CVEs published January 4, 2024
59 CVEs were published on January 4, 2024: 20 critical, 14 high.
- Published
- 59
- Critical
- 20
- High
- 14
- Medium
- 22
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- Kashipara Group Billing Software
- 8
- Kashipara Group Travel Website
- 6
- Samsung Mobile Devices
- 5
- Google Chrome
- 4
- Kashipara Group Online Notice Board System
- 4
- Siemens syngo fastView
- 3
- Samsung Mobile Nearby device scanning
- 2
- audited
- 1
- cbutlerjr WP-Members Membership Plugin
- 1
- class.upload.php · verot/class.upload.php
- 1
Critical 20
- CVE-2024-22051CommonMarker Integer Overflow Vulnerabilitycommonmarker
- CVE-2023-50867Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Travel Website
- CVE-2023-50866Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Travel Website
- CVE-2023-50865Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Travel Website
- CVE-2023-50864Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Travel Website
- CVE-2023-50863Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Travel Website
- CVE-2023-50862Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Travel Website
- CVE-2023-50753Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Online Notice Board System
- CVE-2023-50752Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Online Notice Board System
- CVE-2023-50743Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Online Notice Board System
- CVE-2023-49666Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Billing Software
- CVE-2023-49665Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Billing Software
- CVE-2023-49658Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Billing Software
- CVE-2023-49639Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Billing Software
- CVE-2023-49633Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Billing Software
- CVE-2023-49625Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Billing Software
- CVE-2023-49624Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Billing Software
- CVE-2023-49622Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)Kashipara Group Billing Software
- CVE-2023-51154Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php.
- CVE-2023-51812Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /goform/SetNetControl
High 14
- CVE-2024-0241encoded_id-rails Denial of Service Vulnerabilityencoded_id-rails
- CVE-2024-22050Iodine Static File Server Path Traversal Vulnerabilityiodine
- CVE-2023-6270Kernel: aoe: improper reference count leads to use-after-free vulnerabilityRed Hat Enterprise Linux
- CVE-2024-21625One-click remote code execution via malicious deep linkSideQuestVR SideQuest
- CVE-2023-50760Online Notice Board System v1.0 - Insecure File UploadKashipara Group Online Notice Board System
- CVE-2021-40367A vulnerability has been identified in syngo fastView (All versions).Siemens syngo fastView
- CVE-2021-45465A vulnerability has been identified in syngo fastView (All versions).Siemens syngo fastView
- CVE-2021-42028A vulnerability has been identified in syngo fastView (All versions).Siemens syngo fastView
- CVE-2022-2081A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above.Hitachi Energy RTU500 series CMU firmware
- CVE-2024-0225Use after free in WebGPU in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2024-0224Use after free in WebAudio in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2024-0223Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via Google Chrome
- CVE-2024-0222Use after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had compromised the renderer process to potenGoogle Chrome
- CVE-2023-50082Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via sessio
Medium, low and unrated 25
- CVE-2024-22048govuk_tech_docs XSS Vulnerabilitygovuk_tech_docs
- CVE-2024-22047Audited Log Integrity Errors Due to Race Conditionaudited
- CVE-2024-22049httparty Multipart/Form-Data Request Tampering Vulnerabilityhttparty
- CVE-2024-21636view_component Cross-site Scripting vulnerabilityViewComponent view_component · view_component
- CVE-2023-6551Stored XSS in class.upload.phpclass.upload.php · verot/class.upload.php
- CVE-2023-3726OCSInventory-ocsreports 2.12.0 - Stored cross-site ScriptingOCSInventory
- CVE-2023-6992Memory corruption issues is Cloudflare zlib implementationCloudflare zlib
- CVE-2023-6944Rhdh: catalog-import function leaks credentials to frontendRed Hat RHDH-1.1-RHEL-9 · @backstage/backend-app-api
- CVE-2022-3864 A vulnerability exists in the Relion update package signature validation.Hitachi Energy Relion 670/650/SAM600-IO Series
- CVE-2023-7044Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2023-41784Permissions and Access Control Vulnerability in ZTE Red Magic 8 ProZTE Red Magic 8 Pro
- CVE-2023-6738PageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fieldssoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2023-6733WP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposurecbutlerjr WP-Members Membership Plugin
- CVE-2023-6498Complianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settingsComplianz – GDPR/CCPA Cookie Consent
- CVE-2024-20809Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access data.Samsung Mobile Nearby device scanning
- CVE-2024-20808Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access data.Samsung Mobile Nearby device scanning
- CVE-2024-20807Implicit intent hijacking vulnerability in Samsung Email prior to version 6.1.90.16 allows local attacker to get sensitive information.Samsung Mobile Samsung Email
- CVE-2024-20806Improper access control in Notification service prior to SMR Jan-2024 Release 1 allows local attacker to access notification data.Samsung Mobile Devices
- CVE-2024-20805Path traversal vulnerability in ZipCompressor of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 12, and version 14.5.00.2Samsung Mobile Devices
- CVE-2024-20804Path traversal vulnerability in FileUriConverter of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 12, and version 14.5.0Samsung Mobile Devices
- CVE-2024-20803Improper authentication vulnerability in Bluetooth pairing process prior to SMR Jan-2024 Release 1 allows remote attackers to establish pairSamsung Mobile Devices
- CVE-2024-20802Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users' notification inSamsung Mobile Devices
- CVE-2023-29962S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.
- CVE-2023-50630Cross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code via a crafted script
- CVE-2023-52322ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from _request() is not restricted to safe