# CVEs published 2024-01-23

145 CVEs were published on January 23, 2024: 14 critical, 59 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-0809](https://cve.now/CVE-2024-0809.md): Inappropriate implementation in Autofill in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to bypass Autofill restrictions v (CVSS 4.3, Google Chrome)
- [CVE-2024-0811](https://cve.now/CVE-2024-0811.md): Inappropriate implementation in Extensions API in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a (CVSS 4.3, Google Chrome)
- [CVE-2024-0804](https://cve.now/CVE-2024-0804.md): Insufficient policy enforcement in iOS Security UI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to leak cross-origin da (CVSS 7.5, Google Chrome)
- [CVE-2024-0805](https://cve.now/CVE-2024-0805.md): Inappropriate implementation in Downloads in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to perform domain spoofing via a (CVSS 4.3, Google Chrome)
- [CVE-2024-0806](https://cve.now/CVE-2024-0806.md): Use after free in Passwords in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via spe (CVSS 8.8, Google Chrome)
- [CVE-2024-0813](https://cve.now/CVE-2024-0813.md): Use after free in Reading Mode in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a malicious exten (CVSS 8.8, Google Chrome)
- [CVE-2024-0814](https://cve.now/CVE-2024-0814.md): Incorrect security UI in Payments in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially spoof security UI via a c (CVSS 6.5, Google Chrome)
- [CVE-2024-0810](https://cve.now/CVE-2024-0810.md): Insufficient policy enforcement in DevTools in Google Chrome prior to 121.0.6167.85 allowed an attacker who convinced a user to install a ma (CVSS 4.3, Google Chrome)
- [CVE-2024-0808](https://cve.now/CVE-2024-0808.md): Integer underflow in WebUI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a ma (CVSS 9.8, Google Chrome)
- [CVE-2024-0812](https://cve.now/CVE-2024-0812.md): Inappropriate implementation in Accessibility in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit objec (CVSS 8.8, Google Chrome)
- [CVE-2024-0807](https://cve.now/CVE-2024-0807.md): Use after free in Web Audio in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit heap corruption via a c (CVSS 8.8, Google Chrome)
- [CVE-2024-23638](https://cve.now/CVE-2024-23638.md): SQUID-2023:11 Denial of Service in Cache Manager (CVSS 6.5, squid-cache squid)
- [CVE-2024-23633](https://cve.now/CVE-2024-23633.md): Label Studio XSS Vulnerability on Data Import (CVSS 4.7, HumanSignal label-studio · label-studio)
- [CVE-2024-23453](https://cve.now/CVE-2024-23453.md): Android Spoon application version 7.11.1 to 8.6.0 uses hard-coded credentials, which may allow a local attacker to retrieve the hard-coded A (CVSS 5.5, Spoon Radio Japan Android Spoon application)
- [CVE-2023-47115](https://cve.now/CVE-2023-47115.md): Label Studio XSS Vulnerability on Avatar Upload (CVSS 7.1, HumanSignal label-studio · label-studio)
- [CVE-2023-7237](https://cve.now/CVE-2023-7237.md): Lantronix XPort Weak Encoding for Password (CVSS 5.7, Lantronix XPort)
- [CVE-2023-52338](https://cve.now/CVE-2023-52338.md): A link following vulnerability in the Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent could (CVSS 7.8, Trend Micro Deep Security Agent)
- [CVE-2023-52337](https://cve.now/CVE-2023-52337.md): An improper access control vulnerability in Trend Micro Deep Security 20.0 and Trend Micro Cloud One - Endpoint and Workload Security Agent (CVSS 7.8, Trend Micro Deep Security Agent)
- [CVE-2023-52331](https://cve.now/CVE-2023-52331.md): A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central could allow an attacker to interact with i (CVSS 7.1, Trend Micro Apex Central)
- [CVE-2023-52330](https://cve.now/CVE-2023-52330.md): A cross-site scripting vulnerability in Trend Micro Apex Central could allow a remote attacker to execute arbitrary code on affected install (CVSS 6.1, Trend Micro Apex Central)
- [CVE-2023-52329](https://cve.now/CVE-2023-52329.md): Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an at (CVSS 6.1, Trend Micro Apex Central)
- [CVE-2023-52328](https://cve.now/CVE-2023-52328.md): Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an at (CVSS 6.1, Trend Micro Apex Central)
- [CVE-2023-52327](https://cve.now/CVE-2023-52327.md): Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an at (CVSS 6.1, Trend Micro Apex Central)
- [CVE-2023-52326](https://cve.now/CVE-2023-52326.md): Certain dashboard widgets on Trend Micro Apex Central (on-premise) are vulnerable to cross-site scripting (XSS) attacks that may allow an at (CVSS 6.1, Trend Micro Apex Central)
- [CVE-2023-52325](https://cve.now/CVE-2023-52325.md): A local file inclusion vulnerability in one of Trend Micro Apex Central's widgets could allow a remote attacker to execute arbitrary code on (CVSS 7.5, Trend Micro Apex Central)
- [CVE-2023-52324](https://cve.now/CVE-2023-52324.md): An unrestricted file upload vulnerability in Trend Micro Apex Central could allow a remote attacker to create arbitrary files on affected in (CVSS 8.8, Trend Micro Apex Central)
- [CVE-2023-52094](https://cve.now/CVE-2023-52094.md): An updater link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to abuse the updater to delete an arb (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-52093](https://cve.now/CVE-2023-52093.md): An exposed dangerous function vulnerability in the Trend Micro Apex One agent could allow a local attacker to escalate privileges on affecte (CVSS 7.4, Trend Micro Apex One)
- [CVE-2023-52092](https://cve.now/CVE-2023-52092.md): A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-52091](https://cve.now/CVE-2023-52091.md): An anti-spyware engine link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-52090](https://cve.now/CVE-2023-52090.md): A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to escalate privileges on affected instal (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-47202](https://cve.now/CVE-2023-47202.md): A local file inclusion vulnerability on the Trend Micro Apex One management server could allow a local attacker to escalate privileges on af (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-47201](https://cve.now/CVE-2023-47201.md): A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privil (CVSS 6.7, Trend Micro Apex One)
- [CVE-2023-47200](https://cve.now/CVE-2023-47200.md): A plug-in manager origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privil (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-47199](https://cve.now/CVE-2023-47199.md): An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-47198](https://cve.now/CVE-2023-47198.md): An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-47197](https://cve.now/CVE-2023-47197.md): An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-47196](https://cve.now/CVE-2023-47196.md): An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-47195](https://cve.now/CVE-2023-47195.md): An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-47194](https://cve.now/CVE-2023-47194.md): An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-47193](https://cve.now/CVE-2023-47193.md): An origin validation vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affecte (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-47192](https://cve.now/CVE-2023-47192.md): An agent link vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalate privileges on affected insta (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-41178](https://cve.now/CVE-2023-41178.md): Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authentic (CVSS 6.1, Trend Micro Mobile Security for Enterprise)
- [CVE-2023-41177](https://cve.now/CVE-2023-41177.md): Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authentic (CVSS 6.1, Trend Micro Mobile Security for Enterprise)
- [CVE-2023-41176](https://cve.now/CVE-2023-41176.md): Reflected cross-site scripting (XSS) vulnerabilities in Trend Micro Mobile Security (Enterprise) could allow an exploit against an authentic (CVSS 6.1, Trend Micro Mobile Security for Enterprise)
- [CVE-2023-38627](https://cve.now/CVE-2023-38627.md): A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow a (CVSS 5.4, Trend Micro Apex Central)
- [CVE-2023-38626](https://cve.now/CVE-2023-38626.md): A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow a (CVSS 5.4, Trend Micro Apex Central)
- [CVE-2023-38625](https://cve.now/CVE-2023-38625.md): A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow a (CVSS 5.4, Trend Micro Apex Central)
- [CVE-2023-38624](https://cve.now/CVE-2023-38624.md): A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow a (CVSS 5.4, Trend Micro Apex Central)
- [CVE-2023-6926](https://cve.now/CVE-2023-6926.md): Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Crestron AM-300 (CVSS 8.4, Crestron AM-300)
- [CVE-2023-7238](https://cve.now/CVE-2023-7238.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer (CVSS 7.1, Orthanc Osimis DICOM Web Viewer)
- [CVE-2024-23636](https://cve.now/CVE-2024-23636.md): SOFARPC Remote Command Execution(RCE) Vulnerbility (CVSS 9.8, sofastack sofa-rpc · com.alipay.sofa:rpc-sofa-boot-starter)
- [CVE-2024-23341](https://cve.now/CVE-2024-23341.md): TuiTse-TsuSin html injection vulnerability in \`tuitse\_html\` function (CVSS 6.1, i3thuan5 TuiTse-TsuSin · tuitse-tsusin)
- [CVE-2024-23330](https://cve.now/CVE-2024-23330.md): Tuta loads images from external resources (CVSS 5.3, tutao tutanota)
- [CVE-2024-22417](https://cve.now/CVE-2024-22417.md): Whoogle Search Cross-site Scripting vulnerability (CVSS 6.1, benbusby whoogle-search · whoogle-search)
- [CVE-2024-22205](https://cve.now/CVE-2024-22205.md): Whoogle Search Server Side Request Forgery vulnerability (CVSS 9.1, benbusby whoogle-search · whoogle-search)
- [CVE-2024-22204](https://cve.now/CVE-2024-22204.md): Whoogle Search Limited File Write vulnerability (CVSS 5.3, benbusby whoogle-search · whoogle-search)
- [CVE-2024-22203](https://cve.now/CVE-2024-22203.md): Whoogle Search Server Side Request Forgery vulnerability (CVSS 9.1, benbusby whoogle-search · whoogle-search)
- [CVE-2023-6573](https://cve.now/CVE-2023-6573.md): HPE OneView may have a missing passphrase during restore. (CVSS 5.5, Hewlett Packard Enterprise HPE OneView)
- [CVE-2023-50275](https://cve.now/CVE-2023-50275.md): HPE OneView may allow clusterService Authentication Bypass resulting in denial of service. (CVSS 7.5, Hewlett Packard Enterprise HPE OneView)
- [CVE-2023-50274](https://cve.now/CVE-2023-50274.md): HPE OneView may allow command injection with local privilege escalation. (CVSS 7.8, Hewlett Packard Enterprise HPE OneView)
- [CVE-2023-49657](https://cve.now/CVE-2023-49657.md): Apache Superset: Stored XSS in Dashboard Title and Chart Title (CVSS 9.6, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2023-49783](https://cve.now/CVE-2023-49783.md): No permission checks for editing/deleting records with CSV import form (CVSS 4.3, silverstripe-admin · silverstripe/admin)
- [CVE-2023-48714](https://cve.now/CVE-2023-48714.md): Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter (CVSS 4.3, silverstripe-framework · silverstripe/framework)
- [CVE-2024-0754](https://cve.now/CVE-2024-0754.md): Some WASM source files could have caused a crash when loaded in devtools. (CVSS 6.5, Mozilla Firefox)
- [CVE-2024-0752](https://cve.now/CVE-2024-0752.md): A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system. (CVSS 6.5, Mozilla Firefox)
- [CVE-2024-0748](https://cve.now/CVE-2024-0748.md): A compromised content process could have updated the document URI. (CVSS 4.3, Mozilla Firefox)
- [CVE-2024-0745](https://cve.now/CVE-2024-0745.md): The WebAudio \`OscillatorNode\` object was susceptible to a stack buffer overflow. (CVSS 8.8, Mozilla Firefox)
- [CVE-2024-0744](https://cve.now/CVE-2024-0744.md): In some circumstances, JIT compiled code could have dereferenced a wild pointer value. (CVSS 7.5, Mozilla Firefox)
- [CVE-2024-0743](https://cve.now/CVE-2024-0743.md): An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. (CVSS 7.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-0755](https://cve.now/CVE-2024-0755.md): Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-0753](https://cve.now/CVE-2024-0753.md): In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-0751](https://cve.now/CVE-2024-0751.md): A malicious devtools extension could have been used to escalate privileges. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-0750](https://cve.now/CVE-2024-0750.md): A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-0749](https://cve.now/CVE-2024-0749.md): A phishing site could have repurposed an \`about:\` dialog to show phishing content with an incorrect origin in the address bar. (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-0747](https://cve.now/CVE-2024-0747.md): When a parent page loaded a child in an iframe with \`unsafe-inline\`, the parent Content Security Policy could have overridden the child Cont (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-0746](https://cve.now/CVE-2024-0746.md): A Linux user opening the print preview dialog could have caused the browser to crash. (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-0742](https://cve.now/CVE-2024-0742.md): It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timesta (CVSS 4.3, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-0741](https://cve.now/CVE-2024-0741.md): An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-44401](https://cve.now/CVE-2023-44401.md): Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data (CVSS 5.3, silverstripe-graphql · silverstripe/graphql)
- [CVE-2024-0703](https://cve.now/CVE-2024-0703.md): Sticky Buttons \<= 3.2.2 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, wpcalc Sticky Buttons – Floating Buttons Builder)
- [CVE-2024-23348](https://cve.now/CVE-2024-23348.md): Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3 (CVSS 8.8, appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3)
- [CVE-2024-23183](https://cve.now/CVE-2024-23183.md): Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29 (CVSS 5.4, appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3)
- [CVE-2024-23182](https://cve.now/CVE-2024-23182.md): Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0 (CVSS 8.1, appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3)
- [CVE-2024-23181](https://cve.now/CVE-2024-23181.md): Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29 (CVSS 6.1, appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3)
- [CVE-2024-23180](https://cve.now/CVE-2024-23180.md): Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3 (CVSS 8.8, appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3)
- [CVE-2024-0587](https://cve.now/CVE-2024-0587.md): Accelerated Mobile Pages \<= 1.0.92.1 - Reflected Cross-Site Scripting (CVSS 6.1, mohammed\_kaludi AMP for WP – Accelerated Mobile Pages)
- [CVE-2024-23842](https://cve.now/CVE-2024-23842.md): Hitron Systems DVR LGUVR-16H Improper Input Validation Vulnerability (CVSS 7.4, Hitron Systems DVR DVR LGUVR-16H)
- [CVE-2024-22772](https://cve.now/CVE-2024-22772.md): Hitron Systems DVR LGUVR-8H Improper Input Validation Vulnerability (CVSS 7.4, Hitron Systems DVR LGUVR-8H)
- [CVE-2024-22771](https://cve.now/CVE-2024-22771.md): Hitron Systems DVR LGUVR-4H Improper Input Validation Vulnerability (CVSS 7.4, Hitron Systems DVR LGUVR-4H)
- [CVE-2024-22770](https://cve.now/CVE-2024-22770.md): Hitron Systems DVR HVR-16781 Improper Input Validation Vulnerability (CVSS 7.4, Hitron Systems DVR HVR-16781)
- [CVE-2024-22769](https://cve.now/CVE-2024-22769.md): Hitron Systems DVR HVR-8781 Improper Input Validation Vulnerability (CVSS 7.4, Hitron Systems DVR HVR-8781)
- [CVE-2024-22768](https://cve.now/CVE-2024-22768.md): Hitron Systems DVR HVR-4781 Improper Input Validation Vulnerability (CVSS 7.4, Hitron Systems DVR HVR-4781)
- [CVE-2023-39197](https://cve.now/CVE-2023-39197.md): Kernel: dccp: conntrack out-of-bounds read in nf\_conntrack\_dccp\_packet() (CVSS 4.0, Red Hat Enterprise Linux)
- [CVE-2024-23218](https://cve.now/CVE-2024-23218.md): A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. (CVSS 5.9, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-42887](https://cve.now/CVE-2023-42887.md): An access issue was addressed with additional sandbox restrictions. (CVSS 6.3, Apple macOS)
- [CVE-2024-23222](https://cve.now/CVE-2024-23222.md): A type confusion issue was addressed with improved checks. (CVSS 8.8, KEV, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2023-42937](https://cve.now/CVE-2023-42937.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23214](https://cve.now/CVE-2024-23214.md): Multiple memory corruption issues were addressed with improved memory handling. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-23215](https://cve.now/CVE-2024-23215.md): An issue was addressed with improved handling of temporary files. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23203](https://cve.now/CVE-2024-23203.md): The issue was addressed with additional permissions checks. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-23223](https://cve.now/CVE-2024-23223.md): A privacy issue was addressed with improved handling of files. (CVSS 6.2, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23219](https://cve.now/CVE-2024-23219.md): The issue was addressed with improved authentication. (CVSS 6.2, Apple iOS and iPadOS)
- [CVE-2024-23204](https://cve.now/CVE-2024-23204.md): The issue was addressed with additional permissions checks. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23212](https://cve.now/CVE-2024-23212.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23208](https://cve.now/CVE-2024-23208.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-42881](https://cve.now/CVE-2023-42881.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2024-23224](https://cve.now/CVE-2024-23224.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-23209](https://cve.now/CVE-2024-23209.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple macOS)
- [CVE-2024-23213](https://cve.now/CVE-2024-23213.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2024-23210](https://cve.now/CVE-2024-23210.md): This issue was addressed with improved redaction of sensitive information. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23206](https://cve.now/CVE-2024-23206.md): An access issue was addressed with improved access restrictions. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2024-23207](https://cve.now/CVE-2024-23207.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23211](https://cve.now/CVE-2024-23211.md): A privacy issue was addressed with improved handling of user preferences. (CVSS 3.3, Apple Safari · Apple iOS and iPadOS +2)
- [CVE-2023-40528](https://cve.now/CVE-2023-40528.md): This issue was addressed by removing the vulnerable code. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-42935](https://cve.now/CVE-2023-42935.md): An authentication issue was addressed with improved state management. (CVSS 5.5, Apple macOS)
- [CVE-2023-42888](https://cve.now/CVE-2023-42888.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23217](https://cve.now/CVE-2024-23217.md): A privacy issue was addressed with improved handling of temporary files. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2021-42142](https://cve.now/CVE-2021-42142.md): An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. (CVSS 8.2)
- [CVE-2023-31654](https://cve.now/CVE-2023-31654.md): Redis raft master-1b8bd86 to master-7b46079 was discovered to contain an ODR violation via the component hiredisAllocFns at /opt/fs/redisraf (CVSS 9.8)
- [CVE-2023-35835](https://cve.now/CVE-2023-35835.md): An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. (CVSS 9.8)
- [CVE-2023-35836](https://cve.now/CVE-2023-35836.md): An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. (CVSS 6.5)
- [CVE-2023-35837](https://cve.now/CVE-2023-35837.md): An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. (CVSS 9.8)
- [CVE-2023-36177](https://cve.now/CVE-2023-36177.md): An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information (CVSS 9.8)
- [CVE-2023-42143](https://cve.now/CVE-2023-42143.md): Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device (CVSS 5.4)
- [CVE-2023-42144](https://cve.now/CVE-2023-42144.md): Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password. (CVSS 5.5)
- [CVE-2023-45889](https://cve.now/CVE-2023-45889.md): A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.8 allows remote attackers to inject JavaScr (CVSS 6.1)
- [CVE-2023-46343](https://cve.now/CVE-2023-46343.md): In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send\_acknowledge in net/nfc/nci/spi.c. (CVSS 5.5)
- [CVE-2023-46889](https://cve.now/CVE-2023-46889.md): Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. (CVSS 5.7)
- [CVE-2023-46892](https://cve.now/CVE-2023-46892.md): The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record (CVSS 8.8)
- [CVE-2023-51042](https://cve.now/CVE-2023-51042.md): In the Linux kernel before 6.4.12, amdgpu\_cs\_wait\_all\_fences in drivers/gpu/drm/amd/amdgpu/amdgpu\_cs.c has a fence use-after-free. (CVSS 7.8)
- [CVE-2023-51043](https://cve.now/CVE-2023-51043.md): In the Linux kernel before 6.4.5, drivers/gpu/drm/drm\_atomic.c has a use-after-free during a race condition between a nonblocking atomic com (CVSS 7.0)
- [CVE-2023-51210](https://cve.now/CVE-2023-51210.md): SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id\_product parameters (CVSS 9.8)
- [CVE-2024-22076](https://cve.now/CVE-2024-22076.md): MyQ Print Server before 8.2 patch 43 allows remote authenticated administrators to execute arbitrary code via PHP scripts that are reached t (CVSS 9.8)
- [CVE-2024-22490](https://cve.now/CVE-2024-22490.md): Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter. (CVSS 6.1, com.ibeetl:beetl)
- [CVE-2024-22496](https://cve.now/CVE-2024-22496.md): Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter. (CVSS 6.1, com.jfinal:jfinal)
- [CVE-2024-22497](https://cve.now/CVE-2024-22497.md): Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via cr (CVSS 6.1, com.jfinal:jfinal)
- [CVE-2024-22660](https://cve.now/CVE-2024-22660.md): TOTOLINK\_A3700R\_V9.1.2u.6165\_20211012has a stack overflow vulnerability via setLanguageCfg (CVSS 9.8)
- [CVE-2024-22662](https://cve.now/CVE-2024-22662.md): TOTOLINK A3700R\_V9.1.2u.6165\_20211012 has a stack overflow vulnerability via setParentalRules (CVSS 9.8)
- [CVE-2024-22663](https://cve.now/CVE-2024-22663.md): TOTOLINK\_A3700R\_V9.1.2u.6165\_20211012has a command Injection vulnerability via setOpModeCfg (CVSS 9.8)
- [CVE-2024-22705](https://cve.now/CVE-2024-22705.md): An issue was discovered in ksmbd in the Linux kernel before 6.6.10. (CVSS 7.8)
- [CVE-2024-23848](https://cve.now/CVE-2024-23848.md): In the Linux kernel through 6.7.1, there is a use-after-free in cec\_queue\_msg\_fh, related to drivers/media/cec/core/cec-adap.c and drivers/m (CVSS 5.5)
- [CVE-2024-23849](https://cve.now/CVE-2024-23849.md): In rds\_recv\_track\_latency in net/rds/af\_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS\_MSG\_RX\_DGRAM\_TRACE\_ (CVSS 5.5)
- [CVE-2024-23850](https://cve.now/CVE-2024-23850.md): In btrfs\_get\_root\_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolu (CVSS 5.5)
- [CVE-2024-23851](https://cve.now/CVE-2024-23851.md): copy\_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT\_MAX bytes, and crash, because o (CVSS 5.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.