CVEs published January 21, 2024
14 CVEs were published on January 21, 2024: 2 critical, 5 high. 1 is now in CISA KEV.
- Published
- 14
- Critical
- 2
- High
- 5
- Medium
- 5
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 5
Most affected products
- embedchain
- 2
- CodeAstro Internet Banking System
- 1
- D-Link DIR-859
- 1
- European Chemicals Agency IUCLID
- 1
- ghost
- 1
- go4rayyan Scumblr
- 1
- llama-hub
- 1
- Nsasoft Product Key Explorer
- 1
- Nsasoft ShareAlarmPro
- 1
- Red Hat Enterprise Linux
- 1
Critical 2
- CVE-2024-23730The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe_loadllama-hub
- CVE-2024-23731The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function arguembedchain
High 5
- CVE-2023-6531Kernel: gc's deletion of an skb races with unix_stream_read_generic() leading to uafRed Hat Enterprise Linux
- CVE-2023-52353An issue was discovered in Mbed TLS through 3.5.1.
- CVE-2024-23726Ubee DDW365 XCNDDW365 devices have predictable default WPA2 PSKs that could lead to unauthorized remote access.
- CVE-2024-23732The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py.embedchain
- CVE-2024-23744An issue was discovered in Mbed TLS 3.5.1.
Medium, low and unrated 7
- CVE-2024-0773CodeAstro Internet Banking System pages_client_signup.php cross site scriptingCodeAstro Internet Banking System
- CVE-2024-0772Nsasoft ShareAlarmPro Registration memory corruptionNsasoft ShareAlarmPro
- CVE-2024-0771Nsasoft Product Key Explorer Registration memory corruptionNsasoft Product Key Explorer
- CVE-2024-0770European Chemicals Agency IUCLID Desktop Installer iuclid6.exe default permissionEuropean Chemicals Agency IUCLID
- CVE-2024-0769D-Link DIR-859 HTTP POST Request hedwig.cgi path traversalD-Link DIR-859
- CVE-2016-15037go4rayyan Scumblr Task cross site scriptinggo4rayyan Scumblr
- CVE-2024-23725Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js.ghost