# CVEs published 2024-01-12

128 CVEs were published on January 12, 2024: 20 critical, 37 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2024-22137](https://cve.now/CVE-2024-22137.md): WordPress Constant Contact Forms by MailMunch Plugin \<= 2.0.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Constant Contact Forms by MailMunch)
- [CVE-2024-22142](https://cve.now/CVE-2024-22142.md): WordPress Profile Builder Pro Plugin \<= 3.10.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Cozmoslabs Profile Builder Pro)
- [CVE-2024-0230](https://cve.now/CVE-2024-0230.md): A session management issue was addressed with improved checks. (CVSS 2.4, Apple Magic Keyboard Firmware)
- [CVE-2024-0474](https://cve.now/CVE-2024-0474.md): code-projects Dormitory Management System login.php sql injection (CVSS 7.3, code-projects Dormitory Management System)
- [CVE-2022-4962](https://cve.now/CVE-2022-4962.md): Apollo Configuration Center users improper authorization (CVSS 4.3, Apollo)
- [CVE-2023-49647](https://cve.now/CVE-2023-49647.md): Zoom Desktop Client for Windows - Improper Access Control (CVSS 8.8, Zoom Video Communications Zoom Desktop Client for Windows,…)
- [CVE-2024-0473](https://cve.now/CVE-2024-0473.md): code-projects Dormitory Management System comment.php sql injection (CVSS 6.3, code-projects Dormitory Management System)
- [CVE-2024-0472](https://cve.now/CVE-2024-0472.md): code-projects Dormitory Management System modifyuser.php information disclosure (CVSS 3.5, code-projects Dormitory Management System)
- [CVE-2024-21639](https://cve.now/CVE-2024-21639.md): OOB Access in CefLayeredWindowUpdaterOSR::OnAllocatedSharedMemory (CVSS 5.3, chromiumembedded cef)
- [CVE-2023-49801](https://cve.now/CVE-2023-49801.md): Lif Auth Server vulnerable to uncontrolled data in path expression (CVSS 4.2, Lif-Platforms Lif-Auth-Server)
- [CVE-2024-0471](https://cve.now/CVE-2024-0471.md): code-projects Human Resource Integrated System dec\_service\_credits.php sql injection (CVSS 6.3, code-projects Human Resource Integrated System)
- [CVE-2024-0470](https://cve.now/CVE-2024-0470.md): code-projects Human Resource Integrated System inc\_service\_credits.php sql injection (CVSS 6.3, code-projects Human Resource Integrated System)
- [CVE-2024-21654](https://cve.now/CVE-2024-21654.md): rubygems.org MFA Bypass through password reset function could allow account takeover (CVSS 4.8, rubygems.org)
- [CVE-2023-42463](https://cve.now/CVE-2023-42463.md): wazuh-logcollector integer underflow local privilege escalation (CVSS 7.4, wazuh)
- [CVE-2023-49099](https://cve.now/CVE-2023-49099.md): Discourse secure uploads accessible to guests even when login is required (CVSS 3.1, discourse)
- [CVE-2024-21655](https://cve.now/CVE-2024-21655.md): Insufficient control of custom field value sizes (CVSS 4.3, discourse)
- [CVE-2023-49098](https://cve.now/CVE-2023-49098.md): Reaction data for user notifications exposed in Discourse-reactions (CVSS 3.5, discourse-reactions)
- [CVE-2023-48297](https://cve.now/CVE-2023-48297.md): Discourse vulnerable to unlimited mentioned users in message serializer (CVSS 8.6, discourse)
- [CVE-2024-0469](https://cve.now/CVE-2024-0469.md): code-projects Human Resource Integrated System update\_personal\_info.php sql injection (CVSS 6.3, code-projects Human Resource Integrated System)
- [CVE-2024-0468](https://cve.now/CVE-2024-0468.md): code-projects Fighting Cock Information System new-father.php unrestricted upload (CVSS 6.3, code-projects Fighting Cock Information System)
- [CVE-2023-51698](https://cve.now/CVE-2023-51698.md): Atril's CBT comic book parsing vulnerable to Remote Code Execution (CVSS 9.6, mate-desktop atril)
- [CVE-2024-22206](https://cve.now/CVE-2024-22206.md): @clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR) (CVSS 9.1, clerk javascript · @clerk/nextjs)
- [CVE-2024-0467](https://cve.now/CVE-2024-0467.md): code-projects Employee Profile Management System edit\_position\_query.php cross site scripting (CVSS 3.5, code-projects Employee Profile Management System)
- [CVE-2010-10011](https://cve.now/CVE-2010-10011.md): Acritum Femitter Server path traversal (CVSS 4.3, Acritum Femitter Server)
- [CVE-2023-6683](https://cve.now/CVE-2023-6683.md): Qemu: vnc: null pointer dereference in qemu\_clipboard\_request() (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2024-0466](https://cve.now/CVE-2024-0466.md): code-projects Employee Profile Management System file\_table.php sql injection (CVSS 5.5, code-projects Employee Profile Management System)
- [CVE-2024-0465](https://cve.now/CVE-2024-0465.md): code-projects Employee Profile Management System download.php path traversal (CVSS 3.5, code-projects Employee Profile Management System)
- [CVE-2023-31031](https://cve.now/CVE-2023-31031.md): CVE (CVSS 4.2, nvidia DGX A100)
- [CVE-2023-31025](https://cve.now/CVE-2023-31025.md): CVE (CVSS 6.5, nvidia DGX A100)
- [CVE-2023-31034](https://cve.now/CVE-2023-31034.md): CVE (CVSS 6.6, nvidia DGX A100)
- [CVE-2023-31033](https://cve.now/CVE-2023-31033.md): CVE (CVSS 6.8, nvidia DGX A100)
- [CVE-2023-31035](https://cve.now/CVE-2023-31035.md): CVE (CVSS 7.5, nvidia DGX A100)
- [CVE-2023-31032](https://cve.now/CVE-2023-31032.md): CVE (CVSS 7.5, nvidia DGX A100)
- [CVE-2023-31024](https://cve.now/CVE-2023-31024.md): CVE (CVSS 9.0, nvidia DGX A100)
- [CVE-2023-31030](https://cve.now/CVE-2023-31030.md): CVE (CVSS 9.3, nvidia DGX A100)
- [CVE-2023-31029](https://cve.now/CVE-2023-31029.md): CVE (CVSS 9.3, nvidia DGX A100)
- [CVE-2024-0464](https://cve.now/CVE-2024-0464.md): code-projects Online Faculty Clearance HTTP GET Request delete\_faculty.php sql injection (CVSS 6.3, code-projects Online Faculty Clearance)
- [CVE-2024-0463](https://cve.now/CVE-2024-0463.md): code-projects Online Faculty Clearance HTTP POST Request admin\_view\_info.php sql injection (CVSS 6.3, code-projects Online Faculty Clearance)
- [CVE-2024-0462](https://cve.now/CVE-2024-0462.md): code-projects Online Faculty Clearance HTTP POST Request designee\_view\_status.php sql injection (CVSS 6.3, code-projects Online Faculty Clearance)
- [CVE-2023-31036](https://cve.now/CVE-2023-31036.md): CVE (CVSS 7.5, nvidia Triton Inference Server)
- [CVE-2024-21887](https://cve.now/CVE-2024-21887.md): A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an aut (CVSS 9.1, KEV, Ivanti ICS · Ivanti IPS)
- [CVE-2023-46805](https://cve.now/CVE-2023-46805.md): An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to acc (CVSS 8.2, KEV, Ivanti ICS · Ivanti IPS)
- [CVE-2024-0461](https://cve.now/CVE-2024-0461.md): code-projects Online Faculty Clearance HTTP POST Request deactivate.php sql injection (CVSS 6.3, code-projects Online Faculty Clearance)
- [CVE-2023-28899](https://cve.now/CVE-2023-28899.md): Denial of Service via ECU reset service (CVSS 4.7, Škoda Superb III)
- [CVE-2023-28898](https://cve.now/CVE-2023-28898.md): Head Unit Denial-of-Service via Apple CarPlay service (CVSS 5.3, JOYNEXT MIB3 Infotainment Unit)
- [CVE-2023-28897](https://cve.now/CVE-2023-28897.md): Hard-coded password for UDS services (CVSS 4.0, JOYNEXT MIB3 Infotainment Unit)
- [CVE-2024-0460](https://cve.now/CVE-2024-0460.md): code-projects Faculty Management System student-print.php sql injection (CVSS 6.3, code-projects Faculty Management System)
- [CVE-2024-0459](https://cve.now/CVE-2024-0459.md): Blood Bank & Donor Management request-received-bydonar.php sql injection (CVSS 4.7, Blood Bank & Donor Management)
- [CVE-2023-49262](https://cve.now/CVE-2023-49262.md): Buffer overflow vulnerability in Cookie authentication field (CVSS 9.8, Hongdian H8951-4G-ESP)
- [CVE-2023-49261](https://cve.now/CVE-2023-49261.md): Sensitive authentication-related value accessible publicly (CVSS 7.5, Hongdian H8951-4G-ESP)
- [CVE-2023-49260](https://cve.now/CVE-2023-49260.md): Stored cross-site scripting vulnerability (CVSS 6.1, Hongdian H8951-4G-ESP)
- [CVE-2023-49259](https://cve.now/CVE-2023-49259.md): Bruteforcing authentication cookie for a given user (CVSS 7.5, Hongdian H8951-4G-ESP)
- [CVE-2023-49258](https://cve.now/CVE-2023-49258.md): Reflected cross-site scripting vulnerability (CVSS 6.1, Hongdian H8951-4G-ESP)
- [CVE-2023-49257](https://cve.now/CVE-2023-49257.md): Command execution using the certificate upload utility (CVSS 8.8, Hongdian H8951-4G-ESP)
- [CVE-2023-49256](https://cve.now/CVE-2023-49256.md): Predictable encryption passphrase used in publicly accessible configuration file (CVSS 7.5, Hongdian H8951-4G-ESP)
- [CVE-2023-49255](https://cve.now/CVE-2023-49255.md): Router console accessible without authentication (CVSS 9.8, Hongdian H8951-4G-ESP)
- [CVE-2023-49254](https://cve.now/CVE-2023-49254.md): Command injection in the network test tools (CVSS 8.8, Hongdian H8951-4G-ESP)
- [CVE-2023-49253](https://cve.now/CVE-2023-49253.md): Predefined root password (CVSS 9.8, Hongdian H8951-4G-ESP)
- [CVE-2023-2030](https://cve.now/CVE-2023-2030.md): Improper Verification of Cryptographic Signature in GitLab (CVSS 3.5, GitLab)
- [CVE-2023-4812](https://cve.now/CVE-2023-4812.md): Incorrect Authorization in GitLab (CVSS 7.6, GitLab)
- [CVE-2023-5356](https://cve.now/CVE-2023-5356.md): Incorrect Authorization in GitLab (CVSS 7.3, GitLab)
- [CVE-2023-7028](https://cve.now/CVE-2023-7028.md): Weak Password Recovery Mechanism for Forgotten Password in GitLab (CVSS 10.0, KEV, GitLab)
- [CVE-2023-6955](https://cve.now/CVE-2023-6955.md): Missing Authorization in GitLab (CVSS 6.6, GitLab)
- [CVE-2023-0437](https://cve.now/CVE-2023-0437.md): MongoDB client C Driver may infinitely loop when validating certain BSON input data (CVSS 5.3, MongoDB C Driver)
- [CVE-2023-49569](https://cve.now/CVE-2023-49569.md): Maliciously crafted Git server replies can lead to path traversal and RCE on go-git clients (CVSS 9.8, go-git · gopkg.in/src-d/go-git.v4 +1)
- [CVE-2023-49568](https://cve.now/CVE-2023-49568.md): Maliciously crafted Git server replies can cause DoS on go-git clients (CVSS 7.5, go-git · gopkg.in/src-d/go-git.v4 +1)
- [CVE-2023-6740](https://cve.now/CVE-2023-6740.md): Privilege escalation in jar\_signature (CVSS 8.8, Checkmk)
- [CVE-2023-6735](https://cve.now/CVE-2023-6735.md): Privilege escalation in mk\_tsm (CVSS 8.8, Checkmk)
- [CVE-2023-31211](https://cve.now/CVE-2023-31211.md): Disabled automation users could still authenticate (CVSS 8.8, Checkmk)
- [CVE-2023-34061](https://cve.now/CVE-2023-34061.md): CVE-2023-34061 – Gorouter route pruning (CVSS 7.5, Cloud Foundry Routing Release · Cloud Foundry CF deployment)
- [CVE-2024-22027](https://cve.now/CVE-2024-22027.md): Improper input validation vulnerability in WordPress Quiz Maker Plugin prior to 6.5.0.6 allows a remote authenticated attacker to perform a (CVSS 6.5, AYS Pro Plugins WordPress Quiz Maker Plugin)
- [CVE-2022-4961](https://cve.now/CVE-2022-4961.md): Weitong Mall OrderDao.xml sql injection (CVSS 5.5, Weitong Mall)
- [CVE-2022-4960](https://cve.now/CVE-2022-4960.md): cloudfavorites favorites-web Nickname cross site scripting (CVSS 3.5, cloudfavorites favorites-web)
- [CVE-2024-0454](https://cve.now/CVE-2024-0454.md): Security Vulnerability on Match-on-Chip FPR Architecture (CVSS 6.0, ELAN DELL Inspiron)
- [CVE-2023-6040](https://cve.now/CVE-2023-6040.md): An out-of-bounds access vulnerability involving netfilter was reported and fixed as: f1082dd31fe4 (netfilter: nf\_tables: Reject tables of unsupported family) (CVSS 7.8, The Linux Kernel Organization linux)
- [CVE-2023-40250](https://cve.now/CVE-2023-40250.md): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability in Hancom HCell on Windows allows Overflow Buffers.This (CVSS 8.8, Hancom HCell)
- [CVE-2024-21617](https://cve.now/CVE-2024-21617.md): Junos OS: BGP flap on NSR-enabled devices causes memory leak (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-21616](https://cve.now/CVE-2024-21616.md): Junos OS: MX Series and SRX Series: Processing of a specific SIP packet causes NAT IP allocation to fail (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-21614](https://cve.now/CVE-2024-21614.md): Junos OS and Junos OS Evolved: A specific query via DREND causes rpd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-21613](https://cve.now/CVE-2024-21613.md): Junos OS and Junos OS Evolved: A link flap causes patroot memory leak which leads to rpd crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-21612](https://cve.now/CVE-2024-21612.md): Junos OS Evolved: Specific TCP traffic causes OFP core and restart of RE (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-21611](https://cve.now/CVE-2024-21611.md): Junos OS and Junos OS Evolved: In a jflow scenario continuous route churn will cause a memory leak and eventually an rpd crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-21607](https://cve.now/CVE-2024-21607.md): Junos OS: MX Series and EX9200 Series: If the "tcp-reset" option used in an IPv6 filter, matched packets are accepted instead of rejected (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2024-21606](https://cve.now/CVE-2024-21606.md): Junos OS: SRX Series: When "tcp-encap" is configured and specific packets are received flowd will crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-21604](https://cve.now/CVE-2024-21604.md): Junos OS Evolved: A high rate of specific traffic will cause a complete system outage (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-21603](https://cve.now/CVE-2024-21603.md): Junos OS: MX Series: Gathering statistics in a scaled SCU/DCU configuration will lead to a device crash (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-21602](https://cve.now/CVE-2024-21602.md): Junos OS Evolved: ACX7024, ACX7100-32C and ACX7100-48L: Traffic stops when a specific IPv4 UDP packet is received by the RE (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2024-21601](https://cve.now/CVE-2024-21601.md): Junos OS: SRX Series: Due to an error in processing TCP events flowd will crash (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2024-21600](https://cve.now/CVE-2024-21600.md): Junos OS: PTX Series: In an FTI scenario MPLS packets hitting reject next-hop will cause a host path wedge condition (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-21599](https://cve.now/CVE-2024-21599.md): Junos OS: MX Series: MPC3E memory leak with PTP configuration (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-21597](https://cve.now/CVE-2024-21597.md): Junos OS: MX Series: In an AF scenario traffic can bypass configured lo0 firewall filters (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2024-21596](https://cve.now/CVE-2024-21596.md): Junos OS and Junos OS Evolved: A specific BGP UPDATE message will cause a crash in the backup Routing Engine in NSR-enabled devices (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2024-21595](https://cve.now/CVE-2024-21595.md): Junos OS: EX4100, EX4400, EX4600, QFX5000 Series: A high rate of specific ICMP traffic will cause the PFE to hang (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2024-21594](https://cve.now/CVE-2024-21594.md): Junos OS: SRX 5000 Series: Repeated execution of a specific CLI command causes a flowd crash (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2024-21591](https://cve.now/CVE-2024-21591.md): Junos OS: SRX Series and EX Series: Security Vulnerability in J-web allows a preAuth Remote Code Execution (CVSS 9.8, Juniper Networks Junos OS)
- [CVE-2024-21589](https://cve.now/CVE-2024-21589.md): Paragon Active Assurance Control Center: Information disclosure vulnerability (CVSS 7.4, Juniper Networks Paragon Active Assurance)
- [CVE-2024-21587](https://cve.now/CVE-2024-21587.md): Junos OS: MX Series: Memory leak in bbe-smgd process if BFD liveness detection for DHCP subscribers is enabled (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2024-21585](https://cve.now/CVE-2024-21585.md): Junos OS and Junos OS Evolved: BGP session flaps on NSR-enabled devices can cause rpd crash (CVSS 5.9, Juniper Networks Junos OS)
- [CVE-2023-36842](https://cve.now/CVE-2023-36842.md): Junos OS: jdhcpd will hang on receiving a specific DHCP packet (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2016-20021](https://cve.now/CVE-2016-20021.md): In Gentoo Portage before 3.0.47, there is missing PGP validation of executed code: the standalone emerge-webrsync downloads a .gpgsig file b (CVSS 9.8, portage)
- [CVE-2022-48619](https://cve.now/CVE-2022-48619.md): An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. (CVSS 5.5)
- [CVE-2022-48620](https://cve.now/CVE-2022-48620.md): uev (aka libuev) before 2.4.1 has a buffer overflow in epoll\_wait if maxevents is a large number. (CVSS 9.8)
- [CVE-2023-30014](https://cve.now/CVE-2023-30014.md): SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensit (CVSS 9.8)
- [CVE-2023-30015](https://cve.now/CVE-2023-30015.md): SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensit (CVSS 9.8)
- [CVE-2023-30016](https://cve.now/CVE-2023-30016.md): SQL Injection vulnerability in oretnom23 Judging Management System v1.0, allows remote attackers to execute arbitrary code and obtain sensit (CVSS 9.8)
- [CVE-2023-37117](https://cve.now/CVE-2023-37117.md): A heap-use-after-free vulnerability was found in live555 version 2023.05.10 while handling the SETUP. (CVSS 9.8)
- [CVE-2023-40362](https://cve.now/CVE-2023-40362.md): An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023. (CVSS 4.3)
- [CVE-2023-48166](https://cve.now/CVE-2023-48166.md): A directory traversal vulnerability in the SOAP Server integrated in Atos Unify OpenScape Voice V10 before V10R3.26.1 allows a remote attack (CVSS 7.5)
- [CVE-2023-48909](https://cve.now/CVE-2023-48909.md): An issue was discovered in Jave2 version 3.3.1, allows attackers to execute arbitrary code via the FFmpeg function. (CVSS 8.8)
- [CVE-2023-50919](https://cve.now/CVE-2023-50919.md): An issue was discovered on GL.iNet devices before version 4.5.0. (CVSS 9.8)
- [CVE-2023-50920](https://cve.now/CVE-2023-50920.md): An issue was discovered on GL.iNet devices before version 4.5.0. (CVSS 5.5)
- [CVE-2023-51790](https://cve.now/CVE-2023-51790.md): Cross Site Scripting vulnerability in piwigo v.14.0.0 allows a remote attacker to obtain sensitive information via the lang parameter in the (CVSS 6.1)
- [CVE-2023-51806](https://cve.now/CVE-2023-51806.md): File Upload vulnerability in Ujcms v.8.0.2 allows a local attacker to execute arbitrary code via a crafted file. (CVSS 7.8)
- [CVE-2023-51949](https://cve.now/CVE-2023-51949.md): Verydows v2.0 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /protected/controller/backend/role\_controller (CVSS 8.8)
- [CVE-2023-51978](https://cve.now/CVE-2023-51978.md): In PHPGurukul Art Gallery Management System v1.1, "Update Artist Image" functionality of "imageid" parameter is vulnerable to SQL Injection. (CVSS 8.1)
- [CVE-2023-52026](https://cve.now/CVE-2023-52026.md): TOTOlink EX1800T V9.1.0cu.2112\_B20220316 was discovered to contain a remote command execution (RCE) vulnerability via the telnet\_enabled par (CVSS 9.8)
- [CVE-2023-52339](https://cve.now/CVE-2023-52339.md): In libebml before 1.4.5, an integer overflow in MemIOCallback.cpp can occur when reading or writing. (CVSS 6.5)
- [CVE-2024-22492](https://cve.now/CVE-2024-22492.md): A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save contact parameter, which allows remote attackers to inject arbi (CVSS 5.4, com.jfinal:jfinal)
- [CVE-2024-22493](https://cve.now/CVE-2024-22493.md): A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save content parameter, which allows remote attackers to inject arbi (CVSS 5.4, com.jfinal:jfinal)
- [CVE-2024-22494](https://cve.now/CVE-2024-22494.md): A stored XSS vulnerability exists in JFinalcms 5.0.0 via the /gusetbook/save mobile parameter, which allows remote attackers to inject arbit (CVSS 5.4)
- [CVE-2024-23171](https://cve.now/CVE-2024-23171.md): An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before (CVSS 5.4)
- [CVE-2024-23172](https://cve.now/CVE-2024-23172.md): An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40. (CVSS 5.4)
- [CVE-2024-23173](https://cve.now/CVE-2024-23173.md): An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. (CVSS 6.1, mediawiki/cargo)
- [CVE-2024-23174](https://cve.now/CVE-2024-23174.md): An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40 (CVSS 5.4)
- [CVE-2024-23177](https://cve.now/CVE-2024-23177.md): An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. (CVSS 6.1)
- [CVE-2024-23178](https://cve.now/CVE-2024-23178.md): An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. (CVSS 5.4)
- [CVE-2024-23179](https://cve.now/CVE-2024-23179.md): An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. (CVSS 6.1)
- [CVE-2024-23301](https://cve.now/CVE-2024-23301.md): Relax-and-Recover (aka ReaR) through 2.7 creates a world-readable initrd when using GRUB\_RESCUE=y. (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.