# CVEs published 2024-01-11

139 CVEs were published on January 11, 2024: 20 critical, 27 high. Days are UTC.

- [CVE-2024-21982](https://cve.now/CVE-2024-21982.md): CVE-2024-21982 Information Disclosure Vulnerability in ONTAP 9 (CVSS 4.8, NetApp ONTAP)
- [CVE-2024-0443](https://cve.now/CVE-2024-0443.md): Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline. (CVSS 5.5, kernel · Red Hat Enterprise Linux)
- [CVE-2024-21337](https://cve.now/CVE-2024-21337.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 5.2, Microsoft Edge)
- [CVE-2024-20675](https://cve.now/CVE-2024-20675.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 6.3, Microsoft Edge)
- [CVE-2024-0426](https://cve.now/CVE-2024-0426.md): ForU CMS cms\_template.php sql injection (CVSS 6.3, ForU CMS)
- [CVE-2023-7226](https://cve.now/CVE-2023-7226.md): meetyoucrop big-whale Admin Module all.api improper ownership management (CVSS 6.3, meetyoucrop big-whale)
- [CVE-2022-4959](https://cve.now/CVE-2022-4959.md): qkmc-rk redbbs Nickname cross site scripting (CVSS 3.5, qkmc-rk redbbs)
- [CVE-2024-0425](https://cve.now/CVE-2024-0425.md): ForU CMS password recovery (CVSS 5.3, ForU CMS)
- [CVE-2024-22198](https://cve.now/CVE-2024-22198.md): Authenticated (user role) arbitrary command execution by modifying \`start\_cmd\` setting (GHSL-2023-268) (CVSS 7.1, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2024-0424](https://cve.now/CVE-2024-0424.md): CodeAstro Simple Banking System Create a User Page createuser.php cross site scripting (CVSS 3.5, CodeAstro Simple Banking System)
- [CVE-2024-0423](https://cve.now/CVE-2024-0423.md): CodeAstro Online Food Ordering System dishes.php cross site scripting (CVSS 3.5, CodeAstro Online Food Ordering System)
- [CVE-2024-22196](https://cve.now/CVE-2024-22196.md): Authenticated (user role) SQL injection in \`OrderAndPaginate\` (GHSL-2023-270) (CVSS 7.0, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2024-0422](https://cve.now/CVE-2024-0422.md): CodeAstro POS and Inventory Management System New Item Creation Page new\_item cross site scripting (CVSS 3.5, CodeAstro POS and Inventory Management System)
- [CVE-2024-0419](https://cve.now/CVE-2024-0419.md): Jasper httpdx HTTP POST Request denial of service (CVSS 5.3, Jasper httpdx)
- [CVE-2024-0418](https://cve.now/CVE-2024-0418.md): iSharer and upRedSun File Sharing Wizard GET Request denial of service (CVSS 5.3, iSharer and upRedSun File Sharing Wizard)
- [CVE-2024-0417](https://cve.now/CVE-2024-0417.md): DeShang DSShop MemberAuth.php path traversal (CVSS 5.4, DeShang DSShop)
- [CVE-2024-22197](https://cve.now/CVE-2024-22197.md): Authenticated (user role) remote command execution by modifying \`nginx\` settings (GHSL-2023-269) (CVSS 7.7, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2024-22199](https://cve.now/CVE-2024-22199.md): Django Template Engine Vulnerable to XSS (CVSS 9.3, gofiber template · github.com/gofiber/template/django/v3)
- [CVE-2024-0416](https://cve.now/CVE-2024-0416.md): DeShang DSMall MemberAuth.php path traversal (CVSS 5.4, DeShang DSMall)
- [CVE-2024-0415](https://cve.now/CVE-2024-0415.md): DeShang DSMall Image URL TaobaoExport.php access control (CVSS 6.3, DeShang DSMall)
- [CVE-2024-0414](https://cve.now/CVE-2024-0414.md): DeShang DSCMS install.php access control (CVSS 5.3, DeShang DSCMS)
- [CVE-2024-0413](https://cve.now/CVE-2024-0413.md): DeShang DSKMS install.php access control (CVSS 5.3, DeShang DSKMS)
- [CVE-2024-0412](https://cve.now/CVE-2024-0412.md): DeShang DSShop HTTP GET Request install.php access control (CVSS 5.3, DeShang DSShop)
- [CVE-2024-0411](https://cve.now/CVE-2024-0411.md): DeShang DSMall HTTP GET Request install.php access control (CVSS 5.3, DeShang DSMall)
- [CVE-2024-0429](https://cve.now/CVE-2024-0429.md): Buffer overflow vulnerability on Hex Workshop (CVSS 7.3, Hex Workshop)
- [CVE-2023-5118](https://cve.now/CVE-2023-5118.md): Stored cross-site scripting vulnerability in Kofax Capture software (CVSS 5.4, Kofax Capture)
- [CVE-2023-6554](https://cve.now/CVE-2023-6554.md): Missing authorisation in TCExam (CVSS 6.5, Tecnick.com TCExam)
- [CVE-2023-6938](https://cve.now/CVE-2023-6938.md): Oxygen Builder \<= 4.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field (CVSS 6.4, Oxygen Builder)
- [CVE-2023-6242](https://cve.now/CVE-2023-6242.md): EventON - WordPress Virtual Event Calendar Plugin Pro \<= 4.5.4 & Free \<= 2.2.7 - Cross-Site Request Forgery via evo\_eventpost\_update\_meta (CVSS 6.5, ashanjay EventON – Events Calendar · EventON (Pro) - WordPr…)
- [CVE-2023-6244](https://cve.now/CVE-2023-6244.md): EventON - WordPress Virtual Event Calendar Plugin \<= 4.5.4 (Pro) & \<= 2.2.8 (Free) - Cross-Site Request Forgery via save\_virtual\_event\_settings (CVSS 6.5, ashanjay EventON – Events Calendar · EventON (Pro) - WordPr…)
- [CVE-2023-20573](https://cve.now/CVE-2023-20573.md): Debug Exception Delivery in Secure Nested Paging (CVSS 3.2, 3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Processors)
- [CVE-2022-4958](https://cve.now/CVE-2022-4958.md): qkmc-rk redbbs Post cross site scripting (CVSS 3.5, qkmc-rk redbbs)
- [CVE-2023-6582](https://cve.now/CVE-2023-6582.md): ElementsKit Lite \<= 3.0.3 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, roxnor ElementsKit Elementor Addons – Advanced Widgets & Te…)
- [CVE-2023-4960](https://cve.now/CVE-2023-4960.md): WCFM Marketplace \<= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wclovers WCFM Marketplace – Multivendor Marketplace for Woo…)
- [CVE-2023-7071](https://cve.now/CVE-2023-7071.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 4.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2023-7070](https://cve.now/CVE-2023-7070.md): Email Encoder – Protect Email Addresses and Phone Numbers \<= 2.1.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, onlineoptimisation Email Encoder – Protect Email Addresses…)
- [CVE-2023-6504](https://cve.now/CVE-2023-6504.md): Profile Builder \<= 3.10.7 - Insecure Direct Object Reference to Sensitive Information Exposure via user\_meta Shortcode (CVSS 4.3, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2023-5504](https://cve.now/CVE-2023-5504.md): BackWPup \<= 4.0.1 - Authenticated (Administrator+) Directory Traversal (CVSS 8.7, wp\_media BackWPup – WordPress Backup & Restore Plugin)
- [CVE-2023-6875](https://cve.now/CVE-2023-6875.md): POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress \<= 2.8.7 - Authorization Bypass via type connect-app API (CVSS 9.8, saadiqbal Post SMTP – Complete Email Deliverability and SMT…)
- [CVE-2023-4247](https://cve.now/CVE-2023-4247.md): GiveWP \<= 2.33.3 - Cross-Site Request Forgery to plugin deactivation (CVSS 5.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2023-5691](https://cve.now/CVE-2023-5691.md): The Chatbot for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in version 2.3.9 due to insuf (CVSS 4.4, collectchat Collect.chat Chatbot ⚡️)
- [CVE-2023-4246](https://cve.now/CVE-2023-4246.md): GiveWP \<= 2.33.3 - Cross-Site Request Forgery to plugin installation (CVSS 4.3, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2023-6598](https://cve.now/CVE-2023-6598.md): SpeedyCache \<= 1.1.3 - Missing Authorization to Plugin Options Update (CVSS 4.3, softaculous SpeedyCache – Cache, Optimization, Performance)
- [CVE-2023-6751](https://cve.now/CVE-2023-6751.md): Hostinger \<= 1.9.7 - Missing Authorization to Maintenance Mode Activation (CVSS 7.3, Hostinger Tools)
- [CVE-2023-6561](https://cve.now/CVE-2023-6561.md): Featured Image from URL (FIFU) \<= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via featured image alt text (CVSS 6.4, marceljm Featured Image from URL)
- [CVE-2023-6638](https://cve.now/CVE-2023-6638.md): GTG Product Feed for Shopping \<= 1.2.4 - Missing Authorization to Unauthenticated Plugin Settings Update (CVSS 6.5, wpopal GG Woo Feed for WooCommerce Shopping Feed on Google…)
- [CVE-2023-6737](https://cve.now/CVE-2023-6737.md): Enable Media Replace \<= 4.1.4 - Reflected Cross-Site Scripting (CVSS 4.7, shortpixel Enable Media Replace)
- [CVE-2023-6782](https://cve.now/CVE-2023-6782.md): AMP for WP – Accelerated Mobile Pages \<= 1.0.92 - Authenticated (Contributor+) Cross-Site Scripting via Shortcode (CVSS 6.4, mohammed\_kaludi AMP for WP – Accelerated Mobile Pages)
- [CVE-2023-7048](https://cve.now/CVE-2023-7048.md): My Sticky Bar \<= 2.6.6 - Cross-Site Request Forgery to Sensitive Information Exposure (CVSS 3.1, premio My Sticky Bar – Floating Notification Bar & Sticky H…)
- [CVE-2023-6990](https://cve.now/CVE-2023-6990.md): Weaver Xtreme \<= 6.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, wpweaver Weaver Xtreme)
- [CVE-2023-7019](https://cve.now/CVE-2023-7019.md): LightStart – Maintenance Mode, Coming Soon and Landing Page Builder \<= 2.6.8 - Missing Authorization (CVSS 4.3, themeisle LightStart – Maintenance Mode, Coming Soon and La…)
- [CVE-2023-6316](https://cve.now/CVE-2023-6316.md): MW WP Form \<= 5.0.1 - Unauthenticated Arbitrary File Upload (CVSS 9.8, inc2734 MW WP Form)
- [CVE-2023-6220](https://cve.now/CVE-2023-6220.md): Piotnet Forms \<= 1.0.28 - Unauthenticated Arbitrary File Upload (CVSS 8.1, piotnetdotcom Piotnet Forms)
- [CVE-2023-6583](https://cve.now/CVE-2023-6583.md): Import and export users and customers \<= 1.24.2 - Authenticated(Administrator+) Directory Traversal via Recurring Import Functionality (CVSS 6.6, carazo Import and export users and customers)
- [CVE-2023-6645](https://cve.now/CVE-2023-6645.md): Post Grid Combo – 36+ Gutenberg Blocks \<= 2.2.64 - Authenticated (Contributor+) Cross-Site Scripting (CVSS 6.4, pickplugins Post Grid)
- [CVE-2023-6934](https://cve.now/CVE-2023-6934.md): Limit Login Attempts Reloaded \<= 2.25.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, wpchefgadget Limit Login Attempts Reloaded – Login Security…)
- [CVE-2023-6556](https://cve.now/CVE-2023-6556.md): FOX – Currency Switcher Professional for WooCommerce \<= 1.4.1.6 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 5.4, realmag777 FOX – Currency Switcher Professional for WooComm…)
- [CVE-2023-6636](https://cve.now/CVE-2023-6636.md): Greenshift – animation and page builder blocks \<= 7.6.2 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, wpsoul Greenshift – animation and page builder blocks)
- [CVE-2023-6878](https://cve.now/CVE-2023-6878.md): Slick Social Share Buttons \<= 2.4.11 - Authenticated (Subscriber+) Arbitrary Option Update (CVSS 8.8, remix4 Slick Social Share Buttons)
- [CVE-2023-6828](https://cve.now/CVE-2023-6828.md): ARForms \<= 1.5.8 - Unauthenticated Stored Cross-Site Scripting via arf\_http\_referrer\_url (CVSS 7.2, reputeinfosystems Contact Form, Survey, Quiz & Popup Form B…)
- [CVE-2023-6567](https://cve.now/CVE-2023-6567.md): LearnPress \<= 4.2.5.7 - Unauthenticated SQL Injection via order\_by (CVSS 9.8, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2023-4962](https://cve.now/CVE-2023-4962.md): Video PopUp \<= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, alobaidi Video PopUp)
- [CVE-2023-6994](https://cve.now/CVE-2023-6994.md): List category posts \<= 0.89.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, fernandobt List category posts)
- [CVE-2023-6637](https://cve.now/CVE-2023-6637.md): CAOS | Host Google Analytics Locally \<= 4.7.14 - Missing Authorization to Unauthenticated Plugin Settings Update (CVSS 6.5, daanvandenbergh CAOS | Host Google Analytics Locally)
- [CVE-2023-6558](https://cve.now/CVE-2023-6558.md): Export and Import Users and Customers \<= 2.4.8 - Authenticated (Shop Manager+) Arbitrary File Upload (CVSS 7.2, webtoffee Export and Import Users and Customers)
- [CVE-2023-6776](https://cve.now/CVE-2023-6776.md): 3D Flipbook \<= 1.15.2 - Authenticated (Contributor+) Cross-Site Scripting via Ready Function (CVSS 6.4, iberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer…)
- [CVE-2023-6979](https://cve.now/CVE-2023-6979.md): Customer Reviews for WooCommerce \<= 5.38.9 - Authenticated (Author+) Arbitrary File Upload (CVSS 8.8, ivole Customer Reviews for WooCommerce)
- [CVE-2023-6369](https://cve.now/CVE-2023-6369.md): Export WP Page to Static HTML/CSS \<= 2.1.9 - Missing Authorization via Multiple AJAX Actions (CVSS 5.4, recorp Export WordPress Pages to Static HTML & PDF — Static…)
- [CVE-2023-6624](https://cve.now/CVE-2023-6624.md): Import and export users and customers \<= 1.24.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 4.9, carazo Import and export users and customers)
- [CVE-2023-6742](https://cve.now/CVE-2023-6742.md): Envira Gallery Lite \<= 1.8.7.2 - Missing Authorization to Gallery Modification via envira\_gallery\_insert\_images (CVSS 4.3, smub Envira Gallery – Image Photo Gallery, Albums, Video Ga…)
- [CVE-2023-6855](https://cve.now/CVE-2023-6855.md): Paid Memberships Pro \<= 2.12.5 - Missing Authorization via API (CVSS 5.3, strangerstudios Paid Memberships Pro – Content Restriction,…)
- [CVE-2023-6882](https://cve.now/CVE-2023-6882.md): Simple Membership \<= 4.3.8 - Reflected Cross-Site Scripting Vulnerability via environment\_mode (CVSS 6.1, wpinsider-1 Simple Membership)
- [CVE-2023-6988](https://cve.now/CVE-2023-6988.md): Colibri Page Builder \<= 1.0.239 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, extendthemes Colibri Page Builder)
- [CVE-2023-4248](https://cve.now/CVE-2023-4248.md): GiveWP \<= 2.33.3 - Cross-Site Request Forgery to Stripe Integration Deletion (CVSS 5.4, stellarwp GiveWP – Donation Plugin and Fundraising Platform)
- [CVE-2023-4372](https://cve.now/CVE-2023-4372.md): LiteSpeed Cache \<= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, litespeedtech LiteSpeed Cache)
- [CVE-2023-6781](https://cve.now/CVE-2023-6781.md): Orbit Fox Companion \<= 2.10.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via custom fields (CVSS 6.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2023-6924](https://cve.now/CVE-2023-6924.md): Photo Gallery by 10Web \<= 1.8.18 - Authenticated (Administrator+) Stored Cross-Site Scripting via Widget (CVSS 4.4, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2023-6634](https://cve.now/CVE-2023-6634.md): LearnPress \<= 4.2.5.7 - Command Injection (CVSS 8.1, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2023-6684](https://cve.now/CVE-2023-6684.md): Ibtana – WordPress Website Builder \<= 1.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, vowelweb Ibtana – WordPress Website Builder)
- [CVE-2023-6266](https://cve.now/CVE-2023-6266.md): Backup Migration \<= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure (CVSS 7.5, inisev BackupBliss – Backup & Migration with Free Cloud Sto…)
- [CVE-2023-6632](https://cve.now/CVE-2023-6632.md): Happy Addons for Elementor \<= 3.9.1.1 - Reflected Cross-Site Scripting (CVSS 6.1, weDevs Happy Addons for Elementor Pro · thehappymonster Hap…)
- [CVE-2023-6496](https://cve.now/CVE-2023-6496.md): Manage Notification E-mails \<= 1.8.5 - Missing Authorization (CVSS 5.3, virgial Manage Notification E-mails)
- [CVE-2024-0252](https://cve.now/CVE-2024-0252.md): Remote code execution (CVSS 8.8, ManageEngine ADSelfService Plus)
- [CVE-2023-6699](https://cve.now/CVE-2023-6699.md): WP Compress – Image Optimizer \[All-In-One\] \<= 6.10.33 - Unauthenticated Directory Traversal via css (CVSS 9.1, aresit WP Compress – Instant Performance & Speed Optimizati…)
- [CVE-2023-6506](https://cve.now/CVE-2023-6506.md): WP 2FA \<= 2.5.0 - Insecure Direct Object Reference to Arbitrary Email Sending (CVSS 4.3, melapress WP 2FA – Two-factor authentication for WordPress)
- [CVE-2023-6446](https://cve.now/CVE-2023-6446.md): Calculated Fields Form \<= 1.2.40 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, codepeople Calculated Fields Form)
- [CVE-2023-6883](https://cve.now/CVE-2023-6883.md): Easy Social Feed \<= 6.5.2 - Missing Authorization to Settings Modification (CVSS 4.3, sjaved Easy Social Feed – Social Photos Gallery and Post Fe…)
- [CVE-2023-6223](https://cve.now/CVE-2023-6223.md): LearnPress \<= 4.2.5.7 - Insecure Direct Object Reference to Information Disclosure (CVSS 4.3, thimpress LearnPress – WordPress LMS Plugin for Create and…)
- [CVE-2023-6520](https://cve.now/CVE-2023-6520.md): WP 2FA – Two-factor authentication for WordPress \<= 2.5.0 - Cross-Site Request Forgery (CVSS 4.3, melapress WP 2FA – Two-factor authentication for WordPress)
- [CVE-2024-21637](https://cve.now/CVE-2024-21637.md): XSS in Authentik via JavaScript-URI as Redirect URI and form\_post Response Mode (CVSS 7.7, goauthentik authentik)
- [CVE-2024-21669](https://cve.now/CVE-2024-21669.md): Hyperledger Aries Cloud Agent Python result of presentation verification not checked for LDP-VC (CVSS 9.9, hyperledger aries-cloudagent-python · aries-cloudagent)
- [CVE-2023-6630](https://cve.now/CVE-2023-6630.md): Contact Form 7 – Dynamic Text Extension \<= 4.1.0 - Insecure Direct Object Reference (CVSS 4.3, sevenspark Contact Form 7 – Dynamic Text Extension)
- [CVE-2023-5448](https://cve.now/CVE-2023-5448.md): WP Register Profile With Shortcode \<= 3.5.9 - Cross-Site Request Forgery to User Password Reset (CVSS 8.8, avimegladon WP Register Profile With Shortcode)
- [CVE-2023-38267](https://cve.now/CVE-2023-38267.md): IBM Security Access Manager Appliance information disclosure (CVSS 6.2, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2023-31001](https://cve.now/CVE-2023-31001.md): IBM Security Access Manager Container information disclosure (CVSS 5.1, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2024-22195](https://cve.now/CVE-2024-22195.md): Jinja vulnerable to Cross-Site Scripting (XSS) (CVSS 5.4, pallets jinja · jinja2)
- [CVE-2023-31003](https://cve.now/CVE-2023-31003.md): IBM Security Access Manager Container privilege escalation (CVSS 8.4, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2024-22194](https://cve.now/CVE-2024-22194.md): cdo-local-uuid vulnerable to insertion of artifact derived from developer's Present Working Directory into demonstration code (CVSS 2.2, Cyber-Domain-Ontology CDO-Utility-Local-UUID · case-utils +1)
- [CVE-2023-45171](https://cve.now/CVE-2023-45171.md): IBM AIX denial of service (CVSS 6.2, IBM AIX)
- [CVE-2023-45169](https://cve.now/CVE-2023-45169.md): IBM AIX denial of service (CVSS 6.2, IBM AIX)
- [CVE-2023-45173](https://cve.now/CVE-2023-45173.md): IBM AIX denial of service (CVSS 6.2, IBM AIX)
- [CVE-2023-45175](https://cve.now/CVE-2023-45175.md): IBM AIX denial of service (CVSS 6.2, IBM AIX)
- [CVE-2024-22190](https://cve.now/CVE-2024-22190.md): Untrusted search path under some conditions on Windows allows arbitrary code execution (CVSS 7.8, gitpython-developers GitPython · gitpython)
- [CVE-2024-21667](https://cve.now/CVE-2024-21667.md): Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access GDPR extracts (CVSS 6.5, pimcore customer-data-framework · pimcore/customer-manageme…)
- [CVE-2024-21666](https://cve.now/CVE-2024-21666.md): Pimcore Customer Data Framework Improper Access Control allows unprivileged user to access customers duplicates list (CVSS 6.5, pimcore customer-data-framework · pimcore/customer-manageme…)
- [CVE-2024-21665](https://cve.now/CVE-2024-21665.md): Pimcore Ecommerce Framework Bundle Improper Access Control allows unprivileged user to access back-office orders list (CVSS 4.3, pimcore ecommerce-framework-bundle · pimcore/ecommerce-fram…)
- [CVE-2022-40361](https://cve.now/CVE-2022-40361.md): Cross Site Scripting Vulnerability in Elite CRM v1.2.11 allows attacker to execute arbitrary code via the language parameter to the /ngs/log (CVSS 6.1)
- [CVE-2023-37644](https://cve.now/CVE-2023-37644.md): SWFTools 0.9.2 772e55a allows attackers to trigger a large memory-allocation attempt via a crafted document, as demonstrated by pdf2swf. (CVSS 5.5)
- [CVE-2023-46474](https://cve.now/CVE-2023-46474.md): File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uplo (CVSS 7.2)
- [CVE-2023-50123](https://cve.now/CVE-2023-50123.md): The number of attempts to bring the Hozard Alarm system (alarmsystemen) v1.0 to a disarmed state is not limited. (CVSS 8.1)
- [CVE-2023-50124](https://cve.now/CVE-2023-50124.md): Flient Smart Door Lock v1.0 is vulnerable to Use of Default Credentials. (CVSS 6.8)
- [CVE-2023-50125](https://cve.now/CVE-2023-50125.md): A default engineer password set on the Hozard alarm system (Alarmsysteem) v1.0 allows an attacker to bring the alarm system to a disarmed st (CVSS 5.9)
- [CVE-2023-50126](https://cve.now/CVE-2023-50126.md): Missing encryption in the RFID tags of the Hozard alarm system (Alarmsysteem) v1.0 allow attackers to create a cloned tag via brief physical (CVSS 6.5)
- [CVE-2023-50127](https://cve.now/CVE-2023-50127.md): Hozard alarm system (Alarmsysteem) v1.0 is vulnerable to Improper Authentication. (CVSS 5.9)
- [CVE-2023-50128](https://cve.now/CVE-2023-50128.md): The remote keyless system of the Hozard alarm system (alarmsystemen) v1.0 sends an identical radio frequency signal for each request, which (CVSS 5.3)
- [CVE-2023-50129](https://cve.now/CVE-2023-50129.md): Missing encryption in the NFC tags of the Flient Smart Door Lock v1.0 allows attackers to create a cloned tag via brief physical proximity t (CVSS 6.5)
- [CVE-2023-50159](https://cve.now/CVE-2023-50159.md): In ScaleFusion (Windows Desktop App) agent 10.5.2, Kiosk mode application restrictions can be bypassed allowing arbitrary code to be execute (CVSS 8.8)
- [CVE-2023-50671](https://cve.now/CVE-2023-50671.md): In exiftags 1.01, nikon\_prop1 in nikon.c has a heap-based buffer overflow (write of size 28) because snprintf can write to an unexpected add (CVSS 7.8)
- [CVE-2023-51073](https://cve.now/CVE-2023-51073.md): An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to execute arbitrary code via the Firmware Update Script at /etc/init.d/upda (CVSS 8.1)
- [CVE-2023-51350](https://cve.now/CVE-2023-51350.md): A spoofing attack in ujcms v.8.0.2 allows a remote attacker to obtain sensitive information and execute arbitrary code via a crafted script (CVSS 9.8)
- [CVE-2023-51748](https://cve.now/CVE-2023-51748.md): ScaleFusion 10.5.2 does not properly limit users to the Edge application because Ctrl-O and Ctrl-S can be used. (CVSS 8.8)
- [CVE-2023-51749](https://cve.now/CVE-2023-51749.md): ScaleFusion 10.5.2 does not properly limit users to the Edge application because a search can be made from a tooltip. (no CVSS)
- [CVE-2023-51750](https://cve.now/CVE-2023-51750.md): ScaleFusion 10.5.2 does not properly limit users to the Edge application because file downloads can occur. (no CVSS)
- [CVE-2023-51751](https://cve.now/CVE-2023-51751.md): ScaleFusion 10.5.2 does not properly limit users to the Edge application because Alt-F4 can be used. (CVSS 7.3)
- [CVE-2023-51984](https://cve.now/CVE-2023-51984.md): D-Link DIR-822+ V1.0.2 was found to contain a command injection in SetStaticRouteSettings function. (CVSS 9.8)
- [CVE-2023-51987](https://cve.now/CVE-2023-51987.md): D-Link DIR-822+ V1.0.2 contains a login bypass in the HNAP1 interface, which allows attackers to log in to administrator accounts with empty (CVSS 9.8)
- [CVE-2023-52027](https://cve.now/CVE-2023-52027.md): TOTOlink A3700R v9.1.2u.5822\_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the NTPSyncWithHost func (CVSS 9.8)
- [CVE-2023-52028](https://cve.now/CVE-2023-52028.md): TOTOlink A3700R v9.1.2u.5822\_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setTracerouteCfg fun (CVSS 9.8)
- [CVE-2023-52029](https://cve.now/CVE-2023-52029.md): TOTOlink A3700R v9.1.2u.5822\_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setDiagnosisCfg func (CVSS 9.8)
- [CVE-2023-52030](https://cve.now/CVE-2023-52030.md): TOTOlink A3700R v9.1.2u.5822\_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the setOpModeCfg functio (CVSS 9.8)
- [CVE-2023-52031](https://cve.now/CVE-2023-52031.md): TOTOlink A3700R v9.1.2u.5822\_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the UploadFirmwareFile f (CVSS 9.8)
- [CVE-2023-52032](https://cve.now/CVE-2023-52032.md): TOTOlink EX1200T V4.1.2cu.5232\_B20210713 was discovered to contain a remote command execution (RCE) vulnerability via the "main" function. (CVSS 9.8)
- [CVE-2023-52274](https://cve.now/CVE-2023-52274.md): member/index/register.html in YzmCMS 6.5 through 7.0 allows XSS via the Referer HTTP header. (CVSS 6.1)
- [CVE-2024-22942](https://cve.now/CVE-2024-22942.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 was discovered to contain a command injection vulnerability via the hostName parameter in the setWan (CVSS 9.8)
- [CVE-2024-23057](https://cve.now/CVE-2024-23057.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 was discovered to contain a command injection vulnerability via the tz parameter in the setNtpCfg fu (CVSS 8.8)
- [CVE-2024-23058](https://cve.now/CVE-2024-23058.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 was discovered to contain a command injection vulnerability via the pass parameter in the setTr069Cf (CVSS 9.8)
- [CVE-2024-23059](https://cve.now/CVE-2024-23059.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 was discovered to contain a command injection vulnerability via the username parameter in the setDdn (CVSS 9.8)
- [CVE-2024-23060](https://cve.now/CVE-2024-23060.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 was discovered to contain a command injection vulnerability via the ip parameter in the setDmzCfg fu (CVSS 9.8)
- [CVE-2024-23061](https://cve.now/CVE-2024-23061.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 was discovered to contain a command injection vulnerability via the minute parameter in the setSched (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.