CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- nodemailer nodemailer before 6.9.9 ReDoS via attachDataUrls parameter 6.9 Medium
- facilemanager facileManager Privilege Escalation via Mass Assignment 8.8 High
- facilemanager facileManager Authenticated Variable Manipulation leading to SQL Injection 6.5 Medium
- facilemanager facileManager Systemic Cross-Site Scripting (XSS) 5.4 Medium
- minio MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation 8.8 High
- moby buildkit BuildKit interactive containers API does not validate entitlements check 9.8 Critical
- moby buildkit BuildKit possible host system access from mount stub cleaner 10.0 Critical
- moby buildkit BuildKit possible race condition with accessing subpaths from cache mounts 8.7 High
- moby buildkit BuildKit possible panic when incorrect parameters sent from frontend 5.3 Medium
- openbi openBI Screen.php index code injection 7.3 High
- openbi openBI Upload.php index unrestricted upload 7.3 High
- openbi openBI Setting.php dlfile os command injection 7.3 High
- linuxfoundation runc, fedoraproject fedora, red hat ocp-tools-4.15-rhel-8 +26 more +28 more runc container breakout through process.cwd trickery and leaked fds 8.6 High
- openbi openBI Screen.php dlfile access control 6.5 Medium
- openbi openBI Unity.php uploadUnity unrestricted upload 6.3 Medium
- zscaler zia, secure internet and saas access +1 more Bypass of ZIA domain fronting detection module through evasion technique 5.1 Medium
- rems qr code login system SourceCodester QR Code Login System add-user.php cross site scripting 4.3 Medium
- rockwell automation controllogix® 5570, controllogix® 5570 redundant, guardlogix® 5570 +3 more +5 more Rockwell Automation Denial-of-service Vulnerability in ICE1 Controller 8.6 High
- magazine3 schema & structured data for wp & amp, schema \& structured data for wp \& amp +1 more WordPress Schema & Structured Data for WP & AMP Plugin <= 1.25 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium
- fahad mahmood stock locations for woocommerce WordPress Stock Locations for WooCommerce Plugin <= 2.5.9 is vulnerable to Cross Site Scripting (XSS) 5.9 Medium
- pwr plugins portfolio & image gallery for wordpress | powerfolio, pwrplugins powerfolio +1 more WordPress Post Grid, Image Gallery & Portfolio for Elementor | PowerFolio Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium
- rockwell automation factorytalk® service platform, rockwellautomation factorytalk services platform +1 more Rockwell Automation FactoryTalk® Service Platform Service Token Vulnerability 9.8 Critical
- peepso community by peepso – social network, membership, registration, user profiles, peepso +1 more WordPress PeepSo Core: Photos Plugin < 6.3.1.0 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium
- realmag777 wolf – wordpress posts bulk editor and manager professional, pluginus wolf - wordpress posts bulk editor and products manager professional +1 more WordPress WOLF Plugin <= 1.0.8 is vulnerable to Cross Site Scripting (XSS) 7.1 High
- bradley b. dalina image tag manager WordPress Image Tag Manager Plugin <= 1.5 is vulnerable to Cross Site Scripting (XSS) 7.1 High
-
grumpydictator/firefly-iiiPackagist C5 Firefly III CSV Injection. 4.0 Medium - harmonic design hd quiz WordPress HD Quiz Plugin <= 1.8.11 is vulnerable to Cross Site Scripting (XSS) 5.9 Medium
- octoprint OctoPrint Unverified Password Change via Access Control Settings 4.2 Medium
- wpzoom shortcodes WordPress WPZOOM Shortcodes Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) 7.1 High
- getshieldsecurity shield security, paultgoodchild shield security – smart bot blocking & intrusion prevention security, shield security – smart bot blocking & intrusion prevention security +2 more WordPress Shield Security Plugin <= 18.5.7 is vulnerable to Cross Site Scripting (XSS) 7.1 High
- michael torbert simplemap store locator WordPress SimpleMap Store Locator Plugin <= 2.6.1 is vulnerable to Cross Site Scripting (XSS) 7.1 High
- aluka ba plus – before & after image slider free, ba plus +1 more WordPress BA Plus Plugin <= 1.0.3 is vulnerable to Cross Site Scripting (XSS) 7.1 High
- ivanti connect secure, policy secure, connect secure, policy secure, and neurons +3 more +5 more A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x,... 8.2 High
- ivanti connect secure, policy secure, ics +1 more +3 more A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and... 8.8 High
- cybernetikz post views stats WordPress Post views Stats plugin <= 1.4.1 - Cross Site Scripting (XSS) vulnerability 7.1 High
- honeywell controledge uoc, controledge unit operations controller firmware, controledge virtual unit operations controller firmware +2 more An attacker could potentially exploit this vulnerability, leading to files being read from the... 5.3 Medium
- delower wp to do WordPress WP To Do Plugin <= 1.2.8 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium
- andrea tarantini bp profile search WordPress BP Profile Search Plugin <= 5.5 is vulnerable to Cross Site Scripting (XSS) 7.1 High
- robogallery robo gallery, robosoft photo gallery, images, slider in rbs image gallery +1 more WordPress Robo Gallery Plugin <= 3.2.17 is vulnerable to Cross Site Scripting (XSS) 5.9 Medium
- codeboxr cbx map for google map & openstreetmap, cbx map +1 more WordPress CBX Map for Google Map & OpenStreetMap Plugin <= 1.1.11 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium
- pega platform, pegasystems pega platform +1 more Pega Platform from 8.5.4 to 8.8.3 is affected by an XSS issue with an unauthenticated user and... 6.1 Medium
- drupal entity delete log, entity delete log project delete log +1 more Entity Delete Log - Moderately critical - Access bypass - SA-CONTRIB-2024-007 6.5 Medium
- pega platform, pegasystems pega platform +1 more Pega Platform versions 8.2.1 to Infinity 23.1.0 are affected by an Generated PDF issue that could... 8.5 High
- albo pretorio on line project pretorio on line, ignazio scimone albo pretorio on line +1 more WordPress Albo Pretorio Online Plugin <= 4.6.6 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium
- hometory mang board wp, mangboard mang board +1 more WordPress Mang Board WP Plugin <= 1.7.7 is vulnerable to Cross Site Scripting (XSS) 5.9 Medium
- wp lab wp-lister lite for ebay WordPress WP-Lister Lite for eBay plugin <= 3.5.7 - Reflected Cross Site Scripting (XSS) vulnerability 7.1 High
- formzu wp WordPress Formzu WP Plugin <= 1.6.7 is vulnerable to Cross Site Scripting (XSS) 6.5 Medium
- anchore stereoscope Tar path traversal in stereoscope when processing OCI tar archives 5.3 Medium
- lobehub lobe chat, lobe-chat +1 more Lobe Chat unauthorized access to plugins 5.3 Medium
- humansignal label studio, label-studio +1 more Label Studio SSRF on Import Bypassing `SSRF_PROTECTION_ENABLED` Protections 5.3 Medium
- Show olderLoading…