CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- openbiopenBI Icon Screen.php uploadIcon unrestricted upload7.3 High
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability6.5 Medium
- nearform urqlXSS in @urql/next7.2 High
- apollographql apollo-client-nextjs, apollo client +1 moreXSS in @apollo/experimental-nextjs-app-support8.2 High
- splunk add-on builderSensitive Information Disclosure to Internal Log Files in Splunk Add-on Builder8.2 High
- splunk add-on builderSession Token Disclosure to Internal Log Files in Splunk Add-on Builder8.8 High
- latchset pkcs11-provider, fedora +1 morePkcs11-provider: side-channel proofing pkcs#1 1.5 paths8.1 High
- crate, cratedb +1 moreCrateDB database has an arbitrary file read vulnerability5.7 Medium
- goreleaser`goreleaser release --debug` shows secrets5.5 Medium
- truelayer truelayer-dotnet, truelayer.net +1 moreTrueLayer.Client SSRF when fetching payment or payment provider8.6 High
github.com/bincyber/go-sqlcrypterGoIV collision in github.com/bincyber/go-sqlcrypterNo score- tablepressTablePress SSRF vulnerability due to insufficient filtering of cloud provider hosts3.0 Low
- owasp modsecurityWAF bypass of the ModSecurity v3 release line8.6 High
- openbiopenBI Icon.php uploadIcon unrestricted upload7.3 High
- vantage6 vantage6-uivantage6-UI docker image leaks software version information3.3 Low
- vantage6vantage6 unencrypted task can be created in encrypted collaboration3.5 Low
- vantage6vantage6 username timing attack3.7 Low
- vantage6vantage6 insecure SSH configuration for node and server containers6.5 Medium
- vantage6Remote code execution8.8 High
- hcl software bigfix servicenow data flowA code injection vulnerability affects HCL BigFix ServiceNow Data Flow6.4 Medium
- linux kernel, red hat enterprise linux 6, enterprise linux 7 +3 more +5 moreKernel: max page sharing of kernel samepage merging (ksm) may cause memory deduplication5.3 Medium
- openbi project openbiopenBI File.php uploadFile unrestricted upload7.3 High
- openbi project openbiopenBI Datament.php agent information disclosure4.3 Medium
- openbi project openbiopenBI Test Connection Databasesource.php testConnection deserialization7.3 High
- xen, fedoraproject fedora +1 moreVT-d: Failure to quarantine devices in !HVM builds4.1 Medium
- fedoraproject fedora, xen +1 morepci: phantom functions assigned to incorrect contexts5.3 Medium
- codeastro expense management systemCodeAstro Expense Management System Add Expenses Page 5-Add-Expenses.php cross site scripting3.5 Low
xorg-serverUbuntu,xwaylandUbuntu +1 morexorg-server, xwayland regressionNo score- lamassu bitcoin atm douro machines, douro firmware, douro ii firmware +2 moreWeak password requirement vulnerability in Lamassu Bitcoin ATM Douro machines5.6 Medium
- lamassu bitcoin atm douro machines, douro firmware, douro ii firmware +2 moreImproper checking for unusual or exceptional conditions vulnerability in Lamassu Bitcoin ATM Douro machines6.3 Medium
- lamassu bitcoin atm douro machines, douro firmware, douro ii firmware +2 morePrivilege escalation vulnerability in Lamassu Bitcoin ATM Douro machines6.3 Medium
- cogites ereservCogites eReserv tenancyDetail.php cross site scripting3.5 Low
- appwriteAppwrite <= v1.4.13 is affected by a Server-Side Request Forgery (SSRF) via the '/v1/avatars...5.3 Medium
- mitsubishi electric corporation ezsocket, gt designer3 version1(got1000), gt designer3 version1(got2000) +10 more +12 moreUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability...9.8 Critical
- mitsubishi electric corporation ezsocket, gt designer3 version1(got1000), gt designer3 version1(got2000) +10 more +12 moreMissing Authentication for Critical Function vulnerability in Mitsubishi Electric Corporation...7.5 High
- mitsubishi electric corporation melsec ws series ws0-geth00200, mitsubishielectric melsec ws0-geth00200 firmware +1 moreAuthentication Bypass by Capture-replay vulnerability in Mitsubishi Electric Corporation MELSEC...5.9 Medium
- bplugins html5 video playerThe 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL...8.6 High
- chrisvrichardson mappress maps for wordpress, mappresspro mappress +1 moreMapPress <= 2.88.16 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Settings6.4 Medium
- linux kernelPossible UAF in bt_accept_poll in Linux kernel3.5 Low
- graphvizGraphviz 2.36 before 10.0.0 has an out-of-bounds read via a crafted config6a file. NOTE:...7.8 High
- cogites ereservCogites eReserv tenancyDetail.php cross site scripting3.5 Low
- cloudburstmc networknetwork Arbitrary Command Injection vulnerability7.3 High
- oretnom23 facebook news feed likeSourceCodester Facebook News Feed Like Post cross site scripting3.5 Low
- oretnom23 facebook news feed likeSourceCodester Facebook News Feed Like Post unrestricted upload6.3 Medium
- hitachi storage plug-in for vmware vcenter, storage plug-in +1 moreDirectory and File Permission Vulnerability in Hitachi Storage Plug-in for VMware vCenter7.9 High
- cogites ereservCogites eReserv config.php cross site scripting3.5 Low
- zyxel nas326 firmware, nas542 firmware +1 moreThe post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through...7.2 High
- oretnom23 facebook news feed likeSourceCodester Facebook News Feed Like New Account cross site scripting3.5 Low
- totolink a3300r firmwareTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection...9.8 Critical
- totolink a3300r firmwareTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection...9.8 Critical
- Show moreLoading…