# CVEs published 2024-01-17

82 CVEs were published on January 17, 2024: 5 critical, 13 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-6340](https://cve.now/CVE-2023-6340.md): SonicWall Capture Client version 3.7.10, NetExtender client version 10.2.337 and earlier versions are installed with sfpmonitor.sys driver. (CVSS 5.5, SonicWall Capture Client · SonicWall NetExtender)
- [CVE-2024-22416](https://cve.now/CVE-2024-22416.md): Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation (CVSS 9.7, pyload · pyload-ng)
- [CVE-2024-0650](https://cve.now/CVE-2024-0650.md): Project Worlds Visitor Management System URL dataset.php cross site scripting (CVSS 4.3, Project Worlds Visitor Management System)
- [CVE-2024-0649](https://cve.now/CVE-2024-0649.md): ZhiHuiYun Search ImageController.php download\_network\_image server-side request forgery (CVSS 6.3, ZhiHuiYun)
- [CVE-2024-0648](https://cve.now/CVE-2024-0648.md): Yunyou CMS Common.php unrestricted upload (CVSS 7.3, Yunyou CMS)
- [CVE-2024-22414](https://cve.now/CVE-2024-22414.md): User profile page vulnerable to Cross Site Scripting (XSS) in flaskBlog (CVSS 6.5, DogukanUrker flaskBlog)
- [CVE-2024-22410](https://cve.now/CVE-2024-22410.md): Binary Planting Attack on Windows Platforms in Creditcoin (CVSS 3.3, gluwa creditcoin)
- [CVE-2023-5914](https://cve.now/CVE-2023-5914.md): Cross-site scripting (XSS) (CVSS 5.4, Cloud Software Group Citrix StoreFront)
- [CVE-2023-6549](https://cve.now/CVE-2023-6549.md): Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial (CVSS 8.2, KEV, Cloud Software Group NetScaler ADC)
- [CVE-2023-6548](https://cve.now/CVE-2023-6548.md): Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLI (CVSS 5.5, KEV, Cloud Software Group NetScaler ADC · Cloud Software Group N…)
- [CVE-2023-7031](https://cve.now/CVE-2023-7031.md): Avaya Experience Portal Manager Insecure Direct Object Reference Vulnerabilities (CVSS 5.7, Avaya Experience Portal Manager)
- [CVE-2024-0647](https://cve.now/CVE-2024-0647.md): Sparksuite SimpleMDE iFrame cross site scripting (CVSS 4.3, Sparksuite SimpleMDE)
- [CVE-2022-42884](https://cve.now/CVE-2022-42884.md): WordPress WIP Custom Login Plugin \<= 1.2.7 is vulnerable to Broken Access Control (CVSS 5.4, ThemeinProgress WIP Custom Login)
- [CVE-2022-41790](https://cve.now/CVE-2022-41790.md): WordPress WP Time Slots Booking Form Plugin \<= 1.1.76 is vulnerable to Broken Access Control (CVSS 4.3, CodePeople WP Time Slots Booking Form)
- [CVE-2022-41786](https://cve.now/CVE-2022-41786.md): WordPress WP Job Portal Plugin \<= 2.0.1 is vulnerable to Broken Access Control (CVSS 5.4, WP Job Portal – A Complete Job Board)
- [CVE-2022-41695](https://cve.now/CVE-2022-41695.md): WordPress Traffic Manager Plugin \<= 1.4.5 is vulnerable to Broken Access Control (CVSS 5.4, SedLex Traffic Manager)
- [CVE-2023-50950](https://cve.now/CVE-2023-50950.md): IBM QRadar information disclosure (CVSS 3.7, IBM QRadar SIEM)
- [CVE-2022-41619](https://cve.now/CVE-2022-41619.md): WordPress Image Zoom Plugin \<= 1.8.8 is vulnerable to Broken Access Control (CVSS 5.4, SedLex Image Zoom)
- [CVE-2024-20277](https://cve.now/CVE-2024-20277.md): A vulnerability in the web-based management interface of Cisco ThousandEyes Enterprise Agent, Virtual Appliance installation type, could all (CVSS 6.8, Cisco ThousandEyes Recorder Application)
- [CVE-2024-20287](https://cve.now/CVE-2024-20287.md): A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point Setup (CVSS 6.5, Cisco Business Wireless Access Point Software)
- [CVE-2023-20260](https://cve.now/CVE-2023-20260.md): A vulnerability in the application CLI of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager could allow an authentic (CVSS 6.0, Cisco Prime Infrastructure · Cisco Evolved Programmable Net…)
- [CVE-2023-20258](https://cve.now/CVE-2023-20258.md): A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to execute (CVSS 6.5, Cisco Prime Infrastructure)
- [CVE-2023-20271](https://cve.now/CVE-2023-20271.md): A vulnerability in the web-based management interface of Cisco Prime Infrastructure and Cisco Evolved Programmable Network Manager (EPNM) co (CVSS 6.5, Cisco Prime Infrastructure · Cisco Evolved Programmable Net…)
- [CVE-2023-20257](https://cve.now/CVE-2023-20257.md): A vulnerability in the web-based management interface of Cisco Prime Infrastructure could allow an authenticated, remote attacker to conduct (CVSS 4.8, Cisco Prime Infrastructure · Cisco Evolved Programmable Net…)
- [CVE-2024-20251](https://cve.now/CVE-2024-20251.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2024-20272](https://cve.now/CVE-2024-20272.md): A vulnerability in the web-based management interface of Cisco Unity Connection could allow an unauthenticated, remote attacker to upload ar (CVSS 7.3, Cisco Unity Connection)
- [CVE-2024-20270](https://cve.now/CVE-2024-20270.md): A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Service (CVSS 4.8, Cisco BroadWorks)
- [CVE-2022-40702](https://cve.now/CVE-2022-40702.md): WordPress Advanced Local Pickup for WooCommerce Plugin \<= 1.5.2 is vulnerable to Broken Access Control (CVSS 5.4, Zorem Advanced Local Pickup for WooCommerce)
- [CVE-2023-23882](https://cve.now/CVE-2023-23882.md): WordPress Ultimate Addons for Beaver Builder – Lite Plugin \<= 1.5.5 is vulnerable to Broken Access Control (CVSS 4.3, Brainstorm Force Ultimate Addons for Beaver Builder – Lite)
- [CVE-2023-23896](https://cve.now/CVE-2023-23896.md): WordPress URL Shortener by MyThemeShop Plugin \<= 1.0.17 is vulnerable to Broken Access Control (CVSS 5.4, URL Shortener by MyThemeShop)
- [CVE-2022-41990](https://cve.now/CVE-2022-41990.md): WordPress 3D Tag Cloud Plugin \<= 3.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, Vinoj Cardoza 3D Tag Cloud)
- [CVE-2023-34379](https://cve.now/CVE-2023-34379.md): WordPress Cart2Cart: Magento to WooCommerce Migration Plugin \<= 2.0.0 is vulnerable to Broken Access Control (CVSS 5.4, MagneticOne Cart2Cart: Magento to WooCommerce Migration)
- [CVE-2022-40203](https://cve.now/CVE-2022-40203.md): WordPress Advanced Dynamic Pricing for WooCommerce Plugin \<= 4.1.5 is vulnerable to Broken Access Control (CVSS 6.3, AlgolPlus Advanced Dynamic Pricing for WooCommerce)
- [CVE-2022-38141](https://cve.now/CVE-2022-38141.md): WordPress Sales Report Email for WooCommerce Plugin \<= 2.8 is vulnerable to Broken Access Control (CVSS 4.3, Zorem Sales Report Email for WooCommerce)
- [CVE-2024-0396](https://cve.now/CVE-2024-0396.md): Missing Server-Side Input Validation in HTTP Parameter (CVSS 7.1, Progress Software MOVEit Transfer)
- [CVE-2022-36418](https://cve.now/CVE-2022-36418.md): WordPress HREFLANG Tags Lite Plugin \<= 2.0.0 is vulnerable to Broken Authentication (CVSS 6.5, Vagary Digital HREFLANG Tags Lite)
- [CVE-2024-0646](https://cve.now/CVE-2024-0646.md): Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination (CVSS 7.0, kernel · Red Hat Enterprise Linux +2)
- [CVE-2024-0641](https://cve.now/CVE-2024-0641.md): Kernel: deadlock leading to denial of service in tipc\_crypto\_key\_revoke (CVSS 5.5, kernel · Red Hat Enterprise Linux)
- [CVE-2024-0639](https://cve.now/CVE-2024-0639.md): Kernel: potential deadlock on &net-\>sctp.addr\_wq\_lock leading to dos (CVSS 5.5, kernel · Red Hat Enterprise Linux)
- [CVE-2023-5006](https://cve.now/CVE-2023-5006.md): WP Discord Invite \< 2.5.1 - Arbitrary Settings Update via CSRF (CVSS 6.5, WP Discord Invite)
- [CVE-2023-5041](https://cve.now/CVE-2023-5041.md): Track The Click \< 0.3.12 - Author+ Time-Based Blind SQL Injection (CVSS 8.8, Track The Click)
- [CVE-2024-0645](https://cve.now/CVE-2024-0645.md): Buffer Overflow Vulnerability in Explorer++ (CVSS 7.3, explorerplusplus Explorer++.exe)
- [CVE-2024-0643](https://cve.now/CVE-2024-0643.md): Unrestricted upload of dangerous file types in C21 Live Encoder and Live Mosaic (CVSS 10.0, Cires21 C21 Live Encoder and Live Mosaic)
- [CVE-2024-0642](https://cve.now/CVE-2024-0642.md): Inadequate access control in C21 Live Encoder and Live Mosaic (CVSS 9.8, Cires21 C21 Live Encoder and Live Mosaic)
- [CVE-2021-4434](https://cve.now/CVE-2021-4434.md): Social Warfare \<= 3.5.2 - Remote Code Execution (CVSS 10.0, warfareplugins Social Sharing Plugin – Social Warfare)
- [CVE-2023-51743](https://cve.now/CVE-2023-51743.md): Buffer Overflow vulnerability in Skyworth Router (CVSS 6.5, Hathway Skyworth Router CM5100)
- [CVE-2023-51742](https://cve.now/CVE-2023-51742.md): Buffer Overflow vulnerability in Skyworth Router (CVSS 6.5, Hathway Skyworth Router CM5100)
- [CVE-2023-51741](https://cve.now/CVE-2023-51741.md): Cleartext Submission of Password vulnerability in Skyworth Router (CVSS 7.5, Hathway Skyworth Router CM5100)
- [CVE-2023-51740](https://cve.now/CVE-2023-51740.md): Cleartext Submission of Password vulnerability in Skyworth Router (CVSS 7.5, Hathway Skyworth Router CM5100)
- [CVE-2023-51739](https://cve.now/CVE-2023-51739.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51738](https://cve.now/CVE-2023-51738.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51737](https://cve.now/CVE-2023-51737.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51736](https://cve.now/CVE-2023-51736.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51735](https://cve.now/CVE-2023-51735.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51734](https://cve.now/CVE-2023-51734.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51733](https://cve.now/CVE-2023-51733.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51732](https://cve.now/CVE-2023-51732.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51731](https://cve.now/CVE-2023-51731.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51730](https://cve.now/CVE-2023-51730.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51729](https://cve.now/CVE-2023-51729.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51728](https://cve.now/CVE-2023-51728.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51727](https://cve.now/CVE-2023-51727.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51726](https://cve.now/CVE-2023-51726.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51725](https://cve.now/CVE-2023-51725.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51724](https://cve.now/CVE-2023-51724.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51723](https://cve.now/CVE-2023-51723.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51722](https://cve.now/CVE-2023-51722.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51721](https://cve.now/CVE-2023-51721.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51720](https://cve.now/CVE-2023-51720.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2023-51719](https://cve.now/CVE-2023-51719.md): Stored Cross Site Scripting Vulnerability in Skyworth Router (CVSS 6.9, Hathway Skyworth Router CM5100)
- [CVE-2024-0405](https://cve.now/CVE-2024-0405.md): Burst Statistics Really Simple Plugins \<= 1.5.3 - Authenticated (Editor+) SQL Injection (CVSS 7.2, burstbv Burst Statistics – Privacy-Friendly WordPress Analy…)
- [CVE-2023-25295](https://cve.now/CVE-2023-25295.md): A Cross Site Scripting (XSS) vulnerability in evewa3ajax.php in GRUEN eVEWA3 Community 31 through 53 allows attackers to obtain escalated pr (CVSS 6.1)
- [CVE-2023-36235](https://cve.now/CVE-2023-36235.md): An issue in webkul qloapps before v1.6.0 allows an attacker to obtain sensitive information via the id\_order parameter. (CVSS 6.5)
- [CVE-2023-44077](https://cve.now/CVE-2023-44077.md): Studio Network Solutions ShareBrowser before 7.0 on macOS mishandles signature verification, aka PMP-2636. (CVSS 9.8)
- [CVE-2023-46952](https://cve.now/CVE-2023-46952.md): Cross Site Scripting vulnerability in ABO.CMS v.5.9.3 allows an attacker to execute arbitrary code via a crafted payload to the Referer head (CVSS 6.1)
- [CVE-2023-48858](https://cve.now/CVE-2023-48858.md): A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web scrip (CVSS 6.1)
- [CVE-2023-49515](https://cve.now/CVE-2023-49515.md): Insecure Permissiosn vulnerability in TP Link TC70 and C200 WIFI Camera v.3 firmware v.1.3.4 and fixed in v.1.3.11 allows a physically proxi (CVSS 4.6)
- [CVE-2023-52069](https://cve.now/CVE-2023-52069.md): kodbox v1.49.04 was discovered to contain a cross-site scripting (XSS) vulnerability via the URL parameter. (CVSS 5.4)
- [CVE-2023-52285](https://cve.now/CVE-2023-52285.md): ExamSys 9150244 allows SQL Injection via the /Support/action/Pages.php s\_score2 parameter. (CVSS 7.5)
- [CVE-2024-22714](https://cve.now/CVE-2024-22714.md): Stupid Simple CMS \<=1.2.4 is vulnerable to Cross Site Scripting (XSS) in the editing section of the article content. (CVSS 6.1)
- [CVE-2024-22715](https://cve.now/CVE-2024-22715.md): Stupid Simple CMS \<=1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /admin-edit.php. (CVSS 8.8)
- [CVE-2024-23525](https://cve.now/CVE-2024-23525.md): The Spreadsheet::ParseXLSX package before 0.30 for Perl allows XXE attacks because it neglects to use the no\_xxe option of XML::Twig. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.