# CVEs published 2024-01-27

17 CVEs were published on January 27, 2024: 3 critical, 1 high. Days are UTC.

- [CVE-2024-0962](https://cve.now/CVE-2024-0962.md): obgm libcoap Configuration File coap\_oscore.c get\_split\_entry stack-based overflow (CVSS 6.3, obgm libcoap)
- [CVE-2024-0960](https://cve.now/CVE-2024-0960.md): flink-extended ai-flow workflow\_command.py cloudpickle.loads deserialization (CVSS 5.0, flink-extended ai-flow · ai-flow)
- [CVE-2024-0959](https://cve.now/CVE-2024-0959.md): StanfordVL GibsonEnv pposgd\_fuse.py cloudpickle.load deserialization (CVSS 5.0, StanfordVL GibsonEnv)
- [CVE-2024-0958](https://cve.now/CVE-2024-0958.md): CodeAstro Stock Management System Add Category index.php cross site scripting (CVSS 3.5, CodeAstro Stock Management System)
- [CVE-2024-0618](https://cve.now/CVE-2024-0618.md): Fluent Forms \<= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title (CVSS 4.4, techjewel Fluent Forms – Customizable Contact Forms, Survey…)
- [CVE-2024-0824](https://cve.now/CVE-2024-0824.md): Exclusive Addons for Elementor \<= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Anything (CVSS 6.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-0697](https://cve.now/CVE-2024-0697.md): Backuply – Backup, Restore, Migrate and Clone \<= 1.2.3 - Authenticated (Administrator+) Directory Traversal (CVSS 6.5, softaculous Backuply – Backup, Restore, Migrate and Clone)
- [CVE-2024-0667](https://cve.now/CVE-2024-0667.md): Form-Maker (twb\_form-maker) \<= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute (CVSS 5.4, Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact F…)
- [CVE-2023-6497](https://cve.now/CVE-2023-6497.md): WordPress Simple Shopping Cart \<= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting (CVSS 4.4, mra13 Simple Shopping Cart)
- [CVE-2024-0664](https://cve.now/CVE-2024-0664.md): Meks Smart Social Widget \<= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, mekshq Meks Smart Social Widget)
- [CVE-2023-6482](https://cve.now/CVE-2023-6482.md): Encryption key derived from static host information (CVSS 5.2, Synaptics Fingerprint Driver)
- [CVE-2023-48201](https://cve.now/CVE-2023-48201.md): Cross Site Scripting (XSS) vulnerability in Sunlight CMS v.8.0.1, allows remote authenticated attackers to execute arbitrary code and escala (CVSS 5.4)
- [CVE-2023-48202](https://cve.now/CVE-2023-48202.md): Cross-Site Scripting (XSS) vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a craf (CVSS 5.4)
- [CVE-2023-52389](https://cve.now/CVE-2023-52389.md): UTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer overflow because Poco::UTF32Encoding::conver (CVSS 9.8)
- [CVE-2024-22860](https://cve.now/CVE-2024-22860.md): Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the jpegxl\_anim\_read\_packet comp (CVSS 9.8)
- [CVE-2024-22861](https://cve.now/CVE-2024-22861.md): Integer overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of service (DoS) via the avcodec/osq module. (CVSS 7.5)
- [CVE-2024-22862](https://cve.now/CVE-2024-22862.md): Integer overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute arbitrary code via the JJPEG XL Parser. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.