CVEs published December 25, 2023
66 CVEs were published on December 25, 2023: 6 critical, 10 high.
- Published
- 66
- Critical
- 6
- High
- 10
- Medium
- 11
- Low
- 2
- Unrated
- 37
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- concrete5/concrete5
- 5
- code-projects E-Commerce Website
- 3
- code-projects Faculty Management System
- 1
- code-projects Water Billing System
- 1
- github.com/dvsekhvalnov/jose2go
- 1
- IBM Aspera Console
- 1
- IBM Financial Transaction Manager for SWIFT Services
- 1
- IBM i
- 1
- icret EasyImages
- 1
- json-jwt
- 1
Critical 6
- CVE-2023-7095Totolink A7100RU HTTP POST Request main buffer overflowTotolink A7100RU
- CVE-2022-34268An issue was discovered in RWS WorldServer before 11.7.3.
- CVE-2022-34270An issue was discovered in RWS WorldServer before 11.7.3.
- CVE-2023-49954The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address
- CVE-2023-51771In MicroHttpServer (aka Micro HTTP Server) through a8ab029, _ParseHeader in lib/server.c allows a one-byte recv buffer overflow via a long U
- CVE-2023-51773BACnet Stack before 1.3.2 has a decode function APDU buffer over-read in bacapp_decode_application_data in bacapp.c.
High 10
- CVE-2023-7107code-projects E-Commerce Website user_signup.php sql injectioncode-projects E-Commerce Website
- CVE-2023-49880IBM Financial Transaction Manager for SWIFT Services data manipulationIBM Financial Transaction Manager for SWIFT Services
- CVE-2021-38927IBM Aspera Console cross-site scriptingIBM Aspera Console
- CVE-2023-43064IBM i code executionIBM i
- CVE-2022-34269An issue was discovered in RWS WorldServer before 11.7.3.
- CVE-2022-39822In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET
- CVE-2023-47091An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10
- CVE-2023-51772One Identity Password Manager before 5.13.1 allows Kiosk Escape.
- CVE-2023-51774The json-jwt (aka JSON::JWT) gem 1.16.3 for Ruby sometimes allows bypass of identity checks via a sign/encryption confusion attack.json-jwt
- CVE-2023-51779bt_sock_recvmsg in net/bluetooth/af_bluetooth.c in the Linux kernel through 6.6.8 has a use-after-free because of a bt_sock_ioctl race condi
Medium, low and unrated 50
- CVE-2023-7106code-projects E-Commerce Website sql injectioncode-projects E-Commerce Website
- CVE-2023-7105code-projects E-Commerce Website index_search.php sql injectioncode-projects E-Commerce Website
- CVE-2023-7104SQLite SQLite3 make alltest sqlite3session.c sessionReadRecord heap-based overflowSQLite3 · sqlite
- CVE-2023-7100PHPGurukul Restaurant Table Booking System bwdates-report-details.php sql injectionPHPGurukul Restaurant Table Booking System
- CVE-2023-7099PHPGurukul Nipah Virus Testing Management System bwdates-report-result.php sql injectionPHPGurukul Nipah Virus Testing Management System
- CVE-2023-7098icret EasyImages hide.php path traversalicret EasyImages
- CVE-2023-7097code-projects Water Billing System addbill.php sql injectioncode-projects Water Billing System
- CVE-2023-7096code-projects Faculty Management System crud.php sql injectioncode-projects Faculty Management System
- CVE-2023-7094Netentsec NS-ASG Application Security Gateway nsasg6.0.tgz information disclosureNetentsec NS-ASG Application Security Gateway
- CVE-2022-34267An issue was discovered in RWS WorldServer before 11.7.3.
- CVE-2022-39818In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET par
- CVE-2022-39820In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xm
- CVE-2022-41760An issue was discovered in NOKIA NFM-T R19.9.
- CVE-2022-41761An issue was discovered in NOKIA NFM-T R19.9.
- CVE-2022-41762An issue was discovered in NOKIA NFM-T R19.9.
- CVE-2022-43675An issue was discovered in NOKIA NFM-T R19.9.
- CVE-2023-27151openCRX 5.2.0 was discovered to contain an HTML injection vulnerability for Search Criteria-Activity Number (in the Saved Search Activity) v
- CVE-2023-28872Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a sy
- CVE-2023-30451In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directorytypo3/cms-core
- CVE-2023-31224There is broken access control during authentication in Jamf Pro Server before 10.46.1.
- CVE-2023-31289Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort.
- CVE-2023-31297An issue was discovered in SESAMI planfocus CPTO (Cash Point & Transport Optimizer) 6.3.8.6 718.
- CVE-2023-31455Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort.
- CVE-2023-34198In Stormshield Network Security (SNS) 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before
- CVE-2023-36485The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the applicat
- CVE-2023-36486The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the applicat
- CVE-2023-37185C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompress at zfp/blosc2-zfp.c.
- CVE-2023-37186C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset.
- CVE-2023-37187C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress.
- CVE-2023-37188C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c.
- CVE-2023-37225Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.
- CVE-2023-38321OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL po
- CVE-2023-38826A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U.
- CVE-2023-40236In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers' installations, which allows authenticat
- CVE-2023-41165An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0
- CVE-2023-47247In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102.
- CVE-2023-48650Concrete CMS before 8.5.14 and 9 before 9.2.3 is vulnerable to an admin adding a stored XSS payload via the Layout Preset name.concrete5/concrete5
- CVE-2023-48651Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) at /ccm/system/dialogs/file/delete/1/submit.concrete5/concrete5
- CVE-2023-48652Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit.concrete5/concrete5
- CVE-2023-48653Concrete CMS before 8.5.14 and 9 before 9.2.3 allows Cross Site Request Forgery (CSRF) via ccm/calendar/dialogs/event/delete/submit.concrete5/concrete5
- CVE-2023-48654One Identity Password Manager before 5.13.1 allows Kiosk Escape.
- CVE-2023-49226An issue was discovered in Peplink Balance Two before 8.4.0.
- CVE-2023-49328On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve
- CVE-2023-49337Concrete CMS before 9.2.3 allows Stored XSS on the Admin Dashboard via /dashboard/system/basics/name.concrete5/concrete5
- CVE-2023-49944The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypas
- CVE-2023-50658The jose2go component before 1.6.0 for Go allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) github.com/dvsekhvalnov/jose2go
- CVE-2023-51775The jose4j component before 0.9.4 for Java allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count)org.bitbucket.b_c:jose4j
- CVE-2023-51780An issue was discovered in the Linux kernel before 6.6.8.
- CVE-2023-51781An issue was discovered in the Linux kernel before 6.6.8.
- CVE-2023-51782An issue was discovered in the Linux kernel before 6.6.8.