-48225Laf env causes sensitive information disclosurelabring laf
- CVE-2023-49089Umbraco CMS possible path traversal when creating packages from backofficeUmbraco-CMS · Umbraco.CMS
- CVE-2023-35624Azure Connected Machine Agent Elevation of Privilege VulnerabilityMicrosoft Azure Connected Machine Agent
- CVE-2023-35622Windows DNS Spoofing VulnerabilityMicrosoft Windows Server
- CVE-2023-35621Microsoft Dynamics 365 Finance and Operations Denial of Service VulnerabilityMicrosoft Dynamics 365 for Finance and Operations
- CVE-2023-35634Windows Bluetooth Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-35633Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-35632Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-35631Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-35630Internet Connection Sharing (ICS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-35628Windows MSHTML Platform Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-35644Windows Sysmain Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-35643DHCP Server Service Information Disclosure VulnerabilityMicrosoft Windows Server
- CVE-2023-35641Internet Connection Sharing (ICS) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-35639Microsoft ODBC Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-35638DHCP Server Service Denial of Service VulnerabilityMicrosoft Windows Server
- CVE-2023-36006Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-36005Windows Telephony Server Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36004Windows DPAPI (Data Protection Application Programming Interface) Spoofing VulnerabilityMicrosoft Windows
- CVE-2023-36010Microsoft Defender Denial of Service VulnerabilityMicrosoft Malware Protection Platform
- CVE-2023-21740Windows Media Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-36011Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36020Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-36391Local Security Authority Subsystem Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36696Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-49692A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V7.2.2), RUGGEDCOM RM1224 LTE(4G) NASiemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12
- CVE-2023-49691A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.0), RUGGEDCOM RM1224 LTE(4G) NAM Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12
- CVE-2023-48428A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2).Siemens SINEC INS
- CVE-2023-48427A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2).Siemens SINEC INS
- CVE-2023-46285A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATISiemens Opcenter Execution Foundation · Siemens Opcenter… +3
- CVE-2023-46284A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATISiemens Opcenter Execution Foundation · Siemens Opcenter… +3
- CVE-2023-46283A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATISiemens Opcenter Execution Foundation · Siemens Opcenter… +3
- CVE-2023-46282A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATISiemens Opcenter Execution Foundation · Siemens Opcenter… +3
- CVE-2023-46281A vulnerability has been identified in Opcenter Execution Foundation (All versions < V2407), Opcenter Quality (All versions < V2312), SIMATISiemens Opcenter Execution Foundation · Siemens Opcenter… +3
- CVE-2023-46156Affected devices improperly handle specially crafted packets sent to port 102/tcp.Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +63
- CVE-2023-38380A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl.Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +9
- CVE-2022-47375A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400Siemens SIMATIC PC-Station Plus · Siemens SIMATIC S7-400… +7
- CVE-2022-47374A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400Siemens SIMATIC PC-Station Plus · Siemens SIMATIC S7-400… +7
- CVE-2022-42784A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions >= V8.3), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (AllSiemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14
- CVE-2023-49140Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series.JTEKT ELECTRONICS GC-A22W-CW · JTEKT ELECTRONICS GC-A24W… +8
- CVE-2023-48677Local privilege escalation due to DLL hijacking vulnerability.Acronis Cyber Protect Home Office · Acronis Cyber Protec… +2
- CVE-2023-45316Reflected client side path traversal leading to CSRF in PlaybooksMattermost
- CVE-2023-6542Improper Export of Android Application Components in SAP EMARSYS SDK ANDROIDSAP_SE SAP EMARSYS SDK ANDROID
- CVE-2023-49580Information disclosure in SAP GUI for Windows and SAP GUI for JavaSAP_SE SAP GUI for Windows and SAP GUI for Java
- CVE-2023-42481Improper Access Control vulnerability in SAP Commerce CloudSAP_SE SAP Commerce Cloud
- CVE-2023-42478Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence PlatformSAP_SE Business Objects BI Platform
- CVE-2023-40446The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-42906Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42926Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42908Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42903Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2015-8314The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persisdevise
- CVE-2018-16153An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6.org.opencastproject:opencast-common
- CVE-2020-12614An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6.
- CVE-2023-28465The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to cerca.uhn.hapi.fhir:org.hl7.fhir.core · ca.uhn.hapi.fhir:or… +4
- CVE-2023-41117An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be
- CVE-2023-41119An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be
- CVE-2023-48641Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability.
Medium, low and unrated 121
- CVE-2023-50263Nautobot allows unauthenticated db-file-storage viewsnautobot
- CVE-2023-6710Mod_cluster/mod_proxy_cluster: stored cross site scriptingRed Hat JBoss Core Services for RHEL · Red Hat JBoss Cor… +1
- CVE-2023-50251php-svg-lib possible DoS caused by infinite recursion when parsing SVG documentdompdf php-svg-lib · phenx/php-svg-lib
- CVE-2023-50247h2o QUIC state exhaustion DoSh2o
- CVE-2023-34064Privilege Escalation VulnerabilityVMware Workspace ONE Launcher
- CVE-2023-41337h2o vulnerable to TLS session resumption misdirectionh2o
- CVE-2023-49279Umbraco CMS vulnerable to stored XSS via SVG File UploadUmbraco-CMS · Umbraco.CMS
- CVE-2023-49278Umbraco CMS brute force exploit can be used to collect valid usernamesUmbraco-CMS · Umbraco.CMS
- CVE-2023-49274Umbraco CMS SMTP misconfiguration exposes potential registered user emailUmbraco-CMS · Umbraco.CMS
- CVE-2023-49273Umbraco CMS vulnerable to Privilege Escalation using SpoofingUmbraco-CMS · Umbraco.CMS
- CVE-2023-6687Elastic Agent Insertion of Sensitive Information into Log FileElastic Agent
- CVE-2023-49922Beats Insertion of Sensitive Information into Log FileElastic Beats · github.com/elastic/beats/v7 +1
- CVE-2023-35619Microsoft Outlook for Mac Spoofing VulnerabilityMicrosoft Office LTSC for Mac
- CVE-2023-35636Microsoft Outlook Information Disclosure VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2023-35635Windows Kernel Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-35629Microsoft USBHUB 3.0 Device Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-35642Internet Connection Sharing (ICS) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-36003XAML Diagnostics Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36012DHCP Server Service Information Disclosure VulnerabilityMicrosoft Windows Server
- CVE-2023-35625Azure Machine Learning Compute Instance for SDK Users Information Disclosure VulnerabilityMicrosoft Azure Machine Learning · mltable
- CVE-2023-36009Microsoft Word Information Disclosure VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise
- CVE-2023-20275A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTCisco Adaptive Security Appliance (ASA) Software · Cisco Fi…
- CVE-2023-49923Enterprise Search Insertion of Sensitive Information into Log FileElastic Enterprise Search
- CVE-2023-48313Umbraco contains a DOM-XSSUmbraco-CMS · Umbraco.CMS
- CVE-2023-48227Umbraco CMS Backoffice User can bypass "Publish" restrictionUmbraco-CMS · Umbraco.CMS
- CVE-2023-38694Umbraco CMS vulnerable to possible injection of HTML in an unintended formUmbraco-CMS · Umbraco.CMS
- CVE-2023-4421The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks.Mozilla NSS
- CVE-2023-6593 Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to thDevolutions Remote Desktop Manager
- CVE-2023-6193Unbounded queuing of path validation messages in cloudflare-quicheCloudflare quiche · quiche
- CVE-2023-48431A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2).Siemens SINEC INS
- CVE-2023-48430A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2).Siemens SINEC INS
- CVE-2023-48429A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 2).Siemens SINEC INS
- CVE-2022-46141A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions < V19).Siemens SIMATIC STEP
- CVE-2023-6727Leak Inaccessible Playbook Information via Channel Action IDORMattermost
- CVE-2023-4958Stackrox: missing http security headers allows for clickjacking in web uiRed Hat Advanced Cluster Security
- CVE-2023-4932Reflected Cross-Site Scripting in SAS 9.4SAS Institute SAS Integration Technologies
- CVE-2023-49713Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series.JTEKT ELECTRONICS GC-A22W-CW · JTEKT ELECTRONICS GC-A24W… +8
- CVE-2023-49143Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series.JTEKT ELECTRONICS GC-A22W-CW · JTEKT ELECTRONICS GC-A24W… +8
- CVE-2023-41963Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series.JTEKT ELECTRONICS GC-A22W-CW · JTEKT ELECTRONICS GC-A24W… +8
- CVE-2023-49695OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 and earlier allows a neELECOM CO. WRC-X3000GSN · ELECOM CO. WRC-X3000GS +1
- CVE-2023-6547Playbooks access/modification by removed team memberMattermost
- CVE-2023-49607Playbook plugin crash via missing interface type assertionMattermost
- CVE-2023-49809Todo plugin gets crashed and disabled by memberMattermost
- CVE-2023-46701Inaccessible Post Information Leak via Run Timeline IDORMattermost
- CVE-2023-49874IDOR when updating the tasks of a private playbook runMattermost
- CVE-2023-45847 Playbook Plugin Crash via Run ChecklistMattermost
- CVE-2022-48616A Huawei data communication product has a command injection vulnerability.Huawei AR6000
- CVE-2022-48615An improper access control vulnerability exists in a Huawei datacom product.Huawei AR6000
- CVE-2023-5536A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalateCanonical Ubuntu Server
- CVE-2023-46219When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file curl
- CVE-2023-49587Command Injection vulnerability in SAP Solution ManagerSAP_SE SAP Solution Manager
- CVE-2023-49584Client-Side Desynchronization vulnerability in SAP Fiori LaunchpadSAP_SE SAP Fiori Launchpad
- CVE-2023-49581SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP PlatformSAP_SE SAP NetWeaver Application Server ABAP and ABAP Platf…
- CVE-2023-49578Denial of service (DOS) in SAP Cloud ConnectorSAP_SE SAP Cloud Connector
- CVE-2023-49577Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution)SAP_SE SAP HCM
- CVE-2023-49058Directory Traversal vulnerability in SAP Master Data GovernanceSAP_SE SAP Master Data Governance
- CVE-2023-42479Cross-Site Scripting (XSS) vulnerability in SAP Biller DirectSAP_SE SAP Biller Direct
- CVE-2023-42476Cross Site Scripting vulnerability in SAP BusinessObjects Web IntelligenceSAP_SE SAP BusinessObjects Web Intelligence
- CVE-2023-42891An authentication issue was addressed with improved state management.Apple macOS
- CVE-2023-42901Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42900The issue was addressed with improved checks.Apple macOS
- CVE-2023-42886An out-of-bounds read was addressed with improved bounds checking.Apple macOS
- CVE-2023-42890The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +3
- CVE-2023-42874This issue was addressed with improved state management.Apple macOS
- CVE-2023-42897The issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2023-42907Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42911Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42910Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42909Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42899The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-42905Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42883The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +3
- CVE-2023-42894This issue was addressed with improved redaction of sensitive information.Apple macOS
- CVE-2023-42882The issue was addressed with improved memory handling.Apple macOS
- CVE-2023-42904Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42912Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42932A logic issue was addressed with improved checks.Apple macOS
- CVE-2023-42898The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-42924A logic issue was addressed with improved checks.Apple macOS
- CVE-2023-42919A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-42923This issue was addressed through improved state management.Apple iOS and iPadOS
- CVE-2023-42922This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS
- CVE-2023-42884This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-42902Multiple memory corruption issues were addressed with improved input validation.Apple macOS
- CVE-2023-42914The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2009-4123The jruby-openssl gem before 0.6 for JRuby mishandles SSL certificate validation.jruby-openssl
- CVE-2013-2513The flash_tool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file.flash_tool
- CVE-2015-2179The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments.xaviershay-dm-rails
- CVE-2020-10676In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a nagithub.com/rancher/rancher
- CVE-2020-12612An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6.
- CVE-2020-12615An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6.
- CVE-2020-28369In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the use
- CVE-2022-44543The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted groupin2code/femanager
- CVE-2023-26920fast-xml-parser before 4.1.2 allows __proto__ for Prototype Pollution.fast-xml-parser · org.apache.druid:druid-core
- CVE-2023-28604The fluid_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {consitegeist/fluid-components
- CVE-2023-31048The OPC UA .NET Standard Reference Server before 1.4.371.86.OPCFoundation.NetStandard.Opc.Ua.Core · OPCFoundation.NetSt…
- CVE-2023-36647A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to imp
- CVE-2023-36648Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read pot
- CVE-2023-36649Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to im
- CVE-2023-36650A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux use
- CVE-2023-36651Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consu
- CVE-2023-36652A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to read datab
- CVE-2023-36654Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download
- CVE-2023-41113An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be
- CVE-2023-41114An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be
- CVE-2023-41115An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be
- CVE-2023-41116An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be
- CVE-2023-41118An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be
- CVE-2023-41120An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be
- CVE-2023-41623Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php.
- CVE-2023-46454In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the p
- CVE-2023-46455In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN cli
- CVE-2023-46456In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload fu
- CVE-2023-48642Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability.
- CVE-2023-49563Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v.1.1 allows an attacker to execute arbitrary code via a crafted script within a
- CVE-2023-49990Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c.
- CVE-2023-49991Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c.
- CVE-2023-49992Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c.
- CVE-2023-49993Espeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c.
- CVE-2023-49994Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c.
- CVE-2023-50495NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component _nc_wrap_entry().