CVEs published December 24, 2023
11 CVEs were published on December 24, 2023: 0 critical, 2 high. 1 is now in CISA KEV.
- Published
- 11
- Critical
- 0
- High
- 2
- Medium
- 3
- Low
- 0
- Unrated
- 6
- Now in CISA KEV
- 1
- Fix available
- 1
Most affected products
- activeadmin
- 1
- Barracuda Networks Barracuda ESG Appliance
- 1
- Douglas Wilson Spreadsheet::ParseExcel
- 1
- Dreamer CMS
- 1
- KylinSoft kylin-system-updater
- 1
- Uniway UW-302VP
- 1
High 2
Medium, low and unrated 9
- CVE-2023-7093KylinSoft kylin-system-updater com.kylin.systemupgrade Service UpgradeStrategiesDbus.py os command injectionKylinSoft kylin-system-updater
- CVE-2023-7092Uniway UW-302VP Admin Web Interface wlan_basic_set.cgi cross-site request forgeryUniway UW-302VP
- CVE-2023-7102Remote Code Execution (RCE) VulnerabilityBarracuda Networks Barracuda ESG Appliance
- CVE-2023-7091Dreamer CMS uploadFile unrestricted uploadDreamer CMS
- CVE-2023-51714An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x bef
- CVE-2023-51763csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.activeadmin
- CVE-2023-51764Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_k
- CVE-2023-51765sendmail through 8.17.2 allows SMTP smuggling in certain configurations.
- CVE-2023-51766Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations.