CVEs published January 22, 2024
58 CVEs were published on January 22, 2024: 6 critical, 18 high.
- Published
- 58
- Critical
- 6
- High
- 18
- Medium
- 31
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- IBM Db2 for Linux, UNIX and Windows
- 8
- Splunk Enterprise · Splunk Cloud
- 3
- Cloudlinux OS cagefs
- 2
- Mozilla Focus for iOS
- 2
- Product Enquiry for WooCommerce
- 2
- ANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer
- 1
- Any-Capture Any Sound Recorder
- 1
- Autolab
- 1
- blitiri.com.ar/go/chasquid · github.com/albertito/chasquid
- 1
- CodeAstro Internet Banking System
- 1
Critical 6
- CVE-2024-0204Authentication Bypass in GoAnywhere MFTFortra GoAnywhere MFT
- CVE-2017-20189In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization.org.clojure:clojure
- CVE-2023-48118SQL Injection vulnerability in Quest Analytics LLC IQCRM v.2023.9.5 allows a remote attacker to execute arbitrary code via a crafted request
- CVE-2024-23751LlamaIndex (aka llama_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQuerllama-index
- CVE-2024-23752GenerateSDFPipeline in synthetic_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrarpandasai
- CVE-2024-23771darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypas
High 18
- CVE-2024-23345Nautobot has XSS potential in rendered Markdown fieldsnautobot
- CVE-2024-23342python-ecdsa vulnerable to Minerva attack on P-256tlsfuzzer python-ecdsa · ecdsa
- CVE-2024-23678Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk PartitionSplunk Enterprise
- CVE-2023-7082WP All Import < 3.7.3 - Admin+ Arbitrary File Upload to RCEImport any XML or CSV File to WordPress
- CVE-2024-0605Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar.Mozilla Focus for iOS
- CVE-2022-45792Directory Traversal in Project File Format allows overwrite (Zip Slip)Omron Sysmac Studio
- CVE-2022-45790Omron FINS memory protection susceptible to bruteforceOmron CJ-series and CS-series CPU modules
- CVE-2024-0778Uniview ISC 2500-S VM.php setNatConfig os command injectionUniview ISC 2500-S
- CVE-2020-36771CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument.Cloudlinux OS cagefs
- CVE-2024-22233CVE-2024-22233: Spring Framework server Web DoS VulnerabilitySpring Framework · org.springframework:spring-core
- CVE-2024-21484Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process.jsrsasign · org.webjars.npm:jsrsasign +2
- CVE-2021-42141An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30.
- CVE-2023-24135Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a command injection vulnerability in the function formWriteFacM
- CVE-2023-47352Technicolor TC8715D devices have predictable default WPA2 security passwords.
- CVE-2023-52354chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted.blitiri.com.ar/go/chasquid · github.com/albertito/chasquid
- CVE-2024-22895DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.
- CVE-2024-23750MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run_script() passes shell metacharacters to subprmetagpt
- CVE-2024-23768Dremio before 24.3.1 allows path traversal.
Medium, low and unrated 34
- CVE-2024-23340@hono/node-server can't handle "double dots" in URLhonojs node-server · @hono/node-server
- CVE-2024-23339hoolock does not block Prototype pollution with object-path related utilitieselijahharry hoolock · hoolock
- CVE-2024-23676Sensitive Information Disclosure of Index Metrics through “mrollup” SPL CommandSplunk Enterprise · Splunk Cloud
- CVE-2024-23677Server Response Disclosure in RapidDiag Salesforce.com Log FileSplunk Enterprise · Splunk Cloud
- CVE-2024-23675Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection DeletionSplunk Enterprise · Splunk Cloud
- CVE-2023-47141IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2023-47158IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2023-47152IBM Db2 information disclosureIBM Db2 for Linux, UNIX and Windows
- CVE-2023-27859IBM Db2 code executionIBM Db2 for Linux, UNIX and Windows
- CVE-2023-47747IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2023-6447EventPrime < 3.3.6 - Unauthenticated Event AccessEventPrime
- CVE-2023-6626Product Enquiry for WooCommerce < 3.1 - Admin+ Stored XSSProduct Enquiry for WooCommerce
- CVE-2023-6456WP Review Slider < 13.0 - Admin+ Stored XSSWP Review Slider
- CVE-2023-6290WP SEO Press < 7.3 - Admin+ Stored XSSSEOPress
- CVE-2023-7194Meris <= 1.1.2 - Reflected XSSMeris
- CVE-2023-6384WP User Profile Avatar < 1.0.1 - Author+ Avatar Deletion/Update via IDORWP User Profile Avatar
- CVE-2023-6625Product Enquiry for WooCommerce < 3.1 - Arbitrary Enquiry Deletion via CSRFProduct Enquiry for WooCommerce
- CVE-2023-7170EventON-RSVP < 2.9.5 - Reflected XSSEventON-RSVP
- CVE-2023-45193IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2023-50308IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2024-0430IObit Malware Fighter v11.0.0.1274 - Denial of Service (DoS)IObit Malware Fighter
- CVE-2023-47746IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2024-0606An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to uMozilla Focus for iOS
- CVE-2024-0784hongmaple octopus list sql injectionhongmaple octopus
- CVE-2024-0783Project Worlds Online Admission System documents.php unrestricted uploadProject Worlds Online Admission System
- CVE-2024-0782CodeAstro Online Railway Reservation System pass-profile.php cross site scriptingCodeAstro Online Railway Reservation System
- CVE-2024-0781CodeAstro Internet Banking System pages_client_signup.php redirectCodeAstro Internet Banking System
- CVE-2023-44395Autolab has Path Traversal vulnerability in Assessment functionalityAutolab
- CVE-2020-36772CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command.Cloudlinux OS cagefs
- CVE-2024-0775Kernel: use-after-free while changing the mount option in __ext4_remount leadingLinux kernel · Red Hat Enterprise Linux
- CVE-2024-22113Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote unauthenticated attaANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer
- CVE-2024-0776LinZhaoguan pb-cms Comment cross site scriptingLinZhaoguan pb-cms
- CVE-2024-0774Any-Capture Any Sound Recorder Registration memory corruptionAny-Capture Any Sound Recorder
- CVE-2024-23770darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments.