# CVEs published 2023-12-24

11 CVEs were published on December 24, 2023: 0 critical, 2 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-7093](https://cve.now/CVE-2023-7093.md): KylinSoft kylin-system-updater com.kylin.systemupgrade Service UpgradeStrategiesDbus.py os command injection (CVSS 5.3, KylinSoft kylin-system-updater)
- [CVE-2023-7092](https://cve.now/CVE-2023-7092.md): Uniway UW-302VP Admin Web Interface wlan\_basic\_set.cgi cross-site request forgery (CVSS 4.3, Uniway UW-302VP)
- [CVE-2023-7102](https://cve.now/CVE-2023-7102.md): Remote Code Execution (RCE) Vulnerability (no CVSS, Barracuda Networks Barracuda ESG Appliance)
- [CVE-2023-7101](https://cve.now/CVE-2023-7101.md): Arbitrary Code Execution (ACE) Vulnerability (CVSS 7.8, KEV, Douglas Wilson Spreadsheet::ParseExcel)
- [CVE-2023-7091](https://cve.now/CVE-2023-7091.md): Dreamer CMS uploadFile unrestricted upload (CVSS 6.3, Dreamer CMS)
- [CVE-2023-51714](https://cve.now/CVE-2023-51714.md): An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x bef (no CVSS)
- [CVE-2023-51763](https://cve.now/CVE-2023-51763.md): csv\_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection. (no CVSS, activeadmin)
- [CVE-2023-51764](https://cve.now/CVE-2023-51764.md): Postfix through 3.8.5 allows SMTP smuggling unless configured with smtpd\_data\_restrictions=reject\_unauth\_pipelining and smtpd\_discard\_ehlo\_k (no CVSS)
- [CVE-2023-51765](https://cve.now/CVE-2023-51765.md): sendmail through 8.17.2 allows SMTP smuggling in certain configurations. (no CVSS)
- [CVE-2023-51766](https://cve.now/CVE-2023-51766.md): Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. (no CVSS)
- [CVE-2023-51767](https://cve.now/CVE-2023-51767.md): OpenSSH through 10.0, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer val (CVSS 7.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.