CVEs published January 29, 2024
94 CVEs were published on January 29, 2024: 5 critical, 39 high.
- Published
- 94
- Critical
- 5
- High
- 39
- Medium
- 44
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- Totolink N200RE
- 8
- OpenText AppBuilder
- 5
- Red Hat Enterprise Linux
- 5
- SourceCodester Employee Management System
- 5
- Tenda i6
- 4
- OTRS AG OTRS
- 3
- Sichuan Yougou Technology KuERP
- 3
- 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- 2
- aio-libs aiohttp · aiohttp
- 2
- Rebuild
- 2
Critical 5
- CVE-2024-23827Nginx-UI arbitrary file write through the Import Certificate feature0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2024-1015Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3SE-elektronic E-DDC3.3
- CVE-2023-51839DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm.@devicefarmer/stf
- CVE-2023-51840DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.
- CVE-2024-24141Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter.
High 39
- CVE-2023-4551Command Injection via Task SchedulerOpenText AppBuilder
- CVE-2023-4550Unauthenticated Arbitrary File ReadOpenText AppBuilder
- CVE-2024-23940Trend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable toTrend Micro Security (Consumer) uiAirSupport
- CVE-2024-23828Nginx-UI authenticated RCE through injecting into the application config via CRLF0xJacky nginx-ui · github.com/0xJacky/Nginx-UI
- CVE-2024-1009SourceCodester Employee Management System login.php sql injectionSourceCodester Employee Management System
- CVE-2023-1705Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege EscalaForcepoint F|One SmartEdge Agent
- CVE-2024-1006Shanxi Diankeyun Technology NODERP Cookie common.php improper authenticationShanxi Diankeyun Technology NODERP
- CVE-2024-1004Totolink N200RE cstecgi.cgi loginAuth stack-based overflowTotolink N200RE
- CVE-2023-40548Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systemsRed Hat Enterprise Linux
- CVE-2023-6390WordPress Users <= 1.4 - Settings Update via CSRFWordPress Users
- CVE-2023-6391Custom User CSS <= 0.2 - Settings Update via CSRFCustom User CSS
- CVE-2023-6946Autotitle for WordPress <= 1.0.3 - Settings Update to Stored XSS via CSRFAutotitle for WordPress
- CVE-2023-7204WP STAGING WordPress Backup Plugin < 3.2.0 - Unauthorized Sensitive Data ExposureWP STAGING WordPress Backup Plugin
- CVE-2023-6279Woostify Sites Library < 1.4.8 - Subscriber+ Arbitrary Options Update to DoSWoostify Sites Library
- CVE-2023-7074WP Social Bookmark Menu <= 1.2 - Settings Update via CSRFWP SOCIAL BOOKMARK MENU
- CVE-2024-1003Totolink N200RE cstecgi.cgi setLanguageCfg stack-based overflowTotolink N200RE
- CVE-2024-1002Totolink N200RE cstecgi.cgi setIpPortFilterRules stack-based overflowTotolink N200RE
- CVE-2024-1001Totolink N200RE cstecgi.cgi main stack-based overflowTotolink N200RE
- CVE-2024-1000Totolink N200RE cstecgi.cgi setTracerouteCfg stack-based overflowTotolink N200RE
- CVE-2024-0999Totolink N200RE cstecgi.cgi setParentalRules stack-based overflowTotolink N200RE
- CVE-2024-0998Totolink N200RE cstecgi.cgi setDiagnosisCfg stack-based overflowTotolink N200RE
- CVE-2024-0997Totolink N200RE cstecgi.cgi setOpModeCfg stack-based overflowTotolink N200RE
- CVE-2023-29055Apache Kylin: Insufficiently protected credentials in config fileApache Software Foundation Apache Kylin · org.apache.kylin:…
- CVE-2023-5378Stored XSS in SmodBIP and MegaBIPJan Syski MegaBIP · Jan Syski SmodBIP
- CVE-2023-46838Linux: netback processing of zero-length transmit fragmentLinux
- CVE-2024-0212Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users)Cloudflare-WordPress
- CVE-2024-0996Tenda i9 httpd setcfm formSetCfm stack-based overflowTenda i9
- CVE-2024-0995Tenda W6 httpd wifiSSIDset formwrlSSIDset stack-based overflowTenda W6
- CVE-2024-0994Tenda W6 httpd setcfm formSetCfm stack-based overflowTenda W6
- CVE-2024-0993Tenda i6 httpd WifiMacFilterGet formWifiMacFilterGet stack-based overflowTenda i6
- CVE-2024-0992Tenda i6 httpd wifiSSIDset formwrlSSIDset stack-based overflowTenda i6
- CVE-2024-0991Tenda i6 httpd setcfm formSetCfm stack-based overflowTenda i6
- CVE-2024-0990Tenda i6 httpd setAutoPing formSetAutoPing stack-based overflowTenda i6
- CVE-2023-49038Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated attacker to inject arbitrary commands onto t
- CVE-2023-51842An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16.meshcentral
- CVE-2024-23747The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability.
- CVE-2024-24139Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter.
- CVE-2024-24140Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'
- CVE-2024-24736The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remote denial of service (reboot) via a long string to TCP port 110, a related issue
Medium, low and unrated 50
- CVE-2024-1022CodeAstro Simple Student Result Management System Add Class Page add_classes.php cross site scriptingCodeAstro Simple Student Result Management System
- CVE-2024-23334aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversalaio-libs aiohttp · aiohttp
- CVE-2024-23829aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separatorsaio-libs aiohttp · aiohttp
- CVE-2024-1021Rebuild HTTP Request readRawText server-side request forgeryRebuild
- CVE-2024-1020Rebuild proxy-download getStorageFile cross site scriptingRebuild
- CVE-2023-4554XML External Entity (XXE) ProcessingOpenText AppBuilder
- CVE-2023-4553Unauthenticated Access to AppBuilder Configuration FilesOpenText AppBuilder
- CVE-2023-4552Java Database Connectivity (JDBC) URL ManipulationOpenText AppBuilder
- CVE-2024-1018PbootCMS cross site scriptingPbootCMS
- CVE-2023-22836In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the default value, the renamed value may be visible to the rest of the stack’s tenants.com.palantir.skywise:guardian
- CVE-2024-1017Gabriels FTP Server denial of serviceGabriels FTP Server
- CVE-2023-30970Gotham table and Forward App Path traversalcom.palantir.gotham:blackbird-witchcraft
- CVE-2024-1016Solar FTP Server PASV Command denial of serviceSolar FTP Server
- CVE-2024-1011SourceCodester Employee Management System Leave delete-leave.php access controlSourceCodester Employee Management System
- CVE-2023-40551Shim: out of bounds read when parsing mz binariesRed Hat Enterprise Linux
- CVE-2024-1010SourceCodester Employee Management System edit-profile.php cross site scriptingSourceCodester Employee Management System
- CVE-2023-40546Shim: out-of-bounds read printing error messagesRed Hat Enterprise Linux
- CVE-2023-40549Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe fileRed Hat Enterprise Linux
- CVE-2023-40550Shim: out-of-bound read in verify_buffer_sbat()Red Hat Enterprise Linux
- CVE-2024-0788SUPERAntiSpyware Pro X v10.0.1260 - Kernel-level API parameters manipulationSUPERAntiSpyware Pro X
- CVE-2024-23441Vba32 Antivirus v3.36.0 - Denial of Service (DoS)VirusBlokAda Vba32 Antivirus
- CVE-2024-1008SourceCodester Employee Management System Profile Page edit-photo.php unrestricted uploadSourceCodester Employee Management System
- CVE-2024-1007SourceCodester Employee Management System edit_profile.php sql injectionSourceCodester Employee Management System
- CVE-2024-23826Uploading an image with a specific filename causes a server-side DoS spbu-se spbu_se_site
- CVE-2024-23822Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22)sni Thruk
- CVE-2024-1005Shanxi Diankeyun Technology NODERP log file accessShanxi Diankeyun Technology NODERP
- CVE-2023-6165Restrict Usernames Emails Characters Plugin < 3.1.4 - Admin+ Stored XSSRestrict Usernames Emails Characters
- CVE-2023-7200EventON < 4.4.1 - Reflected Cross-Site ScriptingEventON
- CVE-2023-6503WP Plugin Lister <= 2.1.0 - Settings Update to Stored XSS via CSRFWP Plugin Lister
- CVE-2023-5943Wp-Adv-Quiz < 1.0.3 - Admin+ Stored XSSWp-Adv-Quiz
- CVE-2023-7089Easy SVG Allow <= 1.0 - Author+ Stored XSS via SVGEasy SVG Allow
- CVE-2023-5124PageLayer < 1.8.0 - Author+ Stored XSSPage Builder: Pagelayer
- CVE-2023-6530TJ Shortcodes <= 0.1.3 - Contributor+ Stored XSS via ShortcodesTJ Shortcodes
- CVE-2023-5956Wp-Adv-Quiz <= 1.0.2 - Admin+ Stored XSS in Quiz OverviewWp-Adv-Quiz
- CVE-2023-7199Relevanssi (Free < 4.22.0, Premium < 2.25.0) - Unauthenticated Private/Draft Post DisclosureRelevanssi
- CVE-2023-6633Site Notes <= 2.0.0 - Admin Note Deletion via CSRFSite Notes
- CVE-2023-6389WordPress Toolbar <= 2.2.6 - Open RedirectWordPress Toolbar
- CVE-2023-6278Biteship for WooCommerce < 2.2.25 - Reflected Cross-Site ScriptingBiteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo
- CVE-2024-1014Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3SE-elektronic E-DDC3.3
- CVE-2024-23790Missing file type check in avatar picture uploadOTRS AG OTRS
- CVE-2024-23791Unnecessary data is written to log if issues during indexing occursOTRS AG OTRS
- CVE-2024-23792Insufficient access controlOTRS AG OTRS
- CVE-2024-0989Sichuan Yougou Technology KuERP Service.php del_sn_db path traversalSichuan Yougou Technology KuERP
- CVE-2024-0988Sichuan Yougou Technology KuERP common.php checklogin improper authenticationSichuan Yougou Technology KuERP
- CVE-2024-0987Sichuan Yougou Technology KuERP log neutralization for logsSichuan Yougou Technology KuERP
- CVE-2024-22559LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field.
- CVE-2024-22570A stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute arb
- CVE-2024-24134Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update M
- CVE-2024-24135Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XS
- CVE-2024-24136The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting (X