# CVEs published 2023-12-27

30 CVEs were published on December 27, 2023: 6 critical, 6 high. Days are UTC.

- [CVE-2023-7123](https://cve.now/CVE-2023-7123.md): SourceCodester Medicine Tracking System sql injection (CVSS 6.3, SourceCodester Medicine Tracking System)
- [CVE-2023-6879](https://cve.now/CVE-2023-6879.md): heap buffer overflow in libaom (CVSS 9.0, libaom)
- [CVE-2023-52075](https://cve.now/CVE-2023-52075.md): ReVanced API vulnerable to Denial of Service due to lack of error caching (CVSS 7.5, revanced-api)
- [CVE-2023-52077](https://cve.now/CVE-2023-52077.md): External apps using tokens issued by administrators and moderators can call admin APIs (CVSS 8.9, nexryai nexkey)
- [CVE-2023-51700](https://cve.now/CVE-2023-51700.md): WP-Mobile-BankID-Integration WordPress Database Deserialization: Potential for Object Injection (CVSS 6.4, jamieblomerus WP-Mobile-BankID-Integration)
- [CVE-2023-51665](https://cve.now/CVE-2023-51665.md): Audiobookshelf vulnerable to Blind SSRF in \`Auth.js\` (CVSS 4.3, advplyr audiobookshelf)
- [CVE-2023-51697](https://cve.now/CVE-2023-51697.md): Audiobookshelf vulnerable to Blind SSRF in \`podcastUtils.js\` (CVSS 4.3, advplyr audiobookshelf)
- [CVE-2023-51664](https://cve.now/CVE-2023-51664.md): tj-actions/changed-files command injection in output filenames (CVSS 7.3, tj-actions changed-files)
- [CVE-2023-51443](https://cve.now/CVE-2023-51443.md): FreeSWITCH susceptible to Denial of Service via DTLS Hello packets during call initiation (CVSS 7.5, signalwire freeswitch)
- [CVE-2023-50255](https://cve.now/CVE-2023-50255.md): Zip Path Traversal in Deepin-Compressor (CVSS 9.3, linuxdeepin developer-center)
- [CVE-2023-3171](https://cve.now/CVE-2023-3171.md): Eap-7: heap exhaustion via deserialization (CVSS 7.5, Red Hat EAP · Red Hat JBoss Enterprise Application Platf… +1)
- [CVE-2023-4641](https://cve.now/CVE-2023-4641.md): Shadow-utils: possible password leak during passwd(1) change (CVSS 4.7, shadow-utils · Red Hat Enterprise Linux)
- [CVE-2023-7116](https://cve.now/CVE-2023-7116.md): WeiYe-Jing datax-web HTTP POST Request killJob os command injection (CVSS 6.3, WeiYe-Jing datax-web)
- [CVE-2023-6190](https://cve.now/CVE-2023-6190.md): Authenicated Path Traversal in İzmir Katip Çelebi University (CVSS 9.8, İzmir Katip Çelebi University University Information Manage…)
- [CVE-2023-40038](https://cve.now/CVE-2023-40038.md): Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (no CVSS)
- [CVE-2023-43481](https://cve.now/CVE-2023-43481.md): An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022\_dab24cc6\_231221\_gp allows a remote attacker to execute arb (CVSS 9.8)
- [CVE-2023-43955](https://cve.now/CVE-2023-43955.md): The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. (no CVSS)
- [CVE-2023-46918](https://cve.now/CVE-2023-46918.md): Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the andr (no CVSS)
- [CVE-2023-46919](https://cve.now/CVE-2023-46919.md): Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a ha (no CVSS)
- [CVE-2023-47882](https://cve.now/CVE-2023-47882.md): The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9\_20231127 for Android allows a remote attacker to execute arbitrary Ja (no CVSS)
- [CVE-2023-47883](https://cve.now/CVE-2023-47883.md): The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an exp (no CVSS)
- [CVE-2023-49000](https://cve.now/CVE-2023-49000.md): An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the (no CVSS)
- [CVE-2023-49001](https://cve.now/CVE-2023-49001.md): An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.e (CVSS 9.8)
- [CVE-2023-49002](https://cve.now/CVE-2023-49002.md): An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended access restrictions via (no CVSS)
- [CVE-2023-49003](https://cve.now/CVE-2023-49003.md): An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simple (no CVSS)
- [CVE-2023-51074](https://cve.now/CVE-2023-51074.md): json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method. (no CVSS, com.jayway.jsonpath:json-path)
- [CVE-2023-51075](https://cve.now/CVE-2023-51075.md): hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. (CVSS 7.5, cn.hutool:hutool-core)
- [CVE-2023-51079](https://cve.now/CVE-2023-51079.md): A long execution time can occur in the ParseTools.subCompileExpression method in MVEL 2.5.0.Final because of many Java class lookups. (no CVSS, org.mvel:mvel2)
- [CVE-2023-51080](https://cve.now/CVE-2023-51080.md): The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow. (no CVSS, cn.hutool:hutool-core)
- [CVE-2023-51084](https://cve.now/CVE-2023-51084.md): hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method. (CVSS 9.8, com.github:hyavijava)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.