Skip to content
OpenAdvisories

Archive

December 2023

Vulnerabilities first published in this month (UTC), newest first.

← November 2023 2023 / December January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Critical 9.9
    CVE-2023-47840 Public exploit

    WordPress Qode Essential Addons Plugin <= 1.5.2 is vulnerable to Remote Code Execution (RCE)

    Improper Control of Generation of Code ('Code Injection') vulnerability in Qode Interactive Qode Essential Addons.This issue affects Qode Essential Addons: from n/a through 1.5.2.

    Qode Interactive Qode Essential Addons
  • Critical 9.3
    CVE-2023-50839 Public exploit Scanner template

    WordPress JS Help Desk – Best Help Desk & Support Plugin <= 2.8.1 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.1.

    JS Help Desk JS Help Desk – Best Help Desk & Support Plugin
  • Critical 9.8
    CVE-2023-43481 Public exploit

    An issue in Shenzhen TCL Browser TV Web BrowseHere (aka com.tcl.browser) 6.65.022_dab24cc6_231221_gp allows a remote at…

  • Critical 9.8
    CVE-2023-49954 Public exploit

    The CRM Integration in 3CX before 18.0.9.23 and 20 before 20.0.0.1494 allows SQL Injection via a first name, search str…

  • Critical 9.8
    CVE-2023-6972 Public exploit

    Backup Migration <= 1.3.9 - Unauthenticated Path Traversal to Arbitrary File Deletion

    The Backup Migration plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 1.3.9 via the 'content-backups' and 'content-name', 'content-manifest', or 'content-bmitmp' and 'content-identy' HTTP headers. This makes it possib…

    Inisev BackupBliss – Backup & Migration with Free Cloud Storage Web / CMS
  • Critical 9.3
    CVE-2023-50254 Public exploit

    Deepin Reader RCE vulnerability due to a design flaw

    Deepin Linux's default document reader `deepin-reader` software suffers from a serious vulnerability in versions prior to 6.0.7 due to a design flaw that leads to remote command execution via crafted docx document. This is a file overwrite vulnerability. Remo…

    linuxdeepin developer-center
  • Critical 10.0
    CVE-2023-29384 Public exploit

    WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.0 is vulnerable to Arbitrary File Upload

    Unrestricted Upload of File with Dangerous Type vulnerability in HM Plugin WordPress Job Board and Recruitment Plugin – JobWP.This issue affects WordPress Job Board and Recruitment Plugin – JobWP: from n/a through 2.0.

    HM Plugin WordPress Job Board and Recruitment Plugin – JobWP Web / CMS
  • Critical 9.3
    CVE-2023-32590 Public exploit Scanner template

    WordPress Subscribe to Category Plugin <= 2.7.4 is vulnerable to SQL Injection

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Daniel Söderström / Sidney van de Stouwe Subscribe to Category.This issue affects Subscribe to Category: from n/a through 2.7.4.

    Daniel Söderström / Sidney van de Stouwe Subscribe to Category
  • Critical 9.8
    CVE-2023-6553 Public exploit Scanner template EPSS 98%

    Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution

    The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.7 via the /includes/backup-heart.php file. This is due to an attacker being able to control the values passed to an include, and subsequ…

    Inisev BackupBliss – Backup & Migration with Free Cloud Storage Web / CMS
  • Critical 9.6
    CVE-2023-6572 Public exploit

    Command Injection in gradio-app/gradio

    Command Injection in GitHub repository gradio-app/gradio prior to main.

    gradio-app gradio-app/gradio gradio PyPI
  • Critical 9.8
    CVE-2023-42495 Public exploit

    Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    Dasan Networks - W-Web versions 1.22-1.27 - CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

    Dasan Networks Dasan Networks
  • Critical 9.8
    CVE-2023-43364 Public exploit

    Searchor CLI's Search vulnerable to Arbitrary Code using Eval

    main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution.

    searchor PyPI
  • Critical 9.8
    CVE-2023-50245 Public exploit

    OpenEXR-viewer memory overflow vulnerability

    OpenEXR-viewer is a viewer for OpenEXR files with detailed metadata probing. Versions prior to 0.6.1 have a memory overflow vulnerability. This issue is fixed in version 0.6.1.

    afichet openexr-viewer afichet/openexr-viewer GitHub Actions
  • Critical 9.8
    CVE-2023-50164 Public exploit EPSS 81%

    Apache Struts: File upload component had a directory traversal vulnerability

    An attacker can manipulate file upload params to enable paths traversal and under some circumstances this can lead to uploading a malicious file which can be used to perform Remote Code Execution. Users are recommended to upgrade to versions Struts 2.5.33 or …

    Apache Software Foundation Apache Struts org.apache.struts:struts2-core Maven
  • Critical 9.6
    CVE-2023-22524 Public exploit EPSS 25%

    Certain versions of the Atlassian Companion App for MacOS were affected by a remote code execution vulnerability. An at…

    Atlassian Companion for Mac
  • Critical 9.8
    CVE-2023-48842 Public exploit

    D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter a…