# CVEs published 2023-12-20

115 CVEs were published on December 20, 2023: 29 critical, 38 high. Days are UTC.

- [CVE-2023-45703](https://cve.now/CVE-2023-45703.md): HCL Launch is susceptible to a Denial of Service vulnerability (CVSS 5.3, HCL Software HCL Launch)
- [CVE-2023-51390](https://cve.now/CVE-2023-51390.md): Information Disclosure Vulnerability in Journalpump (CVSS 6.5, Aiven-Open journalpump)
- [CVE-2023-46131](https://cve.now/CVE-2023-46131.md): Grails® data binding causes JVM crash and/or DoS (CVSS 6.5, grails-core · org.grails:grails-databinding)
- [CVE-2023-48434](https://cve.now/CVE-2023-48434.md): Online Voting System Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Voting System Project)
- [CVE-2023-48433](https://cve.now/CVE-2023-48433.md): Online Voting System Project v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Projectworlds Pvt. Limited Online Voting System Project)
- [CVE-2022-44684](https://cve.now/CVE-2022-44684.md): Windows Local Session Manager (LSM) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2023-49272](https://cve.now/CVE-2023-49272.md): Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS) (CVSS 5.4, Kashipara Group Hotel Management)
- [CVE-2023-23970](https://cve.now/CVE-2023-23970.md): WordPress Corsa Theme \<= 1.5 is vulnerable to Arbitrary File Upload (CVSS 9.9, WooRockets Corsa)
- [CVE-2023-49271](https://cve.now/CVE-2023-49271.md): Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS) (CVSS 5.4, Kashipara Group Hotel Management)
- [CVE-2023-49270](https://cve.now/CVE-2023-49270.md): Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS) (CVSS 5.4, Kashipara Group Hotel Management)
- [CVE-2023-25970](https://cve.now/CVE-2023-25970.md): WordPress Zendrop – Global Dropshipping Plugin \<= 1.0.0 is vulnerable to Arbitrary File Upload (CVSS 10.0, Zendrop – Global Dropshipping)
- [CVE-2023-28170](https://cve.now/CVE-2023-28170.md): WordPress Theme Demo Import Plugin \<= 1.1.1 is vulnerable to Arbitrary File Upload (CVSS 9.1, Themely Theme Demo Import)
- [CVE-2023-29102](https://cve.now/CVE-2023-29102.md): WordPress Olive One Click Demo Import Plugin \<= 1.1.1 is vulnerable to Arbitrary File Upload (CVSS 9.1, Olive Themes Olive One Click Demo Import)
- [CVE-2023-29384](https://cve.now/CVE-2023-29384.md): WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin \<= 2.0 is vulnerable to Arbitrary File Upload (CVSS 10.0, HM Plugin WordPress Job Board and Recruitment Plugin – JobWP)
- [CVE-2023-31215](https://cve.now/CVE-2023-31215.md): WordPress Dropshipping & Affiliation with Amazon Plugin \<= 2.1.2 is vulnerable to Arbitrary File Upload (CVSS 9.9, AmaderCode Lab Dropshipping & Affiliation with Amazon)
- [CVE-2023-31231](https://cve.now/CVE-2023-31231.md): WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin \<= 1.5.65 is vulnerable to Arbitrary File Upload (CVSS 9.9, Unlimited Elements For Elementor)
- [CVE-2023-33318](https://cve.now/CVE-2023-33318.md): WordPress WooCommerce Follow-Up Emails Plugin \<= 4.9.40 is vulnerable to Arbitrary File Upload (CVSS 9.9, WooCommerce AutomateWoo)
- [CVE-2023-34007](https://cve.now/CVE-2023-34007.md): WordPress Download Monitor Plugin \<= 4.8.3 is vulnerable to Arbitrary File Upload (CVSS 9.9, WPChill Download Monitor)
- [CVE-2023-34385](https://cve.now/CVE-2023-34385.md): WordPress Export Import Menus Plugin \<= 1.8.0 is vulnerable to Arbitrary File Upload (CVSS 9.9, Akshay Menariya Export Import Menus)
- [CVE-2023-40204](https://cve.now/CVE-2023-40204.md): WordPress Folders Plugin \<= 2.9.2 is vulnerable to Arbitrary File Upload (CVSS 9.1, Premio Folders – Unlimited Folders to Organize Media Librar…)
- [CVE-2023-45603](https://cve.now/CVE-2023-45603.md): WordPress User Submitted Posts Plugin \<= 20230902 is vulnerable to Arbitrary File Upload (CVSS 9.0, Jeff Starr User Submitted Posts – Enable Users to Submit Po…)
- [CVE-2023-46149](https://cve.now/CVE-2023-46149.md): WordPress Themify Ultra Theme \<= 7.3.5 is vulnerable to Arbitrary File Upload (CVSS 9.9, Themify Ultra)
- [CVE-2023-47784](https://cve.now/CVE-2023-47784.md): WordPress Slider Revolution Plugin \<= 6.6.15 is vulnerable to Arbitrary File Upload (CVSS 8.4, ThemePunch OHG Slider Revolution)
- [CVE-2023-49814](https://cve.now/CVE-2023-49814.md): WordPress Symbiostock Lite Plugin \<= 6.0.0 is vulnerable to Arbitrary File Upload (CVSS 9.1, Symbiostock)
- [CVE-2022-47597](https://cve.now/CVE-2022-47597.md): WordPress Popup Maker Plugin \<= 1.17.1 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Popup Maker – Popup for opt-ins, lead gen, & more)
- [CVE-2022-47599](https://cve.now/CVE-2022-47599.md): WordPress File Manager Plugin \<= 5.2.7 is vulnerable to PHP Object Injection (CVSS 5.5, File Manager by Bit Form Team File Manager – 100% Free & Op…)
- [CVE-2023-49269](https://cve.now/CVE-2023-49269.md): Hotel Management v1.0 - Multiple Reflected Cross-Site Scripting (XSS) (CVSS 5.4, Kashipara Group Hotel Management)
- [CVE-2023-49752](https://cve.now/CVE-2023-49752.md): WordPress Adifier System Plugin \< 3.1.4 is vulnerable to SQL Injection (CVSS 9.3, Spoon themes Adifier - Classified Ads WordPress Theme)
- [CVE-2023-49166](https://cve.now/CVE-2023-49166.md): WordPress MSync Plugin \<= 1.0.0 is vulnerable to SQL Injection (CVSS 7.6, Magic Logix MSync)
- [CVE-2023-49161](https://cve.now/CVE-2023-49161.md): WordPress Bravo Translate Plugin \<= 1.2 is vulnerable to SQL Injection (CVSS 7.6, Guelben Bravo Translate)
- [CVE-2023-26525](https://cve.now/CVE-2023-26525.md): WordPress Dokan Plugin \<= 3.7.12 is vulnerable to SQL Injection (CVSS 7.1, weDevs Dokan – Best WooCommerce Multivendor Marketplace Sol…)
- [CVE-2023-28491](https://cve.now/CVE-2023-28491.md): WordPress Slideshow Gallery Plugin \<= 1.7.6 is vulnerable to SQL Injection (CVSS 6.7, Tribulant Slideshow Gallery LITE)
- [CVE-2023-28788](https://cve.now/CVE-2023-28788.md): WordPress Advanced Page Visit Counter Plugin \<= 6.4.2 is vulnerable to SQL Injection (CVSS 7.1, Advanced Page Visit Counter – Most Wanted Analytics Plugin…)
- [CVE-2023-29096](https://cve.now/CVE-2023-29096.md): WordPress Contact Form to DB by BestWebSoft Plugin \<= 1.7.0 is vulnerable to SQL Injection (CVSS 8.5, Contact Form to DB by BestWebSoft – Messages Database Plugi…)
- [CVE-2023-29432](https://cve.now/CVE-2023-29432.md): WordPress Houzez Theme \< 2.8.3 is vulnerable to SQL Injection (CVSS 8.2, Favethemes Houzez - Real Estate WordPress Theme)
- [CVE-2023-30495](https://cve.now/CVE-2023-30495.md): WordPress Ultimate Addons for Contact Form 7 Plugin \<= 3.1.23 is vulnerable to SQL Injection (CVSS 8.5, Themefic Ultimate Addons for Contact Form)
- [CVE-2023-30750](https://cve.now/CVE-2023-30750.md): WordPress CM Pop-Up banners Plugin \<= 1.5.10 is vulnerable to SQL Injection (CVSS 8.5, CreativeMindsSolutions CM Popup Plugin for WordPress)
- [CVE-2023-30872](https://cve.now/CVE-2023-30872.md): WordPress BSK Forms Blacklist Plugin \<= 3.6.2 is vulnerable to SQL Injection (CVSS 7.6, BannerSky BSK Forms Blacklist)
- [CVE-2023-47118](https://cve.now/CVE-2023-47118.md): Heap buffer overflow in T64 codec decompression (CVSS 7.0, ClickHouse)
- [CVE-2023-7018](https://cve.now/CVE-2023-7018.md): Deserialization of Untrusted Data in huggingface/transformers (CVSS 9.6, huggingface/transformers · transformers)
- [CVE-2023-31092](https://cve.now/CVE-2023-31092.md): WordPress Easy Bet Plugin \<= 1.0.2 is vulnerable to SQL Injection (CVSS 5.5, Foxskav Easy Bet)
- [CVE-2023-32128](https://cve.now/CVE-2023-32128.md): WordPress Cryptocurrency Donation Box – Bitcoin & Crypto Donations Plugin \<= 2.2.7 is vulnerable to SQL Injection (CVSS 5.5, Adastra Crypto Cryptocurrency Payment & Donation Box – Acce…)
- [CVE-2023-5007](https://cve.now/CVE-2023-5007.md): Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi) (CVSS 8.8, Kashipara Group Student Information System)
- [CVE-2023-5011](https://cve.now/CVE-2023-5011.md): Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi) (CVSS 8.8, Kashipara Group Student Information System)
- [CVE-2023-32743](https://cve.now/CVE-2023-32743.md): WordPress AutomateWoo Plugin \<= 5.7.1 is vulnerable to SQL Injection (CVSS 7.6, WooCommerce AutomateWoo)
- [CVE-2023-5010](https://cve.now/CVE-2023-5010.md): Student Information System v1.0 - Multiple Authenticated SQL Injections (SQLi) (CVSS 8.8, Kashipara Group Student Information System)
- [CVE-2023-33209](https://cve.now/CVE-2023-33209.md): WordPress SEO Change Monitor Plugin \<= 1.2 is vulnerable to SQL Injection (CVSS 8.5, CrawlSpider SEO Change Monitor – Track Website Changes)
- [CVE-2023-33330](https://cve.now/CVE-2023-33330.md): WordPress WooCommerce Follow-Up Emails Plugin \<= 4.9.50 is vulnerable to SQL Injection (CVSS 8.5, WooCommerce AutomateWoo)
- [CVE-2023-49825](https://cve.now/CVE-2023-49825.md): WordPress Soledad Theme \<= 8.4.1 is vulnerable to SQL Injection (CVSS 8.5, PenciDesign Soledad – Multipurpose, Newspaper, Blog & WooCo…)
- [CVE-2023-49776](https://cve.now/CVE-2023-49776.md): WordPress Sayfa Sayaç Plugin \<= 2.6 is vulnerable to SQL Injection (CVSS 9.3, Hakan Demiray Sayfa Sayac)
- [CVE-2023-49773](https://cve.now/CVE-2023-49773.md): WordPress BCorp Shortcodes Plugin \<= 0.23 is vulnerable to PHP Object Injection (CVSS 10.0, Tim Brattberg BCorp Shortcodes)
- [CVE-2023-3742](https://cve.now/CVE-2023-3742.md): Insufficient policy enforcement in ADB in Google Chrome on ChromeOS prior to 114.0.5735.90 allowed a local attacker to bypass device policy (no CVSS, Google Chrome)
- [CVE-2023-49772](https://cve.now/CVE-2023-49772.md): WordPress Genesis Simple Love Plugin \<= 2.0 is vulnerable to PHP Object Injection (CVSS 10.0, Phpbits Creative Studio Genesis Simple Love)
- [CVE-2023-35914](https://cve.now/CVE-2023-35914.md): WordPress WooCommerce Subscriptions Plugin \<= 5.1.2 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 7.5, WooCommerce Woo Subscriptions)
- [CVE-2023-35915](https://cve.now/CVE-2023-35915.md): WordPress WooCommerce Payments Plugin \<= 5.9.0 is vulnerable to SQL Injection (CVSS 7.6, Automattic WooPayments – Fully Integrated Solution Built an…)
- [CVE-2023-35916](https://cve.now/CVE-2023-35916.md): WordPress WooCommerce Payments Plugin \<= 5.9.0 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 7.5, Automattic WooPayments – Fully Integrated Solution Built an…)
- [CVE-2023-40010](https://cve.now/CVE-2023-40010.md): WordPress HUSKY – Products Filter for WooCommerce (formerly WOOF) Plugin \<= 1.3.4.2 is vulnerable to SQL Injection (CVSS 9.3, realmag777 HUSKY – Products Filter for WooCommerce Professi…)
- [CVE-2023-32590](https://cve.now/CVE-2023-32590.md): WordPress Subscribe to Category Plugin \<= 2.7.4 is vulnerable to SQL Injection (CVSS 9.3, Daniel Söderström / Sidney van de Stouwe Subscribe to Categ…)
- [CVE-2023-47852](https://cve.now/CVE-2023-47852.md): WordPress Link Whisper Free Plugin \<= 0.6.5 is vulnerable to SQL Injection (CVSS 8.5, Link Whisper Free)
- [CVE-2023-28782](https://cve.now/CVE-2023-28782.md): WordPress Gravity Forms Plugin \<= 2.7.3 is vulnerable to PHP Object Injection (CVSS 8.3, Rocketgenius Gravity Forms)
- [CVE-2023-35876](https://cve.now/CVE-2023-35876.md): WordPress WooCommerce Square Plugin \<= 3.8.1 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 8.1, WooCommerce Square)
- [CVE-2023-35895](https://cve.now/CVE-2023-35895.md): IBM Informix JDBC code execution (CVSS 6.3, IBM Informix JDBC)
- [CVE-2023-36520](https://cve.now/CVE-2023-36520.md): WordPress Editorial Calendar Plugin \<= 3.7.12 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 5.4, MarketingFire Editorial Calendar)
- [CVE-2023-51458](https://cve.now/CVE-2023-51458.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-51462](https://cve.now/CVE-2023-51462.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-51460](https://cve.now/CVE-2023-51460.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-51461](https://cve.now/CVE-2023-51461.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-51457](https://cve.now/CVE-2023-51457.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-51459](https://cve.now/CVE-2023-51459.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-6784](https://cve.now/CVE-2023-6784.md): Potential Use of the Sitefinity System for Distribution of Phishing Emails (CVSS 4.7, Progress Software Sitefinity)
- [CVE-2023-37871](https://cve.now/CVE-2023-37871.md): WordPress WooCommerce GoCardless Gateway Plugin \<= 2.5.6 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 8.2, WooCommerce GoCardless)
- [CVE-2023-50249](https://cve.now/CVE-2023-50249.md): Sentry's Astro SDK vulnerable to ReDoS (CVSS 7.5, getsentry sentry-javascript · @sentry/astro)
- [CVE-2023-38513](https://cve.now/CVE-2023-38513.md): WordPress Photo Engine Plugin \<= 6.2.5 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 5.4, Jordy Meow Photo Engine)
- [CVE-2023-38519](https://cve.now/CVE-2023-38519.md): WordPress MainWP Plugin \<= 4.4.3.3 is vulnerable to SQL Injection (CVSS 7.6, MainWP Dashboard – WordPress Manager for Multiple Websites…)
- [CVE-2023-40555](https://cve.now/CVE-2023-40555.md): WordPress Flatsome Theme \<= 3.17.5 is vulnerable to PHP Object Injection (CVSS 8.3, UX-themes Flatsome | Multi-Purpose Responsive WooCommerce T…)
- [CVE-2023-41796](https://cve.now/CVE-2023-41796.md): WordPress Sunshine Photo Cart Plugin \< 3.0.0 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 5.3, WP Sunshine Sunshine Photo Cart: Free Client Galleries for…)
- [CVE-2023-46147](https://cve.now/CVE-2023-46147.md): WordPress Themify Ultra Theme \<= 7.3.5 is vulnerable to PHP Object Injection (CVSS 7.4, Themify Ultra)
- [CVE-2023-46311](https://cve.now/CVE-2023-46311.md): WordPress wpDiscuz Plugin \<= 7.6.3 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 2.7, gVectors Team Comments – wpDiscuz)
- [CVE-2023-47236](https://cve.now/CVE-2023-47236.md): WordPress iPages Flipbook Plugin \<= 1.4.8 is vulnerable to SQL Injection (CVSS 7.6, Avirtum iPages Flipbook For WordPress)
- [CVE-2023-47507](https://cve.now/CVE-2023-47507.md): WordPress Master Slider Pro Plugin \<= 3.6.5 is vulnerable to PHP Object Injection (CVSS 7.1, Master Slider Pro)
- [CVE-2023-6562](https://cve.now/CVE-2023-6562.md): JPX Fragment List (flst) box vulnerability in Kakadu 7.9 allows an attacker to exfiltrate local and remote files reachable by a server if th (CVSS 7.5, Kakadu Software Pty Kakadu SDK)
- [CVE-2023-6769](https://cve.now/CVE-2023-6769.md): Stored XSS vulnerability in Amazing Little Poll (CVSS 6.5, Amazing Little poll)
- [CVE-2023-6768](https://cve.now/CVE-2023-6768.md): Authentication bypass vulnerability in Amazing Little Poll (CVSS 9.4, Amazing Little poll)
- [CVE-2023-6910](https://cve.now/CVE-2023-6910.md): Uncontrolled Resource Consumption in M-Files Server (CVSS 6.5, M-Files Server)
- [CVE-2023-6912](https://cve.now/CVE-2023-6912.md): Brute force vulnerability in M-Files user authentication (CVSS 7.5, M-Files Server)
- [CVE-2023-37544](https://cve.now/CVE-2023-37544.md): Apache Pulsar WebSocket Proxy: Improper Authentication for WebSocket Proxy Endpoint Allows DoS (CVSS 7.5, Apache Software Foundation Apache Pulsar WebSocket Proxy ·…)
- [CVE-2023-0011](https://cve.now/CVE-2023-0011.md): Command Execution through Serial Interface of u-blox TOBY-L2 (CVSS 7.6, u-blox TOBY-L2)
- [CVE-2023-6977](https://cve.now/CVE-2023-6977.md): Path Traversal: '\\..\\filename' (CVSS 10.0, mlflow/mlflow · mlflow)
- [CVE-2023-6976](https://cve.now/CVE-2023-6976.md): Unrestricted Upload of File with Dangerous Type (CVSS 8.8, mlflow/mlflow · mlflow)
- [CVE-2023-6975](https://cve.now/CVE-2023-6975.md): Path Traversal: '\\..\\filename' (CVSS 9.8, mlflow/mlflow · mlflow)
- [CVE-2023-6974](https://cve.now/CVE-2023-6974.md): Server-Side Request Forgery (SSRF) (CVSS 8.6, mlflow/mlflow · mlflow)
- [CVE-2023-47707](https://cve.now/CVE-2023-47707.md): IBM Security Guardium Key Lifecycle Manager cross-site scripting (CVSS 5.4, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2023-47703](https://cve.now/CVE-2023-47703.md): IBM Security Guardium Key Lifecycle Manager information disclosure (CVSS 5.3, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2023-47702](https://cve.now/CVE-2023-47702.md): IBM Security Guardium Key Lifecycle Manager directory traversal (CVSS 4.3, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2023-47706](https://cve.now/CVE-2023-47706.md): IBM Security Guardium Key Lifecycle Manager file upload (CVSS 6.6, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2023-47705](https://cve.now/CVE-2023-47705.md): IBM Security Guardium Key Lifecycle Manager improper input validation (CVSS 4.3, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2023-47704](https://cve.now/CVE-2023-47704.md): IBM Security Guardium Key Lifecycle Manager information disclosure (CVSS 4.0, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2023-27172](https://cve.now/CVE-2023-27172.md): Xpand IT Write-back Manager v2.3.1 uses weak secret keys to sign JWT tokens. (CVSS 9.1)
- [CVE-2023-41166](https://cve.now/CVE-2023-41166.md): An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 thro (no CVSS)
- [CVE-2023-47093](https://cve.now/CVE-2023-47093.md): An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0. (no CVSS)
- [CVE-2023-47990](https://cve.now/CVE-2023-47990.md): SQL Injection vulnerability in components/table\_manager/html/edit\_admin\_table.php in CuppaCMS V1.0 allows attackers to run arbitrary SQL com (CVSS 9.8)
- [CVE-2023-49032](https://cve.now/CVE-2023-49032.md): An issue in LTB Self Service Password before v.1.5.4 allows a remote attacker to execute arbitrary code and obtain sensitive information via (CVSS 9.8)
- [CVE-2023-50044](https://cve.now/CVE-2023-50044.md): Cesanta MJS 2.20.0 has a getprop\_builtin\_foreign out-of-bounds read if a Built-in API name occurs in a substring of an input string. (no CVSS)
- [CVE-2023-50628](https://cve.now/CVE-2023-50628.md): Buffer Overflow vulnerability in libming version 0.4.8, allows attackers to execute arbitrary code and obtain sensitive information via pars (no CVSS)
- [CVE-2023-50639](https://cve.now/CVE-2023-50639.md): Cross Site Scripting (XSS) vulnerability in CuteHttpFileServer v.1.0 and v.2.0 allows attackers to obtain sensitive information via the file (no CVSS)
- [CVE-2023-50983](https://cve.now/CVE-2023-50983.md): Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the sysScheduleRebootSet function. (no CVSS)
- [CVE-2023-50984](https://cve.now/CVE-2023-50984.md): Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the ip parameter in the spdtstConfigAndStart function. (no CVSS)
- [CVE-2023-50985](https://cve.now/CVE-2023-50985.md): Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the lanGw parameter in the lanCfgSet function. (no CVSS)
- [CVE-2023-50986](https://cve.now/CVE-2023-50986.md): Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysLogin function. (CVSS 8.8)
- [CVE-2023-50987](https://cve.now/CVE-2023-50987.md): Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the time parameter in the sysTimeInfoSet function. (no CVSS)
- [CVE-2023-50988](https://cve.now/CVE-2023-50988.md): Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the bandwidth parameter in the wifiRadioSetIndoor function. (no CVSS)
- [CVE-2023-50989](https://cve.now/CVE-2023-50989.md): Tenda i29 v1.0 V1.0.0.5 was discovered to contain a command injection vulnerability via the pingSet function. (no CVSS)
- [CVE-2023-50990](https://cve.now/CVE-2023-50990.md): Tenda i29 v1.0 V1.0.0.5 was discovered to contain a buffer overflow via the rebootTime parameter in the sysScheduleRebootSet function. (no CVSS)
- [CVE-2023-50992](https://cve.now/CVE-2023-50992.md): Tenda i29 v1.0 V1.0.0.5 was discovered to contain a stack overflow via the ip parameter in the setPing function. (no CVSS)
- [CVE-2023-50993](https://cve.now/CVE-2023-50993.md): Ruijie WS6008 v1.x v2.x AC\_RGOS11.9(6)W3B2\_G2C6-01\_10221911 and WS6108 v1.x AC\_RGOS11.9(6)W3B2\_G2C6-01\_10221911 was discovered to contain a (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.