CVEs published January 29, 2024
94 CVEs were published on January 29, 2024: 5 critical, 39 high. Browse them by severity, product and exploitation status.
- Published
- 94
- Critical
- 5
- High
- 39
- Medium
- 44
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Totolink N200RE
- 8
- OpenText AppBuilder
- 5
- Red Hat Enterprise Linux
- 5
- SourceCodester Employee Management System
- 5
- Tenda i6
- 4
- OTRS AG OTRS
- 3
- Sichuan Yougou Technology KuERP
- 3
- 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- 2
- aio-libs aiohttp · aiohttp
- 2
- Rebuild
- 2
Critical 5
- CVE-2024-23827Nginx-UI arbitrary file write through the Import Certificate feature0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2024-1015Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3SE-elektronic E-DDC3.3
- CVE-2023-51839DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.@devicefarmer/stf
- CVE-2023-51840DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.
- CVE-2024-24141Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter.
High 39
- CVE-2023-4551Command Injection via Task SchedulerOpenText AppBuilder
- CVE-2023-4550Unauthenticated Arbitrary File ReadOpenText AppBuilder
- CVE-2024-23940Trend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable…Trend Micro Security (Consumer) uiAirSupport
- CVE-2024-23828Nginx-UI authenticated RCE through injecting into the application config via CRLF0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2024-1009SourceCodester Employee Management System login.php sql injectionSourceCodester Employee Management System
- CVE-2023-1705Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege…Forcepoint F|One SmartEdge Agent
- CVE-2024-1006Shanxi Diankeyun Technology NODERP Cookie common.php improper authenticationShanxi Diankeyun Technology NODERP
- CVE-2024-1004Totolink N200RE cstecgi.cgi loginAuth stack-based overflowTotolink N200RE
- CVE-2023-40548Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsRed Hat Enterprise Linux
- CVE-2023-6390WordPress Users <= 1.4 - Settings Update via CSRFWordPress Users
- CVE-2023-6391Custom User CSS <= 0.2 - Settings Update via CSRFCustom User CSS
- CVE-2023-6946Autotitle for WordPress <= 1.0.3 - Settings Update to Stored XSS via CSRFAutotitle for WordPress
- CVE-2023-7204WP STAGING WordPress Backup Plugin < 3.2.0 - Unauthorized Sensitive Data ExposureWP STAGING WordPress Backup Plugin
- CVE-2023-6279Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoSWoostify Sites Library
- CVE-2023-7074WP Social Bookmark Menu <= 1.2 - Settings Update via CSRFWP SOCIAL BOOKMARK MENU
- CVE-2024-1003Totolink N200RE cstecgi.cgi setLanguageCfg stack-based overflowTotolink N200RE
- CVE-2024-1002Totolink N200RE cstecgi.cgi setIpPortFilterRules stack-based overflowTotolink N200RE
- CVE-2024-1001Totolink N200RE cstecgi.cgi main stack-based overflowTotolink N200RE
- CVE-2024-1000Totolink N200RE cstecgi.cgi setTracerouteCfg stack-based overflowTotolink N200RE
- CVE-2024-0999Totolink N200RE cstecgi.cgi setParentalRules stack-based overflowTotolink N200RE
- CVE-2024-0998Totolink N200RE cstecgi.cgi setDiagnosisCfg stack-based overflowTotolink N200RE
- CVE-2024-0997Totolink N200RE cstecgi.cgi setOpModeCfg stack-based overflowTotolink N200RE
- CVE-2023-29055Apache Kylin: Insufficiently protected credentials in config fileApache Software Foundation Apache Kylin · org.apache.kylin:…
- CVE-2023-5378Stored XSS in SmodBIP and MegaBIPJan Syski MegaBIP · Jan Syski SmodBIP
- CVE-2023-46838Linux: netback processing of zero-length transmit fragmentLinux
Show all 39 entriesShow fewer entries
- CVE-2024-0212Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)Cloudflare-WordPress
- CVE-2024-0996Tenda i9 httpd setcfm formSetCfm stack-based overflowTenda i9
- CVE-2024-0995Tenda W6 httpd wifiSSIDset formwrlSSIDset stack-based overflowTenda W6
- CVE-2024-0994Tenda W6 httpd setcfm formSetCfm stack-based overflowTenda W6
- CVE-2024-0993Tenda i6 httpd WifiMacFilterGet formWifiMacFilterGet stack-based overflowTenda i6
- CVE-2024-0992Tenda i6 httpd wifiSSIDset formwrlSSIDset stack-based overflowTenda i6
- CVE-2024-0991Tenda i6 httpd setcfm formSetCfm stack-based overflowTenda i6
- CVE-2024-0990Tenda i6 httpd setAutoPing formSetAutoPing stack-based overflowTenda i6
- CVE-2023-49038Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated attacker to inject arbitrary commands onto…
- CVE-2023-51842An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16.meshcentral
- CVE-2024-23747The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability.
- CVE-2024-24139Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter.
- CVE-2024-24140Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'
- CVE-2024-24736The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remote denial of service (reboot) via a long string to TCP port 110, a related…
Medium, low and unrated 50
- CVE-2024-1022CodeAstro Simple Student Result Management System Add Class Page add_classes.php cross site scriptingCodeAstro Simple Student Result Management System
- CVE-2024-23334aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversalaio-libs aiohttp · aiohttp
- CVE-2024-23829aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separatorsaio-libs aiohttp · aiohttp
- CVE-2024-1021Rebuild HTTP Request readRawText server-side request forgeryRebuild
- CVE-2024-1020Rebuild proxy-download getStorageFile cross site scriptingRebuild
- CVE-2023-4554XML External Entity (XXE) ProcessingOpenText AppBuilder
- CVE-2023-4553Unauthenticated Access to AppBuilder Configuration FilesOpenText AppBuilder
- CVE-2023-4552Java Database Connectivity (JDBC) URL ManipulationOpenText AppBuilder
- CVE-2024-1018PbootCMS cross site scriptingPbootCMS
- CVE-2023-22836In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the default…com.palantir.skywise:guardian
- CVE-2024-1017Gabriels FTP Server denial of serviceGabriels FTP Server
- CVE-2023-30970Gotham table and Forward App Path traversalcom.palantir.gotham:blackbird-witchcraft
- CVE-2024-1016Solar FTP Server PASV Command denial of serviceSolar FTP Server
- CVE-2024-1011SourceCodester Employee Management System Leave delete-leave.php access controlSourceCodester Employee Management System
- CVE-2023-40551Shim: out of bounds read when parsing mz binariesRed Hat Enterprise Linux
- CVE-2024-1010SourceCodester Employee Management System edit-profile.php cross site scriptingSourceCodester Employee Management System
- CVE-2023-40546Shim: out-of-bounds read printing error messagesRed Hat Enterprise Linux
- CVE-2023-40549Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe fileRed Hat Enterprise Linux
- CVE-2023-40550Shim: out-of-bound read in verify_buffer_sbat()Red Hat Enterprise Linux
- CVE-2024-0788SUPERAntiSpyware Pro X v10.0.1260 - Kernel-level API parameters manipulationSUPERAntiSpyware Pro X
- CVE-2024-23441Vba32 Antivirus v3.36.0 - Denial of Service (DoS)VirusBlokAda Vba32 Antivirus
- CVE-2024-1008SourceCodester Employee Management System Profile Page edit-photo.php unrestricted uploadSourceCodester Employee Management System
- CVE-2024-1007SourceCodester Employee Management System edit_profile.php sql injectionSourceCodester Employee Management System
- CVE-2024-23826Uploading an image with a specific filename causes a server-side DoSspbu-se spbu_se_site
- CVE-2024-23822Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)sni Thruk
Show all 50 entriesShow fewer entries
- CVE-2024-1005Shanxi Diankeyun Technology NODERP log file accessShanxi Diankeyun Technology NODERP
- CVE-2023-6165Restrict Usernames Emails Characters Plugin < 3.1.4 - Admin+ Stored XSSRestrict Usernames Emails Characters
- CVE-2023-7200EventON < 4.4.1 - Reflected Cross-Site ScriptingEventON
- CVE-2023-6503WP Plugin Lister <= 2.1.0 - Settings Update to Stored XSS via CSRFWP Plugin Lister
- CVE-2023-5943Wp-Adv-Quiz < 1.0.3 - Admin+ Stored XSSWp-Adv-Quiz
- CVE-2023-7089Easy SVG Allow <= 1.0 - Author+ Stored XSS via SVGEasy SVG Allow
- CVE-2023-5124PageLayer < 1.8.0 - Author+ Stored XSSPage Builder: Pagelayer
- CVE-2023-6530TJ Shortcodes <= 0.1.3 - Contributor+ Stored XSS via ShortcodesTJ Shortcodes
- CVE-2023-5956Wp-Adv-Quiz <= 1.0.2 - Admin+ Stored XSS in Quiz OverviewWp-Adv-Quiz
- CVE-2023-7199Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post DisclosureRelevanssi
- CVE-2023-6633Site Notes <= 2.0.0 - Admin Note Deletion via CSRFSite Notes
- CVE-2023-6389WordPress Toolbar <= 2.2.6 - Open RedirectWordPress Toolbar
- CVE-2023-6278Biteship for WooCommerce < 2.2.25 - Reflected Cross-Site ScriptingBiteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
- CVE-2024-1014Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3SE-elektronic E-DDC3.3
- CVE-2024-23790Missing file type check in avatar picture uploadOTRS AG OTRS
- CVE-2024-23791Unnecessary data is written to log if issues during indexing occursOTRS AG OTRS
- CVE-2024-23792Insufficient access controlOTRS AG OTRS
- CVE-2024-0989Sichuan Yougou Technology KuERP Service.php del_sn_db path traversalSichuan Yougou Technology KuERP
- CVE-2024-0988Sichuan Yougou Technology KuERP common.php checklogin improper authenticationSichuan Yougou Technology KuERP
- CVE-2024-0987Sichuan Yougou Technology KuERP log neutralization for logsSichuan Yougou Technology KuERP
- CVE-2024-22559LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field.
- CVE-2024-22570A stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute…
- CVE-2024-24134Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update…
- CVE-2024-24135Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to…
- CVE-2024-24136The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting…