CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreNULL pointer deference in rfcomm_check_security in Linux kernel6.3 Medium
- linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +1 moreInteger overflow in raid5_cache_count in Linux kernel4.4 Medium
- openssl, siemens sidis prime, simatic s7-1500 tm mfp - gnu/linux subsystem +1 more +3 morePKCS12 Decoding crashes5.5 Medium
- syam mohan wpfront notification bar, wpfront notification bar +1 moreWPFront Notification Bar <= 3.3.2 - Authenticated (Admin+) Stored Cross-Site Scripting via wpfront-notification-bar-options[custom_class]4.4 Medium
- joshfraz websub (fka. pubsubhubbub), pubsubhubbub websub +1 moreWebSub (FKA. PubSubHubbub) <= 3.1.4 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- strangerstudios paid memberships pro – content restriction, user registration, & paid subscriptions, paid memberships pro +1 morePaid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update5.3 Medium
- quanticedgesolutions category discount woocommerce, vidishp simple discount rules for woocommerce +1 moreCategory Discount Woocommerce <= 4.12 - Missing Authorization via wpcd_save_discount()5.3 Medium
simdutfOSS-FuzzHeap-buffer-overflow in simdutf::westmere::implementation::convert_utf8_to_utf32No scorelibredwgOSS-FuzzHeap-buffer-overflow in json_HEADERNo score- lepton-cms leptoncmsAn arbitrary file upload vulnerability in LeptonCMS v7.0.0 allows authenticated attackers to...7.2 High
- ezhometech ezserverEzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the...7.5 High
- plone docker official imageAn issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code...6.1 Medium
- projectworlds visitor management systemAn issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to...9.8 Critical
- gpacGPAC v2.3 was detected to contain a buffer overflow via the function...7.8 High
- netis-systems mw5360 firmwareNETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via...9.8 Critical
- igalerieiGalerie v3.0.22 was discovered to contain a reflected cross-site scripting (XSS) vulnerability...6.1 Medium
- livesiteliveSite v2019.1 was discovered to contain a remote code execution (RCE) vulenrabiity via the...9.8 Critical
- formtools form toolsForm Tools v3.1.1 was discovered to contain a reflected cross-site scripting (XSS) vulnerability...6.1 Medium
- pluxmlPluXml Blog v5.8.9 was discovered to contain a remote code execution (RCE) vulnerability in the...8.8 High
- webcalendar project webcalendarWebCalendar v1.3.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability...6.1 Medium
- totolink x2000r, x2000r firmware +1 moreTOTOLINK X2000R_V2 V2.0.0-B20230727.10434 has a command injection vulnerability in the sub_449040...9.8 Critical
- provectus uiAn issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages. No fixed release is…8.8 High
- webminCross Site Scripting vulnerability (XSS) in webmin v.2.105 and earlier allows a remote attacker...4.8 Medium
- trendnet tew-411brpplus firmwareA command injection issue in TRENDnet TEW-411BRPplus v.2.07_eu that allows a local attacker to...8.1 High
- zohocorp manageengine adaudit plusZoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary...2.7 Low
- ivanti avalancheDirectory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated...6.5 Medium
- splicecom maximiser soft pbxSpliceCom Maximiser Soft PBX v1.5 and before was discovered to utilize a default SSL certificate....5.3 Medium
- splicecom maximiser soft pbxSpliceCom Maximiser Soft PBX v1.5 and before does not restrict excessive authentication attempts,...9.8 Critical
- splicecom maximiser soft pbxSplicecom Maximiser Soft PBX v1.5 and before was discovered to contain a cross-site scripting ...6.1 Medium
- splicecom ipcs, ipcs2 +1 moreA lack of SSL certificate validation in Splicecom iPCS (iOS App) v1.3.4, iPCS2 (iOS App) v2.8 and...5.9 Medium
- pimcore admin classic bundle, admin-ui-classic-bundle +1 morePimcore Admin Classic Bundle SQL Injection in Admin download files as zip8.8 High
- join-lemmy lemmyAny authenticated user may obtain private message details from other users on the same instance7.5 High
- pimcore admin classic bundle, admin-ui-classic-bundle +1 morePimcore Admin Classic Bundle host header injection in the password reset8.8 High
- jenkins red hat dependency analytics, jenkins project red hat dependency analytics plugin +1 moreContent-Security-Policy disabled by Red Hat Dependency Analytics Jenkins Plugin5.4 Medium
- jenkins log command, jenkins project log command plugin +1 moreArbitrary file read vulnerability in Jenkins Log Command Plugin7.5 High
- jenkins project gitlab branch source plugin, jenkins github branch source +1 moreNon-constant time webhook token comparison in Jenkins GitLab Branch Source Plugin5.3 Medium
- jenkins project gitlab branch source plugin, jenkins github branch source +1 moreCSRF vulnerability in Jenkins GitLab Branch Source Plugin4.3 Medium
- jenkins project gitlab branch source plugin, jenkins github branch source +1 moreShared projects are unconditionally discovered by Jenkins GitLab Branch Source Plugin6.5 Medium
- jenkins matrix project, jenkins project matrix project plugin +1 morePath traversal vulnerability in Jenkins Matrix Project Plugin4.3 Medium
- jenkins git server, jenkins project git server plugin +1 moreArbitrary file read vulnerability in Git server Plugin can lead to RCE6.5 Medium
- jenkinsCross-site WebSocket hijacking vulnerability in the Jenkins CLI8.8 High
- jenkins, jenkins command line interface (cli) +1 moreArbitrary file read vulnerability through the Jenkins CLI can lead to RCE9.8 Critical
- dell unity, unity operating environment, unity xt operating environment +1 more +3 moreDell Unity, versions prior to 5.4, contain a vulnerability whereby log messages can be spoofed...3.1 Low
- swift mailer project mailer, drupal swift mailer (abandoned) +1 moreSwift Mailer - Moderately critical - Access bypass - SA-CONTRIB-2024-0069.1 Critical
- drupal open socialOpen Social - Moderately critical - Information Disclosure - SA-CONTRIB-2024-0059.1 Critical
- drupal open socialOpen Social - Moderately critical - Access bypass - SA-CONTRIB-2024-0047.5 High
- drupal two-factor authentication (tfa), two-factor authentication project authentication +1 moreTwo-factor Authentication (TFA) - Moderately critical - Access bypass - SA-CONTRIB-2024-0039.8 Critical
- dell pairDell Pair Installer version prior to 1.2.1 contains an elevation of privilege vulnerability. A...6.6 Medium
- cozmoslabs profile builder pro, profile builder +1 moreWordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Sensitive Data Exposure6.5 Medium
- svelte adapter-node, kit +1 moreSending a GET or HEAD request with a body crashes SvelteKit7.5 High
- Show moreLoading…