# CVEs published 2024-01-03

92 CVEs were published on January 3, 2024: 10 critical, 34 high. Days are UTC.

- [CVE-2024-21634](https://cve.now/CVE-2024-21634.md): Ion Java StackOverflow vulnerability (CVSS 7.5, amazon-ion ion-java · com.amazon.ion:ion-java +1)
- [CVE-2023-50256](https://cve.now/CVE-2023-50256.md): Froxlor username/surname AND company field Bypass (CVSS 7.5, Froxlor · froxlor/froxlor)
- [CVE-2023-5138](https://cve.now/CVE-2023-5138.md): Glitch detection not active by default in Silicon Labs Secure Vault High devices (CVSS 6.8, silabs.com GSDK)
- [CVE-2023-6540](https://cve.now/CVE-2023-6540.md): A vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android that could allow an attacker to craft a pay (CVSS 6.5, Lenovo Browser Mobile · Lenovo Browser HD)
- [CVE-2023-6338](https://cve.now/CVE-2023-6338.md): Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local a (CVSS 7.8, Lenovo Universal Device Client)
- [CVE-2023-5881](https://cve.now/CVE-2023-5881.md): Unauthenticated access permitted to web interface page "Garage Door Control Module Setup" (CVSS 7.1, The Genie Company Aladdin Connect)
- [CVE-2023-5880](https://cve.now/CVE-2023-5880.md): Cross-site Scripting (XSS) injected into Aladdin Connect garage door opener (Retrofit-Kit) configuration setup webserver console via broadcast SSID name (CVSS 8.8, The Genie Company Aladdin Connect)
- [CVE-2023-5879](https://cve.now/CVE-2023-5879.md): Aladdin Connect Android Application Insecure Storage (CVSS 6.8, The Genie Company Aladdin Connect Mobile Application)
- [CVE-2024-0217](https://cve.now/CVE-2024-0217.md): Packagekitd: use-after-free in idle function callback (CVSS 3.3, PackageKit · Red Hat Enterprise Linux)
- [CVE-2023-6004](https://cve.now/CVE-2023-6004.md): Libssh: proxycommand/proxyjump features allow injection of malicious code through hostname (CVSS 4.8, Red Hat Enterprise Linux)
- [CVE-2024-21633](https://cve.now/CVE-2024-21633.md): Arbitrary file write on Decoding (CVSS 7.8, iBotPeaches Apktool)
- [CVE-2024-21631](https://cve.now/CVE-2024-21631.md): Integer overflow in URI leading to potential host spoofing (CVSS 6.5, vapor)
- [CVE-2024-21622](https://cve.now/CVE-2024-21622.md): Craft CMS Privilege Escalation (CVSS 5.4, craftcms cms · craftcms/cms)
- [CVE-2023-50253](https://cve.now/CVE-2023-50253.md): laf logs leak (CVSS 9.7, labring laf)
- [CVE-2023-46742](https://cve.now/CVE-2023-46742.md): CubeFS leaks users key in logs (CVSS 4.8, cubefs · github.com/cubefs/cubefs)
- [CVE-2023-46741](https://cve.now/CVE-2023-46741.md): CubeFS leaks magic secret key when starting Blobstore access service (CVSS 4.8, cubefs · github.com/cubefs/cubefs)
- [CVE-2023-46740](https://cve.now/CVE-2023-46740.md): Insecure random string generator used for sensitive data (CVSS 6.5, cubefs · github.com/cubefs/cubefs)
- [CVE-2023-46739](https://cve.now/CVE-2023-46739.md): Timing attack can leak user passwords (CVSS 6.5, cubefs · github.com/cubefs/cubefs)
- [CVE-2024-21911](https://cve.now/CVE-2024-21911.md): Cross-site scripting vulnerability in TinyMCE (CVSS 6.1, TinyMCE · tinymce/tinymce)
- [CVE-2024-21910](https://cve.now/CVE-2024-21910.md): Cross-site scripting vulnerability in TinyMCE plugins (CVSS 6.1, TinyMCE · tinymce/tinymce +1)
- [CVE-2024-21909](https://cve.now/CVE-2024-21909.md): Denial of service in CBOR library (CVSS 7.5, PeterO.Cbor)
- [CVE-2024-21908](https://cve.now/CVE-2024-21908.md): Cross-site scripting vulnerability in TinyMCE (CVSS 6.1, TinyMCE · tinymce/tinymce)
- [CVE-2023-46738](https://cve.now/CVE-2023-46738.md): Authenticated users can crash the CubeFS servers with maliciously crafted requests (CVSS 6.5, cubefs · github.com/cubefs/cubefs)
- [CVE-2023-30617](https://cve.now/CVE-2023-30617.md): Leverage the kruise-daemon pod to list all secrets in the entire cluster (CVSS 6.5, openkruise kruise · github.com/openkruise/kruise)
- [CVE-2024-21907](https://cve.now/CVE-2024-21907.md): Improper Handling of Exceptional Conditions in Newtonsoft.Json (CVSS 7.5, Newtonsoft.Json)
- [CVE-2023-51784](https://cve.now/CVE-2023-51784.md): Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager (CVSS 9.8, Apache Software Foundation Apache InLong · org.apache.inlon…)
- [CVE-2023-51785](https://cve.now/CVE-2023-51785.md): Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager (CVSS 7.5, Apache Software Foundation Apache InLong · org.apache.inlon…)
- [CVE-2024-0201](https://cve.now/CVE-2024-0201.md): Product Expiry for WooCommerce \<= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update (CVSS 5.4, webcodingplace Product Expiry for WooCommerce)
- [CVE-2023-6621](https://cve.now/CVE-2023-6621.md): Post SMTP \< 2.8.7 - Reflected Cross-Site Scripting (CVSS 6.1, POST SMTP)
- [CVE-2023-6984](https://cve.now/CVE-2023-6984.md): PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) \<= 2.7.13 - Cross-Site Request Forgery (CVSS 5.3, ideaboxcreations PowerPack Addons for Elementor)
- [CVE-2023-6747](https://cve.now/CVE-2023-6747.md): FooGallery Premium \<= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, https://fooplugins.com FooGallery Premium · fooplugins Gall…)
- [CVE-2023-7068](https://cve.now/CVE-2023-7068.md): WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \<= 4.3.0 - Missing Authorization to Order Export (CVSS 4.3, WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…)
- [CVE-2023-52314](https://cve.now/CVE-2023-52314.md): Command injection in convert\_shape\_compare (CVSS 9.6, PaddlePaddle)
- [CVE-2023-52313](https://cve.now/CVE-2023-52313.md): FPE in paddle.argmin and paddle.argmax (CVSS 4.7, PaddlePaddle)
- [CVE-2023-52312](https://cve.now/CVE-2023-52312.md): Null pointer dereference in paddle.crop (CVSS 4.7, PaddlePaddle)
- [CVE-2023-52311](https://cve.now/CVE-2023-52311.md): Command injection in \_wget\_download (CVSS 9.6, PaddlePaddle)
- [CVE-2023-52310](https://cve.now/CVE-2023-52310.md): Command injection in get\_online\_pass\_interval (CVSS 9.6, PaddlePaddle)
- [CVE-2023-52309](https://cve.now/CVE-2023-52309.md): Heap buffer overflow in paddle.repeat\_interleave (CVSS 8.2, PaddlePaddle)
- [CVE-2023-52308](https://cve.now/CVE-2023-52308.md): FPE in paddle.amin (CVSS 4.7, PaddlePaddle)
- [CVE-2023-52307](https://cve.now/CVE-2023-52307.md): Stack overflow in paddle.linalg.lu\_unpack (CVSS 8.2, PaddlePaddle)
- [CVE-2023-52306](https://cve.now/CVE-2023-52306.md): FPE in paddle.lerp (CVSS 4.7, PaddlePaddle)
- [CVE-2023-52305](https://cve.now/CVE-2023-52305.md): FPE in paddle.topk (CVSS 4.7, PaddlePaddle)
- [CVE-2023-52304](https://cve.now/CVE-2023-52304.md): Stack overflow in paddle.searchsorted (CVSS 8.2, PaddlePaddle)
- [CVE-2023-52303](https://cve.now/CVE-2023-52303.md): Segfault in paddle.put\_along\_axis (CVSS 4.7, PaddlePaddle)
- [CVE-2023-52302](https://cve.now/CVE-2023-52302.md): Segfault in paddle.nextafter (CVSS 4.7, PaddlePaddle)
- [CVE-2023-38678](https://cve.now/CVE-2023-38678.md): Segfault in paddle.mode (CVSS 4.7, PaddlePaddle)
- [CVE-2023-38677](https://cve.now/CVE-2023-38677.md): FPE in paddle.linalg.eig (CVSS 4.7, PaddlePaddle)
- [CVE-2023-38676](https://cve.now/CVE-2023-38676.md): Segfault in paddle.dot (CVSS 4.7, PaddlePaddle)
- [CVE-2023-38675](https://cve.now/CVE-2023-38675.md): FPE in paddle.linalg.matrix\_rank (CVSS 4.7, PaddlePaddle)
- [CVE-2023-38674](https://cve.now/CVE-2023-38674.md): FPE in paddle.nanmedian (CVSS 4.7, PaddlePaddle)
- [CVE-2024-0211](https://cve.now/CVE-2024-0211.md): Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-0210](https://cve.now/CVE-2024-0210.md): Uncontrolled Recursion in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-0209](https://cve.now/CVE-2024-0209.md): NULL Pointer Dereference in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-0208](https://cve.now/CVE-2024-0208.md): Improper Handling of Missing Values in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-0207](https://cve.now/CVE-2024-0207.md): Out-of-bounds Read in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2023-6986](https://cve.now/CVE-2023-6986.md): EmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor \<= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…)
- [CVE-2023-6981](https://cve.now/CVE-2023-6981.md): WP SMS \<= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting (CVSS 6.1, veronalabs WSMS (formerly WP SMS) – SMS & MMS Notifications…)
- [CVE-2023-6980](https://cve.now/CVE-2023-6980.md): WP SMS \<= 6.5 - Cross-Site Request Forgery to Subscriber Deletion (CVSS 4.3, veronalabs WSMS (formerly WP SMS) – SMS & MMS Notifications…)
- [CVE-2023-6600](https://cve.now/CVE-2023-6600.md): OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. \<= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletion and Cross-Site Scripting (CVSS 8.6, daanvandenbergh OMGF | GDPR/DSGVO Compliant, Faster Google…)
- [CVE-2023-6524](https://cve.now/CVE-2023-6524.md): MapPress Maps for WordPress \<= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, chrisvrichardson MapPress Maps for WordPress)
- [CVE-2023-7027](https://cve.now/CVE-2023-7027.md): POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \<= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device (CVSS 7.2, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2023-6629](https://cve.now/CVE-2023-6629.md): POST SMTP Mailer \<= 2.8.6 - Reflected Cross-Site Scripting via msg (CVSS 6.1, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2023-45722](https://cve.now/CVE-2023-45722.md): Path Traversal Arbitrary File Read affects DRYiCE MyXalytics (CVSS 8.8, HCL Software DRYiCE MyXalytics)
- [CVE-2023-45724](https://cve.now/CVE-2023-45724.md): Unauthenticated File Upload affects DRYiCE MyXalytics (CVSS 8.2, HCL Software DRYiCE MyXalytics)
- [CVE-2023-45723](https://cve.now/CVE-2023-45723.md): Path Traversal which allows file upload capability affects DRYiCE MyXalytics (CVSS 7.6, HCL Software DRYiCE MyXalytics)
- [CVE-2023-50341](https://cve.now/CVE-2023-50341.md): Improper Access Control affects DRYiCE MyXalytics (CVSS 7.6, HCL Software DRYiCE MyXalytics)
- [CVE-2023-50342](https://cve.now/CVE-2023-50342.md): Insecure Direct Object Reference (IDOR) affects DRYiCE MyXalytics (CVSS 7.1, HCL Software DRYiCE MyXalytics)
- [CVE-2023-50343](https://cve.now/CVE-2023-50343.md): Improper Access Control (Controller APIs) affects DRYiCE MyXalytics (CVSS 8.3, HCL Software DRYiCE MyXalytics)
- [CVE-2023-50344](https://cve.now/CVE-2023-50344.md): Unauthenticated File Downloads affect DRYiCE MyXalytics (CVSS 5.4, HCL Software DRYiCE MyXalytics)
- [CVE-2023-41783](https://cve.now/CVE-2023-41783.md): Command Injection Vulnerability of ZTE's ZXCLOUD iRAI (CVSS 4.3, ZTE ZXCLOUD iRAI)
- [CVE-2023-50345](https://cve.now/CVE-2023-50345.md): Open Redirect affects DRYiCE MyXalytics (CVSS 3.7, HCL Software DRYiCE MyXalytics)
- [CVE-2023-50346](https://cve.now/CVE-2023-50346.md): An information disclosure affects DRYiCE MyXalytics (CVSS 3.1, HCL Software DRYiCE MyXalytics)
- [CVE-2023-41776](https://cve.now/CVE-2023-41776.md): Local Privilege Escalation Vulnerability of ZTE's ZXCLOUD iRAI (CVSS 6.7, ZTE ZXCLOUD iRAI)
- [CVE-2023-50348](https://cve.now/CVE-2023-50348.md): Improper Error Handling affects DRYiCE MyXalytics (CVSS 3.1, HCL Software DRYiCE MyXalytics)
- [CVE-2023-41780](https://cve.now/CVE-2023-41780.md): Unsafe DLL Loading Vulnerability in ZTE ZXCLOUD iRAI (CVSS 6.4, ZTE ZXCLOUD iRAI)
- [CVE-2023-50350](https://cve.now/CVE-2023-50350.md): A broken cryptographic algorithm impacts MyXalytics (CVSS 8.2, HCL Software DRYiCE MyXalytics)
- [CVE-2023-50351](https://cve.now/CVE-2023-50351.md): Insecure key rotation affects MyXalytics (CVSS 8.2, HCL Software DRYiCE MyXalytics)
- [CVE-2023-41779](https://cve.now/CVE-2023-41779.md): Illegal Memory Access Vulnerability of ZTE's ZXCLOUD iRAI (CVSS 4.4, ZTE ZXCLOUD iRAI)
- [CVE-2023-37607](https://cve.now/CVE-2023-37607.md): Directory Traversal in Automatic Systems SOC FL9600 FirstLane V06 lego\_T04E00 allows a remote attacker to obtain sensitive information via c (CVSS 7.5)
- [CVE-2023-37608](https://cve.now/CVE-2023-37608.md): An issue in Automatic Systems SOC FL9600 FirstLane V06 lego\_T04E00 allows a remote attacker to obtain sensitive information because there is (CVSS 7.5)
- [CVE-2023-39655](https://cve.now/CVE-2023-39655.md): A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions \<= 0.20.0. (CVSS 9.6, @perfood/couch-auth)
- [CVE-2023-42358](https://cve.now/CVE-2023-42358.md): An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of (CVSS 7.5)
- [CVE-2023-45559](https://cve.now/CVE-2023-45559.md): An issue in Tamaki\_hamanoki Line v.13.6.1 allows attackers to send crafted notifications via leakage of the channel access token. (CVSS 8.2)
- [CVE-2023-46308](https://cve.now/CVE-2023-46308.md): In Plotly plotly.js before 2.25.2, plot API calls have a risk of \_\_proto\_\_ being polluted in expandObjectPaths or nestedProperty. (CVSS 9.8, plotly/plotly.js · plotly.js)
- [CVE-2023-46929](https://cve.now/CVE-2023-46929.md): An issue discovered in GPAC 2.3-DEV-rev605-gfc9e29089-master in MP4Box in gf\_avc\_change\_vui /afltest/gpac/src/media\_tools/av\_parsers.c:6872: (CVSS 7.5)
- [CVE-2023-47473](https://cve.now/CVE-2023-47473.md): Directory Traversal vulnerability in fuwushe.org iFair versions 23.8\_ad0 and before allows an attacker to obtain sensitive information via a (CVSS 7.5)
- [CVE-2023-49442](https://cve.now/CVE-2023-49442.md): Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POS (CVSS 9.8)
- [CVE-2023-50090](https://cve.now/CVE-2023-50090.md): Arbitrary File Write vulnerability in the saveReportFile method of ureport2 2.2.9 and before allows attackers to write arbitrary files and r (CVSS 9.8)
- [CVE-2023-50092](https://cve.now/CVE-2023-50092.md): APIIDA API Gateway Manager for Broadcom Layer7 v2023.2 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2023-50093](https://cve.now/CVE-2023-50093.md): APIIDA API Gateway Manager for Broadcom Layer7 v2023.2.2 is vulnerable to Host Header Injection. (CVSS 5.4)
- [CVE-2023-50921](https://cve.now/CVE-2023-50921.md): An issue was discovered on GL.iNet devices through 4.5.0. (CVSS 9.8)
- [CVE-2023-50922](https://cve.now/CVE-2023-50922.md): An issue was discovered on GL.iNet devices through 4.5.0. (CVSS 7.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.