# CVEs published 2023-12-13

154 CVEs were published on December 13, 2023: 5 critical, 46 high. Days are UTC.

- [CVE-2023-21751](https://cve.now/CVE-2023-21751.md): Azure DevOps Server Spoofing Vulnerability (CVSS 6.5, Microsoft Azure DevOps Server)
- [CVE-2023-45170](https://cve.now/CVE-2023-45170.md): IBM AIX privilege escalation (CVSS 8.4, IBM AIX)
- [CVE-2023-45174](https://cve.now/CVE-2023-45174.md): IBM AIX privilege escalation (CVSS 8.4, IBM AIX)
- [CVE-2023-45166](https://cve.now/CVE-2023-45166.md): IBM AIX privilege escalation (CVSS 8.4, IBM AIX)
- [CVE-2023-49646](https://cve.now/CVE-2023-49646.md): Improper authentication in some Zoom clients before version 5.16.5 may allow an authenticated user to conduct a denial of service via networ (CVSS 6.4, Zoom Video Communications Zoom Clients)
- [CVE-2023-43586](https://cve.now/CVE-2023-43586.md): Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to (CVSS 7.3, Zoom Video Communications Zoom Desktop Client for Windows,…)
- [CVE-2023-43585](https://cve.now/CVE-2023-43585.md): Improper access control in Zoom Mobile App for iOS and Zoom SDKs for iOS before version 5.16.5 may allow an authenticated user to conduct a (CVSS 7.1, Zoom Video Communications Zoom Mobile App for iOS and SDKs…)
- [CVE-2023-43583](https://cve.now/CVE-2023-43583.md): Cryptographic issues Zoom Mobile App for Android, Zoom Mobile App for iOS, and Zoom SDKs for Android and iOS before version 5.16.0 may allow (CVSS 4.9, Zoom Video Communications Zoom Mobile App for Android, Zoom…)
- [CVE-2023-50709](https://cve.now/CVE-2023-50709.md): Denial of service attack on the cube-api endpoint (CVSS 6.5, cube-js cube · @cubejs-backend/api-gateway)
- [CVE-2023-47620](https://cve.now/CVE-2023-47620.md): Scrypted reflected Cross-site Scripting vulnerability (CVSS 6.1, koush scrypted · @scrypted/server)
- [CVE-2023-47623](https://cve.now/CVE-2023-47623.md): Scrypted reflected Cross-site Scripting vulnerability (CVSS 6.1, koush scrypted · @scrypted/core)
- [CVE-2023-47624](https://cve.now/CVE-2023-47624.md): Audiobookshelf Arbitrary File Read Vulnerability (CVSS 7.5, advplyr audiobookshelf)
- [CVE-2023-47619](https://cve.now/CVE-2023-47619.md): Audiobookshelf Server-Side Request Forgery and Arbitrary File Read Vulnerability (CVSS 8.1, advplyr audiobookshelf)
- [CVE-2023-48702](https://cve.now/CVE-2023-48702.md): Jellyfin Possible Remote Code Execution via custom FFmpeg binary (CVSS 7.2, jellyfin)
- [CVE-2023-50262](https://cve.now/CVE-2023-50262.md): Dompdf possible DoS caused by infinite recursion when parsing SVG images (CVSS 5.3, dompdf · dompdf/dompdf)
- [CVE-2023-50268](https://cve.now/CVE-2023-50268.md): jq has stack-based buffer overflow in decNaNs (CVSS 6.2, jqlang jq)
- [CVE-2023-50248](https://cve.now/CVE-2023-50248.md): CKAN out of memory error when submitting the dataset form with a specially-crafted field (CVSS 4.5, ckan)
- [CVE-2023-50246](https://cve.now/CVE-2023-50246.md): jq has heap-buffer-overflow vulnerability in the function decToString in decNumber.c (CVSS 6.2, jqlang jq)
- [CVE-2023-49878](https://cve.now/CVE-2023-49878.md): IBM System Storage Virtualization Engine information disclosure (CVSS 4.3, IBM System Storage Virtualization Engine)
- [CVE-2023-49877](https://cve.now/CVE-2023-49877.md): IBM System Storage Virtualization Engine information disclosure (CVSS 4.3, IBM System Storage Virtualization Engine)
- [CVE-2023-6775](https://cve.now/CVE-2023-6775.md): CodeAstro POS and Inventory Management System item\_con cross site scripting (CVSS 3.5, CodeAstro POS and Inventory Management System)
- [CVE-2023-6774](https://cve.now/CVE-2023-6774.md): CodeAstro POS and Inventory Management System register\_account cross site scripting (CVSS 4.3, CodeAstro POS and Inventory Management System)
- [CVE-2023-49296](https://cve.now/CVE-2023-49296.md): Arduino Create Agent vulnerable to Reflected Cross-Site Scripting (CVSS 6.3, arduino-create-agent)
- [CVE-2023-46247](https://cve.now/CVE-2023-46247.md): Vyper has incorrect storage layout for contracts containing large arrays (CVSS 7.5, vyperlang vyper · vyper)
- [CVE-2023-6773](https://cve.now/CVE-2023-6773.md): CodeAstro POS and Inventory Management System User Creation register\_account access control (CVSS 4.3, CodeAstro POS and Inventory Management System)
- [CVE-2023-6772](https://cve.now/CVE-2023-6772.md): OTCMS ind\_backstage.php sql injection (CVSS 4.7, OTCMS)
- [CVE-2023-6793](https://cve.now/CVE-2023-6793.md): PAN-OS: XML API Keys Revoked by Read-Only PAN-OS Administrator (CVSS 2.7, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Ac… +1)
- [CVE-2023-6771](https://cve.now/CVE-2023-6771.md): SourceCodester Simple Student Attendance System actions.class.php save\_attendance sql injection (CVSS 5.5, SourceCodester Simple Student Attendance System)
- [CVE-2023-6791](https://cve.now/CVE-2023-6791.md): PAN-OS: Plaintext Disclosure of External System Integration Credentials (CVSS 4.9, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Ac… +1)
- [CVE-2023-46727](https://cve.now/CVE-2023-46727.md): GLPI SQL injection through inventory agent request (CVSS 8.6, glpi-project glpi)
- [CVE-2023-6789](https://cve.now/CVE-2023-6789.md): PAN-OS: Stored Cross-Site Scripting (XSS) Vulnerability in the Web Interface (CVSS 4.3, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Ac… +1)
- [CVE-2023-46726](https://cve.now/CVE-2023-46726.md): GLPI Remote code execution from LDAP server configuration form on PHP 7.4 (CVSS 7.2, glpi-project glpi)
- [CVE-2023-6795](https://cve.now/CVE-2023-6795.md): PAN-OS: OS Command Injection Vulnerability in the Web Interface (CVSS 5.5, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Ac… +1)
- [CVE-2023-43813](https://cve.now/CVE-2023-43813.md): glpi Authenticated SQL Injection (CVSS 6.5, glpi-project glpi)
- [CVE-2023-6794](https://cve.now/CVE-2023-6794.md): PAN-OS: File Upload Vulnerability in the Web Interface (CVSS 5.5, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Ac… +1)
- [CVE-2023-6792](https://cve.now/CVE-2023-6792.md): PAN-OS: OS Command Injection Vulnerability in the XML API (CVSS 5.5, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Ac… +1)
- [CVE-2023-6790](https://cve.now/CVE-2023-6790.md): PAN-OS: DOM-Based Cross-Site Scripting (XSS) Vulnerability in the Web Interface (CVSS 8.8, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Ac… +1)
- [CVE-2023-6767](https://cve.now/CVE-2023-6767.md): SourceCodester Wedding Guest e-Book add-guest.php cross site scripting (CVSS 4.3, SourceCodester Wedding Guest e-Book)
- [CVE-2023-6766](https://cve.now/CVE-2023-6766.md): PHPGurukul Teacher Subject Allocation Management System Delete Course course.php cross-site request forgery (CVSS 4.3, PHPGurukul Teacher Subject Allocation Management System)
- [CVE-2023-6765](https://cve.now/CVE-2023-6765.md): SourceCodester Online Tours & Travels Management System email\_setup.php prepare sql injection (CVSS 5.5, SourceCodester Online Tours & Travels Management System)
- [CVE-2023-50779](https://cve.now/CVE-2023-50779.md): Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to a (no CVSS, Jenkins Project Jenkins PaaSLane Estimate Plugin · com.clou…)
- [CVE-2023-50778](https://cve.now/CVE-2023-50778.md): A cross-site request forgery (CSRF) vulnerability in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allows attackers to connect to an at (no CVSS, Jenkins Project Jenkins PaaSLane Estimate Plugin · com.clou…)
- [CVE-2023-50777](https://cve.now/CVE-2023-50777.md): Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier does not mask PaaSLane authentication tokens displayed on the job configuration form, inc (CVSS 4.3, Jenkins Project Jenkins PaaSLane Estimate Plugin · com.clou…)
- [CVE-2023-50776](https://cve.now/CVE-2023-50776.md): Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier stores PaaSLane authentication tokens unencrypted in job config.xml files on the Jenkins (no CVSS, Jenkins Project Jenkins PaaSLane Estimate Plugin · com.clou…)
- [CVE-2023-50775](https://cve.now/CVE-2023-50775.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Deployment Dashboard Plugin 1.0.10 and earlier allows attackers to copy jobs. (no CVSS, Jenkins Project Jenkins Deployment Dashboard Plugin · org.j…)
- [CVE-2023-50774](https://cve.now/CVE-2023-50774.md): A cross-site request forgery (CSRF) vulnerability in Jenkins HTMLResource Plugin 1.02 and earlier allows attackers to delete arbitrary files (no CVSS, Jenkins Project Jenkins HTMLResource Plugin · org.jenkins-c…)
- [CVE-2023-50773](https://cve.now/CVE-2023-50773.md): Jenkins Dingding JSON Pusher Plugin 2.0 and earlier does not mask access tokens displayed on the job configuration form, increasing the pote (no CVSS, Jenkins Project Jenkins Dingding JSON Pusher Plugin · com.z…)
- [CVE-2023-50772](https://cve.now/CVE-2023-50772.md): Jenkins Dingding JSON Pusher Plugin 2.0 and earlier stores access tokens unencrypted in job config.xml files on the Jenkins controller where (no CVSS, Jenkins Project Jenkins Dingding JSON Pusher Plugin · com.z…)
- [CVE-2023-50771](https://cve.now/CVE-2023-50771.md): Jenkins OpenId Connect Authentication Plugin 2.6 and earlier improperly determines that a redirect URL after login is legitimately pointing (no CVSS, Jenkins Project Jenkins OpenId Connect Authentication Plugi…)
- [CVE-2023-50770](https://cve.now/CVE-2023-50770.md): Jenkins OpenId Connect Authentication Plugin 2.6 and earlier stores a password of a local user account used as an anti-lockout feature in a (no CVSS, Jenkins Project Jenkins OpenId Connect Authentication Plugi…)
- [CVE-2023-50769](https://cve.now/CVE-2023-50769.md): Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to (no CVSS, Jenkins Project Jenkins Nexus Platform Plugin · org.sonatyp…)
- [CVE-2023-50768](https://cve.now/CVE-2023-50768.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to connect to an a (CVSS 8.8, Jenkins Project Jenkins Nexus Platform Plugin · org.sonatyp…)
- [CVE-2023-50767](https://cve.now/CVE-2023-50767.md): Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTT (no CVSS, Jenkins Project Jenkins Nexus Platform Plugin · org.sonatyp…)
- [CVE-2023-50766](https://cve.now/CVE-2023-50766.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allows attackers to send an HTTP re (CVSS 8.8, Jenkins Project Jenkins Nexus Platform Plugin · org.sonatyp…)
- [CVE-2023-50765](https://cve.now/CVE-2023-50765.md): A missing permission check in Jenkins Scriptler Plugin 342.v6a\_89fd40f466 and earlier allows attackers with Overall/Read permission to read (no CVSS, Jenkins Project Jenkins Scriptler Plugin · org.jenkins-ci.p…)
- [CVE-2023-50764](https://cve.now/CVE-2023-50764.md): Jenkins Scriptler Plugin 342.v6a\_89fd40f466 and earlier does not restrict a file name query parameter in an HTTP endpoint, allowing attacker (no CVSS, Jenkins Project Jenkins Scriptler Plugin · org.jenkins-ci.p…)
- [CVE-2023-6762](https://cve.now/CVE-2023-6762.md): Thecosy IceCMS Article permission (CVSS 5.4, Thecosy IceCMS)
- [CVE-2023-6761](https://cve.now/CVE-2023-6761.md): Thecosy IceCMS User Data access control (CVSS 4.3, Thecosy IceCMS)
- [CVE-2023-6760](https://cve.now/CVE-2023-6760.md): Thecosy IceCMS user session (CVSS 6.3, Thecosy IceCMS)
- [CVE-2023-6759](https://cve.now/CVE-2023-6759.md): Thecosy IceCMS Love resource improper enforcement of a single, unique action (CVSS 5.3, Thecosy IceCMS)
- [CVE-2023-6758](https://cve.now/CVE-2023-6758.md): Thecosy IceCMS API PlanetCommentList access control (CVSS 5.3, Thecosy IceCMS)
- [CVE-2023-6757](https://cve.now/CVE-2023-6757.md): Thecosy IceCMS API PlanetUser information disclosure (CVSS 5.3, Thecosy IceCMS)
- [CVE-2023-48638](https://cve.now/CVE-2023-48638.md): Adobe Substance 3D Designer 13.0.2 build 6942 Vulnerability III (CVSS 5.5, Adobe Substance3D - Designer)
- [CVE-2023-48639](https://cve.now/CVE-2023-48639.md): Adobe Substance 3D Designer 13.0.2 build 6942 Vulnerability I (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-48637](https://cve.now/CVE-2023-48637.md): Adobe Substance 3D Designer 13.0.2 build 6942 Vulnerability II (CVSS 5.5, Adobe Substance3D - Designer)
- [CVE-2023-48636](https://cve.now/CVE-2023-48636.md): Adobe Substance 3D Designer 13.0.2 build 6942 Vulnerability IV (CVSS 5.5, Adobe Substance3D - Designer)
- [CVE-2023-6756](https://cve.now/CVE-2023-6756.md): Thecosy IceCMS Captcha login excessive authentication (CVSS 5.3, Thecosy IceCMS)
- [CVE-2023-48633](https://cve.now/CVE-2023-48633.md): ZDI-CAN-22173: Adobe After Effects AEP File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-48634](https://cve.now/CVE-2023-48634.md): ZDI-CAN-22175: Adobe After Effects AEP File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-48635](https://cve.now/CVE-2023-48635.md): ZDI-CAN-22174: Adobe After Effects AEP File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe After Effects)
- [CVE-2023-48632](https://cve.now/CVE-2023-48632.md): ZDI-CAN-22172: Adobe After Effects AEP File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe After Effects)
- [CVE-2023-48625](https://cve.now/CVE-2023-48625.md): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability VI (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2023-48627](https://cve.now/CVE-2023-48627.md): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability IV (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2023-48628](https://cve.now/CVE-2023-48628.md): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability III (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2023-48630](https://cve.now/CVE-2023-48630.md): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability I (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2023-48629](https://cve.now/CVE-2023-48629.md): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability II (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2023-48626](https://cve.now/CVE-2023-48626.md): Adobe Substance 3D Sampler v4.2.1Build3527 OOBW Vulnerability V (CVSS 7.8, Adobe Substance3D - Sampler)
- [CVE-2023-47080](https://cve.now/CVE-2023-47080.md): Adobe Substance 3D Stager v2.1.1 Vulnerability VI (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2023-47081](https://cve.now/CVE-2023-47081.md): Adobe Substance 3D Stager v2.1.1 Vulnerability II (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2023-47079](https://cve.now/CVE-2023-47079.md): ZDI-CAN-22279: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-47061](https://cve.now/CVE-2023-47061.md): ZDI-CAN-22278: Adobe Dimension GLB File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-47062](https://cve.now/CVE-2023-47062.md): ZDI-CAN-22284: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-47078](https://cve.now/CVE-2023-47078.md): ZDI-CAN-22249: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-6755](https://cve.now/CVE-2023-6755.md): DedeBIZ content\_batchup\_action.php sql injection (CVSS 4.7, DedeBIZ)
- [CVE-2023-42495](https://cve.now/CVE-2023-42495.md): Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command… (CVSS 9.8, Dasan Networks)
- [CVE-2023-44362](https://cve.now/CVE-2023-44362.md): ZDI-CAN-21791: Adobe Prelude MP4 File Uninitialized Variable Information Disclosure Vulnerability (CVSS 5.5, Adobe Prelude)
- [CVE-2023-6380](https://cve.now/CVE-2023-6380.md): Open Redirect in Alkacon Software OpenCms (CVSS 6.1, Alkacon Open CMS)
- [CVE-2023-6379](https://cve.now/CVE-2023-6379.md): Cross-site Scripting in Alkacon Software OpenCms (CVSS 5.4, Alkacon Open CMS · org.opencms:opencms-core)
- [CVE-2023-6381](https://cve.now/CVE-2023-6381.md): Improper input validation in Newsletter Software SuperMailer (CVSS 3.3, SuperMailer Newsletter Software)
- [CVE-2023-6723](https://cve.now/CVE-2023-6723.md): Unrestricted Upload of File with Dangerous Type in Repox (CVSS 10.0, Repox)
- [CVE-2023-6722](https://cve.now/CVE-2023-6722.md): Relative Path Traversal in Repox (CVSS 7.5, Repox)
- [CVE-2023-6721](https://cve.now/CVE-2023-6721.md): Improper Restriction of XML External Entity Reference in Repox (CVSS 8.3, Repox)
- [CVE-2023-6720](https://cve.now/CVE-2023-6720.md): Cross-site Scripting in Repox (CVSS 5.5, Repox)
- [CVE-2023-47076](https://cve.now/CVE-2023-47076.md): Adobe InDesign CC 2023 Memory Corruption Vulnerability IV. (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2023-47077](https://cve.now/CVE-2023-47077.md): Adobe InDesign CC 2023 Memory Corruption Vulnerability VI. (CVSS 5.5, Adobe InDesign Desktop)
- [CVE-2023-47063](https://cve.now/CVE-2023-47063.md): Adobe Illustrator 2023 CC 27.7 Memory Corruption Out-Of-Bounds-Write Vulnerability IV. (CVSS 7.8, Adobe Illustrator)
- [CVE-2023-47074](https://cve.now/CVE-2023-47074.md): ZDI-CAN-21812: Adobe Illustrator JP2 File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2023-47075](https://cve.now/CVE-2023-47075.md): ZDI-CAN-22006: Adobe Illustrator JP2 File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2023-6719](https://cve.now/CVE-2023-6719.md): Cross-site Scripting in Repox (CVSS 6.3, Repox)
- [CVE-2023-6718](https://cve.now/CVE-2023-6718.md): Authentication Bypass Using an Alternate Path or Channel in Repox (CVSS 9.4, Repox)
- [CVE-2023-44251](https://cve.now/CVE-2023-44251.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\*A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability \[CWE-22\] in Fo (CVSS 8.1, Fortinet FortiWAN)
- [CVE-2023-44252](https://cve.now/CVE-2023-44252.md): \*\* UNSUPPORTED WHEN ASSIGNED \*\*An improper authentication vulnerability \[CWE-287\] in Fortinet FortiWAN version 5.2.0 through 5.2.1 and versi (CVSS 8.6, Fortinet FortiWAN)
- [CVE-2023-31210](https://cve.now/CVE-2023-31210.md): Privilege escalation in agent via LD\_LIBRARY\_PATH (CVSS 8.8, Checkmk)
- [CVE-2023-6660](https://cve.now/CVE-2023-6660.md): NFS client data corruption and kernel memory disclosure (no CVSS, FreeBSD)
- [CVE-2022-22942](https://cve.now/CVE-2022-22942.md): The vmwgfx driver contains a local privilege escalation vulnerability that allows unprivileged users to gain access to files opened by other (CVSS 7.8, Photon OS)
- [CVE-2023-6534](https://cve.now/CVE-2023-6534.md): TCP spoofing vulnerability in pf(4) (no CVSS, FreeBSD)
- [CVE-2023-47536](https://cve.now/CVE-2023-47536.md): An improper access control vulnerability \[CWE-284\] in FortiOS version 7.2.0, version 7.0.13 and below, version 6.4.14 and below and FortiPro (CVSS 2.8, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2023-45725](https://cve.now/CVE-2023-45725.md): Apache CouchDB, IBM Cloudant: Privilege Escalation Using \_design Documents (no CVSS, Apache Software Foundation Apache CouchDB · Apache Software…)
- [CVE-2023-46675](https://cve.now/CVE-2023-46675.md): Kibana Insertion of Sensitive Information into Log File (CVSS 8.0, Elastic Kibana)
- [CVE-2023-46671](https://cve.now/CVE-2023-46671.md): Kibana Insertion of Sensitive Information into Log File (CVSS 8.0, Elastic Kibana)
- [CVE-2023-48791](https://cve.now/CVE-2023-48791.md): An improper neutralization of special elements used in a command ('Command Injection') vulnerability \[CWE-77\] in FortiPortal version 7.2.0, (CVSS 7.9, Fortinet FortiPortal)
- [CVE-2023-41678](https://cve.now/CVE-2023-41678.md): A double free in Fortinet FortiOS versions 7.0.0 through 7.0.5, FortiPAM version 1.0.0 through 1.0.3, 1.1.0 through 1.1.1 allows attacker to (CVSS 8.3, Fortinet FortiOS · Fortinet FortiPAM)
- [CVE-2023-40716](https://cve.now/CVE-2023-40716.md): An improper neutralization of special elements used in an OS command vulnerability \[CWE-78\] in the command line interpreter of FortiTester (CVSS 6.5, Fortinet FortiTester)
- [CVE-2023-41673](https://cve.now/CVE-2023-41673.md): An improper authorization vulnerability \[CWE-285\] in Fortinet FortiADC version 7.4.0 and before 7.2.2 may allow a low privileged user to rea (CVSS 6.9, Fortinet FortiADC)
- [CVE-2023-36639](https://cve.now/CVE-2023-36639.md): A use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4 (CVSS 7.0, Fortinet FortiOS · Fortinet FortiPAM +1)
- [CVE-2023-41844](https://cve.now/CVE-2023-41844.md): A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through (CVSS 3.4, Fortinet FortiSandbox)
- [CVE-2023-46713](https://cve.now/CVE-2023-46713.md): An improper output neutralization for logs in Fortinet FortiWeb 6.2.0 - 6.2.8, 6.3.0 - 6.3.23, 7.0.0 - 7.0.9, 7.2.0 - 7.2.5 and 7.4.0 may al (CVSS 4.9, Fortinet FortiWeb)
- [CVE-2023-45587](https://cve.now/CVE-2023-45587.md): An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through (CVSS 3.4, Fortinet FortiSandbox)
- [CVE-2022-27488](https://cve.now/CVE-2022-27488.md): A cross-site request forgery (CSRF) in Fortinet FortiVoiceEnterprise version 6.4.x, 6.0.x, FortiSwitch version 7.0.0 through 7.0.4, 6.4.0 th (CVSS 7.5, Fortinet FortiVoice · Fortinet FortiRecorder +3)
- [CVE-2023-48782](https://cve.now/CVE-2023-48782.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6. (CVSS 8.6, Fortinet FortiWLM)
- [CVE-2023-6478](https://cve.now/CVE-2023-6478.md): Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty (CVSS 7.6, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EX…)
- [CVE-2023-6377](https://cve.now/CVE-2023-6377.md): Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions (CVSS 7.8, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EX…)
- [CVE-2023-45801](https://cve.now/CVE-2023-45801.md): Improper Authentication vulnerability in Nadatel DVR allows Information Elicitation.This issue affects DVR: from 3.0.0 before 9.9.0. (CVSS 7.5, Nadatel DVR)
- [CVE-2023-45800](https://cve.now/CVE-2023-45800.md): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Hanbiro Hanbiro groupware allows Infor (CVSS 7.5, Hanbiro groupware)
- [CVE-2023-6753](https://cve.now/CVE-2023-6753.md): Path Traversal in mlflow/mlflow (CVSS 9.6, mlflow/mlflow · mlflow)
- [CVE-2023-34194](https://cve.now/CVE-2023-34194.md): StringEqual in TiXmlDeclaration::Parse in tinyxmlparser.cpp in TinyXML through 2.6.2 has a reachable assertion (and application exit) via a (no CVSS)
- [CVE-2023-40921](https://cve.now/CVE-2023-40921.md): SQL Injection vulnerability in functions/point\_list.php in Common Services soliberte before v4.3.03 allows attackers to obtain sensitive inf (CVSS 9.8)
- [CVE-2023-41618](https://cve.now/CVE-2023-41618.md): Emlog Pro v2.1.14 was discovered to contain a reflective cross-site scripting (XSS) vulnerability via the component /admin/article.php?activ (no CVSS)
- [CVE-2023-41621](https://cve.now/CVE-2023-41621.md): A Cross Site Scripting (XSS) vulnerability was discovered in Emlog Pro v2.1.14 via the component /admin/store.php. (no CVSS)
- [CVE-2023-42483](https://cve.now/CVE-2023-42483.md): A TOCTOU race condition in Samsung Mobile Processor Exynos 9820, Exynos 980, Exynos 1080, Exynos 2100, Exynos 2200, Exynos 1280, and Exynos (CVSS 6.3)
- [CVE-2023-43122](https://cve.now/CVE-2023-43122.md): Samsung Mobile Processor and Wearable Processor (Exynos 980, 850, 1080, 2100, 2200, 1280, 1380, 1330, and W920) allow Information Disclosure (CVSS 4.8)
- [CVE-2023-45864](https://cve.now/CVE-2023-45864.md): A race condition issue discovered in Samsung Mobile Processor Exynos 9820, 980, 1080, 2100, 2200, 1280, and 1380 allows unintended modificat (CVSS 4.0)
- [CVE-2023-47320](https://cve.now/CVE-2023-47320.md): Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control. (CVSS 8.1, org.silverpeas.core:silverpeas-core-war · org.silverpeas.co…)
- [CVE-2023-47321](https://cve.now/CVE-2023-47321.md): Silverpeas Core 6.3.1 is vulnerable to Incorrect Access Control via the "Porlet Deployer" which allows administrators to deploy .WAR portlet (no CVSS, org.silverpeas.core:silverpeas-core-web)
- [CVE-2023-47322](https://cve.now/CVE-2023-47322.md): The "userModify" feature of Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) leading to privilege escalation. (no CVSS, org.silverpeas.core:silverpeas-core-web)
- [CVE-2023-47323](https://cve.now/CVE-2023-47323.md): The notification/messaging feature of Silverpeas Core 6.3.1 does not enforce access control on the ID parameter. (no CVSS, org.silverpeas.core:silverpeas-core-api · org.silverpeas.co…)
- [CVE-2023-47324](https://cve.now/CVE-2023-47324.md): Silverpeas Core 6.3.1 is vulnerable to Cross Site Scripting (XSS) via the message/notification feature. (no CVSS, org.silverpeas.core:silverpeas-core-web · org.silverpeas… +2)
- [CVE-2023-47325](https://cve.now/CVE-2023-47325.md): Silverpeas Core 6.3.1 administrative "Bin" feature is affected by broken access control. (CVSS 5.4, org.silverpeas.core:silverpeas-core-web)
- [CVE-2023-47326](https://cve.now/CVE-2023-47326.md): Silverpeas Core 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) via the Domain SQL Create function. (no CVSS, org.silverpeas.core:silverpeas-core)
- [CVE-2023-47327](https://cve.now/CVE-2023-47327.md): The "Create a Space" feature in Silverpeas Core 6.3.1 is reserved for use by administrators. (no CVSS, org.silverpeas.core:silverpeas-core-web)
- [CVE-2023-47573](https://cve.now/CVE-2023-47573.md): An issue discovered in Relyum RELY-PCIe 22.2.1 devices. (no CVSS)
- [CVE-2023-47574](https://cve.now/CVE-2023-47574.md): An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. (no CVSS)
- [CVE-2023-47575](https://cve.now/CVE-2023-47575.md): An issue was discovered on Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices. (no CVSS)
- [CVE-2023-47576](https://cve.now/CVE-2023-47576.md): An issue was discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices, allowing authenticated command injection through the web int (no CVSS)
- [CVE-2023-47577](https://cve.now/CVE-2023-47577.md): An issue discovered in Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 allows for unauthorized password changes due to no check for current pass (no CVSS)
- [CVE-2023-47578](https://cve.now/CVE-2023-47578.md): Relyum RELY-PCIe 22.2.1 and RELY-REC 23.1.0 devices are susceptible to Cross Site Request Forgery (CSRF) attacks due to the absence of CSRF (CVSS 8.8)
- [CVE-2023-47579](https://cve.now/CVE-2023-47579.md): Relyum RELY-PCIe 22.2.1 devices suffer from a system group misconfiguration, allowing read access to the central password hash file of the o (no CVSS)
- [CVE-2023-49363](https://cve.now/CVE-2023-49363.md): Rockoa \<2.3.3 is vulnerable to SQL Injection. (no CVSS)
- [CVE-2023-50439](https://cve.now/CVE-2023-50439.md): ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission), ZED! for Windows before Q.2021.2 (ANSSI (no CVSS)
- [CVE-2023-50440](https://cve.now/CVE-2023-50440.md): ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2021.2 (ANSSI (CVSS 5.5)
- [CVE-2023-50441](https://cve.now/CVE-2023-50441.md): Encrypted folders created by PRIMX ZONECENTRAL for Windows before Q.2021.2 (ANSSI qualification submission) or ZONECENTRAL for Windows befor (no CVSS)
- [CVE-2023-50442](https://cve.now/CVE-2023-50442.md): Encrypted folders created by PRIMX ZONECENTRAL through 2023.5 can be modified by a local attacker (with appropriate privileges) so that spec (no CVSS)
- [CVE-2023-50443](https://cve.now/CVE-2023-50443.md): Encrypted disks created by PRIMX CRYHOD for Windows before Q.2020.4 (ANSSI qualification submission) or CRYHOD for Windows before 2023.5 can (no CVSS)
- [CVE-2023-50444](https://cve.now/CVE-2023-50444.md): By default, .ZED containers produced by PRIMX ZED! for Windows before Q.2020.3 (ANSSI qualification submission); ZED! for Windows before Q.2 (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.