# CVEs published 2024-01-22

58 CVEs were published on January 22, 2024: 6 critical, 18 high. Days are UTC.

- [CVE-2024-23345](https://cve.now/CVE-2024-23345.md): Nautobot has XSS potential in rendered Markdown fields (CVSS 7.1, nautobot)
- [CVE-2024-23342](https://cve.now/CVE-2024-23342.md): python-ecdsa vulnerable to Minerva attack on P-256 (CVSS 7.4, tlsfuzzer python-ecdsa · ecdsa)
- [CVE-2024-23340](https://cve.now/CVE-2024-23340.md): @hono/node-server can't handle "double dots" in URL (CVSS 5.3, honojs node-server · @hono/node-server)
- [CVE-2024-23339](https://cve.now/CVE-2024-23339.md): hoolock does not block Prototype pollution with object-path related utilities (CVSS 6.3, elijahharry hoolock · hoolock)
- [CVE-2024-23678](https://cve.now/CVE-2024-23678.md): Deserialization of Untrusted Data on Splunk Enterprise for Windows through Path Traversal from Separate Disk Partition (CVSS 7.5, Splunk Enterprise)
- [CVE-2024-23676](https://cve.now/CVE-2024-23676.md): Sensitive Information Disclosure of Index Metrics through “mrollup” SPL Command (CVSS 4.6, Splunk Enterprise · Splunk Cloud)
- [CVE-2024-23677](https://cve.now/CVE-2024-23677.md): Server Response Disclosure in RapidDiag Salesforce.com Log File (CVSS 4.3, Splunk Enterprise · Splunk Cloud)
- [CVE-2024-23675](https://cve.now/CVE-2024-23675.md): Splunk App Key Value Store (KV Store) Improper Handling of Permissions Leads to KV Store Collection Deletion (CVSS 6.5, Splunk Enterprise · Splunk Cloud)
- [CVE-2023-47141](https://cve.now/CVE-2023-47141.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-47158](https://cve.now/CVE-2023-47158.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-47152](https://cve.now/CVE-2023-47152.md): IBM Db2 information disclosure (CVSS 5.9, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-27859](https://cve.now/CVE-2023-27859.md): IBM Db2 code execution (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-47747](https://cve.now/CVE-2023-47747.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-6447](https://cve.now/CVE-2023-6447.md): EventPrime \< 3.3.6 - Unauthenticated Event Access (CVSS 5.3, EventPrime)
- [CVE-2023-7082](https://cve.now/CVE-2023-7082.md): WP All Import \< 3.7.3 - Admin+ Arbitrary File Upload to RCE (CVSS 7.2, Import any XML or CSV File to WordPress)
- [CVE-2023-6626](https://cve.now/CVE-2023-6626.md): Product Enquiry for WooCommerce \< 3.1 - Admin+ Stored XSS (CVSS 4.8, Product Enquiry for WooCommerce)
- [CVE-2023-6456](https://cve.now/CVE-2023-6456.md): WP Review Slider \< 13.0 - Admin+ Stored XSS (CVSS 4.8, WP Review Slider)
- [CVE-2023-6290](https://cve.now/CVE-2023-6290.md): WP SEO Press \< 7.3 - Admin+ Stored XSS (CVSS 4.8, SEOPress)
- [CVE-2023-7194](https://cve.now/CVE-2023-7194.md): Meris \<= 1.1.2 - Reflected XSS (CVSS 6.1, Meris)
- [CVE-2023-6384](https://cve.now/CVE-2023-6384.md): WP User Profile Avatar \< 1.0.1 - Author+ Avatar Deletion/Update via IDOR (CVSS 4.3, WP User Profile Avatar)
- [CVE-2023-6625](https://cve.now/CVE-2023-6625.md): Product Enquiry for WooCommerce \< 3.1 - Arbitrary Enquiry Deletion via CSRF (CVSS 4.3, Product Enquiry for WooCommerce)
- [CVE-2023-7170](https://cve.now/CVE-2023-7170.md): EventON-RSVP \< 2.9.5 - Reflected XSS (CVSS 6.1, EventON-RSVP)
- [CVE-2023-45193](https://cve.now/CVE-2023-45193.md): IBM Db2 denial of service (CVSS 5.9, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-50308](https://cve.now/CVE-2023-50308.md): IBM Db2 denial of service (CVSS 6.5, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-0430](https://cve.now/CVE-2024-0430.md): IObit Malware Fighter v11.0.0.1274 - Denial of Service (DoS) (CVSS 5.5, IObit Malware Fighter)
- [CVE-2023-47746](https://cve.now/CVE-2023-47746.md): IBM Db2 denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-0606](https://cve.now/CVE-2024-0606.md): An attacker could execute unauthorized script on a legitimate site through UXSS using window.open() by opening a javascript URI leading to u (CVSS 6.1, Mozilla Focus for iOS)
- [CVE-2024-0605](https://cve.now/CVE-2024-0605.md): Using a javascript: URI with a setTimeout race condition, an attacker can execute unauthorized scripts on top origin sites in urlbar. (CVSS 7.5, Mozilla Focus for iOS)
- [CVE-2024-0204](https://cve.now/CVE-2024-0204.md): Authentication Bypass in GoAnywhere MFT (CVSS 9.8, Fortra GoAnywhere MFT)
- [CVE-2022-45792](https://cve.now/CVE-2022-45792.md): Directory Traversal in Project File Format allows overwrite (Zip Slip) (CVSS 7.8, Omron Sysmac Studio)
- [CVE-2024-0784](https://cve.now/CVE-2024-0784.md): hongmaple octopus list sql injection (CVSS 6.3, hongmaple octopus)
- [CVE-2024-0783](https://cve.now/CVE-2024-0783.md): Project Worlds Online Admission System documents.php unrestricted upload (CVSS 6.3, Project Worlds Online Admission System)
- [CVE-2022-45790](https://cve.now/CVE-2022-45790.md): Omron FINS memory protection susceptible to bruteforce (CVSS 8.6, Omron CJ-series and CS-series CPU modules)
- [CVE-2024-0782](https://cve.now/CVE-2024-0782.md): CodeAstro Online Railway Reservation System pass-profile.php cross site scripting (CVSS 3.5, CodeAstro Online Railway Reservation System)
- [CVE-2024-0781](https://cve.now/CVE-2024-0781.md): CodeAstro Internet Banking System pages\_client\_signup.php redirect (CVSS 3.5, CodeAstro Internet Banking System)
- [CVE-2024-0778](https://cve.now/CVE-2024-0778.md): Uniview ISC 2500-S VM.php setNatConfig os command injection (CVSS 8.0, Uniview ISC 2500-S)
- [CVE-2023-44395](https://cve.now/CVE-2023-44395.md): Autolab has Path Traversal vulnerability in Assessment functionality (CVSS 4.9, Autolab)
- [CVE-2020-36772](https://cve.now/CVE-2020-36772.md): CloudLinux CageFS 7.0.8-2 or below insufficiently restricts file paths supplied to the sendmail proxy command. (CVSS 4.4, Cloudlinux OS cagefs)
- [CVE-2020-36771](https://cve.now/CVE-2020-36771.md): CloudLinux CageFS 7.1.1-1 or below passes the authentication token as a command line argument. (CVSS 7.8, Cloudlinux OS cagefs)
- [CVE-2024-0775](https://cve.now/CVE-2024-0775.md): Kernel: use-after-free while changing the mount option in \_\_ext4\_remount leading (CVSS 6.7, Linux kernel · Red Hat Enterprise Linux)
- [CVE-2024-22233](https://cve.now/CVE-2024-22233.md): CVE-2024-22233: Spring Framework server Web DoS Vulnerability (CVSS 7.5, Spring Framework · org.springframework:spring-core)
- [CVE-2024-21484](https://cve.now/CVE-2024-21484.md): Versions of the package jsrsasign before 11.0.0 are vulnerable to Observable Discrepancy via the RSA PKCS1.5 or RSAOAEP decryption process. (CVSS 7.5, jsrsasign · org.webjars.npm:jsrsasign +2)
- [CVE-2024-22113](https://cve.now/CVE-2024-22113.md): Open redirect vulnerability in Access analysis CGI An-Analyzer released in 2023 December 31 and earlier allows a remote unauthenticated atta (CVSS 6.1, ANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer)
- [CVE-2024-0776](https://cve.now/CVE-2024-0776.md): LinZhaoguan pb-cms Comment cross site scripting (CVSS 3.5, LinZhaoguan pb-cms)
- [CVE-2024-0774](https://cve.now/CVE-2024-0774.md): Any-Capture Any Sound Recorder Registration memory corruption (CVSS 5.3, Any-Capture Any Sound Recorder)
- [CVE-2017-20189](https://cve.now/CVE-2017-20189.md): In Clojure before 1.9.0, classes can be used to construct a serialized object that executes arbitrary code upon deserialization. (CVSS 9.8, org.clojure:clojure)
- [CVE-2021-42141](https://cve.now/CVE-2021-42141.md): An issue was discovered in Contiki-NG tinyDTLS through 2018-08-30. (CVSS 7.5)
- [CVE-2023-24135](https://cve.now/CVE-2023-24135.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a command injection vulnerability in the function formWriteFacM (CVSS 7.8)
- [CVE-2023-47352](https://cve.now/CVE-2023-47352.md): Technicolor TC8715D devices have predictable default WPA2 security passwords. (CVSS 8.8)
- [CVE-2023-48118](https://cve.now/CVE-2023-48118.md): SQL Injection vulnerability in Quest Analytics LLC IQCRM v.2023.9.5 allows a remote attacker to execute arbitrary code via a crafted request (CVSS 9.8)
- [CVE-2023-52354](https://cve.now/CVE-2023-52354.md): chasquid before 1.13 allows SMTP smuggling because LF-terminated lines are accepted. (CVSS 7.5, blitiri.com.ar/go/chasquid · github.com/albertito/chasquid)
- [CVE-2024-22895](https://cve.now/CVE-2024-22895.md): DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module\_upload.php. (CVSS 8.8)
- [CVE-2024-23750](https://cve.now/CVE-2024-23750.md): MetaGPT through 0.6.4 allows the QaEngineer role to execute arbitrary code because RunCode.run\_script() passes shell metacharacters to subpr (CVSS 8.8, metagpt)
- [CVE-2024-23751](https://cve.now/CVE-2024-23751.md): LlamaIndex (aka llama\_index) through 0.9.34 allows SQL injection via the Text-to-SQL feature in NLSQLTableQueryEngine, SQLTableRetrieverQuer (CVSS 9.8, llama-index)
- [CVE-2024-23752](https://cve.now/CVE-2024-23752.md): GenerateSDFPipeline in synthetic\_dataframe in PandasAI (aka pandas-ai) through 1.5.17 allows attackers to trigger the generation of arbitrar (CVSS 9.8, pandasai)
- [CVE-2024-23768](https://cve.now/CVE-2024-23768.md): Dremio before 24.3.1 allows path traversal. (CVSS 8.8)
- [CVE-2024-23770](https://cve.now/CVE-2024-23770.md): darkhttpd through 1.15 allows local users to discover credentials (for --auth) by listing processes and their arguments. (CVSS 5.5)
- [CVE-2024-23771](https://cve.now/CVE-2024-23771.md): darkhttpd before 1.15 uses strcmp (which is not constant time) to verify authentication, which makes it easier for remote attackers to bypas (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.