CVEs published January 25, 2024
73 CVEs were published on January 25, 2024: 22 critical, 20 high.
- Published
- 73
- Critical
- 22
- High
- 20
- Medium
- 28
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Motorola MR2600
- 5
- IBM Merge Healthcare eFilm Workstation
- 4
- D-Link DAP-1650
- 2
- hongmaple octopus
- 2
- Juniper Networks Junos OS
- 2
- Linux kernel
- 2
- SourceCodester Online Tours & Travels Management System
- 2
- Symantec Messaging Gateway
- 2
- Arris SURFboard SBG6950AC2
- 1
- BORGChat
- 1
Critical 22
- CVE-2024-23630Motorola MR2600 Arbitrary Firmware Upload VulnerabilityMotorola MR2600
- CVE-2024-23629Motorola MR2600 Authentication Bypass VulnerabilityMotorola MR2600
- CVE-2024-23628Motorola MR2600 SaveStaticRouteIPv6Params Command Injection VulnerabilityMotorola MR2600
- CVE-2024-23627Motorola MR2600 SaveStaticRouteIPv4Params Command Injection VulnerabilityMotorola MR2600
- CVE-2024-23626Motorola MR2600 SaveSysLogParams Command Injection VulnerabilityMotorola MR2600
- CVE-2024-23625D-Link DAP-1650 SUBSCRIBE Callback Command Injection VulnerabilityD-Link DAP-1650
- CVE-2024-23624D-Link DAP-1650 gena.cgi SUBSCRIBE Command Injection VulnerabilityD-Link DAP-1650
- CVE-2024-23622IBM Merge Healthcare eFilm Workstation License Server CopySLS_Request3 Buffer OverflowIBM Merge Healthcare eFilm Workstation
- CVE-2024-23621IBM Merge Healthcare eFilm Workstation License Server Buffer OverflowIBM Merge Healthcare eFilm Workstation
- CVE-2024-23619IBM Merge Healthcare eFilm Workstation Hardcoded CredentialsIBM Merge Healthcare eFilm Workstation
- CVE-2024-23618Arris SURFboard SBG6950AC2 Arbitrary Code Execution VulnerabilityArris SURFboard SBG6950AC2
- CVE-2024-23617Symantec Data Loss Prevention Buffer OverflowSymantec Data Loss Prevention
- CVE-2024-23616Symantec Server Management Suite Buffer OverflowSymantec Server Management Suite
- CVE-2024-23615Symantec Messaging Gateway Buffer OverflowSymantec Messaging Gateway
- CVE-2024-23614Symantec Messaging Gateway Buffer OverflowSymantec Messaging Gateway
- CVE-2024-23613Symantec Deployment Solution Remote Code ExecutionSymantec Deployment Solution
- CVE-2023-7227Command Injection vulnerability in SystemK NVR 504/508/516SystemK NVR
- CVE-2023-33759SpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts, allowing attackers to bypass authenticatio
- CVE-2024-22529TOTOLINK X2000R_V2 V2.0.0-B20230727.10434 has a command injection vulnerability in the sub_449040 (handle function of formUploadFile) of /bi
- CVE-2024-22638liveSite v2019.1 was discovered to contain a remote code execution (RCE) vulenrabiity via the component /livesite/edit_designer_region.php o
- CVE-2024-22729NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.
- CVE-2024-22922An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the l
High 20
- CVE-2024-23620IBM Merge Healthcare eFilm Workstation SYSTEM Privilege EscalationIBM Merge Healthcare eFilm Workstation
- CVE-2024-21620Junos OS: SRX Series and EX Series: J-Web doesn't sufficiently sanitize input to prevent XSSJuniper Networks Junos OS
- CVE-2023-52356Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of servicelibtiff · Red Hat Enterprise Linux +2
- CVE-2023-52355Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oomlibtiff · Red Hat Enterprise Linux +3
- CVE-2024-23656Dex 2.37.0 is discarding TLSconfig and always serves deprecated TLS 1.0/1.1 and insecure ciphersdexidp dex · github.com/dexidp/dex
- CVE-2024-23817Dolibarr Application Home Page HTML injection vulnerabilitydolibarr · dolibarr/dolibarr
- CVE-2024-23655Attacker can prevent users from accessing received emailstutao tutanota
- CVE-2023-6267Quarkus: json payload getting processed prior to security checks when rest resources are used with annotations.Red Hat build of Quarkus 2.13.9.Final · Red Hat build of… +5
- CVE-2023-40547Shim: rce in http boot support may lead to secure boot bypassRed Hat Enterprise Linux
- CVE-2023-52076Remote Code Execution Vulnerability in Atril's EPUB ebook parsingmate-desktop atril
- CVE-2023-3181Insecure Permissions in Splashtop Software UpdaterSplashtop Software Updater
- CVE-2024-0822Ovirt: authentication bypassovirt-engine · Red Hat Virtualization Engine
- CVE-2024-22432 Networker 19.9 and all prior versions contains a Plain-text Password stored in temporary config file during backup duration in NMDA MySQL DDell NetWorker Module for Databases and Applications - Orac…
- CVE-2024-23855Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2023-51833A command injection issue in TRENDnet TEW-411BRPplus v.2.07_eu that allows a local attacker to execute arbitrary code via the data1 paramete
- CVE-2023-52251An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/
- CVE-2024-22636PluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the Static Pages feature.
- CVE-2024-22749GPAC v2.3 was detected to contain a buffer overflow via the function gf_isom_new_generic_sample_description function in the isomedia/isom_wr
- CVE-2024-23985EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command.
- CVE-2024-24399An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code
Medium, low and unrated 31
- CVE-2024-0891hongmaple octopus cross site scriptinghongmaple octopus
- CVE-2024-21619Junos OS: SRX Series and EX Series: J-Web - unauthenticated access to temporary files containing sensitive informationJuniper Networks Junos OS
- CVE-2024-0890hongmaple octopus edit sql injectionhongmaple octopus
- CVE-2024-0889Kmint21 Golden FTP Server PASV Command denial of serviceKmint21 Golden FTP Server
- CVE-2024-0888BORGChat Service Port 7551 denial of serviceBORGChat
- CVE-2024-0887Mafiatic Blue Server Connection denial of serviceMafiatic Blue Server
- CVE-2024-0886Poikosoft EZ CD Audio Converter Activation denial of servicePoikosoft EZ CD Audio Converter
- CVE-2024-0885SpyCamLizard HTTP GET Request denial of serviceSpyCamLizard
- CVE-2024-0884SourceCodester Online Tours & Travels Management System payment.php exec sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2024-21630Zulip non-admins can invite new users to streams they would not otherwise be able to add existing users tozulip
- CVE-2024-0883SourceCodester Online Tours & Travels Management System pay.php prepare sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2024-0882qwdigital LinkWechat Universal Download Interface resource path traversalqwdigital LinkWechat
- CVE-2024-0880Qidianbang qdbcrm Password Reset cross-site request forgeryQidianbang qdbcrm
- CVE-2024-0879Authentication bypass in vector-admin domain restrictionMintplex-Labs vector-admin
- CVE-2023-6282Cross-Site Scripting vulnerability in IceHrmIceHrm
- CVE-2024-22099NULL pointer deference in rfcomm_check_security in Linux kernelLinux kernel
- CVE-2024-23307Integer overflow in raid5_cache_count in Linux kernelLinux kernel
- CVE-2024-0625WPFront Notification Bar <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via wpfront-notification-bar-options[custom_class]syammohanm WPFront Notification Bar
- CVE-2024-0688WebSub (FKA. PubSubHubbub) <= 3.1.4 - Authenticated (Admin+) Stored Cross-Site Scriptingjoshfraz WebSub
- CVE-2024-0624Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Updatestrangerstudios Paid Memberships Pro – Content Restriction,…
- CVE-2024-0617Category Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount()vidishp Simple Discount Rules for Woocommerce
- CVE-2023-33757A lack of SSL certificate validation in Splicecom iPCS (iOS App) v1.3.4, iPCS2 (iOS App) v2.8 and before, and iPCS (Android App) v1.8.5 and
- CVE-2023-33758Splicecom Maximiser Soft PBX v1.5 and before was discovered to contain a cross-site scripting (XSS) vulnerability via the CLIENT_NAME and DE
- CVE-2023-33760SpliceCom Maximiser Soft PBX v1.5 and before was discovered to utilize a default SSL certificate.
- CVE-2023-41474Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via t
- CVE-2023-50785Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal.
- CVE-2023-52046Cross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker to execute arbitrary code via a crafted payl
- CVE-2024-22635WebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /WebCalendarvqsmnseug2/e
- CVE-2024-22637Form Tools v3.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /form_builder/preview.php
- CVE-2024-22639iGalerie v3.0.22 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Titre (Title) field in the editing i
- CVE-2024-23055An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input