CVEs published December 20, 2023
115 CVEs were published on December 20, 2023: 29 critical, 38 high.
- Published
- 115
- Critical
- 29
- High
- 38
- Medium
- 32
- Low
- 1
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Adobe Experience Manager
- 6
- IBM Security Guardium Key Lifecycle Manager
- 6
- Kashipara Group Hotel Management
- 4
- mlflow/mlflow · mlflow
- 4
- Kashipara Group Student Information System
- 3
- WooCommerce AutomateWoo
- 3
- Amazing Little poll
- 2
- Automattic WooPayments – Fully Integrated Solution Built an…
- 2
- M-Files Server
- 2
- Projectworlds Pvt. Limited Online Voting System Project
- 2
Critical 29
- CVE-2023-48434Online Voting System Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Voting System Project
- CVE-2023-48433Online Voting System Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Projectworlds Pvt. Limited Online Voting System Project
- CVE-2023-23970WordPress Corsa Theme <= 1.5 is vulnerable to Arbitrary File UploadWooRockets Corsa
- CVE-2023-25970WordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to Arbitrary File UploadZendrop – Global Dropshipping
- CVE-2023-28170WordPress Theme Demo Import Plugin <= 1.1.1 is vulnerable to Arbitrary File UploadThemely Theme Demo Import
- CVE-2023-29102WordPress Olive One Click Demo Import Plugin <= 1.1.1 is vulnerable to Arbitrary File UploadOlive Themes Olive One Click Demo Import
- CVE-2023-29384WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.0 is vulnerable to Arbitrary File UploadHM Plugin WordPress Job Board and Recruitment Plugin – JobWP
- CVE-2023-31215WordPress Dropshipping & Affiliation with Amazon Plugin <= 2.1.2 is vulnerable to Arbitrary File UploadAmaderCode Lab Dropshipping & Affiliation with Amazon
- CVE-2023-31231WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.65 is vulnerable to Arbitrary File UploadUnlimited Elements For Elementor
- CVE-2023-33318WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.40 is vulnerable to Arbitrary File UploadWooCommerce AutomateWoo
- CVE-2023-34007WordPress Download Monitor Plugin <= 4.8.3 is vulnerable to Arbitrary File UploadWPChill Download Monitor
- CVE-2023-34385WordPress Export Import Menus Plugin <= 1.8.0 is vulnerable to Arbitrary File UploadAkshay Menariya Export Import Menus
- CVE-2023-40204WordPress Folders Plugin <= 2.9.2 is vulnerable to Arbitrary File UploadPremio Folders – Unlimited Folders to Organize Media Librar…
- CVE-2023-45603WordPress User Submitted Posts Plugin <= 20230902 is vulnerable to Arbitrary File UploadJeff Starr User Submitted Posts – Enable Users to Submit Po…
- CVE-2023-46149WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to Arbitrary File UploadThemify Ultra
- CVE-2023-49814WordPress Symbiostock Lite Plugin <= 6.0.0 is vulnerable to Arbitrary File UploadSymbiostock
- CVE-2023-49752WordPress Adifier System Plugin < 3.1.4 is vulnerable to SQL InjectionSpoon themes Adifier - Classified Ads WordPress Theme
- CVE-2023-7018Deserialization of Untrusted Data in huggingface/transformershuggingface/transformers · transformers
- CVE-2023-49776WordPress Sayfa Sayaç Plugin <= 2.6 is vulnerable to SQL InjectionHakan Demiray Sayfa Sayac
- CVE-2023-49773WordPress BCorp Shortcodes Plugin <= 0.23 is vulnerable to PHP Object InjectionTim Brattberg BCorp Shortcodes
- CVE-2023-49772WordPress Genesis Simple Love Plugin <= 2.0 is vulnerable to PHP Object InjectionPhpbits Creative Studio Genesis Simple Love
- CVE-2023-40010WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin <= 1.3.4.2 is vulnerable to SQL Injectionrealmag777 HUSKY – Products Filter for WooCommerce Professi…
- CVE-2023-32590WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL InjectionDaniel Söderström / Sidney van de Stouwe Subscribe to Categ…
- CVE-2023-6768Authentication bypass vulnerability in Amazing Little PollAmazing Little poll
- CVE-2023-6977Path Traversal: '\..\filename'mlflow/mlflow · mlflow
- CVE-2023-6975Path Traversal: '\..\filename'mlflow/mlflow · mlflow
- CVE-2023-27172Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens.
- CVE-2023-47990SQL Injection vulnerability in components/table_manager/html/edit_admin_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL com
- CVE-2023-49032An issue in LTB Self Service Password before v.1.5.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via
High 38
- CVE-2023-47784WordPress Slider Revolution Plugin <= 6.6.15 is vulnerable to Arbitrary File UploadThemePunch OHG Slider Revolution
- CVE-2023-49166WordPress MSync Plugin <= 1.0.0 is vulnerable to SQL InjectionMagic Logix MSync
- CVE-2023-49161WordPress Bravo Translate Plugin <= 1.2 is vulnerable to SQL InjectionGuelben Bravo Translate
- CVE-2023-26525WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL InjectionweDevs Dokan – Best WooCommerce Multivendor Marketplace Sol…
- CVE-2023-28788WordPress Advanced Page Visit Counter Plugin <= 6.4.2 is vulnerable to SQL InjectionAdvanced Page Visit Counter – Most Wanted Analytics Plugin…
- CVE-2023-29096WordPress Contact Form to DB by BestWebSoft Plugin <= 1.7.0 is vulnerable to SQL InjectionContact Form to DB by BestWebSoft – Messages Database Plugi…
- CVE-2023-29432WordPress Houzez Theme < 2.8.3 is vulnerable to SQL InjectionFavethemes Houzez - Real Estate WordPress Theme
- CVE-2023-30495WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL InjectionThemefic Ultimate Addons for Contact Form
- CVE-2023-30750WordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL InjectionCreativeMindsSolutions CM Popup Plugin for WordPress
- CVE-2023-30872WordPress BSK Forms Blacklist Plugin <= 3.6.2 is vulnerable to SQL InjectionBannerSky BSK Forms Blacklist
- CVE-2023-47118Heap buffer overflow in T64 codec decompressionClickHouse
- CVE-2023-5007Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)Kashipara Group Student Information System
- CVE-2023-5011Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)Kashipara Group Student Information System
- CVE-2023-32743WordPress AutomateWoo Plugin <= 5.7.1 is vulnerable to SQL InjectionWooCommerce AutomateWoo
- CVE-2023-5010Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi)Kashipara Group Student Information System
- CVE-2023-33209WordPress SEO Change Monitor Plugin <= 1.2 is vulnerable to SQL InjectionCrawlSpider SEO Change Monitor – Track Website Changes
- CVE-2023-33330WordPress WooCommerce Follow-Up Emails Plugin <= 4.9.50 is vulnerable to SQL InjectionWooCommerce AutomateWoo
- CVE-2023-49825WordPress Soledad Theme <= 8.4.1 is vulnerable to SQL InjectionPenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCo…
- CVE-2023-35914WordPress WooCommerce Subscriptions Plugin <= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce Woo Subscriptions
- CVE-2023-35915WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to SQL InjectionAutomattic WooPayments – Fully Integrated Solution Built an…
- CVE-2023-35916WordPress WooCommerce Payments Plugin <= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR)Automattic WooPayments – Fully Integrated Solution Built an…
- CVE-2023-47852WordPress Link Whisper Free Plugin <= 0.6.5 is vulnerable to SQL InjectionLink Whisper Free
- CVE-2023-28782WordPress Gravity Forms Plugin <= 2.7.3 is vulnerable to PHP Object InjectionRocketgenius Gravity Forms
- CVE-2023-35876WordPress WooCommerce Square Plugin <= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce Square
- CVE-2023-37871WordPress WooCommerce GoCardless Gateway Plugin <= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce GoCardless
- CVE-2023-50249Sentry's Astro SDK vulnerable to ReDoSgetsentry sentry-javascript · @sentry/astro
- CVE-2023-38519WordPress MainWP Plugin <= 4.4.3.3 is vulnerable to SQL InjectionMainWP Dashboard – WordPress Manager for Multiple Websites…
- CVE-2023-40555WordPress Flatsome Theme <= 3.17.5 is vulnerable to PHP Object InjectionUX-themes Flatsome | Multi-Purpose Responsive WooCommerce T…
- CVE-2023-46147WordPress Themify Ultra Theme <= 7.3.5 is vulnerable to PHP Object InjectionThemify Ultra
- CVE-2023-47236WordPress iPages Flipbook Plugin <= 1.4.8 is vulnerable to SQL InjectionAvirtum iPages Flipbook For WordPress
- CVE-2023-47507WordPress Master Slider Pro Plugin <= 3.6.5 is vulnerable to PHP Object InjectionMaster Slider Pro
- CVE-2023-6562JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if thKakadu Software Pty Kakadu SDK
- CVE-2023-6912Brute force vulnerability in M-Files user authenticationM-Files Server
- CVE-2023-37544Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoSApache Software Foundation Apache Pulsar WebSocket Proxy ·…
- CVE-2023-0011Command Execution through Serial Interface of u-blox TOBY-L2u-blox TOBY-L2
- CVE-2023-6976Unrestricted Upload of File with Dangerous Typemlflow/mlflow · mlflow
- CVE-2023-6974Server-Side Request Forgery (SSRF)mlflow/mlflow · mlflow
- CVE-2023-50986Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function.
Medium, low and unrated 48
- CVE-2023-45703HCL Launch is susceptible to a Denial of Service vulnerabilityHCL Software HCL Launch
- CVE-2023-51390Information Disclosure Vulnerability in JournalpumpAiven-Open journalpump
- CVE-2023-46131Grails® data binding causes JVM crash and/or DoS grails-core · org.grails:grails-databinding
- CVE-2022-44684Windows Local Session Manager (LSM) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-49272Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)Kashipara Group Hotel Management
- CVE-2023-49271Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)Kashipara Group Hotel Management
- CVE-2023-49270Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)Kashipara Group Hotel Management
- CVE-2022-47597WordPress Popup Maker Plugin <= 1.17.1 is vulnerable to Sensitive Data ExposurePopup Maker – Popup for opt-ins, lead gen, & more
- CVE-2022-47599WordPress File Manager Plugin <= 5.2.7 is vulnerable to PHP Object InjectionFile Manager by Bit Form Team File Manager – 100% Free & Op…
- CVE-2023-49269Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS)Kashipara Group Hotel Management
- CVE-2023-28491WordPress Slideshow Gallery Plugin <= 1.7.6 is vulnerable to SQL InjectionTribulant Slideshow Gallery LITE
- CVE-2023-31092WordPress Easy Bet Plugin <= 1.0.2 is vulnerable to SQL InjectionFoxskav Easy Bet
- CVE-2023-32128WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations Plugin <= 2.2.7 is vulnerable to SQL InjectionAdastra Crypto Cryptocurrency Payment & Donation Box – Acce…
- CVE-2023-3742Insufficient policy enforcement in ADB in Google Chrome on ChromeOS prior to 114.0.5735.90 allowed a local attacker to bypass device policy Google Chrome
- CVE-2023-35895IBM Informix JDBC code executionIBM Informix JDBC
- CVE-2023-36520WordPress Editorial Calendar Plugin <= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR)MarketingFire Editorial Calendar
- CVE-2023-51458Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-51462Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-51460Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-51461Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-51457Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-51459Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-6784Potential Use of the Sitefinity System for Distribution of Phishing EmailsProgress Software Sitefinity
- CVE-2023-38513WordPress Photo Engine Plugin <= 6.2.5 is vulnerable to Insecure Direct Object References (IDOR)Jordy Meow Photo Engine
- CVE-2023-41796WordPress Sunshine Photo Cart Plugin < 3.0.0 is vulnerable to Insecure Direct Object References (IDOR)WP Sunshine Sunshine Photo Cart: Free Client Galleries for…
- CVE-2023-46311WordPress wpDiscuz Plugin <= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR)gVectors Team Comments – wpDiscuz
- CVE-2023-6769Stored XSS vulnerability in Amazing Little PollAmazing Little poll
- CVE-2023-6910Uncontrolled Resource Consumption in M-Files ServerM-Files Server
- CVE-2023-47707IBM Security Guardium Key Lifecycle Manager cross-site scriptingIBM Security Guardium Key Lifecycle Manager
- CVE-2023-47703IBM Security Guardium Key Lifecycle Manager information disclosureIBM Security Guardium Key Lifecycle Manager
- CVE-2023-47702IBM Security Guardium Key Lifecycle Manager directory traversalIBM Security Guardium Key Lifecycle Manager
- CVE-2023-47706IBM Security Guardium Key Lifecycle Manager file uploadIBM Security Guardium Key Lifecycle Manager
- CVE-2023-47705IBM Security Guardium Key Lifecycle Manager improper input validationIBM Security Guardium Key Lifecycle Manager
- CVE-2023-47704IBM Security Guardium Key Lifecycle Manager information disclosureIBM Security Guardium Key Lifecycle Manager
- CVE-2023-41166An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 thro
- CVE-2023-47093An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0.
- CVE-2023-50044Cesanta MJS 2.20.0 has a getprop_builtin_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string.
- CVE-2023-50628Buffer Overflow vulnerability in libming version 0.4.8, allows attackers to execute arbitrary code and obtain sensitive information via pars
- CVE-2023-50639Cross Site Scripting (XSS) vulnerability in CuteHttpFileServer v.1.0 and v.2.0 allows attackers to obtain sensitive information via the file
- CVE-2023-50983Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function.
- CVE-2023-50984Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the ip parameter in the spdtstConfigAndStart function.
- CVE-2023-50985Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the lanGw parameter in the lanCfgSet function.
- CVE-2023-50987Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysTimeInfoSet function.
- CVE-2023-50988Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the bandwidth parameter in the wifiRadioSetIndoor function.
- CVE-2023-50989Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function.
- CVE-2023-50990Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the rebootTime parameter in the sysScheduleRebootSet function.
- CVE-2023-50992Tenda i29 v1.0 V1.0.0.5 was discovered to contain a stack overflow via the ip parameter in the setPing function.
- CVE-2023-50993Ruijie WS6008 v1.x v2.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 and WS6108 v1.x AC_RGOS11.9(6)W3B2_G2C6-01_10221911 was discovered to contain a