CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- ypopsemail ypops\!The POP3 service in YahooPOPs (aka YPOPs!) 1.6 allows a remote denial of service (reboot) via a...7.5 High
- remyandrade school task managerSourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter.9.8 Critical
- remyandrade daily habit trackerSourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'7.2 High
- remyandrade login system with email verificationSourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user'...7.2 High
- remyandrade math gameThe 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1...6.1 Medium
- remyandrade product inventory with export to excelProduct Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory...6.1 Medium
- remyandrade online food menuSourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu...4.8 Medium
- modernasistemas modernanet hospital management system 2024The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure...7.5 High
- njtech greencmsA stored cross-site scripting (XSS) vulnerability in /install.php?m=install&c=index&a=step3 of...5.4 Medium
- lightcms project lightcmsLightCMS v2.0 is vulnerable to Cross Site Scripting (XSS) in the Content Management - Articles...5.4 Medium
- linux kernelThe IPv6 implementation in the Linux kernel before 6.3 has a net/ipv6/route.c max_size threshold...7.5 High
- meshcentralMeshCentral algorithm-downgrade issue7.5 High
- html-js doracmsDoraCMS 2.1.8 is vulnerable to Use of Hard-coded Cryptographic Key.9.8 Critical
- devicefarmer smartphone test farmDeviceFarmer stf uses DES-ECB9.1 Critical
- buffalo ls210d firmwareCommand injection in the ping utility on Buffalo LS210D 1.78-0.03 allows a remote authenticated...7.2 High
- issabel pbxIssabel PBX Asterisk-Cli os command injection4.7 Medium
- appleple a-blog cms, appleple inc. a-blog cms ver.3.1.x series, a-blog cms ver.2.10.x series +2 more +4 moreCross-site scripting vulnerability exists in a-blog cms Ver.3.1.x series versions prior to Ver.3...5.4 Medium
- linux kernel, fedora, red hat enterprise linux 6 +4 more +6 moreKernel: icmpv6 router advertisement packets, aka linux tcp/ip remote code execution vulnerability7.5 High
- linux kernel, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreKernel: hugetlbfs: null pointer dereference in hugetlbfs_fill_super function6.6 Medium
- notionAn issue in Notion for macOS version 3.1.0 and before, allows remote attackers to execute...3.3 Low
- loomAn issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute...9.8 Critical
- hyperAn issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary...9.8 Critical
- getkap kapAn issue in Kap for macOS version 3.6.0 and before, allows remote attackers to execute arbitrary...9.8 Critical
- discordAn issue in Discord for macOS version 0.0.291 and before, allows remote attackers to execute...9.8 Critical
- postmanAn issue in Postman version 10.22 and before on macOS allows a remote attacker to execute...9.8 Critical
- libcoapobgm libcoap Configuration File coap_oscore.c get_split_entry stack-based overflow6.3 Medium
- flink-extended ai-flow, aiflow +1 moreflink-extended ai-flow workflow_command.py cloudpickle.loads deserialization5.0 Medium
- standford gibsonenvStanfordVL GibsonEnv pposgd_fuse.py cloudpickle.load deserialization5.0 Medium
- codeastro stock management systemCodeAstro Stock Management System Add Category index.php cross site scripting3.5 Low
- fluentforms contact form, techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builder +1 moreFluent Forms <= 5.1.5 - Authenticated(Administrator+) Stored Cross-Site Scripting via imported form title4.4 Medium
- devscred exclusive addons for elementorExclusive Addons for Elementor <= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Link Anything6.4 Medium
- softaculous backuply, backuply – backup, restore, migrate and clone +1 moreBackuply – Backup, Restore, Migrate and Clone <= 1.2.3 - Authenticated (Administrator+) Directory Traversal6.5 Medium
- 10web form maker by 10web – mobile-friendly drag & drop contact form builder, form maker +1 moreForm-Maker (twb_form-maker) <= 1.15.21 - Cross-Site Request Forgery to Limited Code Execution via Execute5.4 Medium
- mekshq meks smart social widgetMeks Smart Social Widget <= 1.6.3 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- mra13 simple shopping cart, tipsandtricks-hq wordpress simple paypal shopping cart +1 moreWordPress Simple Shopping Cart <= 4.7.1 - Authenticated(Administrator+) Stored Cross-Site Scripting4.4 Medium
- synaptics fingerprint driverEncryption key derived from static host information5.2 Medium
- ffmpegInteger overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute...9.8 Critical
- ffmpegInteger overflow vulnerability in FFmpeg before n6.1, allows attackers to cause a denial of...7.5 High
- ffmpegInteger overflow vulnerability in FFmpeg before n6.1, allows remote attackers to execute...9.8 Critical
- gstreamerGStreamer AV1 Video Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability7.5 High
- pocoproject pocoUTF32Encoding.cpp in POCO has a Poco::UTF32Encoding integer overflow and resultant stack buffer...9.8 Critical
- sunlight-cms sunlight cmsCross-Site Scripting (XSS) vulnerability in Sunlight CMS 8.0.1 allows an authenticated low...5.4 Medium
- sunlight-cms sunlight cmsCross Site Scripting (XSS) vulnerability in Sunlight CMS v.8.0.1, allows remote authenticated...5.4 Medium
- instawp connectWordPress InstaWP Connect plugin <= 0.1.0.9 - Sensitive Data Exposure vulnerability7.7 High
- wp overnight pdf invoices & packing slips for woocommerce, wpovernight woocommerce pdf invoices\& packing slips +1 moreWordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.7.5 is vulnerable to SQL Injection7.6 High
- delhivery logistics courierWordPress Delhivery Logistics Courier Plugin <= 1.0.107 is vulnerable to SQL Injection8.5 High
- imagesourcecontrol image source control, thomas maier image source control lite – show image credits and captions +1 moreWordPress Image Source Control Plugin <= 2.17.0 is vulnerable to Sensitive Data Exposure5.3 Medium
- netboxNetBox Home Page Configuration config-revisions cross site scripting2.4 Low
- 60indexpage project 60indexpage60IndexPage Parameter index.php server-side request forgery7.3 High
- 60indexpage project 60indexpage60IndexPage Parameter file.php server-side request forgery7.3 High
- Show moreLoading…