CVEs published January 19, 2024
104 CVEs were published on January 19, 2024: 12 critical, 38 high.
- Published
- 104
- Critical
- 12
- High
- 38
- Medium
- 46
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- Intel NUC BIOS firmware
- 6
- de.tum.in.ase:artemis-java-test-sandbox
- 3
- Byzoro Smart S150 Management Platform
- 2
- ForU CMS
- 2
- IBM OpenPages with Watson
- 2
- jupyterlab · notebook
- 2
- Lenovo Tablet
- 2
- Lenovo Vantage
- 2
- PCMan FTP Server
- 2
- Smsot
- 2
Critical 12
- CVE-2024-23687FOLIO mod-data-export-spring Hard-Coded Credentialsorg.folio:mod-data-export-spring
- CVE-2024-23679Enonic XP Session Fixation Vulnerabilitycom.enonic.xp:lib-auth
- CVE-2024-0705Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injectionthemehigh Payment Gateway of Stripe for WooCommerce
- CVE-2023-5716ASUS Armoury Crate - Arbitrary File WriteASUS Armoury Crate
- CVE-2023-27168An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted jsp fi
- CVE-2023-43985SunnyToo stblogsearch up to v1.0.0 was discovered to contain a SQL injection vulnerability via the StBlogSearchClass::prepareSearch componen
- CVE-2023-46351In the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection.
- CVE-2023-50028In the module "Sliding cart block" (blockslidingcart) up to version 2.3.8 from PrestashopModules.eu for PrestaShop, a guest can perform SQL
- CVE-2023-50030In the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions <= 1.1.0.
- CVE-2023-50693An issue in Jester v.0.6.0 and before allows a remote attacker to send a malicious crafted request.
- CVE-2023-50694An issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to send a malicious crafted request due to insufficient parsing in t
- CVE-2023-51947Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types
High 38
- CVE-2024-0739Hecheng Leadshop leadshop.php deserializationHecheng Leadshop
- CVE-2024-23689ClickHouse Client Certificate Password Exposurecom.clickhouse:clickhouse-r2dbc · com.clickhouse:clickho… +1
- CVE-2024-23684upokecenter CBOR Denial of Servicecom.upokecenter:cbor
- CVE-2024-23681Artemis Java Test Sandbox Libary Load Escapede.tum.in.ase:artemis-java-test-sandbox
- CVE-2024-23683Artemis Java Test Sandbox InvocationTargetException Subclass Escapede.tum.in.ase:artemis-java-test-sandbox
- CVE-2024-22421Potential authentication and CSRF tokens leak in JupyterLabjupyterlab · notebook
- CVE-2024-23682Artemis Java Test Sandbox Class Loading Escapede.tum.in.ase:artemis-java-test-sandbox
- CVE-2023-6043A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and executeLenovo Vantage
- CVE-2023-32544Improper access control in some Intel HotKey Services for Windows 10 for Intel NUC P14E Laptop Element software installers before version 1.Intel HotKey Services for Windows 10 for Intel NUC P14E Lap…
- CVE-2023-32272Uncontrolled search path in some Intel NUC Pro Software Suite Configuration Tool software installers before version 3.0.0.6 may allow an autIntel NUC Pro Software Suite Configuration Tool software in…
- CVE-2023-29495Improper input validation for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalatioIntel NUC BIOS firmware
- CVE-2023-28743Improper input validation for some Intel NUC BIOS firmware before version QN0073 may allow a privileged user to potentially enable escalatioIntel NUC BIOS firmware
- CVE-2023-28738Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalatioIntel NUC BIOS firmware
- CVE-2023-42766Improper input validation in some Intel NUC 8 Compute Element BIOS firmware may allow a privileged user to potentially enable escalation of Intel NUC 8 Compute Element BIOS firmware
- CVE-2023-38587Improper input validation in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via locaIntel NUC BIOS firmware
- CVE-2023-42429Improper buffer restrictions in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via lIntel NUC BIOS firmware
- CVE-2024-23331Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystemvitejs vite · vite
- CVE-2022-40700Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress pluginsMontonio for WooCommerce · Wpopal Core Features +13
- CVE-2024-0712Byzoro Smart S150 Management Platform userattea.php access controlByzoro Smart S150 Management Platform
- CVE-2023-40683IBM OpenPages with Watson privilege escalationIBM OpenPages with Watson
- CVE-2024-22424Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cdargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2024-22422Unauthenticated Denial of Service (DOS) attack in AnythingLLMMintplex-Labs anything-llm
- CVE-2023-47033MultiSigWallet 0xF0C99 was discovered to contain a reentrancy vulnerability via the function executeTransaction.
- CVE-2023-47034A vulnerability in UniswapFrontRunBot 0xdB94c allows attackers to cause financial losses via unspecified vectors.
- CVE-2023-47035RPTC 0x3b08c was discovered to not conduct status checks on the parameter tradingOpen.
- CVE-2023-49329Anomali Match before 4.6.2 allows OS Command Injection.
- CVE-2023-50447Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2pillow
- CVE-2023-51948A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files host
- CVE-2024-22562swftools 0.9.2 was discovered to contain a Stack Buffer Underflow via the function dict_foreach_keyvalue at swftools/lib/q.c.
- CVE-2024-22563openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in openvswitch-2.17.8/lib/util.c.
- CVE-2024-22911A stack-buffer-underflow vulnerability was found in SWFTools v0.9.2, in the function parseExpression at src/swfc.c:2602.
- CVE-2024-22912A global-buffer-overflow was found in SWFTools v0.9.2, in the function countline at swf5compiler.flex:327.
- CVE-2024-22913A heap-buffer-overflow was found in SWFTools v0.9.2, in the function swf5lex at lex.swf5.c:1321.
- CVE-2024-22915A heap-use-after-free was found in SWFTools v0.9.2, in the function swf_DeleteTag at rfxswf.c:1193.
- CVE-2024-22919swftools0.9.2 was discovered to contain a global-buffer-overflow vulnerability via the function parseExpression at swftools/src/swfc.c:2587.
- CVE-2024-22920swftools 0.9.2 was discovered to contain a heap-use-after-free via the function bufferWriteData in swftools/lib/action/compile.c.
- CVE-2024-22955swftools 0.9.2 was discovered to contain a stack-buffer-underflow vulnerability via the function parseExpression at swftools/src/swfc.c:2576
- CVE-2024-22956swftools 0.9.2 was discovered to contain a heap-use-after-free vulnerability via the function removeFromTo at swftools/src/swfc.c:838
Medium, low and unrated 54
- CVE-2024-23332Client configured with permissive trust policies susceptible to rollback attack in Notary Projectnotaryproject specifications · github.com/notaryproject/not…
- CVE-2024-0738个人开源 mldong DecisionModel.java ExpressionEngine code injection个人开源 mldong
- CVE-2024-0737Xlightftpd Xlight FTP Server Login denial of serviceXlightftpd Xlight FTP Server
- CVE-2024-23688Consensys Discovery Nonce Reusetech.pegasys.discovery:discovery
- CVE-2024-23686DependencyCheck Debug Mode Logging of NVD API Keyorg.owasp:dependency-check-maven · org.owasp:dependency-… +1
- CVE-2024-23685FOLIO mod-remote-storage Hard Coded Credentialsorg.folio:mod-remote-storage
- CVE-2024-0736EFS Easy File Sharing FTP Login denial of serviceEFS Easy File Sharing FTP
- CVE-2024-0735SourceCodester Online Tours & Travels Management System expense.php exec sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2024-22420Stored cross site scripting in Markdown Preview in JupyterLabjupyterlab · notebook
- CVE-2024-23680AWS Encryption SDK for Java Improper Verification of Cryptographic Signaturecom.amazonaws:aws-encryption-sdk-java
- CVE-2024-0734Smsot get.php sql injectionSmsot
- CVE-2024-0733Smsot HTTP POST Request api.php sql injectionSmsot
- CVE-2024-0758MolecularFaces XSSde.ipb-halle:molecularfaces
- CVE-2023-6450An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, resultLenovo App Store Application
- CVE-2023-6044A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate LeLenovo Vantage
- CVE-2023-5081An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettableLenovo Tablet
- CVE-2023-5080A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identiLenovo Tablet
- CVE-2023-29244Incorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software insIntel Integrated Sensor Hub (ISH) driver for Windows 10 for…
- CVE-2023-38541Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before veIntel HID Event Filter drivers for Windows 10 for some Inte…
- CVE-2023-28722Improper buffer restrictions for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalaIntel NUC BIOS firmware
- CVE-2024-0732PCMan FTP Server STOR Command denial of servicePCMan FTP Server
- CVE-2024-22211FreeRDP integer Overflow leading to Heap OverflowFreeRDP
- CVE-2024-23329changedetection.io API endpoint is not secured with API tokendgtlmoon changedetection.io · changedetection-io
- CVE-2024-0731PCMan FTP Server PUT Command denial of servicePCMan FTP Server
- CVE-2024-0730Project Worlds Online Time Table Generator course_ajax.php sql injectionProject Worlds Online Time Table Generator
- CVE-2024-0729ForU CMS cms_admin.php sql injectionForU CMS
- CVE-2024-0728ForU CMS channel.php file inclusionForU CMS
- CVE-2024-0726Project Worlds Student Project Allocation System Admin Login Module admin_login.php cross site scriptingProject Worlds Student Project Allocation System
- CVE-2024-0725ProSSHD denial of serviceProSSHD
- CVE-2024-0723freeSSHd denial of servicefreeSSHd
- CVE-2024-0722code-projects Social Networking Site Message Page message.php cross site scriptingcode-projects Social Networking Site
- CVE-2024-0721Jspxcms Survey Label cross site scriptingJspxcms
- CVE-2024-0720FactoMineR FactoInvestigate HTML Report Generator cross site scriptingFactoMineR FactoInvestigate
- CVE-2024-0718liuwy-dlsdys zhglxt HTTP POST Request edit cross site scriptingliuwy-dlsdys zhglxt
- CVE-2024-0717D-Link Good Line Router v2 HTTP GET Request devinfo information disclosureD-Link DAP-1360 · D-Link DIR-300 +43
- CVE-2024-0716Byzoro Smart S150 Management Platform Backup File download.php information disclosureByzoro Smart S150 Management Platform
- CVE-2022-47160WordPress Wp Social Plugin <= 1.9.0 is vulnerable to Sensitive Data ExposureWpmet Wp Social Login and Register Social Counter
- CVE-2022-45845WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object InjectionNextend Smart Slider
- CVE-2022-45083WordPress ProfilePress Plugin <= 4.3.2 is vulnerable to PHP Object InjectionProfilePress Membership Team Paid Membership Plugin, Ecomme…
- CVE-2024-0714MiczFlor RPi-Jukebox-RFID HTTP Request userScripts.php os command injectionMiczFlor RPi-Jukebox-RFID
- CVE-2024-21733Apache Tomcat: Leaking of unrelated request bodies in default error pageApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2024-23387FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability.FusionPBX
- CVE-2023-50963IBM Storage Defender HTTP HOST header injectionIBM Storage Defender - Data Protect
- CVE-2023-32337IBM Maximo Spatial Asset Management server-side request forgeryIBM Maximo Spatial Asset Management
- CVE-2023-47718IBM Maximo Asset Management cross-site request forgeryIBM Maximo Asset Management
- CVE-2023-35020IBM Sterling Control Center directory traversalIBM Sterling Control Center
- CVE-2023-38738IBM OpenPages with Watson information disclosureIBM OpenPages with Watson
- CVE-2023-33295Cohesity DataProtect prior to 6.8.1_u5 or 7.1 was discovered to have a incorrect access control vulnerability due to a lack of TLS Certifica
- CVE-2023-51946Multiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to
- CVE-2024-22876StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which
- CVE-2024-22877StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality.
- CVE-2024-22914A heap-use-after-free was found in SWFTools v0.9.2, in the function input at lex.swf5.c:2620.
- CVE-2024-22957swftools 0.9.2 was discovered to contain an Out-of-bounds Read vulnerability via the function dict_do_lookup in swftools/lib/q.c:1190.
- CVE-2024-23659SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file.