Security Vulnerabilities - CVEs Published In December 2023
SLiMS (aka SENAYAN Library Management System) through 9.6.1 allows admin/modules/reporting/customs/staff_act.php SQL Injection via startDate or untilDate.
CVSS Score
8.8
EPSS Score
0.007
Published
2023-12-01
IBM AIX 7.2, 7.3, and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the invscout command to execute arbitrary commands. IBM X-Force ID: 267966.
CVSS Score
8.4
EPSS Score
0.003
Published
2023-12-01
RuoYi up to v4.6 was discovered to contain a SQL injection vulnerability via /system/dept/edit.
CVSS Score
9.8
EPSS Score
0.037
Published
2023-12-01
A vulnerability exists in the input validation of the GOOSE
messages where out of range values received and processed
by the IED caused a reboot of the device. In order for an
attacker to exploit the vulnerability, goose receiving blocks need
to be configured.
CVSS Score
6.5
EPSS Score
0.007
Published
2023-12-01
Improper Protection for Outbound Error Messages and Alert Signals vulnerability in ArslanSoft Education Portal allows Account Footprinting.
This issue affects Education Portal: before v1.1.
CVSS Score
7.5
EPSS Score
0.006
Published
2023-12-01
Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Command Injection.
This issue affects Education Portal: before v1.1.
CVSS Score
9.8
EPSS Score
0.017
Published
2023-12-01
Unrestricted Upload of File with Dangerous Type vulnerability in ArslanSoft Education Portal allows Read Sensitive Strings Within an Executable.
This issue affects Education Portal: before v1.1.
CVSS Score
7.5
EPSS Score
0.006
Published
2023-12-01
Cross-site Scripting (XSS) - Reflected in GitHub repository viliusle/minipaint prior to 4.14.0.
CVSS Score
8.6
EPSS Score
0.005
Published
2023-12-01
The password for access to the debugging console of the PoWer Controller chip (PWC) of the MIB3 infotainment is hard-coded in the firmware. The console allows attackers with physical access to the MIB3 unit to gain full control over the PWC chip.
Vulnerability found on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.
CVSS Score
3.5
EPSS Score
0.003
Published
2023-12-01
Access to critical Unified Diagnostics Services (UDS) of the Modular Infotainment Platform 3 (MIB3) infotainment is transmitted via Controller Area Network (CAN) bus in a form that can be easily decoded by attackers with physical access to the vehicle.
Vulnerability discovered on Škoda Superb III (3V3) - 2.0 TDI manufactured in 2022.
CVSS Score
3.3
EPSS Score
0.001
Published
2023-12-01