# CVEs published 2024-01-19

104 CVEs were published on January 19, 2024: 12 critical, 38 high. Days are UTC.

- [CVE-2024-23332](https://cve.now/CVE-2024-23332.md): Client configured with permissive trust policies susceptible to rollback attack in Notary Project (CVSS 4.0, notaryproject specifications · github.com/notaryproject/not…)
- [CVE-2024-0739](https://cve.now/CVE-2024-0739.md): Hecheng Leadshop leadshop.php deserialization (CVSS 7.3, Hecheng Leadshop)
- [CVE-2024-0738](https://cve.now/CVE-2024-0738.md): 个人开源 mldong DecisionModel.java ExpressionEngine code injection (CVSS 6.3, 个人开源 mldong)
- [CVE-2024-0737](https://cve.now/CVE-2024-0737.md): Xlightftpd Xlight FTP Server Login denial of service (CVSS 5.3, Xlightftpd Xlight FTP Server)
- [CVE-2024-23688](https://cve.now/CVE-2024-23688.md): Consensys Discovery Nonce Reuse (CVSS 5.3, tech.pegasys.discovery:discovery)
- [CVE-2024-23687](https://cve.now/CVE-2024-23687.md): FOLIO mod-data-export-spring Hard-Coded Credentials (CVSS 9.1, org.folio:mod-data-export-spring)
- [CVE-2024-23686](https://cve.now/CVE-2024-23686.md): DependencyCheck Debug Mode Logging of NVD API Key (CVSS 5.3, org.owasp:dependency-check-maven · org.owasp:dependency-… +1)
- [CVE-2024-23685](https://cve.now/CVE-2024-23685.md): FOLIO mod-remote-storage Hard Coded Credentials (CVSS 5.3, org.folio:mod-remote-storage)
- [CVE-2024-23689](https://cve.now/CVE-2024-23689.md): ClickHouse Client Certificate Password Exposure (CVSS 8.8, com.clickhouse:clickhouse-r2dbc · com.clickhouse:clickho… +1)
- [CVE-2024-0736](https://cve.now/CVE-2024-0736.md): EFS Easy File Sharing FTP Login denial of service (CVSS 5.3, EFS Easy File Sharing FTP)
- [CVE-2024-0735](https://cve.now/CVE-2024-0735.md): SourceCodester Online Tours & Travels Management System expense.php exec sql injection (CVSS 6.3, SourceCodester Online Tours & Travels Management System)
- [CVE-2024-23684](https://cve.now/CVE-2024-23684.md): upokecenter CBOR Denial of Service (CVSS 7.5, com.upokecenter:cbor)
- [CVE-2024-23681](https://cve.now/CVE-2024-23681.md): Artemis Java Test Sandbox Libary Load Escape (CVSS 8.2, de.tum.in.ase:artemis-java-test-sandbox)
- [CVE-2024-22420](https://cve.now/CVE-2024-22420.md): Stored cross site scripting in Markdown Preview in JupyterLab (CVSS 6.5, jupyterlab · notebook)
- [CVE-2024-23683](https://cve.now/CVE-2024-23683.md): Artemis Java Test Sandbox InvocationTargetException Subclass Escape (CVSS 8.2, de.tum.in.ase:artemis-java-test-sandbox)
- [CVE-2024-22421](https://cve.now/CVE-2024-22421.md): Potential authentication and CSRF tokens leak in JupyterLab (CVSS 7.6, jupyterlab · notebook)
- [CVE-2024-23680](https://cve.now/CVE-2024-23680.md): AWS Encryption SDK for Java Improper Verification of Cryptographic Signature (CVSS 5.3, com.amazonaws:aws-encryption-sdk-java)
- [CVE-2024-0734](https://cve.now/CVE-2024-0734.md): Smsot get.php sql injection (CVSS 6.3, Smsot)
- [CVE-2024-0733](https://cve.now/CVE-2024-0733.md): Smsot HTTP POST Request api.php sql injection (CVSS 6.3, Smsot)
- [CVE-2024-23679](https://cve.now/CVE-2024-23679.md): Enonic XP Session Fixation Vulnerability (CVSS 9.8, com.enonic.xp:lib-auth)
- [CVE-2024-0758](https://cve.now/CVE-2024-0758.md): MolecularFaces XSS (CVSS 6.1, de.ipb-halle:molecularfaces)
- [CVE-2024-23682](https://cve.now/CVE-2024-23682.md): Artemis Java Test Sandbox Class Loading Escape (CVSS 8.2, de.tum.in.ase:artemis-java-test-sandbox)
- [CVE-2023-6450](https://cve.now/CVE-2023-6450.md): An incorrect permissions vulnerability was reported in the Lenovo App Store app that could allow an attacker to use system resources, result (CVSS 5.5, Lenovo App Store Application)
- [CVE-2023-6044](https://cve.now/CVE-2023-6044.md): A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker with physical access to impersonate Le (CVSS 6.3, Lenovo Vantage)
- [CVE-2023-6043](https://cve.now/CVE-2023-6043.md): A privilege escalation vulnerability was reported in Lenovo Vantage that could allow a local attacker to bypass integrity checks and execute (CVSS 7.8, Lenovo Vantage)
- [CVE-2023-5081](https://cve.now/CVE-2023-5081.md): An information disclosure vulnerability was reported in the Lenovo Tab M8 HD that could allow a local application to gather a non-resettable (CVSS 3.3, Lenovo Tablet)
- [CVE-2023-5080](https://cve.now/CVE-2023-5080.md): A privilege escalation vulnerability was reported in some Lenovo tablet products that could allow local applications access to device identi (CVSS 6.8, Lenovo Tablet)
- [CVE-2023-29244](https://cve.now/CVE-2023-29244.md): Incorrect default permissions in some Intel Integrated Sensor Hub (ISH) driver for Windows 10 for Intel NUC P14E Laptop Element software ins (CVSS 6.7, Intel Integrated Sensor Hub (ISH) driver for Windows 10 for…)
- [CVE-2023-38541](https://cve.now/CVE-2023-38541.md): Insecure inherited permissions in some Intel HID Event Filter drivers for Windows 10 for some Intel NUC laptop software installers before ve (CVSS 6.7, Intel HID Event Filter drivers for Windows 10 for some Inte…)
- [CVE-2023-32544](https://cve.now/CVE-2023-32544.md): Improper access control in some Intel HotKey Services for Windows 10 for Intel NUC P14E Laptop Element software installers before version 1. (CVSS 7.3, Intel HotKey Services for Windows 10 for Intel NUC P14E Lap…)
- [CVE-2023-32272](https://cve.now/CVE-2023-32272.md): Uncontrolled search path in some Intel NUC Pro Software Suite Configuration Tool software installers before version 3.0.0.6 may allow an aut (CVSS 7.9, Intel NUC Pro Software Suite Configuration Tool software in…)
- [CVE-2023-28722](https://cve.now/CVE-2023-28722.md): Improper buffer restrictions for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escala (CVSS 6.7, Intel NUC BIOS firmware)
- [CVE-2023-29495](https://cve.now/CVE-2023-29495.md): Improper input validation for some Intel NUC BIOS firmware before version IN0048 may allow a privileged user to potentially enable escalatio (CVSS 7.5, Intel NUC BIOS firmware)
- [CVE-2023-28743](https://cve.now/CVE-2023-28743.md): Improper input validation for some Intel NUC BIOS firmware before version QN0073 may allow a privileged user to potentially enable escalatio (CVSS 7.5, Intel NUC BIOS firmware)
- [CVE-2023-28738](https://cve.now/CVE-2023-28738.md): Improper input validation for some Intel NUC BIOS firmware before version JY0070 may allow a privileged user to potentially enable escalatio (CVSS 7.5, Intel NUC BIOS firmware)
- [CVE-2023-42766](https://cve.now/CVE-2023-42766.md): Improper input validation in some Intel NUC 8 Compute Element BIOS firmware may allow a privileged user to potentially enable escalation of (CVSS 7.5, Intel NUC 8 Compute Element BIOS firmware)
- [CVE-2023-38587](https://cve.now/CVE-2023-38587.md): Improper input validation in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via loca (CVSS 7.5, Intel NUC BIOS firmware)
- [CVE-2023-42429](https://cve.now/CVE-2023-42429.md): Improper buffer restrictions in some Intel NUC BIOS firmware may allow a privileged user to potentially enable escalation of privilege via l (CVSS 7.5, Intel NUC BIOS firmware)
- [CVE-2024-0732](https://cve.now/CVE-2024-0732.md): PCMan FTP Server STOR Command denial of service (CVSS 5.3, PCMan FTP Server)
- [CVE-2024-22211](https://cve.now/CVE-2024-22211.md): FreeRDP integer Overflow leading to Heap Overflow (CVSS 3.7, FreeRDP)
- [CVE-2024-23329](https://cve.now/CVE-2024-23329.md): changedetection.io API endpoint is not secured with API token (CVSS 3.7, dgtlmoon changedetection.io · changedetection-io)
- [CVE-2024-23331](https://cve.now/CVE-2024-23331.md): Vite dev server option \`server.fs.deny\` can be bypassed when hosted on case-insensitive filesystem (CVSS 7.5, vitejs vite · vite)
- [CVE-2024-0731](https://cve.now/CVE-2024-0731.md): PCMan FTP Server PUT Command denial of service (CVSS 5.3, PCMan FTP Server)
- [CVE-2024-0730](https://cve.now/CVE-2024-0730.md): Project Worlds Online Time Table Generator course\_ajax.php sql injection (CVSS 6.3, Project Worlds Online Time Table Generator)
- [CVE-2024-0729](https://cve.now/CVE-2024-0729.md): ForU CMS cms\_admin.php sql injection (CVSS 5.5, ForU CMS)
- [CVE-2024-0728](https://cve.now/CVE-2024-0728.md): ForU CMS channel.php file inclusion (CVSS 4.7, ForU CMS)
- [CVE-2024-0726](https://cve.now/CVE-2024-0726.md): Project Worlds Student Project Allocation System Admin Login Module admin\_login.php cross site scripting (CVSS 4.3, Project Worlds Student Project Allocation System)
- [CVE-2024-0725](https://cve.now/CVE-2024-0725.md): ProSSHD denial of service (CVSS 5.3, ProSSHD)
- [CVE-2024-0723](https://cve.now/CVE-2024-0723.md): freeSSHd denial of service (CVSS 5.3, freeSSHd)
- [CVE-2024-0722](https://cve.now/CVE-2024-0722.md): code-projects Social Networking Site Message Page message.php cross site scripting (CVSS 3.5, code-projects Social Networking Site)
- [CVE-2024-0721](https://cve.now/CVE-2024-0721.md): Jspxcms Survey Label cross site scripting (CVSS 3.5, Jspxcms)
- [CVE-2024-0720](https://cve.now/CVE-2024-0720.md): FactoMineR FactoInvestigate HTML Report Generator cross site scripting (CVSS 3.5, FactoMineR FactoInvestigate)
- [CVE-2024-0718](https://cve.now/CVE-2024-0718.md): liuwy-dlsdys zhglxt HTTP POST Request edit cross site scripting (CVSS 2.4, liuwy-dlsdys zhglxt)
- [CVE-2024-0717](https://cve.now/CVE-2024-0717.md): D-Link Good Line Router v2 HTTP GET Request devinfo information disclosure (CVSS 5.3, D-Link DAP-1360 · D-Link DIR-300 +43)
- [CVE-2024-0716](https://cve.now/CVE-2024-0716.md): Byzoro Smart S150 Management Platform Backup File download.php information disclosure (CVSS 3.1, Byzoro Smart S150 Management Platform)
- [CVE-2022-47160](https://cve.now/CVE-2022-47160.md): WordPress Wp Social Plugin \<= 1.9.0 is vulnerable to Sensitive Data Exposure (CVSS 6.5, Wpmet Wp Social Login and Register Social Counter)
- [CVE-2022-45845](https://cve.now/CVE-2022-45845.md): WordPress Smart Slider 3 Plugin \<= 3.5.1.9 is vulnerable to PHP Object Injection (CVSS 4.3, Nextend Smart Slider)
- [CVE-2022-45083](https://cve.now/CVE-2022-45083.md): WordPress ProfilePress Plugin \<= 4.3.2 is vulnerable to PHP Object Injection (CVSS 6.6, ProfilePress Membership Team Paid Membership Plugin, Ecomme…)
- [CVE-2024-0714](https://cve.now/CVE-2024-0714.md): MiczFlor RPi-Jukebox-RFID HTTP Request userScripts.php os command injection (CVSS 6.3, MiczFlor RPi-Jukebox-RFID)
- [CVE-2022-40700](https://cve.now/CVE-2022-40700.md): Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress plugins (CVSS 8.2, Montonio for WooCommerce · Wpopal Core Features +13)
- [CVE-2024-0712](https://cve.now/CVE-2024-0712.md): Byzoro Smart S150 Management Platform userattea.php access control (CVSS 7.3, Byzoro Smart S150 Management Platform)
- [CVE-2024-21733](https://cve.now/CVE-2024-21733.md): Apache Tomcat: Leaking of unrelated request bodies in default error page (CVSS 5.3, Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2024-0705](https://cve.now/CVE-2024-0705.md): Stripe Payment Plugin for WooCommerce \<= 3.7.9 - Unauthenticated SQL Injection (CVSS 9.8, themehigh Payment Gateway of Stripe for WooCommerce)
- [CVE-2024-23387](https://cve.now/CVE-2024-23387.md): FusionPBX prior to 5.1.0 contains a cross-site scripting vulnerability. (CVSS 4.8, FusionPBX)
- [CVE-2023-5716](https://cve.now/CVE-2023-5716.md): ASUS Armoury Crate - Arbitrary File Write (CVSS 9.8, ASUS Armoury Crate)
- [CVE-2023-50963](https://cve.now/CVE-2023-50963.md): IBM Storage Defender HTTP HOST header injection (CVSS 6.5, IBM Storage Defender - Data Protect)
- [CVE-2023-32337](https://cve.now/CVE-2023-32337.md): IBM Maximo Spatial Asset Management server-side request forgery (CVSS 5.4, IBM Maximo Spatial Asset Management)
- [CVE-2023-47718](https://cve.now/CVE-2023-47718.md): IBM Maximo Asset Management cross-site request forgery (CVSS 4.3, IBM Maximo Asset Management)
- [CVE-2023-35020](https://cve.now/CVE-2023-35020.md): IBM Sterling Control Center directory traversal (CVSS 5.4, IBM Sterling Control Center)
- [CVE-2023-40683](https://cve.now/CVE-2023-40683.md): IBM OpenPages with Watson privilege escalation (CVSS 8.8, IBM OpenPages with Watson)
- [CVE-2023-38738](https://cve.now/CVE-2023-38738.md): IBM OpenPages with Watson information disclosure (CVSS 6.8, IBM OpenPages with Watson)
- [CVE-2024-22424](https://cve.now/CVE-2024-22424.md): Cross-Site Request Forgery (CSRF) in github.com/argoproj/argo-cd (CVSS 8.4, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2024-22422](https://cve.now/CVE-2024-22422.md): Unauthenticated Denial of Service (DOS) attack in AnythingLLM (CVSS 7.5, Mintplex-Labs anything-llm)
- [CVE-2023-27168](https://cve.now/CVE-2023-27168.md): An arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to execute arbitrary code via a crafted jsp fi (CVSS 9.8)
- [CVE-2023-33295](https://cve.now/CVE-2023-33295.md): Cohesity DataProtect prior to 6.8.1\_u5 or 7.1 was discovered to have a incorrect access control vulnerability due to a lack of TLS Certifica (CVSS 6.5)
- [CVE-2023-43985](https://cve.now/CVE-2023-43985.md): SunnyToo stblogsearch up to v1.0.0 was discovered to contain a SQL injection vulnerability via the StBlogSearchClass::prepareSearch componen (CVSS 9.8)
- [CVE-2023-46351](https://cve.now/CVE-2023-46351.md): In the module mib \< 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. (CVSS 9.8)
- [CVE-2023-47033](https://cve.now/CVE-2023-47033.md): MultiSigWallet 0xF0C99 was discovered to contain a reentrancy vulnerability via the function executeTransaction. (CVSS 7.5)
- [CVE-2023-47034](https://cve.now/CVE-2023-47034.md): A vulnerability in UniswapFrontRunBot 0xdB94c allows attackers to cause financial losses via unspecified vectors. (CVSS 7.5)
- [CVE-2023-47035](https://cve.now/CVE-2023-47035.md): RPTC 0x3b08c was discovered to not conduct status checks on the parameter tradingOpen. (CVSS 7.5)
- [CVE-2023-49329](https://cve.now/CVE-2023-49329.md): Anomali Match before 4.6.2 allows OS Command Injection. (CVSS 7.2)
- [CVE-2023-50028](https://cve.now/CVE-2023-50028.md): In the module "Sliding cart block" (blockslidingcart) up to version 2.3.8 from PrestashopModules.eu for PrestaShop, a guest can perform SQL (CVSS 9.8)
- [CVE-2023-50030](https://cve.now/CVE-2023-50030.md): In the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL injection in versions \<= 1.1.0. (CVSS 9.8)
- [CVE-2023-50447](https://cve.now/CVE-2023-50447.md): Pillow through 10.1.0 allows PIL.ImageMath.eval Arbitrary Code Execution via the environment parameter, a different vulnerability than CVE-2 (CVSS 8.1, pillow)
- [CVE-2023-50693](https://cve.now/CVE-2023-50693.md): An issue in Jester v.0.6.0 and before allows a remote attacker to send a malicious crafted request. (CVSS 9.8)
- [CVE-2023-50694](https://cve.now/CVE-2023-50694.md): An issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to send a malicious crafted request due to insufficient parsing in t (CVSS 9.8)
- [CVE-2023-51946](https://cve.now/CVE-2023-51946.md): Multiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS-SL-2U-8 3.2.03-SP1 allow remote attackers to (CVSS 6.1)
- [CVE-2023-51947](https://cve.now/CVE-2023-51947.md): Improper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to read and modify different types (CVSS 9.1)
- [CVE-2023-51948](https://cve.now/CVE-2023-51948.md): A Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote attackers to list the files host (CVSS 7.5)
- [CVE-2024-22562](https://cve.now/CVE-2024-22562.md): swftools 0.9.2 was discovered to contain a Stack Buffer Underflow via the function dict\_foreach\_keyvalue at swftools/lib/q.c. (CVSS 7.8)
- [CVE-2024-22563](https://cve.now/CVE-2024-22563.md): openvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc\_\_ in openvswitch-2.17.8/lib/util.c. (CVSS 7.5)
- [CVE-2024-22876](https://cve.now/CVE-2024-22876.md): StrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case attachment functionality which (CVSS 5.4)
- [CVE-2024-22877](https://cve.now/CVE-2024-22877.md): StrangeBee TheHive 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS) in the case reporting functionality. (CVSS 5.4)
- [CVE-2024-22911](https://cve.now/CVE-2024-22911.md): A stack-buffer-underflow vulnerability was found in SWFTools v0.9.2, in the function parseExpression at src/swfc.c:2602. (CVSS 7.8)
- [CVE-2024-22912](https://cve.now/CVE-2024-22912.md): A global-buffer-overflow was found in SWFTools v0.9.2, in the function countline at swf5compiler.flex:327. (CVSS 7.8)
- [CVE-2024-22913](https://cve.now/CVE-2024-22913.md): A heap-buffer-overflow was found in SWFTools v0.9.2, in the function swf5lex at lex.swf5.c:1321. (CVSS 7.8)
- [CVE-2024-22914](https://cve.now/CVE-2024-22914.md): A heap-use-after-free was found in SWFTools v0.9.2, in the function input at lex.swf5.c:2620. (CVSS 5.5)
- [CVE-2024-22915](https://cve.now/CVE-2024-22915.md): A heap-use-after-free was found in SWFTools v0.9.2, in the function swf\_DeleteTag at rfxswf.c:1193. (CVSS 7.8)
- [CVE-2024-22919](https://cve.now/CVE-2024-22919.md): swftools0.9.2 was discovered to contain a global-buffer-overflow vulnerability via the function parseExpression at swftools/src/swfc.c:2587. (CVSS 7.8)
- [CVE-2024-22920](https://cve.now/CVE-2024-22920.md): swftools 0.9.2 was discovered to contain a heap-use-after-free via the function bufferWriteData in swftools/lib/action/compile.c. (CVSS 7.8)
- [CVE-2024-22955](https://cve.now/CVE-2024-22955.md): swftools 0.9.2 was discovered to contain a stack-buffer-underflow vulnerability via the function parseExpression at swftools/src/swfc.c:2576 (CVSS 7.8)
- [CVE-2024-22956](https://cve.now/CVE-2024-22956.md): swftools 0.9.2 was discovered to contain a heap-use-after-free vulnerability via the function removeFromTo at swftools/src/swfc.c:838 (CVSS 7.8)
- [CVE-2024-22957](https://cve.now/CVE-2024-22957.md): swftools 0.9.2 was discovered to contain an Out-of-bounds Read vulnerability via the function dict\_do\_lookup in swftools/lib/q.c:1190. (CVSS 5.5)
- [CVE-2024-23659](https://cve.now/CVE-2024-23659.md): SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.