CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- strangebee thehiveStrangeBee TheHive 5.1.0 to 5.1.9 and 5.2.0 to 5.2.8 is vulnerable to Cross Site Scripting (XSS)...5.4 Medium
- openvswitchopenvswitch 2.17.8 was discovered to contain a memory leak via the function xmalloc__ in...7.5 High
- swftoolsswftools 0.9.2 was discovered to contain a Stack Buffer Underflow via the function...7.8 High
- actidata actinas sl 2u-8 rdx firmwareA Site-wide directory listing vulnerability in /fm in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1...7.5 High
- actidata actinas sl 2u-8 rdx firmwareImproper access control on nasSvr.php in actidata actiNAS SL 2U-8 RDX 3.2.03-SP1 allows remote...9.1 Critical
- actidata actinas sl 2u-8 rdx firmwareMultiple reflected cross-site scripting (XSS) vulnerabilities in nasSvr.php in actidata actiNAS...6.1 Medium
- dom96 httpbeastAn issue in dom96 HTTPbeast v.0.4.1 and before allows a remote attacker to execute arbitrary code...9.8 Critical
- jester project jesterAn issue in dom96 Jester v.0.6.0 and before allows a remote attacker to execute arbitrary code...9.8 Critical
- joommasters jmssettingIn the module "Jms Setting" (jmssetting) from Joommasters for PrestaShop, a guest can perform SQL...9.8 Critical
- prestashopmodules sliding cart blockIn the module "Sliding cart block" (blockslidingcart) up to version 2.3.8 from PrestashopModules...9.8 Critical
- anomali matchAnomali Match before 4.6.2 allows OS Command Injection. An authenticated admin user can inject...7.2 High
- etherscan reptilian coinRPTC 0x3b08c was discovered to not conduct status checks on the parameter tradingOpen. This...7.5 High
- uniswapfrontrunbot project uniswapfrontrunbotA vulnerability in UniswapFrontRunBot 0xdB94c allows attackers to cause financial losses via...7.5 High
- multisigwallet project multisigwalletMultiSigWallet 0xF0C99 was discovered to contain a reentrancy vulnerability via the function...7.5 High
- mypresta manufacturers \(brands\) images blockIn the module mib < 1.6.1 from MyPresta.eu for PrestaShop, a guest can perform SQL injection. The...9.8 Critical
- sunnytoo stblogsearchSunnyToo stblogsearch up to v1.0.0 was discovered to contain a SQL injection vulnerability via...9.8 Critical
- cohesity dataplatformCohesity DataProtect 6.8.1 and 6.6.0d was discovered to have a incorrect access control...6.5 Medium
- xpand-it write-back managerAn arbitrary file upload vulnerability in Xpand IT Write-back Manager v2.3.1 allows attackers to...9.8 Critical
- atrocore atropimAtroCore AtroPIM Product Series Overview cross site scripting3.5 Low
- easy chat server project chat server, efs easy chat server +1 moreEFS Easy Chat Server HTTP GET Request denial of service4.3 Medium
- efs easy file sharing ftp, easy file sharing ftp server project file sharing ftp server +1 moreEFS Easy File Sharing FTP denial of service5.3 Medium
- delta electronics dopsoftDelta Electronics Delta Industrial Automation DOPSoft DPS File wTitleTextLen Buffer Overflow Remote Code Execution8.8 High
- delta electronics dopsoftDelta Electronics Delta Industrial Automation DOPSoft DPS File wTTitleLen Buffer Overflow Remote Code Execution8.8 High
- delta electronics dopsoftDelta Electronics Delta Industrial Automation DOPSoft DPS File wLogTitlesTimeLen Buffer Overflow Remote Code Execution8.8 High
- delta electronics dopsoftDelta Electronics Delta Industrial Automation DOPSoft DPS File wLogTitlesActionLen Buffer Overflow Remote Code Execution8.8 High
- delta electronics dopsoftDelta Electronics Delta Industrial Automation DOPSoft DPS File wLogTitlesPrevValueLen Buffer Overflow Remote Code Execution8.8 High
- delta electronics dopsoftDelta Electronics Delta Industrial Automation DOPSoft DPS File InitialMacroLen Buffer Overflow Remote Code Execution8.8 High
- delta electronics dopsoftDelta Electronics Delta Industrial Automation DOPSoft DPS File wTextLen Buffer Overflow Remote Code Execution8.8 High
- delta electronics dopsoftDelta Electronics Delta Industrial Automation DOPSoft DPS File wMailContentLen Buffer Overflow Remote Code Execution7.5 High
- delta electronics dopsoftDelta Electronics Delta Industrial Automation DOPSoft DPS File wKPFStringLen Buffer Overflow Remote Code Execution6.3 Medium
- delta electronics dopsoftDelta Electronics Delta Industrial Automation DOPSoft DPS File wScreenDESCTextLen Buffer Overflow Remote Code Execution7.1 High
- delta electronics ispsoftDelta Electronics ISPSoft Heap Buffer-Overflow8.2 High
- delta electronics wplsoftDelta Electronics WPLSoft Buffer-Overflow8.2 High
- group-office group office, intermesh groupoffice +1 moreStored Cross-site Scripting Vulnerability via Malicious File Names in GroupOffice6.5 Medium
- nextcloud guests, kiteworks security-advisories +1 moreImproper handling of request URLs in Nextcloud Guests app allows guest users to bypass app allowlist5.4 Medium
- nextcloud guests, kiteworks security-advisories +1 moreAll users can reset the allowed apps list for Nextcloud Guest App users4.1 Medium
- kiteworks security-advisories, nextcloud zipper +1 morePermissions bypass in Nextcloud with the files zip app4.1 Medium
- nextcloud server, kiteworks security-advisories +1 moreOAuth2 authorization codes are valid indefinetly in Nextcloud server3.0 Low
- kiteworks security-advisories, nextcloud sso \& saml authentication +1 moreOpen redirect in user_saml via RelayState parameter in Nextcloud User Saml3.1 Low
- nextcloud deck, kiteworks security-advisories +1 moreCross-site Scripting when sending HTML as a comment in the Nextcloud Deck app0.0 None
- nextcloud global site selector, kiteworks security-advisories +1 moreNextcloud global site selector authentication bypass9.7 Critical
- vyperlang vyperconcat built-in can corrupt memory in vyper7.3 High
- aveva pi serverImproper Check or Handling of Exceptional Conditions in Aveva PI Server7.5 High
- aveva pi serverMissing Release of Resource after Effective Lifetime vulnerability in Aveva PI Server5.3 Medium
- skoda auto connect, skoda-auto skoda connect +1 moreTrip Data Disclosure from Backend5.3 Medium
- skoda-auto skoda connect, škoda auto connect +1 moreNickname Disclosure on the Backend Automotive Server5.3 Medium
- jupyter language server protocol integration, jupyter-lsp jupyterlab-lsp +1 moreUnsecured endpoints in the jupyter-lsp server extension7.3 High
- surrealdbSurrealDB before 1.1.0 Uncontrolled Recursion Denial of Service7.1 High
- surrealdbSurrealDB before 1.1.0 Denial of Service via HTTP Headers8.7 High
- surrealdbSurrealDB before 1.1.1 Denial of Service via Global Parameters7.1 High
- Show moreLoading…