# CVEs published 2024-01-29

94 CVEs were published on January 29, 2024: 5 critical, 39 high. Days are UTC.

- [CVE-2024-1022](https://cve.now/CVE-2024-1022.md): CodeAstro Simple Student Result Management System Add Class Page add\_classes.php cross site scripting (CVSS 2.4, CodeAstro Simple Student Result Management System)
- [CVE-2024-23334](https://cve.now/CVE-2024-23334.md): aiohttp.web.static(follow\_symlinks=True) is vulnerable to directory traversal (CVSS 5.9, aio-libs aiohttp · aiohttp)
- [CVE-2024-23829](https://cve.now/CVE-2024-23829.md): aiohttp's HTTP parser (the python one, not llhttp) still overly lenient about separators (CVSS 6.5, aio-libs aiohttp · aiohttp)
- [CVE-2024-1021](https://cve.now/CVE-2024-1021.md): Rebuild HTTP Request readRawText server-side request forgery (CVSS 6.3, Rebuild)
- [CVE-2024-1020](https://cve.now/CVE-2024-1020.md): Rebuild proxy-download getStorageFile cross site scripting (CVSS 3.5, Rebuild)
- [CVE-2023-4554](https://cve.now/CVE-2023-4554.md): XML External Entity (XXE) Processing (CVSS 4.9, OpenText AppBuilder)
- [CVE-2023-4553](https://cve.now/CVE-2023-4553.md): Unauthenticated Access to AppBuilder Configuration Files (CVSS 5.3, OpenText AppBuilder)
- [CVE-2023-4552](https://cve.now/CVE-2023-4552.md): Java Database Connectivity (JDBC) URL Manipulation (CVSS 5.5, OpenText AppBuilder)
- [CVE-2023-4551](https://cve.now/CVE-2023-4551.md): Command Injection via Task Scheduler (CVSS 7.2, OpenText AppBuilder)
- [CVE-2023-4550](https://cve.now/CVE-2023-4550.md): Unauthenticated Arbitrary File Read (CVSS 7.5, OpenText AppBuilder)
- [CVE-2024-1018](https://cve.now/CVE-2024-1018.md): PbootCMS cross site scripting (CVSS 2.4, PbootCMS)
- [CVE-2023-22836](https://cve.now/CVE-2023-22836.md): In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes the linter name from the default value, the renamed value may be visible to the rest of the stack’s tenants. (CVSS 3.5, com.palantir.skywise:guardian)
- [CVE-2024-1017](https://cve.now/CVE-2024-1017.md): Gabriels FTP Server denial of service (CVSS 5.3, Gabriels FTP Server)
- [CVE-2023-30970](https://cve.now/CVE-2023-30970.md): Gotham table and Forward App Path traversal (CVSS 6.5, com.palantir.gotham:blackbird-witchcraft)
- [CVE-2024-23940](https://cve.now/CVE-2024-23940.md): Trend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable to (CVSS 7.8, Trend Micro Security (Consumer) uiAirSupport)
- [CVE-2024-1016](https://cve.now/CVE-2024-1016.md): Solar FTP Server PASV Command denial of service (CVSS 5.3, Solar FTP Server)
- [CVE-2024-1011](https://cve.now/CVE-2024-1011.md): SourceCodester Employee Management System Leave delete-leave.php access control (CVSS 4.3, SourceCodester Employee Management System)
- [CVE-2024-23828](https://cve.now/CVE-2024-23828.md): Nginx-UI authenticated RCE through injecting into the application config via CRLF (CVSS 8.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2023-40551](https://cve.now/CVE-2023-40551.md): Shim: out of bounds read when parsing mz binaries (CVSS 5.1, Red Hat Enterprise Linux)
- [CVE-2024-1010](https://cve.now/CVE-2024-1010.md): SourceCodester Employee Management System edit-profile.php cross site scripting (CVSS 3.5, SourceCodester Employee Management System)
- [CVE-2024-1009](https://cve.now/CVE-2024-1009.md): SourceCodester Employee Management System login.php sql injection (CVSS 7.3, SourceCodester Employee Management System)
- [CVE-2023-40546](https://cve.now/CVE-2023-40546.md): Shim: out-of-bounds read printing error messages (CVSS 6.2, Red Hat Enterprise Linux)
- [CVE-2023-40549](https://cve.now/CVE-2023-40549.md): Shim: out-of-bounds read in verify\_buffer\_authenticode() malformed pe file (CVSS 6.2, Red Hat Enterprise Linux)
- [CVE-2023-40550](https://cve.now/CVE-2023-40550.md): Shim: out-of-bound read in verify\_buffer\_sbat() (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2023-1705](https://cve.now/CVE-2023-1705.md): Missing Authorization vulnerability in Forcepoint F|One SmartEdge Agent on Windows (bgAutoinstaller service modules) allows Privilege Escala (CVSS 8.4, Forcepoint F|One SmartEdge Agent)
- [CVE-2024-0788](https://cve.now/CVE-2024-0788.md): SUPERAntiSpyware Pro X v10.0.1260 - Kernel-level API parameters manipulation (CVSS 6.6, SUPERAntiSpyware Pro X)
- [CVE-2024-23827](https://cve.now/CVE-2024-23827.md): Nginx-UI arbitrary file write through the Import Certificate feature (CVSS 9.8, 0xJacky nginx-ui · github.com/0xJacky/Nginx-UI)
- [CVE-2024-23441](https://cve.now/CVE-2024-23441.md): Vba32 Antivirus v3.36.0 - Denial of Service (DoS) (CVSS 5.5, VirusBlokAda Vba32 Antivirus)
- [CVE-2024-1008](https://cve.now/CVE-2024-1008.md): SourceCodester Employee Management System Profile Page edit-photo.php unrestricted upload (CVSS 4.7, SourceCodester Employee Management System)
- [CVE-2024-1007](https://cve.now/CVE-2024-1007.md): SourceCodester Employee Management System edit\_profile.php sql injection (CVSS 6.3, SourceCodester Employee Management System)
- [CVE-2024-23826](https://cve.now/CVE-2024-23826.md): Uploading an image with a specific filename causes a server-side DoS (CVSS 6.8, spbu-se spbu\_se\_site)
- [CVE-2024-23822](https://cve.now/CVE-2024-23822.md): Thruk Incorrect limitation of a pathname to a restricted directory (Path Traversal) (CWE-22) (CVSS 5.4, sni Thruk)
- [CVE-2024-1006](https://cve.now/CVE-2024-1006.md): Shanxi Diankeyun Technology NODERP Cookie common.php improper authentication (CVSS 7.3, Shanxi Diankeyun Technology NODERP)
- [CVE-2024-1005](https://cve.now/CVE-2024-1005.md): Shanxi Diankeyun Technology NODERP log file access (CVSS 5.3, Shanxi Diankeyun Technology NODERP)
- [CVE-2024-1004](https://cve.now/CVE-2024-1004.md): Totolink N200RE cstecgi.cgi loginAuth stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2023-40548](https://cve.now/CVE-2023-40548.md): Shim: interger overflow leads to heap buffer overflow in verify\_sbat\_section on 32-bits systems (CVSS 7.4, Red Hat Enterprise Linux)
- [CVE-2023-6390](https://cve.now/CVE-2023-6390.md): WordPress Users \<= 1.4 - Settings Update via CSRF (CVSS 8.8, WordPress Users)
- [CVE-2023-6165](https://cve.now/CVE-2023-6165.md): Restrict Usernames Emails Characters Plugin \< 3.1.4 - Admin+ Stored XSS (CVSS 4.8, Restrict Usernames Emails Characters)
- [CVE-2023-6391](https://cve.now/CVE-2023-6391.md): Custom User CSS \<= 0.2 - Settings Update via CSRF (CVSS 8.8, Custom User CSS)
- [CVE-2023-7200](https://cve.now/CVE-2023-7200.md): EventON \< 4.4.1 - Reflected Cross-Site Scripting (CVSS 6.1, EventON)
- [CVE-2023-6503](https://cve.now/CVE-2023-6503.md): WP Plugin Lister \<= 2.1.0 - Settings Update to Stored XSS via CSRF (CVSS 5.4, WP Plugin Lister)
- [CVE-2023-5943](https://cve.now/CVE-2023-5943.md): Wp-Adv-Quiz \< 1.0.3 - Admin+ Stored XSS (CVSS 4.8, Wp-Adv-Quiz)
- [CVE-2023-7089](https://cve.now/CVE-2023-7089.md): Easy SVG Allow \<= 1.0 - Author+ Stored XSS via SVG (CVSS 5.4, Easy SVG Allow)
- [CVE-2023-5124](https://cve.now/CVE-2023-5124.md): PageLayer \< 1.8.0 - Author+ Stored XSS (CVSS 4.8, Page Builder: Pagelayer)
- [CVE-2023-6530](https://cve.now/CVE-2023-6530.md): TJ Shortcodes \<= 0.1.3 - Contributor+ Stored XSS via Shortcodes (CVSS 5.4, TJ Shortcodes)
- [CVE-2023-6946](https://cve.now/CVE-2023-6946.md): Autotitle for WordPress \<= 1.0.3 - Settings Update to Stored XSS via CSRF (CVSS 8.8, Autotitle for WordPress)
- [CVE-2023-7204](https://cve.now/CVE-2023-7204.md): WP STAGING WordPress Backup Plugin \< 3.2.0 - Unauthorized Sensitive Data Exposure (CVSS 7.5, WP STAGING WordPress Backup Plugin)
- [CVE-2023-5956](https://cve.now/CVE-2023-5956.md): Wp-Adv-Quiz \<= 1.0.2 - Admin+ Stored XSS in Quiz Overview (CVSS 4.8, Wp-Adv-Quiz)
- [CVE-2023-7199](https://cve.now/CVE-2023-7199.md): Relevanssi (Free \< 4.22.0, Premium \< 2.25.0) - Unauthenticated Private/Draft Post Disclosure (CVSS 5.3, Relevanssi)
- [CVE-2023-6279](https://cve.now/CVE-2023-6279.md): Woostify Sites Library \< 1.4.8 - Subscriber+ Arbitrary Options Update to DoS (CVSS 7.1, Woostify Sites Library)
- [CVE-2023-6633](https://cve.now/CVE-2023-6633.md): Site Notes \<= 2.0.0 - Admin Note Deletion via CSRF (CVSS 4.3, Site Notes)
- [CVE-2023-6389](https://cve.now/CVE-2023-6389.md): WordPress Toolbar \<= 2.2.6 - Open Redirect (CVSS 6.1, WordPress Toolbar)
- [CVE-2023-7074](https://cve.now/CVE-2023-7074.md): WP Social Bookmark Menu \<= 1.2 - Settings Update via CSRF (CVSS 8.8, WP SOCIAL BOOKMARK MENU)
- [CVE-2023-6278](https://cve.now/CVE-2023-6278.md): Biteship for WooCommerce \< 2.2.25 - Reflected Cross-Site Scripting (CVSS 6.1, Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo)
- [CVE-2024-1003](https://cve.now/CVE-2024-1003.md): Totolink N200RE cstecgi.cgi setLanguageCfg stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-1002](https://cve.now/CVE-2024-1002.md): Totolink N200RE cstecgi.cgi setIpPortFilterRules stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-1015](https://cve.now/CVE-2024-1015.md): Remote command execution vulnerability in SE-elektronic GmbH E-DDC3.3 (CVSS 9.8, SE-elektronic E-DDC3.3)
- [CVE-2024-1014](https://cve.now/CVE-2024-1014.md): Uncontrolled resource consumption vulnerability in SE-elektronic GmbH E-DDC3.3 (CVSS 6.2, SE-elektronic E-DDC3.3)
- [CVE-2024-1001](https://cve.now/CVE-2024-1001.md): Totolink N200RE cstecgi.cgi main stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-1000](https://cve.now/CVE-2024-1000.md): Totolink N200RE cstecgi.cgi setTracerouteCfg stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-0999](https://cve.now/CVE-2024-0999.md): Totolink N200RE cstecgi.cgi setParentalRules stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-0998](https://cve.now/CVE-2024-0998.md): Totolink N200RE cstecgi.cgi setDiagnosisCfg stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2024-0997](https://cve.now/CVE-2024-0997.md): Totolink N200RE cstecgi.cgi setOpModeCfg stack-based overflow (CVSS 7.2, Totolink N200RE)
- [CVE-2023-29055](https://cve.now/CVE-2023-29055.md): Apache Kylin: Insufficiently protected credentials in config file (CVSS 7.5, Apache Software Foundation Apache Kylin · org.apache.kylin:…)
- [CVE-2023-5378](https://cve.now/CVE-2023-5378.md): Stored XSS in SmodBIP and MegaBIP (CVSS 8.8, Jan Syski MegaBIP · Jan Syski SmodBIP)
- [CVE-2023-46838](https://cve.now/CVE-2023-46838.md): Linux: netback processing of zero-length transmit fragment (CVSS 7.5, Linux)
- [CVE-2024-23790](https://cve.now/CVE-2024-23790.md): Missing file type check in avatar picture upload (CVSS 3.5, OTRS AG OTRS)
- [CVE-2024-23791](https://cve.now/CVE-2024-23791.md): Unnecessary data is written to log if issues during indexing occurs (CVSS 4.9, OTRS AG OTRS)
- [CVE-2024-23792](https://cve.now/CVE-2024-23792.md): Insufficient access control (CVSS 5.3, OTRS AG OTRS)
- [CVE-2024-0212](https://cve.now/CVE-2024-0212.md): Cloudflare WordPress plugin enables information disclosure of Cloudflare API (for low privileged users) (CVSS 8.1, Cloudflare-WordPress)
- [CVE-2024-0996](https://cve.now/CVE-2024-0996.md): Tenda i9 httpd setcfm formSetCfm stack-based overflow (CVSS 7.2, Tenda i9)
- [CVE-2024-0995](https://cve.now/CVE-2024-0995.md): Tenda W6 httpd wifiSSIDset formwrlSSIDset stack-based overflow (CVSS 7.2, Tenda W6)
- [CVE-2024-0994](https://cve.now/CVE-2024-0994.md): Tenda W6 httpd setcfm formSetCfm stack-based overflow (CVSS 7.2, Tenda W6)
- [CVE-2024-0993](https://cve.now/CVE-2024-0993.md): Tenda i6 httpd WifiMacFilterGet formWifiMacFilterGet stack-based overflow (CVSS 7.2, Tenda i6)
- [CVE-2024-0992](https://cve.now/CVE-2024-0992.md): Tenda i6 httpd wifiSSIDset formwrlSSIDset stack-based overflow (CVSS 7.2, Tenda i6)
- [CVE-2024-0991](https://cve.now/CVE-2024-0991.md): Tenda i6 httpd setcfm formSetCfm stack-based overflow (CVSS 7.2, Tenda i6)
- [CVE-2024-0990](https://cve.now/CVE-2024-0990.md): Tenda i6 httpd setAutoPing formSetAutoPing stack-based overflow (CVSS 7.2, Tenda i6)
- [CVE-2024-0989](https://cve.now/CVE-2024-0989.md): Sichuan Yougou Technology KuERP Service.php del\_sn\_db path traversal (CVSS 5.4, Sichuan Yougou Technology KuERP)
- [CVE-2024-0988](https://cve.now/CVE-2024-0988.md): Sichuan Yougou Technology KuERP common.php checklogin improper authentication (CVSS 6.3, Sichuan Yougou Technology KuERP)
- [CVE-2024-0987](https://cve.now/CVE-2024-0987.md): Sichuan Yougou Technology KuERP log neutralization for logs (CVSS 6.3, Sichuan Yougou Technology KuERP)
- [CVE-2023-49038](https://cve.now/CVE-2023-49038.md): Command injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated attacker to inject arbitrary commands onto t (CVSS 7.2)
- [CVE-2023-51839](https://cve.now/CVE-2023-51839.md): DeviceFarmer stf v3.6.6 suffers from Use of a Broken or Risky Cryptographic Algorithm. (CVSS 9.1, @devicefarmer/stf)
- [CVE-2023-51840](https://cve.now/CVE-2023-51840.md): DoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key. (CVSS 9.8)
- [CVE-2023-51842](https://cve.now/CVE-2023-51842.md): An algorithm-downgrade issue was discovered in Ylianst MeshCentral 1.1.16. (CVSS 7.5, meshcentral)
- [CVE-2024-22559](https://cve.now/CVE-2024-22559.md): LightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles field. (CVSS 5.4)
- [CVE-2024-22570](https://cve.now/CVE-2024-22570.md): A stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of GreenCMS v2.3 allows attackers to execute arb (CVSS 5.4)
- [CVE-2024-23747](https://cve.now/CVE-2024-23747.md): The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability. (CVSS 7.5)
- [CVE-2024-24134](https://cve.now/CVE-2024-24134.md): Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update M (CVSS 4.8)
- [CVE-2024-24135](https://cve.now/CVE-2024-24135.md): Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XS (CVSS 6.1)
- [CVE-2024-24136](https://cve.now/CVE-2024-24136.md): The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting (X (CVSS 6.1)
- [CVE-2024-24139](https://cve.now/CVE-2024-24139.md): Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter. (CVSS 7.2)
- [CVE-2024-24140](https://cve.now/CVE-2024-24140.md): Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.' (CVSS 7.2)
- [CVE-2024-24141](https://cve.now/CVE-2024-24141.md): Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter. (CVSS 9.8)
- [CVE-2024-24736](https://cve.now/CVE-2024-24736.md): The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remote denial of service (reboot) via a long string to TCP port 110, a related issue (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-01-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.