# CVEs published 2024-01-10

178 CVEs were published on January 10, 2024: 33 critical, 53 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-21833](https://cve.now/CVE-2024-21833.md): Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product to execute arbitrary OS commands. (CVSS 8.8, TP-Link Archer AX3000 · TP-Link Archer AX5400 +3)
- [CVE-2024-21821](https://cve.now/CVE-2024-21821.md): Multiple TP-LINK products allow a network-adjacent authenticated attacker with access to the product from the LAN port or Wi-Fi to execute a (CVSS 8.0, TP-Link Archer AX3000 · TP-Link Archer AX5400 +2)
- [CVE-2024-21773](https://cve.now/CVE-2024-21773.md): Multiple TP-LINK products allow a network-adjacent unauthenticated attacker with access to the product from the LAN port or Wi-Fi to execute (CVSS 8.8, TP-Link Archer AX3000 · TP-Link Archer AX5400 +3)
- [CVE-2022-45794](https://cve.now/CVE-2022-45794.md): Omron CJ-series and CS-series unauthenticated filesystem access. (CVSS 8.6, Omron CJ-series and CS-series CPU modules)
- [CVE-2023-40394](https://cve.now/CVE-2023-40394.md): The issue was addressed with improved validation of environment variables. (CVSS 3.3, Apple iOS and iPadOS)
- [CVE-2023-42829](https://cve.now/CVE-2023-42829.md): The issue was addressed with additional restrictions on the observability of app states. (CVSS 5.5, Apple macOS)
- [CVE-2023-41069](https://cve.now/CVE-2023-41069.md): This issue was addressed by improving Face ID anti-spoofing models. (CVSS 5.5, Apple iOS and iPadOS)
- [CVE-2023-40414](https://cve.now/CVE-2023-40414.md): A use-after-free issue was addressed with improved memory management. (CVSS 9.8, Apple iOS and iPadOS · Apple tvOS +3)
- [CVE-2023-40438](https://cve.now/CVE-2023-40438.md): An issue was addressed with improved handling of temporary files. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2022-42816](https://cve.now/CVE-2022-42816.md): A logic issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2023-42872](https://cve.now/CVE-2023-42872.md): The issue was addressed with additional permissions checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42833](https://cve.now/CVE-2023-42833.md): A correctness issue was addressed with improved checks. (CVSS 8.8, Apple iOS and iPadOS · Apple Safari +1)
- [CVE-2022-32919](https://cve.now/CVE-2022-32919.md): The issue was addressed with improved UI handling. (CVSS 4.7, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-28185](https://cve.now/CVE-2023-28185.md): An integer overflow was addressed through improved input validation. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-38612](https://cve.now/CVE-2023-38612.md): The issue was addressed with improved checks. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42832](https://cve.now/CVE-2023-42832.md): A race condition was addressed with improved state handling. (CVSS 7.0, Apple macOS)
- [CVE-2023-42865](https://cve.now/CVE-2023-42865.md): An out-of-bounds read was addressed with improved input validation. (CVSS 6.5, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2023-40439](https://cve.now/CVE-2023-40439.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-40383](https://cve.now/CVE-2023-40383.md): A path handling issue was addressed with improved validation. (CVSS 3.3, Apple macOS)
- [CVE-2023-42869](https://cve.now/CVE-2023-42869.md): Multiple memory corruption issues were addressed with improved input validation. (CVSS 7.5, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-32383](https://cve.now/CVE-2023-32383.md): This issue was addressed by forcing hardened runtime on the affected binaries at the system level. (CVSS 7.8, Apple macOS)
- [CVE-2023-42828](https://cve.now/CVE-2023-42828.md): This issue was addressed by removing the vulnerable code. (CVSS 7.8, Apple macOS)
- [CVE-2022-46710](https://cve.now/CVE-2022-46710.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-41075](https://cve.now/CVE-2023-41075.md): A type confusion issue was addressed with improved checks. (CVSS 7.8, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-42862](https://cve.now/CVE-2023-42862.md): An out-of-bounds read was addressed with improved input validation. (CVSS 6.5, Apple macOS · Apple iOS and iPadOS +2)
- [CVE-2022-48504](https://cve.now/CVE-2022-48504.md): The issue was addressed with improved handling of caches. (CVSS 5.5, Apple macOS)
- [CVE-2022-46721](https://cve.now/CVE-2022-46721.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-32424](https://cve.now/CVE-2023-32424.md): The issue was addressed with improved memory handling. (CVSS 5.5, Apple iOS and iPadOS · Apple watchOS)
- [CVE-2023-40385](https://cve.now/CVE-2023-40385.md): This issue was addressed by removing the vulnerable code. (CVSS 6.5, Apple iOS and iPadOS · Apple Safari +1)
- [CVE-2023-41994](https://cve.now/CVE-2023-41994.md): A logic issue was addressed with improved checks This issue is fixed in macOS Sonoma 14. (CVSS 5.5, Apple macOS)
- [CVE-2023-40393](https://cve.now/CVE-2023-40393.md): An authentication issue was addressed with improved state management. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-40433](https://cve.now/CVE-2023-40433.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-32366](https://cve.now/CVE-2023-32366.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 7.8, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-28197](https://cve.now/CVE-2023-28197.md): An access issue was addressed with additional sandbox restrictions. (CVSS 3.3, Apple macOS)
- [CVE-2022-32931](https://cve.now/CVE-2022-32931.md): This issue was addressed with improved data protection. (CVSS 5.5, Apple macOS)
- [CVE-2023-40430](https://cve.now/CVE-2023-40430.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-42933](https://cve.now/CVE-2023-42933.md): This issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2023-42876](https://cve.now/CVE-2023-42876.md): The issue was addressed with improved bounds checks. (CVSS 7.1, Apple macOS)
- [CVE-2023-41974](https://cve.now/CVE-2023-41974.md): A use-after-free issue was addressed with improved memory management. (CVSS 7.8, KEV, Apple iOS and iPadOS)
- [CVE-2023-42929](https://cve.now/CVE-2023-42929.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2022-47915](https://cve.now/CVE-2022-47915.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2023-40411](https://cve.now/CVE-2023-40411.md): This issue was addressed with improved data protection. (CVSS 5.5, Apple macOS)
- [CVE-2023-41060](https://cve.now/CVE-2023-41060.md): A type confusion issue was addressed with improved checks. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2022-48577](https://cve.now/CVE-2022-48577.md): An access issue was addressed with improved access restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2023-41987](https://cve.now/CVE-2023-41987.md): This issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-32436](https://cve.now/CVE-2023-32436.md): The issue was addressed with improved bounds checks. (CVSS 7.1, Apple macOS)
- [CVE-2023-38607](https://cve.now/CVE-2023-38607.md): The issue was addressed with improved handling of caches. (CVSS 5.5, Apple macOS)
- [CVE-2023-42831](https://cve.now/CVE-2023-42831.md): This issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-42866](https://cve.now/CVE-2023-42866.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple Safari · Apple tvOS +3)
- [CVE-2023-42870](https://cve.now/CVE-2023-42870.md): A use-after-free issue was addressed with improved memory management. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42826](https://cve.now/CVE-2023-42826.md): The issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2023-42934](https://cve.now/CVE-2023-42934.md): An information disclosure issue was addressed by removing the vulnerable code. (CVSS 4.2, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42871](https://cve.now/CVE-2023-42871.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42830](https://cve.now/CVE-2023-42830.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-38610](https://cve.now/CVE-2023-38610.md): A memory corruption issue was addressed by removing the vulnerable code. (CVSS 7.1, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-40437](https://cve.now/CVE-2023-40437.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2022-47965](https://cve.now/CVE-2022-47965.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2022-42839](https://cve.now/CVE-2022-42839.md): This issue was addressed with improved redaction of sensitive information. (CVSS 3.3, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-32401](https://cve.now/CVE-2023-32401.md): A buffer overflow was addressed with improved bounds checking. (CVSS 7.8, Apple macOS)
- [CVE-2023-32378](https://cve.now/CVE-2023-32378.md): A use-after-free issue was addressed with improved memory management. (CVSS 7.8, Apple macOS)
- [CVE-2023-40529](https://cve.now/CVE-2023-40529.md): This issue was addressed with improved redaction of sensitive information. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2024-21638](https://cve.now/CVE-2024-21638.md): Azure IPAM solution Elevation of Privilege Vulnerability (CVSS 9.1, Azure ipam)
- [CVE-2023-49295](https://cve.now/CVE-2023-49295.md): quic-go's path validation mechanism can cause denial of service (CVSS 6.4, quic-go · github.com/quic-go/quic-go)
- [CVE-2024-0333](https://cve.now/CVE-2024-0333.md): Insufficient data validation in Extensions in Google Chrome prior to 120.0.6099.216 allowed an attacker in a privileged network position to (CVSS 5.3, Google Chrome)
- [CVE-2023-42941](https://cve.now/CVE-2023-42941.md): The issue was addressed with improved checks. (CVSS 4.8, Apple iOS and iPadOS)
- [CVE-2022-45793](https://cve.now/CVE-2022-45793.md): Executable files writable by low-privileged users in Omron Sysmac Studio (CVSS 5.5, Omron Sysmac Studio)
- [CVE-2023-29447](https://cve.now/CVE-2023-29447.md): Insufficiently Protected Credentials in PTC's Kepware KEPServerEX (CVSS 5.7, PTC Kepware KEPServerEX · PTC ThingWorx Kepware Server +1)
- [CVE-2023-29446](https://cve.now/CVE-2023-29446.md): Improper Input Validation in PTC's Kepware KEPServerEX (CVSS 4.7, PTC Kepware KEPServerEX · PTC ThingWorx Kepware Server +1)
- [CVE-2023-29445](https://cve.now/CVE-2023-29445.md): Uncontrolled Search Path Element in PTC's Kepware KEPServerEX (CVSS 7.8, PTC Kepware KEPServerEX · PTC ThingWorx Kepware Server +1)
- [CVE-2023-48783](https://cve.now/CVE-2023-48783.md): An Authorization Bypass Through User-Controlled Key vulnerability \[CWE-639\] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and (CVSS 4.9, Fortinet FortiPortal)
- [CVE-2023-46712](https://cve.now/CVE-2023-46712.md): A improper access control in Fortinet FortiPortal version 7.0.0 through 7.0.6, Fortinet FortiPortal version 7.2.0 through 7.2.1 allows attac (CVSS 6.3, Fortinet FortiPortal)
- [CVE-2023-44250](https://cve.now/CVE-2023-44250.md): An improper privilege management vulnerability \[CWE-269\] in a Fortinet FortiOS HA cluster version 7.4.0 through 7.4.1 and 7.2.5 and in a For (CVSS 8.3, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2023-37934](https://cve.now/CVE-2023-37934.md): An allocation of resources without limits or throttling vulnerability \[CWE-770\] in FortiPAM 1.0 all versions allows an authenticated attacke (CVSS 4.2, Fortinet FortiPAM)
- [CVE-2023-37932](https://cve.now/CVE-2023-37932.md): An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability \[CWE-22\] in FortiVoiceEntreprise version 7.0 (CVSS 6.2, Fortinet FortiVoice)
- [CVE-2023-29444](https://cve.now/CVE-2023-29444.md): Uncontrolled Search Path Element in PTC's Kepware KEPServerEX (CVSS 6.3, PTC Kepware KEPServerEX · PTC ThingWorx Kepware Server +1)
- [CVE-2023-45139](https://cve.now/CVE-2023-45139.md): fonttools XML External Entity Injection (XXE) Vulnerability (CVSS 7.5, fonttools)
- [CVE-2023-41056](https://cve.now/CVE-2023-41056.md): Redis vulnerable to integer overflow in certain payloads (CVSS 8.1, redis)
- [CVE-2023-47171](https://cve.now/CVE-2023-47171.md): An information disclosure vulnerability exists in the aVideoEncoder.json.php chunkFile path functionality of WWBN AVideo 11.6 and dev master (CVSS 6.5, WWBN AVideo)
- [CVE-2023-49864](https://cve.now/CVE-2023-49864.md): An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev maste (CVSS 6.5, WWBN AVideo)
- [CVE-2023-49863](https://cve.now/CVE-2023-49863.md): An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev maste (CVSS 6.5, WWBN AVideo)
- [CVE-2023-49862](https://cve.now/CVE-2023-49862.md): An information disclosure vulnerability exists in the aVideoEncoderReceiveImage.json.php image upload functionality of WWBN AVideo dev maste (CVSS 6.5, WWBN AVideo)
- [CVE-2023-49738](https://cve.now/CVE-2023-49738.md): An information disclosure vulnerability exists in the image404Raw.php functionality of WWBN AVideo dev master commit 15fed957fb. (CVSS 7.5, WWBN AVideo)
- [CVE-2023-48730](https://cve.now/CVE-2023-48730.md): A cross-site scripting (xss) vulnerability exists in the navbarMenuAndLogo.php user name functionality of WWBN AVideo dev master commit 15fe (CVSS 8.5, WWBN AVideo)
- [CVE-2023-48728](https://cve.now/CVE-2023-48728.md): A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master com (CVSS 9.6, WWBN AVideo)
- [CVE-2023-47861](https://cve.now/CVE-2023-47861.md): A cross-site scripting (xss) vulnerability exists in the channelBody.php user name functionality of WWBN AVideo 11.6 and dev master commit 1 (CVSS 9.0, WWBN AVideo)
- [CVE-2023-49715](https://cve.now/CVE-2023-49715.md): A unrestricted php file upload vulnerability exists in the import.json.php temporary copy functionality of WWBN AVideo dev master commit 15f (CVSS 4.3, WWBN AVideo)
- [CVE-2023-47862](https://cve.now/CVE-2023-47862.md): A local file inclusion vulnerability exists in the getLanguageFromBrowser functionality of WWBN AVideo dev master commit 15fed957fb. (CVSS 9.8, WWBN AVideo)
- [CVE-2023-49589](https://cve.now/CVE-2023-49589.md): An insufficient entropy vulnerability exists in the userRecoverPass.php recoverPass generation functionality of WWBN AVideo dev master commi (CVSS 8.8, WWBN AVideo)
- [CVE-2023-50172](https://cve.now/CVE-2023-50172.md): A recovery notification bypass vulnerability exists in the userRecoverPass.php captcha validation functionality of WWBN AVideo dev master co (CVSS 5.3, WWBN AVideo · wwbn/avideo)
- [CVE-2023-49810](https://cve.now/CVE-2023-49810.md): A login attempt restriction bypass vulnerability exists in the checkLoginAttempts functionality of WWBN AVideo dev master commit 15fed957fb. (CVSS 7.3, WWBN AVideo · wwbn/avideo)
- [CVE-2023-49599](https://cve.now/CVE-2023-49599.md): An insufficient entropy vulnerability exists in the salt generation functionality of WWBN AVideo dev master commit 15fed957fb. (CVSS 9.8, WWBN AVideo · wwbn/avideo)
- [CVE-2023-6158](https://cve.now/CVE-2023-6158.md): EventON - WordPress Virtual Event Calendar Plugin Pro \<= 4.5.4 & Free \<= 2.2.7 - Missing Authorization to Arbitrary Post Meta Update via evo\_eventpost\_update\_meta (CVSS 6.5, ashanjay EventON – Events Calendar · EventON (Pro) - WordPr…)
- [CVE-2024-0389](https://cve.now/CVE-2024-0389.md): SourceCodester Student Attendance System attendance\_report.php sql injection (CVSS 6.3, SourceCodester Student Attendance System)
- [CVE-2023-48266](https://cve.now/CVE-2023-48266.md): The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Exe (CVSS 8.1, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48265](https://cve.now/CVE-2023-48265.md): The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Exe (CVSS 8.1, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48264](https://cve.now/CVE-2023-48264.md): The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Exe (CVSS 8.1, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48263](https://cve.now/CVE-2023-48263.md): The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Exe (CVSS 8.1, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48262](https://cve.now/CVE-2023-48262.md): The vulnerability allows an unauthenticated remote attacker to perform a Denial-of-Service (DoS) attack or, possibly, obtain Remote Code Exe (CVSS 8.1, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48261](https://cve.now/CVE-2023-48261.md): The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. (CVSS 5.3, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48260](https://cve.now/CVE-2023-48260.md): The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. (CVSS 5.3, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48259](https://cve.now/CVE-2023-48259.md): The vulnerability allows a remote unauthenticated attacker to read arbitrary content of the results database via a crafted HTTP request. (CVSS 5.3, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48258](https://cve.now/CVE-2023-48258.md): The vulnerability allows a remote attacker to delete arbitrary files on the file system via a crafted URL or HTTP request through a victim’ (CVSS 5.5, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48257](https://cve.now/CVE-2023-48257.md): The vulnerability allows a remote attacker to access sensitive data inside exported packages or obtain up to Remote Code Execution (RCE) wit (CVSS 7.8, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48256](https://cve.now/CVE-2023-48256.md): The vulnerability allows a remote attacker to inject arbitrary HTTP response headers or manipulate HTTP response bodies inside a victim’s se (CVSS 5.3, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48255](https://cve.now/CVE-2023-48255.md): The vulnerability allows an unauthenticated remote attacker to send malicious network requests containing arbitrary client-side script code (CVSS 6.3, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48254](https://cve.now/CVE-2023-48254.md): The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted U (CVSS 5.3, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48253](https://cve.now/CVE-2023-48253.md): The vulnerability allows a remote authenticated attacker to read or update arbitrary content of the authentication database via a crafted HT (CVSS 8.8, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48252](https://cve.now/CVE-2023-48252.md): The vulnerability allows an authenticated remote attacker to perform actions exceeding their authorized access via crafted HTTP requests. (CVSS 8.8, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48251](https://cve.now/CVE-2023-48251.md): The vulnerability allows a remote attacker to authenticate to the SSH service with root privileges through a hidden hard-coded account. (CVSS 8.1, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-5455](https://cve.now/CVE-2023-5455.md): Ipa: invalid csrf protection (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2024-20711](https://cve.now/CVE-2024-20711.md): Adobe Substance 3D Stager v2.1.1 Vulnerability VII (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2024-20712](https://cve.now/CVE-2024-20712.md): Adobe Substance 3D Stager v2.1.1 Vulnerability III (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2024-20713](https://cve.now/CVE-2024-20713.md): Adobe Substance 3D Stager v2.1.1 Vulnerability IV (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2024-20714](https://cve.now/CVE-2024-20714.md): Adobe Substance 3D Stager v2.1.1 Vulnerability V (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2024-20715](https://cve.now/CVE-2024-20715.md): Adobe Substance 3D Stager v2.1.1 Vulnerability VIII (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2024-20710](https://cve.now/CVE-2024-20710.md): Adobe Substance 3D Stager v2.1.1 Vulnerability I (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2024-0310](https://cve.now/CVE-2024-0310.md): A content-security-policy vulnerability in ENS Control browser extension prior to 10.7.0 Update 15 allows a remote attacker to alter the re (CVSS 6.1, Trellix Endpoint Security (ENS) Web Control)
- [CVE-2023-48250](https://cve.now/CVE-2023-48250.md): The vulnerability allows a remote attacker to authenticate to the web application with high privileges through multiple hidden hard-coded ac (CVSS 8.1, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48249](https://cve.now/CVE-2023-48249.md): The vulnerability allows an authenticated remote attacker to list arbitrary folders in all paths of the system under the context of the appl (CVSS 6.5, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48248](https://cve.now/CVE-2023-48248.md): The vulnerability allows an authenticated remote attacker to upload a malicious file to the SD card containing arbitrary client-side script (CVSS 5.5, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48247](https://cve.now/CVE-2023-48247.md): The vulnerability allows an unauthenticated remote attacker to read arbitrary files under the context of the application OS user (“root”) vi (CVSS 5.3, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48246](https://cve.now/CVE-2023-48246.md): The vulnerability allows a remote attacker to download arbitrary files in all paths of the system under the context of the application OS us (CVSS 6.5, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48245](https://cve.now/CVE-2023-48245.md): The vulnerability allows an unauthenticated remote attacker to upload arbitrary files under the context of the application OS user (“root”) (CVSS 6.5, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48244](https://cve.now/CVE-2023-48244.md): The vulnerability allows a remote attacker to inject and execute arbitrary client-side script code inside a victim’s session via a crafted U (CVSS 5.3, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48243](https://cve.now/CVE-2023-48243.md): The vulnerability allows a remote attacker to upload arbitrary files in all paths of the system under the context of the application OS user (CVSS 8.1, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-48242](https://cve.now/CVE-2023-48242.md): The vulnerability allows an authenticated remote attacker to download arbitrary files in all paths of the system under the context of the ap (CVSS 6.5, Rexroth Nexo cordless nutrunner NXA015S-36V · Rexroth N… +13)
- [CVE-2023-49619](https://cve.now/CVE-2023-49619.md): Apache Answer: Repeated submissions using scripts resulted in an abnormal number of collections for questions. (CVSS 3.1, Apache Software Foundation Apache Answer · github.com/apach…)
- [CVE-2023-41781](https://cve.now/CVE-2023-41781.md): XSS Vulnerability in ZTE MF258 Products (CVSS 5.7, ZTE MF258)
- [CVE-2024-21643](https://cve.now/CVE-2024-21643.md): Microsoft.IdentityModel.Protocols.SignedHttpRequest remote code execution vulnerability (CVSS 7.1, AzureAD azure-activedirectory-identitymodel-extensions-for-…)
- [CVE-2024-0364](https://cve.now/CVE-2024-0364.md): PHPGurukul Hospital Management System query-details.php sql injection (CVSS 5.5, PHPGurukul Hospital Management System)
- [CVE-2024-0363](https://cve.now/CVE-2024-0363.md): PHPGurukul Hospital Management System patient-search.php sql injection (CVSS 5.5, PHPGurukul Hospital Management System)
- [CVE-2024-0362](https://cve.now/CVE-2024-0362.md): PHPGurukul Hospital Management System change-password.php sql injection (CVSS 5.5, PHPGurukul Hospital Management System)
- [CVE-2024-0361](https://cve.now/CVE-2024-0361.md): PHPGurukul Hospital Management System contact.php sql injection (CVSS 5.5, PHPGurukul Hospital Management System)
- [CVE-2024-0360](https://cve.now/CVE-2024-0360.md): PHPGurukul Hospital Management System edit-doctor-specialization.php sql injection (CVSS 5.5, PHPGurukul Hospital Management System)
- [CVE-2024-0359](https://cve.now/CVE-2024-0359.md): code-projects Simple Online Hotel Reservation System login.php sql injection (CVSS 7.3, code-projects Simple Online Hotel Reservation System)
- [CVE-2024-0358](https://cve.now/CVE-2024-0358.md): DeShang DSO2O install.php access control (CVSS 5.3, DeShang DSO2O)
- [CVE-2024-0357](https://cve.now/CVE-2024-0357.md): coderd-repos Eva HTTP POST Request page sql injection (CVSS 5.5, coderd-repos Eva)
- [CVE-2024-0356](https://cve.now/CVE-2024-0356.md): Mandelo ssm\_shiro\_blog Backend updateRoles access control (CVSS 4.3, Mandelo ssm\_shiro\_blog)
- [CVE-2020-26627](https://cve.now/CVE-2020-26627.md): A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database info (CVSS 4.9)
- [CVE-2020-26628](https://cve.now/CVE-2020-26628.md): A Cross-Site Scripting (XSS) vulnerability was discovered in Hospital Management System V4.0 which allows an attacker to execute arbitrary w (CVSS 6.1)
- [CVE-2020-26629](https://cve.now/CVE-2020-26629.md): A JQuery Unrestricted Arbitrary File Upload vulnerability was discovered in Hospital Management System V4.0 which allows an unauthenticated (CVSS 9.8)
- [CVE-2020-26630](https://cve.now/CVE-2020-26630.md): A Time-Based SQL Injection vulnerability was discovered in Hospital Management System V4.0 which can allow an attacker to dump database info (CVSS 4.9)
- [CVE-2022-46025](https://cve.now/CVE-2022-46025.md): Totolink N200RE\_V5 V9.3.5u.6255\_B20211224 is vulnerable to Incorrect Access Control. (CVSS 9.1)
- [CVE-2023-31446](https://cve.now/CVE-2023-31446.md): In Cassia Gateway firmware XC1000\_2.1.1.2303082218 and XC2000\_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. (CVSS 9.8)
- [CVE-2023-31488](https://cve.now/CVE-2023-31488.md): Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco (CVSS 9.8)
- [CVE-2023-41603](https://cve.now/CVE-2023-41603.md): D-Link R15 before v1.08.02 was discovered to contain no firewall restrictions for IPv6 traffic. (CVSS 5.3)
- [CVE-2023-48864](https://cve.now/CVE-2023-48864.md): SEMCMS v4.8 was discovered to contain a SQL injection vulnerability via the languageID parameter in /web\_inc.php. (CVSS 7.5)
- [CVE-2023-49394](https://cve.now/CVE-2023-49394.md): Zentao versions 4.1.3 and before has a URL redirect vulnerability, which prevents the system from functioning properly. (CVSS 6.1)
- [CVE-2023-49427](https://cve.now/CVE-2023-49427.md): Buffer Overflow vulnerability in Tenda AX12 V22.03.01.46, allows remote attackers to cause a denial of service (DoS) via list parameter in S (CVSS 7.5)
- [CVE-2023-49471](https://cve.now/CVE-2023-49471.md): Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before (CVSS 8.8)
- [CVE-2023-50120](https://cve.now/CVE-2023-50120.md): MP4Box GPAC version 2.3-DEV-rev636-gfbd7e13aa-master was discovered to contain an infinite loop in the function av1\_uvlc at media\_tools/av\_p (CVSS 5.5)
- [CVE-2023-50916](https://cve.now/CVE-2023-50916.md): Kyocera Device Manager before 3.1.1213.0 allows NTLM credential exposure during UNC path authentication via a crafted change from a local pa (CVSS 7.2)
- [CVE-2023-51123](https://cve.now/CVE-2023-51123.md): An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the se (CVSS 9.8)
- [CVE-2023-51126](https://cve.now/CVE-2023-51126.md): Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value param (CVSS 9.8)
- [CVE-2023-51127](https://cve.now/CVE-2023-51127.md): FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction. (CVSS 7.5)
- [CVE-2023-51252](https://cve.now/CVE-2023-51252.md): PublicCMS 4.0 is vulnerable to Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2023-51952](https://cve.now/CVE-2023-51952.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formSetIptv. (CVSS 9.8)
- [CVE-2023-51953](https://cve.now/CVE-2023-51953.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv. (CVSS 9.8)
- [CVE-2023-51954](https://cve.now/CVE-2023-51954.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formSetIptv. (CVSS 9.8)
- [CVE-2023-51955](https://cve.now/CVE-2023-51955.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formSetIptv. (CVSS 6.5)
- [CVE-2023-51956](https://cve.now/CVE-2023-51956.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formSetIptv (CVSS 9.8)
- [CVE-2023-51957](https://cve.now/CVE-2023-51957.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formGetIptv. (CVSS 9.8)
- [CVE-2023-51958](https://cve.now/CVE-2023-51958.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function formGetIptv. (CVSS 9.8)
- [CVE-2023-51959](https://cve.now/CVE-2023-51959.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function formGetIptv. (CVSS 9.8)
- [CVE-2023-51960](https://cve.now/CVE-2023-51960.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function formGetIptv. (CVSS 9.8)
- [CVE-2023-51961](https://cve.now/CVE-2023-51961.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function formGetIptv. (CVSS 9.8)
- [CVE-2023-51962](https://cve.now/CVE-2023-51962.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function setIptvInfo. (CVSS 9.8)
- [CVE-2023-51963](https://cve.now/CVE-2023-51963.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function setIptvInfo. (CVSS 9.8)
- [CVE-2023-51964](https://cve.now/CVE-2023-51964.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function setIptvInfo. (CVSS 9.8)
- [CVE-2023-51965](https://cve.now/CVE-2023-51965.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function setIptvInfo. (CVSS 9.8)
- [CVE-2023-51966](https://cve.now/CVE-2023-51966.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function setIptvInfo. (CVSS 9.8)
- [CVE-2023-51967](https://cve.now/CVE-2023-51967.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.port parameter in the function getIptvInfo. (CVSS 9.8)
- [CVE-2023-51968](https://cve.now/CVE-2023-51968.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stballvlans parameter in the function getIptvInfo. (CVSS 9.8)
- [CVE-2023-51969](https://cve.now/CVE-2023-51969.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.city.vlan parameter in the function getIptvInfo. (CVSS 9.8)
- [CVE-2023-51970](https://cve.now/CVE-2023-51970.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the iptv.stb.mode parameter in the function formSetIptv. (CVSS 9.8)
- [CVE-2023-51971](https://cve.now/CVE-2023-51971.md): Tenda AX1803 v1.0.0.1 contains a stack overflow via the adv.iptv.stbpvid parameter in the function getIptvInfo. (CVSS 9.8)
- [CVE-2023-51972](https://cve.now/CVE-2023-51972.md): Tenda AX1803 v1.0.0.1 was discovered to contain a command injection vulnerability via the function fromAdvSetLanIp. (CVSS 9.8)
- [CVE-2023-52064](https://cve.now/CVE-2023-52064.md): Wuzhicms v4.1.0 was discovered to contain a SQL injection vulnerability via the $keywords parameter at /core/admin/copyfrom.php. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.