# CVEs published 2023-01-24

122 CVEs were published on January 24, 2023: 14 critical, 47 high. Days are UTC.

- [CVE-2023-24508](https://cve.now/CVE-2023-24508.md): Remote Code Execution in Baicells RTS Platform (CVSS 8.1, Baicells Nova)
- [CVE-2023-23612](https://cve.now/CVE-2023-23612.md): Issue with whitespace in JWT roles in OpenSearch (CVSS 4.7, opensearch-project security · org.opensearch.plugin:opensea…)
- [CVE-2023-23613](https://cve.now/CVE-2023-23613.md): Field-level security issue with .keyword fields in OpenSearch (CVSS 5.7, opensearch-project security · org.opensearch.plugin:opensea…)
- [CVE-2023-0356](https://cve.now/CVE-2023-0356.md): SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in thre (CVSS 5.7, SOCOMEC MODULYS GP)
- [CVE-2023-0463](https://cve.now/CVE-2023-0463.md): The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022 (CVSS 7.8, Devolutions Remote Desktop Manager)
- [CVE-2023-24022](https://cve.now/CVE-2023-24022.md): Hard Coded Credential Crypt Vulnerability (CVSS 10.0, Baicells Nova)
- [CVE-2023-0284](https://cve.now/CVE-2023-0284.md): Improper validation of LDAP user IDs (CVSS 6.8, Tribe29 Checkmk)
- [CVE-2022-45820](https://cve.now/CVE-2022-45820.md): WordPress LearnPress Plugin \<= 4.1.7.3.2 is vulnerable to SQL Injection (CVSS 9.1, ThimPress LearnPress – WordPress LMS Plugin)
- [CVE-2022-45808](https://cve.now/CVE-2022-45808.md): WordPress LearnPress Plugin \<= 4.1.7.3.2 is vulnerable to SQL Injection (CVSS 9.9, ThimPress LearnPress – WordPress LMS Plugin)
- [CVE-2022-47615](https://cve.now/CVE-2022-47615.md): WordPress LearnPress Plugin \<= 4.1.7.3.2 is vulnerable to Local File Inclusion (CVSS 9.3, ThimPress LearnPress – WordPress LMS Plugin)
- [CVE-2022-25860](https://cve.now/CVE-2022-25860.md): Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemot (CVSS 8.1, simple-git)
- [CVE-2022-25908](https://cve.now/CVE-2022-25908.md): All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input (CVSS 7.4, create-choo-electron)
- [CVE-2022-25350](https://cve.now/CVE-2022-25350.md): All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization. (CVSS 7.4, puppet-facter)
- [CVE-2023-23608](https://cve.now/CVE-2023-23608.md): spotipy Path traversal vulnerability that may lead to type confusion in URI handling code (CVSS 0.0, spotipy-dev spotipy · spotipy)
- [CVE-2023-22486](https://cve.now/CVE-2023-22486.md): cmark-gfm Quadratic complexity bug in handle\_close\_bracket may lead to a denial of service (CVSS 3.5, github cmark-gfm)
- [CVE-2023-22485](https://cve.now/CVE-2023-22485.md): cmark-gfm out-of-bounds read in validate\_protocol (CVSS 5.3, github cmark-gfm)
- [CVE-2021-28510](https://cve.now/CVE-2021-28510.md): For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable. (CVSS 5.3, Arista Networks EOS)
- [CVE-2022-20213](https://cve.now/CVE-2022-20213.md): In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack. (CVSS 5.5, Android)
- [CVE-2022-20214](https://cve.now/CVE-2022-20214.md): In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack. (CVSS 4.7, Android)
- [CVE-2022-20215](https://cve.now/CVE-2022-20215.md): In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack. (CVSS 5.5, Android)
- [CVE-2022-20235](https://cve.now/CVE-2022-20235.md): The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem. (CVSS 5.5, Android)
- [CVE-2022-20456](https://cve.now/CVE-2022-20456.md): In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android)
- [CVE-2022-20458](https://cve.now/CVE-2022-20458.md): The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build. (CVSS 5.5, Android)
- [CVE-2022-20461](https://cve.now/CVE-2022-20461.md): In pinReplyNative of com\_android\_bluetooth\_btservice\_AdapterService.cpp, there is a possible out of bounds read due to type confusion. (CVSS 7.8, Android)
- [CVE-2022-20489](https://cve.now/CVE-2022-20489.md): In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android)
- [CVE-2022-20490](https://cve.now/CVE-2022-20490.md): In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android)
- [CVE-2022-20492](https://cve.now/CVE-2022-20492.md): In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. (CVSS 7.8, Android)
- [CVE-2022-20493](https://cve.now/CVE-2022-20493.md): In Condition of Condition.java, there is a possible way to grant notification access due to improper input validation. (CVSS 7.8, Android)
- [CVE-2022-20494](https://cve.now/CVE-2022-20494.md): In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion. (CVSS 5.5, Android)
- [CVE-2022-26329](https://cve.now/CVE-2022-26329.md): File existence disclosue vulnerability in IDM plugin (CVSS 1.8, Micro Focus NetIQ Identity Manager)
- [CVE-2022-27507](https://cve.now/CVE-2022-27507.md): Authenticated denial of service (CVSS 6.5, Citirx Citrix Application Delivery Controller (Citrix ADC)…)
- [CVE-2022-27508](https://cve.now/CVE-2022-27508.md): Unauthenticated denial of service (CVSS 7.5, Citirx Citrix Application Delivery Controller (Citrix ADC)…)
- [CVE-2022-3478](https://cve.now/CVE-2022-3478.md): An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5. (CVSS 4.3, GitLab)
- [CVE-2022-3482](https://cve.now/CVE-2022-3482.md): An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 1 (CVSS 5.3, GitLab)
- [CVE-2022-3572](https://cve.now/CVE-2022-3572.md): A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, and (CVSS 9.3, GitLab)
- [CVE-2022-3740](https://cve.now/CVE-2022-3740.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior (CVSS 6.5, GitLab)
- [CVE-2022-3820](https://cve.now/CVE-2022-3820.md): An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. (CVSS 6.5, GitLab)
- [CVE-2022-38774](https://cve.now/CVE-2022-38774.md): An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivileg (CVSS 7.8, Elastic Endpoint Security and Elastic Endgame Security)
- [CVE-2022-38775](https://cve.now/CVE-2022-38775.md): An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate th (CVSS 7.8, Elastic Endpoint Security)
- [CVE-2022-3902](https://cve.now/CVE-2022-3902.md): An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5 (CVSS 5.5, GitLab)
- [CVE-2022-40036](https://cve.now/CVE-2022-40036.md): An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing permission checks via (CVSS 6.5)
- [CVE-2022-40037](https://cve.now/CVE-2022-40037.md): An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component (CVSS 9.8)
- [CVE-2022-4054](https://cve.now/CVE-2022-4054.md): An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5 (CVSS 5.5, GitLab)
- [CVE-2022-4092](https://cve.now/CVE-2022-4092.md): An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1. (CVSS 5.7, GitLab)
- [CVE-2022-4554](https://cve.now/CVE-2022-4554.md): Reflected XSS B2B Dealer Ordering System (CVSS 5.4, ID Software Project and Consultancy Services B2B Customer O…)
- [CVE-2022-45639](https://cve.now/CVE-2022-45639.md): OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m (CVSS 7.8)
- [CVE-2022-47040](https://cve.now/CVE-2022-47040.md): An issue in ASKEY router RTF3505VW-N1 BR\_SV\_g000\_R3505VMN1001\_s32\_7 allows attackers to escalate privileges via running the tcpdump command (CVSS 7.8)
- [CVE-2022-47042](https://cve.now/CVE-2022-47042.md): MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do. (CVSS 8.8, net.mingsoft:ms-mcms)
- [CVE-2022-47100](https://cve.now/CVE-2022-47100.md): A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802 (CVSS 7.5)
- [CVE-2022-48199](https://cve.now/CVE-2022-48199.md): SoftPerfect NetWorx 7.1.1 on Windows allows an attacker to execute a malicious binary with potentially higher privileges via a low-privilege (CVSS 8.8)
- [CVE-2023-0394](https://cve.now/CVE-2023-0394.md): A NULL pointer dereference flaw was found in rawv6\_push\_pending\_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel. (CVSS 5.5, Kernel)
- [CVE-2023-0411](https://cve.now/CVE-2023-0411.md): Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0412](https://cve.now/CVE-2023-0412.md): TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture fi (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0413](https://cve.now/CVE-2023-0413.md): Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture f (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0414](https://cve.now/CVE-2023-0414.md): Crash in the EAP dissector in Wireshark 4.0.0 to 4.0.2 allows denial of service via packet injection or crafted capture file (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0415](https://cve.now/CVE-2023-0415.md): iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture f (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0416](https://cve.now/CVE-2023-0416.md): GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture fil (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0417](https://cve.now/CVE-2023-0417.md): Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafte (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-0444](https://cve.now/CVE-2023-0444.md): A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a. (CVSS 8.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-0448](https://cve.now/CVE-2023-0448.md): The WP Helper Lite WordPress plugin, in versions \< 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cro (CVSS 6.1, WP Helper Lite Wordpress Plugin)
- [CVE-2023-0471](https://cve.now/CVE-2023-0471.md): Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2023-0472](https://cve.now/CVE-2023-0472.md): Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2023-0473](https://cve.now/CVE-2023-0473.md): Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruptio (CVSS 8.8, Google Chrome)
- [CVE-2023-0474](https://cve.now/CVE-2023-0474.md): Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extensi (CVSS 8.8, Google Chrome)
- [CVE-2023-20904](https://cve.now/CVE-2023-20904.md): In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code. (CVSS 7.8, Android)
- [CVE-2023-20905](https://cve.now/CVE-2023-20905.md): In Mfc\_Transceive of phNxpExtns\_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Android)
- [CVE-2023-20908](https://cve.now/CVE-2023-20908.md): In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion. (CVSS 5.5, Android)
- [CVE-2023-20912](https://cve.now/CVE-2023-20912.md): In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permiss (CVSS 7.8, Android)
- [CVE-2023-20913](https://cve.now/CVE-2023-20913.md): In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious ph (CVSS 7.8, Android)
- [CVE-2023-20915](https://cve.now/CVE-2023-20915.md): In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due to (CVSS 7.8, Android)
- [CVE-2023-20916](https://cve.now/CVE-2023-20916.md): In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from t (CVSS 7.8, Android)
- [CVE-2023-20919](https://cve.now/CVE-2023-20919.md): In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code. (CVSS 7.8, Android)
- [CVE-2023-20920](https://cve.now/CVE-2023-20920.md): In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free. (CVSS 7.8, Android)
- [CVE-2023-20921](https://cve.now/CVE-2023-20921.md): In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logic (CVSS 7.3, Android)
- [CVE-2023-20922](https://cve.now/CVE-2023-20922.md): In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion. (CVSS 5.5, Android)
- [CVE-2023-20923](https://cve.now/CVE-2023-20923.md): In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions bypas (CVSS 5.5, Android)
- [CVE-2023-20924](https://cve.now/CVE-2023-20924.md): In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure. (CVSS 6.8, Android)
- [CVE-2023-20925](https://cve.now/CVE-2023-20925.md): In setUclampMinLocked of PowerSessionManager.cpp, there is a possible way to corrupt memory due to a use after free. (CVSS 7.8, Android)
- [CVE-2023-20928](https://cve.now/CVE-2023-20928.md): In binder\_vma\_close of binder.c, there is a possible use after free due to improper locking. (CVSS 7.8, Android)
- [CVE-2023-23331](https://cve.now/CVE-2023-23331.md): Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection. (CVSS 9.8)
- [CVE-2023-23949](https://cve.now/CVE-2023-23949.md): An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser. (CVSS 8.1, Symantec Identity Management And Governance)
- [CVE-2023-23950](https://cve.now/CVE-2023-23950.md): User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses. (CVSS 6.1, Symantec Identity Management And Governance)
- [CVE-2023-23951](https://cve.now/CVE-2023-23951.md): Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the application (CVSS 6.1, Symantec Identity Management And Governance)
- [CVE-2023-24057](https://cve.now/CVE-2023-24057.md): HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal f (CVSS 8.1, org.hl7.fhir.publisher:org.hl7.fhir.publisher · ca.uhn.h… +5)
- [CVE-2023-24422](https://cve.now/CVE-2023-24422.md): A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a\_2fb\_25 and earlier allows attacker (CVSS 8.8, Jenkins Project Jenkins Script Security Plugin · org.jenkin…)
- [CVE-2023-24423](https://cve.now/CVE-2023-24423.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous b (CVSS 6.5, Jenkins Project Jenkins Gerrit Trigger Plugin · com.sonyeri…)
- [CVE-2023-24424](https://cve.now/CVE-2023-24424.md): Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login. (CVSS 8.8, Jenkins Project Jenkins OpenId Connect Authentication Plugi…)
- [CVE-2023-24425](https://cve.now/CVE-2023-24425.md): Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentia (CVSS 6.5, Jenkins Project Jenkins Kubernetes Credentials Provider Plu…)
- [CVE-2023-24426](https://cve.now/CVE-2023-24426.md): Jenkins Azure AD Plugin 303.va\_91ef20ee49f and earlier does not invalidate the previous session on login. (CVSS 8.8, Jenkins Project Jenkins Azure AD Plugin · org.jenkins-ci.pl…)
- [CVE-2023-24427](https://cve.now/CVE-2023-24427.md): Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login. (CVSS 9.8, Jenkins Project Jenkins Bitbucket OAuth Plugin · org.jenkin…)
- [CVE-2023-24428](https://cve.now/CVE-2023-24428.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into lo (CVSS 5.7, Jenkins Project Jenkins Bitbucket OAuth Plugin · org.jenkin…)
- [CVE-2023-24429](https://cve.now/CVE-2023-24429.md): Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no (CVSS 9.8, Jenkins Project Jenkins Semantic Versioning Plugin · org.je…)
- [CVE-2023-24430](https://cve.now/CVE-2023-24430.md): Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 9.8, Jenkins Project Jenkins Semantic Versioning Plugin · org.je…)
- [CVE-2023-24431](https://cve.now/CVE-2023-24431.md): A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate (CVSS 4.3, Jenkins Project Jenkins Orka by MacStadium Plugin · io.jenk…)
- [CVE-2023-24432](https://cve.now/CVE-2023-24432.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an at (CVSS 8.8, Jenkins Project Jenkins Orka by MacStadium Plugin · io.jenk…)
- [CVE-2023-24433](https://cve.now/CVE-2023-24433.md): Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to a (CVSS 6.5, Jenkins Project Jenkins Orka by MacStadium Plugin · io.jenk…)
- [CVE-2023-24434](https://cve.now/CVE-2023-24434.md): A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to conne (CVSS 8.8, Jenkins Project Jenkins GitHub Pull Request Builder Plugin…)
- [CVE-2023-24435](https://cve.now/CVE-2023-24435.md): A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to (CVSS 6.5, Jenkins Project Jenkins GitHub Pull Request Builder Plugin…)
- [CVE-2023-24436](https://cve.now/CVE-2023-24436.md): A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission to (CVSS 4.3, Jenkins Project Jenkins GitHub Pull Request Builder Plugin…)
- [CVE-2023-24437](https://cve.now/CVE-2023-24437.md): A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers t (CVSS 8.8, Jenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…)
- [CVE-2023-24438](https://cve.now/CVE-2023-24438.md): A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permis (CVSS 6.5, Jenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…)
- [CVE-2023-24439](https://cve.now/CVE-2023-24439.md): Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file on (CVSS 5.5, Jenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…)
- [CVE-2023-24440](https://cve.now/CVE-2023-24440.md): Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins c (CVSS 5.5, Jenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…)
- [CVE-2023-24441](https://cve.now/CVE-2023-24441.md): Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 9.8, Jenkins Project Jenkins MSTest Plugin · org.jvnet.hudson.pl…)
- [CVE-2023-24442](https://cve.now/CVE-2023-24442.md): Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar p (CVSS 5.5, Jenkins Project Jenkins GitHub Pull Request Coverage Status…)
- [CVE-2023-24443](https://cve.now/CVE-2023-24443.md): Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 9.8, Jenkins Project Jenkins TestComplete support Plugin · org.j…)
- [CVE-2023-24444](https://cve.now/CVE-2023-24444.md): Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login. (CVSS 9.8, Jenkins Project Jenkins OpenID Plugin · org.jenkins-ci.plug…)
- [CVE-2023-24445](https://cve.now/CVE-2023-24445.md): Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins. (CVSS 6.1, Jenkins Project Jenkins OpenID Plugin · org.jenkins-ci.plug…)
- [CVE-2023-24446](https://cve.now/CVE-2023-24446.md): A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in t (CVSS 8.8, Jenkins Project Jenkins OpenID Plugin · org.jenkins-ci.plug…)
- [CVE-2023-24447](https://cve.now/CVE-2023-24447.md): A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an atta (CVSS 8.8, Jenkins Project Jenkins RabbitMQ Consumer Plugin · org.jenk…)
- [CVE-2023-24448](https://cve.now/CVE-2023-24448.md): A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to a (CVSS 6.5, Jenkins Project Jenkins RabbitMQ Consumer Plugin · org.jenk…)
- [CVE-2023-24449](https://cve.now/CVE-2023-24449.md): Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing (CVSS 4.3, Jenkins Project Jenkins PWauth Security Realm Plugin · org.…)
- [CVE-2023-24450](https://cve.now/CVE-2023-24450.md): Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be (CVSS 6.5, Jenkins Project Jenkins view-cloner Plugin · org.jenkins-ci…)
- [CVE-2023-24451](https://cve.now/CVE-2023-24451.md): A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumera (no CVSS, Jenkins Project Jenkins Cisco Spark Notifier Plugin · org.j…)
- [CVE-2023-24452](https://cve.now/CVE-2023-24452.md): A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an at (CVSS 8.8, Jenkins Project Jenkins TestQuality Updater Plugin · org.je…)
- [CVE-2023-24453](https://cve.now/CVE-2023-24453.md): A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attacke (CVSS 6.5, Jenkins Project Jenkins TestQuality Updater Plugin · org.je…)
- [CVE-2023-24454](https://cve.now/CVE-2023-24454.md): Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on t (CVSS 5.5, Jenkins Project Jenkins TestQuality Updater Plugin · org.je…)
- [CVE-2023-24455](https://cve.now/CVE-2023-24455.md): Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackers (CVSS 4.3, Jenkins Project Jenkins visualexpert Plugin · io.jenkins.pl…)
- [CVE-2023-24456](https://cve.now/CVE-2023-24456.md): Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login. (CVSS 9.8, Jenkins Project Jenkins Keycloak Authentication Plugin · or…)
- [CVE-2023-24457](https://cve.now/CVE-2023-24457.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick user (CVSS 6.5, Jenkins Project Jenkins Keycloak Authentication Plugin · or…)
- [CVE-2023-24458](https://cve.now/CVE-2023-24458.md): A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-s (CVSS 8.8, Jenkins Project Jenkins BearyChat Plugin · org.jenkins-ci.p…)
- [CVE-2023-24459](https://cve.now/CVE-2023-24459.md): A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an atta (CVSS 6.5, Jenkins Project Jenkins BearyChat Plugin · org.jenkins-ci.p…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.