CVEs published January 17, 2024
82 CVEs were published on January 17, 2024: 5 critical, 13 high. 2 are now in CISA KEV.
- Published
- 82
- Critical
- 5
- High
- 13
- Medium
- 62
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 11
Most affected products
- Hathway Skyworth Router CM5100
- 25
- Cisco Prime Infrastructure · Cisco Evolved Programmable Net…
- 3
- Cires21 C21 Live Encoder and Live Mosaic
- 2
- kernel · Red Hat Enterprise Linux
- 2
- AlgolPlus Advanced Dynamic Pricing for WooCommerce
- 1
- Avaya Experience Portal Manager
- 1
- Brainstorm Force Ultimate Addons for Beaver Builder – Lite
- 1
- burstbv Burst Statistics – Privacy-Friendly WordPress Analy…
- 1
- Cisco BroadWorks
- 1
- Cisco Business Wireless Access Point Software
- 1
Critical 5
- CVE-2024-22416Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalationpyload · pyload-ng
- CVE-2024-0643Unrestricted upload of dangerous file types in C21 Live Encoder and Live MosaicCires21 C21 Live Encoder and Live Mosaic
- CVE-2024-0642Inadequate access control in C21 Live Encoder and Live MosaicCires21 C21 Live Encoder and Live Mosaic
- CVE-2021-4434Social Warfare <= 3.5.2 - Remote Code Executionwarfareplugins Social Sharing Plugin – Social Warfare
- CVE-2023-44077Studio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636.
High 13
- CVE-2024-0648Yunyou CMS Common.php unrestricted uploadYunyou CMS
- CVE-2023-6549Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated DenialCloud Software Group NetScaler ADC
- CVE-2024-20272A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload arCisco Unity Connection
- CVE-2022-41990WordPress 3D Tag Cloud Plugin <= 3.8 is vulnerable to Cross Site Request Forgery (CSRF)Vinoj Cardoza 3D Tag Cloud
- CVE-2024-0396Missing Server-Side Input Validation in HTTP ParameterProgress Software MOVEit Transfer
- CVE-2024-0646Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destinationkernel · Red Hat Enterprise Linux +2
- CVE-2023-5041Track The Click < 0.3.12 - Author+ Time-Based Blind SQL InjectionTrack The Click
- CVE-2024-0645Buffer Overflow Vulnerability in Explorer++explorerplusplus Explorer++.exe
- CVE-2023-51741Cleartext Submission of Password vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51740Cleartext Submission of Password vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2024-0405Burst Statistics Really Simple Plugins <= 1.5.3 - Authenticated (Editor+) SQL Injectionburstbv Burst Statistics – Privacy-Friendly WordPress Analy…
- CVE-2023-52285ExamSys 9150244 allows SQL Injection via the /Support/action/Pages.php s_score2 parameter.
- CVE-2024-22715Stupid Simple CMS <=1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin-edit.php.
Medium, low and unrated 64
- CVE-2023-6340SonicWall Capture Client version 3.7.10, NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver.SonicWall Capture Client · SonicWall NetExtender
- CVE-2024-0650Project Worlds Visitor Management System URL dataset.php cross site scriptingProject Worlds Visitor Management System
- CVE-2024-0649ZhiHuiYun Search ImageController.php download_network_image server-side request forgeryZhiHuiYun
- CVE-2024-22414User profile page vulnerable to Cross Site Scripting (XSS) in flaskBlogDogukanUrker flaskBlog
- CVE-2024-22410Binary Planting Attack on Windows Platforms in Creditcoingluwa creditcoin
- CVE-2023-5914 Cross-site scripting (XSS)Cloud Software Group Citrix StoreFront
- CVE-2023-6548Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLICloud Software Group NetScaler ADC · Cloud Software Group N…
- CVE-2023-7031Avaya Experience Portal Manager Insecure Direct Object Reference VulnerabilitiesAvaya Experience Portal Manager
- CVE-2024-0647Sparksuite SimpleMDE iFrame cross site scriptingSparksuite SimpleMDE
- CVE-2022-42884WordPress WIP Custom Login Plugin <= 1.2.7 is vulnerable to Broken Access ControlThemeinProgress WIP Custom Login
- CVE-2022-41790WordPress WP Time Slots Booking Form Plugin <= 1.1.76 is vulnerable to Broken Access ControlCodePeople WP Time Slots Booking Form
- CVE-2022-41786WordPress WP Job Portal Plugin <= 2.0.1 is vulnerable to Broken Access ControlWP Job Portal – A Complete Job Board
- CVE-2022-41695WordPress Traffic Manager Plugin <= 1.4.5 is vulnerable to Broken Access ControlSedLex Traffic Manager
- CVE-2023-50950IBM QRadar information disclosureIBM QRadar SIEM
- CVE-2022-41619WordPress Image Zoom Plugin <= 1.8.8 is vulnerable to Broken Access ControlSedLex Image Zoom
- CVE-2024-20277A vulnerability in the web-based management interface of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could allCisco ThousandEyes Recorder Application
- CVE-2024-20287A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point SetupCisco Business Wireless Access Point Software
- CVE-2023-20260A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authenticCisco Prime Infrastructure · Cisco Evolved Programmable Net…
- CVE-2023-20258A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to executeCisco Prime Infrastructure
- CVE-2023-20271A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) coCisco Prime Infrastructure · Cisco Evolved Programmable Net…
- CVE-2023-20257A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conductCisco Prime Infrastructure · Cisco Evolved Programmable Net…
- CVE-2024-20251A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker Cisco Identity Services Engine Software
- CVE-2024-20270A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended ServiceCisco BroadWorks
- CVE-2022-40702WordPress Advanced Local Pickup for WooCommerce Plugin <= 1.5.2 is vulnerable to Broken Access ControlZorem Advanced Local Pickup for WooCommerce
- CVE-2023-23882WordPress Ultimate Addons for Beaver Builder – Lite Plugin <= 1.5.5 is vulnerable to Broken Access ControlBrainstorm Force Ultimate Addons for Beaver Builder – Lite
- CVE-2023-23896WordPress URL Shortener by MyThemeShop Plugin <= 1.0.17 is vulnerable to Broken Access ControlURL Shortener by MyThemeShop
- CVE-2023-34379WordPress Cart2Cart: Magento to WooCommerce Migration Plugin <= 2.0.0 is vulnerable to Broken Access ControlMagneticOne Cart2Cart: Magento to WooCommerce Migration
- CVE-2022-40203WordPress Advanced Dynamic Pricing for WooCommerce Plugin <= 4.1.5 is vulnerable to Broken Access ControlAlgolPlus Advanced Dynamic Pricing for WooCommerce
- CVE-2022-38141WordPress Sales Report Email for WooCommerce Plugin <= 2.8 is vulnerable to Broken Access ControlZorem Sales Report Email for WooCommerce
- CVE-2022-36418WordPress HREFLANG Tags Lite Plugin <= 2.0.0 is vulnerable to Broken AuthenticationVagary Digital HREFLANG Tags Lite
- CVE-2024-0641Kernel: deadlock leading to denial of service in tipc_crypto_key_revokekernel · Red Hat Enterprise Linux
- CVE-2024-0639Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to doskernel · Red Hat Enterprise Linux
- CVE-2023-5006WP Discord Invite < 2.5.1 - Arbitrary Settings Update via CSRFWP Discord Invite
- CVE-2023-51743Buffer Overflow vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51742Buffer Overflow vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51739Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51738Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51737Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51736Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51735Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51734Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51733Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51732Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51731Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51730Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51729Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51728Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51727Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51726Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51725Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51724Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51723Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51722Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51721Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51720Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-51719Stored Cross Site Scripting Vulnerability in Skyworth RouterHathway Skyworth Router CM5100
- CVE-2023-25295A Cross Site Scripting (XSS) vulnerability in evewa3ajax.php in GRUEN eVEWA3 Community 31 through 53 allows attackers to obtain escalated pr
- CVE-2023-36235An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id_order parameter.
- CVE-2023-46952Cross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer head
- CVE-2023-48858A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web scrip
- CVE-2023-49515Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proxi
- CVE-2023-52069kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter.
- CVE-2024-22714Stupid Simple CMS <=1.2.4 is vulnerable to Cross Site Scripting (XSS) in the editing section of the article content.
- CVE-2024-23525The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no_xxe option of XML::Twig.