# CVEs published 2023-12-19

117 CVEs were published on December 19, 2023: 20 critical, 31 high. Days are UTC.

- [CVE-2023-47161](https://cve.now/CVE-2023-47161.md): IBM UrbanCode Deploy denial of service (CVSS 5.3, IBM UrbanCode Deploy)
- [CVE-2023-42012](https://cve.now/CVE-2023-42012.md): IBM UrbanCode Deploy denial of service (CVSS 6.2, IBM UrbanCode Deploy)
- [CVE-2023-50706](https://cve.now/CVE-2023-50706.md): Improper Access Control in EFACEC UC 500E (CVSS 4.1, EFACEC UC)
- [CVE-2023-42013](https://cve.now/CVE-2023-42013.md): IBM UrbanCode Deploy information disclosure (CVSS 5.3, IBM UrbanCode Deploy)
- [CVE-2023-50705](https://cve.now/CVE-2023-50705.md): Exposure of Sensitive Information to an Unauthorized Actor in EFACEC UC 500E (CVSS 5.3, EFACEC UC)
- [CVE-2023-50704](https://cve.now/CVE-2023-50704.md): URL Redirection to Untrusted Site ('Open Redirect') in EFACEC UC 500E (CVSS 4.3, EFACEC UC)
- [CVE-2023-50703](https://cve.now/CVE-2023-50703.md): Cleartext Transmission of Sensitive Information in EFACEC UC 500E (CVSS 6.3, EFACEC UC)
- [CVE-2023-6689](https://cve.now/CVE-2023-6689.md): Cross-Site Request Forgery in EFACEC BCU 500 (CVSS 8.2, EFACEC BCU)
- [CVE-2023-50707](https://cve.now/CVE-2023-50707.md): Uncontrolled Resource Consumption in EFACEC BCU 500 (CVSS 9.6, EFACEC BCU)
- [CVE-2023-6930](https://cve.now/CVE-2023-6930.md): Improper Access Control in EuroTel ETL3100 (CVSS 9.4, EuroTel ETL3100)
- [CVE-2023-6929](https://cve.now/CVE-2023-6929.md): Authorization Bypass Through User-Controlled Key in EuroTel ETL3100 (CVSS 7.5, EuroTel ETL3100)
- [CVE-2023-6928](https://cve.now/CVE-2023-6928.md): Improper Restriction of Excessive Authentication Attempts (CVSS 9.8, EuroTel ETL3100)
- [CVE-2023-45172](https://cve.now/CVE-2023-45172.md): IBM AIX denial of service (CVSS 6.2, IBM AIX)
- [CVE-2023-47146](https://cve.now/CVE-2023-47146.md): IBM QRadar SIEM information disclosure (CVSS 4.9, IBM QRadar SIEM)
- [CVE-2023-38126](https://cve.now/CVE-2023-38126.md): Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability (CVSS 7.2, Softing edgeAggregator)
- [CVE-2023-50835](https://cve.now/CVE-2023-50835.md): WordPress Advanced Category Template Plugin \<= 0.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Praveen Goswami Advanced Category Template)
- [CVE-2023-49164](https://cve.now/CVE-2023-49164.md): WordPress Ocean Extra Plugin \<= 2.2.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, OceanWP Ocean Extra)
- [CVE-2023-46624](https://cve.now/CVE-2023-46624.md): WordPress Parcel Pro Plugin \<= 1.6.11 is vulnerable to Open Redirection (CVSS 4.7, Parcel Pro)
- [CVE-2022-43450](https://cve.now/CVE-2022-43450.md): WordPress Stream Plugin \<= 3.9.2 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 4.3, XWP Stream)
- [CVE-2023-42940](https://cve.now/CVE-2023-42940.md): A session rendering issue was addressed with improved session tracking. (CVSS 5.7, Apple macOS)
- [CVE-2023-49812](https://cve.now/CVE-2023-49812.md): WordPress WP Photo Album Plus Plugin \<= 8.5.02.005 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 5.3, J.N. Breetvelt a.k.a. OpaJaap WP Photo Album Plus)
- [CVE-2023-48327](https://cve.now/CVE-2023-48327.md): WordPress WC Vendors Marketplace Plugin \<= 2.4.7 is vulnerable to SQL Injection (CVSS 7.6, WC Vendors – WooCommerce Multi-Vendor, WooCommerce Marketpl…)
- [CVE-2023-48738](https://cve.now/CVE-2023-48738.md): WordPress Porto Theme - Functionality Plugin \< 2.12.1 is vulnerable to SQL Injection (CVSS 9.3, Porto Theme - Functionality)
- [CVE-2023-48741](https://cve.now/CVE-2023-48741.md): WordPress ChatBot Plugin \<= 4.7.8 is vulnerable to SQL Injection (CVSS 7.6, QuantumCloud AI ChatBot)
- [CVE-2023-48764](https://cve.now/CVE-2023-48764.md): WordPress WordPress Brute Force Protection – Stop Brute Force Attacks Plugin \<= 2.2.5 is vulnerable to SQL Injection (CVSS 7.6, GuardGiant Brute Force Protection WordPress Brute Force Pro…)
- [CVE-2023-49750](https://cve.now/CVE-2023-49750.md): WordPress Couponis Demo Plugin \< 2.2 is vulnerable to SQL Injection (CVSS 9.3, Spoonthemes Couponis - Affiliate & Submitting Coupons WordP…)
- [CVE-2023-49764](https://cve.now/CVE-2023-49764.md): WordPress Advanced Database Cleaner Plugin \<= 3.1.2 is vulnerable to SQL Injection (CVSS 7.6, Younes JFR. Advanced Database Cleaner)
- [CVE-2023-35883](https://cve.now/CVE-2023-35883.md): WordPress Core Web Vitals & PageSpeed Booster Plugin \<= 1.0.12 is vulnerable to Open Redirection (CVSS 4.7, Magazine3 Core Web Vitals & PageSpeed Booster)
- [CVE-2023-37982](https://cve.now/CVE-2023-37982.md): WordPress Integration for Contact Form 7 and Salesforce Plugin \<= 1.3.3 is vulnerable to Open Redirection (CVSS 4.7, CRM Perks Integration for Salesforce and Contact Form 7, WP…)
- [CVE-2023-38478](https://cve.now/CVE-2023-38478.md): WordPress Integration for WooCommerce and QuickBooks Plugin \<= 1.2.3 is vulnerable to Open Redirection (CVSS 4.7, CRM Perks Integration for WooCommerce and QuickBooks)
- [CVE-2023-38481](https://cve.now/CVE-2023-38481.md): WordPress Integration for WooCommerce and Zoho CRM Plugin \< 1.3.7 is vulnerable to Open Redirection (CVSS 4.7, CRM Perks Integration for WooCommerce and Zoho CRM, Books,…)
- [CVE-2023-40602](https://cve.now/CVE-2023-40602.md): WordPress Doofinder for WooCommerce Plugin \<= 1.5.49 is vulnerable to Open Redirection (CVSS 4.7, Doofinder WP & WooCommerce Search)
- [CVE-2023-41648](https://cve.now/CVE-2023-41648.md): WordPress Login and Logout Redirect Plugin \<= 2.0.3 is vulnerable to Open Redirection (CVSS 4.7, Swapnil V. Patil Login and Logout Redirect)
- [CVE-2023-43826](https://cve.now/CVE-2023-43826.md): Apache Guacamole: Integer overflow in handling of VNC image buffers (CVSS 7.5, Apache Software Foundation Apache Guacamole)
- [CVE-2023-45105](https://cve.now/CVE-2023-45105.md): WordPress affiliate-toolkit – WordPress Affiliate Plugin Plugin \<= 3.3.9 is vulnerable to Open Redirection (CVSS 4.7, SERVIT Software Solutions affiliate-toolkit – WordPress Aff…)
- [CVE-2023-34027](https://cve.now/CVE-2023-34027.md): WordPress Recently Viewed Products Plugin \<= 1.0.0 is vulnerable to PHP Object Injection (CVSS 8.3, Rajnish Arora Recently Viewed Products)
- [CVE-2023-34382](https://cve.now/CVE-2023-34382.md): WordPress Dokan Plugin \<= 3.7.19 is vulnerable to PHP Object Injection (CVSS 4.4, weDevs Dokan – Best WooCommerce Multivendor Marketplace Sol…)
- [CVE-2023-37390](https://cve.now/CVE-2023-37390.md): WordPress Themesflat Addons For Elementor Plugin \<= 2.0.0 is vulnerable to PHP Object Injection (CVSS 8.3, Themesflat Addons For Elementor)
- [CVE-2023-46220](https://cve.now/CVE-2023-46220.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Avalanche)
- [CVE-2023-46261](https://cve.now/CVE-2023-46261.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Avalanche)
- [CVE-2023-46260](https://cve.now/CVE-2023-46260.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 7.5, Ivanti Avalanche)
- [CVE-2023-46266](https://cve.now/CVE-2023-46266.md): An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. (CVSS 7.3, Ivanti Avalanche)
- [CVE-2023-46258](https://cve.now/CVE-2023-46258.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Avalanche)
- [CVE-2023-46803](https://cve.now/CVE-2023-46803.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 7.5, Ivanti Avalanche)
- [CVE-2023-46264](https://cve.now/CVE-2023-46264.md): An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t (CVSS 7.2, Ivanti Avalanche)
- [CVE-2023-46224](https://cve.now/CVE-2023-46224.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Avalanche)
- [CVE-2023-46262](https://cve.now/CVE-2023-46262.md): An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche R (CVSS 7.5, Ivanti Avalanche)
- [CVE-2023-46221](https://cve.now/CVE-2023-46221.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Avalanche)
- [CVE-2023-46216](https://cve.now/CVE-2023-46216.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Wavelink)
- [CVE-2023-46222](https://cve.now/CVE-2023-46222.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Avalanche)
- [CVE-2023-41727](https://cve.now/CVE-2023-41727.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Wavelink)
- [CVE-2023-46217](https://cve.now/CVE-2023-46217.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Wavelink)
- [CVE-2023-46265](https://cve.now/CVE-2023-46265.md): An unauthenticated could abuse a XXE vulnerability in the Smart Device Server to leak data or perform a Server-Side Request Forgery (SSRF). (CVSS 6.5, Ivanti Avalanche)
- [CVE-2023-46257](https://cve.now/CVE-2023-46257.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Avalanche)
- [CVE-2023-46804](https://cve.now/CVE-2023-46804.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 7.5, Ivanti Avalanche)
- [CVE-2023-46263](https://cve.now/CVE-2023-46263.md): An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker t (CVSS 7.2, Ivanti Avalanche)
- [CVE-2023-46225](https://cve.now/CVE-2023-46225.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Avalanche)
- [CVE-2023-46259](https://cve.now/CVE-2023-46259.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Avalanche)
- [CVE-2023-46223](https://cve.now/CVE-2023-46223.md): An attacker sending specially crafted data packets to the Mobile Device Server can cause memory corruption which could result to a Denial of (CVSS 9.8, Ivanti Avalanche)
- [CVE-2021-22962](https://cve.now/CVE-2021-22962.md): An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. (CVSS 7.3, Ivanti Avalanche)
- [CVE-2023-50272](https://cve.now/CVE-2023-50272.md): A potential security vulnerability has been identified in HPE Integrated Lights-Out 5 (iLO 5) and Integrated Lights-Out 6 (iLO 6). (CVSS 7.5, Hewlett Packard Enterprise (HPE) HPE Integrated Lights-out…)
- [CVE-2023-25715](https://cve.now/CVE-2023-25715.md): WordPress GamiPress Plugin \<= 2.5.6 is vulnerable to Broken Access Control (CVSS 5.4, GamiPress – The #1 gamification plugin to reward points, ac…)
- [CVE-2023-44991](https://cve.now/CVE-2023-44991.md): WordPress Media File Renamer Plugin \<= 5.6.9 is vulnerable to Sensitive Data Exposure (CVSS 6.5, Jordy Meow Media File Renamer: Rename Files)
- [CVE-2023-44983](https://cve.now/CVE-2023-44983.md): WordPress Aruba HiSpeed Cache Plugin \<= 2.0.6 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Aruba.it Aruba HiSpeed Cache)
- [CVE-2023-43870](https://cve.now/CVE-2023-43870.md): When installing the Net2 software a root certificate is installed into the trusted store. (CVSS 8.1, Paxton Net2)
- [CVE-2023-6280](https://cve.now/CVE-2023-6280.md): XML External Entity Reference on 52North WPS (CVSS 7.2, 52North WPS)
- [CVE-2023-6711](https://cve.now/CVE-2023-6711.md): Vulnerability exists in SCI IEC 60870-5-104 and HCI IEC 60870-5-104 that affects the RTU500 series product versions listed below. (CVSS 5.9, Hitachi Energy RTU500 series CMU Firmware)
- [CVE-2023-6913](https://cve.now/CVE-2023-6913.md): Session Hijacking on Imou Life app (CVSS 8.1, Imou Life app)
- [CVE-2023-1514](https://cve.now/CVE-2023-1514.md): A vulnerability exists in the component RTU500 Scripting interface. (CVSS 7.4, Hitachi Energy RTU500 Scripting Interface)
- [CVE-2023-6932](https://cve.now/CVE-2023-6932.md): Use-after-free in Linux kernel's ipv4: igmp component (CVSS 7.8, Linux Kernel)
- [CVE-2023-6931](https://cve.now/CVE-2023-6931.md): Out-of-bounds write in Linux kernel's Performance Events system component (CVSS 7.8, Linux Kernel)
- [CVE-2023-6873](https://cve.now/CVE-2023-6873.md): Memory safety bugs present in Firefox 120. (no CVSS, Mozilla Firefox)
- [CVE-2023-6872](https://cve.now/CVE-2023-6872.md): Browser tab titles were being leaked by GNOME to system logs. (no CVSS, Mozilla Firefox)
- [CVE-2023-6871](https://cve.now/CVE-2023-6871.md): Under certain conditions, Firefox did not display a warning when a user attempted to navigate to a new protocol handler. (no CVSS, Mozilla Firefox)
- [CVE-2023-6870](https://cve.now/CVE-2023-6870.md): Applications which spawn a Toast notification in a background thread may have obscured fullscreen notifications displayed by Firefox. (no CVSS, Mozilla Firefox)
- [CVE-2023-6869](https://cve.now/CVE-2023-6869.md): A \`&lt;dialog\>\` element could have been manipulated to paint content outside of a sandboxed iframe. (CVSS 6.5, Mozilla Firefox)
- [CVE-2023-6868](https://cve.now/CVE-2023-6868.md): In some instances, the user-agent would allow push requests which lacked a valid VAPID even though the push manager subscription defined one (no CVSS, Mozilla Firefox)
- [CVE-2023-6867](https://cve.now/CVE-2023-6867.md): The timing of a button click causing a popup to disappear was approximately the same length as the anti-clickjacking delay on permission pro (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2023-6866](https://cve.now/CVE-2023-6866.md): TypedArrays can be fallible and lacked proper exception handling. (CVSS 8.8, Mozilla Firefox)
- [CVE-2023-6865](https://cve.now/CVE-2023-6865.md): \`EncryptingOutputStream\` was susceptible to exposing uninitialized data. (no CVSS, Mozilla Firefox ESR · Mozilla Firefox)
- [CVE-2023-6135](https://cve.now/CVE-2023-6135.md): Multiple NSS NIST curves were susceptible to a side-channel attack known as "Minerva". (no CVSS, Mozilla Firefox)
- [CVE-2023-6864](https://cve.now/CVE-2023-6864.md): Memory safety bugs present in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2023-6863](https://cve.now/CVE-2023-6863.md): The \`ShutdownObserver()\` was susceptible to potentially undefined behavior due to its reliance on a dynamic type that lacked a virtual destr (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2023-6862](https://cve.now/CVE-2023-6862.md): A use-after-free was identified in the \`nsDNSService::Init\`. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird)
- [CVE-2023-6861](https://cve.now/CVE-2023-6861.md): The \`nsWindow::PickerOpen(void)\` method was susceptible to a heap buffer overflow when running in headless mode. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2023-6860](https://cve.now/CVE-2023-6860.md): The \`VideoBridge\` allowed any content process to use textures produced by remote decoders. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2023-6859](https://cve.now/CVE-2023-6859.md): A use-after-free condition affected TLS socket creation when under memory pressure. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2023-6858](https://cve.now/CVE-2023-6858.md): Firefox was susceptible to a heap buffer overflow in \`nsTextFragment\` due to insufficient OOM handling. (CVSS 8.8, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2023-6857](https://cve.now/CVE-2023-6857.md): When resolving a symlink, a race may occur where the buffer passed to \`readlink\` may actually be smaller than necessary. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2023-6856](https://cve.now/CVE-2023-6856.md): The WebGL \`DrawElementsInstanced\` method was susceptible to a heap buffer overflow when used on systems with the Mesa VM driver. (no CVSS, Mozilla Firefox ESR · Mozilla Thunderbird +1)
- [CVE-2023-50761](https://cve.now/CVE-2023-50761.md): The signature of a digitally signed S/MIME email message may optionally specify the signature creation date and time. (no CVSS, Mozilla Thunderbird)
- [CVE-2023-50762](https://cve.now/CVE-2023-50762.md): When processing a PGP/MIME payload that contains digitally signed text, the first paragraph of the text was never shown to the user. (no CVSS, Mozilla Thunderbird)
- [CVE-2019-25158](https://cve.now/CVE-2019-25158.md): pedroetb tts-api app.js onSpeechDone os command injection (CVSS 5.5, pedroetb tts-api · tts-api)
- [CVE-2023-6730](https://cve.now/CVE-2023-6730.md): Deserialization of Untrusted Data in huggingface/transformers (CVSS 9.0, huggingface/transformers · transformers)
- [CVE-2023-6945](https://cve.now/CVE-2023-6945.md): SourceCodester Online Student Management System edit-student-detail.php cross site scripting (CVSS 2.4, SourceCodester Online Student Management System)
- [CVE-2023-49734](https://cve.now/CVE-2023-49734.md): Apache Superset: Privilege Escalation Vulnerability (CVSS 7.7, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-49736](https://cve.now/CVE-2023-49736.md): Apache Superset: SQL Injection on where\_in JINJA macro (CVSS 6.5, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-46104](https://cve.now/CVE-2023-46104.md): Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (CVSS 6.5, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-50376](https://cve.now/CVE-2023-50376.md): WordPress Simple Membership Plugin \<= 4.3.8 is vulnerable to Unauth. Reflected Cross Site Scripting (XSS) (CVSS 7.1, smp7, wp.insider Simple Membership)
- [CVE-2023-5432](https://cve.now/CVE-2023-5432.md): Jquery news ticker \<= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, gopiplushotmailcom Jquery news ticker)
- [CVE-2023-5413](https://cve.now/CVE-2023-5413.md): Image horizontal reel scroll slideshow \<= 13.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, gopiplus Image horizontal reel scroll slideshow)
- [CVE-2023-42015](https://cve.now/CVE-2023-42015.md): IBM UrbanCode Deploy HTML injection (CVSS 4.3, IBM UrbanCode Deploy)
- [CVE-2019-25157](https://cve.now/CVE-2019-25157.md): Ethex Contracts Monthly Jackpot EthexJackpot.sol access control (CVSS 4.3, Ethex Contracts)
- [CVE-2014-125107](https://cve.now/CVE-2014-125107.md): Corveda PHPSandbox String protection mechanism (CVSS 4.3, Corveda PHPSandbox · corveda/phpsandbox)
- [CVE-2023-6488](https://cve.now/CVE-2023-6488.md): WP Shortcodes Plugin — Shortcodes Ultimate \<= 7.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2023-6940](https://cve.now/CVE-2023-6940.md): Command Injection (CVSS 9.0, mlflow/mlflow · mlflow)
- [CVE-2023-6315](https://cve.now/CVE-2023-6315.md): Out-of-bouds read vulnerability in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a s (CVSS 7.8, Panasonic Control FPWIN Pro)
- [CVE-2023-6314](https://cve.now/CVE-2023-6314.md): Stack-based buffer overflow in FPWin Pro version 7.7.0.0 and all previous versions may allow attackers to execute arbitrary code via a speci (CVSS 7.8, Panasonic Control FPWIN Pro)
- [CVE-2023-44982](https://cve.now/CVE-2023-44982.md): WordPress WP Retina 2x Plugin \<= 6.4.5 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Jordy Meow Perfect Images)
- [CVE-2023-45887](https://cve.now/CVE-2023-45887.md): DS Wireless Communication (DWC) with DWC\_VERSION\_3 and DWC\_VERSION\_11 allows remote attackers to execute arbitrary code on a game-playing cl (no CVSS)
- [CVE-2023-47267](https://cve.now/CVE-2023-47267.md): An issue discovered in TheGreenBow Windows Enterprise Certified VPN Client 6.52, Windows Standard VPN Client 6.87, and Windows Enterprise VP (no CVSS)
- [CVE-2023-49004](https://cve.now/CVE-2023-49004.md): An issue in D-Link DIR-850L v.B1\_FW223WWb01 allows a remote attacker to execute arbitrary code via a crafted script to the en parameter. (no CVSS)
- [CVE-2023-49006](https://cve.now/CVE-2023-49006.md): Cross Site Request Forgery (CSRF) vulnerability in Phpsysinfo version 3.4.3 allows a remote attacker to obtain sensitive information via a c (no CVSS, phpsysinfo/phpsysinfo)
- [CVE-2023-49147](https://cve.now/CVE-2023-49147.md): An issue was discovered in PDF24 Creator 11.14.0. (no CVSS)
- [CVE-2023-49489](https://cve.now/CVE-2023-49489.md): Reflective Cross Site Scripting (XSS) vulnerability in KodExplorer version 4.51, allows attackers to obtain sensitive information and escala (CVSS 6.1)
- [CVE-2023-49706](https://cve.now/CVE-2023-49706.md): Defective request context handling in Self Service in LinOTP 3.x before 3.2.5 allows remote unauthenticated attackers to escalate privileges (no CVSS)
- [CVE-2023-50466](https://cve.now/CVE-2023-50466.md): An authenticated command injection vulnerability in Weintek cMT2078X easyweb Web Version v2.1.3, OS v20220215 allows attackers to execute ar (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.