CVEs published January 9, 2024
159 CVEs were published on January 9, 2024: 18 critical, 71 high. 1 is now in CISA KEV.
- Published
- 159
- Critical
- 18
- High
- 71
- Medium
- 62
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 73
Most affected products
- Microsoft Windows
- 30
- Siemens Solid Edge SE2023
- 11
- AMI MegaRAC_SPx
- 8
- SourceCodester Engineers Online Portal
- 5
- Siemens JT2Go · Siemens Teamcenter Visualization
- 4
- Microsoft Windows Server · Microsoft Windows
- 3
- Siemens SIMATIC CN
- 3
- TianoCore edk2
- 3
- CodeAstro Vehicle Booking System
- 2
- Inis
- 2
Critical 18
- CVE-2023-37293stack-based buffer overflow AMI MegaRAC_SPx
- CVE-2023-3043Stack-based Buffer Overflow BMCAMI MegaRAC_SPx
- CVE-2024-0057NET, .NET Framework, and Visual Studio Security Feature Bypass VulnerabilityMicrosoft .NET · Microsoft Visual Studio +4
- CVE-2023-7221Totolink T6 HTTP POST Request main buffer overflowTotolink T6
- CVE-2023-51438A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager < V4.14.00.26068 on Windows), SIMATIC IPCSiemens SIMATIC IPC1047E · Siemens SIMATIC IPC647E +1
- CVE-2023-49621A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7).Siemens SIMATIC CN
- CVE-2023-5347Unauthenticated Firmware UpgradeKorenix JetNet Series
- CVE-2023-7220Totolink NR1800X cstecgi.cgi loginAuth stack-based overflowTotolink NR1800X
- CVE-2023-39336An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the intIvanti Endpoint Manager
- CVE-2024-21646Azure IoT Platform Device SDK Remote Code Execution Vulnerabilityazure-uamqp-c
- CVE-2023-26999An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted
- CVE-2023-49235An issue was discovered in libremote_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices.
- CVE-2023-49236A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution.
- CVE-2023-49237An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices.
- CVE-2023-49238In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) b
- CVE-2023-50585Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function.
- CVE-2023-50643An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnsp
- CVE-2023-51717Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass.
High 71
- CVE-2024-0352Likeshop HTTP POST Request File.php userFormImage unrestricted uploadLikeshop
- CVE-2023-37297heap memory overflow AMI MegaRAC_SPx
- CVE-2023-37296Stack-based Buffer OverflowAMI MegaRAC_SPx
- CVE-2023-37295Heap-based Buffer OverflowAMI MegaRAC_SPx
- CVE-2023-37294Heap-based Buffer OverflowAMI MegaRAC_SPx
- CVE-2023-34333Untrusted Pointer Dereference AMI MegaRAC_SPx
- CVE-2023-34332Untrusted Pointer Dereference in BMCAMI MegaRAC_SPx
- CVE-2023-7032 A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain Schneider Electric Easergy Studio
- CVE-2022-48618The issue was addressed with improved checks.Apple tvOS · Apple macOS +2
- CVE-2024-21318Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2024-21312.NET Framework Denial of Service VulnerabilityMicrosoft .NET Framework 3.5 AND · Microsoft .NET Framework
- CVE-2024-21310Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-21309Windows Kernel-Mode Driver Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-20687Microsoft AllJoyn API Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-20686Win32k Elevation of Privilege VulnerabilityMicrosoft Windows Server 2022, 23H2 Edition
- CVE-2024-20681Windows Subsystem for Linux Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-20661Microsoft Message Queuing (MSMQ) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-20656Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2024-20653Microsoft Common Log File System Elevation of Privilege VulnerabilityMicrosoft Windows Server 2022, 23H2 Edition · Microsoft Win…
- CVE-2024-20652Windows HTML Platforms Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-0056Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass VulnerabilityMicrosoft SQL Server · Microsoft .NET +4
- CVE-2024-20672.NET Denial of Service VulnerabilityMicrosoft .NET
- CVE-2024-21325Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution VulnerabilityMicrosoft Printer Metadata Troubleshooter Tool
- CVE-2024-21307Remote Desktop Client Remote Code Execution VulnerabilityMicrosoft Windows · Microsoft Remote Desktop client for Win…
- CVE-2024-20700Windows Hyper-V Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-20698Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-20697Windows libarchive Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-20696Windows libarchive Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-20683Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-20682Windows Cryptographic Services Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-20658Microsoft Virtual Hard Disk Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-20657Windows Group Policy Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2024-20654Microsoft ODBC Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2024-20676Azure Storage Mover Remote Code Execution VulnerabilityMicrosoft Azure Storage Mover
- CVE-2024-20677Microsoft Office Remote Code Execution VulnerabilityMicrosoft 3D Viewer · Microsoft Office +1
- CVE-2024-20674Windows Kerberos Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2022-36765Integer Overflow in CreateHobTianoCore edk2
- CVE-2022-36764Heap Buffer Overflow in Tcg2MeasurePeImageTianoCore edk2
- CVE-2022-36763Heap Buffer Overflow in Tcg2MeasureGptTableTianoCore edk2
- CVE-2023-7222Totolink X2000R HTTP POST Request boa formTmultiAP buffer overflowTotolink X2000R
- CVE-2024-0213 A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause Trellix Agent
- CVE-2024-0206 A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local uTrellix Anti-Malware Engine
- CVE-2023-51746A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2023-51745A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2023-51439A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2023-49252A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7).Siemens SIMATIC CN
- CVE-2023-49251A vulnerability has been identified in SIMATIC CN 4100 (All versions < V2.7).Siemens SIMATIC CN
- CVE-2023-49132A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).Siemens Solid Edge SE2023
- CVE-2023-49131A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).Siemens Solid Edge SE2023
- CVE-2023-49130A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).Siemens Solid Edge SE2023
- CVE-2023-49129A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).Siemens Solid Edge SE2023
- CVE-2023-49128A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).Siemens Solid Edge SE2023
- CVE-2023-49127A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).Siemens Solid Edge SE2023
- CVE-2023-49126A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).Siemens Solid Edge SE2023
- CVE-2023-49124A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).Siemens Solid Edge SE2023
- CVE-2023-49123A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).Siemens Solid Edge SE2023
- CVE-2023-49122A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).Siemens Solid Edge SE2023
- CVE-2023-49121A vulnerability has been identified in Solid Edge SE2023 (All versions < V223.0 Update 10).Siemens Solid Edge SE2023
- CVE-2023-44120A vulnerability has been identified in Spectrum Power 7 (All versions < V23Q4).Siemens Spectrum Power
- CVE-2023-49722Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an attacker to connect to the device via same WiFi netwBosch BCC101 · Bosch BCC102 +1
- CVE-2023-5376TFTP Without AuthenticationKorenix JetNet Series
- CVE-2023-7219Totolink N350RT cstecgi.cgi loginAuth stack-based overflowTotolink N350RT
- CVE-2024-22125Information Disclosure vulnerability in Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge)SAP_SE Microsoft Edge browser extension
- CVE-2024-21737Code Injection vulnerability in SAP Application Interface Framework (File Adapter)SAP_SE SAP Application Interface Framework
- CVE-2024-21735Improper Authorization check in SAP LT Replication ServerSAP_SE SAP LT Replication Server
- CVE-2023-27098TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel.
- CVE-2023-47992An integer overflow vulnerability in FreeImageIO.cpp::_MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information,
- CVE-2023-47994An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive in
- CVE-2023-50930An issue was discovered in savignano S/Notify before 4.0.2 for Jira.
- CVE-2023-50931An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket.
- CVE-2023-50932An issue was discovered in savignano S/Notify before 4.0.2 for Confluence.
Medium, low and unrated 70
- CVE-2024-0355PHPGurukul Dairy Farm Shop Management System add-category.php sql injectionPHPGurukul Dairy Farm Shop Management System
- CVE-2024-0354unknown-o download-station index.php path traversalunknown-o download-station
- CVE-2024-0351SourceCodester Engineers Online Portal session fixiationSourceCodester Engineers Online Portal
- CVE-2024-0350SourceCodester Engineers Online Portal session expirationSourceCodester Engineers Online Portal
- CVE-2024-0349SourceCodester Engineers Online Portal missing secure attributeSourceCodester Engineers Online Portal
- CVE-2023-5770HTML injection in email body through email subjectProofpoint Enterprise Protection
- CVE-2024-0348SourceCodester Engineers Online Portal File Upload resource consumptionSourceCodester Engineers Online Portal
- CVE-2023-6476Cri-o: pods are able to break out of resource confinement on cgroupv2Red Hat OpenShift Container Platform · github.com/cri-o/cri…
- CVE-2024-0347SourceCodester Engineers Online Portal signup_teacher.php weak passwordSourceCodester Engineers Online Portal
- CVE-2024-0346CodeAstro Vehicle Booking System Feedback Page user-give-feedback.php cross site scriptingCodeAstro Vehicle Booking System
- CVE-2024-0345CodeAstro Vehicle Booking System User Registration usr-register.php cross site scriptingCodeAstro Vehicle Booking System
- CVE-2024-0344soxft TimeMail check.php sql injectionsoxft TimeMail
- CVE-2024-0343CodeAstro Simple House Rental System Login Panel cross site scriptingCodeAstro Simple House Rental System
- CVE-2024-0342Inis Sqlite.php sql injectionInis
- CVE-2024-21664Parsing JSON serialized payload without protected field can lead to segfaultlestrrat-go jwx · github.com/lestrrat-go/jwx +1
- CVE-2024-21668Insertion of Sensitive Information into Log File in react-native-mmkvmrousavy react-native-mmkv · react-native-mmkv
- CVE-2024-21319Microsoft Identity Denial of service vulnerabilityMicrosoft .NET · Microsoft Visual Studio +5
- CVE-2024-0341Inis GET Request File.php path traversalInis
- CVE-2024-21320Windows Themes Spoofing VulnerabilityMicrosoft Windows
- CVE-2024-21314Microsoft Message Queuing Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-21311Windows Cryptographic Services Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-21306Microsoft Bluetooth Driver Spoofing VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2024-20692Microsoft Local Security Authority Subsystem Service Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-21316Windows Server Key Distribution Service Security Feature BypassMicrosoft Windows
- CVE-2024-20664Microsoft Message Queuing Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-20663Windows Message Queuing Client (MSMQC) Information DisclosureMicrosoft Windows
- CVE-2024-20662Windows Online Certificate Status Protocol (OCSP) Information Disclosure VulnerabilityMicrosoft Windows Server
- CVE-2024-20660Microsoft Message Queuing Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-20655Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2024-21313Windows TCP/IP Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-21305Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-20699Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2024-20694Windows CoreMessaging Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-20691Windows Themes Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2024-20690Windows Nearby Sharing Spoofing VulnerabilityMicrosoft Windows
- CVE-2024-20680Windows Message Queuing Client (MSMQC) Information DisclosureMicrosoft Windows
- CVE-2024-20666BitLocker Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2024-0226Stored Cross-Site Scripting in Synopsys SeekerSynopsys Seeker
- CVE-2024-0340Kernel: information disclosure in vhost/vhost.c:vhost_new_msg()kernel · Red Hat Enterprise Linux
- CVE-2024-22164Denial of Service of an Investigation in Splunk Enterprise Security through Investigation attachmentsSplunk Enterprise Security
- CVE-2024-22165Denial of Service in Splunk Enterprise Security of the Investigations manager through Investigation creationSplunk Enterprise Security
- CVE-2023-6129POLY1305 MAC implementation corrupts vector registers on PowerPCOpenSSL
- CVE-2023-7223Totolink T6 cstecgi.cgi access controlTotolink T6
- CVE-2023-51744A vulnerability has been identified in JT2Go (All versions < V14.3.0.6), Teamcenter Visualization V13.3 (All versions < V13.3.0.13), TeamcenSiemens JT2Go · Siemens Teamcenter Visualization
- CVE-2023-42797A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05.20), CP-8050 MASTER MODULE (All versions < CPCI85 V0Siemens CP-8031 MASTER MODULE · Siemens CP-8050 MASTER MODU…
- CVE-2024-22370In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possibleJetBrains YouTrack
- CVE-2023-6149Possible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security Qualys Web App Scanning Connector Jenkins Plugin · com.qual…
- CVE-2023-6148Possible XSS vulnerability in Jenkins Plugin for Qualys Policy ComplianceQualys Policy Compliance Connector Jenkins Plugin · com.qua…
- CVE-2023-6147Possible XXE vulnerability in Jenkins Plugin for Qualys Policy ComplianceQualys Policy Compliance Connector Jenkins Plugin · com.qua…
- CVE-2023-6830Formidable Forms <= 6.7 - HTML Injectionstrategy11team Formidable Forms – Contact Form Plugin, Surv…
- CVE-2023-6842Formidable Forms <= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scriptingstrategy11team Formidable Forms – Contact Form Plugin, Surv…
- CVE-2023-6788Metform Elementor Contact Form Builder <= 3.8.1 - Cross-Site Request Forgeryroxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-6594WordPress Button Plugin MaxButtons <= 9.7.4 - Authenticated (Administrator+) Stored Cross-Site Scriptingmaxfoundry MaxButtons – Create buttons
- CVE-2024-22124Information Disclosure vulnerability in SAP NetWeaver Internet Communication ManagerSAP_SE SAP NetWeaver
- CVE-2024-21738Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP PlatformSAP_SE SAP NetWeaver ABAP Application Server and ABAP Platf…
- CVE-2024-21736Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management)SAP_SE SAP S/4HANA Finance
- CVE-2024-21734URL Redirection vulnerability in SAP Marketing (Contacts App)SAP_SE SAP Marketing
- CVE-2022-28975A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML v
- CVE-2023-26998Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator pa
- CVE-2023-27000Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the name param
- CVE-2023-36629The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read.
- CVE-2023-38827Cross Site Scripting vulnerability in Follet School Solutions Destiny v.20_0_1_AU4 and later allows a remote attacker to run arbitrary code
- CVE-2023-46906juzaweb <= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code.juzaweb/cms
- CVE-2023-47993A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32 in FreeImage 3.18.0 allows attackers to cause a denial-of-service.
- CVE-2023-47995Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 allows attackers to
- CVE-2023-47996An integer overflow vulnerability in Exif.cpp::jpeg_read_exif_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a den
- CVE-2023-47997An issue discovered in BitmapAccess.cpp::FreeImage_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to caus
- CVE-2023-50136Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new cu
- CVE-2023-50974In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json fileappwrite-cli · appwrite
- CVE-2024-22368The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document.