# CVEs published 2024-01-06

8 CVEs were published on January 6, 2024: 1 critical, 2 high. Days are UTC.

- [CVE-2023-51441](https://cve.now/CVE-2023-51441.md): Apache Axis 1.x (EOL) may allow SSRF when untrusted input is passed to the service admin HTTP API (CVSS 7.2, Apache Software Foundation Apache Axis · org.apache.axis… +1)
- [CVE-2023-6798](https://cve.now/CVE-2023-6798.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 4.3.2 - Missing Authorization (CVSS 5.4, themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…)
- [CVE-2023-6801](https://cve.now/CVE-2023-6801.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 4.3.2 - Authenticated (Author+) Stored Cross-Site Scripting (CVSS 6.4, themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…)
- [CVE-2023-39853](https://cve.now/CVE-2023-39853.md): SQL Injection vulnerability in Dzzoffice version 2.01, allows remote attackers to obtain sensitive information via the doobj and doevent par (CVSS 6.5)
- [CVE-2023-46953](https://cve.now/CVE-2023-46953.md): SQL Injection vulnerability in ABO.CMS v.5.9.3, allows remote attackers to execute arbitrary code via the d parameter in the Documents modul (CVSS 9.8)
- [CVE-2023-50121](https://cve.now/CVE-2023-50121.md): Autel EVO NANO drone flight control firmware version 1.6.5 is vulnerable to denial of service (DoS). (CVSS 5.7)
- [CVE-2023-50609](https://cve.now/CVE-2023-50609.md): Cross Site Scripting (XSS) vulnerability in AVA teaching video application service platform version 3.1, allows remote attackers to execute (CVSS 6.1)
- [CVE-2023-50612](https://cve.now/CVE-2023-50612.md): Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain s (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.