# CVEs published 2023-12-14

157 CVEs were published on December 14, 2023: 7 critical, 54 high. Days are UTC.

- [CVE-2023-4489](https://cve.now/CVE-2023-4489.md): Z/IP Gateway Use of Uninitialized PRNG when Generating S0 Encryption Key (CVSS 6.4, silabs.com Z/IP Gateway SDK)
- [CVE-2023-6707](https://cve.now/CVE-2023-6707.md): Use after free in CSS in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2023-6706](https://cve.now/CVE-2023-6706.md): Use after free in FedCM in Google Chrome prior to 120.0.6099.109 allowed a remote attacker who convinced a user to engage in specific UI int (CVSS 8.8, Google Chrome)
- [CVE-2023-6705](https://cve.now/CVE-2023-6705.md): Use after free in WebRTC in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2023-6704](https://cve.now/CVE-2023-6704.md): Use after free in libavif in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a cr (no CVSS, Google Chrome)
- [CVE-2023-6703](https://cve.now/CVE-2023-6703.md): Use after free in Blink in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2023-6702](https://cve.now/CVE-2023-6702.md): Type confusion in V8 in Google Chrome prior to 120.0.6099.109 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-6134](https://cve.now/CVE-2023-6134.md): Keycloak: reflected xss via wildcard in oidc redirect\_uri (CVSS 4.6, Red Hat build of Keycloak · Red Hat Single Sign-On +2)
- [CVE-2023-49347](https://cve.now/CVE-2023-49347.md): Temporary data passed between application components by Budgie Extras Windows Previews could potentially be viewed or manipulated. (CVSS 6.0, Ubuntu Budgie Budgie Extras)
- [CVE-2023-49346](https://cve.now/CVE-2023-49346.md): Temporary data passed between application components by Budgie Extras WeatherShow applet could potentially be viewed or manipulated. (CVSS 6.0, Ubuntu Budgie Budgie Extras)
- [CVE-2023-49345](https://cve.now/CVE-2023-49345.md): Temporary data passed between application components by Budgie Extras Takeabreak applet could potentially be viewed or manipulated. (CVSS 6.0, Ubuntu Budgie Budgie Extras)
- [CVE-2023-49344](https://cve.now/CVE-2023-49344.md): Temporary data passed between application components by Budgie Extras Window Shuffler applet could potentially be viewed or manipulated. (CVSS 6.0, Ubuntu Budgie Budgie Extras)
- [CVE-2023-49343](https://cve.now/CVE-2023-49343.md): Temporary data passed between application components by Budgie Extras Dropby applet could potentially be viewed or manipulated. (CVSS 6.0, Ubuntu Budgie Budgie Extras)
- [CVE-2023-49342](https://cve.now/CVE-2023-49342.md): Temporary data passed between application components by Budgie Extras Clockworks applet could potentially be viewed or manipulated. (CVSS 6.0, Ubuntu Budgie Budgie Extras)
- [CVE-2023-0248](https://cve.now/CVE-2023-0248.md): Kantech Gen1 ioSmart card reader (CVSS 7.5, Sensormatic Electronics, a subsidiary of Johnson Controls i…)
- [CVE-2023-49786](https://cve.now/CVE-2023-49786.md): Asterisk susceptible to Denial of Service via DTLS Hello packets during call initiation (CVSS 7.5, asterisk)
- [CVE-2023-37457](https://cve.now/CVE-2023-37457.md): Asterisk's PJSIP\_HEADER dialplan function can overwrite memory/cause crash when using 'update' (CVSS 7.5, asterisk)
- [CVE-2023-49294](https://cve.now/CVE-2023-49294.md): Asterisk Path Traversal vulnerability (CVSS 4.9, asterisk)
- [CVE-2023-4694](https://cve.now/CVE-2023-4694.md): Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when sending a SOAP message to the service on TCP port 3 (no CVSS, HP OfficeJet Pro Printers)
- [CVE-2023-50713](https://cve.now/CVE-2023-50713.md): Speckle Server API Token Privilege Escalation (CVSS 6.5, specklesystems speckle-server)
- [CVE-2023-6563](https://cve.now/CVE-2023-6563.md): Keycloak: offline session token dos (CVSS 7.7, Red Hat Single Sign-On 7.6 for RHEL · Red Hat RHEL-8 bas… +3)
- [CVE-2023-50710](https://cve.now/CVE-2023-50710.md): Hono's named path parameters can be overridden in TrieRouter (CVSS 4.2, honojs hono · hono)
- [CVE-2023-49157](https://cve.now/CVE-2023-49157.md): WordPress Multiple Post Passwords Plugin \<= 1.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Andreas Münch Multiple Post Passwords)
- [CVE-2023-49152](https://cve.now/CVE-2023-49152.md): WordPress Credit Tracker Plugin \<= 1.1.17 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Labs64 Credit Tracker)
- [CVE-2023-49151](https://cve.now/CVE-2023-49151.md): WordPress Google Calendar Events Plugin \<= 3.2.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Simple Calendar – Google Calendar Plugin)
- [CVE-2023-50269](https://cve.now/CVE-2023-50269.md): SQUID-2023:10 Denial of Service in HTTP Request parsing (CVSS 8.6, squid-cache squid)
- [CVE-2023-49150](https://cve.now/CVE-2023-49150.md): WordPress Crypto Converter Widget Plugin \<= 1.8.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, CurrencyRate.today Crypto Converter Widget)
- [CVE-2023-42801](https://cve.now/CVE-2023-42801.md): Stack buffer overflow due to \`strcpy\` into fixed size buffer in \`extractVersionQuadFromString\` (CVSS 7.6, moonlight-stream moonlight-common-c)
- [CVE-2023-49149](https://cve.now/CVE-2023-49149.md): WordPress Currency Converter Calculator Plugin \<= 1.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, CurrencyRate.today Currency Converter Calculator)
- [CVE-2023-42800](https://cve.now/CVE-2023-42800.md): Buffer overflow due to use of \`strcpy\` in \`performRtspHandshake\` (CVSS 8.8, moonlight-stream moonlight-common-c)
- [CVE-2023-48780](https://cve.now/CVE-2023-48780.md): WordPress WP Catalogue Plugin \<= 1.7.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, EnigmaWeb WP Catalogue)
- [CVE-2023-48771](https://cve.now/CVE-2023-48771.md): WordPress File Gallery Plugin \<= 1.8.5.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Bruno "Aesqe" Babic File Gallery)
- [CVE-2023-48770](https://cve.now/CVE-2023-48770.md): WordPress Aparat Plugin \<= 1.7.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Nima Saberi Aparat)
- [CVE-2023-42799](https://cve.now/CVE-2023-42799.md): Buffer overflow due to use of \`strcpy\` in \`parseUrlAddrFromRtspUrlString\` (CVSS 8.8, moonlight-stream moonlight-common-c)
- [CVE-2023-48767](https://cve.now/CVE-2023-48767.md): WordPress MyTube PlayList Plugin \<= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Raghu Goriya MyTube PlayList)
- [CVE-2023-48756](https://cve.now/CVE-2023-48756.md): WordPress JetBlocks For Elementor Plugin \<= 1.3.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Crocoblock JetBlocks For Elementor)
- [CVE-2023-5769](https://cve.now/CVE-2023-5769.md): A vulnerability exists in the webserver that affects the RTU500 series product versions listed below. (CVSS 5.4, Hitachi Energy RTU500)
- [CVE-2023-49860](https://cve.now/CVE-2023-49860.md): WordPress WP Project Manager Plugin \<= 2.6.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, weDevs WP Project Manager – Task, team, and project managem…)
- [CVE-2023-49842](https://cve.now/CVE-2023-49842.md): WordPress Rocket Maintenance Mode & Coming Soon Page Plugin \<= 4.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, wpexpertsio Rocket Maintenance Mode & Coming Soon Page)
- [CVE-2023-48671](https://cve.now/CVE-2023-48671.md): Dell vApp Manager, versions prior to 9.2.4.x contain an information disclosure vulnerability. (CVSS 7.5, Dell vApp Manager)
- [CVE-2023-48665](https://cve.now/CVE-2023-48665.md): Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. (CVSS 7.2, Dell vApp Manager,)
- [CVE-2023-48664](https://cve.now/CVE-2023-48664.md): Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. (CVSS 7.2, Dell vApp Manager)
- [CVE-2023-6368](https://cve.now/CVE-2023-6368.md): WhatsUp Gold Unauthenticated Access to an API Endpoint (CVSS 5.9, Progress Software WhatsUp Gold)
- [CVE-2023-6595](https://cve.now/CVE-2023-6595.md): WhatsUp Gold Unauthenticated Access to an API Endpoint (CVSS 7.5, Progress Software WhatsUp Gold)
- [CVE-2023-6367](https://cve.now/CVE-2023-6367.md): WhatsUp Gold Stored Cross-Site Scripting (XSS) via Roles (CVSS 7.6, Progress Software WhatsUp Gold)
- [CVE-2023-6366](https://cve.now/CVE-2023-6366.md): WhatsUp Gold Stored Cross-Site Scripting (XSS) via Alert Center (CVSS 7.6, Progress Software WhatsUp Gold)
- [CVE-2023-6365](https://cve.now/CVE-2023-6365.md): WhatsUp Gold Stored Cross-Site Scripting (XSS) via Device Groups (CVSS 7.6, Progress Software WhatsUp Gold)
- [CVE-2023-6364](https://cve.now/CVE-2023-6364.md): WhatsUp Gold Stored Cross-Site Scripting (XSS) via Dashboard (CVSS 7.6, Progress Software WhatsUp Gold)
- [CVE-2023-48663](https://cve.now/CVE-2023-48663.md): Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. (CVSS 7.2, Dell vApp Manager)
- [CVE-2023-48662](https://cve.now/CVE-2023-48662.md): Dell vApp Manager, versions prior to 9.2.4.x contain a command injection vulnerability. (CVSS 7.2, Dell vApp Manager)
- [CVE-2023-49841](https://cve.now/CVE-2023-49841.md): WordPress Optin Forms Plugin \<= 1.3.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, FancyThemes Optin Forms – Simple List Building Plugin for W…)
- [CVE-2023-48661](https://cve.now/CVE-2023-48661.md): Dell vApp Manager, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. (CVSS 4.9, Dell vApp Manager)
- [CVE-2023-49820](https://cve.now/CVE-2023-49820.md): WordPress Structured Content Plugin \<= 1.5.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD)…)
- [CVE-2023-48660](https://cve.now/CVE-2023-48660.md): Dell vApp Manger, versions prior to 9.2.4.x contain an arbitrary file read vulnerability. (CVSS 7.5, Dell vApp Manger)
- [CVE-2023-49813](https://cve.now/CVE-2023-49813.md): WordPress WP Photo Album Plus Plugin \<= 8.5.02.005 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus)
- [CVE-2023-49771](https://cve.now/CVE-2023-49771.md): WordPress Smart External Link Click Monitor \[Link Log\] Plugin \<= 5.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Peter Raschendorfer Smart External Link Click Monitor \[Link…)
- [CVE-2023-48668](https://cve.now/CVE-2023-48668.md): Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 on DDMC contain an OS command injection vulnerabi (CVSS 8.2, Dell PowerProtect DD)
- [CVE-2023-49770](https://cve.now/CVE-2023-49770.md): WordPress Smart External Link Click Monitor \[Link Log\] Plugin \<= 5.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Peter Raschendorfer Smart External Link Click Monitor \[Link…)
- [CVE-2023-49766](https://cve.now/CVE-2023-49766.md): WordPress Ultimate Addons for Contact Form 7 Plugin \<= 3.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Themefic Ultimate Addons for Contact Form)
- [CVE-2023-48667](https://cve.now/CVE-2023-48667.md): Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in (CVSS 7.2, Dell PowerProtect DD)
- [CVE-2023-49195](https://cve.now/CVE-2023-49195.md): WordPress Nested Pages Plugin \<= 3.2.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Kyle Phillips Nested Pages)
- [CVE-2023-44286](https://cve.now/CVE-2023-44286.md): Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a DOM-based Cross-Site Scripting vulnera (CVSS 8.8, Dell PowerProtect DD)
- [CVE-2023-49173](https://cve.now/CVE-2023-49173.md): WordPress 10to8 Online Appointment Booking System Plugin \<= 1.0.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, 10to8 Sign In Scheduling Online Appointment Booking System)
- [CVE-2023-44285](https://cve.now/CVE-2023-44285.md): Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an improper access control vulnerability. (CVSS 7.8, Dell PowerProtect DD)
- [CVE-2023-49172](https://cve.now/CVE-2023-49172.md): WordPress BrainCert – HTML5 Virtual Classroom Plugin \<= 1.30 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, BrainCert – HTML5 Virtual Classroom)
- [CVE-2023-49171](https://cve.now/CVE-2023-49171.md): WordPress Innovs HR Plugin \<= 1.0.3.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, TheInnovs Innovs HR – Complete Human Resource Management Sy…)
- [CVE-2023-44284](https://cve.now/CVE-2023-44284.md): Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an SQL Injection vulnerability. (CVSS 4.3, Dell PowerProtect DD)
- [CVE-2023-44279](https://cve.now/CVE-2023-44279.md): Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability i (CVSS 6.7, Dell PowerProtect DD)
- [CVE-2023-44278](https://cve.now/CVE-2023-44278.md): Dell PowerProtect DD , versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain a path traversal vulnerability. (CVSS 6.7, Dell PowerProtect DD)
- [CVE-2023-44277](https://cve.now/CVE-2023-44277.md): Dell PowerProtect DD, versions prior to 7.13.0.10, LTS 7.7.5.25, LTS 7.10.1.15, 6.2.1.110 contain an OS command injection vulnerability in (CVSS 7.8, Dell PowerProtect DD)
- [CVE-2023-49168](https://cve.now/CVE-2023-49168.md): WordPress BP Better Messages Plugin \<= 2.4.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WordPlus Better Messages – Live Chat for WordPress, BuddyPr…)
- [CVE-2022-45365](https://cve.now/CVE-2022-45365.md): WordPress Stock Ticker Plugin \<= 3.23.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Aleksandar Urošević Stock Ticker)
- [CVE-2023-49739](https://cve.now/CVE-2023-49739.md): WordPress PowerPack Pro for Elementor plugin \<= 2.9.23 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, IdeaBox Creations PowerPack Pro for Elementor)
- [CVE-2023-49740](https://cve.now/CVE-2023-49740.md): WordPress Seraphinite Accelerator Plugin \<= 2.20.28 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Seraphinite Solutions Seraphinite Accelerator)
- [CVE-2023-49743](https://cve.now/CVE-2023-49743.md): WordPress Dashboard Widgets Suite Plugin \<= 3.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Jeff Starr Dashboard Widgets Suite)
- [CVE-2023-49745](https://cve.now/CVE-2023-49745.md): WordPress Spiffy Calendar Plugin \<= 4.9.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Spiffy Plugins Spiffy Calendar)
- [CVE-2023-49827](https://cve.now/CVE-2023-49827.md): WordPress Soledad Theme \<= 8.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCo…)
- [CVE-2023-49828](https://cve.now/CVE-2023-49828.md): WordPress WooCommerce Payments Plugin \<= 6.4.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Automattic WooPayments – Fully Integrated Solution Built an…)
- [CVE-2023-49833](https://cve.now/CVE-2023-49833.md): WordPress Spectra Plugin \<= 2.7.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Brainstorm Force Spectra – WordPress Gutenberg Blocks)
- [CVE-2023-49836](https://cve.now/CVE-2023-49836.md): WordPress Cookie Bar Plugin \<= 2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Brontobytes Cookie Bar)
- [CVE-2023-6545](https://cve.now/CVE-2023-6545.md): Beckhoff: Open redirect in TwinCAT/BSD package authelia-bhf (CVSS 4.7, Beckhoff authelia-bhf of TwinCAT/BSD)
- [CVE-2023-46144](https://cve.now/CVE-2023-46144.md): PHOENIX CONTACT: PLCnext Control prone to download of code without integrity check (CVSS 6.5, PHOENIX CONTACT AXC F · PHOENIX CONTACT BPC +3)
- [CVE-2023-49846](https://cve.now/CVE-2023-49846.md): WordPress Author Avatars List/Block Plugin \<= 2.1.17 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Paul Bearne Author Avatars List/Block)
- [CVE-2023-46143](https://cve.now/CVE-2023-46143.md): Phoenix Contact: Classic line industrial controllers prone to inadequate integrity check of PLC (CVSS 7.5, PHOENIX CONTACT Automation Worx Software Suite · PHOENI… +11)
- [CVE-2023-46142](https://cve.now/CVE-2023-46142.md): PHOENIX CONTACT: Insufficient Read and Write Protection to Logic and Runtime Data in PLCnext Control (CVSS 8.8, PHOENIX CONTACT AXC F · PHOENIX CONTACT BPC +3)
- [CVE-2023-46141](https://cve.now/CVE-2023-46141.md): Phoenix Contact: Automation Worx and classic line controllers prone to Incorrect Permission Assignment for Critical Resource (CVSS 9.8, PHOENIX CONTACT Automation Worx Software Suite · PHOENI… +11)
- [CVE-2023-5592](https://cve.now/CVE-2023-5592.md): Phoenix Contact: ProConOs prone to Download of Code Without Integrity Check (CVSS 7.5, PHOENIX CONTACT MULTIPROG · PHOENIX CONTACT ProConOS eCLR)
- [CVE-2023-45185](https://cve.now/CVE-2023-45185.md): IBM i Access Client Solutions code execution (CVSS 7.4, IBM i Access Client Solutions)
- [CVE-2023-0757](https://cve.now/CVE-2023-0757.md): Phoenix Contact ProConOS prone to Incorrect Permission Assignment for Critical Resource (CVSS 9.8, PHOENIX CONTACT MULTIPROG · PHOENIX CONTACT ProConOS eCLR)
- [CVE-2023-45182](https://cve.now/CVE-2023-45182.md): IBM i Access Client Solutions information disclosure (CVSS 7.4, IBM i Access Client Solutions)
- [CVE-2023-49847](https://cve.now/CVE-2023-49847.md): WordPress Annual Archive Plugin \<= 1.6.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Twinpictures Annual Archive)
- [CVE-2023-50368](https://cve.now/CVE-2023-50368.md): WordPress Shortcodes and extra features for Phlox theme Plugin \<= 2.15.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Averta Shortcodes and extra features for Phlox theme)
- [CVE-2023-50369](https://cve.now/CVE-2023-50369.md): WordPress Alma – Pay in installments or later for WooCommerce Plugin \<= 5.1.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Alma – Pay in installments or later for WooCommerce)
- [CVE-2023-50370](https://cve.now/CVE-2023-50370.md): WordPress Livemesh Addons for WPBakery Page Builder Plugin \<= 3.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WPBakery Page Builder Addons by Livemesh)
- [CVE-2023-48676](https://cve.now/CVE-2023-48676.md): Sensitive information disclosure and manipulation due to missing authorization. (CVSS 3.3, Acronis Cyber Protect Cloud Agent)
- [CVE-2023-6572](https://cve.now/CVE-2023-6572.md): Command Injection in gradio-app/gradio (CVSS 9.6, gradio-app/gradio · gradio)
- [CVE-2023-48631](https://cve.now/CVE-2023-48631.md): Denial of Service of regular expression in package @adobe/css-tools (CVSS 5.3, Adobe Not a product · @adobe/css-tools)
- [CVE-2023-6571](https://cve.now/CVE-2023-6571.md): Cross-site Scripting (XSS) - Reflected in kubeflow/kubeflow (CVSS 5.4, kubeflow/kubeflow)
- [CVE-2023-6570](https://cve.now/CVE-2023-6570.md): Server-Side Request Forgery (SSRF) in kubeflow/kubeflow (CVSS 7.7, kubeflow/kubeflow)
- [CVE-2023-6569](https://cve.now/CVE-2023-6569.md): External Control of File Name or Path in h2oai/h2o-3 (CVSS 9.3, h2oai/h2o-3 · h2o)
- [CVE-2023-50371](https://cve.now/CVE-2023-50371.md): WordPress Advanced Page Visit Counter Plugin \<= 8.0.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Advanced Page Visit Counter – Most Wanted Analytics Plugin…)
- [CVE-2023-40627](https://cve.now/CVE-2023-40627.md): Extension - MLWebTechnologies - Reflected XSS in LivingWord component for Joomla 1.0.0-3.0.0 (no CVSS, https://github.com/MLWebTechnologies LivingWord component f…)
- [CVE-2023-40659](https://cve.now/CVE-2023-40659.md): Extension - joomboost.com - Reflected XSS in Easy Quick Contact module for Joomla 1.0.0-1.3.0 (no CVSS, joomboost.com Easy Quick Contact module for Joomla)
- [CVE-2023-40658](https://cve.now/CVE-2023-40658.md): Extension - deconf.net - Reflected XSS in Clicky Analytics Dashboard module for Joomla 1.0.0-1.3.1 (no CVSS, deconf.net Clicky Analytics Dashboard module for Joomla)
- [CVE-2023-40628](https://cve.now/CVE-2023-40628.md): Extension - Extplorer.net - Reflected XSS in Extplorer component for Joomla 1.0.0-2.1.15 (no CVSS, Extplorer.net Extplorer component for Joomla)
- [CVE-2023-40629](https://cve.now/CVE-2023-40629.md): Extension - king-products.net - SQLi vulnerability in LMS Lite component for Joomla 1.0.0-3.3.0.1 (no CVSS, king-products.net LMS Lite component for Joomla)
- [CVE-2023-49708](https://cve.now/CVE-2023-49708.md): Extension - joomstar.com - SQLi vulnerability in Starshop component for Joomla 1.0.0-1.0.9 (no CVSS, Joomstar.com Starshop component for Joomla)
- [CVE-2023-40656](https://cve.now/CVE-2023-40656.md): Extension - plasma-web.ru - Reflected XSS in Quickform component for Joomla 1.0.0-3.3.01 (no CVSS, plasma-web.ru Quickform component for Joomla)
- [CVE-2023-49707](https://cve.now/CVE-2023-49707.md): Extension - joomlart.com - SQLi vulnerability in S5 Register module for Joomla 1.0.0-3.0.0 (no CVSS, joomlart.com S5 Register module for Joomla)
- [CVE-2023-40657](https://cve.now/CVE-2023-40657.md): Extension - artio.net - Reflected XSS in Joomdoc component for Joomla 1.0.0-4.0.5 (no CVSS, artio.net Joomdoc component for Joomla)
- [CVE-2023-40630](https://cve.now/CVE-2023-40630.md): Extension - joomcode.com - Unauthenticated LFI/SSRF in JCDashboards component for Joomla 1.0.0-1.1.30 (CVSS 9.8, joomcode.com JCDashboards component for Joomla)
- [CVE-2023-40655](https://cve.now/CVE-2023-40655.md): Extension - mooj.org - Reflected XSS in Proforms Basic component for Joomla \<= 1.6.0 (no CVSS, mooj.org Proforms Basic component for Joomla)
- [CVE-2023-46750](https://cve.now/CVE-2023-46750.md): Apache Shiro: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in FORM authentication feature Apache Shiro. (CVSS 4.7, Apache Software Foundation Apache Shiro · org.apache.shiro:…)
- [CVE-2023-25644](https://cve.now/CVE-2023-25644.md): Denial of Service Vulnerability in Some ZTE Mobile Internet Products (CVSS 6.5, ZTE MC801A · ZTE MC801A1)
- [CVE-2023-1904](https://cve.now/CVE-2023-1904.md): In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Oc (CVSS 4.2, Octopus Deploy Octopus Server)
- [CVE-2023-25643](https://cve.now/CVE-2023-25643.md): Two Vulnerabilities in Some ZTE Mobile Internet Products (CVSS 8.4, ZTE MC801A · ZTE MC801A1)
- [CVE-2023-25642](https://cve.now/CVE-2023-25642.md): Two Vulnerabilities in Some ZTE Mobile Internet Products (CVSS 5.9, ZTE MC801A · ZTE MC801A1)
- [CVE-2023-25651](https://cve.now/CVE-2023-25651.md): SQL Injection Vulnerability in Some ZTE Mobile Internet Products (CVSS 4.3, ZTE Mobile Internet Products)
- [CVE-2023-25650](https://cve.now/CVE-2023-25650.md): Arbitrary File Download Vulnerability in ZTE ZXCLOUD iRAI (CVSS 6.5, ZTE ZXCLOUD iRAI)
- [CVE-2023-25648](https://cve.now/CVE-2023-25648.md): Weak Folder Permission Vulnerability in ZTE ZXCLOUD iRAI (CVSS 6.5, ZTE ZXCLOUD iRAI)
- [CVE-2023-6407](https://cve.now/CVE-2023-6407.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability exists that could cause arbitrary fi (CVSS 5.3, Schneider Electric Easy UPS Online Monitoring Software)
- [CVE-2023-5630](https://cve.now/CVE-2023-5630.md): A CWE-494: Download of Code Without Integrity Check vulnerability exists that could allow a privileged user to install an untrusted firmw (CVSS 6.5, Schneider Electric Trio Q-Series Ethernet Data Radio · S… +1)
- [CVE-2023-5629](https://cve.now/CVE-2023-5629.md): A CWE-601:URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability exists that could cause disclosure of information through phish (CVSS 8.2, Schneider Electric Trio Q-Series Ethernet Data Radio · S… +1)
- [CVE-2023-41719](https://cve.now/CVE-2023-41719.md): A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker impersonating an administrator may craft a sp (CVSS 7.2, Ivanti Connect Secure)
- [CVE-2023-41720](https://cve.now/CVE-2023-41720.md): A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker with a foothold on an Ivanti Connect Secure ( (CVSS 7.0, Ivanti Connect Secure)
- [CVE-2023-45184](https://cve.now/CVE-2023-45184.md): IBM i Access Client Solutions (CVSS 6.2, IBM i Access Client Solutions)
- [CVE-2023-43042](https://cve.now/CVE-2023-43042.md): IBM Storage Virtualize information disclosure (CVSS 7.5, IBM Storage Virtualize)
- [CVE-2022-43843](https://cve.now/CVE-2022-43843.md): IBM Spectrum Scale information disclosure (CVSS 5.9, IBM Spectrum Scale)
- [CVE-2023-31546](https://cve.now/CVE-2023-31546.md): Cross Site Scripting (XSS) vulnerability in DedeBIZ v6.0.3 allows attackers to run arbitrary code via the search feature. (no CVSS)
- [CVE-2023-41151](https://cve.now/CVE-2023-41151.md): An uncaught exception issue discovered in Softing OPC UA C++ SDK before 6.30 for Windows operating system may cause the application to crash (CVSS 7.5)
- [CVE-2023-44709](https://cve.now/CVE-2023-44709.md): PlutoSVG commit 336c02997277a1888e6ccbbbe674551a0582e5c4 and before was discovered to contain an integer overflow via the component plutosvg (CVSS 9.8)
- [CVE-2023-45894](https://cve.now/CVE-2023-45894.md): The Remote Application Server in Parallels RAS before 19.2.23975 does not segment virtualized applications from the server, which allows a r (no CVSS)
- [CVE-2023-46348](https://cve.now/CVE-2023-46348.md): SQL njection vulnerability in SunnyToo sturls before version 1.1.13, allows attackers to escalate privileges and obtain sensitive informatio (no CVSS)
- [CVE-2023-47261](https://cve.now/CVE-2023-47261.md): Dokmee ECM 7.4.6 allows remote code execution because the response to a GettingStarted/SaveSQLConnectionAsync /#/gettingstarted request cont (no CVSS)
- [CVE-2023-48049](https://cve.now/CVE-2023-48049.md): A SQL injection vulnerability in Cybrosys Techno Solutions Website Blog Search (aka website\_search\_blog) v. (no CVSS)
- [CVE-2023-48084](https://cve.now/CVE-2023-48084.md): Nagios XI before version 5.11.3 was discovered to contain a SQL injection vulnerability via the bulk modification tool. (no CVSS)
- [CVE-2023-48085](https://cve.now/CVE-2023-48085.md): Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command\_test.php. (CVSS 9.8)
- [CVE-2023-48925](https://cve.now/CVE-2023-48925.md): SQL injection vulnerability in Buy Addons bavideotab before version 1.0.6, allows attackers to escalate privileges and obtain sensitive info (no CVSS)
- [CVE-2023-49933](https://cve.now/CVE-2023-49933.md): An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. (no CVSS)
- [CVE-2023-49934](https://cve.now/CVE-2023-49934.md): An issue was discovered in SchedMD Slurm 23.11.x. (no CVSS)
- [CVE-2023-49935](https://cve.now/CVE-2023-49935.md): An issue was discovered in SchedMD Slurm 23.02.x and 23.11.x. (no CVSS)
- [CVE-2023-49936](https://cve.now/CVE-2023-49936.md): An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. (no CVSS)
- [CVE-2023-49937](https://cve.now/CVE-2023-49937.md): An issue was discovered in SchedMD Slurm 22.05.x, 23.02.x, and 23.11.x. (no CVSS)
- [CVE-2023-49938](https://cve.now/CVE-2023-49938.md): An issue was discovered in SchedMD Slurm 22.05.x and 23.02.x. (no CVSS)
- [CVE-2023-50011](https://cve.now/CVE-2023-50011.md): PopojiCMS version 2.0.1 is vulnerable to remote command execution in the Meta Social field. (no CVSS)
- [CVE-2023-50017](https://cve.now/CVE-2023-50017.md): Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin/database/backup (no CVSS)
- [CVE-2023-50073](https://cve.now/CVE-2023-50073.md): EmpireCMS v7.5 was discovered to contain a SQL injection vulnerability via the ftppassword parameter at SetEnews.php. (no CVSS)
- [CVE-2023-50100](https://cve.now/CVE-2023-50100.md): JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via carousel image editing. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-50101](https://cve.now/CVE-2023-50101.md): JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) via Label management editing. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-50102](https://cve.now/CVE-2023-50102.md): JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS). (no CVSS, com.jfinal:jfinal)
- [CVE-2023-50137](https://cve.now/CVE-2023-50137.md): JFinalcms 5.0.0 is vulnerable to Cross Site Scripting (XSS) in the site management office. (no CVSS, com.jfinal:jfinal)
- [CVE-2023-50471](https://cve.now/CVE-2023-50471.md): cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON\_InsertItemInArray at cJSON.c. (no CVSS)
- [CVE-2023-50472](https://cve.now/CVE-2023-50472.md): cJSON v1.7.16 was discovered to contain a segmentation violation via the function cJSON\_SetValuestring at cJSON.c. (no CVSS)
- [CVE-2023-50563](https://cve.now/CVE-2023-50563.md): Semcms v4.8 was discovered to contain a SQL injection vulnerability via the AID parameter at SEMCMS\_Function.php. (no CVSS)
- [CVE-2023-50564](https://cve.now/CVE-2023-50564.md): An arbitrary file upload vulnerability in the component /inc/modules\_install.php of Pluck-CMS v4.7.18 allows attackers to execute arbitrary (CVSS 8.8)
- [CVE-2023-50565](https://cve.now/CVE-2023-50565.md): A cross-site scripting (XSS) vulnerability in the component /logs/dopost.html in RPCMS v3.5.5 allows attackers to execute arbitrary web scri (no CVSS)
- [CVE-2023-50566](https://cve.now/CVE-2023-50566.md): A stored cross-site scripting (XSS) vulnerability in EyouCMS-V1.6.5-UTF8-SP1 allows attackers to execute arbitrary web scripts or HTML via a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.