# CVEs published 2024-01-15

66 CVEs were published on January 15, 2024: 4 critical, 23 high. Days are UTC.

- [CVE-2023-7206](https://cve.now/CVE-2023-7206.md): Horner Automation Cscape Stack-Based Buffer Overflow (CVSS 7.8, Horner Automation Cscape)
- [CVE-2024-0565](https://cve.now/CVE-2024-0565.md): Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive\_encrypted\_standard of client (CVSS 6.8, Linux kernel · Red Hat Enterprise Linux +2)
- [CVE-2024-0562](https://cve.now/CVE-2024-0562.md): Kernel: use-after-free after removing device in wb\_inode\_writeback\_end in mm/page-writeback.c (CVSS 7.8, kernel · Red Hat Enterprise Linux 8.6 Extended Update Su… +2)
- [CVE-2024-0558](https://cve.now/CVE-2024-0558.md): DedeBIZ makehtml\_freelist\_action.php sql injection (CVSS 4.7, DedeBIZ)
- [CVE-2024-0557](https://cve.now/CVE-2024-0557.md): DedeBIZ Website Copyright Setting cross site scripting (CVSS 2.4, DedeBIZ)
- [CVE-2024-0320](https://cve.now/CVE-2024-0320.md): Cross-Site Scripting in FireEye Malware Analysis (AX) (CVSS 5.4, FireEye Malware Analysis)
- [CVE-2024-0319](https://cve.now/CVE-2024-0319.md): Open Redirect vulnerability in FireEye HXTool (CVSS 5.4, FireEye HXTool)
- [CVE-2024-0318](https://cve.now/CVE-2024-0318.md): Cross-Site Scripting in FireEye HXTool (CVSS 5.4, FireEye HXTool)
- [CVE-2024-0317](https://cve.now/CVE-2024-0317.md): Cross-Site Scripting in FireEye EX (CVSS 5.4, FireEye EX)
- [CVE-2024-0316](https://cve.now/CVE-2024-0316.md): Improper cleanup vulnerability in FireEye Endpoint Security (CVSS 6.8, FireEye Endpoint Security)
- [CVE-2024-0315](https://cve.now/CVE-2024-0315.md): Remote file inclusion vulnerability in FireEye Central Management (CVSS 6.6, FireEye Central Management)
- [CVE-2024-0314](https://cve.now/CVE-2024-0314.md): XSS vulnerability in FireEye Central Management (CVSS 5.4, FireEye Central Management)
- [CVE-2023-50729](https://cve.now/CVE-2023-50729.md): An unrestricted file upload vulnerability in traccar leads to RCE (CVSS 8.5, traccar)
- [CVE-2024-22207](https://cve.now/CVE-2024-22207.md): Default swagger-ui configuration exposes all files in the module (CVSS 5.3, fastify-swagger-ui · @fastify/swagger-ui)
- [CVE-2023-4925](https://cve.now/CVE-2023-4925.md): Easy Forms for Mailchimp \<= 6.8.10 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Easy Forms for Mailchimp)
- [CVE-2023-5905](https://cve.now/CVE-2023-5905.md): DeMomentSomTres WordPress Export Posts With Images \<= 20220825 - Subscriber+ unauthorized data export (CVSS 8.1, DeMomentSomTres WordPress Export Posts With Images)
- [CVE-2023-6066](https://cve.now/CVE-2023-6066.md): WP Custom Widget Area \<= 1.2.5 - Subscriber+ Menus Creation/Deletion/Update (CVSS 4.3, WP Custom Widget area)
- [CVE-2023-6050](https://cve.now/CVE-2023-6050.md): Estatik Real Estate Plugin \< 4.1.1 - Reflected XSS (CVSS 6.1, Estatik Real Estate Plugin)
- [CVE-2023-6991](https://cve.now/CVE-2023-6991.md): JSM file\_get\_contents() Shortcode \< 2.7.1 - Contributor+ SSRF (CVSS 8.8, JSM file\_get\_contents() Shortcode)
- [CVE-2023-6620](https://cve.now/CVE-2023-6620.md): Post SMTP \< 2.8.7 - Admin+ SQL Injection (CVSS 7.2, POST SMTP Mailer)
- [CVE-2023-6163](https://cve.now/CVE-2023-6163.md): WP Crowdfunding \< 2.1.10 - Admin+ Stored XSS (CVSS 4.8, WP Crowdfunding)
- [CVE-2023-6048](https://cve.now/CVE-2023-6048.md): Estatik Real Estate Plugin \< 4.1.1 - Subscriber+ Arbitrary Option Update (CVSS 6.5, Estatik Real Estate Plugin)
- [CVE-2023-6623](https://cve.now/CVE-2023-6623.md): Essential Blocks \< 4.4.3 - Unauthenticated Local File Inclusion (CVSS 9.8, Essential Blocks)
- [CVE-2023-6843](https://cve.now/CVE-2023-6843.md): easy.jobs \< 2.4.7 - Subscriber+ Arbitrary Settings Update (CVSS 4.3, easy.jobs- Best Recruitment Plugin for Job Board Listing, M…)
- [CVE-2023-6029](https://cve.now/CVE-2023-6029.md): EazyDocs \< 2.3.6 - Unauthenticated Arbitrary Posts Deletion and Document Management (CVSS 7.5, EazyDocs)
- [CVE-2023-6049](https://cve.now/CVE-2023-6049.md): Estatik Real Estate Plugin \< 4.1.1 - Unauthenticated PHP Object Injection (CVSS 9.8, Estatik Real Estate Plugin)
- [CVE-2023-6941](https://cve.now/CVE-2023-6941.md): Keap Official Opt-in Forms \<= 1.0.11 - Admin+ Stored XSS (CVSS 4.8, Keap Official Opt-in Forms)
- [CVE-2023-42137](https://cve.now/CVE-2023-42137.md): PAX Android based POS devices with PayDroid\_8.1.0\_Sagittarius\_V11.1.50\_20230614 or earlier can allow for command execution with high privile (CVSS 7.8, PAX Technology POS terminals)
- [CVE-2023-42136](https://cve.now/CVE-2023-42136.md): PAX Android based POS devices with PayDroid\_8.1.0\_Sagittarius\_V11.1.50\_20230614 or earlier can allow the execution of arbitrary commands wit (CVSS 7.8, PAX Technology POS terminals)
- [CVE-2023-42135](https://cve.now/CVE-2023-42135.md): PAX A920Pro/A50 devices with PayDroid\_8.1.0\_Sagittarius\_V11.1.50\_20230614 or earlier can allow local code execution via parameter injection (CVSS 6.8, PAX Technology A920 Pro · PAX Technology A50)
- [CVE-2023-42134](https://cve.now/CVE-2023-42134.md): PAX Android based POS devices with PayDroid\_8.1.0\_Sagittarius\_V11.1.45\_20230314 or earlier can allow the signed partition overwrite and subs (CVSS 6.8, PAX Technology POS terminals)
- [CVE-2023-4818](https://cve.now/CVE-2023-4818.md): PAX A920 device allows to downgrade bootloader due to a bug in its version check. (CVSS 7.6, PAX Technology A920)
- [CVE-2024-20709](https://cve.now/CVE-2024-20709.md): New Edge T5 MSRC Case \[DCMSFT-1081\] (CVSS 5.5, Adobe Acrobat for Edge)
- [CVE-2024-20721](https://cve.now/CVE-2024-20721.md): T5 Acrobat JS vulnerability - Exploitable crash via t5::javascript::get\_page\_num\_words (CVSS 5.5, Adobe Acrobat for Edge)
- [CVE-2023-4001](https://cve.now/CVE-2023-4001.md): Grub2: bypass the grub password protection feature (CVSS 6.8, Red Hat Enterprise Linux)
- [CVE-2023-5253](https://cve.now/CVE-2023-5253.md): Check Point IoT integration: WebSocket returns assets data without authentication in Guardian/CMC before 23.3.0 (CVSS 5.3, Nozomi Networks Guardian · Nozomi Networks CMC)
- [CVE-2023-46226](https://cve.now/CVE-2023-46226.md): Apache IoTDB: Remote Code Execution (RCE) risk via the UDF (CVSS 9.8, Apache Software Foundation Apache IoTDB · org.apache.iot… +1)
- [CVE-2023-46749](https://cve.now/CVE-2023-46749.md): Apache Shiro before 1.13.0 or 2.0.0-alpha-4, may be susceptible to a path traversal attack that results in an authentication bypass when used together with path rewriting (CVSS 6.5, Apache Software Foundation Apache Shiro · org.apache.shiro:…)
- [CVE-2023-50290](https://cve.now/CVE-2023-50290.md): Apache Solr: Host environment variables are published via the Metrics API (CVSS 6.5, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2023-6915](https://cve.now/CVE-2023-6915.md): Kernel: null pointer dereference vulnerability in ida\_free in lib/idr.c (CVSS 6.2, Red Hat Enterprise Linux)
- [CVE-2024-22028](https://cve.now/CVE-2024-22028.md): Insufficient technical documentation issue exists in thermal camera TMC series all firmware versions. (CVSS 4.6, THREE R SOLUTION CORP. JAPAN 3R-TMC01 · THREE R SOLUTION… +4)
- [CVE-2024-0548](https://cve.now/CVE-2024-0548.md): FreeFloat FTP Server SIZE Command denial of service (CVSS 5.3, FreeFloat FTP Server)
- [CVE-2024-0547](https://cve.now/CVE-2024-0547.md): Ability FTP Server APPE Command denial of service (CVSS 5.3, Ability FTP Server)
- [CVE-2024-0546](https://cve.now/CVE-2024-0546.md): EasyFTP LIST Command denial of service (CVSS 5.3, EasyFTP)
- [CVE-2024-0545](https://cve.now/CVE-2024-0545.md): CodeCanyon RISE Ultimate Project Manager signin redirect (CVSS 6.9, CodeCanyon RISE Ultimate Project Manager)
- [CVE-2024-0543](https://cve.now/CVE-2024-0543.md): CodeAstro Real Estate Management System propertydetail.php sql injection (CVSS 6.3, CodeAstro Real Estate Management System)
- [CVE-2024-0542](https://cve.now/CVE-2024-0542.md): Tenda W9 httpd formWifiMacFilterGet stack-based overflow (CVSS 8.8, Tenda W9)
- [CVE-2024-0541](https://cve.now/CVE-2024-0541.md): Tenda W9 httpd formAddSysLogRule stack-based overflow (CVSS 8.8, Tenda W9)
- [CVE-2024-0540](https://cve.now/CVE-2024-0540.md): Tenda W9 httpd formOfflineSet stack-based overflow (CVSS 6.3, Tenda W9)
- [CVE-2024-0539](https://cve.now/CVE-2024-0539.md): Tenda W9 httpd formQosManage\_user stack-based overflow (CVSS 8.8, Tenda W9)
- [CVE-2024-0552](https://cve.now/CVE-2024-0552.md): Intumit inc. SmartRobot - Remote Code Execution (CVSS 9.8, Intumit SmartRobot)
- [CVE-2024-0538](https://cve.now/CVE-2024-0538.md): Tenda W9 httpd formQosManage\_auto stack-based overflow (CVSS 8.8, Tenda W9)
- [CVE-2024-0537](https://cve.now/CVE-2024-0537.md): Tenda W9 httpd setWrlBasicInfo stack-based overflow (CVSS 8.8, Tenda W9)
- [CVE-2024-0536](https://cve.now/CVE-2024-0536.md): Tenda W9 httpd setWrlAccessList stack-based overflow (CVSS 8.8, Tenda W9)
- [CVE-2024-0535](https://cve.now/CVE-2024-0535.md): Tenda PA6 httpd portmap cgiPortMapAdd stack-based overflow (CVSS 8.8, Tenda PA6)
- [CVE-2023-48383](https://cve.now/CVE-2023-48383.md): NetVision Information airPASS - Path Traversal (CVSS 7.5, NetVision Information airPASS)
- [CVE-2024-0534](https://cve.now/CVE-2024-0534.md): Tenda A15 Web-based Management Interface SetOnlineDevName stack-based overflow (CVSS 7.2, Tenda A15)
- [CVE-2024-0533](https://cve.now/CVE-2024-0533.md): Tenda A15 Web-based Management Interface SetOnlineDevName stack-based overflow (CVSS 7.2, Tenda A15)
- [CVE-2024-0532](https://cve.now/CVE-2024-0532.md): Tenda A15 Web-based Management Interface WifiExtraSet set\_repeat5 stack-based overflow (CVSS 8.6, Tenda A15)
- [CVE-2024-0531](https://cve.now/CVE-2024-0531.md): Tenda A15 Web-based Management Interface setBlackRule stack-based overflow (CVSS 7.2, Tenda A15)
- [CVE-2024-0530](https://cve.now/CVE-2024-0530.md): CXBSoft Post-Office HTTP POST Request reg\_go.php sql injection (CVSS 5.5, CXBSoft Post-Office)
- [CVE-2024-0529](https://cve.now/CVE-2024-0529.md): CXBSoft Post-Office HTTP POST Request login\_auth.php sql injection (CVSS 5.5, CXBSoft Post-Office)
- [CVE-2024-0528](https://cve.now/CVE-2024-0528.md): CXBSoft Post-Office HTTP POST Request update\_go.php sql injection (CVSS 5.5, CXBSoft Post-Office)
- [CVE-2024-0527](https://cve.now/CVE-2024-0527.md): CXBSoft Url-shorting HTTP POST Request update\_go.php sql injection (CVSS 6.3, CXBSoft Url-shorting)
- [CVE-2024-0526](https://cve.now/CVE-2024-0526.md): CXBSoft Url-shorting HTTP POST Request short\_to\_long.php sql injection (CVSS 5.5, CXBSoft Url-shorting)
- [CVE-2020-36770](https://cve.now/CVE-2020-36770.md): pkg\_postinst in the Gentoo ebuild for Slurm through 22.05.3 unnecessarily calls chown to assign root's ownership on files in the live root f (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.