CVEs published January 24, 2024
76 CVEs were published on January 24, 2024: 11 critical, 23 high. 1 is now in CISA KEV.
- Published
- 76
- Critical
- 11
- High
- 23
- Medium
- 40
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 19
Most affected products
- Jenkins Project Jenkins GitLab Branch Source Plugin · io.je…
- 3
- Apache Software Foundation Apache Airflow · apache-airflow
- 2
- Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- 2
- pimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…
- 2
- aguilatechnologies WP Customer Area
- 1
- Apache Software Foundation Apache Airflow CNCF Kubernete… +2
- 1
- Canonical Ubuntu pipewire-pulse
- 1
- Cozmoslabs Profile Builder Pro
- 1
- Dell Pair
- 1
- Dell Unity
- 1
Critical 11
- CVE-2024-23897Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character folloJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-52221WordPress Barcode Scanner with Inventory & Order Manager Plugin <= 1.5.1 is vulnerable to Arbitrary File UploadUkrSolution Barcode Scanner and Inventory manager
- CVE-2021-42143An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97.
- CVE-2021-42147Buffer over-read vulnerability in the dtls_sha256_update function in Contiki-NG tinyDTLS through master branch 53a0d97 allows remote attacke
- CVE-2023-51885Buffer Overflow vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via the length of the LaTeX st
- CVE-2023-51887Command Injection vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in applic
- CVE-2023-51889Stack Overflow vulnerability in the validate() function in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via
- CVE-2023-52038An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415C80 function.
- CVE-2023-52039An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_415AA4 function.
- CVE-2024-22651There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04.
- CVE-2024-22751D-Link DIR-882 DIR882A1_FW130B06 was discovered to contain a stack overflow via the sub_477AA0 function.
High 23
- CVE-2024-23646Pimcore Admin Classic Bundle SQL Injection in Admin download files as zippimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…
- CVE-2024-23649Any authenticated user may obtain private message details from other users on the same instanceLemmyNet lemmy · lemmy_server
- CVE-2024-23648Pimcore Admin Classic Bundle host header injection in the password resetpimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…
- CVE-2024-23904Jenkins Log Command Plugin 1.0.2 and earlier does not disable a feature of its command parser that replaces an '@' character followed by a fJenkins Project Jenkins Log Command Plugin · org.jenkins-ci…
- CVE-2024-23898Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests maJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2024-23641Sending a GET or HEAD request with a body crashes SvelteKitsveltejs kit · @sveltejs/kit +1
- CVE-2023-50943Apache Airflow: Potential pickle deserialization vulnerability in XComsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2024-22154WordPress SalesKing Plugin <= 1.6.15 is vulnerable to Sensitive Data ExposureSNP Digital SalesKing
- CVE-2024-22135WordPress Order Export & Order Import for WooCommerce Plugin <= 2.4.3 is vulnerable to Arbitrary File UploadWebToffee Order Export & Order Import for WooCommerce
- CVE-2024-22152WordPress Product Import Export for WooCommerce Plugin <= 2.3.7 is vulnerable to Arbitrary File UploadWebToffee Product Import Export for WooCommerce
- CVE-2024-22284WordPress Asgaros Forum Plugin <= 2.7.2 is vulnerable to PHP Object InjectionThomas Belser Asgaros Forum
- CVE-2024-22309WordPress ChatBot Plugin <= 5.1.0 is vulnerable to PHP Object InjectionQuantumCloud ChatBot with AI
- CVE-2023-31037 NVIDIA Bluefield 2 and Bluefield 3 DPU BMC contains a vulnerability in ipmitool, where a root user may cause code injection by a network caNVIDIA Bluefield 2 DPU BMC, BlueField 3 DPU BMC
- CVE-2021-42144Buffer over-read vulnerability in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers obtain sensitive information via crafte
- CVE-2021-42145An assertion failure discovered in in check_certificate_request() in Contiki-NG tinyDTLS through master branch 53a0d97 allows attackers to c
- CVE-2021-42146An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97.
- CVE-2023-24676An issue found in ProcessWire 3.0.210 allows attackers to execute arbitrary code and install a reverse shell via the download_zip_url parameprocesswire/processwire
- CVE-2023-43317An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storag
- CVE-2023-51711An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbit
- CVE-2023-51886Buffer Overflow vulnerability in the main() function in Mathtex 1.05 and before allows a remote attacker to cause a denial of service when u
- CVE-2023-51888Buffer Overflow vulnerability in the nomath() function in Mathtex v.1.05 and before allows a remote attacker to cause a denial of service vi
- CVE-2023-51890An infinite loop issue discovered in Mathtex 1.05 and before allows a remote attackers to consume CPU resources via crafted string in the ap
- CVE-2023-52040An issue discovered in TOTOLINK X6000R v9.4.0cu.852_B20230719 allows attackers to run arbitrary commands via the sub_41284C function.
Medium, low and unrated 42
- CVE-2024-23644trillium-http and trillium-client vulnerable to HTTP Request/Response Splittingtrillium-rs trillium · trillium-http +1
- CVE-2024-23905Jenkins Red Hat Dependency Analytics Plugin 0.7.1 and earlier programmatically disables Content-Security-Policy protection for user-generateJenkins Project Jenkins Red Hat Dependency Analytics Plugin…
- CVE-2024-23903Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier uses a non-constant time comparison function when checking whether the pJenkins Project Jenkins GitLab Branch Source Plugin · io.je…
- CVE-2024-23902A cross-site request forgery (CSRF) vulnerability in Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier allows attackers toJenkins Project Jenkins GitLab Branch Source Plugin · io.je…
- CVE-2024-23901Jenkins GitLab Branch Source Plugin 684.vea_fa_7c1e2fe3 and earlier unconditionally discovers projects that are shared with the configured oJenkins Project Jenkins GitLab Branch Source Plugin · io.je…
- CVE-2024-23900Jenkins Matrix Project Plugin 822.v01b_8c85d16d2 and earlier does not sanitize user-defined axis names of multi-configuration projects, alloJenkins Project Jenkins Matrix Project Plugin · org.jenkins…
- CVE-2024-23899Jenkins Git server Plugin 99.va_0826a_b_cdfa_d and earlier does not disable a feature of its command parser that replaces an '@' character fJenkins Project Jenkins Git server Plugin · org.jenkins-ci.…
- CVE-2024-22229 Dell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed by an authenticated attacker.Dell Unity
- CVE-2023-44281 Dell Pair Installer version prior to 1.2.1 contains an elevation of privilege vulnerability.Dell Pair
- CVE-2024-22141WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Sensitive Data ExposureCozmoslabs Profile Builder Pro
- CVE-2023-6697WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scriptingwpgmaps WP Go Maps
- CVE-2023-50944Apache Airflow: Bypass permission verification to read code of other dagsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2023-51702Apache Airflow CNCF Kubernetes provider, Apache Airflow: Kubernetes configuration file saved without encryption in the Metadata and logged as plain text in the Triggerer serviceApache Software Foundation Apache Airflow CNCF Kubernete… +2
- CVE-2024-22294WordPress Download IP2Location Country Blocker Plugin <= 2.33.3 is vulnerable to Sensitive Data ExposureIP2Location Country Blocker
- CVE-2024-22301WordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Sensitive Data ExposureIgnazio Scimone Albo Pretorio On line
- CVE-2024-22308WordPress Simple Membership Plugin <= 4.4.1 is vulnerable to Open Redirectionsmp7, wp.insider Simple Membership
- CVE-2024-22134WordPress Contact Form 7 Extension For Mailchimp Plugin <= 0.5.70 is vulnerable to Server Side Request Forgery (SSRF)Renzo Johnson Contact Form 7 Extension For Mailchimp
- CVE-2024-0854URL redirection to untrusted site ('Open Redirect') vulnerability in file access component in Synology DiskStation Manager (DSM) before 6.2.Synology DiskStation Manager
- CVE-2024-0665WP Customer Area <= 8.2.2 - Reflected Cross-Site Scriptingaguilatechnologies WP Customer Area
- CVE-2024-22372OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to exeELECOM CO. WRC-X1500GS-B · ELECOM CO. WRC-X1500GSA-B +13
- CVE-2024-22366Active debug code exists in Yamaha wireless LAN access point devices.Yamaha WLX222 · Yamaha WLX413 +3
- CVE-2024-21796Electronic Deliverables Creation Support Tool (Construction Edition) prior to Ver1.0.4 and Electronic Deliverables Creation Support Tool (DeMinistry of Defense Electronic Deliverables Creation Suppor…
- CVE-2024-22380Electronic Delivery Check System (Ministry of Agriculture, Forestry and Fisheries The Agriculture and Rural Development Project Version) MarElectronic Delivery Check System (Ministry of Agriculture,…
- CVE-2024-21765Electronic Delivery Check System (Doboku) Ver.18.1.0 and earlier, Electronic Delivery Check System (Dentsu) Ver.12.1.0 and earlier, ElectronMinistry of Land, Infrastructure, Transport and Tourism, Ja…
- CVE-2022-4964Ubuntu's pipewire-pulse in snap grants microphone access even when the snap interface for audio-record is not set.Canonical Ubuntu pipewire-pulse
- CVE-2021-43584DOM-based Cross Site Scripting (XSS vulnerability in 'Tail Event Logs' functionality in Nagios Nagios Cross-Platform Agent (NCPA) before 2.4
- CVE-2023-43988An issue in nature fitness saijo mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channe
- CVE-2023-43989An issue in mokumoku chohu mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel acce
- CVE-2023-43990An issue in cherub-hair mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access
- CVE-2023-43991An issue in PRIMA CLINIC mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access
- CVE-2023-43992An issue in STOCKMAN GROUP mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel acce
- CVE-2023-43993An issue in smaregi_app_market mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel
- CVE-2023-43994An issue in Cleaning_makotoya mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel a
- CVE-2023-43995An issue in picot.golf mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access t
- CVE-2023-43996An issue in Q co ltd mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access tok
- CVE-2023-43997An issue in Yoruichi hobby base mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel
- CVE-2023-43998An issue in Books-futaba mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access
- CVE-2023-43999An issue in COLORFUL_laundry mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel ac
- CVE-2023-44000An issue in Otakara lapis totuka mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channe
- CVE-2023-44001An issue in Ailand clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel acces
- CVE-2024-22720Kanboard 1.2.34 is vulnerable to Html Injection in the group management feature.
- CVE-2024-22725Orthanc versions before 1.12.2 are affected by a reflected cross-site scripting (XSS) vulnerability.