CVEs published December 27, 2023
30 CVEs were published on December 27, 2023: 6 critical, 6 high.
- Published
- 30
- Critical
- 6
- High
- 6
- Medium
- 6
- Low
- 0
- Unrated
- 12
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- advplyr audiobookshelf
- 2
- cn.hutool:hutool-core
- 2
- com.github:hyavijava
- 1
- com.jayway.jsonpath:json-path
- 1
- İzmir Katip Çelebi University University Information Manage…
- 1
- jamieblomerus WP-Mobile-BankID-Integration
- 1
- libaom
- 1
- linuxdeepin developer-center
- 1
- nexryai nexkey
- 1
- org.mvel:mvel2
- 1
Critical 6
- CVE-2023-6879heap buffer overflow in libaomlibaom
- CVE-2023-50255Zip Path Traversal in Deepin-Compressorlinuxdeepin developer-center
- CVE-2023-6190Authenicated Path Traversal in İzmir Katip Çelebi Universityİzmir Katip Çelebi University University Information Manage…
- CVE-2023-43481An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arb
- CVE-2023-49001An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.e
- CVE-2023-51084hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method.com.github:hyavijava
High 6
- CVE-2023-52075ReVanced API vulnerable to Denial of Service due to lack of error cachingrevanced-api
- CVE-2023-52077External apps using tokens issued by administrators and moderators can call admin APIsnexryai nexkey
- CVE-2023-51664tj-actions/changed-files command injection in output filenamestj-actions changed-files
- CVE-2023-51443FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiationsignalwire freeswitch
- CVE-2023-3171Eap-7: heap exhaustion via deserializationRed Hat EAP · Red Hat JBoss Enterprise Application Platf… +1
- CVE-2023-51075hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function.cn.hutool:hutool-core
Medium, low and unrated 18
- CVE-2023-7123SourceCodester Medicine Tracking System sql injectionSourceCodester Medicine Tracking System
- CVE-2023-51700WP-Mobile-BankID-Integration WordPress Database Deserialization: Potential for Object Injectionjamieblomerus WP-Mobile-BankID-Integration
- CVE-2023-51665Audiobookshelf vulnerable to Blind SSRF in `Auth.js`advplyr audiobookshelf
- CVE-2023-51697Audiobookshelf vulnerable to Blind SSRF in `podcastUtils.js`advplyr audiobookshelf
- CVE-2023-4641Shadow-utils: possible password leak during passwd(1) changeshadow-utils · Red Hat Enterprise Linux
- CVE-2023-7116WeiYe-Jing datax-web HTTP POST Request killJob os command injectionWeiYe-Jing datax-web
- CVE-2023-40038Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access.
- CVE-2023-43955The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView.
- CVE-2023-46918Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the andr
- CVE-2023-46919Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a ha
- CVE-2023-47882The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary Ja
- CVE-2023-47883The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an exp
- CVE-2023-49000An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the
- CVE-2023-49002An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended access restrictions via
- CVE-2023-49003An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simple
- CVE-2023-51074json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.com.jayway.jsonpath:json-path
- CVE-2023-51079A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups.org.mvel:mvel2
- CVE-2023-51080The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.cn.hutool:hutool-core