CVEs published January 2, 2024
107 CVEs were published on January 2, 2024: 11 critical, 40 high.
- Published
- 107
- Critical
- 11
- High
- 40
- Medium
- 44
- Low
- 12
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 16
Most affected products
- Qualcomm Snapdragon
- 26
- MediaTek MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT…
- 6
- RRJ Nueva Ecija Engineer Online Portal
- 6
- OpenHarmony
- 5
- MediaTek MT2735, MT6813, MT6833, MT6833P, MT6835, MT6853, M…
- 4
- gilacms/gila
- 3
- MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- 3
- Google Pixel Watch
- 2
- Mattermost · github.com/mattermost/mattermost-server +3
- 2
- PrestaShop · prestashop/prestashop
- 2
Critical 11
- CVE-2023-48418User Build misconfiguration resulting in local escalation of privilegeGoogle Pixel Watch
- CVE-2023-6339Google Nest WiFi Pro root code-execution & user-data compromiseGoogle Wifi Pro
- CVE-2024-21623Arbitrary Expression Injection in github workflow leads to Command execution & leaking secretsmehah otclient
- CVE-2023-48419An attacker in the wifi vicinity of a target Google Home can spy on the victim, resulting in EoPGoogle Nest Mini
- CVE-2023-4280Unvalidated input in Silicon Labs TrustZone implementation leads to accessing Trusted memory regionsilabs.com GSDK
- CVE-2023-6436SQLi in Ekol Bilisim Website TemplateEkol Informatics Website Template
- CVE-2023-33032Integer Overflow or Wraparound in TZ Secure OSQualcomm Snapdragon
- CVE-2023-33030Buffer Copy without Checking Size of Input in HLOSQualcomm Snapdragon
- CVE-2023-33025Buffer Copy without Checking Size of Input in Data ModemQualcomm Snapdragon
- CVE-2023-32874In Modem IMS Stack, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2735, MT6779, MT6781, MT6783, MT6785, MT6785T, M…
- CVE-2023-47458An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework.
High 40
- CVE-2024-21632omniauth-microsoft_graph vulnerable to account takeover (nOAuth)synth omniauth-microsoft_graph · omniauth-microsoft_graph
- CVE-2023-4164There is a possible information disclosure due to a missing permission check in Pixel WatchGoogle Pixel Watch
- CVE-2024-21627Some attribute not escaped in Validate::isCleanHTML methodPrestaShop · prestashop/prestashop
- CVE-2022-3010Predictable SSH credentials in Priva TopControl SuitePriva TopControl Suite - Bacnet · Priva TopControl Suite… +3
- CVE-2024-0193Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalationkernel · Red Hat Enterprise Linux +1
- CVE-2023-43514Use After Free in DSP ServicesQualcomm Snapdragon
- CVE-2023-43512Buffer Over-read in Qualcomm ESLQualcomm Snapdragon
- CVE-2023-43511Loop with Unreachable Exit Condition (Infinite Loop) in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33120Use After Free in AudioQualcomm Snapdragon
- CVE-2023-33118Use After Free in Automotive AudioQualcomm Snapdragon
- CVE-2023-33117Use After Free in AudioQualcomm Snapdragon
- CVE-2023-33116Buffer over-read without Checking Size of Input in WLAN HostQualcomm Snapdragon
- CVE-2023-33114Use after free in Neural Processing UnitQualcomm Snapdragon
- CVE-2023-33113Buffer Copy Without Checking Size of Input (`Classic Buffer Overflow`) in KernelQualcomm Snapdragon
- CVE-2023-33112Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33110Use of Out-of-range Pointer Offset in AudioQualcomm Snapdragon
- CVE-2023-33109NULL Pointer Dereference in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33108Use After Free in GraphicsQualcomm Snapdragon
- CVE-2023-33094Use After Free in Linux GraphicsQualcomm Snapdragon
- CVE-2023-33085Buffer Copy Without Checking Size of Input (Classic Buffer Overflow) in WearablesQualcomm Snapdragon
- CVE-2023-33062Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33040Buffer Over-read in Data ModemQualcomm Snapdragon
- CVE-2023-33037Cryptographic Issues in AutomotiveQualcomm Snapdragon
- CVE-2023-33036NULL Pointer Dereference in HypervisorQualcomm Snapdragon
- CVE-2023-33033Use of Out-of-range Pointer Offset in AudioQualcomm Snapdragon
- CVE-2023-33014Improper Input Validation in ServicesQualcomm Snapdragon
- CVE-2023-47039Perl: perl for windows binary hijacking vulnerabilityperl · Red Hat Enterprise Linux
- CVE-2023-26159Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by tfollow-redirects
- CVE-2023-32889In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2735, MT6813, MT6833, MT6833P, MT6835, MT6853, M…
- CVE-2023-32888In Modem IMS Call UA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2735, MT6813, MT6833, MT6833P, MT6835, MT6853, M…
- CVE-2023-32887In Modem IMS Stack, there is a possible system crash due to a missing bounds check.MediaTek MT2735, MT6813, MT6833, MT6833P, MT6835, MT6853, M…
- CVE-2023-32886In Modem IMS SMS UA, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2735, MT6813, MT6833, MT6833P, MT6835, MT6853, M…
- CVE-2023-45892An issue discovered in the Order and Invoice pages in Floorsight Insights Q3 2023 allows an unauthenticated remote attacker to view sensitiv
- CVE-2023-45893An indirect Object Reference (IDOR) in the Order and Invoice pages in Floorsight Customer Portal Q3 2023 allows an unauthenticated remote at
- CVE-2023-49549An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_getretvalpos function in the msj.c file.
- CVE-2023-49550An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs+0x4ec508 component.
- CVE-2023-49551An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_parse function in the msj.c file.
- CVE-2023-49552An Out of Bounds Write in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_op_json_stringify function in
- CVE-2023-49553An issue in Cesanta mjs 2.20.0 allows a remote attacker to cause a denial of service via the mjs_destroy function in the msj.c file.
- CVE-2023-50020An issue was discovered in open5gs v2.6.6.
Medium, low and unrated 56
- CVE-2024-0196Magic-Api code injectionMagic-Api
- CVE-2024-21629Erroneous handling of `record_external_operation` error returnrust-ethereum evm · evm
- CVE-2024-21628XSS can be stored in DB from "add a message form" in order detail page (FO)PrestaShop · prestashop/prestashop
- CVE-2024-0195spider-flow FunctionController.java FunctionService.saveFunction code injectionspider-flow
- CVE-2024-0194CodeAstro Internet Banking System Profile Picture pages_account.php unrestricted uploadCodeAstro Internet Banking System
- CVE-2023-51652OWASP.AntiSamy mXSS when preserving commentsspassarop antisamy-dotnet · OWASP.AntiSamy
- CVE-2023-50711`serde` deserialization for `FamStructWrapper` lacks bound checks that could potentially lead to out-of-bounds memory accessrust-vmm vmm-sys-util · vmm-sys-util
- CVE-2024-0192RRJ Nueva Ecija Engineer Online Portal Add Downloadable downloadable.php unrestricted uploadRRJ Nueva Ecija Engineer Online Portal
- CVE-2023-49794The logic of get apk path in KernelSU module can be bypassedtiann KernelSU
- CVE-2024-0191RRJ Nueva Ecija Engineer Online Portal file information disclosureRRJ Nueva Ecija Engineer Online Portal
- CVE-2023-7192Kernel: refcount leak in ctnetlink_create_conntrack()Red Hat Enterprise Linux 8.2 Advanced Update Support ·… +10
- CVE-2024-0190RRJ Nueva Ecija Engineer Online Portal Quiz add_quiz.php cross site scriptingRRJ Nueva Ecija Engineer Online Portal
- CVE-2024-0189RRJ Nueva Ecija Engineer Online Portal Create Message teacher_message.php cross site scriptingRRJ Nueva Ecija Engineer Online Portal
- CVE-2018-25097Acumos Design Studio cross site scriptingAcumos Design Studio
- CVE-2024-0188RRJ Nueva Ecija Engineer Online Portal change_password_teacher.php weak passwordRRJ Nueva Ecija Engineer Online Portal
- CVE-2017-20188Zimbra zm-ajax XFormItem.js XFormItem.prototype.setError cross site scriptingZimbra zm-ajax
- CVE-2015-10128rt-prettyphoto Plugin rt-prettyphoto.php royal_prettyphoto_plugin_links cross site scriptingrt-prettyphoto Plugin
- CVE-2023-47858Details of archived public channels are leaked to members of another teamMattermost · github.com/mattermost/mattermost-server +3
- CVE-2023-50333Lack of restriction to manage group names for freshly demoted guestsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2023-48732Keywords that trigger mentions are leaked to other usersMattermost · github.com/mattermost/mattermost-server +3
- CVE-2023-6693Qemu: virtio-net: stack buffer overflow in virtio_net_flush_tx()Red Hat Enterprise Linux
- CVE-2023-49142multimedia audio has a UAF vulnerabilityOpenHarmony
- CVE-2023-49135multimedia player has a UAF vulnerabilityOpenHarmony
- CVE-2023-48360multimedia player has a UAF vulnerabilityOpenHarmony
- CVE-2023-47857multimedia camera has a UAF vulnerabilityOpenHarmony
- CVE-2023-47216Liteos-A has a missing release of resource vulnerabilityOpenHarmony
- CVE-2023-33038Integer Overflow or Wraparound in Radio Interface LayerQualcomm Snapdragon
- CVE-2023-28583Double Free in Data Network Stack & ConnectivityQualcomm Snapdragon
- CVE-2023-26157Versions of the package libredwg before 0.12.5.6384 are vulnerable to Denial of Service (DoS) due to an out-of-bounds read involving sectionlibredwg
- CVE-2023-32891In bluetooth service, there is a possible out of bounds write due to improper input validation.MediaTek MT2713, MT6739, MT6761, MT6765, MT6768, MT6769, MT…
- CVE-2023-32831In wlan driver, there is a possible PIN crack due to use of insufficiently random values.MediaTek MT6890, MT7612, MT7613, MT7615, MT7622, MT7626, MT…
- CVE-2023-32890In modem EMM, there is a possible system crash due to improper input validation.MediaTek MT2731, MT6767, MT6768, MT6769, MT6769T, MT6769Z,…
- CVE-2023-32885In display drm, there is a possible memory corruption due to a missing bounds check.MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…
- CVE-2023-32884In netdagent, there is a possible information disclosure due to an incorrect bounds check.MediaTek MT2713, MT6580, MT6739, MT6761, MT6765, MT6768, MT…
- CVE-2023-32883In Engineer Mode, there is a possible out of bounds write due to a missing bounds check.MediaTek MT2713, MT6580, MT6739, MT6761, MT6762, MT6765, MT…
- CVE-2023-32882In battery, there is a possible memory corruption due to a missing bounds check.MediaTek MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT…
- CVE-2023-32881In battery, there is a possible information disclosure due to an integer overflow.MediaTek MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT…
- CVE-2023-32880In battery, there is a possible information disclosure due to a missing bounds check.MediaTek MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT…
- CVE-2023-32879In battery, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT…
- CVE-2023-32878In battery, there is a possible information disclosure due to a missing bounds check.MediaTek MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT…
- CVE-2023-32877In battery, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6762, MT6765, MT6833, MT6879, MT6883, MT6885, MT…
- CVE-2023-32876In keyInstall, there is a possible information disclosure due to a missing bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2023-32875In keyInstall, there is a possible information disclosure due to a missing bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2023-32872In keyInstall, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2024-0186HuiRan Host Reseller System HTTP POST Request password recoveryHuiRan Host Reseller System
- CVE-2024-0185RRJ Nueva Ecija Engineer Online Portal Avatar dasboard_teacher.php unrestricted uploadRRJ Nueva Ecija Engineer Online Portal
- CVE-2020-26623SQL Injection vulnerability discovered in Gila CMS 1.15.4 and earlier allows a remote attacker to execute arbitrary web scripts via the Areagilacms/gila
- CVE-2020-26624A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts gilacms/gila
- CVE-2020-26625A SQL injection vulnerability was discovered in Gila CMS 1.15.4 and earlier which allows a remote attacker to execute arbitrary web scripts gilacms/gila
- CVE-2023-45561An issue in A-WORLD OIRASE BEER_waiting Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token
- CVE-2023-49554Use After Free vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the do_directive function in t
- CVE-2023-49555An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_smacro function in the modules/preprocs
- CVE-2023-49556Buffer Overflow vulnerability in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expr_delete_term function
- CVE-2023-49557An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the yasm_section_bcs_first function in the libyasm
- CVE-2023-49558An issue in YASM 1.3.0.86.g9def allows a remote attacker to cause a denial of service via the expand_mmac_params function in the modules/pre
- CVE-2023-50019An issue was discovered in open5gs v2.6.6.