CVEs published December 26, 2023
69 CVEs were published on December 26, 2023: 2 critical, 8 high.
- Published
- 69
- Critical
- 2
- High
- 8
- Medium
- 7
- Low
- 2
- Unrated
- 50
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- WESEEK GROWI
- 13
- WP Mail Log
- 5
- BUFFALO VR-S1000
- 4
- code-projects Library Management System
- 3
- Alfasado PowerCMS
- 2
- Apache Software Foundation Apache OFBiz
- 2
- BestWebSoft Portfolio Plugin
- 2
- Quiz Maker
- 2
- rtMedia for WordPress, BuddyPress and bbPress
- 2
- BestWebSoft's Like & Share
- 1
Critical 2
High 8
- CVE-2023-5644WP Mail Log < 1.1.3 – Incorrect Authorization in REST API EndpointsWP Mail Log
- CVE-2023-5203WP Sessions Time Monitoring Full Automatic < 1.0.9 - Unauthenticated SQL injectionWP Sessions Time Monitoring Full Automatic
- CVE-2023-5180Out-of-bounds Write vulnerability exists in ODA Drawings SDK before 2024.12Open Design Alliance ODA Drawings SDK - All Versions <
- CVE-2023-7110code-projects Library Management System login.php sql injectioncode-projects Library Management System
- CVE-2023-7109code-projects Library Management System login.php sql injectioncode-projects Library Management System
- CVE-2023-51092Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade.
- CVE-2023-51104A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function pnm_binary_read_image() of load
- CVE-2023-51107A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in functon compute_color() of jquant2.c.
Medium, low and unrated 59
- CVE-2023-5991Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & DeletionHotel Booking Lite
- CVE-2023-5980BSK Forms Blacklist < 3.7 - Admin+ Stored Cross-Site ScriptingBSK Forms Blacklist
- CVE-2023-6114Duplicator < 1.5.7.1; Duplicator Pro < 4.5.14.2 - Unauthenticated Sensitive Data ExposureDuplicator
- CVE-2023-6155Quiz Maker < 6.4.9.5 - Unauthenticated Email Address DisclosureQuiz Maker
- CVE-2023-6250BestWebSoft's Like & Share < 2.74 - Unauthenticated Password Protected Post ReadBestWebSoft's Like & Share
- CVE-2023-5939rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Admin+ RCErtMedia for WordPress, BuddyPress and bbPress
- CVE-2023-5672WP Mail Log < 1.1.3 – Contributor+ LFI in wml_logs/send_mail endpointWP Mail Log
- CVE-2023-5645WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs endpointWP Mail Log
- CVE-2023-6268JSON Content Importer < 1.5.4 - Reflected XSSJSON Content Importer
- CVE-2023-5673WP Mail Log < 1.1.3 – Contributor+ Arbitrary File Upload to RCEWP Mail Log
- CVE-2023-5674WP Mail Log < 1.1.3 – Contributor+ SQL Injection in wml_logs/send_mail endpointWP Mail Log
- CVE-2023-6166Quiz Maker < 6.4.9.5 - Reflected Cross-Site ScriptingQuiz Maker
- CVE-2023-5931rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCErtMedia for WordPress, BuddyPress and bbPress
- CVE-2015-10127PlusCaptcha Plugin cross site scriptingPlusCaptcha Plugin
- CVE-2014-125109BestWebSoft Portfolio Plugin bws_menu.php bws_add_menu_render cross site scriptingBestWebSoft Portfolio Plugin
- CVE-2023-50968Apache OFBiz: Arbitrary file properties reading and SSRF attackApache Software Foundation Apache OFBiz
- CVE-2012-10017BestWebSoft Portfolio Plugin cross-site request forgeryBestWebSoft Portfolio Plugin
- CVE-2023-51363VR-S1000 firmware Ver.BUFFALO VR-S1000
- CVE-2023-46711VR-S1000 firmware Ver.BUFFALO VR-S1000
- CVE-2023-46681Improper neutralization of argument delimiters in a command ('Argument Injection') vulnerability in VR-S1000 firmware Ver.BUFFALO VR-S1000
- CVE-2023-45741VR-S1000 firmware Ver.BUFFALO VR-S1000
- CVE-2023-42436Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0.WESEEK GROWI
- CVE-2023-50332Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6.WESEEK GROWI
- CVE-2023-50294The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form.WESEEK GROWI
- CVE-2023-50175Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and thWESEEK GROWI
- CVE-2023-49807Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0.WESEEK GROWI
- CVE-2023-49779Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0.WESEEK GROWI
- CVE-2023-49598Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0.WESEEK GROWI
- CVE-2023-49119Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0.WESEEK GROWI
- CVE-2023-47215Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0.WESEEK GROWI
- CVE-2023-46699Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0.WESEEK GROWI
- CVE-2023-45740Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3.WESEEK GROWI
- CVE-2023-45737Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GWESEEK GROWI
- CVE-2023-50339Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11.WESEEK GROWI
- CVE-2023-50297Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbAlfasado PowerCMS
- CVE-2023-49117PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability.Alfasado PowerCMS
- CVE-2023-51654Improper link resolution before file access ('Link Following') issue exists in iPrint&Scan Desktop for Windows versions 11.0.0 and earlier.Brother Industries iPrint&Scan Desktop for Windows
- CVE-2023-7111code-projects Library Management System index.php sql injectioncode-projects Library Management System
- CVE-2023-7108code-projects E-Commerce Website user_signup.php cross site scriptingcode-projects E-Commerce Website
- CVE-2023-27150openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage org.opencrx:opencrx-core
- CVE-2023-28616An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1.
- CVE-2023-48003An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims
- CVE-2023-49438An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to maliciousflask-security-too
- CVE-2023-49949Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes.
- CVE-2023-51090Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formGetWeiXinConfig.
- CVE-2023-51091Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function R7WebsSecurityHandler.
- CVE-2023-51093Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function fromSetLocalVlanInfo.
- CVE-2023-51094Tenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet.
- CVE-2023-51095Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formDelWlRfPolicy.
- CVE-2023-51097Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetAutoPing.
- CVE-2023-51098Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo .
- CVE-2023-51099Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formexeCommand .
- CVE-2023-51100Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formGetDiagnoseInfo .
- CVE-2023-51102Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formWifiMacFilterSet.
- CVE-2023-51103A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in the function fz_new_pixmap_from_float_da
- CVE-2023-51105A floating point exception (divide-by-zero) vulnerability was discovered in Artifex MuPDF 1.23.4 in function bmp_decompress_rle4() of load-b
- CVE-2023-51106A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in function pnm_binary_read_image() of load-pnm.c w
- CVE-2023-52086resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in mul
- CVE-2023-52096SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an applic