PUBLIÉES EN

décembre 2023

1 325 CVE, des plus récentes aux plus anciennes.

← novembre 2023 janvier 2024 →

CVE-2023-50783Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable. This flaw compro… 6.5 MOYENNE

CVE-2023-49920Apache Airflow, version 2.7.0 through 2.7.3, has a vulnerability that allows an attacker to trigger a DAG in a GET request without CSRF validation. As a result, it was possible for… 6.5 MOYENNE

CVE-2023-48291Apache Airflow, in versions prior to 2.8.0, contains a security vulnerability that allows an authenticated user with limited access to some DAGs, to craft a request that could give… 4.3 MOYENNE

CVE-2023-47265Apache Airflow, versions 2.6.0 through 2.7.3 has a stored XSS vulnerability that allows a DAG author to add an unbounded and not-sanitized javascript in the parameter description f… 5.4 MOYENNE

CVE-2023-7026A vulnerability was found in Lightxun IPTV Gateway up to 20231208. It has been rated as problematic. This issue affects some unknown processing of the file /ZHGXTV/index.php/admin/… 4.3 MOYENNE

CVE-2023-7023A vulnerability was found in Tongda OA 2017 up to 11.9. It has been rated as critical. Affected by this issue is some unknown functionality of the file general/vehicle/query/delete… 6.3 MOYENNE

CVE-2023-7022A vulnerability was found in Tongda OA 2017 up to 11.9. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file general/work_plan/m… 6.3 MOYENNE

CVE-2023-7021A vulnerability was found in Tongda OA 2017 up to 11.9. It has been classified as critical. Affected is an unknown function of the file general/vehicle/checkup/delete_search.php. T… 6.3 MOYENNE

CVE-2023-7020A vulnerability was found in Tongda OA 2017 up to 11.9 and classified as critical. This issue affects some unknown processing of the file general/wiki/cp/ct/view.php. The manipulat… 6.3 MOYENNE

CVE-2023-45700HCL Launch is vulnerable to HTML injection. This vulnerability may allow a user to embed arbitrary HTML tags in the Web UI potentially leading to sensitive information disclosure. 4.3 MOYENNE

CVE-2023-28025Due to this vulnerability, the Master operator could potentially incorporate an SVG tag into HTML, leading to an alert pop-up displaying a cookie. To mitigate stored XSS vulnerabil… 6.6 MOYENNE

CVE-2023-51390journalpump is a daemon that takes log messages from journald and pumps them to a given output. A logging vulnerability was found in journalpump which logs out the configuration of… 6.5 MOYENNE

CVE-2023-47093An issue was discovered in Stormshield Network Security (SNS) 4.0.0 through 4.3.21, 4.4.0 through 4.6.8, and 4.7.0. Sending a crafted ICMP packet may lead to a crash of the ASQ eng… 6.5 MOYENNE

CVE-2023-46131Grails is a framework used to build web applications with the Groovy programming language. A specially crafted web request can lead to a JVM crash or denial of service. Any Grails … 6.5 MOYENNE

CVE-2023-45703HCL Launch may mishandle input validation of an uploaded archive file leading to a denial of service due to resource exhaustion. 5.3 MOYENNE

CVE-2023-41166An issue was discovered in Stormshield Network Security (SNS) 3.7.0 through 3.7.39, 3.11.0 through 3.11.27, 4.3.0 through 4.3.22, 4.6.0 through 4.6.9, and 4.7.0 through 4.7.1. It's… 5.3 MOYENNE

CVE-2023-50639Cross Site Scripting (XSS) vulnerability in CuteHttpFileServer v.1.0 and v.2.0 allows attackers to obtain sensitive information via the file upload function in the home page. 5.4 MOYENNE

CVE-2023-49272Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'children' parameter of the reservation.php resource is copied int… 5.4 MOYENNE

CVE-2023-49271Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_out_date' parameter of the reservation.php resource is copi… 5.4 MOYENNE

CVE-2023-49270Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'check_in_date' parameter of the reservation.php resource is copie… 5.4 MOYENNE

CVE-2022-44684Windows Local Session Manager (LSM) Denial of Service Vulnerability 6.5 MOYENNE

CVE-2023-49269Hotel Management v1.0 is vulnerable to multiple authenticated Reflected Cross-Site Scripting vulnerabilities. The 'adults' parameter of the reservation.php resource is copied into … 5.4 MOYENNE

CVE-2023-28491Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tribulant Slideshow Gallery LITE.This issue affects Slideshow Gallery LITE: fr… 6.7 MOYENNE

CVE-2022-47599Deserialization of Untrusted Data vulnerability in File Manager by Bit Form Team File Manager – 100% Free & Open Source File Manager Plugin for WordPress | Bit File Manager.This is… 5.5 MOYENNE

CVE-2022-47597Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Popup Maker Popup Maker – Popup for opt-ins, lead gen, & more.This issue affects Popup Maker – Popup for… 5.3 MOYENNE

CVE-2023-3742Insufficient policy enforcement in ADB in Google Chrome on ChromeOS prior to 114.0.5735.90 allowed a local attacker to bypass device policy restrictions via physical access to the … 6.8 MOYENNE

CVE-2023-32128Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Adastra Crypto Cryptocurrency Payment & Donation Box – Accept Payments in any … 5.5 MOYENNE

CVE-2023-31092Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Foxskav Easy Bet.This issue affects Easy Bet: from n/a through 1.0.2. 5.5 MOYENNE

CVE-2023-36520Authorization Bypass Through User-Controlled Key vulnerability in MarketingFire Editorial Calendar.This issue affects Editorial Calendar: from n/a through 3.7.12. 5.4 MOYENNE

CVE-2023-35895IBM Informix JDBC Driver 4.10 and 4.50 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. IBM X-Force ID: 2591… 6.3 MOYENNE

CVE-2023-6784 A malicious user could potentially use the Sitefinity system for the distribution of phishing emails. 4.7 MOYENNE

CVE-2023-51462Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim… 5.4 MOYENNE

CVE-2023-51461Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject m… 5.4 MOYENNE

CVE-2023-51460Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject m… 5.4 MOYENNE

CVE-2023-51459Adobe Experience Manager versions 6.5.18 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If a low-privileged attacker is able to convince a victim… 5.4 MOYENNE

CVE-2023-51458Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject m… 5.4 MOYENNE

CVE-2023-51457Adobe Experience Manager versions 6.5.18 and earlier are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a low-privileged attacker to inject m… 5.4 MOYENNE

CVE-2023-41796Authorization Bypass Through User-Controlled Key vulnerability in WP Sunshine Sunshine Photo Cart: Free Client Galleries for Photographers.This issue affects Sunshine Photo Cart: F… 5.3 MOYENNE

CVE-2023-38513Authorization Bypass Through User-Controlled Key vulnerability in Jordy Meow Photo Engine (Media Organizer & Lightroom).This issue affects Photo Engine (Media Organizer & Lightroom… 5.4 MOYENNE

CVE-2023-6910A vulnerable API method in M-Files Server before 23.12.13195.0 allows for uncontrolled resource consumption. Authenticated attacker can exhaust server storage space to a point wher… 6.5 MOYENNE

CVE-2023-6769Stored XSS vulnerability in Amazing Little Poll, affecting versions 1.3 and 1.4. This vulnerability allows a remote attacker to store a malicious JavaScript payload in the "lp_admi… 6.5 MOYENNE

CVE-2023-47707IBM Security Guardium Key Lifecycle Manager 4.3 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus alterin… 5.4 MOYENNE

CVE-2023-47705IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to manipulate username data due to improper input validation. IBM X-Force ID: 271228. 4.3 MOYENNE

CVE-2023-47703IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. T… 5.3 MOYENNE

CVE-2023-47702IBM Security Guardium Key Lifecycle Manager 4.3 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containi… 4.3 MOYENNE

CVE-2023-47706IBM Security Guardium Key Lifecycle Manager 4.3 could allow an authenticated user to upload files of a dangerous file type. IBM X-Force ID: 271341. 6.6 MOYENNE

CVE-2023-47704IBM Security Guardium Key Lifecycle Manager 4.3 contains plain text hard-coded credentials or other secrets in source code repository. IBM X-Force ID: 271220. 4.0 MOYENNE

CVE-2023-50706 A user without administrator permissions with access to the UC500 windows system could perform a memory dump of the running processes and extract clear credentials or … 4.1 MOYENNE

CVE-2023-50705 An attacker could create malicious requests to obtain sensitive information about the web server. 5.3 MOYENNE

CVE-2023-50704 An attacker could construct a URL within the application that causes a redirection to an arbitrary external domain and could be leveraged to facilitate phishing attacks agains… 4.3 MOYENNE