CVEs published January 26, 2024
109 CVEs were published on January 26, 2024: 7 critical, 54 high.
- Published
- 109
- Critical
- 7
- High
- 54
- Medium
- 42
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Cups Easy
- 40
- Tenda AC10U
- 11
- Microsoft Edge
- 6
- GitLab
- 5
- 60IndexPage
- 2
- "Mercari" App for Android
- 1
- Biges Safe Life Technologies Electronics VGuard
- 1
- Byzoro Smart S210 Management Platform
- 1
- Cisco Small Business Smart and Managed Switches
- 1
- Cisco Unified Contact Center Enterprise · Cisco Unity Co… +4
- 1
Critical 7
- CVE-2024-20253A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attackCisco Unified Contact Center Enterprise · Cisco Unity Co… +4
- CVE-2024-0402Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabGitLab
- CVE-2024-21326Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2023-38317An issue was discovered in OpenNDS before 10.1.3.
- CVE-2023-38318An issue was discovered in OpenNDS before 10.1.3.
- CVE-2023-38319An issue was discovered in OpenNDS before 10.1.3.
- CVE-2023-38323An issue was discovered in OpenNDS before 10.1.3.
High 54
- CVE-2024-23506WordPress InstaWP Connect plugin <= 0.1.0.9 - Sensitive Data Exposure vulnerabilityInstaWP Connect
- CVE-2024-22147WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.7.5 is vulnerable to SQL InjectionWP Overnight PDF Invoices & Packing Slips for WooCommerce
- CVE-2024-22283WordPress Delhivery Logistics Courier Plugin <= 1.0.107 is vulnerable to SQL InjectionDelhivery Logistics Courier
- CVE-2024-094660IndexPage Parameter index.php server-side request forgery60IndexPage
- CVE-2024-094560IndexPage Parameter file.php server-side request forgery60IndexPage
- CVE-2024-21985Privilege Escalation Vulnerability in ONTAP 9 NetApp ONTAP
- CVE-2023-6291Keycloak: redirect_uri validation bypassRed Hat build of Keycloak · Red Hat Single Sign-On +10
- CVE-2024-23896Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23894Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23893Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23892Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23891Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23890Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23889Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23888Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23887Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23886Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23885Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23884Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23883Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23882Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23881Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23880Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23879Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23878Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23877Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23876Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23875Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23874Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23873Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23872Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23871Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23870Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23869Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23868Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23867Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23866Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23865Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23864Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23863Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23862Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23861Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23860Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23859Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23858Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23857Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-23856Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-0920TRENDnet TEW-822DRE POST Request admin_ping.htm command injectionTRENDnet TEW-822DRE
- CVE-2024-0919TRENDnet TEW-815DAP POST Request do_setNTP command injectionTRENDnet TEW-815DAP
- CVE-2024-0918TRENDnet TEW-800MB POST Request os command injectionTRENDnet TEW-800MB
- CVE-2023-6919Path Traversal in VGuard IP Camera Network RecorderBiges Safe Life Technologies Electronics VGuard
- CVE-2024-21385Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2022-48622In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani_loa
- CVE-2024-22545An issue was discovered in TRENDnet TEW-824DRU version 1.04b01, allows unauthenticated attackers to execute arbitrary code via the system.nt
Medium, low and unrated 48
- CVE-2023-52187WordPress Image Source Control Plugin <= 2.17.0 is vulnerable to Sensitive Data ExposureThomas Maier Image Source Control Lite – Show Image Credits…
- CVE-2024-0948NetBox Home Page Configuration config-revisions cross site scriptingNetBox
- CVE-2023-29081InstallShield Symlink Vulnerability Affecting Suite Project SetupsRevenera InstallShield
- CVE-2024-0944Totolink T8 cstecgi.cgi session expirationTotolink T8
- CVE-2024-0943Totolink N350RT cstecgi.cgi session expirationTotolink N350RT
- CVE-2024-0942Totolink N200RE V5 cstecgi.cgi session expirationTotolink N200RE
- CVE-2024-0941Novel-Plus list sql injectionNovel-Plus
- CVE-2024-0939Byzoro Smart S210 Management Platform uploadfile.php unrestricted uploadByzoro Smart S210 Management Platform
- CVE-2024-0938Tongda OA 2017 delete_webmail.php sql injectionTongda OA
- CVE-2024-21336Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-0937van_der_Schaar LAB synthcity PKL File load_from_file deserializationvan_der_Schaar LAB synthcity · synthcity
- CVE-2024-20263A vulnerability with the access control list (ACL) management within a stacked switch configuration of Cisco Business 250 Series Smart SwitcCisco Small Business Smart and Managed Switches
- CVE-2024-20305A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a cCisco Unity Connection
- CVE-2024-0936van_der_Schaar LAB TemporAI PKL File load_from_file deserializationvan_der_Schaar LAB TemporAI · temporai
- CVE-2024-0933Niushop B2B2C Upload.php unrestricted uploadNiushop B2B2C
- CVE-2024-23820OpenFGA DoSopenfga · github.com/openfga/openfga
- CVE-2024-0932Tenda AC10U setSmartPowerManagement stack-based overflowTenda AC10U
- CVE-2024-0931Tenda AC10U saveParentControlInfo stack-based overflowTenda AC10U
- CVE-2024-0930Tenda AC10U fromSetWirelessRepeat stack-based overflowTenda AC10U
- CVE-2024-0929Tenda AC10U fromNatStaticSetting stack-based overflowTenda AC10U
- CVE-2024-0928Tenda AC10U fromDhcpListClient stack-based overflowTenda AC10U
- CVE-2024-0927Tenda AC10U fromAddressNat stack-based overflowTenda AC10U
- CVE-2024-0926Tenda AC10U formWifiWpsOOB stack-based overflowTenda AC10U
- CVE-2024-0925Tenda AC10U formSetVirtualSer stack-based overflowTenda AC10U
- CVE-2024-0924Tenda AC10U formSetPPTPServer stack-based overflowTenda AC10U
- CVE-2024-0923Tenda AC10U formSetDeviceName stack-based overflowTenda AC10U
- CVE-2024-0922Tenda AC10U formQuickIndex stack-based overflowTenda AC10U
- CVE-2024-0921D-Link DIR-816 A2 Web Interface setDeviceSettings os command injectionD-Link DIR-816 A2
- CVE-2024-0727PKCS12 Decoding crashesOpenSSL · cryptography
- CVE-2024-23388Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker "Mercari" App for Android
- CVE-2023-5612Missing Authorization in GitLabGitLab
- CVE-2023-6159Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2023-5933Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLabGitLab
- CVE-2024-0456Direct Request ('Forced Browsing') in GitLabGitLab
- CVE-2024-21387Microsoft Edge for Android Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-21383Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-21382Microsoft Edge for Android Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2023-48126An issue in Luxe Beauty Clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel
- CVE-2023-48127An issue in myGAKUYA mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access tok
- CVE-2023-48128An issue in UNITED BOXING GYM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel a
- CVE-2023-48129An issue in kimono-oldnew mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel acces
- CVE-2023-48130An issue in GINZA CAFE mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access t
- CVE-2023-48131An issue in CHIGASAKI BAKERY mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel ac
- CVE-2023-48132An issue in kosei entertainment esportsstudioLegends mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via l
- CVE-2023-48133An issue in angel coffee mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access
- CVE-2023-48135An issue in mimasaka_farm mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel acces
- CVE-2024-22550An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code
- CVE-2024-22551WhatACart v2.0.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /site/default/search.