CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- siemens syngo fastviewA vulnerability has been identified in syngo fastView (All versions). The affected application...7.8 High
- siemens syngo fastviewA vulnerability has been identified in syngo fastView (All versions). The affected application...7.8 High
- cloudflare zlibMemory corruption issues is Cloudflare zlib implementation4.0 Medium
- redhat red hat developer hub, linuxfoundation backstage, red hat rhdh-1.1-rhel-9 +2 moreRhdh: catalog-import function leaks credentials to frontend5.7 Medium
- hitachi energy relion 670/650/sam600-io series, hitachienergy relion 650 firmware, relion 670 firmware +1 more +3 moreA vulnerability exists in the Relion update package signature validation. A tampered update...4.5 Medium
- wpdeveloper essential addons for elementor, wpdevteam essential addons for elementor – popular elementor templates & widgets +1 moreEssential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- hitachi energy rtu500 series cmu firmware, hitachienergy rtu520 firmware, rtu530 firmware +2 more +4 moreA vulnerability exists in the HCI Modbus TCP function included in the product versions listed...7.5 High
- zte red magic 8 pro, redmagic 8 pro firmware +1 morePermissions and Access Control Vulnerability in ZTE Red Magic 8 Pro6.6 Medium
- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePageLayer <= 1.7.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via meta fields5.4 Medium
- butlerblog wp-members, cbutlerjr wp-members membership plugin +1 moreWP-Members Membership Plugin <= 3.4.8 - Missing Authorization to Sensitive Information Exposure6.5 Medium
- complianz – gdpr/ccpa cookie consent, really-simple-plugins complianz +1 moreComplianz | GDPR/CCPA Cookie Consent <= 6.5.5 - Authenticated(Administrator+) Stored Cross-site Scripting via settings4.4 Medium
- samsung nearby device scanningImproper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows...4.0 Medium
- samsung nearby device scanningImproper access control vulnerability in Nearby device scanning prior version 11.1.14.7 allows...4.0 Medium
- samsung emailImplicit intent hijacking vulnerability in Samsung Email prior to version 6.1.90.16 allows...3.3 Low
- samsung android, samsung mobile devices +1 moreImproper access control in Notification service prior to SMR Jan-2024 Release 1 allows local...6.2 Medium
- samsung android, myfiles, samsung mobile devices +2 morePath traversal vulnerability in ZipCompressor of MyFiles prior to SMR Jan-2024 Release 1 in...3.3 Low
- samsung android, myfiles, samsung mobile devices +2 morePath traversal vulnerability in FileUriConverter of MyFiles prior to SMR Jan-2024 Release 1 in...4.0 Medium
- samsung android, samsung mobile devices +1 moreImproper authentication vulnerability in Bluetooth pairing process prior to SMR Jan-2024 Release...6.8 Medium
- samsung dex, samsung mobile devices +1 moreImproper access control vulnerability in Samsung DeX prior to SMR Jan-2024 Release 1 allows owner...4.6 Medium
checkstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.grammar.java.JavaLanguageParser.exprNo scoreicuOSS-FuzzStack-buffer-overflow in icu_75::TZDBTimeZoneNames::getMetaZoneNamesNo score- google chrome, fedoraproject fedora +1 moreUse after free in WebGPU in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in WebAudio in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreHeap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker who...8.8 High
- spipecrire/public/assembler.php in SPIP before 4.1.3 and 4.2.x before 4.2.7 allows XSS because input...6.1 Medium
- tenda ax3 firmwareTenda AX3 v16.03.12.11 was discovered to contain a remote code execution (RCE) vulnerability via...9.8 Critical
- jizhicmsJizhicms v2.5 was discovered to contain an arbitrary file download vulnerability via the...9.8 Critical
- teamwork management system project management systemCross Site Scripting (XSS) vulnerability in xiweicheng TMS v.2.28.0 allows a remote attacker to...6.1 Medium
- pbootcmsAoyun Technology pbootcms V3.1.2 is vulnerable to Incorrect Access Control, allows remote...7.5 High
- s-cmsS-CMS v5.0 was discovered to contain an arbitrary file read vulnerability.6.5 Medium
- froxlorFroxlor username/surname AND company field Bypass7.5 High
gratientPyPIgratient 0.5 contains credential harvesting codeNo score- silabs gecko software development kit, silabs.com gsdk +1 moreGlitch detection not active by default in Silicon Labs Secure Vault High devices6.8 Medium
- amazon ion, amazon-ion ion-java +1 moreIon Java StackOverflow vulnerability7.5 High
safe_pqc_kybercrates.iosafe_pqc_kyber leaks parts of secret keysNo score- lenovo browser hd, browser mobile +1 moreA vulnerability was reported in the Lenovo Browser Mobile and Lenovo Browser HD Apps for Android...6.5 Medium
- lenovo universal device client (udc), universal device client +1 moreUncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC...7.8 High
github.com/karmada-io/karmadaGoThe DES/3DES cipher was used as part of the TLS protocol by installation toolsNo score- geniecompany aladdin connect garage door opener, aladdin connect garage door opener firmware, the genie company aladdin connect (retrofit-kit) +2 moreUnauthenticated access permitted to web interface page "Garage Door Control Module Setup"8.2 High
- geniecompany aladdin connect, aladdin connect garage door opener firmware, the genie company aladdin connect (retrofit-kit) +2 moreCross-site Scripting (XSS) injected into Aladdin Connect garage door opener (Retrofit-Kit) configuration setup webserver console via broadcast SSID name8.8 High
- geniecompany aladdin connect, the genie company aladdin connect mobile application +1 moreAladdin Connect Android Application Insecure Storage6.8 Medium
- packagekit project packagekit, fedoraproject fedora, red hat enterprise linux 6 +4 more +6 morePackagekitd: use-after-free in idle function callback3.3 Low
- apktoolArbitrary file write on Decoding7.8 High
- vaporInteger overflow in URI leading to potential host spoofing6.5 Medium
- craftcms cms, craft cms +1 moreCraft CMS Privilege Escalation5.4 Medium
- labring laflaf logs leak9.7 Critical
- cubefsCubeFS leaks users key in logs4.8 Medium
- cubefsCubeFS leaks magic secret key when starting Blobstore access service4.8 Medium
- cubefsInsecure random string generator used for sensitive data6.5 Medium
- Show moreLoading…