CVEs published January 15, 2024
66 CVEs were published on January 15, 2024: 4 critical, 23 high.
- Published
- 66
- Critical
- 4
- High
- 23
- Medium
- 38
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- Tenda W9
- 7
- Tenda A15
- 4
- CXBSoft Post-Office
- 3
- Estatik Real Estate Plugin
- 3
- PAX Technology POS terminals
- 3
- Adobe Acrobat for Edge
- 2
- CXBSoft Url-shorting
- 2
- DedeBIZ
- 2
- FireEye Central Management
- 2
- FireEye HXTool
- 2
Critical 4
- CVE-2023-6623Essential Blocks < 4.4.3 - Unauthenticated Local File InclusionEssential Blocks
- CVE-2023-6049Estatik Real Estate Plugin < 4.1.1 - Unauthenticated PHP Object InjectionEstatik Real Estate Plugin
- CVE-2023-46226Apache IoTDB: Remote Code Execution (RCE) risk via the UDFApache Software Foundation Apache IoTDB · org.apache.iot… +1
- CVE-2024-0552Intumit inc. SmartRobot - Remote Code ExecutionIntumit SmartRobot
High 23
- CVE-2023-7206Horner Automation Cscape Stack-Based Buffer OverflowHorner Automation Cscape
- CVE-2024-0562Kernel: use-after-free after removing device in wb_inode_writeback_end in mm/page-writeback.ckernel · Red Hat Enterprise Linux 8.6 Extended Update Su… +2
- CVE-2023-50729An unrestricted file upload vulnerability in traccar leads to RCEtraccar
- CVE-2023-5905DeMomentSomTres WordPress Export Posts With Images <= 20220825 - Subscriber+ unauthorized data exportDeMomentSomTres WordPress Export Posts With Images
- CVE-2023-6991JSM file_get_contents() Shortcode < 2.7.1 - Contributor+ SSRFJSM file_get_contents() Shortcode
- CVE-2023-6620Post SMTP < 2.8.7 - Admin+ SQL InjectionPOST SMTP Mailer
- CVE-2023-6029EazyDocs < 2.3.6 - Unauthenticated Arbitrary Posts Deletion and Document ManagementEazyDocs
- CVE-2023-42137PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow for command execution with high privilePAX Technology POS terminals
- CVE-2023-42136PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow the execution of arbitrary commands witPAX Technology POS terminals
- CVE-2023-4818PAX A920 device allows to downgrade bootloader due to a bug in its version check.PAX Technology A920
- CVE-2024-0542Tenda W9 httpd formWifiMacFilterGet stack-based overflowTenda W9
- CVE-2024-0541Tenda W9 httpd formAddSysLogRule stack-based overflowTenda W9
- CVE-2024-0539Tenda W9 httpd formQosManage_user stack-based overflowTenda W9
- CVE-2024-0538Tenda W9 httpd formQosManage_auto stack-based overflowTenda W9
- CVE-2024-0537Tenda W9 httpd setWrlBasicInfo stack-based overflowTenda W9
- CVE-2024-0536Tenda W9 httpd setWrlAccessList stack-based overflowTenda W9
- CVE-2024-0535Tenda PA6 httpd portmap cgiPortMapAdd stack-based overflowTenda PA6
- CVE-2023-48383NetVision Information airPASS - Path TraversalNetVision Information airPASS
- CVE-2024-0534Tenda A15 Web-based Management Interface SetOnlineDevName stack-based overflowTenda A15
- CVE-2024-0533Tenda A15 Web-based Management Interface SetOnlineDevName stack-based overflowTenda A15
- CVE-2024-0532Tenda A15 Web-based Management Interface WifiExtraSet set_repeat5 stack-based overflowTenda A15
- CVE-2024-0531Tenda A15 Web-based Management Interface setBlackRule stack-based overflowTenda A15
- CVE-2020-36770pkg_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root f
Medium, low and unrated 39
- CVE-2024-0565Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard of clientLinux kernel · Red Hat Enterprise Linux +2
- CVE-2024-0558DedeBIZ makehtml_freelist_action.php sql injectionDedeBIZ
- CVE-2024-0557DedeBIZ Website Copyright Setting cross site scriptingDedeBIZ
- CVE-2024-0320Cross-Site Scripting in FireEye Malware Analysis (AX)FireEye Malware Analysis
- CVE-2024-0319Open Redirect vulnerability in FireEye HXToolFireEye HXTool
- CVE-2024-0318Cross-Site Scripting in FireEye HXToolFireEye HXTool
- CVE-2024-0317Cross-Site Scripting in FireEye EXFireEye EX
- CVE-2024-0316Improper cleanup vulnerability in FireEye Endpoint SecurityFireEye Endpoint Security
- CVE-2024-0315Remote file inclusion vulnerability in FireEye Central ManagementFireEye Central Management
- CVE-2024-0314XSS vulnerability in FireEye Central ManagementFireEye Central Management
- CVE-2024-22207Default swagger-ui configuration exposes all files in the modulefastify-swagger-ui · @fastify/swagger-ui
- CVE-2023-4925Easy Forms for Mailchimp <= 6.8.10 - Admin+ Stored Cross-Site ScriptingEasy Forms for Mailchimp
- CVE-2023-6066WP Custom Widget Area <= 1.2.5 - Subscriber+ Menus Creation/Deletion/UpdateWP Custom Widget area
- CVE-2023-6050Estatik Real Estate Plugin < 4.1.1 - Reflected XSSEstatik Real Estate Plugin
- CVE-2023-6163WP Crowdfunding < 2.1.10 - Admin+ Stored XSSWP Crowdfunding
- CVE-2023-6048Estatik Real Estate Plugin < 4.1.1 - Subscriber+ Arbitrary Option UpdateEstatik Real Estate Plugin
- CVE-2023-6843easy.jobs < 2.4.7 - Subscriber+ Arbitrary Settings Updateeasy.jobs- Best Recruitment Plugin for Job Board Listing, M…
- CVE-2023-6941Keap Official Opt-in Forms <= 1.0.11 - Admin+ Stored XSSKeap Official Opt-in Forms
- CVE-2023-42135PAX A920Pro/A50 devices with PayDroid_8.1.0_Sagittarius_V11.1.50_20230614 or earlier can allow local code execution via parameter injection PAX Technology A920 Pro · PAX Technology A50
- CVE-2023-42134PAX Android based POS devices with PayDroid_8.1.0_Sagittarius_V11.1.45_20230314 or earlier can allow the signed partition overwrite and subsPAX Technology POS terminals
- CVE-2024-20709New Edge T5 MSRC Case [DCMSFT-1081]Adobe Acrobat for Edge
- CVE-2024-20721T5 Acrobat JS vulnerability - Exploitable crash via t5::javascript::get_page_num_wordsAdobe Acrobat for Edge
- CVE-2023-4001Grub2: bypass the grub password protection featureRed Hat Enterprise Linux
- CVE-2023-5253Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0Nozomi Networks Guardian · Nozomi Networks CMC
- CVE-2023-46749Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting Apache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2023-50290Apache Solr: Host environment variables are published via the Metrics APIApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2023-6915Kernel: null pointer dereference vulnerability in ida_free in lib/idr.cRed Hat Enterprise Linux
- CVE-2024-22028Insufficient technical documentation issue exists in thermal camera TMC series all firmware versions.THREE R SOLUTION CORP. JAPAN 3R-TMC01 · THREE R SOLUTION… +4
- CVE-2024-0548FreeFloat FTP Server SIZE Command denial of serviceFreeFloat FTP Server
- CVE-2024-0547Ability FTP Server APPE Command denial of serviceAbility FTP Server
- CVE-2024-0546EasyFTP LIST Command denial of serviceEasyFTP
- CVE-2024-0545CodeCanyon RISE Ultimate Project Manager signin redirectCodeCanyon RISE Ultimate Project Manager
- CVE-2024-0543CodeAstro Real Estate Management System propertydetail.php sql injectionCodeAstro Real Estate Management System
- CVE-2024-0540Tenda W9 httpd formOfflineSet stack-based overflowTenda W9
- CVE-2024-0530CXBSoft Post-Office HTTP POST Request reg_go.php sql injectionCXBSoft Post-Office
- CVE-2024-0529CXBSoft Post-Office HTTP POST Request login_auth.php sql injectionCXBSoft Post-Office
- CVE-2024-0528CXBSoft Post-Office HTTP POST Request update_go.php sql injectionCXBSoft Post-Office
- CVE-2024-0527CXBSoft Url-shorting HTTP POST Request update_go.php sql injectionCXBSoft Url-shorting
- CVE-2024-0526CXBSoft Url-shorting HTTP POST Request short_to_long.php sql injectionCXBSoft Url-shorting