CVEs published January 12, 2024
128 CVEs were published on January 12, 2024: 20 critical, 37 high. 3 are now in CISA KEV.
- Published
- 128
- Critical
- 20
- High
- 37
- Medium
- 63
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 54
Most affected products
- Juniper Networks Junos OS
- 19
- Hongdian H8951-4G-ESP
- 10
- nvidia DGX A100
- 9
- GitLab
- 5
- code-projects Online Faculty Clearance
- 4
- Checkmk
- 3
- code-projects Dormitory Management System
- 3
- code-projects Employee Profile Management System
- 3
- code-projects Human Resource Integrated System
- 3
- discourse
- 3
Critical 20
- CVE-2023-51698Atril's CBT comic book parsing vulnerable to Remote Code Executionmate-desktop atril
- CVE-2024-22206@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)clerk javascript · @clerk/nextjs
- CVE-2023-31024CVEnvidia DGX A100
- CVE-2023-31030CVEnvidia DGX A100
- CVE-2023-31029CVEnvidia DGX A100
- CVE-2024-21887A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an autIvanti ICS · Ivanti IPS
- CVE-2023-49262Buffer overflow vulnerability in Cookie authentication fieldHongdian H8951-4G-ESP
- CVE-2023-49255Router console accessible without authenticationHongdian H8951-4G-ESP
- CVE-2023-49253Predefined root passwordHongdian H8951-4G-ESP
- CVE-2023-7028Weak Password Recovery Mechanism for Forgotten Password in GitLabGitLab
- CVE-2023-49569Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clientsgo-git · gopkg.in/src-d/go-git.v4 +1
- CVE-2024-21591Junos OS: SRX Series and EX Series: Security Vulnerability in J-web allows a preAuth Remote Code ExecutionJuniper Networks Junos OS
- CVE-2016-20021In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file bportage
- CVE-2022-48620uev (aka libuev) before 2.4.1 has a buffer overflow in epoll_wait if maxevents is a large number.
- CVE-2023-30014SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensit
- CVE-2023-30015SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensit
- CVE-2023-30016SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensit
- CVE-2023-37117A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP.
- CVE-2023-50919An issue was discovered on GL.iNet devices before version 4.5.0.
- CVE-2023-52026TOTOlink EX1800T V9.1.0cu.2112_B20220316 was discovered to contain a remote command execution (RCE) vulnerability via the telnet_enabled par
High 37
- CVE-2024-22142WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)Cozmoslabs Profile Builder Pro
- CVE-2024-0474code-projects Dormitory Management System login.php sql injectioncode-projects Dormitory Management System
- CVE-2023-49647Zoom Desktop Client for Windows - Improper Access ControlZoom Video Communications Zoom Desktop Client for Windows,…
- CVE-2023-42463wazuh-logcollector integer underflow local privilege escalationwazuh
- CVE-2023-48297Discourse vulnerable to unlimited mentioned users in message serializerdiscourse
- CVE-2023-31035CVEnvidia DGX A100
- CVE-2023-31032CVEnvidia DGX A100
- CVE-2023-31036CVEnvidia Triton Inference Server
- CVE-2023-46805An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to accIvanti ICS · Ivanti IPS
- CVE-2023-49261Sensitive authentication-related value accessible publiclyHongdian H8951-4G-ESP
- CVE-2023-49259Bruteforcing authentication cookie for a given userHongdian H8951-4G-ESP
- CVE-2023-49257Command execution using the certificate upload utilityHongdian H8951-4G-ESP
- CVE-2023-49256Predictable encryption passphrase used in publicly accessible configuration fileHongdian H8951-4G-ESP
- CVE-2023-49254Command injection in the network test toolsHongdian H8951-4G-ESP
- CVE-2023-4812Incorrect Authorization in GitLabGitLab
- CVE-2023-5356Incorrect Authorization in GitLabGitLab
- CVE-2023-49568Maliciously crafted Git server replies can cause DoS on go-git clientsgo-git · gopkg.in/src-d/go-git.v4 +1
- CVE-2023-6740Privilege escalation in jar_signatureCheckmk
- CVE-2023-6735Privilege escalation in mk_tsmCheckmk
- CVE-2023-31211Disabled automation users could still authenticateCheckmk
- CVE-2023-34061CVE-2023-34061 – Gorouter route pruningCloud Foundry Routing Release · Cloud Foundry CF deployment
- CVE-2023-6040An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf_tables: Reject tables of unsupported family)The Linux Kernel Organization linux
- CVE-2023-40250Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Hancom HCell on Windows allows Overflow Buffers.ThisHancom HCell
- CVE-2024-21616Junos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to failJuniper Networks Junos OS
- CVE-2024-21614Junos OS and Junos OS Evolved: A specific query via DREND causes rpd crashJuniper Networks Junos OS
- CVE-2024-21612Junos OS Evolved: Specific TCP traffic causes OFP core and restart of REJuniper Networks Junos OS Evolved
- CVE-2024-21611Junos OS and Junos OS Evolved: In a jflow scenario continuous route churn will cause a memory leak and eventually an rpd crashJuniper Networks Junos OS
- CVE-2024-21606Junos OS: SRX Series: When "tcp-encap" is configured and specific packets are received flowd will crashJuniper Networks Junos OS
- CVE-2024-21604Junos OS Evolved: A high rate of specific traffic will cause a complete system outageJuniper Networks Junos OS Evolved
- CVE-2024-21602Junos OS Evolved: ACX7024, ACX7100-32C and ACX7100-48L: Traffic stops when a specific IPv4 UDP packet is received by the REJuniper Networks Junos OS Evolved
- CVE-2024-21595Junos OS: EX4100, EX4400, EX4600, QFX5000 Series: A high rate of specific ICMP traffic will cause the PFE to hangJuniper Networks Junos OS
- CVE-2024-21589Paragon Active Assurance Control Center: Information disclosure vulnerabilityJuniper Networks Paragon Active Assurance
- CVE-2023-48166A directory traversal vulnerability in the SOAP Server integrated in Atos Unify OpenScape Voice V10 before V10R3.26.1 allows a remote attack
- CVE-2023-48909An issue was discovered in Jave2 version 3.3.1, allows attackers to execute arbitrary code via the FFmpeg function.
- CVE-2023-51806File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file.
- CVE-2023-51949Verydows v2.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /protected/controller/backend/role_controller
- CVE-2023-51978In PHPGurukul Art Gallery Management System v1.1, "Update Artist Image" functionality of "imageid" parameter is vulnerable to SQL Injection.
Medium, low and unrated 71
- CVE-2024-22137WordPress Constant Contact Forms by MailMunch Plugin <= 2.0.11 is vulnerable to Cross Site Scripting (XSS)Constant Contact Forms by MailMunch
- CVE-2024-0230A session management issue was addressed with improved checks.Apple Magic Keyboard Firmware
- CVE-2022-4962Apollo Configuration Center users improper authorizationApollo
- CVE-2024-0473code-projects Dormitory Management System comment.php sql injectioncode-projects Dormitory Management System
- CVE-2024-0472code-projects Dormitory Management System modifyuser.php information disclosurecode-projects Dormitory Management System
- CVE-2024-21639OOB Access in CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemorychromiumembedded cef
- CVE-2023-49801Lif Auth Server vulnerable to uncontrolled data in path expression Lif-Platforms Lif-Auth-Server
- CVE-2024-0471code-projects Human Resource Integrated System dec_service_credits.php sql injectioncode-projects Human Resource Integrated System
- CVE-2024-0470code-projects Human Resource Integrated System inc_service_credits.php sql injectioncode-projects Human Resource Integrated System
- CVE-2024-21654rubygems.org MFA Bypass through password reset function could allow account takeover rubygems.org
- CVE-2023-49099Discourse secure uploads accessible to guests even when login is requireddiscourse
- CVE-2024-21655Insufficient control of custom field value sizesdiscourse
- CVE-2023-49098Reaction data for user notifications exposed in Discourse-reactionsdiscourse-reactions
- CVE-2024-0469code-projects Human Resource Integrated System update_personal_info.php sql injectioncode-projects Human Resource Integrated System
- CVE-2024-0468code-projects Fighting Cock Information System new-father.php unrestricted uploadcode-projects Fighting Cock Information System
- CVE-2024-0467code-projects Employee Profile Management System edit_position_query.php cross site scriptingcode-projects Employee Profile Management System
- CVE-2010-10011Acritum Femitter Server path traversalAcritum Femitter Server
- CVE-2023-6683Qemu: vnc: null pointer dereference in qemu_clipboard_request()Red Hat Enterprise Linux
- CVE-2024-0466code-projects Employee Profile Management System file_table.php sql injectioncode-projects Employee Profile Management System
- CVE-2024-0465code-projects Employee Profile Management System download.php path traversalcode-projects Employee Profile Management System
- CVE-2023-31031CVEnvidia DGX A100
- CVE-2023-31025CVEnvidia DGX A100
- CVE-2023-31034CVEnvidia DGX A100
- CVE-2023-31033CVEnvidia DGX A100
- CVE-2024-0464code-projects Online Faculty Clearance HTTP GET Request delete_faculty.php sql injectioncode-projects Online Faculty Clearance
- CVE-2024-0463code-projects Online Faculty Clearance HTTP POST Request admin_view_info.php sql injectioncode-projects Online Faculty Clearance
- CVE-2024-0462code-projects Online Faculty Clearance HTTP POST Request designee_view_status.php sql injectioncode-projects Online Faculty Clearance
- CVE-2024-0461code-projects Online Faculty Clearance HTTP POST Request deactivate.php sql injectioncode-projects Online Faculty Clearance
- CVE-2023-28899Denial of Service via ECU reset serviceŠkoda Superb III
- CVE-2023-28898Head Unit Denial-of-Service via Apple CarPlay serviceJOYNEXT MIB3 Infotainment Unit
- CVE-2023-28897Hard-coded password for UDS servicesJOYNEXT MIB3 Infotainment Unit
- CVE-2024-0460code-projects Faculty Management System student-print.php sql injectioncode-projects Faculty Management System
- CVE-2024-0459Blood Bank & Donor Management request-received-bydonar.php sql injectionBlood Bank & Donor Management
- CVE-2023-49260Stored cross-site scripting vulnerabilityHongdian H8951-4G-ESP
- CVE-2023-49258Reflected cross-site scripting vulnerabilityHongdian H8951-4G-ESP
- CVE-2023-2030Improper Verification of Cryptographic Signature in GitLabGitLab
- CVE-2023-6955Missing Authorization in GitLabGitLab
- CVE-2023-0437MongoDB client C Driver may infinitely loop when validating certain BSON input dataMongoDB C Driver
- CVE-2024-22027Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a AYS Pro Plugins WordPress Quiz Maker Plugin
- CVE-2022-4961Weitong Mall OrderDao.xml sql injectionWeitong Mall
- CVE-2022-4960cloudfavorites favorites-web Nickname cross site scriptingcloudfavorites favorites-web
- CVE-2024-0454Security Vulnerability on Match-on-Chip FPR ArchitectureELAN DELL Inspiron
- CVE-2024-21617Junos OS: BGP flap on NSR-enabled devices causes memory leakJuniper Networks Junos OS
- CVE-2024-21613Junos OS and Junos OS Evolved: A link flap causes patroot memory leak which leads to rpd crashJuniper Networks Junos OS
- CVE-2024-21607Junos OS: MX Series and EX9200 Series: If the "tcp-reset" option used in an IPv6 filter, matched packets are accepted instead of rejectedJuniper Networks Junos OS
- CVE-2024-21603Junos OS: MX Series: Gathering statistics in a scaled SCU/DCU configuration will lead to a device crashJuniper Networks Junos OS
- CVE-2024-21601Junos OS: SRX Series: Due to an error in processing TCP events flowd will crashJuniper Networks Junos OS
- CVE-2024-21600Junos OS: PTX Series: In an FTI scenario MPLS packets hitting reject next-hop will cause a host path wedge conditionJuniper Networks Junos OS
- CVE-2024-21599Junos OS: MX Series: MPC3E memory leak with PTP configurationJuniper Networks Junos OS
- CVE-2024-21597Junos OS: MX Series: In an AF scenario traffic can bypass configured lo0 firewall filtersJuniper Networks Junos OS
- CVE-2024-21596Junos OS and Junos OS Evolved: A specific BGP UPDATE message will cause a crash in the backup Routing Engine in NSR-enabled devicesJuniper Networks Junos OS
- CVE-2024-21594Junos OS: SRX 5000 Series: Repeated execution of a specific CLI command causes a flowd crashJuniper Networks Junos OS
- CVE-2024-21587Junos OS: MX Series: Memory leak in bbe-smgd process if BFD liveness detection for DHCP subscribers is enabledJuniper Networks Junos OS
- CVE-2024-21585Junos OS and Junos OS Evolved: BGP session flaps on NSR-enabled devices can cause rpd crashJuniper Networks Junos OS
- CVE-2023-36842Junos OS: jdhcpd will hang on receiving a specific DHCP packetJuniper Networks Junos OS
- CVE-2022-48619An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10.
- CVE-2023-40362An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023.
- CVE-2023-50920An issue was discovered on GL.iNet devices before version 4.5.0.
- CVE-2023-51790Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the
- CVE-2023-52339In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing.
- CVE-2024-22492A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbicom.jfinal:jfinal
- CVE-2024-22493A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbicom.jfinal:jfinal
- CVE-2024-22494A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbit
- CVE-2024-23171An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before
- CVE-2024-23172An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.
- CVE-2024-23173An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2.mediawiki/cargo
- CVE-2024-23174An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40
- CVE-2024-23177An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2.
- CVE-2024-23178An issue was discovered in the Phonos extension in MediaWiki before 1.40.2.
- CVE-2024-23179An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2.
- CVE-2024-23301Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB_RESCUE=y.