CVEs published December 30, 2023
36 CVEs were published on December 30, 2023: 3 critical, 5 high.
- Published
- 36
- Critical
- 3
- High
- 5
- Medium
- 10
- Low
- 0
- Unrated
- 18
- Now in CISA KEV
- 0
- Fix available
- 4
Most affected products
- Campcodes Online College Library System
- 5
- org.jeecgframework.boot:jeecg-boot-common
- 3
- PHPGurukul Hospital Management System
- 2
- Apache Software Foundation Apache DolphinScheduler · org.ap…
- 1
- CoolKit Technology eWeLink - Smart Home · CoolKit Technolog…
- 1
- layui
- 1
- MdAlAmin-aol Own Health Record
- 1
- Muyun DedeBIZ
- 1
- net.mingsoft:ms-mcms
- 1
- Tongda OA
- 1
Critical 3
- CVE-2023-41542SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information viaorg.jeecgframework.boot:jeecg-boot-common
- CVE-2023-50578Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.net.mingsoft:ms-mcms
- CVE-2023-50651TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/c
High 5
- CVE-2023-6998Lockscreen bypass in eWeLink AppCoolKit Technology eWeLink - Smart Home · CoolKit Technolog…
- CVE-2023-49299Apache DolphinScheduler: Arbitrary js execute as root for authenticated usersApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2023-7172PHPGurukul Hospital Management System Admin Dashboard sql injectionPHPGurukul Hospital Management System
- CVE-2022-46487Improper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for Intel
- CVE-2023-52266ehttp 1.0.6 before 17405b9 has an epoll_socket.cpp read_func use-after-free.
Medium, low and unrated 28
- CVE-2023-7181Muyun DedeBIZ Add Attachment unrestricted uploadMuyun DedeBIZ
- CVE-2023-7180Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2023-7179Campcodes Online College Library System HTTP POST Request category_row.php sql injectionCampcodes Online College Library System
- CVE-2023-7178Campcodes Online College Library System HTTP POST Request book_row.php sql injectionCampcodes Online College Library System
- CVE-2023-7177Campcodes Online College Library System HTTP POST Request book_add.php sql injectionCampcodes Online College Library System
- CVE-2023-7176Campcodes Online College Library System HTTP POST Request return_add.php sql injectionCampcodes Online College Library System
- CVE-2023-7175Campcodes Online College Library System HTTP POST Request borrow_add.php sql injectionCampcodes Online College Library System
- CVE-2023-7173PHPGurukul Hospital Management System registration.php cross site scriptingPHPGurukul Hospital Management System
- CVE-2018-25096MdAlAmin-aol Own Health Record logout.php cross-site request forgeryMdAlAmin-aol Own Health Record
- CVE-2022-46486A lack of pointer-validation logic in the __scone_dispatch component of SCONE before v5.8.0 for Intel SGX allows attackers to access sensiti
- CVE-2023-38021An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.32 for Intel SGX.
- CVE-2023-38022An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX.
- CVE-2023-38023An issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX.
- CVE-2023-41543SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the coorg.jeecgframework.boot:jeecg-boot-common
- CVE-2023-41544SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-50110TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used.
- CVE-2023-50550layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.layui
- CVE-2023-50589Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page.
- CVE-2023-51133TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute.
- CVE-2023-51135TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup.
- CVE-2023-51136TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSchedule.
- CVE-2023-52252Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remo
- CVE-2023-52257LogoBee 0.2 allows updates.php?id= XSS.
- CVE-2023-52262outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extra
- CVE-2023-52263Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect.
- CVE-2023-52264The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is m
- CVE-2023-52265IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update
- CVE-2023-52267ehttp 1.0.6 before 17405b9 has a simple_log.cpp _log out-of-bounds-read during error logging for long strings.