CVEs published January 23, 2024
145 CVEs were published on January 23, 2024: 14 critical, 59 high. 1 is now in CISA KEV.
- Published
- 145
- Critical
- 14
- High
- 59
- Medium
- 69
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 100
Most affected products
- Trend Micro Apex One
- 16
- Trend Micro Apex Central
- 12
- Google Chrome
- 11
- Mozilla Firefox · Mozilla Thunderbird
- 10
- Apple iOS and iPadOS · Apple macOS +2
- 7
- Apple iOS and iPadOS · Apple macOS +1
- 5
- Apple macOS
- 5
- appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3
- 5
- Mozilla Firefox
- 5
- benbusby whoogle-search · whoogle-search
- 4
Critical 14
- CVE-2024-0808Integer underflow in WebUI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a maGoogle Chrome
- CVE-2024-23636SOFARPC Remote Command Execution(RCE) Vulnerbilitysofastack sofa-rpc · com.alipay.sofa:rpc-sofa-boot-starter
- CVE-2024-22205Whoogle Search Server Side Request Forgery vulnerabilitybenbusby whoogle-search · whoogle-search
- CVE-2024-22203Whoogle Search Server Side Request Forgery vulnerabilitybenbusby whoogle-search · whoogle-search
- CVE-2023-49657Apache Superset: Stored XSS in Dashboard Title and Chart TitleApache Software Foundation Apache Superset · apache-superset
- CVE-2023-31654Redis raft master-1b8bd86 to master-7b46079 was discovered to contain an ODR violation via the component hiredisAllocFns at /opt/fs/redisraf
- CVE-2023-35835An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02.
- CVE-2023-35837An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02.
- CVE-2023-36177An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information
- CVE-2023-51210SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters
- CVE-2024-22076MyQ Print Server before 8.2 patch 43 allows remote authenticated administrators to execute arbitrary code via PHP scripts that are reached t
- CVE-2024-22660TOTOLINK_A3700R_V9.1.2u.6165_20211012has a stack overflow vulnerability via setLanguageCfg
- CVE-2024-22662TOTOLINK A3700R_V9.1.2u.6165_20211012 has a stack overflow vulnerability via setParentalRules
- CVE-2024-22663TOTOLINK_A3700R_V9.1.2u.6165_20211012has a command Injection vulnerability via setOpModeCfg
High 59
- CVE-2024-0804Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin daGoogle Chrome
- CVE-2024-0806Use after free in Passwords in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via speGoogle Chrome
- CVE-2024-0813Use after free in Reading Mode in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious extenGoogle Chrome
- CVE-2024-0812Inappropriate implementation in Accessibility in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit objecGoogle Chrome
- CVE-2024-0807Use after free in Web Audio in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a cGoogle Chrome
- CVE-2023-47115Label Studio XSS Vulnerability on Avatar UploadHumanSignal label-studio · label-studio
- CVE-2023-52338A link following vulnerability in the Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could Trend Micro Deep Security Agent
- CVE-2023-52337An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent Trend Micro Deep Security Agent
- CVE-2023-52331A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with iTrend Micro Apex Central
- CVE-2023-52325A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code onTrend Micro Apex Central
- CVE-2023-52324An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected inTrend Micro Apex Central
- CVE-2023-52094An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the updater to delete an arbTrend Micro Apex One
- CVE-2023-52093An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affecteTrend Micro Apex One
- CVE-2023-52092A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instalTrend Micro Apex One
- CVE-2023-52091An anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected Trend Micro Apex One
- CVE-2023-52090A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instalTrend Micro Apex One
- CVE-2023-47202A local file inclusion vulnerability on the Trend Micro Apex One management server could allow a local attacker to escalate privileges on afTrend Micro Apex One
- CVE-2023-47200A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privilTrend Micro Apex One
- CVE-2023-47199An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteTrend Micro Apex One
- CVE-2023-47198An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteTrend Micro Apex One
- CVE-2023-47197An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteTrend Micro Apex One
- CVE-2023-47196An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteTrend Micro Apex One
- CVE-2023-47195An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteTrend Micro Apex One
- CVE-2023-47194An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteTrend Micro Apex One
- CVE-2023-47193An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecteTrend Micro Apex One
- CVE-2023-47192An agent link vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected instaTrend Micro Apex One
- CVE-2023-6926Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Crestron AM-300Crestron AM-300
- CVE-2023-7238Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web ViewerOrthanc Osimis DICOM Web Viewer
- CVE-2023-50275HPE OneView may allow clusterService Authentication Bypass resulting in denial of service.Hewlett Packard Enterprise HPE OneView
- CVE-2023-50274HPE OneView may allow command injection with local privilege escalation.Hewlett Packard Enterprise HPE OneView
- CVE-2024-0745The WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow.Mozilla Firefox
- CVE-2024-0744In some circumstances, JIT compiled code could have dereferenced a wild pointer value.Mozilla Firefox
- CVE-2024-0743An unchecked return value in TLS handshake code could have caused a potentially exploitable crash.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-0755Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-0751A malicious devtools extension could have been used to escalate privileges.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-0750A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-23348Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3
- CVE-2024-23182Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3
- CVE-2024-23180Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3
- CVE-2024-23842Hitron Systems DVR LGUVR-16H Improper Input Validation VulnerabilityHitron Systems DVR DVR LGUVR-16H
- CVE-2024-22772Hitron Systems DVR LGUVR-8H Improper Input Validation VulnerabilityHitron Systems DVR LGUVR-8H
- CVE-2024-22771Hitron Systems DVR LGUVR-4H Improper Input Validation VulnerabilityHitron Systems DVR LGUVR-4H
- CVE-2024-22770Hitron Systems DVR HVR-16781 Improper Input Validation Vulnerability Hitron Systems DVR HVR-16781
- CVE-2024-22769Hitron Systems DVR HVR-8781 Improper Input Validation Vulnerability Hitron Systems DVR HVR-8781
- CVE-2024-22768Hitron Systems DVR HVR-4781 Improper Input Validation Vulnerability Hitron Systems DVR HVR-4781
- CVE-2024-23222A type confusion issue was addressed with improved checks.Apple Safari · Apple iOS and iPadOS +3
- CVE-2024-23214Multiple memory corruption issues were addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2024-23203The issue was addressed with additional permissions checks.Apple iOS and iPadOS · Apple macOS
- CVE-2024-23204The issue was addressed with additional permissions checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-23212The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-23208The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-42881The issue was addressed with improved memory handling.Apple macOS
- CVE-2024-23209The issue was addressed with improved memory handling.Apple macOS
- CVE-2024-23213The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +3
- CVE-2021-42142An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97.
- CVE-2023-46892The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record
- CVE-2023-51042In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-after-free.
- CVE-2023-51043In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic com
- CVE-2024-22705An issue was discovered in ksmbd in the Linux kernel before 6.6.10.
Medium, low and unrated 72
- CVE-2024-0809Inappropriate implementation in Autofill in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to bypass Autofill restrictions vGoogle Chrome
- CVE-2024-0811Inappropriate implementation in Extensions API in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install aGoogle Chrome
- CVE-2024-0805Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to perform domain spoofing via aGoogle Chrome
- CVE-2024-0814Incorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially spoof security UI via a cGoogle Chrome
- CVE-2024-0810Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a maGoogle Chrome
- CVE-2024-23638SQUID-2023:11 Denial of Service in Cache Managersquid-cache squid
- CVE-2024-23633 Label Studio XSS Vulnerability on Data ImportHumanSignal label-studio · label-studio
- CVE-2024-23453Android Spoon application version 7.11.1 to 8.6.0 uses hard-coded credentials, which may allow a local attacker to retrieve the hard-coded ASpoon Radio Japan Android Spoon application
- CVE-2023-7237Lantronix XPort Weak Encoding for PasswordLantronix XPort
- CVE-2023-52330A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected installTrend Micro Apex Central
- CVE-2023-52329Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atTrend Micro Apex Central
- CVE-2023-52328Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atTrend Micro Apex Central
- CVE-2023-52327Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atTrend Micro Apex Central
- CVE-2023-52326Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an atTrend Micro Apex Central
- CVE-2023-47201A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privilTrend Micro Apex One
- CVE-2023-41178Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticTrend Micro Mobile Security for Enterprise
- CVE-2023-41177Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticTrend Micro Mobile Security for Enterprise
- CVE-2023-41176Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authenticTrend Micro Mobile Security for Enterprise
- CVE-2023-38627A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow aTrend Micro Apex Central
- CVE-2023-38626A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow aTrend Micro Apex Central
- CVE-2023-38625A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow aTrend Micro Apex Central
- CVE-2023-38624A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow aTrend Micro Apex Central
- CVE-2024-23341TuiTse-TsuSin html injection vulnerability in `tuitse_html` functioni3thuan5 TuiTse-TsuSin · tuitse-tsusin
- CVE-2024-23330Tuta loads images from external resourcestutao tutanota
- CVE-2024-22417Whoogle Search Cross-site Scripting vulnerabilitybenbusby whoogle-search · whoogle-search
- CVE-2024-22204Whoogle Search Limited File Write vulnerabilitybenbusby whoogle-search · whoogle-search
- CVE-2023-6573HPE OneView may have a missing passphrase during restore.Hewlett Packard Enterprise HPE OneView
- CVE-2023-49783No permission checks for editing/deleting records with CSV import formsilverstripe-admin · silverstripe/admin
- CVE-2023-48714Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompletersilverstripe-framework · silverstripe/framework
- CVE-2024-0754Some WASM source files could have caused a crash when loaded in devtools.Mozilla Firefox
- CVE-2024-0752A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system.Mozilla Firefox
- CVE-2024-0748A compromised content process could have updated the document URI.Mozilla Firefox
- CVE-2024-0753In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-0749A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-0747When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child ContMozilla Firefox · Mozilla Thunderbird
- CVE-2024-0746A Linux user opening the print preview dialog could have caused the browser to crash.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-0742It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestaMozilla Firefox · Mozilla Thunderbird
- CVE-2024-0741An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-44401Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM datasilverstripe-graphql · silverstripe/graphql
- CVE-2024-0703Sticky Buttons <= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scriptingwpcalc Sticky Buttons – Floating Buttons Builder
- CVE-2024-23183Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3
- CVE-2024-23181Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3
- CVE-2024-0587Accelerated Mobile Pages <= 1.0.92.1 - Reflected Cross-Site Scriptingmohammed_kaludi AMP for WP – Accelerated Mobile Pages
- CVE-2023-39197Kernel: dccp: conntrack out-of-bounds read in nf_conntrack_dccp_packet()Red Hat Enterprise Linux
- CVE-2024-23218A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-42887An access issue was addressed with additional sandbox restrictions.Apple macOS
- CVE-2023-42937A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-23215An issue was addressed with improved handling of temporary files.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-23223A privacy issue was addressed with improved handling of files.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-23219The issue was addressed with improved authentication.Apple iOS and iPadOS
- CVE-2024-23224The issue was addressed with improved checks.Apple macOS
- CVE-2024-23210This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-23206An access issue was addressed with improved access restrictions.Apple Safari · Apple iOS and iPadOS +3
- CVE-2024-23207This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-23211A privacy issue was addressed with improved handling of user preferences.Apple Safari · Apple iOS and iPadOS +2
- CVE-2023-40528This issue was addressed by removing the vulnerable code.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-42935An authentication issue was addressed with improved state management.Apple macOS
- CVE-2023-42888The issue was addressed with improved checks.Apple iOS and iPadOS · Apple macOS +1
- CVE-2024-23217A privacy issue was addressed with improved handling of temporary files.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-35836An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02.
- CVE-2023-42143Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device
- CVE-2023-42144Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password.
- CVE-2023-45889A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.8 allows remote attackers to inject JavaScr
- CVE-2023-46343In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c.
- CVE-2023-46889Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information.
- CVE-2024-22490Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter.com.ibeetl:beetl
- CVE-2024-22496Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter.com.jfinal:jfinal
- CVE-2024-22497Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crcom.jfinal:jfinal
- CVE-2024-23848In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/m
- CVE-2024-23849In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_
- CVE-2024-23850In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolu
- CVE-2024-23851copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because o