CVEs published January 5, 2024
74 CVEs were published on January 5, 2024: 9 critical, 12 high.
- Published
- 74
- Critical
- 9
- High
- 12
- Medium
- 43
- Low
- 10
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Xen
- 10
- QNAP Systems QTS · QNAP Systems QuTS hero
- 4
- QNAP Systems QuTS hero · QNAP Systems QTS
- 4
- QNAP Systems QuMagie
- 3
- QNAP Systems Video Station
- 2
- wp.insider, wpaffiliatemgr Affiliates Manager
- 2
- Aaron J 404 Solution
- 1
- Apollo13Themes Apollo13 Framework Extensions
- 1
- averta Depicter — Popup & Slider Builder
- 1
- Awesome Support Team Awesome Support – WordPress HelpDesk &…
- 1
Critical 9
- CVE-2022-46839WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin <= 2.7.1 is vulnerable to Arbitrary File UploadJS Help Desk – Best Help Desk & Support Plugin
- CVE-2020-13878IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27ef heap-based out-of-bounds write.
- CVE-2020-13879IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write.
- CVE-2020-13880IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write.
- CVE-2023-50027SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers t
- CVE-2023-51277nbviewer-app (aka Jupyter Notebook Viewer) before 0.1.6 has the get-task-allow entitlement for release builds.
- CVE-2024-22086handle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to remote code executio
- CVE-2024-22087route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code e
- CVE-2024-22088Lotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h via a long URI, because realloc is mishand
High 12
- CVE-2024-21642D-Tale server-side request forgery through Web uploadsman-group dtale · dtale
- CVE-2024-0247CodeAstro Online Food Ordering System Admin Panel sql injectionCodeAstro Online Food Ordering System
- CVE-2023-34325Multiple vulnerabilities in libfsimage disk handlingXen
- CVE-2023-34326x86/AMD: missing IOMMU TLB flushingXen
- CVE-2023-39296QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-41288Video StationQNAP Systems Video Station
- CVE-2023-47560QuMagieQNAP Systems QuMagie
- CVE-2023-34322top-level shadow reference dropped too early for 64-bit PV guestsXen
- CVE-2023-52143WordPress WP Stripe Checkout Plugin <= 1.2.2.37 is vulnerable to Sensitive Data ExposureNaa986 WP Stripe Checkout
- CVE-2023-52150WordPress Dynamic Content for Elementor Plugin < 2.12.5 is vulnerable to Cross Site Request Forgery (CSRF)Ovation S.r.l. Dynamic Content for Elementor
- CVE-2023-51502WordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)WooCommerce Stripe Payment Gateway
- CVE-2023-50991Buffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote attackers to cause a denial of service (DoS
Medium, low and unrated 53
- CVE-2024-21641Flarum's Logout Route allows open redirectsflarum framework · flarum/core +1
- CVE-2023-46837arm32: The cache may not be properly cleaned/invalidated (take two)Xen
- CVE-2023-46836x86: BTC/SRSO fixes not fully effectiveXen
- CVE-2023-46835x86/AMD: mismatch in IOMMU quarantine page table levelsXen
- CVE-2023-34328x86/AMD: Debug Mask handlingXen
- CVE-2023-34327x86/AMD: Debug Mask handlingXen
- CVE-2023-34324Possible deadlock in Linux kernel event handlingLinux
- CVE-2023-34323xenstored: A transaction conflict can crash C XenstoredXen
- CVE-2023-39294QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-41287Video StationQNAP Systems Video Station
- CVE-2023-41289QcalAgentQNAP Systems QcalAgent
- CVE-2023-45044QTS, QuTS heroQNAP Systems QuTS hero · QNAP Systems QTS
- CVE-2023-45043QTS, QuTS heroQNAP Systems QuTS hero · QNAP Systems QTS
- CVE-2023-45042QTS, QuTS heroQNAP Systems QuTS hero · QNAP Systems QTS
- CVE-2023-45041QTS, QuTS heroQNAP Systems QuTS hero · QNAP Systems QTS
- CVE-2023-45040QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-45039QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-47219QuMagieQNAP Systems QuMagie
- CVE-2023-47559QuMagieQNAP Systems QuMagie
- CVE-2023-34321arm32: The cache may not be properly cleaned/invalidatedXen
- CVE-2024-0246IceWarp Utility Download cross site scriptingIceWarp
- CVE-2023-52124WordPress WP Tabs Plugin <= 2.2.0 is vulnerable to Cross Site Scripting (XSS)ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress
- CVE-2023-52125WordPress iFrame Plugin <= 4.8 is vulnerable to Cross Site Scripting (XSS)webvitaly iframe
- CVE-2023-52126WordPress Send Users Email Plugin <= 1.4.3 is vulnerable to Sensitive Data ExposureSuman Bhattarai Send Users Email
- CVE-2023-52146WordPress 404 Solution Plugin <= 2.33.0 is vulnerable to Sensitive Data ExposureAaron J 404 Solution
- CVE-2023-52148WordPress Affiliates Manager Plugin <= 2.9.30 is vulnerable to Sensitive Data Exposurewp.insider, wpaffiliatemgr Affiliates Manager
- CVE-2023-52151WordPress Uncanny Automator Plugin <= 5.1.0.2 is vulnerable to Sensitive Data ExposureUncanny Automator, Uncanny Owl Uncanny Automator – Automate…
- CVE-2023-51678WordPress Doofinder for WooCommerce Plugin <= 2.0.33 is vulnerable to Broken Access ControlDoofinder WP & WooCommerce Search
- CVE-2023-51535WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin <= 6.20 is vulnerable to Cross Site Request Forgery (CSRF)СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam…
- CVE-2023-51673WordPress Stylish Price List Plugin <= 7.0.17 is vulnerable to Broken Access ControlDesignful Stylish Price List – Price Table Builder & QR Cod…
- CVE-2023-51668WordPress Inline Image Upload for BBPress Plugin <= 1.1.18 is vulnerable to Cross Site Request Forgery (CSRF)WP Zone Inline Image Upload for BBPress
- CVE-2023-51538WordPress Awesome Support Plugin <= 6.1.5 is vulnerable to Cross Site Request Forgery (CSRF)Awesome Support Team Awesome Support – WordPress HelpDesk &…
- CVE-2023-51539WordPress Apollo13 Framework Extensions Plugin <= 1.9.1 is vulnerable to Cross Site Request Forgery (CSRF)Apollo13Themes Apollo13 Framework Extensions
- CVE-2023-52119WordPress Icegram Plugin <= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF)Icegram Engage – WordPress Lead Generation, Popup Builder,…
- CVE-2023-52120WordPress NEX-Forms – Ultimate Form Builder Plugin <= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF)Basix NEX-Forms – Ultimate Form Builder – Contact forms and…
- CVE-2023-52121WordPress NitroPack Plugin <= 1.10.2 is vulnerable to Cross Site Request Forgery (CSRF)NitroPack – Cache & Speed Optimization for Core Web Vitals,…
- CVE-2023-52122WordPress Simple Job Board Plugin <= 2.10.6 is vulnerable to Cross Site Request Forgery (CSRF)PressTigers Simple Job Board
- CVE-2023-52123WordPress Strong Testimonials Plugin <= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF)WPChill Strong Testimonials
- CVE-2023-52127WordPress WPC Product Bundles for WooCommerce Plugin <= 7.3.1 is vulnerable to Cross Site Request Forgery (CSRF)WPClever WPC Product Bundles for WooCommerce
- CVE-2023-52128WordPress White Label Plugin <= 2.9.0 is vulnerable to Cross Site Request Forgery (CSRF)WhiteWP White Label – WordPress Custom Admin, Custom Login…
- CVE-2023-52129WordPress teachPress Plugin <= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF)Michael Winkler teachPress
- CVE-2023-52130WordPress Affiliates Manager Plugin <= 2.9.31 is vulnerable to Cross Site Request Forgery (CSRF)wp.insider, wpaffiliatemgr Affiliates Manager
- CVE-2023-52136WordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)Smash Balloon Custom Twitter Feeds – A Tweets Widget or X F…
- CVE-2023-52145WordPress Republish Old Posts Plugin <= 1.21 is vulnerable to Cross Site Request Forgery (CSRF)Marios Alexandrou Republish Old Posts
- CVE-2023-52149WordPress Floating Button Plugin <= 6.0 is vulnerable to Cross Site Request Forgery (CSRF)Wow-Company Floating Button
- CVE-2023-52184WordPress WP Job Portal Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)WP Job Portal – A Complete Job Board
- CVE-2023-52178WordPress WP Affiliate Disclosure Plugin <= 1.2.7 is vulnerable to Cross-Site Scripting (XSS)MojofyWP WP Affiliate Disclosure
- CVE-2023-6493Depicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via saveaverta Depicter — Popup & Slider Builder
- CVE-2023-41782DLL Hijacking Vulnerability in ZTE ZXCLOUD iRAIZTE ZXCLOUD iRAI
- CVE-2023-7207Debian's cpio contains a path traversal vulnerability.Debian cpio
- CVE-2022-36677Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document.
- CVE-2023-52323PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack.pycryptodomex · pycryptodome
- CVE-2024-22075Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection.grumpydictator/firefly-iii