# CVEs published 2024-01-08

196 CVEs were published on January 8, 2024: 15 critical, 126 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-21663](https://cve.now/CVE-2024-21663.md): Remote code execution on ReconServer due to improper input sanitization on the prips command (CVSS 10.0, DEMON1A Discord-Recon)
- [CVE-2024-21648](https://cve.now/CVE-2024-21648.md): XWiki has no right protection on rollback action (CVSS 8.0, xwiki-platform · org.xwiki.platform:xwiki-platform-oldco… +1)
- [CVE-2024-21651](https://cve.now/CVE-2024-21651.md): XWiki Denial of Service attack through attachments (CVSS 7.5, xwiki-platform · org.xwiki.platform:xwiki-platform-distribu…)
- [CVE-2022-40696](https://cve.now/CVE-2022-40696.md): WordPress Advanced Custom Fields Plugin 3.1.1-6.0.2 is vulnerable to Sensitive Data Exposure (CVSS 3.7, WP Engine Advanced Custom Fields)
- [CVE-2022-36352](https://cve.now/CVE-2022-36352.md): WordPress ProfileGrid Plugin \<= 5.0.3 is vulnerable to Broken Access Control (CVSS 6.3, ProfileGrid – User Profiles, Memberships, Groups and Commun…)
- [CVE-2022-34344](https://cve.now/CVE-2022-34344.md): WordPress Wholesale Suite Plugin \<= 2.1.5 is vulnerable to Broken Access Control (CVSS 5.4, Rymera Web Wholesale Suite – WooCommerce Wholesale Prices,…)
- [CVE-2023-7218](https://cve.now/CVE-2023-7218.md): Totolink N350RT cstecgi.cgi loginAuth stack-based overflow (CVSS 7.2, Totolink N350RT)
- [CVE-2023-52142](https://cve.now/CVE-2023-52142.md): WordPress Events Shortcodes & Templates For The Events Calendar Plugin \<= 2.3.1 is vulnerable to SQL Injection (CVSS 7.6, Cool Plugins Events Shortcodes For The Events Calendar)
- [CVE-2023-52202](https://cve.now/CVE-2023-52202.md): WordPress HTML5 MP3 Player with Folder Feedburner Plugin \<= 2.8.0 is vulnerable to PHP Object Injection (CVSS 9.1, SVNLabs Softwares HTML5 MP3 Player with Folder Feedburner P…)
- [CVE-2022-45354](https://cve.now/CVE-2022-45354.md): WordPress Download Monitor Plugin \<= 4.7.60 is vulnerable to Sensitive Data Exposure (CVSS 5.3, WPChill Download Monitor)
- [CVE-2023-51406](https://cve.now/CVE-2023-51406.md): WordPress FastDup Plugin \<= 2.1.7 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Ninja Team FastDup – Fastest WordPress Migration & Duplicat…)
- [CVE-2023-51408](https://cve.now/CVE-2023-51408.md): WordPress WP Optin Wheel Plugin \<= 1.4.3 is vulnerable to Sensitive Data Exposure (CVSS 5.3, StudioWombat WP Optin Wheel – Gamified Optin Email Marketin…)
- [CVE-2023-52196](https://cve.now/CVE-2023-52196.md): WordPress CPT Bootstrap Carousel Plugin \<= 1.12 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Phil Ewels CPT Bootstrap Carousel)
- [CVE-2023-52197](https://cve.now/CVE-2023-52197.md): WordPress Ads Invalid Click Protection Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Impactpixel Ads Invalid Click Protection)
- [CVE-2023-52198](https://cve.now/CVE-2023-52198.md): WordPress Private Google Calendars Plugin \<= 20231125 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Michiel van Eerd Private Google Calendars)
- [CVE-2023-51490](https://cve.now/CVE-2023-51490.md): WordPress Defender Security Plugin \<= 4.1.0 is vulnerable to Sensitive Data Exposure (CVSS 5.3, WPMU DEV Defender Security – Malware Scanner, Login Securit…)
- [CVE-2023-51508](https://cve.now/CVE-2023-51508.md): WordPress Database Cleaner Plugin \<= 0.9.8 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Jordy Meow Database Cleaner: Clean, Optimize & Repair)
- [CVE-2023-52201](https://cve.now/CVE-2023-52201.md): WordPress pTypeConverter Plugin \<= 0.2.8.1 is vulnerable to SQL Injection (CVSS 7.6, Brian D. Goad pTypeConverter)
- [CVE-2023-52203](https://cve.now/CVE-2023-52203.md): WordPress CformsII Plugin \<= 15.0.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Oliver Seidel, Bastian Germann cformsII)
- [CVE-2023-52204](https://cve.now/CVE-2023-52204.md): WordPress Randomize Plugin \<= 1.4.3 is vulnerable to SQL Injection (CVSS 8.5, Javik Randomize)
- [CVE-2023-52206](https://cve.now/CVE-2023-52206.md): WordPress Page Builder: Live Composer Plugin \<= 1.5.25 is vulnerable to PHP Object Injection (CVSS 7.7, Live Composer Team Page Builder: Live Composer)
- [CVE-2023-52213](https://cve.now/CVE-2023-52213.md): WordPress Rate Star Review Plugin \<= 1.5.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, VideoWhisper Rate Star Review – AJAX Reviews for Content, w…)
- [CVE-2023-52216](https://cve.now/CVE-2023-52216.md): WordPress JS & CSS Script Optimizer Plugin \<= 0.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Yevhen Kotelnytskyi JS & CSS Script Optimizer)
- [CVE-2023-52200](https://cve.now/CVE-2023-52200.md): WordPress ARMember Plugin \<= 4.0.22 is vulnerable to Cross Site Request Forgery (CSRF) leading to PHP Object Injection (CVSS 9.6, Repute Infosystems ARMember – Membership Plugin, Content Re…)
- [CVE-2023-52205](https://cve.now/CVE-2023-52205.md): WordPress HTML5 SoundCloud Player Plugin \<= 2.8.0 is vulnerable to PHP Object Injection (CVSS 9.1, SVNLabs Softwares HTML5 SoundCloud Player with Playlist Free)
- [CVE-2023-52207](https://cve.now/CVE-2023-52207.md): WordPress HTML5 MP3 Player with Playlist Free Plugin \<= 3.0.0 is vulnerable to PHP Object Injection (CVSS 9.1, SVNLabs Softwares HTML5 MP3 Player with Playlist Free)
- [CVE-2023-6631](https://cve.now/CVE-2023-6631.md): Subnet Solutions Inc. PowerSYSTEM Center Unquoted Search Path or Element (CVSS 7.8, Subnet Solutions PowerSYSTEM Center)
- [CVE-2023-6532](https://cve.now/CVE-2023-6532.md): WP Blogs' Planetarium \<= 1.0 - Settings Update via CSRF (CVSS 8.8, WP Blogs' Planetarium)
- [CVE-2023-52190](https://cve.now/CVE-2023-52190.md): WordPress Coupon Referral Program Plugin \<= 1.7.2 is vulnerable to Sensitive Data Exposure (CVSS 7.5, WP Swings Coupon Referral Program)
- [CVE-2023-6505](https://cve.now/CVE-2023-6505.md): Prime Mover \< 1.9.3 - Directory Listing to Sensitive Data Exposure (CVSS 7.5, Migrate WordPress Website & Backups)
- [CVE-2023-6845](https://cve.now/CVE-2023-6845.md): CommentTweets \<= 0.6 - Settings Update via CSRF (CVSS 8.8, CommentTweets)
- [CVE-2023-6750](https://cve.now/CVE-2023-6750.md): Clone \< 2.4.3 - Unauthenticated Backup Download (CVSS 7.5, Clone)
- [CVE-2023-5911](https://cve.now/CVE-2023-5911.md): WP Custom Cursors \<= 3.2 - Admin+ Stored XSS (CVSS 4.8, WP Custom Cursors | WordPress Cursor Plugin)
- [CVE-2023-6140](https://cve.now/CVE-2023-6140.md): Essential Real Estate \< 4.4 - Subscriber+ Arbitrary File Upload (CVSS 8.8, Essential Real Estate)
- [CVE-2023-5235](https://cve.now/CVE-2023-5235.md): Ovic Responsive WPBakery \< 1.2.9 - Subscriber+ Option Update (CVSS 8.8, Ovic Responsive WPBakery)
- [CVE-2023-6141](https://cve.now/CVE-2023-6141.md): Essential Real Estate \< 4.4.0 - Subscriber+ Stored XSS (CVSS 5.4, Essential Real Estate)
- [CVE-2023-6528](https://cve.now/CVE-2023-6528.md): Slider Revolution \< 6.6.19 - Author+ Insecure Deserialization leading to RCE (CVSS 8.8, Slider Revolution)
- [CVE-2023-6383](https://cve.now/CVE-2023-6383.md): Debug Log Manager \< 2.3.0 - Sensitive Logs Exposure (CVSS 7.5, Debug Log Manager)
- [CVE-2018-25095](https://cve.now/CVE-2018-25095.md): Duplicator \< 1.3.0 - Unauthenticated RCE (CVSS 9.8, Duplicator)
- [CVE-2023-5957](https://cve.now/CVE-2023-5957.md): Ni Purchase Order(PO) For WooCommerce \<= 1.2.1 - Admin+ File Upload to Remote Code Execution (CVSS 7.2, Ni Purchase Order(PO) For WooCommerce)
- [CVE-2023-6139](https://cve.now/CVE-2023-6139.md): Essential Real Estate \< 4.4.0 - Subscriber+ Denial of Service via Arbitrary Option Update (CVSS 6.5, Essential Real Estate)
- [CVE-2023-6627](https://cve.now/CVE-2023-6627.md): WP Go Maps \< 9.0.28 - Unauthenticated Stored XSS (CVSS 6.1, WP Go Maps)
- [CVE-2023-6042](https://cve.now/CVE-2023-6042.md): Getwid \< 2.0.3 - Unauthenticated Arbitrary Email Sending to Admin (CVSS 7.5, Getwid)
- [CVE-2023-6161](https://cve.now/CVE-2023-6161.md): WP Crowdfunding \< 2.1.9 - Reflected XSS (CVSS 6.1, WP Crowdfunding)
- [CVE-2023-6555](https://cve.now/CVE-2023-6555.md): Email Subscription Popup \< 1.2.20 - Reflected XSS (CVSS 6.1, Email Subscription Popup)
- [CVE-2023-6529](https://cve.now/CVE-2023-6529.md): WP VR \< 8.3.15 - Unauthenticated Plugin Downgrade leading to XSS (CVSS 6.1, WP VR)
- [CVE-2023-52208](https://cve.now/CVE-2023-52208.md): WordPress Constant Contact Forms Plugin \<= 2.4.2 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Constant Contact Forms)
- [CVE-2023-52222](https://cve.now/CVE-2023-52222.md): WordPress WooCommerce Plugin \<= 8.2.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Automattic WooCommerce)
- [CVE-2021-3600](https://cve.now/CVE-2021-3600.md): It was discovered that the eBPF implementation in the Linux kernel did not properly track bounds information for 32 bit registers when perfo (CVSS 7.8, The Linux Kernel Organization linux)
- [CVE-2023-1032](https://cve.now/CVE-2023-1032.md): The Linux kernel io\_uring IORING\_OP\_SOCKET operation contained a double free in function \_\_sys\_socket\_file() in file net/socket.c. (CVSS 4.7, The Linux Kernel Organization linux)
- [CVE-2022-3328](https://cve.now/CVE-2022-3328.md): Race condition in snap-confine's must\_mkdir\_and\_open\_with\_perms() (CVSS 7.8, Canonical snapd · github.com/snapcore/snapd)
- [CVE-2022-2602](https://cve.now/CVE-2022-2602.md): io\_uring UAF, Unix SCM garbage collection (CVSS 5.3, The Linux Kernel Organization linux)
- [CVE-2022-2588](https://cve.now/CVE-2022-2588.md): It was discovered that the cls\_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before free (CVSS 5.3, The Linux Kernel Organization linux)
- [CVE-2022-2586](https://cve.now/CVE-2022-2586.md): It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that (CVSS 5.3, KEV, The Linux Kernel Organization linux)
- [CVE-2023-52215](https://cve.now/CVE-2023-52215.md): WordPress Barcode Scanner with Inventory & Order Manager Plugin \<=1.5.1 is vulnerable to SQL Injection (CVSS 9.3, UkrSolution Simple Inventory Management – just scan barcode…)
- [CVE-2022-2585](https://cve.now/CVE-2022-2585.md): It was discovered that when exec'ing from a non-leader thread, armed POSIX CPU timers would be left on a list but freed, leading to a use-af (CVSS 5.3, The Linux Kernel Organization linux)
- [CVE-2023-52218](https://cve.now/CVE-2023-52218.md): WordPress WooCommerce Tranzila Gateway Plugin \<= 1.0.8 is vulnerable to PHP Object Injection (CVSS 10.0, Anton Bond Woocommerce Tranzila Payment Gateway)
- [CVE-2023-52219](https://cve.now/CVE-2023-52219.md): WordPress Gecka Terms Thumbnails Plugin \<= 1.1 is vulnerable to PHP Object Injection (CVSS 9.9, Gecka Terms Thumbnails)
- [CVE-2023-52225](https://cve.now/CVE-2023-52225.md): WordPress Taggbox Plugin \<= 3.1 is vulnerable to PHP Object Injection (CVSS 10.0, Tagbox – UGC Galleries, Social Media Widgets, User Reviews…)
- [CVE-2024-21744](https://cve.now/CVE-2024-21744.md): WordPress Mapster WP Maps Plugin \<= 1.2.38 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Mapster Technology Mapster WP Maps)
- [CVE-2024-21745](https://cve.now/CVE-2024-21745.md): WordPress Laybuy Payment Extension for WooCommerce Plugin \<= 5.3.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Laybuy Payment Extension for WooCommerce)
- [CVE-2024-21747](https://cve.now/CVE-2024-21747.md): WordPress WP ERP Plugin \<= 1.12.8 is vulnerable to SQL Injection (CVSS 7.6, weDevs WP ERP | Complete HR solution with recruitment & job…)
- [CVE-2024-21650](https://cve.now/CVE-2024-21650.md): XWiki Remote Code Execution vulnerability via user registration (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-administ…)
- [CVE-2023-32650](https://cve.now/CVE-2023-32650.md): An integer overflow vulnerability exists in the FST\_BL\_GEOM parsing maxhandle functionality of GTKWave 3.3.115, when compiled as a 32-bit bi (CVSS 7.0, GTKWave)
- [CVE-2023-35704](https://cve.now/CVE-2023-35704.md): Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35703](https://cve.now/CVE-2023-35703.md): Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35702](https://cve.now/CVE-2023-35702.md): Multiple stack-based buffer overflow vulnerabilities exist in the FST LEB128 varint functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35958](https://cve.now/CVE-2023-35958.md): Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35957](https://cve.now/CVE-2023-35957.md): Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35956](https://cve.now/CVE-2023-35956.md): Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35955](https://cve.now/CVE-2023-35955.md): Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 VCDATA parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35964](https://cve.now/CVE-2023-35964.md): Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35963](https://cve.now/CVE-2023-35963.md): Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35962](https://cve.now/CVE-2023-35962.md): Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35961](https://cve.now/CVE-2023-35961.md): Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35960](https://cve.now/CVE-2023-35960.md): Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35959](https://cve.now/CVE-2023-35959.md): Multiple OS command injection vulnerabilities exist in the decompression functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35970](https://cve.now/CVE-2023-35970.md): Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain\_table parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35969](https://cve.now/CVE-2023-35969.md): Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 chain\_table parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35992](https://cve.now/CVE-2023-35992.md): An integer overflow vulnerability exists in the FST fstReaderIterBlocks2 vesc allocation functionality of GTKWave 3.3.115, when compiled as (CVSS 7.0, GTKWave)
- [CVE-2023-35997](https://cve.now/CVE-2023-35997.md): Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35996](https://cve.now/CVE-2023-35996.md): Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35995](https://cve.now/CVE-2023-35995.md): Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35994](https://cve.now/CVE-2023-35994.md): Multiple improper array index validation vulnerabilities exist in the fstReaderIterBlocks2 tdelta functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35128](https://cve.now/CVE-2023-35128.md): An integer overflow vulnerability exists in the fstReaderIterBlocks2 time\_table tsec\_nitems functionality of GTKWave 3.3.115. (CVSS 7.0, GTKWave)
- [CVE-2023-36747](https://cve.now/CVE-2023-36747.md): Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. (CVSS 7.0, GTKWave)
- [CVE-2023-36746](https://cve.now/CVE-2023-36746.md): Multiple heap-based buffer overflow vulnerabilities exist in the fstReaderIterBlocks2 fstWritex len functionality of GTKWave 3.3.115. (CVSS 7.0, GTKWave)
- [CVE-2023-36864](https://cve.now/CVE-2023-36864.md): An integer overflow vulnerability exists in the fstReaderIterBlocks2 temp\_signal\_value\_buf allocation functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-36916](https://cve.now/CVE-2023-36916.md): Multiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain\_table allocation functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-36915](https://cve.now/CVE-2023-36915.md): Multiple integer overflow vulnerabilities exist in the FST fstReaderIterBlocks2 chain\_table allocation functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-34087](https://cve.now/CVE-2023-34087.md): An improper array index validation vulnerability exists in the EVCD var len parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37420](https://cve.now/CVE-2023-37420.md): Multiple out-of-bounds write vulnerabilities exist in the VCD parse\_valuechange portdump functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37419](https://cve.now/CVE-2023-37419.md): Multiple out-of-bounds write vulnerabilities exist in the VCD parse\_valuechange portdump functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37418](https://cve.now/CVE-2023-37418.md): Multiple out-of-bounds write vulnerabilities exist in the VCD parse\_valuechange portdump functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37417](https://cve.now/CVE-2023-37417.md): Multiple out-of-bounds write vulnerabilities exist in the VCD parse\_valuechange portdump functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37416](https://cve.now/CVE-2023-37416.md): Multiple out-of-bounds write vulnerabilities exist in the VCD parse\_valuechange portdump functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37447](https://cve.now/CVE-2023-37447.md): Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37446](https://cve.now/CVE-2023-37446.md): Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37445](https://cve.now/CVE-2023-37445.md): Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37444](https://cve.now/CVE-2023-37444.md): Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37443](https://cve.now/CVE-2023-37443.md): Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37442](https://cve.now/CVE-2023-37442.md): Multiple out-of-bounds read vulnerabilities exist in the VCD var definition section functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37578](https://cve.now/CVE-2023-37578.md): Multiple use-after-free vulnerabilities exist in the VCD get\_vartoken realloc functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37577](https://cve.now/CVE-2023-37577.md): Multiple use-after-free vulnerabilities exist in the VCD get\_vartoken realloc functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37576](https://cve.now/CVE-2023-37576.md): Multiple use-after-free vulnerabilities exist in the VCD get\_vartoken realloc functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37575](https://cve.now/CVE-2023-37575.md): Multiple use-after-free vulnerabilities exist in the VCD get\_vartoken realloc functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37574](https://cve.now/CVE-2023-37574.md): Multiple use-after-free vulnerabilities exist in the VCD get\_vartoken realloc functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37573](https://cve.now/CVE-2023-37573.md): Multiple use-after-free vulnerabilities exist in the VCD get\_vartoken realloc functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37923](https://cve.now/CVE-2023-37923.md): Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37922](https://cve.now/CVE-2023-37922.md): Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37921](https://cve.now/CVE-2023-37921.md): Multiple arbitrary write vulnerabilities exist in the VCD sorted bsearch functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-37282](https://cve.now/CVE-2023-37282.md): An out-of-bounds write vulnerability exists in the VZT LZMA\_Read dmem extraction functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-36861](https://cve.now/CVE-2023-36861.md): An out-of-bounds write vulnerability exists in the VZT LZMA\_read\_varint functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-38623](https://cve.now/CVE-2023-38623.md): Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-38622](https://cve.now/CVE-2023-38622.md): Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-38621](https://cve.now/CVE-2023-38621.md): Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-38620](https://cve.now/CVE-2023-38620.md): Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-38619](https://cve.now/CVE-2023-38619.md): Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-38618](https://cve.now/CVE-2023-38618.md): Multiple integer overflow vulnerabilities exist in the VZT facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-38649](https://cve.now/CVE-2023-38649.md): Multiple out-of-bounds write vulnerabilities exist in the VZT vzt\_rd\_get\_facname decompression functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-38648](https://cve.now/CVE-2023-38648.md): Multiple out-of-bounds write vulnerabilities exist in the VZT vzt\_rd\_get\_facname decompression functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-38651](https://cve.now/CVE-2023-38651.md): Multiple integer overflow vulnerabilities exist in the VZT vzt\_rd\_block\_vch\_decode times parsing functionality of GTKWave 3.3.115. (CVSS 7.0, GTKWave)
- [CVE-2023-38650](https://cve.now/CVE-2023-38650.md): Multiple integer overflow vulnerabilities exist in the VZT vzt\_rd\_block\_vch\_decode times parsing functionality of GTKWave 3.3.115. (CVSS 7.0, GTKWave)
- [CVE-2023-38653](https://cve.now/CVE-2023-38653.md): Multiple integer overflow vulnerabilities exist in the VZT vzt\_rd\_block\_vch\_decode dict parsing functionality of GTKWave 3.3.115. (CVSS 7.0, GTKWave)
- [CVE-2023-38652](https://cve.now/CVE-2023-38652.md): Multiple integer overflow vulnerabilities exist in the VZT vzt\_rd\_block\_vch\_decode dict parsing functionality of GTKWave 3.3.115. (CVSS 7.0, GTKWave)
- [CVE-2023-35004](https://cve.now/CVE-2023-35004.md): An integer overflow vulnerability exists in the VZT longest\_len value allocation functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39235](https://cve.now/CVE-2023-39235.md): Multiple out-of-bounds write vulnerabilities exist in the VZT vzt\_rd\_process\_block autosort functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39234](https://cve.now/CVE-2023-39234.md): Multiple out-of-bounds write vulnerabilities exist in the VZT vzt\_rd\_process\_block autosort functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39275](https://cve.now/CVE-2023-39275.md): Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39274](https://cve.now/CVE-2023-39274.md): Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39273](https://cve.now/CVE-2023-39273.md): Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39272](https://cve.now/CVE-2023-39272.md): Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39271](https://cve.now/CVE-2023-39271.md): Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39270](https://cve.now/CVE-2023-39270.md): Multiple integer overflow vulnerabilities exist in the LXT2 facgeometry parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-34436](https://cve.now/CVE-2023-34436.md): An out-of-bounds write vulnerability exists in the LXT2 num\_time\_table\_entries functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39317](https://cve.now/CVE-2023-39317.md): Multiple integer overflow vulnerabilities exist in the LXT2 num\_dict\_entries functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39316](https://cve.now/CVE-2023-39316.md): Multiple integer overflow vulnerabilities exist in the LXT2 num\_dict\_entries functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35057](https://cve.now/CVE-2023-35057.md): An integer overflow vulnerability exists in the LXT2 lxt2\_rd\_trace value elements allocation functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-35989](https://cve.now/CVE-2023-35989.md): An integer overflow vulnerability exists in the LXT2 zlib block allocation functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-38657](https://cve.now/CVE-2023-38657.md): An out-of-bounds write vulnerability exists in the LXT2 zlib block decompression functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39414](https://cve.now/CVE-2023-39414.md): Multiple integer underflow vulnerabilities exist in the LXT2 lxt2\_rd\_iter\_radix shift operation functionality of GTKWave 3.3.115. (CVSS 7.0, GTKWave)
- [CVE-2023-39413](https://cve.now/CVE-2023-39413.md): Multiple integer underflow vulnerabilities exist in the LXT2 lxt2\_rd\_iter\_radix shift operation functionality of GTKWave 3.3.115. (CVSS 7.0, GTKWave)
- [CVE-2023-39444](https://cve.now/CVE-2023-39444.md): Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-39443](https://cve.now/CVE-2023-39443.md): Multiple out-of-bounds write vulnerabilities exist in the LXT2 parsing functionality of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-38583](https://cve.now/CVE-2023-38583.md): A stack-based buffer overflow vulnerability exists in the LXT2 lxt2\_rd\_expand\_integer\_to\_bits function of GTKWave 3.3.115. (CVSS 7.8, GTKWave)
- [CVE-2023-47211](https://cve.now/CVE-2023-47211.md): A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. (CVSS 9.1, ManageEngine OpManager)
- [CVE-2023-7224](https://cve.now/CVE-2023-7224.md): OpenVPN Connect version 3.0 through 3.4.6 on macOS allows local users to execute code in external third party libraries using the DYLD\_INSER (CVSS 7.8, OpenVPN Connect)
- [CVE-2023-51701](https://cve.now/CVE-2023-51701.md): @fastify-reply-from JSON Content-Type parsing confusion (CVSS 5.3, fastify-reply-from · @fastify/reply-from)
- [CVE-2024-21647](https://cve.now/CVE-2024-21647.md): HTTP Request/Response Smuggling in puma (CVSS 5.9, puma)
- [CVE-2024-21644](https://cve.now/CVE-2024-21644.md): pyLoad unauthenticated flask configuration leakage (CVSS 7.5, pyload · pyload-ng)
- [CVE-2024-21645](https://cve.now/CVE-2024-21645.md): pyLoad Log Injection (CVSS 5.3, pyload · pyload-ng)
- [CVE-2024-0322](https://cve.now/CVE-2024-0322.md): Out-of-bounds Read in gpac/gpac (CVSS 4.4, gpac/gpac)
- [CVE-2023-6552](https://cve.now/CVE-2023-6552.md): Open redirect in TasmoAdmin (CVSS 6.1, TasmoAdmin)
- [CVE-2024-0321](https://cve.now/CVE-2024-0321.md): Stack-based Buffer Overflow in gpac/gpac (CVSS 4.0, gpac/gpac)
- [CVE-2023-6921](https://cve.now/CVE-2023-6921.md): SQL Injection in PrestaShop Google Integrator (CVSS 9.8, PrestaShow PrestaShop Google Integrator)
- [CVE-2024-0308](https://cve.now/CVE-2024-0308.md): Inis Proxy.php server-side request forgery (CVSS 6.3, Inis)
- [CVE-2024-0307](https://cve.now/CVE-2024-0307.md): Kashipara Dynamic Lab Management System login\_process.php sql injection (CVSS 7.3, Kashipara Dynamic Lab Management System)
- [CVE-2023-5091](https://cve.now/CVE-2023-5091.md): Mali GPU Kernel Driver allows improper GPU processing operations (CVSS 7.0, Arm Valhall GPU Kernel Driver)
- [CVE-2023-41710](https://cve.now/CVE-2023-41710.md): User-defined script code could be stored for a upsell related shop URL. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2023-29052](https://cve.now/CVE-2023-29052.md): Users were able to define disclaimer texts for an upsell shop dialog that would contain script code that was not sanitized correctly. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2023-29051](https://cve.now/CVE-2023-29051.md): User-defined OXMF templates could be used to access a limited part of the internal OX App Suite Java API. (CVSS 8.1, Open-Xchange OX App Suite)
- [CVE-2024-0306](https://cve.now/CVE-2024-0306.md): Kashipara Dynamic Lab Management System admin\_login\_process.php sql injection (CVSS 7.3, Kashipara Dynamic Lab Management System)
- [CVE-2023-29050](https://cve.now/CVE-2023-29050.md): The optional "LDAP contacts provider" could be abused by privileged users to inject LDAP filter strings that allow to access content outside (CVSS 7.6, Open-Xchange OX App Suite)
- [CVE-2023-29049](https://cve.now/CVE-2023-29049.md): The "upsell" widget at the portal page could be abused to inject arbitrary script code. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2023-29048](https://cve.now/CVE-2023-29048.md): A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged run (CVSS 8.8, Open-Xchange OX App Suite)
- [CVE-2024-0305](https://cve.now/CVE-2024-0305.md): Guangzhou Yingke Electronic Technology Ncast Guest Login IPSetup.php information disclosure (CVSS 5.3, Guangzhou Yingke Electronic Technology Ncast)
- [CVE-2024-0304](https://cve.now/CVE-2024-0304.md): Youke365 collect.php server-side request forgery (CVSS 6.3, Youke365)
- [CVE-2024-0303](https://cve.now/CVE-2024-0303.md): Youke365 Parameter caiji.php server-side request forgery (CVSS 6.3, Youke365)
- [CVE-2024-0302](https://cve.now/CVE-2024-0302.md): fhs-opensource iparking vueLogin deserialization (CVSS 6.3, fhs-opensource iparking)
- [CVE-2024-0301](https://cve.now/CVE-2024-0301.md): fhs-opensource iparking PayTempOrderAction.java getData sql injection (CVSS 6.3, fhs-opensource iparking)
- [CVE-2024-0300](https://cve.now/CVE-2024-0300.md): Byzoro Smart S150 Management Platform HTTP POST Request userattestation.php unrestricted upload (CVSS 6.3, Byzoro Smart S150 Management Platform)
- [CVE-2024-0299](https://cve.now/CVE-2024-0299.md): Totolink N200RE cstecgi.cgi setTracerouteCfg os command injection (CVSS 7.3, Totolink N200RE)
- [CVE-2024-0298](https://cve.now/CVE-2024-0298.md): Totolink N200RE cstecgi.cgi setDiagnosisCfg os command injection (CVSS 7.3, Totolink N200RE)
- [CVE-2024-0297](https://cve.now/CVE-2024-0297.md): Totolink N200RE cstecgi.cgi UploadFirmwareFile os command injection (CVSS 7.3, Totolink N200RE)
- [CVE-2024-0296](https://cve.now/CVE-2024-0296.md): Totolink N200RE cstecgi.cgi NTPSyncWithHost os command injection (CVSS 7.3, Totolink N200RE)
- [CVE-2024-0295](https://cve.now/CVE-2024-0295.md): Totolink LR1200GB cstecgi.cgi setWanCfg os command injection (CVSS 7.3, Totolink LR1200GB)
- [CVE-2024-0294](https://cve.now/CVE-2024-0294.md): Totolink LR1200GB cstecgi.cgi setUssd os command injection (CVSS 7.3, Totolink LR1200GB)
- [CVE-2024-0293](https://cve.now/CVE-2024-0293.md): Totolink LR1200GB cstecgi.cgi setUploadSetting os command injection (CVSS 6.3, Totolink LR1200GB)
- [CVE-2023-47140](https://cve.now/CVE-2023-47140.md): IBM CICS Transaction Gateway improper access controls (CVSS 4.0, IBM CICS Transaction Gateway Containers)
- [CVE-2024-0292](https://cve.now/CVE-2024-0292.md): Totolink LR1200GB cstecgi.cgi setOpModeCfg os command injection (CVSS 6.3, Totolink LR1200GB)
- [CVE-2023-50948](https://cve.now/CVE-2023-50948.md): IBM Storage Fusion HCI information disclosure (CVSS 6.5, IBM Storage Fusion HCI)
- [CVE-2023-7215](https://cve.now/CVE-2023-7215.md): Chanzhaoyu chatgpt-web cross site scripting (CVSS 3.5, Chanzhaoyu chatgpt-web)
- [CVE-2024-0291](https://cve.now/CVE-2024-0291.md): Totolink LR1200GB cstecgi.cgi UploadFirmwareFile command injection (CVSS 6.3, Totolink LR1200GB)
- [CVE-2024-0290](https://cve.now/CVE-2024-0290.md): Kashipara Food Management System stock\_edit.php sql injection (CVSS 6.3, Kashipara Food Management System)
- [CVE-2024-0289](https://cve.now/CVE-2024-0289.md): Kashipara Food Management System stock\_entry\_submit.php sql injection (CVSS 6.3, Kashipara Food Management System)
- [CVE-2023-27739](https://cve.now/CVE-2023-27739.md): easyXDM 2.5 allows XSS via the xdm\_e parameter. (CVSS 6.1)
- [CVE-2023-47890](https://cve.now/CVE-2023-47890.md): pyLoad 0.5.0 is vulnerable to Unrestricted File Upload. (CVSS 8.8, pyload-ng)
- [CVE-2023-49961](https://cve.now/CVE-2023-49961.md): WALLIX Bastion 7.x, 8.x, 9.x and 10.x and WALLIX Access Manager 3.x and 4.x have Incorrect Access Control which can lead to sensitive data e (CVSS 7.5)
- [CVE-2023-50162](https://cve.now/CVE-2023-50162.md): SQL injection vulnerability in EmpireCMS v7.5, allows remote attackers to execute arbitrary code and obtain sensitive information via the Do (CVSS 7.2)
- [CVE-2023-50982](https://cve.now/CVE-2023-50982.md): Stud.IP 5.x through 5.3.3 allows XSS with resultant upload of executable files, because upload\_action and edit\_action in Admin\_SmileysContro (CVSS 9.0)
- [CVE-2023-51246](https://cve.now/CVE-2023-51246.md): A Cross Site Scripting (XSS) vulnerability in GetSimple CMS 3.3.16 exists when using Source Code Mode as a backend user to add articles via (CVSS 5.4)
- [CVE-2023-52072](https://cve.now/CVE-2023-52072.md): FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/userconfig\_updagte. (CVSS 8.8)
- [CVE-2023-52073](https://cve.now/CVE-2023-52073.md): FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /system/site/config\_footer\_updagte. (CVSS 8.8)
- [CVE-2023-52074](https://cve.now/CVE-2023-52074.md): FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component system/site/webconfig\_updagte. (CVSS 8.8)
- [CVE-2023-52271](https://cve.now/CVE-2023-52271.md): The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via a (CVSS 6.5)
- [CVE-2024-22216](https://cve.now/CVE-2024-22216.md): In default installations of Microchip maxView Storage Manager (for Adaptec Smart Storage Controllers) where Redfish server is configured for (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.