# CVEs published 2024-01-20

14 CVEs were published on January 20, 2024: 8 critical, 3 high. Days are UTC.

- [CVE-2024-0521](https://cve.now/CVE-2024-0521.md): Code Injection in paddlepaddle/paddle (CVSS 9.3, paddlepaddle/paddle · paddlepaddle)
- [CVE-2023-7063](https://cve.now/CVE-2023-7063.md): The WPForms Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via form submission parameters in all versions up to, and (CVSS 7.2, WPForms Pro)
- [CVE-2024-0679](https://cve.now/CVE-2024-0679.md): ColorMag \<= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation (CVSS 6.5, themegrill ColorMag)
- [CVE-2024-0623](https://cve.now/CVE-2024-0623.md): VK Block Patterns \<= 1.31.1.1 - Cross-Site Request Forgery (CVSS 4.3, vektor-inc VK Block Patterns)
- [CVE-2021-31314](https://cve.now/CVE-2021-31314.md): File upload vulnerability in ejinshan v8+ terminal security system allows attackers to upload arbitrary files to arbitrary locations on the (CVSS 9.8)
- [CVE-2023-46447](https://cve.now/CVE-2023-46447.md): The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over (CVSS 4.3)
- [CVE-2023-47024](https://cve.now/CVE-2023-47024.md): Cross-Site Request Forgery (CSRF) in NCR Terminal Handler v.1.5.1 leads to a one-click account takeover. (CVSS 8.8)
- [CVE-2023-51892](https://cve.now/CVE-2023-51892.md): An issue in weaver e-cology v.10.0.2310.01 allows a remote attacker to execute arbitrary code via a crafted script to the FrameworkShellCont (CVSS 9.8)
- [CVE-2023-51906](https://cve.now/CVE-2023-51906.md): An issue in yonyou YonBIP v3\_23.05 allows a remote attacker to execute arbitrary code via a crafted script to the ServiceDispatcherServlet u (CVSS 9.8)
- [CVE-2023-51924](https://cve.now/CVE-2023-51924.md): An arbitrary file upload vulnerability in the uap.framework.rc.itf.IResourceManager interface of YonBIP v3\_23.05 allows attackers to execute (CVSS 9.8)
- [CVE-2023-51925](https://cve.now/CVE-2023-51925.md): An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3\_23.05 allo (CVSS 9.8)
- [CVE-2023-51926](https://cve.now/CVE-2023-51926.md): YonBIP v3\_23.05 was discovered to contain an arbitrary file read vulnerability via the nc.bs.framework.comn.serv.CommonServletDispatcher com (CVSS 7.5)
- [CVE-2023-51927](https://cve.now/CVE-2023-51927.md): YonBIP v3\_23.05 was discovered to contain a SQL injection vulnerability via the com.yonyou.hrcloud.attend.web.AttendScriptController.runScri (CVSS 9.8)
- [CVE-2023-51928](https://cve.now/CVE-2023-51928.md): An arbitrary file upload vulnerability in the nccloud.web.arcp.taskmonitor.action.ArcpUploadAction.doAction() method of YonBIP v3\_23.05 allo (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.