CVEs published January 11, 2024
139 CVEs were published on January 11, 2024: 20 critical, 27 high.
- Published
- 139
- Critical
- 20
- High
- 27
- Medium
- 82
- Low
- 8
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- IBM AIX
- 4
- 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- 3
- DeShang DSMall
- 3
- IBM Security Verify Access Appliance · IBM Security Verify…
- 3
- stellarwp GiveWP – Donation Plugin and Fundraising Platform
- 3
- thimpress LearnPress – WordPress LMS Plugin for Create and…
- 3
- ashanjay EventON – Events Calendar · EventON (Pro) - WordPr…
- 2
- carazo Import and export users and customers
- 2
- DeShang DSShop
- 2
- ForU CMS
- 2
Critical 20
- CVE-2024-22199Django Template Engine Vulnerable to XSSgofiber template · github.com/gofiber/template/django/v3
- CVE-2023-6875POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app APIsaadiqbal Post SMTP – Complete Email Deliverability and SMT…
- CVE-2023-6316MW WP Form <= 5.0.1 - Unauthenticated Arbitrary File Uploadinc2734 MW WP Form
- CVE-2023-6567LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_bythimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2023-6699WP Compress – Image Optimizer [All-In-One] <= 6.10.33 - Unauthenticated Directory Traversal via cssaresit WP Compress – Instant Performance & Speed Optimizati…
- CVE-2024-21669Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VChyperledger aries-cloudagent-python · aries-cloudagent
- CVE-2023-51350A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script
- CVE-2023-51984D-Link DIR-822+ V1.0.2 was found to contain a command injection in SetStaticRouteSettings function.
- CVE-2023-51987D-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 interface, which allows attackers to log in to administrator accounts with empty
- CVE-2023-52027TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the NTPSyncWithHost func
- CVE-2023-52028TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setTracerouteCfg fun
- CVE-2023-52029TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setDiagnosisCfg func
- CVE-2023-52030TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setOpModeCfg functio
- CVE-2023-52031TOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the UploadFirmwareFile f
- CVE-2023-52032TOTOlink EX1200T V4.1.2cu.5232_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via the "main" function.
- CVE-2024-22942TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the hostName parameter in the setWan
- CVE-2024-23058TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cf
- CVE-2024-23059TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdn
- CVE-2024-23060TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg fu
- CVE-2024-23061TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setSched
High 27
- CVE-2024-22198Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2024-22196Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2024-22197Authenticated (user role) remote command execution by modifying `nginx` settings (GHSL-2023-269)0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2024-0429Buffer overflow vulnerability on Hex WorkshopHex Workshop
- CVE-2023-5504BackWPup <= 4.0.1 - Authenticated (Administrator+) Directory Traversalwp_media BackWPup – WordPress Backup & Restore Plugin
- CVE-2023-6751Hostinger <= 1.9.7 - Missing Authorization to Maintenance Mode ActivationHostinger Tools
- CVE-2023-6220Piotnet Forms <= 1.0.28 - Unauthenticated Arbitrary File Uploadpiotnetdotcom Piotnet Forms
- CVE-2023-6636Greenshift – animation and page builder blocks <= 7.6.2 - Authenticated (Administrator+) Arbitrary File Uploadwpsoul Greenshift – animation and page builder blocks
- CVE-2023-6878Slick Social Share Buttons <= 2.4.11 - Authenticated (Subscriber+) Arbitrary Option Updateremix4 Slick Social Share Buttons
- CVE-2023-6828ARForms <= 1.5.8 - Unauthenticated Stored Cross-Site Scripting via arf_http_referrer_urlreputeinfosystems Contact Form, Survey, Quiz & Popup Form B…
- CVE-2023-6558Export and Import Users and Customers <= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Uploadwebtoffee Export and Import Users and Customers
- CVE-2023-6979Customer Reviews for WooCommerce <= 5.38.9 - Authenticated (Author+) Arbitrary File Uploadivole Customer Reviews for WooCommerce
- CVE-2023-6634LearnPress <= 4.2.5.7 - Command Injectionthimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2023-6266Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposureinisev BackupBliss – Backup & Migration with Free Cloud Sto…
- CVE-2024-0252Remote code executionManageEngine ADSelfService Plus
- CVE-2024-21637XSS in Authentik via JavaScript-URI as Redirect URI and form_post Response Modegoauthentik authentik
- CVE-2023-5448WP Register Profile With Shortcode <= 3.5.9 - Cross-Site Request Forgery to User Password Resetavimegladon WP Register Profile With Shortcode
- CVE-2023-31003IBM Security Access Manager Container privilege escalationIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2024-22190Untrusted search path under some conditions on Windows allows arbitrary code executiongitpython-developers GitPython · gitpython
- CVE-2023-46474File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uplo
- CVE-2023-50123The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited.
- CVE-2023-50159In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be execute
- CVE-2023-50671In exiftags 1.01, nikon_prop1 in nikon.c has a heap-based buffer overflow (write of size 28) because snprintf can write to an unexpected add
- CVE-2023-51073An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to execute arbitrary code via the Firmware Update Script at /etc/init.d/upda
- CVE-2023-51748ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used.
- CVE-2023-51751ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used.
- CVE-2024-23057TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg fu
Medium, low and unrated 92
- CVE-2024-21982 CVE-2024-21982 Information Disclosure Vulnerability in ONTAP 9 NetApp ONTAP
- CVE-2024-0443Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline.kernel · Red Hat Enterprise Linux
- CVE-2024-21337Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2024-20675Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2024-0426ForU CMS cms_template.php sql injectionForU CMS
- CVE-2023-7226meetyoucrop big-whale Admin Module all.api improper ownership managementmeetyoucrop big-whale
- CVE-2022-4959qkmc-rk redbbs Nickname cross site scriptingqkmc-rk redbbs
- CVE-2024-0425ForU CMS password recoveryForU CMS
- CVE-2024-0424CodeAstro Simple Banking System Create a User Page createuser.php cross site scriptingCodeAstro Simple Banking System
- CVE-2024-0423CodeAstro Online Food Ordering System dishes.php cross site scriptingCodeAstro Online Food Ordering System
- CVE-2024-0422CodeAstro POS and Inventory Management System New Item Creation Page new_item cross site scriptingCodeAstro POS and Inventory Management System
- CVE-2024-0419Jasper httpdx HTTP POST Request denial of serviceJasper httpdx
- CVE-2024-0418iSharer and upRedSun File Sharing Wizard GET Request denial of serviceiSharer and upRedSun File Sharing Wizard
- CVE-2024-0417DeShang DSShop MemberAuth.php path traversalDeShang DSShop
- CVE-2024-0416DeShang DSMall MemberAuth.php path traversalDeShang DSMall
- CVE-2024-0415DeShang DSMall Image URL TaobaoExport.php access controlDeShang DSMall
- CVE-2024-0414DeShang DSCMS install.php access controlDeShang DSCMS
- CVE-2024-0413DeShang DSKMS install.php access controlDeShang DSKMS
- CVE-2024-0412DeShang DSShop HTTP GET Request install.php access controlDeShang DSShop
- CVE-2024-0411DeShang DSMall HTTP GET Request install.php access controlDeShang DSMall
- CVE-2023-5118Stored cross-site scripting vulnerability in Kofax Capture softwareKofax Capture
- CVE-2023-6554Missing authorisation in TCExamTecnick.com TCExam
- CVE-2023-6938Oxygen Builder <= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom FieldOxygen Builder
- CVE-2023-6242EventON - WordPress Virtual Event Calendar Plugin Pro <= 4.5.4 & Free <= 2.2.7 - Cross-Site Request Forgery via evo_eventpost_update_metaashanjay EventON – Events Calendar · EventON (Pro) - WordPr…
- CVE-2023-6244EventON - WordPress Virtual Event Calendar Plugin <= 4.5.4 (Pro) & <= 2.2.8 (Free) - Cross-Site Request Forgery via save_virtual_event_settingsashanjay EventON – Events Calendar · EventON (Pro) - WordPr…
- CVE-2023-20573Debug Exception Delivery in Secure Nested Paging3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Processors
- CVE-2022-4958qkmc-rk redbbs Post cross site scriptingqkmc-rk redbbs
- CVE-2023-6582ElementsKit Lite <= 3.0.3 - Unauthenticated Sensitive Information Exposureroxnor ElementsKit Elementor Addons – Advanced Widgets & Te…
- CVE-2023-4960WCFM Marketplace <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewclovers WCFM Marketplace – Multivendor Marketplace for Woo…
- CVE-2023-7071Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2023-7070Email Encoder – Protect Email Addresses and Phone Numbers <= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingonlineoptimisation Email Encoder – Protect Email Addresses…
- CVE-2023-6504Profile Builder <= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user_meta Shortcodecozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2023-4247GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin deactivationstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2023-5691The Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insufcollectchat Collect.chat Chatbot ⚡️
- CVE-2023-4246GiveWP <= 2.33.3 - Cross-Site Request Forgery to plugin installationstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2023-6598SpeedyCache <= 1.1.3 - Missing Authorization to Plugin Options Updatesoftaculous SpeedyCache – Cache, Optimization, Performance
- CVE-2023-6561Featured Image from URL (FIFU) <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt textmarceljm Featured Image from URL
- CVE-2023-6638GTG Product Feed for Shopping <= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Updatewpopal GG Woo Feed for WooCommerce Shopping Feed on Google…
- CVE-2023-6737Enable Media Replace <= 4.1.4 - Reflected Cross-Site Scriptingshortpixel Enable Media Replace
- CVE-2023-6782AMP for WP – Accelerated Mobile Pages <= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcodemohammed_kaludi AMP for WP – Accelerated Mobile Pages
- CVE-2023-7048My Sticky Bar <= 2.6.6 - Cross-Site Request Forgery to Sensitive Information Exposurepremio My Sticky Bar – Floating Notification Bar & Sticky H…
- CVE-2023-6990Weaver Xtreme <= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpweaver Weaver Xtreme
- CVE-2023-7019LightStart – Maintenance Mode, Coming Soon and Landing Page Builder <= 2.6.8 - Missing Authorizationthemeisle LightStart – Maintenance Mode, Coming Soon and La…
- CVE-2023-6583Import and export users and customers <= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionalitycarazo Import and export users and customers
- CVE-2023-6645Post Grid Combo – 36+ Gutenberg Blocks <= 2.2.64 - Authenticated (Contributor+) Cross-Site Scriptingpickplugins Post Grid
- CVE-2023-6934Limit Login Attempts Reloaded <= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpchefgadget Limit Login Attempts Reloaded – Login Security…
- CVE-2023-6556FOX – Currency Switcher Professional for WooCommerce <= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scriptingrealmag777 FOX – Currency Switcher Professional for WooComm…
- CVE-2023-4962Video PopUp <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodealobaidi Video PopUp
- CVE-2023-6994List category posts <= 0.89.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodefernandobt List category posts
- CVE-2023-6637CAOS | Host Google Analytics Locally <= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings Updatedaanvandenbergh CAOS | Host Google Analytics Locally
- CVE-2023-67763D Flipbook <= 1.15.2 - Authenticated (Contributor+) Cross-Site Scripting via Ready Functioniberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer…
- CVE-2023-6369Export WP Page to Static HTML/CSS <= 2.1.9 - Missing Authorization via Multiple AJAX Actionsrecorp Export WordPress Pages to Static HTML & PDF — Static…
- CVE-2023-6624Import and export users and customers <= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcodecarazo Import and export users and customers
- CVE-2023-6742Envira Gallery Lite <= 1.8.7.2 - Missing Authorization to Gallery Modification via envira_gallery_insert_imagessmub Envira Gallery – Image Photo Gallery, Albums, Video Ga…
- CVE-2023-6855Paid Memberships Pro <= 2.12.5 - Missing Authorization via APIstrangerstudios Paid Memberships Pro – Content Restriction,…
- CVE-2023-6882Simple Membership <= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment_modewpinsider-1 Simple Membership
- CVE-2023-6988Colibri Page Builder <= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeextendthemes Colibri Page Builder
- CVE-2023-4248GiveWP <= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletionstellarwp GiveWP – Donation Plugin and Fundraising Platform
- CVE-2023-4372LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodelitespeedtech LiteSpeed Cache
- CVE-2023-6781Orbit Fox Companion <= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fieldsthemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2023-6924Photo Gallery by 10Web <= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via WidgetPhoto Gallery by 10Web – Mobile-Friendly Image Gallery
- CVE-2023-6684Ibtana – WordPress Website Builder <= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodevowelweb Ibtana – WordPress Website Builder
- CVE-2023-6632Happy Addons for Elementor <= 3.9.1.1 - Reflected Cross-Site ScriptingweDevs Happy Addons for Elementor Pro · thehappymonster Hap…
- CVE-2023-6496Manage Notification E-mails <= 1.8.5 - Missing Authorizationvirgial Manage Notification E-mails
- CVE-2023-6506WP 2FA <= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sendingmelapress WP 2FA – Two-factor authentication for WordPress
- CVE-2023-6446Calculated Fields Form <= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scriptingcodepeople Calculated Fields Form
- CVE-2023-6883Easy Social Feed <= 6.5.2 - Missing Authorization to Settings Modificationsjaved Easy Social Feed – Social Photos Gallery and Post Fe…
- CVE-2023-6223LearnPress <= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosurethimpress LearnPress – WordPress LMS Plugin for Create and…
- CVE-2023-6520WP 2FA – Two-factor authentication for WordPress <= 2.5.0 - Cross-Site Request Forgerymelapress WP 2FA – Two-factor authentication for WordPress
- CVE-2023-6630Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Referencesevenspark Contact Form 7 – Dynamic Text Extension
- CVE-2023-38267IBM Security Access Manager Appliance information disclosureIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2023-31001IBM Security Access Manager Container information disclosureIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2024-22195Jinja vulnerable to Cross-Site Scripting (XSS)pallets jinja · jinja2
- CVE-2024-22194cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration codeCyber-Domain-Ontology CDO-Utility-Local-UUID · case-utils +1
- CVE-2023-45171IBM AIX denial of serviceIBM AIX
- CVE-2023-45169IBM AIX denial of serviceIBM AIX
- CVE-2023-45173IBM AIX denial of serviceIBM AIX
- CVE-2023-45175IBM AIX denial of serviceIBM AIX
- CVE-2024-21667Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extractspimcore customer-data-framework · pimcore/customer-manageme…
- CVE-2024-21666Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates listpimcore customer-data-framework · pimcore/customer-manageme…
- CVE-2024-21665Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders listpimcore ecommerce-framework-bundle · pimcore/ecommerce-fram…
- CVE-2022-40361Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/log
- CVE-2023-37644SWFTools 0.9.2 772e55a allows attackers to trigger a large memory-allocation attempt via a crafted document, as demonstrated by pdf2swf.
- CVE-2023-50124Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials.
- CVE-2023-50125A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed st
- CVE-2023-50126Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical
- CVE-2023-50127Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication.
- CVE-2023-50128The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which
- CVE-2023-50129Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity t
- CVE-2023-51749ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip.
- CVE-2023-51750ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur.
- CVE-2023-52274member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header.