# CVEs published 2023-12-12

190 CVEs were published on December 12, 2023: 7 critical, 62 high. Days are UTC.

- [CVE-2023-3517](https://cve.now/CVE-2023-3517.md): Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection') (CVSS 8.5, Hitachi Vantara Pentaho Data Integration & Analytics)
- [CVE-2023-50263](https://cve.now/CVE-2023-50263.md): Nautobot allows unauthenticated db-file-storage views (CVSS 3.7, nautobot)
- [CVE-2023-6710](https://cve.now/CVE-2023-6710.md): Mod\_cluster/mod\_proxy\_cluster: stored cross site scripting (CVSS 5.4, Red Hat JBoss Core Services for RHEL · Red Hat JBoss Cor… +1)
- [CVE-2023-5764](https://cve.now/CVE-2023-5764.md): Ansible: template injection (CVSS 7.1, Red Hat Ansible Automation Platform 2.4 for RHEL · ansible-…)
- [CVE-2023-5379](https://cve.now/CVE-2023-5379.md): Undertow: ajp request closes connection exceeding maxrequestsize (CVSS 7.5, Red Hat JBoss Enterprise Application Platform 7.1 EUS f… +10)
- [CVE-2023-50252](https://cve.now/CVE-2023-50252.md): php-svg-lib unsafe attributes merge when parsing \`use\` tag (CVSS 8.3, dompdf php-svg-lib)
- [CVE-2023-50251](https://cve.now/CVE-2023-50251.md): php-svg-lib possible DoS caused by infinite recursion when parsing SVG document (CVSS 5.3, dompdf php-svg-lib · phenx/php-svg-lib)
- [CVE-2023-48225](https://cve.now/CVE-2023-48225.md): Laf env causes sensitive information disclosure (CVSS 8.9, labring laf)
- [CVE-2023-50247](https://cve.now/CVE-2023-50247.md): h2o QUIC state exhaustion DoS (CVSS 3.7, h2o)
- [CVE-2023-34064](https://cve.now/CVE-2023-34064.md): Privilege Escalation Vulnerability (no CVSS, VMware Workspace ONE Launcher)
- [CVE-2023-41337](https://cve.now/CVE-2023-41337.md): h2o vulnerable to TLS session resumption misdirection (CVSS 6.1, h2o)
- [CVE-2023-49279](https://cve.now/CVE-2023-49279.md): Umbraco CMS vulnerable to stored XSS via SVG File Upload (CVSS 3.7, Umbraco-CMS · Umbraco.CMS)
- [CVE-2023-49278](https://cve.now/CVE-2023-49278.md): Umbraco CMS brute force exploit can be used to collect valid usernames (CVSS 5.3, Umbraco-CMS · Umbraco.CMS)
- [CVE-2023-49274](https://cve.now/CVE-2023-49274.md): Umbraco CMS SMTP misconfiguration exposes potential registered user email (CVSS 3.7, Umbraco-CMS · Umbraco.CMS)
- [CVE-2023-49273](https://cve.now/CVE-2023-49273.md): Umbraco CMS vulnerable to Privilege Escalation using Spoofing (CVSS 5.4, Umbraco-CMS · Umbraco.CMS)
- [CVE-2023-49089](https://cve.now/CVE-2023-49089.md): Umbraco CMS possible path traversal when creating packages from backoffice (CVSS 7.7, Umbraco-CMS · Umbraco.CMS)
- [CVE-2023-6687](https://cve.now/CVE-2023-6687.md): Elastic Agent Insertion of Sensitive Information into Log File (CVSS 6.8, Elastic Agent)
- [CVE-2023-49922](https://cve.now/CVE-2023-49922.md): Beats Insertion of Sensitive Information into Log File (CVSS 6.8, Elastic Beats · github.com/elastic/beats/v7 +1)
- [CVE-2023-35624](https://cve.now/CVE-2023-35624.md): Azure Connected Machine Agent Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Azure Connected Machine Agent)
- [CVE-2023-35622](https://cve.now/CVE-2023-35622.md): Windows DNS Spoofing Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2023-35621](https://cve.now/CVE-2023-35621.md): Microsoft Dynamics 365 Finance and Operations Denial of Service Vulnerability (CVSS 7.5, Microsoft Dynamics 365 for Finance and Operations)
- [CVE-2023-35619](https://cve.now/CVE-2023-35619.md): Microsoft Outlook for Mac Spoofing Vulnerability (CVSS 5.3, Microsoft Office LTSC for Mac)
- [CVE-2023-35636](https://cve.now/CVE-2023-35636.md): Microsoft Outlook Information Disclosure Vulnerability (CVSS 6.5, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2023-35635](https://cve.now/CVE-2023-35635.md): Windows Kernel Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-35634](https://cve.now/CVE-2023-35634.md): Windows Bluetooth Driver Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2023-35633](https://cve.now/CVE-2023-35633.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-35632](https://cve.now/CVE-2023-35632.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-35631](https://cve.now/CVE-2023-35631.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-35630](https://cve.now/CVE-2023-35630.md): Internet Connection Sharing (ICS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-35629](https://cve.now/CVE-2023-35629.md): Microsoft USBHUB 3.0 Device Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2023-35628](https://cve.now/CVE-2023-35628.md): Windows MSHTML Platform Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-35644](https://cve.now/CVE-2023-35644.md): Windows Sysmain Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-35643](https://cve.now/CVE-2023-35643.md): DHCP Server Service Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2023-35642](https://cve.now/CVE-2023-35642.md): Internet Connection Sharing (ICS) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2023-35641](https://cve.now/CVE-2023-35641.md): Internet Connection Sharing (ICS) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-35639](https://cve.now/CVE-2023-35639.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-35638](https://cve.now/CVE-2023-35638.md): DHCP Server Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2023-36006](https://cve.now/CVE-2023-36006.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-36005](https://cve.now/CVE-2023-36005.md): Windows Telephony Server Elevation of Privilege Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36004](https://cve.now/CVE-2023-36004.md): Windows DPAPI (Data Protection Application Programming Interface) Spoofing Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-36003](https://cve.now/CVE-2023-36003.md): XAML Diagnostics Elevation of Privilege Vulnerability (CVSS 6.7, Microsoft Windows)
- [CVE-2023-36012](https://cve.now/CVE-2023-36012.md): DHCP Server Service Information Disclosure Vulnerability (CVSS 5.3, Microsoft Windows Server)
- [CVE-2023-36010](https://cve.now/CVE-2023-36010.md): Microsoft Defender Denial of Service Vulnerability (CVSS 7.5, Microsoft Malware Protection Platform)
- [CVE-2023-36019](https://cve.now/CVE-2023-36019.md): Microsoft Power Platform Connector Spoofing Vulnerability (CVSS 9.6, Microsoft Power Platform · Microsoft Azure Logic Apps)
- [CVE-2023-21740](https://cve.now/CVE-2023-21740.md): Windows Media Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-35625](https://cve.now/CVE-2023-35625.md): Azure Machine Learning Compute Instance for SDK Users Information Disclosure Vulnerability (CVSS 4.7, Microsoft Azure Machine Learning · mltable)
- [CVE-2023-36011](https://cve.now/CVE-2023-36011.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36009](https://cve.now/CVE-2023-36009.md): Microsoft Word Information Disclosure Vulnerability (CVSS 5.5, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2023-36020](https://cve.now/CVE-2023-36020.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2023-36391](https://cve.now/CVE-2023-36391.md): Local Security Authority Subsystem Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-36696](https://cve.now/CVE-2023-36696.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-20275](https://cve.now/CVE-2023-20275.md): A vulnerability in the AnyConnect SSL VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FT (CVSS 4.1, Cisco Adaptive Security Appliance (ASA) Software · Cisco Fi…)
- [CVE-2023-49923](https://cve.now/CVE-2023-49923.md): Enterprise Search Insertion of Sensitive Information into Log File (CVSS 6.8, Elastic Enterprise Search)
- [CVE-2023-48313](https://cve.now/CVE-2023-48313.md): Umbraco contains a DOM-XSS (CVSS 4.3, Umbraco-CMS · Umbraco.CMS)
- [CVE-2023-48227](https://cve.now/CVE-2023-48227.md): Umbraco CMS Backoffice User can bypass "Publish" restriction (CVSS 4.3, Umbraco-CMS · Umbraco.CMS)
- [CVE-2023-38694](https://cve.now/CVE-2023-38694.md): Umbraco CMS vulnerable to possible injection of HTML in an unintended form (CVSS 3.5, Umbraco-CMS · Umbraco.CMS)
- [CVE-2023-4421](https://cve.now/CVE-2023-4421.md): The NSS code used for checking PKCS#1 v1.5 was leaking information useful in mounting Bleichenbacher-like attacks. (no CVSS, Mozilla NSS)
- [CVE-2023-6593](https://cve.now/CVE-2023-6593.md): Client side permission bypass in Devolutions Remote Desktop Manager 2023.3.4.0 and earlier on iOS allows an attacker that has access to th (no CVSS, Devolutions Remote Desktop Manager)
- [CVE-2023-6193](https://cve.now/CVE-2023-6193.md): Unbounded queuing of path validation messages in cloudflare-quiche (CVSS 5.3, Cloudflare quiche · quiche)
- [CVE-2023-49692](https://cve.now/CVE-2023-49692.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V7.2.2), RUGGEDCOM RM1224 LTE(4G) NA (CVSS 7.2, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12)
- [CVE-2023-49691](https://cve.now/CVE-2023-49691.md): A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions \< V8.0), RUGGEDCOM RM1224 LTE(4G) NAM (CVSS 7.2, Siemens RUGGEDCOM RM1224 LTE(4G) EU · Siemens RUGGEDCOM… +12)
- [CVE-2023-48431](https://cve.now/CVE-2023-48431.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 2). (CVSS 6.8, Siemens SINEC INS)
- [CVE-2023-48430](https://cve.now/CVE-2023-48430.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 2). (CVSS 2.7, Siemens SINEC INS)
- [CVE-2023-48429](https://cve.now/CVE-2023-48429.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 2). (CVSS 2.7, Siemens SINEC INS)
- [CVE-2023-48428](https://cve.now/CVE-2023-48428.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 2). (CVSS 7.2, Siemens SINEC INS)
- [CVE-2023-48427](https://cve.now/CVE-2023-48427.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 2). (CVSS 8.1, Siemens SINEC INS)
- [CVE-2023-46285](https://cve.now/CVE-2023-46285.md): A vulnerability has been identified in Opcenter Execution Foundation (All versions \< V2407), Opcenter Quality (All versions \< V2312), SIMATI (CVSS 7.5, Siemens Opcenter Execution Foundation · Siemens Opcenter… +3)
- [CVE-2023-46284](https://cve.now/CVE-2023-46284.md): A vulnerability has been identified in Opcenter Execution Foundation (All versions \< V2407), Opcenter Quality (All versions \< V2312), SIMATI (CVSS 7.5, Siemens Opcenter Execution Foundation · Siemens Opcenter… +3)
- [CVE-2023-46283](https://cve.now/CVE-2023-46283.md): A vulnerability has been identified in Opcenter Execution Foundation (All versions \< V2407), Opcenter Quality (All versions \< V2312), SIMATI (CVSS 7.5, Siemens Opcenter Execution Foundation · Siemens Opcenter… +3)
- [CVE-2023-46282](https://cve.now/CVE-2023-46282.md): A vulnerability has been identified in Opcenter Execution Foundation (All versions \< V2407), Opcenter Quality (All versions \< V2312), SIMATI (CVSS 7.1, Siemens Opcenter Execution Foundation · Siemens Opcenter… +3)
- [CVE-2023-46281](https://cve.now/CVE-2023-46281.md): A vulnerability has been identified in Opcenter Execution Foundation (All versions \< V2407), Opcenter Quality (All versions \< V2312), SIMATI (CVSS 7.1, Siemens Opcenter Execution Foundation · Siemens Opcenter… +3)
- [CVE-2023-46156](https://cve.now/CVE-2023-46156.md): Affected devices improperly handle specially crafted packets sent to port 102/tcp. (CVSS 7.5, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +63)
- [CVE-2023-38380](https://cve.now/CVE-2023-38380.md): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (incl. (CVSS 7.5, Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +9)
- [CVE-2022-47375](https://cve.now/CVE-2022-47375.md): A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 (CVSS 7.5, Siemens SIMATIC PC-Station Plus · Siemens SIMATIC S7-400… +7)
- [CVE-2022-47374](https://cve.now/CVE-2022-47374.md): A vulnerability has been identified in SIMATIC PC-Station Plus (All versions), SIMATIC S7-400 CPU 412-2 PN V7 (All versions), SIMATIC S7-400 (CVSS 7.5, Siemens SIMATIC PC-Station Plus · Siemens SIMATIC S7-400… +7)
- [CVE-2022-46141](https://cve.now/CVE-2022-46141.md): A vulnerability has been identified in SIMATIC STEP 7 (TIA Portal) (All versions \< V19). (CVSS 4.2, Siemens SIMATIC STEP)
- [CVE-2023-6727](https://cve.now/CVE-2023-6727.md): Leak Inaccessible Playbook Information via Channel Action IDOR (CVSS 3.1, Mattermost)
- [CVE-2022-42784](https://cve.now/CVE-2022-42784.md): A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA1) (All versions \>= V8.3), LOGO! 12/24RCEo (6ED1052-2MD08-0BA1) (All (CVSS 7.6, Siemens LOGO! 12/24RCE · Siemens LOGO! 12/24RCEo +14)
- [CVE-2023-4958](https://cve.now/CVE-2023-4958.md): Stackrox: missing http security headers allows for clickjacking in web ui (CVSS 6.1, Red Hat Advanced Cluster Security)
- [CVE-2023-4932](https://cve.now/CVE-2023-4932.md): Reflected Cross-Site Scripting in SAS 9.4 (CVSS 6.3, SAS Institute SAS Integration Technologies)
- [CVE-2023-49713](https://cve.now/CVE-2023-49713.md): Denial-of-service (DoS) vulnerability exists in NetBIOS service of HMI GC-A2 series. (no CVSS, JTEKT ELECTRONICS GC-A22W-CW · JTEKT ELECTRONICS GC-A24W… +8)
- [CVE-2023-49143](https://cve.now/CVE-2023-49143.md): Denial-of-service (DoS) vulnerability exists in rfe service of HMI GC-A2 series. (no CVSS, JTEKT ELECTRONICS GC-A22W-CW · JTEKT ELECTRONICS GC-A24W… +8)
- [CVE-2023-49140](https://cve.now/CVE-2023-49140.md): Denial-of-service (DoS) vulnerability exists in commplex-link service of HMI GC-A2 series. (CVSS 7.5, JTEKT ELECTRONICS GC-A22W-CW · JTEKT ELECTRONICS GC-A24W… +8)
- [CVE-2023-41963](https://cve.now/CVE-2023-41963.md): Denial-of-service (DoS) vulnerability exists in FTP service of HMI GC-A2 series. (no CVSS, JTEKT ELECTRONICS GC-A22W-CW · JTEKT ELECTRONICS GC-A24W… +8)
- [CVE-2023-49695](https://cve.now/CVE-2023-49695.md): OS command injection vulnerability in WRC-X3000GSN v1.0.2, WRC-X3000GS v1.0.24 and earlier, and WRC-X3000GSA v1.0.24 and earlier allows a ne (CVSS 6.8, ELECOM CO. WRC-X3000GSN · ELECOM CO. WRC-X3000GS +1)
- [CVE-2023-48677](https://cve.now/CVE-2023-48677.md): Local privilege escalation due to DLL hijacking vulnerability. (CVSS 7.3, Acronis Cyber Protect Home Office · Acronis Cyber Protec… +2)
- [CVE-2023-45316](https://cve.now/CVE-2023-45316.md): Reflected client side path traversal leading to CSRF in Playbooks (CVSS 7.3, Mattermost)
- [CVE-2023-6547](https://cve.now/CVE-2023-6547.md): Playbooks access/modification by removed team member (CVSS 3.7, Mattermost)
- [CVE-2023-49607](https://cve.now/CVE-2023-49607.md): Playbook plugin crash via missing interface type assertion (CVSS 4.3, Mattermost)
- [CVE-2023-49809](https://cve.now/CVE-2023-49809.md): Todo plugin gets crashed and disabled by member (CVSS 4.3, Mattermost)
- [CVE-2023-46701](https://cve.now/CVE-2023-46701.md): Inaccessible Post Information Leak via Run Timeline IDOR (CVSS 6.5, Mattermost)
- [CVE-2023-49874](https://cve.now/CVE-2023-49874.md): IDOR when updating the tasks of a private playbook run (CVSS 4.3, Mattermost)
- [CVE-2023-45847](https://cve.now/CVE-2023-45847.md): Playbook Plugin Crash via Run Checklist (CVSS 4.3, Mattermost)
- [CVE-2022-48616](https://cve.now/CVE-2022-48616.md): A Huawei data communication product has a command injection vulnerability. (CVSS 6.4, Huawei AR6000)
- [CVE-2022-48615](https://cve.now/CVE-2022-48615.md): An improper access control vulnerability exists in a Huawei datacom product. (CVSS 4.8, Huawei AR6000)
- [CVE-2023-6709](https://cve.now/CVE-2023-6709.md): Improper Neutralization of Special Elements Used in a Template Engine in mlflow/mlflow (CVSS 10.0, mlflow/mlflow · mlflow)
- [CVE-2023-50424](https://cve.now/CVE-2023-50424.md): Escalation of Privileges in SAP BTP Security Services Integration Library (\[Golang\] github.com/sap/cloud-security-client-go) (CVSS 9.1, SAP\_SE github.com/sap/cloud-security-client-go · github.… +3)
- [CVE-2023-50423](https://cve.now/CVE-2023-50423.md): Escalation of Privileges in SAP BTP Security Services Integration Library (\[Python\] cloud-pysec) (CVSS 9.1, SAP\_SE sap-xssec · sap-xssec)
- [CVE-2023-5536](https://cve.now/CVE-2023-5536.md): A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the lxd group to escalate (CVSS 5.0, Canonical Ubuntu Server)
- [CVE-2023-46219](https://cve.now/CVE-2023-46219.md): When saving HSTS data to an excessively long file name, curl could end up removing all contents, making subsequent requests using that file (CVSS 5.3, curl)
- [CVE-2023-6542](https://cve.now/CVE-2023-6542.md): Improper Export of Android Application Components in SAP EMARSYS SDK ANDROID (CVSS 7.1, SAP\_SE SAP EMARSYS SDK ANDROID)
- [CVE-2023-49587](https://cve.now/CVE-2023-49587.md): Command Injection vulnerability in SAP Solution Manager (CVSS 6.4, SAP\_SE SAP Solution Manager)
- [CVE-2023-49584](https://cve.now/CVE-2023-49584.md): Client-Side Desynchronization vulnerability in SAP Fiori Launchpad (CVSS 4.3, SAP\_SE SAP Fiori Launchpad)
- [CVE-2023-50422](https://cve.now/CVE-2023-50422.md): Escalation of Privileges in SAP BTP Security Services Integration Library (\[Java\] cloud-security-services-integration-library) (CVSS 9.1, SAP\_SE cloud-security-services-integration-library · git… +3)
- [CVE-2023-49583](https://cve.now/CVE-2023-49583.md): Escalation of Privileges in SAP BTP Security Services Integration Library (\[Node.js\] @sap/xssec) (CVSS 9.1, SAP\_SE @sap/xssec · @sap/xssec)
- [CVE-2023-49581](https://cve.now/CVE-2023-49581.md): SQL Injection vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform (CVSS 4.1, SAP\_SE SAP NetWeaver Application Server ABAP and ABAP Platf…)
- [CVE-2023-49580](https://cve.now/CVE-2023-49580.md): Information disclosure in SAP GUI for Windows and SAP GUI for Java (CVSS 7.3, SAP\_SE SAP GUI for Windows and SAP GUI for Java)
- [CVE-2023-49578](https://cve.now/CVE-2023-49578.md): Denial of service (DOS) in SAP Cloud Connector (CVSS 3.5, SAP\_SE SAP Cloud Connector)
- [CVE-2023-49577](https://cve.now/CVE-2023-49577.md): Cross-Site Scripting (XSS) vulnerability in the SAP HCM (SMART PAYE solution) (CVSS 6.1, SAP\_SE SAP HCM)
- [CVE-2023-49058](https://cve.now/CVE-2023-49058.md): Directory Traversal vulnerability in SAP Master Data Governance (CVSS 3.5, SAP\_SE SAP Master Data Governance)
- [CVE-2023-42481](https://cve.now/CVE-2023-42481.md): Improper Access Control vulnerability in SAP Commerce Cloud (CVSS 8.1, SAP\_SE SAP Commerce Cloud)
- [CVE-2023-42479](https://cve.now/CVE-2023-42479.md): Cross-Site Scripting (XSS) vulnerability in SAP Biller Direct (CVSS 6.1, SAP\_SE SAP Biller Direct)
- [CVE-2023-42478](https://cve.now/CVE-2023-42478.md): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (CVSS 7.5, SAP\_SE Business Objects BI Platform)
- [CVE-2023-42476](https://cve.now/CVE-2023-42476.md): Cross Site Scripting vulnerability in SAP BusinessObjects Web Intelligence (CVSS 6.8, SAP\_SE SAP BusinessObjects Web Intelligence)
- [CVE-2023-40446](https://cve.now/CVE-2023-40446.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42891](https://cve.now/CVE-2023-42891.md): An authentication issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-42901](https://cve.now/CVE-2023-42901.md): Multiple memory corruption issues were addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-42900](https://cve.now/CVE-2023-42900.md): The issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-42886](https://cve.now/CVE-2023-42886.md): An out-of-bounds read was addressed with improved bounds checking. (no CVSS, Apple macOS)
- [CVE-2023-42890](https://cve.now/CVE-2023-42890.md): The issue was addressed with improved memory handling. (no CVSS, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2023-42874](https://cve.now/CVE-2023-42874.md): This issue was addressed with improved state management. (no CVSS, Apple macOS)
- [CVE-2023-42897](https://cve.now/CVE-2023-42897.md): The issue was addressed with improved checks. (no CVSS, Apple iOS and iPadOS)
- [CVE-2023-42907](https://cve.now/CVE-2023-42907.md): Multiple memory corruption issues were addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-42911](https://cve.now/CVE-2023-42911.md): Multiple memory corruption issues were addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-42910](https://cve.now/CVE-2023-42910.md): Multiple memory corruption issues were addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-42906](https://cve.now/CVE-2023-42906.md): Multiple memory corruption issues were addressed with improved input validation. (CVSS 8.8, Apple macOS)
- [CVE-2023-42926](https://cve.now/CVE-2023-42926.md): Multiple memory corruption issues were addressed with improved input validation. (CVSS 7.8, Apple macOS)
- [CVE-2023-42909](https://cve.now/CVE-2023-42909.md): Multiple memory corruption issues were addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-42899](https://cve.now/CVE-2023-42899.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-42905](https://cve.now/CVE-2023-42905.md): Multiple memory corruption issues were addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-42883](https://cve.now/CVE-2023-42883.md): The issue was addressed with improved memory handling. (no CVSS, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2023-42894](https://cve.now/CVE-2023-42894.md): This issue was addressed with improved redaction of sensitive information. (no CVSS, Apple macOS)
- [CVE-2023-42882](https://cve.now/CVE-2023-42882.md): The issue was addressed with improved memory handling. (no CVSS, Apple macOS)
- [CVE-2023-42904](https://cve.now/CVE-2023-42904.md): Multiple memory corruption issues were addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-42912](https://cve.now/CVE-2023-42912.md): Multiple memory corruption issues were addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-42932](https://cve.now/CVE-2023-42932.md): A logic issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-42898](https://cve.now/CVE-2023-42898.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-42924](https://cve.now/CVE-2023-42924.md): A logic issue was addressed with improved checks. (no CVSS, Apple macOS)
- [CVE-2023-42908](https://cve.now/CVE-2023-42908.md): Multiple memory corruption issues were addressed with improved input validation. (CVSS 7.8, Apple macOS)
- [CVE-2023-42903](https://cve.now/CVE-2023-42903.md): Multiple memory corruption issues were addressed with improved input validation. (CVSS 7.8, Apple macOS)
- [CVE-2023-42919](https://cve.now/CVE-2023-42919.md): A privacy issue was addressed with improved private data redaction for log entries. (no CVSS, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-42923](https://cve.now/CVE-2023-42923.md): This issue was addressed through improved state management. (no CVSS, Apple iOS and iPadOS)
- [CVE-2023-42922](https://cve.now/CVE-2023-42922.md): This issue was addressed with improved redaction of sensitive information. (no CVSS, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42884](https://cve.now/CVE-2023-42884.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2023-42902](https://cve.now/CVE-2023-42902.md): Multiple memory corruption issues were addressed with improved input validation. (no CVSS, Apple macOS)
- [CVE-2023-42914](https://cve.now/CVE-2023-42914.md): The issue was addressed with improved memory handling. (no CVSS, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2009-4123](https://cve.now/CVE-2009-4123.md): The jruby-openssl gem before 0.6 for JRuby mishandles SSL certificate validation. (no CVSS, jruby-openssl)
- [CVE-2013-2513](https://cve.now/CVE-2013-2513.md): The flash\_tool gem through 0.6.0 for Ruby allows command execution via shell metacharacters in the name of a downloaded file. (no CVSS, flash\_tool)
- [CVE-2015-2179](https://cve.now/CVE-2015-2179.md): The xaviershay-dm-rails gem 0.10.3.8 for Ruby allows local users to discover MySQL credentials by listing a process and its arguments. (no CVSS, xaviershay-dm-rails)
- [CVE-2015-8314](https://cve.now/CVE-2015-8314.md): The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persis (CVSS 7.5, devise)
- [CVE-2018-16153](https://cve.now/CVE-2018-16153.md): An issue was discovered in Apereo Opencast 4.x through 10.x before 10.6. (CVSS 7.5, org.opencastproject:opencast-common)
- [CVE-2020-10676](https://cve.now/CVE-2020-10676.md): In Rancher 2.x before 2.6.13 and 2.7.x before 2.7.4, an incorrectly applied authorization check allows users who have certain access to a na (no CVSS, github.com/rancher/rancher)
- [CVE-2020-12612](https://cve.now/CVE-2020-12612.md): An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. (no CVSS)
- [CVE-2020-12614](https://cve.now/CVE-2020-12614.md): An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. (CVSS 8.4)
- [CVE-2020-12615](https://cve.now/CVE-2020-12615.md): An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. (no CVSS)
- [CVE-2020-28369](https://cve.now/CVE-2020-28369.md): In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the use (no CVSS)
- [CVE-2022-44543](https://cve.now/CVE-2022-44543.md): The femanager extension before 5.5.2, 6.x before 6.3.3, and 7.x before 7.0.1 for TYPO3 allows creation of frontend users in restricted group (no CVSS, in2code/femanager)
- [CVE-2023-26920](https://cve.now/CVE-2023-26920.md): fast-xml-parser before 4.1.2 allows \_\_proto\_\_ for Prototype Pollution. (no CVSS, fast-xml-parser · org.apache.druid:druid-core)
- [CVE-2023-28465](https://cve.now/CVE-2023-28465.md): The package-decompression feature in HL7 (Health Level 7) FHIR Core Libraries before 5.6.106 allows attackers to copy arbitrary files to cer (CVSS 7.5, ca.uhn.hapi.fhir:org.hl7.fhir.core · ca.uhn.hapi.fhir:or… +4)
- [CVE-2023-28604](https://cve.now/CVE-2023-28604.md): The fluid\_components (aka Fluid Components) extension before 3.5.0 for TYPO3 allows XSS via a component argument parameter, for certain {con (CVSS 6.1, sitegeist/fluid-components)
- [CVE-2023-31048](https://cve.now/CVE-2023-31048.md): The OPC UA .NET Standard Reference Server before 1.4.371.86. (CVSS 5.3, OPCFoundation.NetStandard.Opc.Ua.Core · OPCFoundation.NetSt…)
- [CVE-2023-36647](https://cve.now/CVE-2023-36647.md): A hard-coded cryptographic private key used to sign JWT authentication tokens in ProLion CryptoSpike 3.0.15P2 allows remote attackers to imp (no CVSS)
- [CVE-2023-36648](https://cve.now/CVE-2023-36648.md): Missing authentication in the internal data streaming system in ProLion CryptoSpike 3.0.15P2 allows remote unauthenticated users to read pot (no CVSS)
- [CVE-2023-36649](https://cve.now/CVE-2023-36649.md): Insertion of sensitive information in the centralized (Grafana) logging system in ProLion CryptoSpike 3.0.15P2 allows remote attackers to im (no CVSS)
- [CVE-2023-36650](https://cve.now/CVE-2023-36650.md): A missing integrity check in the update system in ProLion CryptoSpike 3.0.15P2 allows attackers to execute OS commands as the root Linux use (no CVSS)
- [CVE-2023-36651](https://cve.now/CVE-2023-36651.md): Hidden and hard-coded credentials in ProLion CryptoSpike 3.0.15P2 allow remote attackers to login to web management as super-admin and consu (no CVSS)
- [CVE-2023-36652](https://cve.now/CVE-2023-36652.md): A SQL Injection in the users searching REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to read datab (CVSS 4.3)
- [CVE-2023-36654](https://cve.now/CVE-2023-36654.md): Directory traversal in the log-download REST API endpoint in ProLion CryptoSpike 3.0.15P2 allows remote authenticated attackers to download (no CVSS)
- [CVE-2023-41113](https://cve.now/CVE-2023-41113.md): An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be (CVSS 4.3)
- [CVE-2023-41114](https://cve.now/CVE-2023-41114.md): An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be (CVSS 6.5)
- [CVE-2023-41115](https://cve.now/CVE-2023-41115.md): An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be (CVSS 6.5)
- [CVE-2023-41116](https://cve.now/CVE-2023-41116.md): An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be (CVSS 4.3)
- [CVE-2023-41117](https://cve.now/CVE-2023-41117.md): An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be (CVSS 8.8)
- [CVE-2023-41118](https://cve.now/CVE-2023-41118.md): An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be (no CVSS)
- [CVE-2023-41119](https://cve.now/CVE-2023-41119.md): An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be (CVSS 8.8)
- [CVE-2023-41120](https://cve.now/CVE-2023-41120.md): An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x be (CVSS 6.5)
- [CVE-2023-41623](https://cve.now/CVE-2023-41623.md): Emlog version pro2.1.14 was discovered to contain a SQL injection vulnerability via the uid parameter at /admin/media.php. (no CVSS)
- [CVE-2023-43364](https://cve.now/CVE-2023-43364.md): main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution. (CVSS 9.8, searchor)
- [CVE-2023-46454](https://cve.now/CVE-2023-46454.md): In GL.iNET GL-AR300M routers with firmware v4.3.7, it is possible to inject arbitrary shell commands through a crafted package name in the p (no CVSS)
- [CVE-2023-46455](https://cve.now/CVE-2023-46455.md): In GL.iNET GL-AR300M routers with firmware v4.3.7 it is possible to write arbitrary files through a path traversal attack in the OpenVPN cli (no CVSS)
- [CVE-2023-46456](https://cve.now/CVE-2023-46456.md): In GL.iNET GL-AR300M routers with firmware 3.216 it is possible to inject arbitrary shell commands through the OpenVPN client file upload fu (no CVSS)
- [CVE-2023-48641](https://cve.now/CVE-2023-48641.md): Archer Platform 6.x before 6.14 P1 HF2 (6.14.0.1.2) contains an insecure direct object reference vulnerability. (CVSS 7.5)
- [CVE-2023-48642](https://cve.now/CVE-2023-48642.md): Archer Platform 6.x before 6.13 P2 (6.13.0.2) contains an authenticated HTML content injection vulnerability. (no CVSS)
- [CVE-2023-49563](https://cve.now/CVE-2023-49563.md): Cross Site Scripting (XSS) in Voltronic Power SNMP Web Pro v.1.1 allows an attacker to execute arbitrary code via a crafted script within a (no CVSS)
- [CVE-2023-49990](https://cve.now/CVE-2023-49990.md): Espeak-ng 1.52-dev was discovered to contain a buffer-overflow via the function SetUpPhonemeTable at synthdata.c. (CVSS 5.3)
- [CVE-2023-49991](https://cve.now/CVE-2023-49991.md): Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Underflow via the function CountVowelPosition at synthdata.c. (no CVSS)
- [CVE-2023-49992](https://cve.now/CVE-2023-49992.md): Espeak-ng 1.52-dev was discovered to contain a Stack Buffer Overflow via the function RemoveEnding at dictionary.c. (no CVSS)
- [CVE-2023-49993](https://cve.now/CVE-2023-49993.md): Espeak-ng 1.52-dev was discovered to contain a Buffer Overflow via the function ReadClause at readclause.c. (no CVSS)
- [CVE-2023-49994](https://cve.now/CVE-2023-49994.md): Espeak-ng 1.52-dev was discovered to contain a Floating Point Exception via the function PeaksToHarmspect at wavegen.c. (no CVSS)
- [CVE-2023-50495](https://cve.now/CVE-2023-50495.md): NCurse v6.4-20230418 was discovered to contain a segmentation fault via the component \_nc\_wrap\_entry(). (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.