# CVEs published 2024-01-05

74 CVEs were published on January 5, 2024: 9 critical, 12 high. Days are UTC.

- [CVE-2024-21642](https://cve.now/CVE-2024-21642.md): D-Tale server-side request forgery through Web uploads (CVSS 7.5, man-group dtale · dtale)
- [CVE-2024-21641](https://cve.now/CVE-2024-21641.md): Flarum's Logout Route allows open redirects (CVSS 6.5, flarum framework · flarum/core +1)
- [CVE-2024-0247](https://cve.now/CVE-2024-0247.md): CodeAstro Online Food Ordering System Admin Panel sql injection (CVSS 7.3, CodeAstro Online Food Ordering System)
- [CVE-2023-46837](https://cve.now/CVE-2023-46837.md): arm32: The cache may not be properly cleaned/invalidated (take two) (CVSS 3.3, Xen)
- [CVE-2023-46836](https://cve.now/CVE-2023-46836.md): x86: BTC/SRSO fixes not fully effective (CVSS 4.7, Xen)
- [CVE-2023-46835](https://cve.now/CVE-2023-46835.md): x86/AMD: mismatch in IOMMU quarantine page table levels (CVSS 5.5, Xen)
- [CVE-2023-34328](https://cve.now/CVE-2023-34328.md): x86/AMD: Debug Mask handling (CVSS 5.5, Xen)
- [CVE-2023-34327](https://cve.now/CVE-2023-34327.md): x86/AMD: Debug Mask handling (CVSS 5.5, Xen)
- [CVE-2023-34325](https://cve.now/CVE-2023-34325.md): Multiple vulnerabilities in libfsimage disk handling (CVSS 7.8, Xen)
- [CVE-2023-34326](https://cve.now/CVE-2023-34326.md): x86/AMD: missing IOMMU TLB flushing (CVSS 7.8, Xen)
- [CVE-2023-34324](https://cve.now/CVE-2023-34324.md): Possible deadlock in Linux kernel event handling (CVSS 4.9, Linux)
- [CVE-2023-34323](https://cve.now/CVE-2023-34323.md): xenstored: A transaction conflict can crash C Xenstored (CVSS 5.5, Xen)
- [CVE-2023-39294](https://cve.now/CVE-2023-39294.md): QTS, QuTS hero (CVSS 6.6, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-39296](https://cve.now/CVE-2023-39296.md): QTS, QuTS hero (CVSS 7.5, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-41287](https://cve.now/CVE-2023-41287.md): Video Station (CVSS 4.3, QNAP Systems Video Station)
- [CVE-2023-41288](https://cve.now/CVE-2023-41288.md): Video Station (CVSS 8.8, QNAP Systems Video Station)
- [CVE-2023-41289](https://cve.now/CVE-2023-41289.md): QcalAgent (CVSS 6.3, QNAP Systems QcalAgent)
- [CVE-2023-45044](https://cve.now/CVE-2023-45044.md): QTS, QuTS hero (CVSS 3.8, QNAP Systems QuTS hero · QNAP Systems QTS)
- [CVE-2023-45043](https://cve.now/CVE-2023-45043.md): QTS, QuTS hero (CVSS 3.8, QNAP Systems QuTS hero · QNAP Systems QTS)
- [CVE-2023-45042](https://cve.now/CVE-2023-45042.md): QTS, QuTS hero (CVSS 3.8, QNAP Systems QuTS hero · QNAP Systems QTS)
- [CVE-2023-45041](https://cve.now/CVE-2023-45041.md): QTS, QuTS hero (CVSS 3.8, QNAP Systems QuTS hero · QNAP Systems QTS)
- [CVE-2023-45040](https://cve.now/CVE-2023-45040.md): QTS, QuTS hero (CVSS 3.8, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-45039](https://cve.now/CVE-2023-45039.md): QTS, QuTS hero (CVSS 3.8, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-47219](https://cve.now/CVE-2023-47219.md): QuMagie (CVSS 3.5, QNAP Systems QuMagie)
- [CVE-2023-47559](https://cve.now/CVE-2023-47559.md): QuMagie (CVSS 5.5, QNAP Systems QuMagie)
- [CVE-2023-47560](https://cve.now/CVE-2023-47560.md): QuMagie (CVSS 7.4, QNAP Systems QuMagie)
- [CVE-2023-34322](https://cve.now/CVE-2023-34322.md): top-level shadow reference dropped too early for 64-bit PV guests (CVSS 7.8, Xen)
- [CVE-2023-34321](https://cve.now/CVE-2023-34321.md): arm32: The cache may not be properly cleaned/invalidated (CVSS 3.3, Xen)
- [CVE-2024-0246](https://cve.now/CVE-2024-0246.md): IceWarp Utility Download cross site scripting (CVSS 4.3, IceWarp)
- [CVE-2023-52124](https://cve.now/CVE-2023-52124.md): WordPress WP Tabs Plugin \<= 2.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, ShapedPlugin WP Tabs – Responsive Tabs Plugin for WordPress)
- [CVE-2023-52125](https://cve.now/CVE-2023-52125.md): WordPress iFrame Plugin \<= 4.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, webvitaly iframe)
- [CVE-2023-52126](https://cve.now/CVE-2023-52126.md): WordPress Send Users Email Plugin \<= 1.4.3 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Suman Bhattarai Send Users Email)
- [CVE-2023-52143](https://cve.now/CVE-2023-52143.md): WordPress WP Stripe Checkout Plugin \<= 1.2.2.37 is vulnerable to Sensitive Data Exposure (CVSS 7.5, Naa986 WP Stripe Checkout)
- [CVE-2023-52146](https://cve.now/CVE-2023-52146.md): WordPress 404 Solution Plugin \<= 2.33.0 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Aaron J 404 Solution)
- [CVE-2023-52148](https://cve.now/CVE-2023-52148.md): WordPress Affiliates Manager Plugin \<= 2.9.30 is vulnerable to Sensitive Data Exposure (CVSS 5.3, wp.insider, wpaffiliatemgr Affiliates Manager)
- [CVE-2023-52151](https://cve.now/CVE-2023-52151.md): WordPress Uncanny Automator Plugin \<= 5.1.0.2 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Uncanny Automator, Uncanny Owl Uncanny Automator – Automate…)
- [CVE-2022-46839](https://cve.now/CVE-2022-46839.md): WordPress JS Help Desk – Best Help Desk & Support Plugin Plugin \<= 2.7.1 is vulnerable to Arbitrary File Upload (CVSS 10.0, JS Help Desk – Best Help Desk & Support Plugin)
- [CVE-2023-51678](https://cve.now/CVE-2023-51678.md): WordPress Doofinder for WooCommerce Plugin \<= 2.0.33 is vulnerable to Broken Access Control (CVSS 4.3, Doofinder WP & WooCommerce Search)
- [CVE-2023-51535](https://cve.now/CVE-2023-51535.md): WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin \<= 6.20 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam…)
- [CVE-2023-51673](https://cve.now/CVE-2023-51673.md): WordPress Stylish Price List Plugin \<= 7.0.17 is vulnerable to Broken Access Control (CVSS 5.4, Designful Stylish Price List – Price Table Builder & QR Cod…)
- [CVE-2023-51668](https://cve.now/CVE-2023-51668.md): WordPress Inline Image Upload for BBPress Plugin \<= 1.1.18 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WP Zone Inline Image Upload for BBPress)
- [CVE-2023-51538](https://cve.now/CVE-2023-51538.md): WordPress Awesome Support Plugin \<= 6.1.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Awesome Support Team Awesome Support – WordPress HelpDesk &…)
- [CVE-2023-51539](https://cve.now/CVE-2023-51539.md): WordPress Apollo13 Framework Extensions Plugin \<= 1.9.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Apollo13Themes Apollo13 Framework Extensions)
- [CVE-2023-52119](https://cve.now/CVE-2023-52119.md): WordPress Icegram Plugin \<= 3.1.18 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Icegram Engage – WordPress Lead Generation, Popup Builder,…)
- [CVE-2023-52120](https://cve.now/CVE-2023-52120.md): WordPress NEX-Forms – Ultimate Form Builder Plugin \<= 8.5.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Basix NEX-Forms – Ultimate Form Builder – Contact forms and…)
- [CVE-2023-52121](https://cve.now/CVE-2023-52121.md): WordPress NitroPack Plugin \<= 1.10.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, NitroPack – Cache & Speed Optimization for Core Web Vitals,…)
- [CVE-2023-52122](https://cve.now/CVE-2023-52122.md): WordPress Simple Job Board Plugin \<= 2.10.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, PressTigers Simple Job Board)
- [CVE-2023-52123](https://cve.now/CVE-2023-52123.md): WordPress Strong Testimonials Plugin \<= 3.1.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WPChill Strong Testimonials)
- [CVE-2023-52127](https://cve.now/CVE-2023-52127.md): WordPress WPC Product Bundles for WooCommerce Plugin \<= 7.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WPClever WPC Product Bundles for WooCommerce)
- [CVE-2023-52128](https://cve.now/CVE-2023-52128.md): WordPress White Label Plugin \<= 2.9.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WhiteWP White Label – WordPress Custom Admin, Custom Login…)
- [CVE-2023-52129](https://cve.now/CVE-2023-52129.md): WordPress teachPress Plugin \<= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.3, Michael Winkler teachPress)
- [CVE-2023-52130](https://cve.now/CVE-2023-52130.md): WordPress Affiliates Manager Plugin \<= 2.9.31 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, wp.insider, wpaffiliatemgr Affiliates Manager)
- [CVE-2023-52136](https://cve.now/CVE-2023-52136.md): WordPress Custom Twitter Feeds (Tweets Widget) Plugin \<= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Smash Balloon Custom Twitter Feeds – A Tweets Widget or X F…)
- [CVE-2023-52145](https://cve.now/CVE-2023-52145.md): WordPress Republish Old Posts Plugin \<= 1.21 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Marios Alexandrou Republish Old Posts)
- [CVE-2023-52149](https://cve.now/CVE-2023-52149.md): WordPress Floating Button Plugin \<= 6.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Wow-Company Floating Button)
- [CVE-2023-52150](https://cve.now/CVE-2023-52150.md): WordPress Dynamic Content for Elementor Plugin \< 2.12.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 8.8, Ovation S.r.l. Dynamic Content for Elementor)
- [CVE-2023-52184](https://cve.now/CVE-2023-52184.md): WordPress WP Job Portal Plugin \<= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WP Job Portal – A Complete Job Board)
- [CVE-2023-51502](https://cve.now/CVE-2023-51502.md): WordPress WooCommerce Stripe Payment Gateway Plugin \<= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR) (CVSS 7.5, WooCommerce Stripe Payment Gateway)
- [CVE-2023-52178](https://cve.now/CVE-2023-52178.md): WordPress WP Affiliate Disclosure Plugin \<= 1.2.7 is vulnerable to Cross-Site Scripting (XSS) (CVSS 6.5, MojofyWP WP Affiliate Disclosure)
- [CVE-2023-6493](https://cve.now/CVE-2023-6493.md): Depicter Slider – Responsive Image Slider, Video Slider & Post Slider \<= 2.0.6 - Cross-Site Request Forgery via save (CVSS 4.3, averta Depicter — Popup & Slider Builder)
- [CVE-2023-41782](https://cve.now/CVE-2023-41782.md): DLL Hijacking Vulnerability in ZTE ZXCLOUD iRAI (CVSS 3.9, ZTE ZXCLOUD iRAI)
- [CVE-2023-7207](https://cve.now/CVE-2023-7207.md): Debian's cpio contains a path traversal vulnerability. (CVSS 4.9, Debian cpio)
- [CVE-2020-13878](https://cve.now/CVE-2020-13878.md): IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27ef heap-based out-of-bounds write. (CVSS 9.8)
- [CVE-2020-13879](https://cve.now/CVE-2020-13879.md): IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write. (CVSS 9.8)
- [CVE-2020-13880](https://cve.now/CVE-2020-13880.md): IrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write. (CVSS 9.8)
- [CVE-2022-36677](https://cve.now/CVE-2022-36677.md): Obsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload injected into an uploaded document. (CVSS 6.1)
- [CVE-2023-50027](https://cve.now/CVE-2023-50027.md): SQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1.0.16 and before, allows remote attackers t (CVSS 9.8)
- [CVE-2023-50991](https://cve.now/CVE-2023-50991.md): Buffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote attackers to cause a denial of service (DoS (CVSS 7.5)
- [CVE-2023-51277](https://cve.now/CVE-2023-51277.md): nbviewer-app (aka Jupyter Notebook Viewer) before 0.1.6 has the get-task-allow entitlement for release builds. (CVSS 9.8)
- [CVE-2023-52323](https://cve.now/CVE-2023-52323.md): PyCryptodome and pycryptodomex before 3.19.1 allow side-channel leakage for OAEP decryption, exploitable for a Manger attack. (CVSS 5.9, pycryptodomex · pycryptodome)
- [CVE-2024-22075](https://cve.now/CVE-2024-22075.md): Firefly III (aka firefly-iii) before 6.1.1 allows webhooks HTML Injection. (CVSS 6.1, grumpydictator/firefly-iii)
- [CVE-2024-22086](https://cve.now/CVE-2024-22086.md): handle\_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via a long URI, leading to remote code executio (CVSS 9.8)
- [CVE-2024-22087](https://cve.now/CVE-2024-22087.md): route in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer overflow via a long URI, leading to remote code e (CVSS 9.8)
- [CVE-2024-22088](https://cve.now/CVE-2024-22088.md): Lotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer\_avail() at buffer.h via a long URI, because realloc is mishand (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.