# CVEs published 2024-01-09

159 CVEs were published on January 9, 2024: 18 critical, 71 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-0355](https://cve.now/CVE-2024-0355.md): PHPGurukul Dairy Farm Shop Management System add-category.php sql injection (CVSS 5.5, PHPGurukul Dairy Farm Shop Management System)
- [CVE-2024-0354](https://cve.now/CVE-2024-0354.md): unknown-o download-station index.php path traversal (CVSS 5.3, unknown-o download-station)
- [CVE-2024-0352](https://cve.now/CVE-2024-0352.md): Likeshop HTTP POST Request File.php userFormImage unrestricted upload (CVSS 7.3, Likeshop)
- [CVE-2024-0351](https://cve.now/CVE-2024-0351.md): SourceCodester Engineers Online Portal session fixiation (CVSS 3.1, SourceCodester Engineers Online Portal)
- [CVE-2024-0350](https://cve.now/CVE-2024-0350.md): SourceCodester Engineers Online Portal session expiration (CVSS 3.1, SourceCodester Engineers Online Portal)
- [CVE-2024-0349](https://cve.now/CVE-2024-0349.md): SourceCodester Engineers Online Portal missing secure attribute (CVSS 3.7, SourceCodester Engineers Online Portal)
- [CVE-2023-37297](https://cve.now/CVE-2023-37297.md): heap memory overflow (CVSS 8.3, AMI MegaRAC\_SPx)
- [CVE-2023-37296](https://cve.now/CVE-2023-37296.md): Stack-based Buffer Overflow (CVSS 8.3, AMI MegaRAC\_SPx)
- [CVE-2023-37295](https://cve.now/CVE-2023-37295.md): Heap-based Buffer Overflow (CVSS 8.3, AMI MegaRAC\_SPx)
- [CVE-2023-37294](https://cve.now/CVE-2023-37294.md): Heap-based Buffer Overflow (CVSS 8.3, AMI MegaRAC\_SPx)
- [CVE-2023-37293](https://cve.now/CVE-2023-37293.md): stack-based buffer overflow (CVSS 9.6, AMI MegaRAC\_SPx)
- [CVE-2023-34333](https://cve.now/CVE-2023-34333.md): Untrusted Pointer Dereference (CVSS 7.8, AMI MegaRAC\_SPx)
- [CVE-2023-3043](https://cve.now/CVE-2023-3043.md): Stack-based Buffer Overflow BMC (CVSS 9.6, AMI MegaRAC\_SPx)
- [CVE-2023-34332](https://cve.now/CVE-2023-34332.md): Untrusted Pointer Dereference in BMC (CVSS 7.8, AMI MegaRAC\_SPx)
- [CVE-2023-5770](https://cve.now/CVE-2023-5770.md): HTML injection in email body through email subject (CVSS 5.3, Proofpoint Enterprise Protection)
- [CVE-2024-0348](https://cve.now/CVE-2024-0348.md): SourceCodester Engineers Online Portal File Upload resource consumption (CVSS 4.3, SourceCodester Engineers Online Portal)
- [CVE-2023-6476](https://cve.now/CVE-2023-6476.md): Cri-o: pods are able to break out of resource confinement on cgroupv2 (CVSS 6.5, Red Hat OpenShift Container Platform · github.com/cri-o/cri…)
- [CVE-2024-0347](https://cve.now/CVE-2024-0347.md): SourceCodester Engineers Online Portal signup\_teacher.php weak password (CVSS 3.7, SourceCodester Engineers Online Portal)
- [CVE-2024-0346](https://cve.now/CVE-2024-0346.md): CodeAstro Vehicle Booking System Feedback Page user-give-feedback.php cross site scripting (CVSS 3.5, CodeAstro Vehicle Booking System)
- [CVE-2024-0345](https://cve.now/CVE-2024-0345.md): CodeAstro Vehicle Booking System User Registration usr-register.php cross site scripting (CVSS 4.3, CodeAstro Vehicle Booking System)
- [CVE-2024-0344](https://cve.now/CVE-2024-0344.md): soxft TimeMail check.php sql injection (CVSS 5.5, soxft TimeMail)
- [CVE-2024-0343](https://cve.now/CVE-2024-0343.md): CodeAstro Simple House Rental System Login Panel cross site scripting (CVSS 4.3, CodeAstro Simple House Rental System)
- [CVE-2024-0342](https://cve.now/CVE-2024-0342.md): Inis Sqlite.php sql injection (CVSS 6.3, Inis)
- [CVE-2023-7032](https://cve.now/CVE-2023-7032.md): A CWE-502: Deserialization of untrusted data vulnerability exists that could allow an attacker logged in with a user level account to gain (CVSS 7.8, Schneider Electric Easergy Studio)
- [CVE-2024-21664](https://cve.now/CVE-2024-21664.md): Parsing JSON serialized payload without protected field can lead to segfault (CVSS 4.3, lestrrat-go jwx · github.com/lestrrat-go/jwx +1)
- [CVE-2024-21668](https://cve.now/CVE-2024-21668.md): Insertion of Sensitive Information into Log File in react-native-mmkv (CVSS 4.4, mrousavy react-native-mmkv · react-native-mmkv)
- [CVE-2024-21319](https://cve.now/CVE-2024-21319.md): Microsoft Identity Denial of service vulnerability (CVSS 6.8, Microsoft .NET · Microsoft Visual Studio +5)
- [CVE-2024-0341](https://cve.now/CVE-2024-0341.md): Inis GET Request File.php path traversal (CVSS 3.5, Inis)
- [CVE-2022-48618](https://cve.now/CVE-2022-48618.md): The issue was addressed with improved checks. (CVSS 7.0, KEV, Apple tvOS · Apple macOS +2)
- [CVE-2024-21320](https://cve.now/CVE-2024-21320.md): Windows Themes Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-21318](https://cve.now/CVE-2024-21318.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-21314](https://cve.now/CVE-2024-21314.md): Microsoft Message Queuing Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-21312](https://cve.now/CVE-2024-21312.md): .NET Framework Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET Framework 3.5 AND · Microsoft .NET Framework)
- [CVE-2024-21311](https://cve.now/CVE-2024-21311.md): Windows Cryptographic Services Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-21310](https://cve.now/CVE-2024-21310.md): Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-21309](https://cve.now/CVE-2024-21309.md): Windows Kernel-Mode Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-21306](https://cve.now/CVE-2024-21306.md): Microsoft Bluetooth Driver Spoofing Vulnerability (CVSS 5.7, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-20692](https://cve.now/CVE-2024-20692.md): Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2024-20687](https://cve.now/CVE-2024-20687.md): Microsoft AllJoyn API Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-20686](https://cve.now/CVE-2024-20686.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server 2022, 23H2 Edition)
- [CVE-2024-20681](https://cve.now/CVE-2024-20681.md): Windows Subsystem for Linux Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-21316](https://cve.now/CVE-2024-21316.md): Windows Server Key Distribution Service Security Feature Bypass (CVSS 6.1, Microsoft Windows)
- [CVE-2024-20664](https://cve.now/CVE-2024-20664.md): Microsoft Message Queuing Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-20663](https://cve.now/CVE-2024-20663.md): Windows Message Queuing Client (MSMQC) Information Disclosure (CVSS 6.5, Microsoft Windows)
- [CVE-2024-20662](https://cve.now/CVE-2024-20662.md): Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability (CVSS 4.9, Microsoft Windows Server)
- [CVE-2024-20661](https://cve.now/CVE-2024-20661.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-20660](https://cve.now/CVE-2024-20660.md): Microsoft Message Queuing Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-20656](https://cve.now/CVE-2024-20656.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Visual Studio)
- [CVE-2024-20655](https://cve.now/CVE-2024-20655.md): Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server)
- [CVE-2024-20653](https://cve.now/CVE-2024-20653.md): Microsoft Common Log File System Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server 2022, 23H2 Edition · Microsoft Win…)
- [CVE-2024-20652](https://cve.now/CVE-2024-20652.md): Windows HTML Platforms Security Feature Bypass Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-0057](https://cve.now/CVE-2024-0057.md): NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability (CVSS 9.1, Microsoft .NET · Microsoft Visual Studio +4)
- [CVE-2024-0056](https://cve.now/CVE-2024-0056.md): Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability (CVSS 8.7, Microsoft SQL Server · Microsoft .NET +4)
- [CVE-2024-20672](https://cve.now/CVE-2024-20672.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET)
- [CVE-2024-21325](https://cve.now/CVE-2024-21325.md): Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Printer Metadata Troubleshooter Tool)
- [CVE-2024-21313](https://cve.now/CVE-2024-21313.md): Windows TCP/IP Information Disclosure Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2024-21307](https://cve.now/CVE-2024-21307.md): Remote Desktop Client Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows · Microsoft Remote Desktop client for Win…)
- [CVE-2024-21305](https://cve.now/CVE-2024-21305.md): Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability (CVSS 4.4, Microsoft Windows)
- [CVE-2024-20700](https://cve.now/CVE-2024-20700.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-20699](https://cve.now/CVE-2024-20699.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-20698](https://cve.now/CVE-2024-20698.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-20697](https://cve.now/CVE-2024-20697.md): Windows libarchive Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2024-20696](https://cve.now/CVE-2024-20696.md): Windows libarchive Remote Code Execution Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2024-20694](https://cve.now/CVE-2024-20694.md): Windows CoreMessaging Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-20691](https://cve.now/CVE-2024-20691.md): Windows Themes Information Disclosure Vulnerability (CVSS 4.7, Microsoft Windows)
- [CVE-2024-20690](https://cve.now/CVE-2024-20690.md): Windows Nearby Sharing Spoofing Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-20683](https://cve.now/CVE-2024-20683.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-20682](https://cve.now/CVE-2024-20682.md): Windows Cryptographic Services Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-20680](https://cve.now/CVE-2024-20680.md): Windows Message Queuing Client (MSMQC) Information Disclosure (CVSS 6.5, Microsoft Windows)
- [CVE-2024-20658](https://cve.now/CVE-2024-20658.md): Microsoft Virtual Hard Disk Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-20657](https://cve.now/CVE-2024-20657.md): Windows Group Policy Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-20654](https://cve.now/CVE-2024-20654.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Windows)
- [CVE-2024-20676](https://cve.now/CVE-2024-20676.md): Azure Storage Mover Remote Code Execution Vulnerability (CVSS 8.0, Microsoft Azure Storage Mover)
- [CVE-2024-20677](https://cve.now/CVE-2024-20677.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Viewer · Microsoft Office +1)
- [CVE-2024-20674](https://cve.now/CVE-2024-20674.md): Windows Kerberos Security Feature Bypass Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-20666](https://cve.now/CVE-2024-20666.md): BitLocker Security Feature Bypass Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2024-0226](https://cve.now/CVE-2024-0226.md): Stored Cross-Site Scripting in Synopsys Seeker (CVSS 4.8, Synopsys Seeker)
- [CVE-2024-0340](https://cve.now/CVE-2024-0340.md): Kernel: information disclosure in vhost/vhost.c:vhost\_new\_msg() (CVSS 4.4, kernel · Red Hat Enterprise Linux)
- [CVE-2024-22164](https://cve.now/CVE-2024-22164.md): Denial of Service of an Investigation in Splunk Enterprise Security through Investigation attachments (CVSS 4.3, Splunk Enterprise Security)
- [CVE-2024-22165](https://cve.now/CVE-2024-22165.md): Denial of Service in Splunk Enterprise Security of the Investigations manager through Investigation creation (CVSS 6.5, Splunk Enterprise Security)
- [CVE-2023-6129](https://cve.now/CVE-2023-6129.md): POLY1305 MAC implementation corrupts vector registers on PowerPC (CVSS 6.5, OpenSSL)
- [CVE-2022-36765](https://cve.now/CVE-2022-36765.md): Integer Overflow in CreateHob (CVSS 7.0, TianoCore edk2)
- [CVE-2022-36764](https://cve.now/CVE-2022-36764.md): Heap Buffer Overflow in Tcg2MeasurePeImage (CVSS 7.0, TianoCore edk2)
- [CVE-2022-36763](https://cve.now/CVE-2022-36763.md): Heap Buffer Overflow in Tcg2MeasureGptTable (CVSS 7.0, TianoCore edk2)
- [CVE-2023-7223](https://cve.now/CVE-2023-7223.md): Totolink T6 cstecgi.cgi access control (CVSS 5.3, Totolink T6)
- [CVE-2023-7222](https://cve.now/CVE-2023-7222.md): Totolink X2000R HTTP POST Request boa formTmultiAP buffer overflow (CVSS 7.2, Totolink X2000R)
- [CVE-2023-7221](https://cve.now/CVE-2023-7221.md): Totolink T6 HTTP POST Request main buffer overflow (CVSS 9.8, Totolink T6)
- [CVE-2024-0213](https://cve.now/CVE-2024-0213.md): A buffer overflow vulnerability in TA for Linux and TA for MacOS prior to 5.8.1 allows a local user to gain elevated permissions, or cause (CVSS 8.2, Trellix Agent)
- [CVE-2024-0206](https://cve.now/CVE-2024-0206.md): A symbolic link manipulation vulnerability in Trellix Anti-Malware Engine prior to the January 2024 release allows an authenticated local u (CVSS 7.1, Trellix Anti-Malware Engine)
- [CVE-2023-51746](https://cve.now/CVE-2023-51746.md): A vulnerability has been identified in JT2Go (All versions \< V14.3.0.6), Teamcenter Visualization V13.3 (All versions \< V13.3.0.13), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2023-51745](https://cve.now/CVE-2023-51745.md): A vulnerability has been identified in JT2Go (All versions \< V14.3.0.6), Teamcenter Visualization V13.3 (All versions \< V13.3.0.13), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2023-51744](https://cve.now/CVE-2023-51744.md): A vulnerability has been identified in JT2Go (All versions \< V14.3.0.6), Teamcenter Visualization V13.3 (All versions \< V13.3.0.13), Teamcen (CVSS 3.3, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2023-51439](https://cve.now/CVE-2023-51439.md): A vulnerability has been identified in JT2Go (All versions \< V14.3.0.6), Teamcenter Visualization V13.3 (All versions \< V13.3.0.13), Teamcen (CVSS 7.8, Siemens JT2Go · Siemens Teamcenter Visualization)
- [CVE-2023-51438](https://cve.now/CVE-2023-51438.md): A vulnerability has been identified in SIMATIC IPC1047E (All versions with maxView Storage Manager \< V4.14.00.26068 on Windows), SIMATIC IPC (CVSS 10.0, Siemens SIMATIC IPC1047E · Siemens SIMATIC IPC647E +1)
- [CVE-2023-49621](https://cve.now/CVE-2023-49621.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V2.7). (CVSS 9.8, Siemens SIMATIC CN)
- [CVE-2023-49252](https://cve.now/CVE-2023-49252.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V2.7). (CVSS 7.5, Siemens SIMATIC CN)
- [CVE-2023-49251](https://cve.now/CVE-2023-49251.md): A vulnerability has been identified in SIMATIC CN 4100 (All versions \< V2.7). (CVSS 8.8, Siemens SIMATIC CN)
- [CVE-2023-49132](https://cve.now/CVE-2023-49132.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-49131](https://cve.now/CVE-2023-49131.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-49130](https://cve.now/CVE-2023-49130.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-49129](https://cve.now/CVE-2023-49129.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-49128](https://cve.now/CVE-2023-49128.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-49127](https://cve.now/CVE-2023-49127.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-49126](https://cve.now/CVE-2023-49126.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-49124](https://cve.now/CVE-2023-49124.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-49123](https://cve.now/CVE-2023-49123.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-49122](https://cve.now/CVE-2023-49122.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-49121](https://cve.now/CVE-2023-49121.md): A vulnerability has been identified in Solid Edge SE2023 (All versions \< V223.0 Update 10). (CVSS 7.8, Siemens Solid Edge SE2023)
- [CVE-2023-44120](https://cve.now/CVE-2023-44120.md): A vulnerability has been identified in Spectrum Power 7 (All versions \< V23Q4). (CVSS 7.8, Siemens Spectrum Power)
- [CVE-2023-42797](https://cve.now/CVE-2023-42797.md): A vulnerability has been identified in CP-8031 MASTER MODULE (All versions \< CPCI85 V05.20), CP-8050 MASTER MODULE (All versions \< CPCI85 V0 (CVSS 6.6, Siemens CP-8031 MASTER MODULE · Siemens CP-8050 MASTER MODU…)
- [CVE-2023-5347](https://cve.now/CVE-2023-5347.md): Unauthenticated Firmware Upgrade (CVSS 9.8, Korenix JetNet Series)
- [CVE-2023-49722](https://cve.now/CVE-2023-49722.md): Network port 8899 open in WiFi firmware of BCC101/BCC102/BCC50 products, that allows an attacker to connect to the device via same WiFi netw (CVSS 8.3, Bosch BCC101 · Bosch BCC102 +1)
- [CVE-2024-22370](https://cve.now/CVE-2024-22370.md): In JetBrains YouTrack before 2023.3.22666 stored XSS via markdown was possible (CVSS 4.6, JetBrains YouTrack)
- [CVE-2023-5376](https://cve.now/CVE-2023-5376.md): TFTP Without Authentication (CVSS 8.6, Korenix JetNet Series)
- [CVE-2023-6149](https://cve.now/CVE-2023-6149.md): Possible XXE vulnerability in Jenkins Plugin for Qualys Web Application Security (CVSS 5.7, Qualys Web App Scanning Connector Jenkins Plugin · com.qual…)
- [CVE-2023-6148](https://cve.now/CVE-2023-6148.md): Possible XSS vulnerability in Jenkins Plugin for Qualys Policy Compliance (CVSS 5.7, Qualys Policy Compliance Connector Jenkins Plugin · com.qua…)
- [CVE-2023-6147](https://cve.now/CVE-2023-6147.md): Possible XXE vulnerability in Jenkins Plugin for Qualys Policy Compliance (CVSS 5.7, Qualys Policy Compliance Connector Jenkins Plugin · com.qua…)
- [CVE-2023-7220](https://cve.now/CVE-2023-7220.md): Totolink NR1800X cstecgi.cgi loginAuth stack-based overflow (CVSS 9.8, Totolink NR1800X)
- [CVE-2023-6830](https://cve.now/CVE-2023-6830.md): Formidable Forms \<= 6.7 - HTML Injection (CVSS 6.5, strategy11team Formidable Forms – Contact Form Plugin, Surv…)
- [CVE-2023-6842](https://cve.now/CVE-2023-6842.md): Formidable Forms \<= 6.7 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, strategy11team Formidable Forms – Contact Form Plugin, Surv…)
- [CVE-2023-7219](https://cve.now/CVE-2023-7219.md): Totolink N350RT cstecgi.cgi loginAuth stack-based overflow (CVSS 7.2, Totolink N350RT)
- [CVE-2023-6788](https://cve.now/CVE-2023-6788.md): Metform Elementor Contact Form Builder \<= 3.8.1 - Cross-Site Request Forgery (CVSS 5.4, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-6594](https://cve.now/CVE-2023-6594.md): WordPress Button Plugin MaxButtons \<= 9.7.4 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, maxfoundry MaxButtons – Create buttons)
- [CVE-2023-39336](https://cve.now/CVE-2023-39336.md): An unspecified SQL Injection vulnerability in Ivanti Endpoint Manager released prior to 2022 SU 5 allows an attacker with access to the int (CVSS 9.6, Ivanti Endpoint Manager)
- [CVE-2024-22125](https://cve.now/CVE-2024-22125.md): Information Disclosure vulnerability in Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) (CVSS 7.4, SAP\_SE Microsoft Edge browser extension)
- [CVE-2024-22124](https://cve.now/CVE-2024-22124.md): Information Disclosure vulnerability in SAP NetWeaver Internet Communication Manager (CVSS 4.1, SAP\_SE SAP NetWeaver)
- [CVE-2024-21738](https://cve.now/CVE-2024-21738.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Application Server and ABAP Platform (CVSS 4.1, SAP\_SE SAP NetWeaver ABAP Application Server and ABAP Platf…)
- [CVE-2024-21737](https://cve.now/CVE-2024-21737.md): Code Injection vulnerability in SAP Application Interface Framework (File Adapter) (CVSS 8.4, SAP\_SE SAP Application Interface Framework)
- [CVE-2024-21736](https://cve.now/CVE-2024-21736.md): Missing Authorization check in SAP S/4HANA Finance (Advanced Payment Management) (CVSS 6.4, SAP\_SE SAP S/4HANA Finance)
- [CVE-2024-21735](https://cve.now/CVE-2024-21735.md): Improper Authorization check in SAP LT Replication Server (CVSS 7.3, SAP\_SE SAP LT Replication Server)
- [CVE-2024-21734](https://cve.now/CVE-2024-21734.md): URL Redirection vulnerability in SAP Marketing (Contacts App) (CVSS 3.7, SAP\_SE SAP Marketing)
- [CVE-2024-21646](https://cve.now/CVE-2024-21646.md): Azure IoT Platform Device SDK Remote Code Execution Vulnerability (CVSS 9.8, azure-uamqp-c)
- [CVE-2022-28975](https://cve.now/CVE-2022-28975.md): A stored cross-site scripting (XSS) vulnerability in Infoblox NIOS v8.5.2-409296 allows attackers to execute arbitrary web scripts or HTML v (CVSS 5.4)
- [CVE-2023-26998](https://cve.now/CVE-2023-26998.md): Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the creator pa (CVSS 5.4)
- [CVE-2023-26999](https://cve.now/CVE-2023-26999.md): An issue found in NetScout nGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code and cause a denial of service via a crafted (CVSS 9.8)
- [CVE-2023-27000](https://cve.now/CVE-2023-27000.md): Cross Site Scripting vulnerability found in NetScoutnGeniusOne v.6.3.4 allows a remote attacker to execute arbitrary code via the name param (CVSS 6.1)
- [CVE-2023-27098](https://cve.now/CVE-2023-27098.md): TP-Link Tapo APK up to v2.12.703 uses hardcoded credentials for access to the login panel. (CVSS 7.5)
- [CVE-2023-36629](https://cve.now/CVE-2023-36629.md): The ST ST54-android-packages-apps-Nfc package before 130-20230215-23W07p0 for Android has an out-of-bounds read. (CVSS 5.5)
- [CVE-2023-38827](https://cve.now/CVE-2023-38827.md): Cross Site Scripting vulnerability in Follet School Solutions Destiny v.20\_0\_1\_AU4 and later allows a remote attacker to run arbitrary code (CVSS 6.1)
- [CVE-2023-46906](https://cve.now/CVE-2023-46906.md): juzaweb \<= 3.4 is vulnerable to Incorrect Access Control, resulting in an application outage after a 500 HTTP status code. (CVSS 4.9, juzaweb/cms)
- [CVE-2023-47992](https://cve.now/CVE-2023-47992.md): An integer overflow vulnerability in FreeImageIO.cpp::\_MemoryReadProc in FreeImage 3.18.0 allows attackers to obtain sensitive information, (CVSS 8.8)
- [CVE-2023-47993](https://cve.now/CVE-2023-47993.md): A Buffer out-of-bound read vulnerability in Exif.cpp::ReadInt32 in FreeImage 3.18.0 allows attackers to cause a denial-of-service. (CVSS 6.5)
- [CVE-2023-47994](https://cve.now/CVE-2023-47994.md): An integer overflow vulnerability in LoadPixelDataRLE4 function in PluginBMP.cpp in Freeimage 3.18.0 allows attackers to obtain sensitive in (CVSS 8.8)
- [CVE-2023-47995](https://cve.now/CVE-2023-47995.md): Memory Allocation with Excessive Size Value discovered in BitmapAccess.cpp::FreeImage\_AllocateBitmap in FreeImage 3.18.0 allows attackers to (CVSS 6.5)
- [CVE-2023-47996](https://cve.now/CVE-2023-47996.md): An integer overflow vulnerability in Exif.cpp::jpeg\_read\_exif\_dir in FreeImage 3.18.0 allows attackers to obtain information and cause a den (CVSS 6.5)
- [CVE-2023-47997](https://cve.now/CVE-2023-47997.md): An issue discovered in BitmapAccess.cpp::FreeImage\_AllocateBitmap in FreeImage 3.18.0 leads to an infinite loop and allows attackers to caus (CVSS 6.5)
- [CVE-2023-49235](https://cve.now/CVE-2023-49235.md): An issue was discovered in libremote\_dbg.so on TRENDnet TV-IP1314PI 5.5.3 200714 devices. (CVSS 9.8)
- [CVE-2023-49236](https://cve.now/CVE-2023-49236.md): A stack-based buffer overflow was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices, leading to arbitrary command execution. (CVSS 9.8)
- [CVE-2023-49237](https://cve.now/CVE-2023-49237.md): An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. (CVSS 9.8)
- [CVE-2023-49238](https://cve.now/CVE-2023-49238.md): In Gradle Enterprise before 2023.1, a remote attacker may be able to gain access to a new installation (in certain installation scenarios) b (CVSS 9.8)
- [CVE-2023-50136](https://cve.now/CVE-2023-50136.md): Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the name field when creating a new cu (CVSS 5.4)
- [CVE-2023-50585](https://cve.now/CVE-2023-50585.md): Tenda A18 v15.13.07.09 was discovered to contain a stack overflow via the devName parameter in the formSetDeviceName function. (CVSS 9.8)
- [CVE-2023-50643](https://cve.now/CVE-2023-50643.md): An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnsp (CVSS 9.8)
- [CVE-2023-50930](https://cve.now/CVE-2023-50930.md): An issue was discovered in savignano S/Notify before 4.0.2 for Jira. (CVSS 8.3)
- [CVE-2023-50931](https://cve.now/CVE-2023-50931.md): An issue was discovered in savignano S/Notify before 2.0.1 for Bitbucket. (CVSS 8.3)
- [CVE-2023-50932](https://cve.now/CVE-2023-50932.md): An issue was discovered in savignano S/Notify before 4.0.2 for Confluence. (CVSS 8.3)
- [CVE-2023-50974](https://cve.now/CVE-2023-50974.md): In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file (CVSS 5.5, appwrite-cli · appwrite)
- [CVE-2023-51717](https://cve.now/CVE-2023-51717.md): Dataiku DSS before 11.4.5 and 12.4.1 has Incorrect Access Control that could lead to a full authentication bypass. (CVSS 9.8)
- [CVE-2024-22368](https://cve.now/CVE-2024-22368.md): The Spreadsheet::ParseXLSX package before 0.28 for Perl can encounter an out-of-memory condition during parsing of a crafted XLSX document. (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.