# CVEs published 2024-01-26

109 CVEs were published on January 26, 2024: 7 critical, 54 high. Days are UTC.

- [CVE-2024-23506](https://cve.now/CVE-2024-23506.md): WordPress InstaWP Connect plugin \<= 0.1.0.9 - Sensitive Data Exposure vulnerability (CVSS 7.7, InstaWP Connect)
- [CVE-2024-22147](https://cve.now/CVE-2024-22147.md): WordPress WooCommerce PDF Invoices & Packing Slips Plugin \<= 3.7.5 is vulnerable to SQL Injection (CVSS 7.6, WP Overnight PDF Invoices & Packing Slips for WooCommerce)
- [CVE-2024-22283](https://cve.now/CVE-2024-22283.md): WordPress Delhivery Logistics Courier Plugin \<= 1.0.107 is vulnerable to SQL Injection (CVSS 8.5, Delhivery Logistics Courier)
- [CVE-2023-52187](https://cve.now/CVE-2023-52187.md): WordPress Image Source Control Plugin \<= 2.17.0 is vulnerable to Sensitive Data Exposure (CVSS 5.3, Thomas Maier Image Source Control Lite – Show Image Credits…)
- [CVE-2024-0948](https://cve.now/CVE-2024-0948.md): NetBox Home Page Configuration config-revisions cross site scripting (CVSS 2.4, NetBox)
- [CVE-2024-0946](https://cve.now/CVE-2024-0946.md): 60IndexPage Parameter index.php server-side request forgery (CVSS 7.3, 60IndexPage)
- [CVE-2024-0945](https://cve.now/CVE-2024-0945.md): 60IndexPage Parameter file.php server-side request forgery (CVSS 7.3, 60IndexPage)
- [CVE-2023-29081](https://cve.now/CVE-2023-29081.md): InstallShield Symlink Vulnerability Affecting Suite Project Setups (CVSS 5.5, Revenera InstallShield)
- [CVE-2024-0944](https://cve.now/CVE-2024-0944.md): Totolink T8 cstecgi.cgi session expiration (CVSS 3.7, Totolink T8)
- [CVE-2024-0943](https://cve.now/CVE-2024-0943.md): Totolink N350RT cstecgi.cgi session expiration (CVSS 3.7, Totolink N350RT)
- [CVE-2024-0942](https://cve.now/CVE-2024-0942.md): Totolink N200RE V5 cstecgi.cgi session expiration (CVSS 3.7, Totolink N200RE)
- [CVE-2024-0941](https://cve.now/CVE-2024-0941.md): Novel-Plus list sql injection (CVSS 5.5, Novel-Plus)
- [CVE-2024-0939](https://cve.now/CVE-2024-0939.md): Byzoro Smart S210 Management Platform uploadfile.php unrestricted upload (CVSS 6.3, Byzoro Smart S210 Management Platform)
- [CVE-2024-0938](https://cve.now/CVE-2024-0938.md): Tongda OA 2017 delete\_webmail.php sql injection (CVSS 5.5, Tongda OA)
- [CVE-2024-21336](https://cve.now/CVE-2024-21336.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 2.5, Microsoft Edge)
- [CVE-2024-0937](https://cve.now/CVE-2024-0937.md): van\_der\_Schaar LAB synthcity PKL File load\_from\_file deserialization (CVSS 6.3, van\_der\_Schaar LAB synthcity · synthcity)
- [CVE-2024-20253](https://cve.now/CVE-2024-20253.md): A vulnerability in multiple Cisco Unified Communications and Contact Center Solutions products could allow an unauthenticated, remote attack (CVSS 9.9, Cisco Unified Contact Center Enterprise · Cisco Unity Co… +4)
- [CVE-2024-20263](https://cve.now/CVE-2024-20263.md): A vulnerability with the access control list (ACL) management within a stacked switch configuration of Cisco Business 250 Series Smart Switc (CVSS 5.8, Cisco Small Business Smart and Managed Switches)
- [CVE-2024-20305](https://cve.now/CVE-2024-20305.md): A vulnerability in the web-based management interface of Cisco Unity Connection could allow an authenticated, remote attacker to conduct a c (CVSS 4.8, Cisco Unity Connection)
- [CVE-2024-0936](https://cve.now/CVE-2024-0936.md): van\_der\_Schaar LAB TemporAI PKL File load\_from\_file deserialization (CVSS 6.3, van\_der\_Schaar LAB TemporAI · temporai)
- [CVE-2024-0933](https://cve.now/CVE-2024-0933.md): Niushop B2B2C Upload.php unrestricted upload (CVSS 6.3, Niushop B2B2C)
- [CVE-2024-23820](https://cve.now/CVE-2024-23820.md): OpenFGA DoS (CVSS 5.3, openfga · github.com/openfga/openfga)
- [CVE-2024-0932](https://cve.now/CVE-2024-0932.md): Tenda AC10U setSmartPowerManagement stack-based overflow (CVSS 4.7, Tenda AC10U)
- [CVE-2024-0931](https://cve.now/CVE-2024-0931.md): Tenda AC10U saveParentControlInfo stack-based overflow (CVSS 4.7, Tenda AC10U)
- [CVE-2024-21985](https://cve.now/CVE-2024-21985.md): Privilege Escalation Vulnerability in ONTAP 9 (CVSS 7.6, NetApp ONTAP)
- [CVE-2024-0930](https://cve.now/CVE-2024-0930.md): Tenda AC10U fromSetWirelessRepeat stack-based overflow (CVSS 4.7, Tenda AC10U)
- [CVE-2024-0929](https://cve.now/CVE-2024-0929.md): Tenda AC10U fromNatStaticSetting stack-based overflow (CVSS 4.7, Tenda AC10U)
- [CVE-2024-0928](https://cve.now/CVE-2024-0928.md): Tenda AC10U fromDhcpListClient stack-based overflow (CVSS 4.7, Tenda AC10U)
- [CVE-2024-0927](https://cve.now/CVE-2024-0927.md): Tenda AC10U fromAddressNat stack-based overflow (CVSS 4.7, Tenda AC10U)
- [CVE-2024-0926](https://cve.now/CVE-2024-0926.md): Tenda AC10U formWifiWpsOOB stack-based overflow (CVSS 4.7, Tenda AC10U)
- [CVE-2024-0925](https://cve.now/CVE-2024-0925.md): Tenda AC10U formSetVirtualSer stack-based overflow (CVSS 4.7, Tenda AC10U)
- [CVE-2024-0924](https://cve.now/CVE-2024-0924.md): Tenda AC10U formSetPPTPServer stack-based overflow (CVSS 4.7, Tenda AC10U)
- [CVE-2023-6291](https://cve.now/CVE-2023-6291.md): Keycloak: redirect\_uri validation bypass (CVSS 7.1, Red Hat build of Keycloak · Red Hat Single Sign-On +10)
- [CVE-2024-0923](https://cve.now/CVE-2024-0923.md): Tenda AC10U formSetDeviceName stack-based overflow (CVSS 4.7, Tenda AC10U)
- [CVE-2024-0922](https://cve.now/CVE-2024-0922.md): Tenda AC10U formQuickIndex stack-based overflow (CVSS 4.7, Tenda AC10U)
- [CVE-2024-0921](https://cve.now/CVE-2024-0921.md): D-Link DIR-816 A2 Web Interface setDeviceSettings os command injection (CVSS 4.7, D-Link DIR-816 A2)
- [CVE-2024-23896](https://cve.now/CVE-2024-23896.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23894](https://cve.now/CVE-2024-23894.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23893](https://cve.now/CVE-2024-23893.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23892](https://cve.now/CVE-2024-23892.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23891](https://cve.now/CVE-2024-23891.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23890](https://cve.now/CVE-2024-23890.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23889](https://cve.now/CVE-2024-23889.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23888](https://cve.now/CVE-2024-23888.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23887](https://cve.now/CVE-2024-23887.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23886](https://cve.now/CVE-2024-23886.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23885](https://cve.now/CVE-2024-23885.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23884](https://cve.now/CVE-2024-23884.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23883](https://cve.now/CVE-2024-23883.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23882](https://cve.now/CVE-2024-23882.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23881](https://cve.now/CVE-2024-23881.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23880](https://cve.now/CVE-2024-23880.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23879](https://cve.now/CVE-2024-23879.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23878](https://cve.now/CVE-2024-23878.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23877](https://cve.now/CVE-2024-23877.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23876](https://cve.now/CVE-2024-23876.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23875](https://cve.now/CVE-2024-23875.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23874](https://cve.now/CVE-2024-23874.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23873](https://cve.now/CVE-2024-23873.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23872](https://cve.now/CVE-2024-23872.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23871](https://cve.now/CVE-2024-23871.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23870](https://cve.now/CVE-2024-23870.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23869](https://cve.now/CVE-2024-23869.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23868](https://cve.now/CVE-2024-23868.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23867](https://cve.now/CVE-2024-23867.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23866](https://cve.now/CVE-2024-23866.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23865](https://cve.now/CVE-2024-23865.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23864](https://cve.now/CVE-2024-23864.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23863](https://cve.now/CVE-2024-23863.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23862](https://cve.now/CVE-2024-23862.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23861](https://cve.now/CVE-2024-23861.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23860](https://cve.now/CVE-2024-23860.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23859](https://cve.now/CVE-2024-23859.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23858](https://cve.now/CVE-2024-23858.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23857](https://cve.now/CVE-2024-23857.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-23856](https://cve.now/CVE-2024-23856.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-0727](https://cve.now/CVE-2024-0727.md): PKCS12 Decoding crashes (CVSS 5.5, OpenSSL · cryptography)
- [CVE-2024-0920](https://cve.now/CVE-2024-0920.md): TRENDnet TEW-822DRE POST Request admin\_ping.htm command injection (CVSS 7.2, TRENDnet TEW-822DRE)
- [CVE-2024-0919](https://cve.now/CVE-2024-0919.md): TRENDnet TEW-815DAP POST Request do\_setNTP command injection (CVSS 8.8, TRENDnet TEW-815DAP)
- [CVE-2024-0918](https://cve.now/CVE-2024-0918.md): TRENDnet TEW-800MB POST Request os command injection (CVSS 7.2, TRENDnet TEW-800MB)
- [CVE-2023-6919](https://cve.now/CVE-2023-6919.md): Path Traversal in VGuard IP Camera Network Recorder (CVSS 7.5, Biges Safe Life Technologies Electronics VGuard)
- [CVE-2024-23388](https://cve.now/CVE-2024-23388.md): Improper authorization in handler for custom URL scheme issue in "Mercari" App for Android prior to version 5.78.0 allows a remote attacker (CVSS 6.1, "Mercari" App for Android)
- [CVE-2023-5612](https://cve.now/CVE-2023-5612.md): Missing Authorization in GitLab (CVSS 5.3, GitLab)
- [CVE-2023-6159](https://cve.now/CVE-2023-6159.md): Inefficient Regular Expression Complexity in GitLab (CVSS 6.5, GitLab)
- [CVE-2023-5933](https://cve.now/CVE-2023-5933.md): Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in GitLab (CVSS 6.4, GitLab)
- [CVE-2024-0456](https://cve.now/CVE-2024-0456.md): Direct Request ('Forced Browsing') in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-0402](https://cve.now/CVE-2024-0402.md): Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab (CVSS 9.9, GitLab)
- [CVE-2024-21387](https://cve.now/CVE-2024-21387.md): Microsoft Edge for Android Spoofing Vulnerability (CVSS 5.3, Microsoft Edge)
- [CVE-2024-21385](https://cve.now/CVE-2024-21385.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2024-21383](https://cve.now/CVE-2024-21383.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 3.3, Microsoft Edge)
- [CVE-2024-21382](https://cve.now/CVE-2024-21382.md): Microsoft Edge for Android Information Disclosure Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2024-21326](https://cve.now/CVE-2024-21326.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 9.6, Microsoft Edge)
- [CVE-2022-48622](https://cve.now/CVE-2022-48622.md): In GNOME GdkPixbuf (aka gdk-pixbuf) through 2.42.10, the ANI (Windows animated cursor) decoder encounters heap memory corruption (in ani\_loa (CVSS 7.8)
- [CVE-2023-38317](https://cve.now/CVE-2023-38317.md): An issue was discovered in OpenNDS before 10.1.3. (CVSS 9.8)
- [CVE-2023-38318](https://cve.now/CVE-2023-38318.md): An issue was discovered in OpenNDS before 10.1.3. (CVSS 9.8)
- [CVE-2023-38319](https://cve.now/CVE-2023-38319.md): An issue was discovered in OpenNDS before 10.1.3. (CVSS 9.8)
- [CVE-2023-38323](https://cve.now/CVE-2023-38323.md): An issue was discovered in OpenNDS before 10.1.3. (CVSS 9.8)
- [CVE-2023-48126](https://cve.now/CVE-2023-48126.md): An issue in Luxe Beauty Clinic mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel (CVSS 5.4)
- [CVE-2023-48127](https://cve.now/CVE-2023-48127.md): An issue in myGAKUYA mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access tok (CVSS 5.4)
- [CVE-2023-48128](https://cve.now/CVE-2023-48128.md): An issue in UNITED BOXING GYM mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel a (CVSS 5.4)
- [CVE-2023-48129](https://cve.now/CVE-2023-48129.md): An issue in kimono-oldnew mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel acces (CVSS 5.4)
- [CVE-2023-48130](https://cve.now/CVE-2023-48130.md): An issue in GINZA CAFE mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access t (CVSS 5.4)
- [CVE-2023-48131](https://cve.now/CVE-2023-48131.md): An issue in CHIGASAKI BAKERY mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel ac (CVSS 5.4)
- [CVE-2023-48132](https://cve.now/CVE-2023-48132.md): An issue in kosei entertainment esportsstudioLegends mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via l (CVSS 5.4)
- [CVE-2023-48133](https://cve.now/CVE-2023-48133.md): An issue in angel coffee mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel access (CVSS 5.4)
- [CVE-2023-48135](https://cve.now/CVE-2023-48135.md): An issue in mimasaka\_farm mini-app on Line v13.6.1 allows attackers to send crafted malicious notifications via leakage of the channel acces (CVSS 5.4)
- [CVE-2024-22545](https://cve.now/CVE-2024-22545.md): An issue was discovered in TRENDnet TEW-824DRU version 1.04b01, allows unauthenticated attackers to execute arbitrary code via the system.nt (CVSS 7.8)
- [CVE-2024-22550](https://cve.now/CVE-2024-22550.md): An arbitrary file upload vulnerability in the component /alsdemo/ss/mediam.cgi of ShopSite v14.0 allows attackers to execute arbitrary code (CVSS 6.1)
- [CVE-2024-22551](https://cve.now/CVE-2024-22551.md): WhatACart v2.0.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /site/default/search. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.