# CVEs published 2023-12-16

19 CVEs were published on December 16, 2023: 1 critical, 4 high. Days are UTC.

- [CVE-2023-6885](https://cve.now/CVE-2023-6885.md): Tongda OA 2017 delete.php sql injection (CVSS 5.5, Tongda OA)
- [CVE-2023-6559](https://cve.now/CVE-2023-6559.md): MW WP Form \<= 5.0.3 - Improper Limitation of File Name to Unauthenticated Arbitrary File Deletion (CVSS 7.5, inc2734 MW WP Form)
- [CVE-2023-6853](https://cve.now/CVE-2023-6853.md): kalcaddle KodExplorer app.php index server-side request forgery (CVSS 6.3, kalcaddle KodExplorer)
- [CVE-2023-6852](https://cve.now/CVE-2023-6852.md): kalcaddle KodExplorer app.php server-side request forgery (CVSS 6.3, kalcaddle KodExplorer)
- [CVE-2023-6851](https://cve.now/CVE-2023-6851.md): kalcaddle KodExplorer ZIP Archive app.php unzipList code injection (CVSS 6.3, kalcaddle KodExplorer)
- [CVE-2023-6890](https://cve.now/CVE-2023-6890.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 5.4, thorsten/phpmyfaq)
- [CVE-2023-6889](https://cve.now/CVE-2023-6889.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 5.4, thorsten/phpmyfaq)
- [CVE-2023-6850](https://cve.now/CVE-2023-6850.md): kalcaddle KodExplorer API Endpoint unrestricted upload (CVSS 6.3, kalcaddle KodExplorer)
- [CVE-2023-6849](https://cve.now/CVE-2023-6849.md): kalcaddle kodbox app.php cover server-side request forgery (CVSS 7.3, kalcaddle kodbox)
- [CVE-2023-6848](https://cve.now/CVE-2023-6848.md): kalcaddle kodbox index.class.php check command injection (CVSS 7.3, kalcaddle kodbox)
- [CVE-2023-39340](https://cve.now/CVE-2023-39340.md): A vulnerability exists on all versions of Ivanti Connect Secure below 22.6R2 where an attacker can send a specific request which may lead to (CVSS 7.5, Ivanti Connect Secure)
- [CVE-2020-17483](https://cve.now/CVE-2020-17483.md): An improper access control vulnerability exists in Uffizio's GPS Tracker all versions that lead to sensitive information disclosure of all t (no CVSS)
- [CVE-2020-17484](https://cve.now/CVE-2020-17484.md): An Open Redirection vulnerability exists in Uffizio's GPS Tracker all versions allows an attacker to construct a URL within the application (no CVSS)
- [CVE-2020-17485](https://cve.now/CVE-2020-17485.md): A Remote Code Execution vulnerability exist in Uffizio's GPS Tracker all versions. (no CVSS)
- [CVE-2021-42794](https://cve.now/CVE-2021-42794.md): An issue was discovered in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior. (CVSS 5.3)
- [CVE-2021-42796](https://cve.now/CVE-2021-42796.md): An issue was discovered in ExecuteCommand() in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior that allows unauthenticate (CVSS 9.8)
- [CVE-2021-42797](https://cve.now/CVE-2021-42797.md): Path traversal vulnerability in AVEVA Edge (formerly InduSoft Web Studio) versions R2020 and prior allows an unauthenticated user to steal t (no CVSS)
- [CVE-2022-24351](https://cve.now/CVE-2022-24351.md): TOCTOU race-condition vulnerability in Insyde InsydeH2O with Kernel 5.2 before version 05.27.29, Kernel 5.3 before version 05.36.29, Kernel (no CVSS)
- [CVE-2023-50784](https://cve.now/CVE-2023-50784.md): A buffer overflow in websockets in UnrealIRCd 6.1.0 through 6.1.3 before 6.1.4 allows an unauthenticated remote attacker to crash the server (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.