# CVEs published 2023-01-24

122 CVEs were published on January 24, 2023: 14 critical, 47 high. Days are UTC.

- [CVE-2023-24508](https://cve.now/CVE-2023-24508.md): Remote Code Execution in Baicells RTS Platform (CVSS 8.1, Baicells Nova)
- [CVE-2023-23612](https://cve.now/CVE-2023-23612.md): Issue with whitespace in JWT roles in OpenSearch (CVSS 4.7, opensearch-project security · org.opensearch.plugin:opensea…)
- [CVE-2023-23613](https://cve.now/CVE-2023-23613.md): Field-level security issue with .keyword fields in OpenSearch (CVSS 5.7, opensearch-project security · org.opensearch.plugin:opensea…)
- [CVE-2023-0356](https://cve.now/CVE-2023-0356.md): SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in… (CVSS 5.7, SOCOMEC MODULYS GP)
- [CVE-2023-0463](https://cve.now/CVE-2023-0463.md): The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to… (CVSS 7.8, Devolutions Remote Desktop Manager)
- [CVE-2023-24022](https://cve.now/CVE-2023-24022.md): Hard Coded Credential Crypt Vulnerability (CVSS 10.0, Baicells Nova)
- [CVE-2023-0284](https://cve.now/CVE-2023-0284.md): Improper validation of LDAP user IDs (CVSS 6.8, Tribe29 Checkmk)
- [CVE-2022-45820](https://cve.now/CVE-2022-45820.md): WordPress LearnPress Plugin \<= 4.1.7.3.2 is vulnerable to SQL Injection (CVSS 9.1, ThimPress LearnPress – WordPress LMS Plugin)
- [CVE-2022-45808](https://cve.now/CVE-2022-45808.md): WordPress LearnPress Plugin \<= 4.1.7.3.2 is vulnerable to SQL Injection (CVSS 9.9, ThimPress LearnPress – WordPress LMS Plugin)
- [CVE-2022-47615](https://cve.now/CVE-2022-47615.md): WordPress LearnPress Plugin \<= 4.1.7.3.2 is vulnerable to Local File Inclusion (CVSS 9.3, ThimPress LearnPress – WordPress LMS Plugin)
- [CVE-2022-25860](https://cve.now/CVE-2022-25860.md): Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and… (CVSS 8.1, simple-git)
- [CVE-2022-25908](https://cve.now/CVE-2022-25908.md): All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper… (CVSS 7.4, create-choo-electron)
- [CVE-2022-25350](https://cve.now/CVE-2022-25350.md): All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization. (CVSS 7.4, puppet-facter)
- [CVE-2023-23608](https://cve.now/CVE-2023-23608.md): spotipy Path traversal vulnerability that may lead to type confusion in URI handling code (CVSS 0.0, spotipy-dev spotipy · spotipy)
- [CVE-2023-22486](https://cve.now/CVE-2023-22486.md): cmark-gfm Quadratic complexity bug in handle\_close\_bracket may lead to a denial of service (CVSS 3.5, github cmark-gfm)
- [CVE-2023-22485](https://cve.now/CVE-2023-22485.md): cmark-gfm out-of-bounds read in validate\_protocol (CVSS 5.3, github cmark-gfm)
- [CVE-2021-28510](https://cve.now/CVE-2021-28510.md): For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid… (CVSS 5.3, Arista Networks EOS)
- [CVE-2022-20213](https://cve.now/CVE-2022-20213.md): In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. (CVSS 5.5, Android)
- [CVE-2022-20214](https://cve.now/CVE-2022-20214.md): In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. (CVSS 4.7, Android)
- [CVE-2022-20215](https://cve.now/CVE-2022-20215.md): In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. (CVSS 5.5, Android)
- [CVE-2022-20235](https://cve.now/CVE-2022-20235.md): The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem. (CVSS 5.5, Android)
- [CVE-2022-20456](https://cve.now/CVE-2022-20456.md): In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android)
- [CVE-2022-20458](https://cve.now/CVE-2022-20458.md): The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. (CVSS 5.5, Android)
- [CVE-2022-20461](https://cve.now/CVE-2022-20461.md): In pinReplyNative of com\_android\_bluetooth\_btservice\_AdapterService.cpp, there is a possible out of bounds read due to type confusion. (CVSS 7.8, Android)
- [CVE-2022-20489](https://cve.now/CVE-2022-20489.md): In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android)
- [CVE-2022-20490](https://cve.now/CVE-2022-20490.md): In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android)
- [CVE-2022-20492](https://cve.now/CVE-2022-20492.md): In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android)
- [CVE-2022-20493](https://cve.now/CVE-2022-20493.md): In Condition of Condition.java, there is a possible way to grant notification access due to improper input validation. (CVSS 7.8, Android)
- [CVE-2022-20494](https://cve.now/CVE-2022-20494.md): In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. (CVSS 5.5, Android)
- [CVE-2022-26329](https://cve.now/CVE-2022-26329.md): File existence disclosue vulnerability in IDM plugin (CVSS 1.8, Micro Focus NetIQ Identity Manager)
- [CVE-2022-27507](https://cve.now/CVE-2022-27507.md): Authenticated denial of service (CVSS 6.5, Citirx Citrix Application Delivery Controller (Citrix ADC)…)
- [CVE-2022-27508](https://cve.now/CVE-2022-27508.md): Unauthenticated denial of service (CVSS 7.5, Citirx Citrix Application Delivery Controller (Citrix ADC)…)
- [CVE-2022-3478](https://cve.now/CVE-2022-3478.md): An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before… (CVSS 4.3, GitLab)
- [CVE-2022-3482](https://cve.now/CVE-2022-3482.md): An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to… (CVSS 5.3, GitLab)
- [CVE-2022-3572](https://cve.now/CVE-2022-3572.md): A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4… (CVSS 9.3, GitLab)
- [CVE-2022-3740](https://cve.now/CVE-2022-3740.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5… (CVSS 6.5, GitLab)
- [CVE-2022-3820](https://cve.now/CVE-2022-3820.md): An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. (CVSS 6.5, GitLab)
- [CVE-2022-38774](https://cve.now/CVE-2022-38774.md): An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow… (CVSS 7.8, Elastic Endpoint Security and Elastic Endgame Security)
- [CVE-2022-38775](https://cve.now/CVE-2022-38775.md): An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate… (CVSS 7.8, Elastic Endpoint Security)
- [CVE-2022-3902](https://cve.now/CVE-2022-3902.md): An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before… (CVSS 5.5, GitLab)
- [CVE-2022-40036](https://cve.now/CVE-2022-40036.md): An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing permission checks… (CVSS 6.5)
- [CVE-2022-40037](https://cve.now/CVE-2022-40037.md): An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the… (CVSS 9.8)
- [CVE-2022-4054](https://cve.now/CVE-2022-4054.md): An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before… (CVSS 5.5, GitLab)
- [CVE-2022-4092](https://cve.now/CVE-2022-4092.md): An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. (CVSS 5.7, GitLab)
- [CVE-2022-4554](https://cve.now/CVE-2022-4554.md): Reflected XSS B2B Dealer Ordering System (CVSS 5.4, ID Software Project and Consultancy Services B2B Customer O…)
- [CVE-2022-45639](https://cve.now/CVE-2022-45639.md): OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the… (CVSS 7.8)
- [CVE-2022-47040](https://cve.now/CVE-2022-47040.md): An issue in ASKEY router RTF3505VW-N1 BR\_SV\_g000\_R3505VMN1001\_s32\_7 allows attackers to escalate privileges via running the tcpdump… (CVSS 7.8)
- [CVE-2022-47042](https://cve.now/CVE-2022-47042.md): MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do. (CVSS 8.8, net.mingsoft:ms-mcms)
- [CVE-2022-47100](https://cve.now/CVE-2022-47100.md): A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE… (CVSS 7.5)
- [CVE-2022-48199](https://cve.now/CVE-2022-48199.md): SoftPerfect NetWorx 7.1.1 on Windows allows an attacker to execute a malicious binary with potentially higher privileges via a… (CVSS 8.8)
- [CVE-2023-0394](https://cve.now/CVE-2023-0394.md): A NULL pointer dereference flaw was found in rawv6\_push\_pending\_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. (CVSS 5.5, Kernel)
- [CVE-2023-0411](https://cve.now/CVE-2023-0411.md): Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection… (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0412](https://cve.now/CVE-2023-0412.md): TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture… (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0413](https://cve.now/CVE-2023-0413.md): Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture… (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0414](https://cve.now/CVE-2023-0414.md): Crash in the EAP dissector in Wireshark 4.0.0 to 4.0.2 allows denial of service via packet injection or crafted capture file (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0415](https://cve.now/CVE-2023-0415.md): iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture… (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0416](https://cve.now/CVE-2023-0416.md): GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture… (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0417](https://cve.now/CVE-2023-0417.md): Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or… (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0444](https://cve.now/CVE-2023-0444.md): A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. (CVSS 8.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-0448](https://cve.now/CVE-2023-0448.md): The WP Helper Lite WordPress plugin, in versions \< 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected… (CVSS 6.1, WP Helper Lite Wordpress Plugin)
- [CVE-2023-0471](https://cve.now/CVE-2023-0471.md): Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption… (CVSS 8.8, Google Chrome)
- [CVE-2023-0472](https://cve.now/CVE-2023-0472.md): Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a… (CVSS 8.8, Google Chrome)
- [CVE-2023-0473](https://cve.now/CVE-2023-0473.md): Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap… (CVSS 8.8, Google Chrome)
- [CVE-2023-0474](https://cve.now/CVE-2023-0474.md): Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious… (CVSS 8.8, Google Chrome)
- [CVE-2023-20904](https://cve.now/CVE-2023-20904.md): In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. (CVSS 7.8, Android)
- [CVE-2023-20905](https://cve.now/CVE-2023-20905.md): In Mfc\_Transceive of phNxpExtns\_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Android)
- [CVE-2023-20908](https://cve.now/CVE-2023-20908.md): In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. (CVSS 5.5, Android)
- [CVE-2023-20912](https://cve.now/CVE-2023-20912.md): In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing… (CVSS 7.8, Android)
- [CVE-2023-20913](https://cve.now/CVE-2023-20913.md): In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious… (CVSS 7.8, Android)
- [CVE-2023-20915](https://cve.now/CVE-2023-20915.md): In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due… (CVSS 7.8, Android)
- [CVE-2023-20916](https://cve.now/CVE-2023-20916.md): In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from… (CVSS 7.8, Android)
- [CVE-2023-20919](https://cve.now/CVE-2023-20919.md): In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. (CVSS 7.8, Android)
- [CVE-2023-20920](https://cve.now/CVE-2023-20920.md): In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. (CVSS 7.8, Android)
- [CVE-2023-20921](https://cve.now/CVE-2023-20921.md): In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a… (CVSS 7.3, Android)
- [CVE-2023-20922](https://cve.now/CVE-2023-20922.md): In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. (CVSS 5.5, Android)
- [CVE-2023-20923](https://cve.now/CVE-2023-20923.md): In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions… (CVSS 5.5, Android)
- [CVE-2023-20924](https://cve.now/CVE-2023-20924.md): In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. (CVSS 6.8, Android)
- [CVE-2023-20925](https://cve.now/CVE-2023-20925.md): In setUclampMinLocked of PowerSessionManager.cpp, there is a possible way to corrupt memory due to a use after free. (CVSS 7.8, Android)
- [CVE-2023-20928](https://cve.now/CVE-2023-20928.md): In binder\_vma\_close of binder.c, there is a possible use after free due to improper locking. (CVSS 7.8, Android)
- [CVE-2023-23331](https://cve.now/CVE-2023-23331.md): Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection. (CVSS 9.8)
- [CVE-2023-23949](https://cve.now/CVE-2023-23949.md): An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser. (CVSS 8.1, Symantec Identity Management And Governance)
- [CVE-2023-23950](https://cve.now/CVE-2023-23950.md): User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. (CVSS 6.1, Symantec Identity Management And Governance)
- [CVE-2023-23951](https://cve.now/CVE-2023-23951.md): Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application (CVSS 6.1, Symantec Identity Management And Governance)
- [CVE-2023-24057](https://cve.now/CVE-2023-24057.md): HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal… (CVSS 8.1, org.hl7.fhir.publisher:org.hl7.fhir.publisher · ca.uhn.h… +5)
- [CVE-2023-24422](https://cve.now/CVE-2023-24422.md): A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a\_2fb\_25 and earlier allows… (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2023-24423](https://cve.now/CVE-2023-24423.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous… (CVSS 6.5, Jenkins Project Jenkins Gerrit Trigger Plugin · com.sonyeri…)
- [CVE-2023-24424](https://cve.now/CVE-2023-24424.md): Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login. (CVSS 8.8, Jenkins Project Jenkins OpenId Connect Authentication Plugi…)
- [CVE-2023-24425](https://cve.now/CVE-2023-24425.md): Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes… (CVSS 6.5, Jenkins Project Jenkins Kubernetes Credentials Provider Plu…)
- [CVE-2023-24426](https://cve.now/CVE-2023-24426.md): Jenkins Azure AD Plugin 303.va\_91ef20ee49f and earlier does not invalidate the previous session on login. (CVSS 8.8, Jenkins Project Jenkins Azure AD Plugin · org.jenkins-ci.pl…)
- [CVE-2023-24427](https://cve.now/CVE-2023-24427.md): Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login. (CVSS 9.8, Jenkins Project Jenkins Bitbucket OAuth Plugin · org.jenkin…)
- [CVE-2023-24428](https://cve.now/CVE-2023-24428.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into… (CVSS 5.7, Jenkins Project Jenkins Bitbucket OAuth Plugin · org.jenkin…)
- [CVE-2023-24429](https://cve.now/CVE-2023-24429.md): Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements… (CVSS 9.8, Jenkins Project Jenkins Semantic Versioning Plugin · org.je…)
- [CVE-2023-24430](https://cve.now/CVE-2023-24430.md): Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 9.8, Jenkins Project Jenkins Semantic Versioning Plugin · org.je…)
- [CVE-2023-24431](https://cve.now/CVE-2023-24431.md): A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to… (CVSS 4.3, Jenkins Project Jenkins Orka by MacStadium Plugin · io.jenk…)
- [CVE-2023-24432](https://cve.now/CVE-2023-24432.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an… (CVSS 8.8, Jenkins Project Jenkins Orka by MacStadium Plugin · io.jenk…)
- [CVE-2023-24433](https://cve.now/CVE-2023-24433.md): Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to… (CVSS 6.5, Jenkins Project Jenkins Orka by MacStadium Plugin · io.jenk…)
- [CVE-2023-24434](https://cve.now/CVE-2023-24434.md): A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to… (CVSS 8.8, Jenkins Project Jenkins GitHub Pull Request Builder Plugin…)
- [CVE-2023-24435](https://cve.now/CVE-2023-24435.md): A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission… (CVSS 6.5, Jenkins Project Jenkins GitHub Pull Request Builder Plugin…)
- [CVE-2023-24436](https://cve.now/CVE-2023-24436.md): A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission… (CVSS 4.3, Jenkins Project Jenkins GitHub Pull Request Builder Plugin…)
- [CVE-2023-24437](https://cve.now/CVE-2023-24437.md): A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers… (CVSS 8.8, Jenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…)
- [CVE-2023-24438](https://cve.now/CVE-2023-24438.md): A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read… (CVSS 6.5, Jenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…)
- [CVE-2023-24439](https://cve.now/CVE-2023-24439.md): Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file… (CVSS 5.5, Jenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…)
- [CVE-2023-24440](https://cve.now/CVE-2023-24440.md): Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins… (CVSS 5.5, Jenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…)
- [CVE-2023-24441](https://cve.now/CVE-2023-24441.md): Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 9.8, Jenkins Project Jenkins MSTest Plugin · org.jvnet.hudson.pl…)
- [CVE-2023-24442](https://cve.now/CVE-2023-24442.md): Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar… (CVSS 5.5, Jenkins Project Jenkins GitHub Pull Request Coverage Status…)
- [CVE-2023-24443](https://cve.now/CVE-2023-24443.md): Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 9.8, Jenkins Project Jenkins TestComplete support Plugin · org.j…)
- [CVE-2023-24444](https://cve.now/CVE-2023-24444.md): Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login. (CVSS 9.8, Jenkins Project Jenkins OpenID Plugin · org.jenkins-ci.plug…)
- [CVE-2023-24445](https://cve.now/CVE-2023-24445.md): Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. (CVSS 6.1, Jenkins Project Jenkins OpenID Plugin · org.jenkins-ci.plug…)
- [CVE-2023-24446](https://cve.now/CVE-2023-24446.md): A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in… (CVSS 8.8, Jenkins Project Jenkins OpenID Plugin · org.jenkins-ci.plug…)
- [CVE-2023-24447](https://cve.now/CVE-2023-24447.md): A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an… (CVSS 8.8, Jenkins Project Jenkins RabbitMQ Consumer Plugin · org.jenk…)
- [CVE-2023-24448](https://cve.now/CVE-2023-24448.md): A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to… (CVSS 6.5, Jenkins Project Jenkins RabbitMQ Consumer Plugin · org.jenk…)
- [CVE-2023-24449](https://cve.now/CVE-2023-24449.md): Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation… (CVSS 4.3, Jenkins Project Jenkins PWauth Security Realm Plugin · org.…)
- [CVE-2023-24450](https://cve.now/CVE-2023-24450.md): Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can… (CVSS 6.5, Jenkins Project Jenkins view-cloner Plugin · org.jenkins-ci…)
- [CVE-2023-24451](https://cve.now/CVE-2023-24451.md): A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to… (no CVSS, Jenkins Project Jenkins Cisco Spark Notifier Plugin · org.j…)
- [CVE-2023-24452](https://cve.now/CVE-2023-24452.md): A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an… (CVSS 8.8, Jenkins Project Jenkins TestQuality Updater Plugin · org.je…)
- [CVE-2023-24453](https://cve.now/CVE-2023-24453.md): A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an… (CVSS 6.5, Jenkins Project Jenkins TestQuality Updater Plugin · org.je…)
- [CVE-2023-24454](https://cve.now/CVE-2023-24454.md): Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on… (CVSS 5.5, Jenkins Project Jenkins TestQuality Updater Plugin · org.je…)
- [CVE-2023-24455](https://cve.now/CVE-2023-24455.md): Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing… (CVSS 4.3, Jenkins Project Jenkins visualexpert Plugin · io.jenkins.pl…)
- [CVE-2023-24456](https://cve.now/CVE-2023-24456.md): Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login. (CVSS 9.8, Jenkins Project Jenkins Keycloak Authentication Plugin · or…)
- [CVE-2023-24457](https://cve.now/CVE-2023-24457.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick… (CVSS 6.5, Jenkins Project Jenkins Keycloak Authentication Plugin · or…)
- [CVE-2023-24458](https://cve.now/CVE-2023-24458.md): A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an… (CVSS 8.8, Jenkins Project Jenkins BearyChat Plugin · org.jenkins-ci.p…)
- [CVE-2023-24459](https://cve.now/CVE-2023-24459.md): A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an… (CVSS 6.5, Jenkins Project Jenkins BearyChat Plugin · org.jenkins-ci.p…)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2023-01-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.