# CVEs published 2024-01-18

90 CVEs were published on January 18, 2024: 5 critical, 28 high. Days are UTC.

- [CVE-2024-0696](https://cve.now/CVE-2024-0696.md): AtroCore AtroPIM Product Series Overview cross site scripting (CVSS 3.5, AtroCore AtroPIM)
- [CVE-2024-0695](https://cve.now/CVE-2024-0695.md): EFS Easy Chat Server HTTP GET Request denial of service (CVSS 4.3, EFS Easy Chat Server)
- [CVE-2024-0693](https://cve.now/CVE-2024-0693.md): EFS Easy File Sharing FTP denial of service (CVSS 5.3, EFS Easy File Sharing FTP)
- [CVE-2023-43824](https://cve.now/CVE-2023-43824.md): Delta Electronics Delta Industrial Automation DOPSoft DPS File wTitleTextLen Buffer Overflow Remote Code Execution (CVSS 8.8, Delta Electronics DOPSoft)
- [CVE-2023-43823](https://cve.now/CVE-2023-43823.md): Delta Electronics Delta Industrial Automation DOPSoft DPS File wTTitleLen Buffer Overflow Remote Code Execution (CVSS 8.8, Delta Electronics DOPSoft)
- [CVE-2023-43822](https://cve.now/CVE-2023-43822.md): Delta Electronics Delta Industrial Automation DOPSoft DPS File wLogTitlesTimeLen Buffer Overflow Remote Code Execution (CVSS 8.8, Delta Electronics DOPSoft)
- [CVE-2023-43821](https://cve.now/CVE-2023-43821.md): Delta Electronics Delta Industrial Automation DOPSoft DPS File wLogTitlesActionLen Buffer Overflow Remote Code Execution (CVSS 8.8, Delta Electronics DOPSoft)
- [CVE-2023-43820](https://cve.now/CVE-2023-43820.md): Delta Electronics Delta Industrial Automation DOPSoft DPS File wLogTitlesPrevValueLen Buffer Overflow Remote Code Execution (CVSS 8.8, Delta Electronics DOPSoft)
- [CVE-2023-43819](https://cve.now/CVE-2023-43819.md): Delta Electronics Delta Industrial Automation DOPSoft DPS File InitialMacroLen Buffer Overflow Remote Code Execution (CVSS 8.8, Delta Electronics DOPSoft)
- [CVE-2023-43818](https://cve.now/CVE-2023-43818.md): Delta Electronics Delta Industrial Automation DOPSoft DPS File wTextLen Buffer Overflow Remote Code Execution (CVSS 8.8, Delta Electronics DOPSoft)
- [CVE-2023-43817](https://cve.now/CVE-2023-43817.md): Delta Electronics Delta Industrial Automation DOPSoft DPS File wMailContentLen Buffer Overflow Remote Code Execution (CVSS 7.5, Delta Electronics DOPSoft)
- [CVE-2023-43816](https://cve.now/CVE-2023-43816.md): Delta Electronics Delta Industrial Automation DOPSoft DPS File wKPFStringLen Buffer Overflow Remote Code Execution (CVSS 6.3, Delta Electronics DOPSoft)
- [CVE-2023-43815](https://cve.now/CVE-2023-43815.md): Delta Electronics Delta Industrial Automation DOPSoft DPS File wScreenDESCTextLen Buffer Overflow Remote Code Execution (CVSS 7.1, Delta Electronics DOPSoft)
- [CVE-2023-5131](https://cve.now/CVE-2023-5131.md): Delta Electronics ISPSoft Heap Buffer-Overflow (CVSS 8.2, Delta Electronics ISPSoft)
- [CVE-2023-5130](https://cve.now/CVE-2023-5130.md): Delta Electronics WPLSoft Buffer-Overflow (CVSS 8.2, Delta Electronics WPLSoft)
- [CVE-2024-22418](https://cve.now/CVE-2024-22418.md): Stored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice (CVSS 6.5, Intermesh groupoffice)
- [CVE-2024-22415](https://cve.now/CVE-2024-22415.md): Unsecured endpoints in the jupyter-lsp server extension (CVSS 7.3, jupyter-lsp jupyterlab-lsp · jupyter-lsp)
- [CVE-2024-22402](https://cve.now/CVE-2024-22402.md): Improper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist (CVSS 5.4, nextcloud security-advisories)
- [CVE-2024-22401](https://cve.now/CVE-2024-22401.md): All users can reset the allowed apps list for Nextcloud Guest App users (CVSS 4.1, nextcloud security-advisories)
- [CVE-2024-22404](https://cve.now/CVE-2024-22404.md): Permissions bypass in Nextcloud with the files zip app (CVSS 4.1, nextcloud security-advisories)
- [CVE-2024-22403](https://cve.now/CVE-2024-22403.md): OAuth2 authorization codes are valid indefinetly in Nextcloud server (CVSS 3.0, nextcloud security-advisories)
- [CVE-2024-22400](https://cve.now/CVE-2024-22400.md): Open redirect in user\_saml via RelayState parameter in Nextcloud User Saml (CVSS 3.1, nextcloud security-advisories)
- [CVE-2024-22213](https://cve.now/CVE-2024-22213.md): Cross-site Scripting when sending HTML as a comment in the Nextcloud Deck app (CVSS 0.0, nextcloud security-advisories)
- [CVE-2024-22212](https://cve.now/CVE-2024-22212.md): Nextcloud global site selector authentication bypass (CVSS 9.7, nextcloud security-advisories)
- [CVE-2024-22419](https://cve.now/CVE-2024-22419.md): concat built-in can corrupt memory in vyper (CVSS 7.3, vyperlang vyper · vyper)
- [CVE-2023-34348](https://cve.now/CVE-2023-34348.md): Improper Check or Handling of Exceptional Conditions in Aveva PI Server (CVSS 7.5, Aveva PI Server)
- [CVE-2023-31274](https://cve.now/CVE-2023-31274.md): Missing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server (CVSS 5.3, Aveva PI Server)
- [CVE-2023-28901](https://cve.now/CVE-2023-28901.md): Trip Data Disclosure from Backend (CVSS 5.3, Skoda Auto Skoda Connect)
- [CVE-2023-28900](https://cve.now/CVE-2023-28900.md): Nickname Disclosure on the Backend Automotive Server (CVSS 5.3, Škoda Auto Škoda Connect)
- [CVE-2024-0607](https://cve.now/CVE-2024-0607.md): Kernel: nf\_tables: pointer math issue in nft\_byteorder\_eval() (CVSS 6.6, kernel · Red Hat Enterprise Linux)
- [CVE-2024-0409](https://cve.now/CVE-2024-0409.md): Xorg-x11-server: selinux context corruption (CVSS 7.8, xorg-server · Red Hat Enterprise Linux)
- [CVE-2024-0408](https://cve.now/CVE-2024-0408.md): Xorg-x11-server: selinux unlabeled glx pbuffer (CVSS 5.5, xorg-server · Red Hat Enterprise Linux)
- [CVE-2023-40052](https://cve.now/CVE-2023-40052.md): Progress Application Server (PAS) for OpenEdge Denial of Service (CVSS 7.5, Progress Software OpenEdge)
- [CVE-2023-40051](https://cve.now/CVE-2023-40051.md): Progress Application Server (PAS) for OpenEdge File Upload via Directory Traversal (CVSS 9.1, Progress Software OpenEdge)
- [CVE-2021-33631](https://cve.now/CVE-2021-33631.md): Kernel crash in EXT4 filesystem (CVSS 5.5, openEuler kernel)
- [CVE-2021-33630](https://cve.now/CVE-2021-33630.md): NULL-ptr-deref in network sched (CVSS 5.5, openEuler kernel)
- [CVE-2023-7153](https://cve.now/CVE-2023-7153.md): Reflected XSS in Macroturk's Macro-Bel (CVSS 6.1, Macroturk Software and Internet Technologies Macro-Bel)
- [CVE-2024-22317](https://cve.now/CVE-2024-22317.md): IBM App Connect Enterprise denial of service (CVSS 9.1, IBM App Connect Enterprise)
- [CVE-2023-5806](https://cve.now/CVE-2023-5806.md): SQLi in Mergen Soft Quality Management System (CVSS 9.8, Mergen Software Quality Management System)
- [CVE-2024-0669](https://cve.now/CVE-2024-0669.md): Cross-Frame Scripting (XFS) on Plone CMS (CVSS 6.3, Plone CMS · plone)
- [CVE-2023-51463](https://cve.now/CVE-2023-51463.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-51464](https://cve.now/CVE-2023-51464.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-0580](https://cve.now/CVE-2024-0580.md): Omission of key-controlled authorization in Qsige (CVSS 6.5, IDMSistemas Sinergia, Sinergia 2.0, and Sinergia Corporativo)
- [CVE-2023-6958](https://cve.now/CVE-2023-6958.md): WP Recipe Maker \<= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, brechtvds WP Recipe Maker)
- [CVE-2024-0381](https://cve.now/CVE-2024-0381.md): WP Recipe Maker \<= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' (CVSS 6.4, brechtvds WP Recipe Maker)
- [CVE-2023-6970](https://cve.now/CVE-2023-6970.md): WP Recipe Maker \<= 9.1.0 - Reflected Cross-Site Scripting via Referer (CVSS 6.1, brechtvds WP Recipe Maker)
- [CVE-2023-6816](https://cve.now/CVE-2023-6816.md): Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer (CVSS 9.8, Red Hat Enterprise Linux 6 Extended Lifecycle Support - EX…)
- [CVE-2023-48359](https://cve.now/CVE-2023-48359.md): In autotest driver, there is a possible out of bounds write due to improper input validation. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48358](https://cve.now/CVE-2023-48358.md): In drm driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48357](https://cve.now/CVE-2023-48357.md): In vsp driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48356](https://cve.now/CVE-2023-48356.md): In jpg driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48355](https://cve.now/CVE-2023-48355.md): In jpg driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48354](https://cve.now/CVE-2023-48354.md): In telephone service, there is a possible improper input validation. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48353](https://cve.now/CVE-2023-48353.md): In vsp driver, there is a possible use after free due to a logic error. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48352](https://cve.now/CVE-2023-48352.md): In phasecheckserver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48351](https://cve.now/CVE-2023-48351.md): In video decoder, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48350](https://cve.now/CVE-2023-48350.md): In video decoder, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48349](https://cve.now/CVE-2023-48349.md): In video decoder, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48348](https://cve.now/CVE-2023-48348.md): In video decoder, there is a possible out of bounds write due to improper input validation. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48347](https://cve.now/CVE-2023-48347.md): In video decoder, there is a possible out of bounds read due to improper input validation. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48346](https://cve.now/CVE-2023-48346.md): In video decoder, there is a possible improper input validation. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48345](https://cve.now/CVE-2023-48345.md): In video decoder, there is a possible out of bounds read due to improper input validation. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48344](https://cve.now/CVE-2023-48344.md): In video decoder, there is a possible out of bounds read due to improper input validation. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48343](https://cve.now/CVE-2023-48343.md): In video decoder, there is a possible out of bounds write due to improper input validation. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48342](https://cve.now/CVE-2023-48342.md): In media service, there is a possible out of bounds write due to a missing bounds check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48341](https://cve.now/CVE-2023-48341.md): In video decoder, there is a possible out of bounds read due to improper input validation. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48340](https://cve.now/CVE-2023-48340.md): In video decoder, there is a possible out of bounds write due to improper input validation. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2023-48339](https://cve.now/CVE-2023-48339.md): In jpg driver, there is a possible missing permission check. (CVSS 4.4, Unisoc (Shanghai) Technologies Co. SC7731E/SC9832E/SC9863A/…)
- [CVE-2024-0655](https://cve.now/CVE-2024-0655.md): Novel-Plus list sql injection (CVSS 5.5, Novel-Plus)
- [CVE-2023-6184](https://cve.now/CVE-2023-6184.md): Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting (CVSS 5.0, Cloud Software Group Citrix Session Recording)
- [CVE-2024-0654](https://cve.now/CVE-2024-0654.md): DeepFaceLab Util.py deserialization (CVSS 5.3, DeepFaceLab)
- [CVE-2024-0652](https://cve.now/CVE-2024-0652.md): PHPGurukul Company Visitor Management System search-visitor.php cross site scripting (CVSS 3.5, PHPGurukul Company Visitor Management System)
- [CVE-2021-4433](https://cve.now/CVE-2021-4433.md): Karjasoft Sami HTTP Server HTTP HEAD Rrequest denial of service (CVSS 5.3, Karjasoft Sami HTTP Server)
- [CVE-2024-0651](https://cve.now/CVE-2024-0651.md): PHPGurukul Company Visitor Management System search-visitor.php sql injection (CVSS 6.3, PHPGurukul Company Visitor Management System)
- [CVE-2023-49943](https://cve.now/CVE-2023-49943.md): Zoho ManageEngine ServiceDesk Plus MSP before 14504 allows stored XSS (by a low-privileged technician) via a task's name in a time sheet. (CVSS 5.4)
- [CVE-2023-50614](https://cve.now/CVE-2023-50614.md): An issue discovereed in EBYTE E880-IR01-V1.1 allows an attacker to obtain sensitive information via crafted POST request to /cgi-bin/luci. (CVSS 7.5)
- [CVE-2023-51217](https://cve.now/CVE-2023-51217.md): An issue discovered in TenghuTOS TWS-200 firmware version:V4.0-201809201424 allows a remote attacker to execute arbitrary code via crafted c (CVSS 8.8)
- [CVE-2023-51258](https://cve.now/CVE-2023-51258.md): A memory leak issue discovered in YASM v.1.3.0 allows a local attacker to cause a denial of service via the new\_Token function in the module (CVSS 5.5)
- [CVE-2024-22548](https://cve.now/CVE-2024-22548.md): FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the system website settings website name section. (CVSS 5.4)
- [CVE-2024-22549](https://cve.now/CVE-2024-22549.md): FlyCms 1.0 is vulnerable to Cross Site Scripting (XSS) in the email settings of the website settings section. (CVSS 5.4)
- [CVE-2024-22568](https://cve.now/CVE-2024-22568.md): FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/del. (CVSS 8.8)
- [CVE-2024-22591](https://cve.now/CVE-2024-22591.md): FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group\_save. (CVSS 8.8)
- [CVE-2024-22592](https://cve.now/CVE-2024-22592.md): FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/user/group\_update (CVSS 8.8)
- [CVE-2024-22593](https://cve.now/CVE-2024-22593.md): FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/add\_group\_save (CVSS 8.8)
- [CVE-2024-22601](https://cve.now/CVE-2024-22601.md): FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/score/scorerule\_save (CVSS 8.8)
- [CVE-2024-22603](https://cve.now/CVE-2024-22603.md): FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/links/add\_link (CVSS 8.8)
- [CVE-2024-22699](https://cve.now/CVE-2024-22699.md): FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/admin/update\_group\_save. (CVSS 8.8)
- [CVE-2024-22817](https://cve.now/CVE-2024-22817.md): FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email\_conf\_updagte (CVSS 8.8)
- [CVE-2024-22818](https://cve.now/CVE-2024-22818.md): FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerbility via /system/site/filterKeyword\_save (CVSS 8.8)
- [CVE-2024-22819](https://cve.now/CVE-2024-22819.md): FlyCms v1.0 contains a Cross-Site Request Forgery (CSRF) vulnerability via /system/email/email\_templets\_update. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.