PUBLIÉES EN

décembre 2023

1 325 CVE, des plus récentes aux plus anciennes.

← novembre 2023 janvier 2024 →

CVE-2023-23438 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions 4.0 MOYENNE

CVE-2023-23429 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. 4.0 MOYENNE

CVE-2023-23427 Some Honor products are affected by incorrect privilege assignment vulnerability, successful exploitation could cause device service exceptions. 4.0 MOYENNE

CVE-2023-23426 Some Honor products are affected by file writing vulnerability, successful exploitation could cause information disclosure. 6.6 MOYENNE

CVE-2023-23424 Some Honor products are affected by file writing vulnerability, successful exploitation could cause code execution 6.5 MOYENNE

CVE-2023-7146A vulnerability, which was classified as critical, has been found in gopeak MasterLab up to 3.3.10. This issue affects the function sqlInjectDelete of the file app/ctrl/framework/F… 6.3 MOYENNE

CVE-2023-7145A vulnerability classified as critical was found in gopeak MasterLab up to 3.3.10. This vulnerability affects the function sqlInject of the file app/ctrl/Framework.php of the compo… 6.3 MOYENNE

CVE-2023-31301Stored Cross Site Scripting (XSS) Vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obta… 6.1 MOYENNE

CVE-2023-31298Cross Site Scripting (XSS) vulnerability in Sesami Cash Point & Transport Optimizer (CPTO) version 6.3.8.6 (#718), allows remote attackers to execute arbitrary code and obtain sens… 4.8 MOYENNE

CVE-2023-31292An issue was discovered in Sesami Cash Point & Transport Optimizer (CPTO) 6.3.8.6 (#718), allows local attackers to obtain sensitive information and bypass authentication via "Back… 5.5 MOYENNE

CVE-2023-23435 Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file 4.0 MOYENNE

CVE-2023-23434 Some Honor products are affected by information leak vulnerability, successful exploitation could cause the information leak. 4.0 MOYENNE

CVE-2023-23433 Some Honor products are affected by signature management vulnerability, successful exploitation could cause the forged system file overwrite the correct system file. 4.0 MOYENNE

CVE-2023-7144A vulnerability classified as critical has been found in gopeak MasterLab up to 3.3.10. This affects the function sqlInject of the file app/ctrl/framework/Feature.php of the compon… 6.3 MOYENNE

CVE-2023-7142A vulnerability was found in code-projects Client Details System 1.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /a… 4.3 MOYENNE

CVE-2023-7141A vulnerability was found in code-projects Client Details System 1.0. It has been classified as problematic. Affected is an unknown function of the file /admin/update-clients.php. … 4.3 MOYENNE

CVE-2023-7140A vulnerability was found in code-projects Client Details System 1.0 and classified as problematic. This issue affects some unknown processing of the file /admin/manage-users.php. … 4.3 MOYENNE

CVE-2023-7139A vulnerability has been found in code-projects Client Details System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/regester.php of … 4.3 MOYENNE

CVE-2023-50448In ActiveAdmin (aka Active Admin) before 2.12.0, a concurrency issue allows a malicious actor to access potentially private data (that belongs to another user) by making CSV export… 6.5 MOYENNE

CVE-2023-7138A vulnerability, which was classified as critical, was found in code-projects Client Details System 1.0. This affects an unknown part of the file /admin of the component HTTP POST … 6.3 MOYENNE

CVE-2023-7137A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. Affected by this issue is some unknown functionality of the component … 6.3 MOYENNE

CVE-2022-36399Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointmen… 5.3 MOYENNE

CVE-2023-7134A vulnerability was found in SourceCodester Medicine Tracking System 1.0. It has been rated as critical. This issue affects some unknown processing. The manipulation of the argumen… 6.3 MOYENNE

CVE-2023-7133A vulnerability was found in y_project RuoYi 4.7.8. It has been declared as problematic. This vulnerability affects unknown code of the file /login of the component HTTP POST Reque… 4.3 MOYENNE

CVE-2023-7131A vulnerability was found in code-projects Intern Membership Management System 2.0 and classified as critical. Affected by this issue is some unknown functionality of the file /use… 6.3 MOYENNE

CVE-2023-7129A vulnerability, which was classified as critical, was found in code-projects Voting System 1.0. Affected is an unknown function of the component Voters Login. The manipulation of … 5.5 MOYENNE

CVE-2023-52081ffcss is a CLI interface to apply and configure Firefox CSS themes. Prior to 0.2.0, the function `lookupPreprocess()` is meant to apply some transformations to a string by disablin… 5.3 MOYENNE

CVE-2023-52079msgpackr is a fast MessagePack NodeJS/JavaScript implementation. Prior to 1.10.1, when decoding user supplied MessagePack messages, users can trigger stuck threads by crafting mess… 6.8 MOYENNE

CVE-2023-50267MeterSphere is a one-stop open source continuous testing platform. Prior to 2.10.10-lts, the authenticated attackers can update resources which don't belong to him if the resource … 4.3 MOYENNE

CVE-2023-7128A vulnerability, which was classified as critical, has been found in code-projects Voting System 1.0. This issue affects some unknown processing of the file /admin/ of the componen… 6.3 MOYENNE

CVE-2023-7127A vulnerability classified as critical was found in code-projects Automated Voting System 1.0. This vulnerability affects unknown code of the component Login. The manipulation of t… 6.3 MOYENNE

CVE-2023-50470A cross-site scripting (XSS) vulnerability in the component admin_ Video.php of SeaCMS v12.8 allows attackers to execute arbitrary web scripts or HTML via a crafted payload. 5.4 MOYENNE

CVE-2023-7126A vulnerability classified as critical has been found in code-projects Automated Voting System 1.0. This affects an unknown part of the file /admin/ of the component Admin Login. T… 6.3 MOYENNE

CVE-2023-50873Cross-Site Request Forgery (CSRF) vulnerability in Marios Alexandrou Add Any Extension to Pages.This issue affects Add Any Extension to Pages: from n/a through 1.4. 4.3 MOYENNE

CVE-2023-50860Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Booking for Appointments and Events Calendar – Amelia allows Stored XSS.Th… 6.5 MOYENNE

CVE-2023-50859Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum WP Crowdfunding allows Stored XSS.This issue affects WP Crowdfunding: … 6.5 MOYENNE

CVE-2023-50858Cross-Site Request Forgery (CSRF) vulnerability in Bill Minozzi Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan.This issue affects Disabl… 5.4 MOYENNE

CVE-2023-50836Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ibericode HTML Forms allows Stored XSS.This issue affects HTML Forms: from n/a… 5.9 MOYENNE

CVE-2023-36381Deserialization of Untrusted Data vulnerability in Gesundheit Bewegt GmbH Zippy.This issue affects Zippy: from n/a through 1.6.5. 6.6 MOYENNE

CVE-2023-27447Exposure of Sensitive Information to an Unauthorized Actor vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc.This issu… 5.3 MOYENNE

CVE-2023-50874Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Darren Cooney WordPress Infinite Scroll – Ajax Load More allows Stored XSS.Thi… 6.5 MOYENNE

CVE-2023-4672Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Talent Software ECOP allows Reflected XSS. This issue affects ECOP: before 32… 6.1 MOYENNE

CVE-2023-45702An HCL UrbanCode Deploy Agent installed as a Windows service in a non-standard location could be subject to a denial of service attack by local accounts.. 6.2 MOYENNE

CVE-2023-45701HCL Launch could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in furth… 4.3 MOYENNE

CVE-2023-49469Reflected Cross Site Scripting (XSS) vulnerability in Shaarli v0.12.2, allows remote attackers to execute arbitrary code via search tag function. 6.1 MOYENNE

CVE-2023-51010An issue in the export component AdSdkH5Activity of com.sdjictec.qdmetro v4.2.2 allows attackers to open a crafted URL without any filtering or checking. 5.3 MOYENNE

CVE-2023-49229An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitiv… 4.3 MOYENNE

CVE-2023-49228An issue was discovered in Peplink Balance Two before 8.4.0. Console port authentication uses hard-coded credentials, which allows an attacker with physical access and sufficient k… 6.4 MOYENNE

CVE-2023-7124A vulnerability, which was classified as problematic, was found in code-projects E-Commerce Site 1.0. Affected is an unknown function of the file search.php. The manipulation of th… 4.3 MOYENNE

CVE-2023-34829Incorrect access control in TP-Link Tapo before v3.1.315 allows attackers to access user credentials in plaintext. 6.5 MOYENNE