# CVEs published 2024-01-21

14 CVEs were published on January 21, 2024: 2 critical, 5 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-0773](https://cve.now/CVE-2024-0773.md): CodeAstro Internet Banking System pages\_client\_signup.php cross site scripting (CVSS 3.5, CodeAstro Internet Banking System)
- [CVE-2024-0772](https://cve.now/CVE-2024-0772.md): Nsasoft ShareAlarmPro Registration memory corruption (CVSS 5.3, Nsasoft ShareAlarmPro)
- [CVE-2024-0771](https://cve.now/CVE-2024-0771.md): Nsasoft Product Key Explorer Registration memory corruption (CVSS 5.3, Nsasoft Product Key Explorer)
- [CVE-2024-0770](https://cve.now/CVE-2024-0770.md): European Chemicals Agency IUCLID Desktop Installer iuclid6.exe default permission (CVSS 4.4, European Chemicals Agency IUCLID)
- [CVE-2023-6531](https://cve.now/CVE-2023-6531.md): Kernel: gc's deletion of an skb races with unix\_stream\_read\_generic() leading to uaf (CVSS 7.0, Red Hat Enterprise Linux)
- [CVE-2024-0769](https://cve.now/CVE-2024-0769.md): D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal (CVSS 5.3, KEV, D-Link DIR-859)
- [CVE-2016-15037](https://cve.now/CVE-2016-15037.md): go4rayyan Scumblr Task cross site scripting (CVSS 2.4, go4rayyan Scumblr)
- [CVE-2023-52353](https://cve.now/CVE-2023-52353.md): An issue was discovered in Mbed TLS through 3.5.1. (CVSS 7.5)
- [CVE-2024-23725](https://cve.now/CVE-2024-23725.md): Ghost before 5.76.0 allows XSS via a post excerpt in excerpt.js. (CVSS 6.1, ghost)
- [CVE-2024-23726](https://cve.now/CVE-2024-23726.md): Ubee DDW365 XCNDDW365 devices have predictable default WPA2 PSKs that could lead to unauthorized remote access. (CVSS 8.8)
- [CVE-2024-23730](https://cve.now/CVE-2024-23730.md): The OpenAPI and ChatGPT plugin loaders in LlamaHub (aka llama-hub) before 0.0.67 allow attackers to execute arbitrary code because safe\_load (CVSS 9.8, llama-hub)
- [CVE-2024-23731](https://cve.now/CVE-2024-23731.md): The OpenAPI loader in Embedchain before 0.1.57 allows attackers to execute arbitrary code, related to the openapi.py yaml.load function argu (CVSS 9.8, embedchain)
- [CVE-2024-23732](https://cve.now/CVE-2024-23732.md): The JSON loader in Embedchain before 0.1.57 allows a ReDoS (regular expression denial of service) via a long string to json.py. (CVSS 7.5, embedchain)
- [CVE-2024-23744](https://cve.now/CVE-2024-23744.md): An issue was discovered in Mbed TLS 3.5.1. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.