# CVEs published 2024-01-04

59 CVEs were published on January 4, 2024: 20 critical, 14 high. Days are UTC.

- [CVE-2024-0241](https://cve.now/CVE-2024-0241.md): encoded\_id-rails Denial of Service Vulnerability (CVSS 7.5, encoded\_id-rails)
- [CVE-2024-22048](https://cve.now/CVE-2024-22048.md): govuk\_tech\_docs XSS Vulnerability (CVSS 6.1, govuk\_tech\_docs)
- [CVE-2024-22047](https://cve.now/CVE-2024-22047.md): Audited Log Integrity Errors Due to Race Condition (CVSS 3.1, audited)
- [CVE-2024-22051](https://cve.now/CVE-2024-22051.md): CommonMarker Integer Overflow Vulnerability (CVSS 9.8, commonmarker)
- [CVE-2024-22050](https://cve.now/CVE-2024-22050.md): Iodine Static File Server Path Traversal Vulnerability (CVSS 7.5, iodine)
- [CVE-2024-22049](https://cve.now/CVE-2024-22049.md): httparty Multipart/Form-Data Request Tampering Vulnerability (CVSS 5.3, httparty)
- [CVE-2024-21636](https://cve.now/CVE-2024-21636.md): view\_component Cross-site Scripting vulnerability (CVSS 6.1, ViewComponent view\_component · view\_component)
- [CVE-2023-6270](https://cve.now/CVE-2023-6270.md): Kernel: aoe: improper reference count leads to use-after-free vulnerability (CVSS 7.0, Red Hat Enterprise Linux)
- [CVE-2023-6551](https://cve.now/CVE-2023-6551.md): Stored XSS in class.upload.php (CVSS 5.4, class.upload.php · verot/class.upload.php)
- [CVE-2024-21625](https://cve.now/CVE-2024-21625.md): One-click remote code execution via malicious deep link (CVSS 8.8, SideQuestVR SideQuest)
- [CVE-2023-3726](https://cve.now/CVE-2023-3726.md): OCSInventory-ocsreports 2.12.0 - Stored cross-site Scripting (CVSS 6.9, OCSInventory)
- [CVE-2023-50867](https://cve.now/CVE-2023-50867.md): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Travel Website)
- [CVE-2023-50866](https://cve.now/CVE-2023-50866.md): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Travel Website)
- [CVE-2023-50865](https://cve.now/CVE-2023-50865.md): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Travel Website)
- [CVE-2023-50864](https://cve.now/CVE-2023-50864.md): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Travel Website)
- [CVE-2023-50863](https://cve.now/CVE-2023-50863.md): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Travel Website)
- [CVE-2023-50862](https://cve.now/CVE-2023-50862.md): Travel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Travel Website)
- [CVE-2023-50760](https://cve.now/CVE-2023-50760.md): Online Notice Board System v1.0 - Insecure File Upload (CVSS 8.8, Kashipara Group Online Notice Board System)
- [CVE-2023-50753](https://cve.now/CVE-2023-50753.md): Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Online Notice Board System)
- [CVE-2023-50752](https://cve.now/CVE-2023-50752.md): Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Online Notice Board System)
- [CVE-2023-50743](https://cve.now/CVE-2023-50743.md): Online Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Online Notice Board System)
- [CVE-2023-49666](https://cve.now/CVE-2023-49666.md): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Billing Software)
- [CVE-2023-49665](https://cve.now/CVE-2023-49665.md): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Billing Software)
- [CVE-2023-49658](https://cve.now/CVE-2023-49658.md): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Billing Software)
- [CVE-2023-49639](https://cve.now/CVE-2023-49639.md): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Billing Software)
- [CVE-2023-49633](https://cve.now/CVE-2023-49633.md): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Billing Software)
- [CVE-2023-49625](https://cve.now/CVE-2023-49625.md): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Billing Software)
- [CVE-2023-49624](https://cve.now/CVE-2023-49624.md): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Billing Software)
- [CVE-2023-49622](https://cve.now/CVE-2023-49622.md): Billing Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi) (CVSS 9.8, Kashipara Group Billing Software)
- [CVE-2021-40367](https://cve.now/CVE-2021-40367.md): A vulnerability has been identified in syngo fastView (All versions). (CVSS 7.8, Siemens syngo fastView)
- [CVE-2021-45465](https://cve.now/CVE-2021-45465.md): A vulnerability has been identified in syngo fastView (All versions). (CVSS 7.8, Siemens syngo fastView)
- [CVE-2021-42028](https://cve.now/CVE-2021-42028.md): A vulnerability has been identified in syngo fastView (All versions). (CVSS 7.8, Siemens syngo fastView)
- [CVE-2023-6992](https://cve.now/CVE-2023-6992.md): Memory corruption issues is Cloudflare zlib implementation (CVSS 4.0, Cloudflare zlib)
- [CVE-2023-6944](https://cve.now/CVE-2023-6944.md): Rhdh: catalog-import function leaks credentials to frontend (CVSS 5.7, Red Hat RHDH-1.1-RHEL-9 · @backstage/backend-app-api)
- [CVE-2022-3864](https://cve.now/CVE-2022-3864.md): A vulnerability exists in the Relion update package signature validation. (CVSS 4.5, Hitachi Energy Relion 670/650/SAM600-IO Series)
- [CVE-2023-7044](https://cve.now/CVE-2023-7044.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2022-2081](https://cve.now/CVE-2022-2081.md): A vulnerability exists in the HCI Modbus TCP function included in the product versions listed above. (CVSS 7.5, Hitachi Energy RTU500 series CMU firmware)
- [CVE-2023-41784](https://cve.now/CVE-2023-41784.md): Permissions and Access Control Vulnerability in ZTE Red Magic 8 Pro (CVSS 6.6, ZTE Red Magic 8 Pro)
- [CVE-2023-6738](https://cve.now/CVE-2023-6738.md): PageLayer \<= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields (CVSS 5.4, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2023-6733](https://cve.now/CVE-2023-6733.md): WP-Members Membership Plugin \<= 3.4.8 - Missing Authorization to Sensitive Information Exposure (CVSS 6.5, cbutlerjr WP-Members Membership Plugin)
- [CVE-2023-6498](https://cve.now/CVE-2023-6498.md): Complianz | GDPR/CCPA Cookie Consent \<= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settings (CVSS 4.4, Complianz – GDPR/CCPA Cookie Consent)
- [CVE-2024-0225](https://cve.now/CVE-2024-0225.md): Use after free in WebGPU in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a cra (CVSS 8.8, Google Chrome)
- [CVE-2024-0224](https://cve.now/CVE-2024-0224.md): Use after free in WebAudio in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 8.8, Google Chrome)
- [CVE-2024-0223](https://cve.now/CVE-2024-0223.md): Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2024-0222](https://cve.now/CVE-2024-0222.md): Use after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who had compromised the renderer process to poten (CVSS 8.8, Google Chrome)
- [CVE-2024-20809](https://cve.now/CVE-2024-20809.md): Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access data. (CVSS 4.0, Samsung Mobile Nearby device scanning)
- [CVE-2024-20808](https://cve.now/CVE-2024-20808.md): Improper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows local attacker to access data. (CVSS 4.0, Samsung Mobile Nearby device scanning)
- [CVE-2024-20807](https://cve.now/CVE-2024-20807.md): Implicit intent hijacking vulnerability in Samsung Email prior to version 6.1.90.16 allows local attacker to get sensitive information. (CVSS 3.3, Samsung Mobile Samsung Email)
- [CVE-2024-20806](https://cve.now/CVE-2024-20806.md): Improper access control in Notification service prior to SMR Jan-2024 Release 1 allows local attacker to access notification data. (CVSS 6.2, Samsung Mobile Devices)
- [CVE-2024-20805](https://cve.now/CVE-2024-20805.md): Path traversal vulnerability in ZipCompressor of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 12, and version 14.5.00.2 (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2024-20804](https://cve.now/CVE-2024-20804.md): Path traversal vulnerability in FileUriConverter of MyFiles prior to SMR Jan-2024 Release 1 in Android 11 and Android 12, and version 14.5.0 (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20803](https://cve.now/CVE-2024-20803.md): Improper authentication vulnerability in Bluetooth pairing process prior to SMR Jan-2024 Release 1 allows remote attackers to establish pair (CVSS 6.8, Samsung Mobile Devices)
- [CVE-2024-20802](https://cve.now/CVE-2024-20802.md): Improper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner to access other users&#39; notification in (CVSS 4.6, Samsung Mobile Devices)
- [CVE-2023-29962](https://cve.now/CVE-2023-29962.md): S-CMS v5.0 was discovered to contain an arbitrary file read vulnerability. (CVSS 6.5)
- [CVE-2023-50082](https://cve.now/CVE-2023-50082.md): Aoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote attackers to gain sensitive information via sessio (CVSS 7.5)
- [CVE-2023-50630](https://cve.now/CVE-2023-50630.md): Cross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to execute arbitrary code via a crafted script (CVSS 6.1)
- [CVE-2023-51154](https://cve.now/CVE-2023-51154.md): Jizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the component /admin/c/PluginsController.php. (CVSS 9.8)
- [CVE-2023-51812](https://cve.now/CVE-2023-51812.md): Tenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via the list parameter at /goform/SetNetControl (CVSS 9.8)
- [CVE-2023-52322](https://cve.now/CVE-2023-52322.md): ecrire/public/assembler.php in SPIP before 4.1.13 and 4.2.x before 4.2.7 allows XSS because input from \_request() is not restricted to safe (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.