# CVEs published 2023-12-17

27 CVEs were published on December 17, 2023: 1 critical, 3 high. Days are UTC.

- [CVE-2023-6905](https://cve.now/CVE-2023-6905.md): Jahastech NxFilter Bind Request ldap injection (CVSS 4.3, Jahastech NxFilter)
- [CVE-2023-3907](https://cve.now/CVE-2023-3907.md): Improper User Management in GitLab (CVSS 4.9, GitLab)
- [CVE-2023-6904](https://cve.now/CVE-2023-6904.md): Jahastech NxFilter config,admin.jsp cross-site request forgery (CVSS 4.3, Jahastech NxFilter)
- [CVE-2023-6903](https://cve.now/CVE-2023-6903.md): Netentsec NS-ASG Application Security Gateway sql injection (CVSS 7.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2023-6902](https://cve.now/CVE-2023-6902.md): codelyfe Stupid Simple CMS upload.php unrestricted upload (CVSS 5.5, codelyfe Stupid Simple CMS)
- [CVE-2023-50271](https://cve.now/CVE-2023-50271.md): HP-UX System Management Homepage, Disclosure of Information (CVSS 7.2, HPE System Management Homepage)
- [CVE-2023-6901](https://cve.now/CVE-2023-6901.md): codelyfe Stupid Simple CMS HTTP POST Request handle-command.php os command injection (CVSS 7.3, codelyfe Stupid Simple CMS)
- [CVE-2023-6900](https://cve.now/CVE-2023-6900.md): rmountjoy92 DashMachine delete\_file path traversal (CVSS 4.6, rmountjoy92 DashMachine)
- [CVE-2023-6899](https://cve.now/CVE-2023-6899.md): rmountjoy92 DashMachine Config save\_config code injection (CVSS 4.3, rmountjoy92 DashMachine)
- [CVE-2023-49834](https://cve.now/CVE-2023-49834.md): WordPress WOOCS – WooCommerce Currency Switcher Plugin \<= 1.4.1.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, realmag777 FOX – Currency Switcher Professional for WooComm…)
- [CVE-2023-49824](https://cve.now/CVE-2023-49824.md): WordPress Product Catalog Feed by PixelYourSite Plugin \<= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Product Catalog Feed by PixelYourSite)
- [CVE-2023-6898](https://cve.now/CVE-2023-6898.md): SourceCodester Best Courier Management System manage\_user.php sql injection (CVSS 5.5, SourceCodester Best Courier Management System)
- [CVE-2023-49816](https://cve.now/CVE-2023-49816.md): WordPress Fix My Feed RSS Repair Plugin \<= 1.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Innovative Solutions Fix My Feed RSS Repair)
- [CVE-2023-49775](https://cve.now/CVE-2023-49775.md): WordPress CSV Importer Plugin \<= 0.3.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Denis Kobozev CSV Importer)
- [CVE-2023-6896](https://cve.now/CVE-2023-6896.md): SourceCodester Simple Image Stack Website cross site scripting (CVSS 3.5, SourceCodester Simple Image Stack Website)
- [CVE-2023-49769](https://cve.now/CVE-2023-49769.md): WordPress Integrate Google Drive Plugin \<= 1.3.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, SoftLab Integrate Google Drive)
- [CVE-2023-49751](https://cve.now/CVE-2023-49751.md): WordPress Block for Font Awesome Plugin \<= 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Ciprian Popescu Block for Font Awesome)
- [CVE-2023-24380](https://cve.now/CVE-2023-24380.md): WordPress Simple Wp Sitemap Plugin \<= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Webbjocke Simple Wp Sitemap)
- [CVE-2023-6895](https://cve.now/CVE-2023-6895.md): Hikvision Intercom Broadcasting System ping.php os command injection (CVSS 6.3, Hikvision Intercom Broadcasting System)
- [CVE-2023-6894](https://cve.now/CVE-2023-6894.md): Hikvision Intercom Broadcasting System Log File system.html information disclosure (CVSS 4.3, Hikvision Intercom Broadcasting System)
- [CVE-2023-6893](https://cve.now/CVE-2023-6893.md): Hikvision Intercom Broadcasting System exportrecord.php path traversal (CVSS 4.3, Hikvision Intercom Broadcasting System)
- [CVE-2023-6891](https://cve.now/CVE-2023-6891.md): PeaZip Library dragdropfilesdll.dll uncontrolled search path (CVSS 5.3, PeaZip)
- [CVE-2023-6888](https://cve.now/CVE-2023-6888.md): PHZ76 RtspServer RtspMesaage.cpp ParseRequestLine stack-based overflow (CVSS 6.3, PHZ76 RtspServer)
- [CVE-2023-6887](https://cve.now/CVE-2023-6887.md): saysky ForestBlog Image Upload img unrestricted upload (CVSS 6.3, saysky ForestBlog)
- [CVE-2023-6886](https://cve.now/CVE-2023-6886.md): xnx3 wangmarket Role Management Page code injection (CVSS 4.7, xnx3 wangmarket · com.xnx3.wangmarket:wangmarket)
- [CVE-2023-50965](https://cve.now/CVE-2023-50965.md): In MicroHttpServer (aka Micro HTTP Server) through 4398570, \_ReadStaticFiles in lib/middleware.c allows a stack-based buffer overflow and po (no CVSS)
- [CVE-2023-50976](https://cve.now/CVE-2023-50976.md): Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.