CVEs published January 30, 2024
75 CVEs were published on January 30, 2024: 13 critical, 25 high.
- Published
- 75
- Critical
- 13
- High
- 25
- Medium
- 25
- Low
- 11
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- openBI
- 5
- Cogites eReserv
- 3
- Google Chrome
- 3
- Lamassu Bitcoin ATM Douro machines
- 3
- SourceCodester Facebook News Feed Like
- 3
- Mitsubishi Electric EZSocket · Mitsubishi Electric GT De… +6
- 2
- Splunk Add-on Builder
- 2
- vantage6
- 2
- apollographql apollo-client-nextjs · @apollo/experimental-n…
- 1
- Appwrite
- 1
Critical 13
- CVE-2023-5389 An attacker could potentially exploit this vulnerability, leading to the ability to modify files on Honeywell Experion ControlEdge VirtualUHoneywell ControlEdge UOC
- CVE-2023-6943Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocketMitsubishi Electric EZSocket · Mitsubishi Electric GT De… +6
- CVE-2023-51837Ylianst MeshCentral 1.1.16 is vulnerable to Missing SSL Certificate Validation.meshcentral
- CVE-2023-51982CrateDB 5.5.1 is contains an authentication bypass vulnerability in the Admin UI component.io.crate:crate
- CVE-2024-24324TOTOLINK A8000RU v7.1cu.643_B20200521 was discovered to contain a hardcoded password for root stored in /etc/shadow.
- CVE-2024-24325TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setParen
- CVE-2024-24326TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the arpEnable parameter in the setSt
- CVE-2024-24327TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the pppoePass parameter in the setIp
- CVE-2024-24329TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortF
- CVE-2024-24330TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the port or enable parameter in the
- CVE-2024-24331TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setWiFiS
- CVE-2024-24332TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the url parameter in the setUrlFilte
- CVE-2024-24333TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the desc parameter in the setWiFiAcl
High 25
- CVE-2024-1077Use after free in Network in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a maGoogle Chrome
- CVE-2024-1060Use after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2024-1059Use after free in Peer Connection in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to potentially exploit stack corruptionGoogle Chrome
- CVE-2024-24558react-query-streamed-hydration xssTanStack query · @tanstack/react-query-next-experimental
- CVE-2024-1036openBI Icon Screen.php uploadIcon unrestricted uploadopenBI
- CVE-2024-24556XSS in @urql/nexturql-graphql urql · @urql/next
- CVE-2024-23841XSS in @apollo/experimental-nextjs-app-supportapollographql apollo-client-nextjs · @apollo/experimental-n…
- CVE-2023-46230Sensitive Information Disclosure to Internal Log Files in Splunk Add-on BuilderSplunk Add-on Builder
- CVE-2023-46231Session Token Disclosure to Internal Log Files in Splunk Add-on BuilderSplunk Add-on Builder
- CVE-2023-6258Pkcs11-provider: side-channel proofing pkcs#1 1.5 pathspkcs11-provider · Fedora
- CVE-2024-23838TrueLayer.Client SSRF when fetching payment or payment providertruelayer-dotnet · TrueLayer.Client
- CVE-2024-1019WAF bypass of the ModSecurity v3 release lineOWASP ModSecurity ModSecurity
- CVE-2024-1035openBI Icon.php uploadIcon unrestricted uploadopenBI
- CVE-2024-21649Remote code execution vantage6
- CVE-2024-1034openBI File.php uploadFile unrestricted uploadopenBI
- CVE-2024-1032openBI Test Connection Databasesource.php testConnection deserializationopenBI
- CVE-2023-6942Missing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation EZSocket versions 3.0 to 5.92, GT Designer3 VeMitsubishi Electric EZSocket · Mitsubishi Electric GT De… +6
- CVE-2024-1061The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' paramehtml5-video-player
- CVE-2024-21488Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function witnetwork · org.webjars.npm:network
- CVE-2024-21840Directory and File Permission Vulnerability in Hitachi Storage Plug-in for VMware vCenterHitachi Storage Plug-in for VMware vCenter
- CVE-2023-5372The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versiZyxel NAS326 firmware · Zyxel NAS542 firmware
- CVE-2023-51843react-dashboard 1.4.0 is vulnerable to Cross Site Scripting (XSS) as httpOnly is not set.
- CVE-2024-22523Directory Traversal vulnerability in Qiyu iFair version 23.8_ad0 and before, allows remote attackers to obtain sensitive information via upl
- CVE-2024-22938Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init
- CVE-2024-24328TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFi
Medium, low and unrated 37
- CVE-2024-23834Discourse improperly sanitized user input leads to XSSdiscourse
- CVE-2024-24567raw_call `value=` kwargs not disabled for static and delegate callsvyperlang vyper · vyper
- CVE-2024-21388Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2024-24565CrateDB database has an arbitrary file read vulnerabilitycrate · io.crate:crate
- CVE-2024-23840`goreleaser release --debug` shows secretsgoreleaser · github.com/goreleaser/goreleaser
- CVE-2024-23825TablePress SSRF vulnerability due to insufficient filtering of cloud provider hostsTablePress
- CVE-2024-23647PKCE downgrade attack in Authentikgoauthentik authentik · goauthentik.io
- CVE-2024-22200vantage6-UI docker image leaks software version informationvantage6-UI
- CVE-2024-22193vantage6 unencrypted task can be created in encrypted collaborationvantage6
- CVE-2024-21671vantage6 username timing attackvantage6 · vantage6-server
- CVE-2024-21653vantage6 insecure SSH configuration for node and server containersvantage6 · vantage6-server +1
- CVE-2023-37518A code injection vulnerability affects HCL BigFix ServiceNow Data FlowHCL Software BigFix ServiceNow Data Flow
- CVE-2024-0564Kernel: max page sharing of kernel samepage merging (ksm) may cause memory deduplicationkernel · Red Hat Enterprise Linux
- CVE-2024-1033openBI Datament.php agent information disclosureopenBI
- CVE-2024-1031CodeAstro Expense Management System Add Expenses Page 5-Add-Expenses.php cross site scriptingCodeAstro Expense Management System
- CVE-2024-0676Weak password requirement vulnerability in Lamassu Bitcoin ATM Douro machinesLamassu Bitcoin ATM Douro machines
- CVE-2024-0675Improper checking for unusual or exceptional conditions vulnerability in Lamassu Bitcoin ATM Douro machinesLamassu Bitcoin ATM Douro machines
- CVE-2024-0674Privilege escalation vulnerability in Lamassu Bitcoin ATM Douro machinesLamassu Bitcoin ATM Douro machines
- CVE-2024-1030Cogites eReserv tenancyDetail.php cross site scriptingCogites eReserv
- CVE-2024-1063Appwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars/favicon' endpoint due to an incomplete fix of CAppwrite
- CVE-2023-6374Authentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC WS Series WS0-GETH00200 all serial numbers aMitsubishi Electric MELSEC WS Series WS0-GETH00200
- CVE-2023-7225MapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settingschrisvrichardson MapPress Maps for WordPress
- CVE-2024-21803Possible UAF in bt_accept_poll in Linux kernelLinux kernel
- CVE-2024-1029Cogites eReserv tenancyDetail.php cross site scriptingCogites eReserv
- CVE-2024-1028SourceCodester Facebook News Feed Like Post cross site scriptingSourceCodester Facebook News Feed Like
- CVE-2024-1027SourceCodester Facebook News Feed Like Post unrestricted uploadSourceCodester Facebook News Feed Like
- CVE-2024-1026Cogites eReserv config.php cross site scriptingCogites eReserv
- CVE-2024-1024SourceCodester Facebook News Feed Like New Account cross site scriptingSourceCodester Facebook News Feed Like
- CVE-2023-36259Cross Site Scripting (XSS) vulnerability in Craft CMS Audit Plugin before version 3.0.2 allows attackers to execute arbitrary code during ussuperbig/craft-audit
- CVE-2023-36260An issue was discovered in the Feed Me plugin 4.6.1 for Craft CMS.craftcms/cms
- CVE-2023-37571Softing TH SCOPE through 3.70 allows XSS.
- CVE-2023-51813Cross Site Request Forgery (CSRF) vulnerability in Free Open-Source Inventory Management System v.1.0 allows a remote attacker to execute ar
- CVE-2024-22643A Cross-Site Request Forgery (CSRF) vulnerability in SEO Panel version 4.10.0 allows remote attackers to perform unauthorized user password
- CVE-2024-22646An email address enumeration vulnerability exists in the password reset function of SEO Panel version 4.10.0.
- CVE-2024-22647An user enumeration vulnerability was found in SEO Panel 4.10.0.
- CVE-2024-22648A Blind SSRF vulnerability exists in the "Crawl Meta Data" functionality of SEO Panel version 4.10.0.
- CVE-2024-22894An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3