# CVEs published 2023-12-30

36 CVEs were published on December 30, 2023: 3 critical, 5 high. Days are UTC.

- [CVE-2023-6998](https://cve.now/CVE-2023-6998.md): Lockscreen bypass in eWeLink App (CVSS 7.7, CoolKit Technology eWeLink - Smart Home · CoolKit Technolog…)
- [CVE-2023-7181](https://cve.now/CVE-2023-7181.md): Muyun DedeBIZ Add Attachment unrestricted upload (CVSS 4.7, Muyun DedeBIZ)
- [CVE-2023-7180](https://cve.now/CVE-2023-7180.md): Tongda OA 2017 delete.php sql injection (CVSS 5.5, Tongda OA)
- [CVE-2023-7179](https://cve.now/CVE-2023-7179.md): Campcodes Online College Library System HTTP POST Request category\_row.php sql injection (CVSS 4.7, Campcodes Online College Library System)
- [CVE-2023-7178](https://cve.now/CVE-2023-7178.md): Campcodes Online College Library System HTTP POST Request book\_row.php sql injection (CVSS 4.7, Campcodes Online College Library System)
- [CVE-2023-49299](https://cve.now/CVE-2023-49299.md): Apache DolphinScheduler: Arbitrary js execute as root for authenticated users (CVSS 8.8, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2023-7177](https://cve.now/CVE-2023-7177.md): Campcodes Online College Library System HTTP POST Request book\_add.php sql injection (CVSS 4.7, Campcodes Online College Library System)
- [CVE-2023-7176](https://cve.now/CVE-2023-7176.md): Campcodes Online College Library System HTTP POST Request return\_add.php sql injection (CVSS 4.7, Campcodes Online College Library System)
- [CVE-2023-7175](https://cve.now/CVE-2023-7175.md): Campcodes Online College Library System HTTP POST Request borrow\_add.php sql injection (CVSS 4.7, Campcodes Online College Library System)
- [CVE-2023-7173](https://cve.now/CVE-2023-7173.md): PHPGurukul Hospital Management System registration.php cross site scripting (CVSS 4.3, PHPGurukul Hospital Management System)
- [CVE-2018-25096](https://cve.now/CVE-2018-25096.md): MdAlAmin-aol Own Health Record logout.php cross-site request forgery (CVSS 4.3, MdAlAmin-aol Own Health Record)
- [CVE-2023-7172](https://cve.now/CVE-2023-7172.md): PHPGurukul Hospital Management System Admin Dashboard sql injection (CVSS 7.3, PHPGurukul Hospital Management System)
- [CVE-2022-46486](https://cve.now/CVE-2022-46486.md): A lack of pointer-validation logic in the \_\_scone\_dispatch component of SCONE before v5.8.0 for Intel SGX allows attackers to access sensiti (no CVSS)
- [CVE-2022-46487](https://cve.now/CVE-2022-46487.md): Improper initialization of x87 and SSE floating-point configuration registers in the \_\_scone\_entry component of SCONE before 5.8.0 for Intel (CVSS 7.8)
- [CVE-2023-38021](https://cve.now/CVE-2023-38021.md): An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.32 for Intel SGX. (no CVSS)
- [CVE-2023-38022](https://cve.now/CVE-2023-38022.md): An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. (no CVSS)
- [CVE-2023-38023](https://cve.now/CVE-2023-38023.md): An issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. (no CVSS)
- [CVE-2023-41542](https://cve.now/CVE-2023-41542.md): SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via (CVSS 9.8, org.jeecgframework.boot:jeecg-boot-common)
- [CVE-2023-41543](https://cve.now/CVE-2023-41543.md): SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the co (no CVSS, org.jeecgframework.boot:jeecg-boot-common)
- [CVE-2023-41544](https://cve.now/CVE-2023-41544.md): SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the (no CVSS, org.jeecgframework.boot:jeecg-boot-common)
- [CVE-2023-50110](https://cve.now/CVE-2023-50110.md): TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used. (no CVSS)
- [CVE-2023-50550](https://cve.now/CVE-2023-50550.md): layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter. (no CVSS, layui)
- [CVE-2023-50578](https://cve.now/CVE-2023-50578.md): Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do. (CVSS 9.8, net.mingsoft:ms-mcms)
- [CVE-2023-50589](https://cve.now/CVE-2023-50589.md): Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page. (no CVSS)
- [CVE-2023-50651](https://cve.now/CVE-2023-50651.md): TOTOLINK X6000R v9.4.0cu.852\_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/c (CVSS 9.8)
- [CVE-2023-51133](https://cve.now/CVE-2023-51133.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute. (no CVSS)
- [CVE-2023-51135](https://cve.now/CVE-2023-51135.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup. (no CVSS)
- [CVE-2023-51136](https://cve.now/CVE-2023-51136.md): TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSchedule. (no CVSS)
- [CVE-2023-52252](https://cve.now/CVE-2023-52252.md): Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remo (no CVSS)
- [CVE-2023-52257](https://cve.now/CVE-2023-52257.md): LogoBee 0.2 allows updates.php?id= XSS. (no CVSS)
- [CVE-2023-52262](https://cve.now/CVE-2023-52262.md): outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extra (no CVSS)
- [CVE-2023-52263](https://cve.now/CVE-2023-52263.md): Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. (no CVSS)
- [CVE-2023-52264](https://cve.now/CVE-2023-52264.md): The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing\_url is m (no CVSS)
- [CVE-2023-52265](https://cve.now/CVE-2023-52265.md): IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update (CVSS 5.4)
- [CVE-2023-52266](https://cve.now/CVE-2023-52266.md): ehttp 1.0.6 before 17405b9 has an epoll\_socket.cpp read\_func use-after-free. (CVSS 7.5)
- [CVE-2023-52267](https://cve.now/CVE-2023-52267.md): ehttp 1.0.6 before 17405b9 has a simple\_log.cpp \_log out-of-bounds-read during error logging for long strings. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-12-30
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.