CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- wpclever wpc product bundles for woocommerceWordPress WPC Product Bundles for WooCommerce Plugin <= 7.3.1 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- linksoftwarellc white label, whitewp white label – wordpress custom admin, custom login page, and custom dashboard +1 moreWordPress White Label Plugin <= 2.9.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- michael winkler teachpressWordPress teachPress Plugin <= 9.0.4 is vulnerable to Cross Site Request Forgery (CSRF)6.3 Medium
- mra13 affiliates managerWordPress Affiliates Manager Plugin <= 2.9.31 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- smash balloon custom twitter feeds – a tweets widget or x feed widget, smashballoon custom twitter feeds +1 moreWordPress Custom Twitter Feeds (Tweets Widget) Plugin <= 2.1.2 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- marios alexandrou republish old postsWordPress Republish Old Posts Plugin <= 1.21 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- wow-company floating buttonWordPress Floating Button Plugin <= 6.0 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- ovation dynamic content for elementorWordPress Dynamic Content for Elementor Plugin < 2.12.5 is vulnerable to Cross Site Request Forgery (CSRF)8.8 High
- wp job portal – a complete job board, wpjobportal wp job portal +1 moreWordPress WP Job Portal Plugin <= 2.0.6 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- automattic woocommerce stripe, woocommerce stripe payment gateway +1 moreWordPress WooCommerce Stripe Payment Gateway Plugin <= 7.6.1 is vulnerable to Insecure Direct Object References (IDOR)7.5 High
- mojofywp wp affiliate disclosureWordPress WP Affiliate Disclosure Plugin <= 1.2.7 is vulnerable to Cross-Site Scripting (XSS)6.5 Medium
- averta depicter slider, depicter — popup & slider builder +1 moreDepicter Slider – Responsive Image Slider, Video Slider & Post Slider <= 2.0.6 - Cross-Site Request Forgery via save4.3 Medium
- zte zxcloud iraiDLL Hijacking Vulnerability in ZTE ZXCLOUD iRAI3.9 Low
- debian cpioDebian's cpio contains a path traversal vulnerability. This issue was introduced by reverting CVE...4.9 Medium
- chendotjs lotos webserverLotos WebServer through 0.1.1 (commit 3eb36cc) has a use-after-free in buffer_avail() at buffer.h...9.8 Critical
- alekseykurepin pico http server in croute in main.c in Pico HTTP Server in C through f3b69a6 has an sprintf stack-based buffer...9.8 Critical
- hayyp cherryhandle_request in http.c in cherry through 4b877df has an sscanf stack-based buffer overflow via...9.8 Critical
- firefly-iii firefly iiiFirefly III allows webhooks HTML Injection.6.1 Medium
- pycryptodome, pycryptodome pycryptodomex +1 morePyCryptodome and pycryptodomex side-channel leakage for OAEP decryption5.9 Medium
- tinowagner jupyter notebook viewernbviewer-app (aka Jupyter Notebook Viewer) before 0.1.6 has the get-task-allow entitlement for...9.8 Critical
- tenda i29 firmwareBuffer Overflow vulnerability in Tenda i29 versions 1.0 V1.0.0.5 and 1.0 V1.0.0.2, allows remote...7.5 High
- buy-addons bazoom magnifierSQL Injection vulnerability in Buy Addons baproductzoommagnifier module for PrestaShop versions 1...9.8 Critical
- lynchjames obsidian mind map, obsidian-mindmap +1 moreObsidian Mind Map v1.1.0 allows attackers to execute arbitrary code via a crafted payload...6.1 Medium
- irfanview b3dIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+1cbf heap-based out-of-bounds write.9.8 Critical
- irfanview b3dIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+214f heap-based out-of-bounds write.9.8 Critical
- irfanview b3dIrfanView B3D PlugIns before version 4.56 has a B3d.dll!+27ef heap-based out-of-bounds write.9.8 Critical
- github view componentview_component Cross-site Scripting vulnerability6.1 Medium
- debian linux, linux kernel, fedoraproject fedora +4 more +6 moreKernel: aoe: improper reference count leads to use-after-free vulnerability7.0 High
- class.upload.phpStored XSS in class.upload.php5.4 Medium
- sidequestvr sidequestOne-click remote code execution via malicious deep link8.8 High
- ocsinventory, ocsinventory-ng ocsinventory-ocsreports +1 moreOCSInventory-ocsreports 2.12.0 - Stored cross-site Scripting6.9 Medium
- kashipara travel websiteTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara travel websiteTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara travel websiteTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara travel websiteTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara travel websiteTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara travel websiteTravel Website v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara online notice board systemOnline Notice Board System v1.0 - Insecure File Upload8.8 High
- kashipara online notice board systemOnline Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara online notice board systemOnline Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara online notice board systemOnline Notice Board System v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara billing softwareBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara billing softwareBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara billing softwareBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara billing softwareBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara billing softwareBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara billing softwareBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara billing softwareBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- kashipara billing softwareBilling Software v1.0 - Multiple Unauthenticated SQL Injections (SQLi)9.8 Critical
- siemens syngo fastviewA vulnerability has been identified in syngo fastView (All versions). The affected application...7.8 High
- Show moreLoading…