CVEs published January 16, 2024
227 CVEs were published on January 16, 2024: 12 critical, 84 high. 2 are now in CISA KEV.
- Published
- 227
- Critical
- 12
- High
- 84
- Medium
- 120
- Low
- 11
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 78
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 18
- Oracle MySQL Server
- 11
- TianoCore edk2
- 9
- Totolink LR1200GB
- 8
- EventON
- 5
- Oracle Java SE JDK and JRE
- 5
- Atlassian Confluence Data Center · Atlassian Confluence Ser…
- 4
- Huawei HarmonyOS
- 4
- HYPR Workforce Access
- 4
- Full Compass Systems WIC1200
- 3
Critical 12
- CVE-2024-22406Blind SQL-injection in DAL aggregations in Shopwareshopware · shopware/core +1
- CVE-2023-0224GiveWP < 2.24.1 - Unauthenticated SQLiGiveWP
- CVE-2023-3211WordPress Database Administrator <= 1.0.3 - Unauthenticated SQL Injection WordPress Database Administrator
- CVE-2022-1609The School Management < 9.9.7 - Unauthenticated RCE via REST apischool-management-pro
- CVE-2023-52103Buffer overflow vulnerability in the FLP module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52101Component exposure vulnerability in the Wi-Fi module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-34063Aria Automation contains a Missing Access Control vulnerability.VMware Aria Automation, VMware Cloud Foundation
- CVE-2023-22527A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE Atlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2023-39691An issue discovered in kodbox through 1.43 allows attackers to arbitrarily add Administrator accounts via crafted GET request.
- CVE-2023-49351A stack-based buffer overflow vulnerability in /bin/webs binary in Edimax BR6478AC V2 firmware veraion v1.23 allows attackers to overwrite o
- CVE-2023-52041An issue discovered in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary code via the sub_410118 function of the shtt
- CVE-2024-22916In D-LINK Go-RT-AC750 v101b03, the sprintf function in the sub_40E700 function within the cgibin is susceptible to stack overflow.
High 84
- CVE-2024-22408Server-Side Request Forgery (SSRF) in Shopware Flow Buildershopware
- CVE-2024-22409Default Privileges allow for high level operations for low privileged users in datahubdatahub-project datahub
- CVE-2024-0603ZhiCms giftcontroller.php deserializationZhiCms
- CVE-2024-22191Stored cross-site scripting (XSS) in `key_value` field in Avoavo-hq avo · avo
- CVE-2024-20952Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: SecuritOracle Java SE JDK and JRE
- CVE-2024-20932Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: SecuritOracle Java SE JDK and JRE
- CVE-2024-20924Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall).Oracle Audit Vault and Database Firewall
- CVE-2024-20918Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: HotspotOracle Java SE JDK and JRE
- CVE-2024-20916Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management).Oracle Enterprise Manager Base Platform
- CVE-2023-21901Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (comOracle Financial Services Analytical Applications Infrastru…
- CVE-2024-0519Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption Google Chrome
- CVE-2024-0518Type confusion in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2024-0517Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crGoogle Chrome
- CVE-2023-6336Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows User-Controlled FilenaHYPR Workforce Access
- CVE-2023-5097Improper Input Validation vulnerability in HYPR Workforce Access on Windows allows Path Traversal.This issue affects Workforce Access: beforHYPR Workforce Access
- CVE-2024-0200Unsafe Reflection in Github Enterprise Server leading to Command InjectionGitHub Enterprise Server
- CVE-2024-23347Prior to v176, when opening a new project Meta Spark Studio would execute scripts defined inside of a package.json file included as part of Meta Platforms Meta Spark Studio
- CVE-2023-45234Buffer Overflow in EDK II Network PackageTianoCore edk2
- CVE-2023-45233Infinite loop in EDK II Network PackageTianoCore edk2
- CVE-2023-45232Infinite loop in EDK II Network PackageTianoCore edk2
- CVE-2023-45235Buffer Overflow in EDK II Network PackageTianoCore edk2
- CVE-2023-45230Buffer Overflow in EDK II Network PackageTianoCore edk2
- CVE-2024-0578Totolink LR1200GB cstecgi.cgi UploadCustomModule stack-based overflowTotolink LR1200GB
- CVE-2023-6373ArtPlacer Widget < 2.20.7 - Editor+ SQLiArtPlacer Widget
- CVE-2023-5922Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post ReadRoyal Elementor Addons and Templates
- CVE-2023-4703All in One B2B for WooCommerce <= 1.0.3 - Unauthenticated Privilege EscalationAll in One B2B for WooCommerce
- CVE-2023-4797Newsletter Lite < 4.9.3 - Admin+ Command InjectionNewsletters
- CVE-2023-4536My Account Page Editor < 1.3.2 - Subscriber+ Arbitrary File UploadMy Account Page Editor
- CVE-2023-0824UserPlus <= 2.0 - Stored XSS via CSRFUser registration & user profile
- CVE-2023-1405Formidable Forms < 6.2 - Unauthenticated PHP Object InjectionFormidable Forms
- CVE-2023-2655Contact Form by WD <= 1.13.23 - Admin+ SQLiContact Form by WD
- CVE-2022-3604Contact Form Entries < 1.3.0 - CSV InjectionContact Form Entries
- CVE-2022-38993DPrint < 3.5.6.9 - Arbitrary File and Directory Deletion via CSRF3dprint
- CVE-2022-3764Form Vibes < 1.4.5 - Admin+ SQLiForm Vibes
- CVE-2022-1538Theme-Demo-Importer < 1.1.1 - Admin+ Arbitrary File UploadTheme Demo Import
- CVE-2021-24869WP Fastest Cache < 0.9.5 - Subscriber+ SQL InjectionWP Fastest Cache
- CVE-2021-24151WP Editor < 1.2.7 - Authenticated SQL injectionWP Editor
- CVE-2021-24566WooCommerce Currency Switcher < 1.3.7 - Authenticated (Low Privilege) Local File InclusionFOX
- CVE-2024-0577Totolink LR1200GB cstecgi.cgi setLanguageCfg stack-based overflowTotolink LR1200GB
- CVE-2024-0576Totolink LR1200GB cstecgi.cgi setIpPortFilterRules stack-based overflowTotolink LR1200GB
- CVE-2024-0575Totolink LR1200GB cstecgi.cgi setTracerouteCfg stack-based overflowTotolink LR1200GB
- CVE-2024-0574Totolink LR1200GB cstecgi.cgi setParentalRules stack-based overflowTotolink LR1200GB
- CVE-2024-0582Kernel: io_uring: page use-after-free vulnerability via buffer ring mmapkernel · Red Hat Enterprise Linux
- CVE-2024-0573Totolink LR1200GB cstecgi.cgi setDiagnosisCfg stack-based overflowTotolink LR1200GB
- CVE-2024-0567Gnutls: rejects certificate chain with distributed trustgnutls · Red Hat Enterprise Linux +3
- CVE-2024-0572Totolink LR1200GB cstecgi.cgi setOpModeCfg stack-based overflowTotolink LR1200GB
- CVE-2024-0571Totolink LR1200GB cstecgi.cgi setSmsCfg stack-based overflowTotolink LR1200GB
- CVE-2024-0553Gnutls: incomplete fix for cve-2023-5981gnutls · Red Hat Enterprise Linux +2
- CVE-2024-0556Weak Cryptography for Passwords vulnerability on WIC1200Full Compass Systems WIC1200
- CVE-2023-52105The nearby module has a privilege escalation vulnerability.Huawei HarmonyOS
- CVE-2023-52104Vulnerability of parameters being not verified in the WMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52102Vulnerability of parameters being not verified in the WMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52100The Celia Keyboard module has a vulnerability in access control.Huawei HarmonyOS
- CVE-2023-52099Vulnerability of foreground service restrictions being bypassed in the NMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52098Denial of Service (DoS) vulnerability in the DMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52108Vulnerability of process priorities being raised in the ActivityManagerService module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52107Vulnerability of permissions being not strictly verified in the WMS module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52116Permission management vulnerability in the multi-screen interaction module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52115The iaware module has a Use-After-Free (UAF) vulnerability.Huawei HarmonyOS
- CVE-2023-52114Data confidentiality vulnerability in the ScreenReader module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-44112Out-of-bounds access vulnerability in the device authentication module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52113launchAnyWhere vulnerability in the ActivityManagerService module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52111Authorization vulnerability in the BootLoader module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-52110The sensor module has an out-of-bounds access vulnerability.Successful exploitation of this vulnerability may affect availability.Huawei HarmonyOS
- CVE-2023-52109Vulnerability of trust relationships being inaccurate in distributed scenarios.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-44117Vulnerability of trust relationships being inaccurate in distributed scenarios.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-4566Vulnerability of trust relationships being inaccurate in distributed scenarios.Huawei HarmonyOS · Huawei EMUI
- CVE-2024-21673This High severity Remote Code Execution (RCE) vulnerability was introduced in versions 7.13.0 of Confluence Data Center and Server.Atlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2024-21672This High severity Remote Code Execution (RCE) vulnerability was introduced in version 2.1.0 of Confluence Data Center and Server.Atlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2024-21674This High severity Remote Code Execution (RCE) vulnerability was introduced in version 7.13.0 of Confluence Data Center and Server.Atlassian Confluence Data Center · Atlassian Confluence Ser…
- CVE-2023-22526This High severity RCE (Remote Code Execution) vulnerability was introduced in version 7.19.0 of Confluence Data Center.Atlassian Confluence Data Center
- CVE-2024-22428 Dell iDRAC Service Module, versions 5.2.0.0 and prior, contain an Incorrect Default Permissions vulnerability.Dell iDRAC Service Module
- CVE-2024-22362Drupal contains a vulnerability with improper handling of structural elements.Drupal.org Drupal · drupal/core
- CVE-2023-43449An issue in HummerRisk HummerRisk v.1.10 thru 1.4.1 allows an authenticated attacker to execute arbitrary code via a crafted request to the
- CVE-2023-47460SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/Servi
- CVE-2023-51059An issue in MOKO TECHNOLOGY LTD MOKOSmart MKGW1 BLE Gateway v.1.1.1 and before allows a remote attacker to escalate privileges via the sessi
- CVE-2023-51257An invalid memory write issue in Jasper-Software Jasper v.4.1.1 and before allows a local attacker to execute arbitrary code.
- CVE-2023-51282An issue in mingSoft MCMS v.5.2.4 allows a a remote attacker to obtain sensitive information via a crafted script to the password parameter.net.mingsoft:ms-mcms
- CVE-2023-51810SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain sensitive information
- CVE-2023-52042An issue discovered in sub_4117F8 function in TOTOLINK X6000R V9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the 'lan
- CVE-2024-22625Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_category.php?id=.
- CVE-2024-22626Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_retailer.php?id=.
- CVE-2024-22627Complete Supplier Management System v1.0 is vulnerable to SQL Injection via /Supply_Management_System/admin/edit_distributor.php?id=.
- CVE-2024-22628Budget and Expense Tracker System v1.0 is vulnerable to SQL Injection via /expense_budget/admin/?page=reports/budget&date_start=2023-12-28&d
Medium, low and unrated 131
- CVE-2024-22407Broken Access Control order API in Shopwareshopware · shopware/core +1
- CVE-2024-22411Cross site scripting in Action messages on Avoavo-hq avo · avo
- CVE-2024-22192Ursa CL-Signatures Revocation allows verifiers to generate unique identifiers for holdershyperledger-archives ursa · ursa +1
- CVE-2024-21670CL-Signatures Revocation Scheme in Ursa has flaws that allow a holder to demonstrate non-revocation of a revoked credentialhyperledger-archives ursa · ursa +1
- CVE-2024-20987Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).Oracle BI Publisher
- CVE-2024-20985Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF).Oracle MySQL Server
- CVE-2024-20983Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML).Oracle MySQL Server
- CVE-2024-20981Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).Oracle MySQL Server
- CVE-2024-20979Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server).Oracle BI Publisher
- CVE-2024-20977Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2024-20975Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2024-20973Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2024-20971Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2024-20969Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL).Oracle MySQL Server
- CVE-2024-20967Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication).Oracle MySQL Server
- CVE-2024-20965Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL NDB Cluster · Oracle MySQL Server
- CVE-2024-20963Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption).Oracle MySQL Server
- CVE-2024-20961Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer).Oracle MySQL Server
- CVE-2024-20959Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).Oracle Sun ZFS Storage Appliance Kit (AK) Software
- CVE-2024-20957Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Package Build SEC).Oracle JD Edwards EnterpriseOne Tools
- CVE-2024-20955Vulnerability in the Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Compiler).Oracle GraalVM Enterprise Edition
- CVE-2024-20950Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result).Oracle Customer Interaction History
- CVE-2024-20948Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Setup, Admin).Oracle Knowledge Management
- CVE-2024-20946Vulnerability in the Oracle Solaris product of Oracle Systems (component: Kernel).Oracle Solaris Operating System
- CVE-2024-20944Vulnerability in the Oracle iSupport product of Oracle E-Business Suite (component: Internal Operations).Oracle iSupport
- CVE-2024-20942Vulnerability in the Oracle Complex Maintenance, Repair, and Overhaul product of Oracle Supply Chain (component: LOV).Oracle Complex Maintenance, Repair, and Overhaul
- CVE-2024-20940Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Create, Update, Authoring Flow).Oracle Knowledge Management
- CVE-2024-20938Vulnerability in the Oracle iStore product of Oracle E-Business Suite (component: ECC).Oracle iStore
- CVE-2024-20936Vulnerability in the Oracle One-to-One Fulfillment product of Oracle E-Business Suite (component: Documents).Oracle One-to-One Fulfillment
- CVE-2024-20934Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order).Oracle Installed Base
- CVE-2024-20930Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Content Access SDK, Image Export SDK, PDF Oracle Outside In Technology
- CVE-2024-20928Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).Oracle WebCenter Content
- CVE-2024-20926Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ScriptiOracle Java SE JDK and JRE
- CVE-2024-20922Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX).Oracle Java SE JDK and JRE
- CVE-2024-20920Vulnerability in the Oracle Solaris product of Oracle Systems (component: Filesystem).Oracle Solaris Operating System
- CVE-2024-20914Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Core).Oracle Sun ZFS Storage Appliance Kit (AK) Software
- CVE-2024-20912Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall).Oracle Audit Vault and Database Firewall
- CVE-2024-20910Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall).Oracle Audit Vault and Database Firewall
- CVE-2024-20908Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: Advanced UI).Oracle WebCenter Sites
- CVE-2024-20906Vulnerability in the Integrated Lights Out Manager (ILOM) product of Oracle Systems (component: System Management).Oracle SSM - (hot-tamale) ILOM: Integrated Lights Out Manag…
- CVE-2024-20904Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin).Oracle Business Intelligence Enterprise Edition
- CVE-2022-31021Unlinkability broken in ursa when verifiers use malicious keyshyperledger ursa · anoncreds-clsignatures +1
- CVE-2024-0601ZhongFuCheng3y Austin Email Message Template AustinFileUtils.java getRemoteUrl2File server-side request forgeryZhongFuCheng3y Austin
- CVE-2024-0599Jspxcms Document Management Page InfoController.java cross site scriptingJspxcms
- CVE-2023-6335Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on Windows allows User-Controlled FileHYPR Workforce Access
- CVE-2023-6334Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in HYPR Workforce Access on Windows allows Overflow BuHYPR Workforce Access
- CVE-2024-0507Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise ServerGitHub Enterprise Server
- CVE-2023-7234Integration Objects OPC UA Server Toolkit Improper Output Neutralization for LogsIntegration Objects OPC UA Server Toolkit
- CVE-2023-37523HCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tagsHCL Software HCL BigFix OSD Bare Metal Server WebUI
- CVE-2023-4969GPU kernel implementations susceptible to memory leakKhronos Group OpenCL · Khronos Group Vulkan
- CVE-2024-0579Totolink X2000R formMapDelDevice command injectionTotolink X2000R
- CVE-2023-45237Use of a Weak PseudoRandom Number Generator in EDK II Network PackageTianoCore edk2
- CVE-2023-45236Predictable TCP ISNs in EDK II Network PackageTianoCore edk2
- CVE-2023-45231Out-of-Bounds Read in EDK II Network PackageTianoCore edk2
- CVE-2023-45229Out-of-Bounds Read in EDK II Network PackageTianoCore edk2
- CVE-2023-37522HCL BigFix OSD Bare Metal Server WebUI is affected by missing or insecure tagsHCL Software HCL BigFix OSD Bare Metal Server WebUI
- CVE-2023-7151Product Enquiry for WooCommerce < 3.2 - Reflected XSSProduct Enquiry for WooCommerce
- CVE-2023-6292Ecwid Ecommerce Shopping Cart < 6.12.5 - Arbitrary Plugin Settings Change via CSRFEcwid Ecommerce Shopping Cart
- CVE-2024-0238EventON (Free < 2.2.8, Premium < 4.5.6) - Unauthenticated Arbitrary Post Metadata UpdateEventON Premium · EventON
- CVE-2023-7125Community by PeepSo < 6.3.1.2 - User Post Creation via CSRFCommunity by PeepSo
- CVE-2024-0235EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address DisclosureEventON
- CVE-2023-7083Voting Record <= 2.0 - Settings Update to Stored XSS via CSRFVoting Record
- CVE-2024-0239Contact Form 7 Connector < 1.2.3 - Reflected XSSContact Form 7 Connector
- CVE-2023-7084Voting Record <= 2.0 - Subscriber+ Stored XSSVoting Record
- CVE-2023-7154Hubbub Lite < 1.32.0 - Admin+ Stored XSSHubbub Lite
- CVE-2023-6732Ultimate Maps by Supsystic < 1.2.16 - Admin+ Stored XSSUltimate Maps by Supsystic
- CVE-2024-0233EventON (Free < 2.2.8, Premium < 4.5.5) - Reflected XSSEventON
- CVE-2023-6005EventON (Free < 2.2.7, Premium < 4.5.5) - Admin+ Stored Cross-Site ScriptingEventON
- CVE-2023-6592FastDup – Fastest WordPress Migration & Duplicator < 2.2 - Directory Listing to Account Takeover and Sensitive Data ExposureFastDup
- CVE-2024-0187Community by PeepSo < 6.3.1.2 - Reflected XSSCommunity by PeepSo
- CVE-2023-6824WP Customer Area < 8.2.1 - Subscriber+ Account Address LeakWP Customer Area
- CVE-2024-0236EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Virtual Event Password DisclosureEventON
- CVE-2024-0237EventON (Free < 2.2.9, Premium <= 4.5.8) - Unauthenticated Virtual Event Settings UpdateEventON Premium · EventON
- CVE-2023-6741WP Customer Area < 8.2.1 - Subscriber+ Account Address UpdateWP Customer Area
- CVE-2023-4757Staff / Employee Business Directory for Active Directory < 1.2.3 - Improper escaping of LDAP entriesStaff / Employee Business Directory for Active Directory
- CVE-2023-0769hiWeb Migration Simple <= 2.0.0.1 Reflected Cross-Site ScriptinghiWeb Migration Simple
- CVE-2023-0389Calculated Fields Form < 1.1.151 - Admin+ Stored Cross-Site Scripting via Dropdown FieldsCalculated Fields Form
- CVE-2023-0376Qubely < 1.8.5 - Contributor+ Stored XSSQubely
- CVE-2023-0094UpQode Google Maps <= 1.0.5 - Contributor+ Stored XSSUpQode Google Maps
- CVE-2023-2252Directorist < 7.5.4 - Admin+ LFIDirectorist
- CVE-2023-3372Lana Shortcodes < 1.2.0 - Contributor+ Stored XSSLana Shortcodes
- CVE-2023-3178POST SMTP Mailer < 2.5.7 - Arbitrary Log Deletion via CSRFPOST SMTP Mailer
- CVE-2023-37521HCL BigFix OSD Bare Metal Server WebUI is affected by sensitive information disclosureHCL Software HCL BigFix OSD Bare Metal Server WebUI
- CVE-2023-0479Print Invoice & Delivery Notes for WooCommerce < 4.7.2 - Reflected XSS Print Invoice & Delivery Notes for WooCommerce
- CVE-2023-0079Customer Reviews for WooCommerce < 5.17.0 - Contributor+ Stored XSSCustomer Reviews for WooCommerce
- CVE-2023-5558LearnPress < 4.2.5.5 - Reflected Cross-Site ScriptingLearnPress
- CVE-2023-6046EventON < 2.2 - Admin+ Stored HTML InjectionEventON
- CVE-2023-3771T1 theme <= 19.0 - Open Redirectt1
- CVE-2023-3647IURNY by INDIGITALL < 3.2.3 - Admin+ Stored XSSIURNY by INDIGITALL
- CVE-2022-3194Dokan < 3.6.4 - Vendor Stored Cross-Site ScriptingDokan
- CVE-2022-3829Font Awesome 4 Menus <= 4.7.0 - Admin+ Stored XSSFont Awesome 4 Menus
- CVE-2022-3739WP Best Quiz <= 1.0 - Author+ Stored XSSWP Best Quiz
- CVE-2022-1618Coru LFMember <= 1.0.2 - Stored Cross-Site Scripting via CSRFCoru LFMember
- CVE-2022-1617WP-Invoice <= 4.3.1 - Stored Cross-Site Scripting via CSRFWP-Invoice
- CVE-2022-0775WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment DeletionWooCommerce
- CVE-2021-4227Ark Comment Editor <= 2.15.6 - Iframe Injection via Commentark-commenteditor
- CVE-2022-1760Core Control <= 1.2.1 - Arbitrary Settings Update via CSRFCore Control
- CVE-2022-23179Contact Form & Lead Form Elementor Builder < 1.7.0 - Multiple Admin+ Stored Cross-Site ScriptingContact Form & Lead Form Elementor Builder
- CVE-2022-23180Contact Form & Lead Form Elementor Builder Plugin < 1.7.4 - Multiple Subscriber+ Settings UpdateContact Form & Lead Form Elementor Builder
- CVE-2022-0402Superforms < 6.0.4 - Reflected Cross-Site ScriptingSuper Forms - Drag & Drop Form Builder
- CVE-2022-3836Seed Social < 2.0.4 - Admin+ Stored XSSSeed Social
- CVE-2022-1563WPGraphQL WooCommerce <= 0.11.0 - Unauthenticated Coupon Codes Disclosure wp-graphql-woocommerce
- CVE-2022-2413Slide Anything < 2.3.47 - Author+ Cross Site Scripting in slide titleSlide Anything
- CVE-2021-24870WP Fastest Cache < 0.9.5 - CSRF to Stored Cross-Site ScriptingWP Fastest Cache
- CVE-2021-24433Simple Sort&Search <= 0.0.3 - Ccontributor+ Stored XSSsimple sort&search
- CVE-2021-24432Advanced AJAX Product Filters < 1.5.4.7 - Unauthenticated Reflected Cross-Site Scripting (XSS)Advanced AJAX Product Filters
- CVE-2021-25117WP Postratings < 1.86.1 - Admin+ Stored Cross-Site ScriptingWP-PostRatings
- CVE-2021-24559Qyrr < 0.7 - Authenticated (contributor+) Stored XSSQyrr
- CVE-2021-24567Simple Post <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS)Simple Post
- CVE-2023-6395Mock: privilege escalation for users that can access mock configurationmock · Red Hat Enterprise Linux +3
- CVE-2021-4432PCMan FTP Server USER Command denial of servicePCMan FTP Server
- CVE-2024-0232Sqlite: use-after-free bug in jsonparseaddnodearraysqlite · Red Hat Enterprise Linux
- CVE-2024-0570Totolink N350RT Setting cstecgi.cgi access controlTotolink N350RT
- CVE-2024-0581Uncontrolled Resource Consumption vulnerability on Sandsprite scdbgSandsprite Scdbg
- CVE-2024-0569Totolink T8 Setting cstecgi.cgi getSysStatusCfg information disclosureTotolink T8
- CVE-2024-0555Cross-Site Request Forgery (CSRF) vulnerability on WIC1200Full Compass Systems WIC1200
- CVE-2024-0554Cross-site scripting (XSS) vulnerability on WIC1200Full Compass Systems WIC1200
- CVE-2023-52106Vulnerability of permission verification for APIs in the DownloadProviderMain module.Huawei HarmonyOS · Huawei EMUI
- CVE-2011-10005EasyFTP MKD Command buffer overflowEasyFTP
- CVE-2023-52112Unauthorized file access vulnerability in the wallpaper service module.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-6457File and Directory Permission Vulnerability in Hitachi Tuning ManagerHitachi Tuning Manager
- CVE-2023-49107Generation of Error Message Containing Sensitive Information Vulnerability in Hitachi Device ManagerHitachi Device Manager
- CVE-2023-49106Missing Password Field Masking Vulnerability in Hitachi Device ManagerHitachi Device Manager
- CVE-2023-36236Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file bagisto/bagisto
- CVE-2023-41619Emlog Pro v2.1.14 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /admin/article.php?action=write.
- CVE-2023-47459An issue in Knovos Discovery v.22.67.0 allows a remote attacker to obtain sensitive information via the /DiscoveryReview/Service/CaseManagem
- CVE-2023-48104Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.
- CVE-2023-48926An issue in 202 ecommerce Advanced Loyalty Program: Loyalty Points before v2.3.4 for PrestaShop allows unauthenticated attackers to arbitrar
- CVE-2023-51807Cross Site Scripting vulnerability in OFCMS v.1.14 allows a remote attacker to obtain sensitive information via a crafted payload to the tit
- CVE-2023-52068kodbox v1.43 was discovered to contain a cross-site scripting (XSS) vulnerability via the operation and login logs.
- CVE-2024-22491A Stored Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the post/save content parametecom.ibeetl:beetl