CVEs published January 3, 2024
92 CVEs were published on January 3, 2024: 10 critical, 34 high.
- Published
- 92
- Critical
- 10
- High
- 34
- Medium
- 44
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 47
Most affected products
- PaddlePaddle
- 18
- HCL Software DRYiCE MyXalytics
- 12
- cubefs · github.com/cubefs/cubefs
- 5
- Wireshark Foundation Wireshark
- 5
- ZTE ZXCLOUD iRAI
- 4
- Apache Software Foundation Apache InLong · org.apache.inlon…
- 2
- saadiqbal Post SMTP – Complete Email Deliverability and SMT…
- 2
- The Genie Company Aladdin Connect
- 2
- TinyMCE · tinymce/tinymce
- 2
- veronalabs WSMS (formerly WP SMS) – SMS & MMS Notifications…
- 2
Critical 10
- CVE-2023-50253laf logs leaklabring laf
- CVE-2023-51784Apache InLong: Remote Code Execution vulnerability in Apache InLong ManagerApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2023-52314Command injection in convert_shape_comparePaddlePaddle
- CVE-2023-52311Command injection in _wget_downloadPaddlePaddle
- CVE-2023-52310Command injection in get_online_pass_intervalPaddlePaddle
- CVE-2023-39655A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0.@perfood/couch-auth
- CVE-2023-46308In Plotly plotly.js before 2.25.2, plot API calls have a risk of __proto__ being polluted in expandObjectPaths or nestedProperty.plotly/plotly.js · plotly.js
- CVE-2023-49442Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POS
- CVE-2023-50090Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and r
- CVE-2023-50921An issue was discovered on GL.iNet devices through 4.5.0.
High 34
- CVE-2024-21634Ion Java StackOverflow vulnerabilityamazon-ion ion-java · com.amazon.ion:ion-java +1
- CVE-2023-50256Froxlor username/surname AND company field BypassFroxlor · froxlor/froxlor
- CVE-2023-6338Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local aLenovo Universal Device Client
- CVE-2023-5881Unauthenticated access permitted to web interface page "Garage Door Control Module Setup"The Genie Company Aladdin Connect
- CVE-2023-5880Cross-site Scripting (XSS) injected into Aladdin Connect garage door opener (Retrofit-Kit) configuration setup webserver console via broadcast SSID nameThe Genie Company Aladdin Connect
- CVE-2024-21633Arbitrary file write on DecodingiBotPeaches Apktool
- CVE-2024-21909Denial of service in CBOR libraryPeterO.Cbor
- CVE-2024-21907Improper Handling of Exceptional Conditions in Newtonsoft.JsonNewtonsoft.Json
- CVE-2023-51785Apache InLong: Arbitrary File Read Vulnerability in Apache InLong ManagerApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2023-52309Heap buffer overflow in paddle.repeat_interleavePaddlePaddle
- CVE-2023-52307Stack overflow in paddle.linalg.lu_unpackPaddlePaddle
- CVE-2023-52304Stack overflow in paddle.searchsortedPaddlePaddle
- CVE-2024-0211Loop with Unreachable Exit Condition ('Infinite Loop') in WiresharkWireshark Foundation Wireshark
- CVE-2024-0210Uncontrolled Recursion in WiresharkWireshark Foundation Wireshark
- CVE-2024-0209NULL Pointer Dereference in WiresharkWireshark Foundation Wireshark
- CVE-2024-0208Improper Handling of Missing Values in WiresharkWireshark Foundation Wireshark
- CVE-2024-0207Out-of-bounds Read in WiresharkWireshark Foundation Wireshark
- CVE-2023-6600OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletion and Cross-Site Scriptingdaanvandenbergh OMGF | GDPR/DSGVO Compliant, Faster Google…
- CVE-2023-7027POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via devicesaadiqbal Post SMTP – Complete Email Deliverability and SMT…
- CVE-2023-45722Path Traversal Arbitrary File Read affects DRYiCE MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-45724Unauthenticated File Upload affects DRYiCE MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-45723Path Traversal which allows file upload capability affects DRYiCE MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-50341Improper Access Control affects DRYiCE MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-50342Insecure Direct Object Reference (IDOR) affects DRYiCE MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-50343Improper Access Control (Controller APIs) affects DRYiCE MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-50350A broken cryptographic algorithm impacts MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-50351Insecure key rotation affects MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-37607Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information via c
- CVE-2023-37608An issue in Automatic Systems SOC FL9600 FirstLane V06 lego_T04E00 allows a remote attacker to obtain sensitive information because there is
- CVE-2023-42358An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of
- CVE-2023-45559An issue in Tamaki_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token.
- CVE-2023-46929An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf_avc_change_vui /afltest/gpac/src/media_tools/av_parsers.c:6872:
- CVE-2023-47473Directory Traversal vulnerability in fuwushe.org iFair versions 23.8_ad0 and before allows an attacker to obtain sensitive information via a
- CVE-2023-50922An issue was discovered on GL.iNet devices through 4.5.0.
Medium, low and unrated 48
- CVE-2023-5138Glitch detection not active by default in Silicon Labs Secure Vault High devicessilabs.com GSDK
- CVE-2023-6540A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a payLenovo Browser Mobile · Lenovo Browser HD
- CVE-2023-5879Aladdin Connect Android Application Insecure StorageThe Genie Company Aladdin Connect Mobile Application
- CVE-2024-0217Packagekitd: use-after-free in idle function callbackPackageKit · Red Hat Enterprise Linux
- CVE-2023-6004Libssh: proxycommand/proxyjump features allow injection of malicious code through hostnameRed Hat Enterprise Linux
- CVE-2024-21631Integer overflow in URI leading to potential host spoofingvapor
- CVE-2024-21622Craft CMS Privilege Escalationcraftcms cms · craftcms/cms
- CVE-2023-46742CubeFS leaks users key in logscubefs · github.com/cubefs/cubefs
- CVE-2023-46741CubeFS leaks magic secret key when starting Blobstore access servicecubefs · github.com/cubefs/cubefs
- CVE-2023-46740Insecure random string generator used for sensitive datacubefs · github.com/cubefs/cubefs
- CVE-2023-46739Timing attack can leak user passwordscubefs · github.com/cubefs/cubefs
- CVE-2024-21911Cross-site scripting vulnerability in TinyMCETinyMCE · tinymce/tinymce
- CVE-2024-21910Cross-site scripting vulnerability in TinyMCE pluginsTinyMCE · tinymce/tinymce +1
- CVE-2024-21908Cross-site scripting vulnerability in TinyMCETinyMCE · tinymce/tinymce
- CVE-2023-46738Authenticated users can crash the CubeFS servers with maliciously crafted requestscubefs · github.com/cubefs/cubefs
- CVE-2023-30617Leverage the kruise-daemon pod to list all secrets in the entire clusteropenkruise kruise · github.com/openkruise/kruise
- CVE-2024-0201Product Expiry for WooCommerce <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Updatewebcodingplace Product Expiry for WooCommerce
- CVE-2023-6621Post SMTP < 2.8.7 - Reflected Cross-Site ScriptingPOST SMTP
- CVE-2023-6984PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.13 - Cross-Site Request Forgeryideaboxcreations PowerPack Addons for Elementor
- CVE-2023-6747FooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scriptinghttps://fooplugins.com FooGallery Premium · fooplugins Gall…
- CVE-2023-7068WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order ExportWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…
- CVE-2023-52313FPE in paddle.argmin and paddle.argmaxPaddlePaddle
- CVE-2023-52312Null pointer dereference in paddle.cropPaddlePaddle
- CVE-2023-52308FPE in paddle.aminPaddlePaddle
- CVE-2023-52306FPE in paddle.lerpPaddlePaddle
- CVE-2023-52305FPE in paddle.topkPaddlePaddle
- CVE-2023-52303Segfault in paddle.put_along_axisPaddlePaddle
- CVE-2023-52302Segfault in paddle.nextafterPaddlePaddle
- CVE-2023-38678Segfault in paddle.modePaddlePaddle
- CVE-2023-38677FPE in paddle.linalg.eigPaddlePaddle
- CVE-2023-38676Segfault in paddle.dotPaddlePaddle
- CVE-2023-38675FPE in paddle.linalg.matrix_rankPaddlePaddle
- CVE-2023-38674FPE in paddle.nanmedianPaddlePaddle
- CVE-2023-6986EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2023-6981WP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scriptingveronalabs WSMS (formerly WP SMS) – SMS & MMS Notifications…
- CVE-2023-6980WP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletionveronalabs WSMS (formerly WP SMS) – SMS & MMS Notifications…
- CVE-2023-6524MapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scriptingchrisvrichardson MapPress Maps for WordPress
- CVE-2023-6629POST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msgsaadiqbal Post SMTP – Complete Email Deliverability and SMT…
- CVE-2023-50344Unauthenticated File Downloads affect DRYiCE MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-41783Command Injection Vulnerability of ZTE's ZXCLOUD iRAIZTE ZXCLOUD iRAI
- CVE-2023-50345Open Redirect affects DRYiCE MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-50346An information disclosure affects DRYiCE MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-41776Local Privilege Escalation Vulnerability of ZTE's ZXCLOUD iRAIZTE ZXCLOUD iRAI
- CVE-2023-50348Improper Error Handling affects DRYiCE MyXalyticsHCL Software DRYiCE MyXalytics
- CVE-2023-41780Unsafe DLL Loading Vulnerability in ZTE ZXCLOUD iRAIZTE ZXCLOUD iRAI
- CVE-2023-41779Illegal Memory Access Vulnerability of ZTE's ZXCLOUD iRAIZTE ZXCLOUD iRAI
- CVE-2023-50092APIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-50093APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection.