Skip to content
OpenAdvisories

Archive

December 2023

Vulnerabilities first published in this month (UTC), newest first.

← November 2023 2023 / December January 2024 →
  1. 158
  2. 210
  3. 39
  4. 4243
  5. 5131
  6. 656
  7. 7140
  8. 883
  9. 924
  10. 1024
  11. 1140
  12. 12192
  13. 13155
  14. 14157
  15. 15290
  16. 1619
  17. 1727
  18. 18106
  19. 19119
  20. 20116
  21. 21126
  22. 2280
  23. 2312
  24. 2411
  25. 2566
  26. 2669
  27. 2730
  28. 2874
  29. 29160
  30. 3036
  31. 3134
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Medium 4.3
    CVE-2023-7173 Public exploit

    PHPGurukul Hospital Management System registration.php cross site scripting

    A vulnerability, which was classified as problematic, was found in PHPGurukul Hospital Management System 1.0. This affects an unknown part of the file registration.php. The manipulation of the argument First Name leads to cross site scripting. It is possible …

    PHPGurukul Hospital Management System
  • Medium 5.9
    CVE-2023-44088 Public exploit

    SQL Injection in Visual Console

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Pandora FMS on all allows SQL Injection. Arbitrary SQL queries were allowed to be executed using any account with low privileges. This issue affects Pandora …

    Pandora FMS Pandora FMS
  • Medium 6.1
    CVE-2023-49438 Public exploit Scanner template

    Open redirect vulnerability in Flask-Security-Too

    An open redirect vulnerability in the python package Flask-Security-Too <=5.3.2 allows attackers to redirect unsuspecting users to malicious sites via a crafted URL by abusing the ?next parameter on the /login and /register routes.

    flask-security-too PyPI
  • Medium 5.3
    CVE-2023-49792 Public exploit

    Bruteforce protection can be bypassed with misconfigured proxy

    Nextcloud Server provides data storage for Nextcloud, an open source cloud platform. In Nextcloud Server prior to versions 26.0.9 and 27.1.4; as well as Nextcloud Enterprise Server prior to versions 23.0.12.13, 24.0.12.9, 25.0.13.4, 26.0.9, and 27.1.4; when a…

    Nextcloud security-advisories
  • Medium 4.3
    CVE-2023-6289 Public exploit

    Swift Performance Lite <= 2.3.6.14 - Unauthenticated Configuration Export

    The Swift Performance Lite WordPress plugin before 2.3.6.15 does not prevent users from exporting the plugin's settings, which may include sensitive information such as Cloudflare API tokens.

    Web / CMS
  • Medium 5.9
    CVE-2023-48795 Public exploit Scanner template EPSS 94%

    Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin

    The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server…

    zot kubescape kots k3d Debian Ubuntu Azure Linux Alpine Wolfi PyPI Go crates.io
  • Medium 6.5
    CVE-2023-51385 Public exploit EPSS 20%

    In ssh in OpenSSH before 9.6, OS command injection might occur if a user name or host name has shell metacharacters, an…

    openssh openssh openssh-ssh1 openssh Debian Ubuntu Azure Linux Alpine
  • Medium 6.3
    CVE-2023-6895 Public exploit Scanner template EPSS 89%

    Hikvision Intercom Broadcasting System ping.php os command injection

    A vulnerability was found in Hikvision Intercom Broadcasting System 3.0.3_20201113_RELEASE(HIK). It has been declared as critical. This vulnerability affects unknown code of the file /php/ping.php. The manipulation of the argument jsondata[ip] with the input …

    Hikvision Intercom Broadcasting System
  • Medium 6.2
    CVE-2023-45184 Public exploit

    IBM i Access Client Solutions

    IBM i Access Client Solutions 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.3 could allow an attacker to obtain a decryption key due to improper authority checks. IBM X-Force ID: 268270.

    IBM i Access Client Solutions
  • Medium 5.4
    CVE-2023-6710 Public exploit

    Mod_cluster/mod_proxy_cluster: stored cross site scripting

    A flaw was found in the mod_proxy_cluster in the Apache server. This issue may allow a malicious user to add a script in the 'alias' parameter in the URL to trigger the stored cross-site scripting (XSS) vulnerability. By adding a script on the alias parameter…

    Red Hat Red Hat Enterprise Linux 9 Red Hat JBoss Core Services JBoss Core Services on RHEL 7 Linux
  • Medium 6.5
    CVE-2023-35636 Public exploit EPSS 18%

    Microsoft Outlook Information Disclosure Vulnerability

    Microsoft Outlook Information Disclosure Vulnerability

    Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office 2019
  • Medium 6.7
    CVE-2023-36003 Public exploit

    XAML Diagnostics Elevation of Privilege Vulnerability

    XAML Diagnostics Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Medium 5.0
    CVE-2023-5536 Public exploit

    A feature in LXD (LP#1829071), affects the default configuration of Ubuntu Server which allows privileged users in the …

    Canonical Ubuntu Server cloud-init subiquity Ubuntu
  • Medium 6.3
    CVE-2023-6654 Public exploit

    PHPEMS Session Data session.cls.php deserialization

    A vulnerability classified as critical was found in PHPEMS 6.x/7.x/8.x/9.0. Affected by this vulnerability is an unknown functionality in the library lib/session.cls.php of the component Session Data Handler. The manipulation leads to deserialization. The att…

    phpems/phpems Packagist
  • Medium 6.1
    CVE-2023-4460 Public exploit

    Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG

    The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads.

    Web / CMS