# CVEs published 2024-01-29

94 CVEs were published on January 29, 2024: 5 critical, 39 high. Days are UTC.

- [CVE-2024-1022](https://cve.now/CVE-2024-1022.md): CodeAstro Simple Student Result Management System Add Class Page add\_classes.php cross site scripting (CVSS 2.4, CodeAstro Simple Student Result Management System)
- [CVE-2024-23334](https://cve.now/CVE-2024-23334.md): aiohttp.web.static(follow\_symlinks=True) is vulnerable to directory traversal (CVSS 5.9, aio-libs aiohttp · aiohttp)
- [CVE-2024-23829](https://cve.now/CVE-2024-23829.md): aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators (CVSS 6.5, aio-libs aiohttp · aiohttp)
- [CVE-2024-1021](https://cve.now/CVE-2024-1021.md): Rebuild HTTP Request readRawText server-side request forgery (CVSS 6.3, Rebuild)
- [CVE-2024-1020](https://cve.now/CVE-2024-1020.md): Rebuild proxy-download getStorageFile cross site scripting (CVSS 3.5, Rebuild)
- [CVE-2023-4554](https://cve.now/CVE-2023-4554.md): XML External Entity (XXE) Processing (CVSS 4.9, OpenText AppBuilder)
- [CVE-2023-4553](https://cve.now/CVE-2023-4553.md): Unauthenticated Access to AppBuilder Configuration Files (CVSS 5.3, OpenText AppBuilder)
- [CVE-2023-4552](https://cve.now/CVE-2023-4552.md): Java Database Connectivity (JDBC) URL Manipulation (CVSS 5.5, OpenText AppBuilder)
- [CVE-2023-4551](https://cve.now/CVE-2023-4551.md): Command Injection via Task Scheduler (CVSS 7.2, OpenText AppBuilder)
- [CVE-2023-4550](https://cve.now/CVE-2023-4550.md): Unauthenticated Arbitrary File Read (CVSS 7.5, OpenText AppBuilder)
- [CVE-2024-1018](https://cve.now/CVE-2024-1018.md): PbootCMS cross site scripting (CVSS 2.4, PbootCMS)
- [CVE-2023-22836](https://cve.now/CVE-2023-22836.md): In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the default… (CVSS 3.5, com.palantir.skywise:guardian)
- [CVE-2024-1017](https://cve.now/CVE-2024-1017.md): Gabriels FTP Server denial of service (CVSS 5.3, Gabriels FTP Server)
- [CVE-2023-30970](https://cve.now/CVE-2023-30970.md): Gotham table and Forward App Path traversal (CVSS 6.5, com.palantir.gotham:blackbird-witchcraft)
- [CVE-2024-23940](https://cve.now/CVE-2024-23940.md): Trend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable… (CVSS 7.8, Trend Micro Security (Consumer) uiAirSupport)
- [CVE-2024-1016](https://cve.now/CVE-2024-1016.md): Solar FTP Server PASV Command denial of service (CVSS 5.3, Solar FTP Server)
- [CVE-2024-1011](https://cve.now/CVE-2024-1011.md): SourceCodester Employee Management System Leave delete-leave.php access control (CVSS 4.3, SourceCodester Employee Management System)
- [CVE-2024-23828](https://cve.now/CVE-2024-23828.md): Nginx-UI authenticated RCE through injecting into the application config via CRLF (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2023-40551](https://cve.now/CVE-2023-40551.md): Shim: out of bounds read when parsing mz binaries (CVSS 5.1, Red Hat Enterprise Linux)
- [CVE-2024-1010](https://cve.now/CVE-2024-1010.md): SourceCodester Employee Management System edit-profile.php cross site scripting (CVSS 3.5, SourceCodester Employee Management System)
- [CVE-2024-1009](https://cve.now/CVE-2024-1009.md): SourceCodester Employee Management System login.php sql injection (CVSS 7.3, SourceCodester Employee Management System)
- [CVE-2023-40546](https://cve.now/CVE-2023-40546.md): Shim: out-of-bounds read printing error messages (CVSS 6.2, Red Hat Enterprise Linux)
- [CVE-2023-40549](https://cve.now/CVE-2023-40549.md): Shim: out-of-bounds read in verify\_buffer\_authenticode() malformed pe file (CVSS 6.2, Red Hat Enterprise Linux)
- [CVE-2023-40550](https://cve.now/CVE-2023-40550.md): Shim: out-of-bound read in verify\_buffer\_sbat() (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2023-1705](https://cve.now/CVE-2023-1705.md): Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege… (CVSS 8.4, Forcepoint F|One SmartEdge Agent)
- [CVE-2024-0788](https://cve.now/CVE-2024-0788.md): SUPERAntiSpyware Pro X v10.0.1260 - Kernel-level API parameters manipulation (CVSS 6.6, SUPERAntiSpyware Pro X)
- [CVE-2024-23827](https://cve.now/CVE-2024-23827.md): Nginx-UI arbitrary file write through the Import Certificate feature (CVSS 9.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2024-23441](https://cve.now/CVE-2024-23441.md): Vba32 Antivirus v3.36.0 - Denial of Service (DoS) (CVSS 5.5, VirusBlokAda Vba32 Antivirus)
- [CVE-2024-1008](https://cve.now/CVE-2024-1008.md): SourceCodester Employee Management System Profile Page edit-photo.php unrestricted upload (CVSS 4.7, SourceCodester Employee Management System)
- [CVE-2024-1007](https://cve.now/CVE-2024-1007.md): SourceCodester Employee Management System edit\_profile.php sql injection (CVSS 6.3, SourceCodester Employee Management System)
- [CVE-2024-23826](https://cve.now/CVE-2024-23826.md): Uploading an image with a specific filename causes a server-side DoS (CVSS 6.8, spbu-se spbu\_se\_site)
- [CVE-2024-23822](https://cve.now/CVE-2024-23822.md): Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22) (CVSS 5.4, sni Thruk)
- [CVE-2024-1006](https://cve.now/CVE-2024-1006.md): Shanxi Diankeyun Technology NODERP Cookie common.php improper authentication (CVSS 7.3, Shanxi Diankeyun Technology NODERP)
- [CVE-2024-1005](https://cve.now/CVE-2024-1005.md): Shanxi Diankeyun Technology NODERP log file access (CVSS 5.3, Shanxi Diankeyun Technology NODERP)
- [CVE-2024-1004](https://cve.now/CVE-2024-1004.md): Totolink N200RE cstecgi.cgi loginAuth stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2023-40548](https://cve.now/CVE-2023-40548.md): Shim: interger overflow leads to heap buffer overflow in verify\_sbat\_section on 32-bits systems (CVSS 7.4, Red Hat Enterprise Linux)
- [CVE-2023-6390](https://cve.now/CVE-2023-6390.md): WordPress Users \<= 1.4 - Settings Update via CSRF (CVSS 8.8, WordPress Users)
- [CVE-2023-6165](https://cve.now/CVE-2023-6165.md): Restrict Usernames Emails Characters Plugin \< 3.1.4 - Admin+ Stored XSS (CVSS 4.8, Restrict Usernames Emails Characters)
- [CVE-2023-6391](https://cve.now/CVE-2023-6391.md): Custom User CSS \<= 0.2 - Settings Update via CSRF (CVSS 8.8, Custom User CSS)
- [CVE-2023-7200](https://cve.now/CVE-2023-7200.md): EventON \< 4.4.1 - Reflected Cross-Site Scripting (CVSS 6.1, EventON)
- [CVE-2023-6503](https://cve.now/CVE-2023-6503.md): WP Plugin Lister \<= 2.1.0 - Settings Update to Stored XSS via CSRF (CVSS 5.4, WP Plugin Lister)
- [CVE-2023-5943](https://cve.now/CVE-2023-5943.md): Wp-Adv-Quiz \< 1.0.3 - Admin+ Stored XSS (CVSS 4.8, Wp-Adv-Quiz)
- [CVE-2023-7089](https://cve.now/CVE-2023-7089.md): Easy SVG Allow \<= 1.0 - Author+ Stored XSS via SVG (CVSS 5.4, Easy SVG Allow)
- [CVE-2023-5124](https://cve.now/CVE-2023-5124.md): PageLayer \< 1.8.0 - Author+ Stored XSS (CVSS 4.8, Page Builder: Pagelayer)
- [CVE-2023-6530](https://cve.now/CVE-2023-6530.md): TJ Shortcodes \<= 0.1.3 - Contributor+ Stored XSS via Shortcodes (CVSS 5.4, TJ Shortcodes)
- [CVE-2023-6946](https://cve.now/CVE-2023-6946.md): Autotitle for WordPress \<= 1.0.3 - Settings Update to Stored XSS via CSRF (CVSS 8.8, Autotitle for WordPress)
- [CVE-2023-7204](https://cve.now/CVE-2023-7204.md): WP STAGING WordPress Backup Plugin \< 3.2.0 - Unauthorized Sensitive Data Exposure (CVSS 7.5, WP STAGING WordPress Backup Plugin)
- [CVE-2023-5956](https://cve.now/CVE-2023-5956.md): Wp-Adv-Quiz \<= 1.0.2 - Admin+ Stored XSS in Quiz Overview (CVSS 4.8, Wp-Adv-Quiz)
- [CVE-2023-7199](https://cve.now/CVE-2023-7199.md): Relevanssi (Free \< 4.22.0, Premium \< 2.25.0) - Unauthenticated Private/Draft Post Disclosure (CVSS 5.3, Relevanssi)
- [CVE-2023-6279](https://cve.now/CVE-2023-6279.md): Woostify Sites Library \< 1.4.8 - Subscriber+ Arbitrary Options Update to DoS (CVSS 7.1, Woostify Sites Library)
- [CVE-2023-6633](https://cve.now/CVE-2023-6633.md): Site Notes \<= 2.0.0 - Admin Note Deletion via CSRF (CVSS 4.3, Site Notes)
- [CVE-2023-6389](https://cve.now/CVE-2023-6389.md): WordPress Toolbar \<= 2.2.6 - Open Redirect (CVSS 6.1, WordPress Toolbar)
- [CVE-2023-7074](https://cve.now/CVE-2023-7074.md): WP Social Bookmark Menu \<= 1.2 - Settings Update via CSRF (CVSS 8.8, WP SOCIAL BOOKMARK MENU)
- [CVE-2023-6278](https://cve.now/CVE-2023-6278.md): Biteship for WooCommerce \< 2.2.25 - Reflected Cross-Site Scripting (CVSS 6.1, Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo)
- [CVE-2024-1003](https://cve.now/CVE-2024-1003.md): Totolink N200RE cstecgi.cgi setLanguageCfg stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-1002](https://cve.now/CVE-2024-1002.md): Totolink N200RE cstecgi.cgi setIpPortFilterRules stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-1015](https://cve.now/CVE-2024-1015.md): Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 (CVSS 9.8, SE-elektronic E-DDC3.3)
- [CVE-2024-1014](https://cve.now/CVE-2024-1014.md): Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 (CVSS 6.2, SE-elektronic E-DDC3.3)
- [CVE-2024-1001](https://cve.now/CVE-2024-1001.md): Totolink N200RE cstecgi.cgi main stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-1000](https://cve.now/CVE-2024-1000.md): Totolink N200RE cstecgi.cgi setTracerouteCfg stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-0999](https://cve.now/CVE-2024-0999.md): Totolink N200RE cstecgi.cgi setParentalRules stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-0998](https://cve.now/CVE-2024-0998.md): Totolink N200RE cstecgi.cgi setDiagnosisCfg stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-0997](https://cve.now/CVE-2024-0997.md): Totolink N200RE cstecgi.cgi setOpModeCfg stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2023-29055](https://cve.now/CVE-2023-29055.md): Apache Kylin: Insufficiently protected credentials in config file (CVSS 7.5, Apache Software Foundation Apache Kylin · org.apache.kylin:…)
- [CVE-2023-5378](https://cve.now/CVE-2023-5378.md): Stored XSS in SmodBIP and MegaBIP (CVSS 8.8, Jan Syski MegaBIP · Jan Syski SmodBIP)
- [CVE-2023-46838](https://cve.now/CVE-2023-46838.md): Linux: netback processing of zero-length transmit fragment (CVSS 7.5, Linux)
- [CVE-2024-23790](https://cve.now/CVE-2024-23790.md): Missing file type check in avatar picture upload (CVSS 3.5, OTRS AG OTRS)
- [CVE-2024-23791](https://cve.now/CVE-2024-23791.md): Unnecessary data is written to log if issues during indexing occurs (CVSS 4.9, OTRS AG OTRS)
- [CVE-2024-23792](https://cve.now/CVE-2024-23792.md): Insufficient access control (CVSS 5.3, OTRS AG OTRS)
- [CVE-2024-0212](https://cve.now/CVE-2024-0212.md): Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users) (CVSS 8.1, Cloudflare-WordPress)
- [CVE-2024-0996](https://cve.now/CVE-2024-0996.md): Tenda i9 httpd setcfm formSetCfm stack-based overflow (CVSS 7.2, Tenda i9)
- [CVE-2024-0995](https://cve.now/CVE-2024-0995.md): Tenda W6 httpd wifiSSIDset formwrlSSIDset stack-based overflow (CVSS 7.2, Tenda W6)
- [CVE-2024-0994](https://cve.now/CVE-2024-0994.md): Tenda W6 httpd setcfm formSetCfm stack-based overflow (CVSS 7.2, Tenda W6)
- [CVE-2024-0993](https://cve.now/CVE-2024-0993.md): Tenda i6 httpd WifiMacFilterGet formWifiMacFilterGet stack-based overflow (CVSS 7.2, Tenda i6)
- [CVE-2024-0992](https://cve.now/CVE-2024-0992.md): Tenda i6 httpd wifiSSIDset formwrlSSIDset stack-based overflow (CVSS 7.2, Tenda i6)
- [CVE-2024-0991](https://cve.now/CVE-2024-0991.md): Tenda i6 httpd setcfm formSetCfm stack-based overflow (CVSS 7.2, Tenda i6)
- [CVE-2024-0990](https://cve.now/CVE-2024-0990.md): Tenda i6 httpd setAutoPing formSetAutoPing stack-based overflow (CVSS 7.2, Tenda i6)
- [CVE-2024-0989](https://cve.now/CVE-2024-0989.md): Sichuan Yougou Technology KuERP Service.php del\_sn\_db path traversal (CVSS 5.4, Sichuan Yougou Technology KuERP)
- [CVE-2024-0988](https://cve.now/CVE-2024-0988.md): Sichuan Yougou Technology KuERP common.php checklogin improper authentication (CVSS 6.3, Sichuan Yougou Technology KuERP)
- [CVE-2024-0987](https://cve.now/CVE-2024-0987.md): Sichuan Yougou Technology KuERP log neutralization for logs (CVSS 6.3, Sichuan Yougou Technology KuERP)
- [CVE-2023-49038](https://cve.now/CVE-2023-49038.md): Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated attacker to inject arbitrary commands onto… (CVSS 7.2)
- [CVE-2023-51839](https://cve.now/CVE-2023-51839.md): DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm. (CVSS 9.1, @devicefarmer/stf)
- [CVE-2023-51840](https://cve.now/CVE-2023-51840.md): DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key. (CVSS 9.8)
- [CVE-2023-51842](https://cve.now/CVE-2023-51842.md): An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16. (CVSS 7.5, meshcentral)
- [CVE-2024-22559](https://cve.now/CVE-2024-22559.md): LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field. (CVSS 5.4)
- [CVE-2024-22570](https://cve.now/CVE-2024-22570.md): A stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute… (CVSS 5.4)
- [CVE-2024-23747](https://cve.now/CVE-2024-23747.md): The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. (CVSS 7.5)
- [CVE-2024-24134](https://cve.now/CVE-2024-24134.md): Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update… (CVSS 4.8)
- [CVE-2024-24135](https://cve.now/CVE-2024-24135.md): Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to… (CVSS 6.1)
- [CVE-2024-24136](https://cve.now/CVE-2024-24136.md): The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting… (CVSS 6.1)
- [CVE-2024-24139](https://cve.now/CVE-2024-24139.md): Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter. (CVSS 7.2)
- [CVE-2024-24140](https://cve.now/CVE-2024-24140.md): Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.' (CVSS 7.2)
- [CVE-2024-24141](https://cve.now/CVE-2024-24141.md): Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter. (CVSS 9.8)
- [CVE-2024-24736](https://cve.now/CVE-2024-24736.md): The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remote denial of service (reboot) via a long string to TCP port 110, a related… (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2024-01-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.