CVEs published December 16, 2023
19 CVEs were published on December 16, 2023: 1 critical, 4 high.
- Published
- 19
- Critical
- 1
- High
- 4
- Medium
- 8
- Low
- 0
- Unrated
- 6
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- kalcaddle KodExplorer
- 4
- kalcaddle kodbox
- 2
- thorsten/phpmyfaq
- 2
- inc2734 MW WP Form
- 1
- Ivanti Connect Secure
- 1
- Tongda OA
- 1
Critical 1
High 4
- CVE-2023-6559MW WP Form <= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletioninc2734 MW WP Form
- CVE-2023-6849kalcaddle kodbox app.php cover server-side request forgerykalcaddle kodbox
- CVE-2023-6848kalcaddle kodbox index.class.php check command injectionkalcaddle kodbox
- CVE-2023-39340A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead toIvanti Connect Secure
Medium, low and unrated 14
- CVE-2023-6885Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-6853kalcaddle KodExplorer app.php index server-side request forgerykalcaddle KodExplorer
- CVE-2023-6852kalcaddle KodExplorer app.php server-side request forgerykalcaddle KodExplorer
- CVE-2023-6851kalcaddle KodExplorer ZIP Archive app.php unzipList code injectionkalcaddle KodExplorer
- CVE-2023-6890Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-6889Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-6850kalcaddle KodExplorer API Endpoint unrestricted uploadkalcaddle KodExplorer
- CVE-2020-17483An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all t
- CVE-2020-17484An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application
- CVE-2020-17485A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions.
- CVE-2021-42794An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior.
- CVE-2021-42797Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal t
- CVE-2022-24351TOCTOU race-condition vulnerability in Insyde InsydeH2O with Kernel 5.2 before version 05.27.29, Kernel 5.3 before version 05.36.29, Kernel
- CVE-2023-50784A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server