CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- cubefsTiming attack can leak user passwords6.5 Medium
- cubefsAuthenticated users can crash the CubeFS servers with maliciously crafted requests6.5 Medium
- openkruise kruiseLeverage the kruise-daemon pod to list all secrets in the entire cluster6.5 Medium
- apache inlongApache InLong: Remote Code Execution vulnerability in Apache InLong Manager9.8 Critical
- apache inlongApache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager7.5 High
- webcodingplace product expiry for woocommerceProduct Expiry for WooCommerce <= 2.5 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update5.4 Medium
- saad iqbal post smtpPost SMTP < 2.8.7 - Reflected Cross-Site Scripting6.1 Medium
- ideabox powerpack addons for elementor, ideaboxcreations powerpack addons for elementor (free widgets, extensions and templates) +1 morePowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.13 - Cross-Site Request Forgery5.3 Medium
- webtoffee woocommerce pdf invoices, packing slips, delivery notes & shipping labels, woocommerce pdf invoices\, packing slips\, delivery notes and shipping labels +1 moreWooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.3.0 - Missing Authorization to Order Export4.3 Medium
- fooplugins foogallery, https://fooplugins.com foogallery premium, fooplugins gallery by foogallery +2 moreFooGallery Premium <= 2.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- paddlepaddleCommand injection in convert_shape_compare9.6 Critical
- paddlepaddleFPE in paddle.argmin and paddle.argmax4.7 Medium
- paddlepaddleNull pointer dereference in paddle.crop4.7 Medium
- paddlepaddleCommand injection in _wget_download9.6 Critical
- paddlepaddleCommand injection in get_online_pass_interval9.6 Critical
- paddlepaddleHeap buffer overflow in paddle.repeat_interleave8.2 High
- paddlepaddleFPE in paddle.amin4.7 Medium
- paddlepaddleStack overflow in paddle.linalg.lu_unpack8.2 High
- paddlepaddleFPE in paddle.lerp4.7 Medium
- paddlepaddleFPE in paddle.topk4.7 Medium
- paddlepaddleStack overflow in paddle.searchsorted8.2 High
- paddlepaddleSegfault in paddle.put_along_axis4.7 Medium
- paddlepaddleSegfault in paddle.nextafter4.7 Medium
- paddlepaddleSegfault in paddle.mode4.7 Medium
- paddlepaddleFPE in paddle.linalg.eig4.7 Medium
- paddlepaddleSegfault in paddle.dot4.7 Medium
- paddlepaddleFPE in paddle.linalg.matrix_rank4.7 Medium
- paddlepaddleFPE in paddle.nanmedian4.7 Medium
- wiresharkLoop with Unreachable Exit Condition ('Infinite Loop') in Wireshark7.8 High
- wiresharkUncontrolled Recursion in Wireshark7.8 High
- wiresharkNULL Pointer Dereference in Wireshark7.8 High
- wiresharkImproper Handling of Missing Values in Wireshark7.8 High
- wiresharkOut-of-bounds Read in Wireshark7.8 High
- wpdeveloper embedpress, wpdevteam embedpress – pdf embedder, embed youtube videos, 3d flipbook, social feeds, docs & more +1 moreEmbedPress – Embed PDF, YouTube, Google Docs, Vimeo, Wistia Videos, Audios, Maps & Any Documents in Gutenberg & Elementor <= 3.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortc…6.4 Medium
- veronalabs wp sms, wsms (formerly wp sms) – sms & mms notifications with otp and 2fa for woocommerce +1 moreWP SMS <= 6.5 - Authenticated (Admin+) SQL Injection to Reflected Cross-Site Scripting6.1 Medium
- veronalabs wp sms, wsms (formerly wp sms) – sms & mms notifications with otp and 2fa for woocommerce +1 moreWP SMS <= 6.5 - Cross-Site Request Forgery to Subscriber Deletion4.3 Medium
- daan omgf, daanvandenbergh omgf | gdpr/dsgvo compliant, faster google fonts. easy. +1 moreOMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. <= 5.7.9 - Missing Authorization to Unauthenticated Directory Deletion and Cross-Site Scripting8.6 High
- chrisvrichardson mappress maps for wordpress, mappresspro mappress +1 moreMapPress Maps for WordPress <= 2.88.13 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpexperts post smtp, saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app +1 morePOST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Unauthenticated Stored Cross-Site Scripting via device7.2 High
- wpexperts post smtp, saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile app +1 morePOST SMTP Mailer <= 2.8.6 - Reflected Cross-Site Scripting via msg6.1 Medium
- hcl software dryice myxalyticsPath Traversal Arbitrary File Read affects DRYiCE MyXalytics8.8 High
- hcl software dryice myxalyticsUnauthenticated File Upload affects DRYiCE MyXalytics8.2 High
- hcl software dryice myxalyticsPath Traversal which allows file upload capability affects DRYiCE MyXalytics7.6 High
- hcl software dryice myxalyticsImproper Access Control affects DRYiCE MyXalytics7.6 High
- hcl software dryice myxalyticsInsecure Direct Object Reference (IDOR) affects DRYiCE MyXalytics7.1 High
- hcl software dryice myxalyticsImproper Access Control (Controller APIs) affects DRYiCE MyXalytics8.3 High
- hcl software dryice myxalyticsUnauthenticated File Downloads affect DRYiCE MyXalytics5.4 Medium
- zte zxcloud iraiCommand Injection Vulnerability of ZTE's ZXCLOUD iRAI4.3 Medium
- hcl software dryice myxalyticsOpen Redirect affects DRYiCE MyXalytics3.7 Low
- hcl software dryice myxalyticsAn information disclosure affects DRYiCE MyXalytics3.1 Low
- Show moreLoading…