CVEs published January 31, 2024
91 CVEs were published on January 31, 2024: 4 critical, 38 high. 2 are now in CISA KEV.
- Published
- 91
- Critical
- 4
- High
- 38
- Medium
- 44
- Low
- 4
- Unrated
- 1
- Now in CISA KEV
- 2
- Fix available
- 22
Most affected products
- openBI
- 5
- moby buildkit · github.com/moby/buildkit
- 4
- glibc · Red Hat Enterprise Linux +1
- 3
- WillyXJ facileManager
- 3
- Apache Software Foundation Apache ServiceComb Service-Cente…
- 2
- Ivanti ICS · Ivanti IPS
- 2
- Linux Kernel
- 2
- Pegasystems Pega Platform
- 2
- Rebuild
- 2
- AboZain,O7abeeb,UnitOne Custom Dashboard Widgets
- 1
Critical 4
- CVE-2024-23653BuildKit interactive containers API does not validate entitlements checkmoby buildkit · github.com/moby/buildkit
- CVE-2024-23652BuildKit possible host system access from mount stub cleanermoby buildkit · github.com/moby/buildkit
- CVE-2024-21917Rockwell Automation FactoryTalk® Service Platform Service Token VulnerabilityRockwell Automation FactoryTalk® Service Platform
- CVE-2022-47072SQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to run arbitrary SQL commands via the Find parameter i
High 38
- CVE-2024-24573facileManager Privilege Escalation via Mass AssignmentWillyXJ facileManager
- CVE-2024-24747MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalationminio · github.com/minio/minio
- CVE-2024-23651BuildKit possible race condition with accessing subpaths from cache mountsmoby buildkit · github.com/moby/buildkit
- CVE-2024-21626runc container breakout through process.cwd trickery and leaked fdsopencontainers runc · github.com/opencontainers/runc
- CVE-2024-1117openBI Screen.php index code injectionopenBI
- CVE-2024-1116openBI Upload.php index unrestricted uploadopenBI
- CVE-2024-1115openBI Setting.php dlfile os command injectionopenBI
- CVE-2024-21916Rockwell Automation Denial-of-service Vulnerability in ICE1 ControllerRockwell Automation ControlLogix® · Rockwell Automation Gua…
- CVE-2024-22159WordPress WOLF Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS)realmag777 WOLF – WordPress Posts Bulk Editor and Manager P…
- CVE-2024-22160WordPress Image Tag Manager Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS)Bradley B. Dalina Image Tag Manager
- CVE-2024-22162WordPress WPZOOM Shortcodes Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)WPZOOM Shortcodes
- CVE-2024-22163WordPress Shield Security Plugin <= 18.5.7 is vulnerable to Cross Site Scripting (XSS)Shield Security – Smart Bot Blocking & Intrusion Prevention…
- CVE-2024-22282WordPress SimpleMap Store Locator Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS)Michael Torbert SimpleMap Store Locator
- CVE-2024-22286WordPress BA Plus Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS)Aluka BA Plus – Before & After Image Slider FREE
- CVE-2024-21893A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) Ivanti ICS · Ivanti IPS
- CVE-2024-21888A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a useIvanti ICS · Ivanti IPS
- CVE-2024-22289WordPress Post views Stats plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerabilityCyberNetikz Post views Stats
- CVE-2024-22293WordPress BP Profile Search Plugin <= 5.5 is vulnerable to Cross Site Scripting (XSS)Andrea Tarantini BP Profile Search
- CVE-2023-50165Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could expose file contents.Pegasystems Pega Platform
- CVE-2024-22307WordPress WP-Lister Lite for eBay plugin <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerabilityWP Lab WP-Lister Lite for eBay
- CVE-2024-23508WordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)bPlugins PDF Poster – PDF Embedder Plugin for WordPress
- CVE-2024-0833Privilege Elevation via Telerik Test StudioProgress Software Telerik Test Studio
- CVE-2024-0832Privilege Elevation via Telerik Reporting InstallerProgress Software Telerik Reporting
- CVE-2024-0219Privilege Elevation via Telerik JustDecompile InstallerProgress Software Telerik JustDecompile
- CVE-2023-6779Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()glibc · Red Hat Enterprise Linux +1
- CVE-2023-6246Glibc: heap-based buffer overflow in __vsyslog_internal()glibc · Red Hat Enterprise Linux +1
- CVE-2024-22140WordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Request Forgery (CSRF)Cozmoslabs Profile Builder Pro
- CVE-2024-1112Buffer Overflow Vulnerability in Resource HackerAngus Johnson Resource Hacker
- CVE-2024-1086Use-after-free in Linux kernel's netfilter: nf_tables componentLinux Kernel
- CVE-2024-1085Use-after-free in Linux kernel's netfilter: nf_tables componentLinux Kernel
- CVE-2024-22287WordPress Better Anchor Links Plugin <= 1.7.5 is vulnerable to Cross Site Request Forgery (CSRF)Luděk Melichar Better Anchor Links
- CVE-2024-22290WordPress Custom Dashboard Widgets Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)AboZain,O7abeeb,UnitOne Custom Dashboard Widgets
- CVE-2024-23507WordPress InstaWP Connect plugin <= 0.1.0.9 - SQL Injection vulnerabilityInstaWP Connect
- CVE-2024-22305WordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object References (IDOR)Contact Form builder with drag & drop for WordPress – Kali…
- CVE-2023-44313Apache ServiceComb Service-Center: attacker can perform SSRF through the frontend APIApache Software Foundation Apache ServiceComb Service-Cente…
- CVE-2024-1069Contact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Uploadcrmperks Database for Contact Form 7, WPforms, Elementor fo…
- CVE-2023-31505An arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated attackers to execute arbitrary code and obtain se
- CVE-2024-23775Integer Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows attackers to cause a denial of service (DoS) via m
Medium, low and unrated 49
- CVE-2024-24572facileManager Authenticated Variable Manipulation leading to SQL InjectionWillyXJ facileManager
- CVE-2024-24571facileManager Systemic Cross-Site Scripting (XSS)WillyXJ facileManager
- CVE-2024-23650BuildKit possible panic when incorrect parameters sent from frontendmoby buildkit · github.com/moby/buildkit
- CVE-2024-1114openBI Screen.php dlfile access controlopenBI
- CVE-2024-1113openBI Unity.php uploadUnity unrestricted uploadopenBI
- CVE-2023-28807Bypass of ZIA domain fronting detection module through evasion techniqueZscaler ZIA
- CVE-2024-1111SourceCodester QR Code Login System add-user.php cross site scriptingSourceCodester QR Code Login System
- CVE-2024-22146WordPress Schema & Structured Data for WP & AMP Plugin <= 1.25 is vulnerable to Cross Site Scripting (XSS)Magazine3 Schema & Structured Data for WP & AMP
- CVE-2024-22153WordPress Stock Locations for WooCommerce Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS)Fahad Mahmood & Alexandre Faustino Stock Locations for WooC…
- CVE-2024-22150WordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)PWR Plugins Portfolio & Image Gallery for WordPress | Power…
- CVE-2024-22158WordPress PeepSo Core: Photos Plugin < 6.3.1.0 is vulnerable to Cross Site Scripting (XSS)Community by PeepSo – Social Network, Membership, Registrat…
- CVE-2024-22161WordPress HD Quiz Plugin <= 1.8.11 is vulnerable to Cross Site Scripting (XSS)Harmonic Design HD Quiz
- CVE-2024-23637OctoPrint Unverified Password Change via Access Control SettingsOctoPrint
- CVE-2023-5390An attacker could potentially exploit this vulnerability, leading to files being read from the Honeywell Experion ControlEdge VirtualUOC andHoneywell ControlEdge UOC
- CVE-2024-22292WordPress WP To Do Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS)Delower WP To Do
- CVE-2024-22295WordPress Robo Gallery Plugin <= 3.2.17 is vulnerable to Cross Site Scripting (XSS)RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery
- CVE-2024-22297WordPress CBX Map for Google Map & OpenStreetMap Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS)Codeboxr CBX Map for Google Map & OpenStreetMap
- CVE-2023-50166Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and the redirect parameter.Pegasystems Pega Platform
- CVE-2024-22302WordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Cross Site Scripting (XSS)Ignazio Scimone Albo Pretorio On line
- CVE-2024-22306WordPress Mang Board WP Plugin <= 1.7.7 is vulnerable to Cross Site Scripting (XSS)Hometory Mang Board WP
- CVE-2024-22310WordPress Formzu WP Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS)Formzu WP
- CVE-2024-24579Tar path traversal in stereoscope when processing OCI tar archivesanchore stereoscope · github.com/anchore/stereoscope
- CVE-2024-24566Lobe Chat unauthorized access to pluginslobehub lobe-chat · @lobehub/chat
- CVE-2023-47116Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` ProtectionsHumanSignal label-studio · label-studio
- CVE-2024-23502WordPress Posts List Designer by Category – List Category Posts Or Recent Posts Plugin <= 3.3.2 is vulnerable to Cross Site Scripting (XSS)InfornWeb Posts List Designer by Category – List Category P…
- CVE-2024-23505WordPress PDF Viewer & 3D PDF Flipbook – DearPDF Plugin <= 2.0.38 is vulnerable to Cross Site Scripting (XSS)DearHive PDF Viewer & 3D PDF Flipbook – DearPDF
- CVE-2024-1103CodeAstro Real Estate Management System Feedback Form profile.php cross site scriptingCodeAstro Real Estate Management System
- CVE-2023-6780Glibc: integer overflow in __vsyslog_internal()glibc · Red Hat Enterprise Linux +1
- CVE-2023-5992Opensc: side-channel leaks while stripping encryption pkcs#1 paddingRed Hat Enterprise Linux
- CVE-2024-22136WordPress Droit Elementor Addons Plugin <= 3.1.5 is vulnerable to Cross Site Request Forgery (CSRF)DroitThemes Droit Elementor Addons – Widgets, Blocks, Templ…
- CVE-2024-0589Cross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop Manager 2023.3.36 and earlier on Windows alDevolutions Remote Desktop Manager
- CVE-2024-22143WordPress WP Spell Check Plugin <= 9.17 is vulnerable to Cross Site Request Forgery (CSRF)WP Spell Check
- CVE-2023-7043Unquoted path privilege vulnerability in ESET products for WindowsESET, spol. s r.o. ESET Endpoint Security · ESET, spol.… +4
- CVE-2024-22285WordPress Frontpage Manager Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)Elise Bosse Frontpage Manager
- CVE-2024-22291WordPress Browser Theme Color Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)Marco Milesi Browser Theme Color
- CVE-2024-22304WordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Request Forgery (CSRF)Borbis Media FreshMail For WordPress
- CVE-2024-1099Rebuild read-raw getFileOfData cross site scriptingRebuild
- CVE-2024-1098Rebuild proxy-download QiniuCloud.getStorageFile information disclosureRebuild
- CVE-2023-50357Cross site scripting vulnerability in AREAL SAS Webserv1 ASP Web SiteAREAL SAS Webserv1
- CVE-2023-50356Improper Certificate Validation in AREAL Topkapi Vision (Server)AREAL SAS Topkapi Vision
- CVE-2023-44312Apache ServiceComb Service-Center: attacker can query all environment variables of the service-center serverApache Software Foundation Apache ServiceComb Service-Cente…
- CVE-2024-0836WordPress Review & Structure Data Schema Plugin – Review Schema <= 2.1.14 - Missing Authorization to Arbitrary Review Updatetechlabpro1 Review Schema – Review & Structure Data Schema…
- CVE-2024-1012Wanhu ezOFFICE wf_printnum.jsp sql injectionWanhu ezOFFICE
- CVE-2024-22236In Spring Cloud Contract, versions 4.1.x prior to 4.1.1, versions 4.0.x prior to 4.0.5, and versions 3.1.x prior to 3.1.10, test execution iSpring Cloud Contract · org.springframework.cloud:spring-cl…
- CVE-2024-0914Opencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin)opencryptoki · Red Hat Enterprise Linux
- CVE-2023-2439The UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro' shortcode in versions up to, and including, UserPro - Community and User Profile WordPress Plugin
- CVE-2024-22569Stored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute arbitrary code via a crafted payload to /index
- CVE-2024-23170An issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2.
- CVE-2024-23745In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack.