CVEs published in January 2024
2,664 vulnerabilities, 306 critical, 14 exploited.
- infornweb posts list designer by category – list category posts or recent posts, posts list designer by category +1 moreWordPress Posts List Designer by Category – List Category Posts Or Recent Posts Plugin <= 3.3.2 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- dearhive dearpdf, pdf viewer & 3d pdf flipbook – dearpdf +1 moreWordPress PDF Viewer & 3D PDF Flipbook – DearPDF Plugin <= 2.0.38 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- bplugins pdf poster – pdf embedder plugin for wordpress, pdf poster +1 moreWordPress PDF Poster - PDF Embedder Plugin for WordPress Plugin <= 2.1.17 is vulnerable to Cross Site Scripting (XSS)7.1 High
- progress telerik test studioPrivilege Elevation via Telerik Test Studio7.8 High
- progress telerik reportingPrivilege Elevation via Telerik Reporting Installer7.8 High
- progress telerik justdecompilePrivilege Elevation via Telerik JustDecompile Installer7.8 High
- codeastro real estate management systemCodeAstro Real Estate Management System Feedback Form profile.php cross site scripting3.5 Low
- droitthemes droit elementor addons – widgets, blocks, templates library for elementor builder, droit elementor addons +1 moreWordPress Droit Elementor Addons Plugin <= 3.1.5 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- cozmoslabs profile builder pro, profile builder +1 moreWordPress Profile Builder Pro Plugin <= 3.10.0 is vulnerable to Cross Site Request Forgery (CSRF)8.8 High
- angus johnson resource hackerBuffer Overflow Vulnerability in Resource Hacker7.3 High
- devolutions remote desktop managerCross-site scripting (XSS) vulnerability in the entry overview tab in Devolutions Remote Desktop...5.4 Medium
- wp spell check spell check, wpspellcheck +1 moreWordPress WP Spell Check Plugin <= 9.17 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- eset endpoint antivirus, endpoint security, internet security +9 more +11 moreUnquoted path privilege vulnerability in ESET products for Windows3.3 Low
- elise bosse frontpage managerWordPress Frontpage Manager Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- marco milesi browser theme colorWordPress Browser Theme Color Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- borbis freshmail for wordpressWordPress FreshMail For WordPress Plugin <= 2.3.2 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- debian linux, linux kernel, fedoraproject fedora +15 more +17 moreUse-after-free in Linux kernel's netfilter: nf_tables component7.8 High
- linux kernelUse-after-free in Linux kernel's netfilter: nf_tables component7.8 High
- ludek better anchor linksWordPress Better Anchor Links Plugin <= 1.7.5 is vulnerable to Cross Site Request Forgery (CSRF)7.1 High
- abozain,o7abeeb,unitone custom dashboard widgets, custom dashboard widgets project dashboard widgets +1 moreWordPress Custom Dashboard Widgets Plugin <= 1.3.1 is vulnerable to Cross Site Request Forgery (CSRF)7.1 High
- instawp connectWordPress InstaWP Connect plugin <= 0.1.0.9 - SQL Injection vulnerability8.5 High
- ali forms contact form builder with drag & drop for wordpress – kali forms, kaliforms kali forms +1 moreWordPress Contact Form builder with drag & drop - Kali Forms Plugin <= 2.3.36 is vulnerable to Insecure Direct Object References (IDOR)7.5 High
- ruifang-tech rebuildRebuild read-raw getFileOfData cross site scripting3.5 Low
- ruifang-tech rebuildRebuild proxy-download QiniuCloud.getStorageFile information disclosure4.3 Medium
- areal sas webserv1Cross site scripting vulnerability in AREAL SAS Webserv1 ASP Web Site5.4 Medium
- areal sas topkapi vision (server), areal-topkapi vision server +1 moreImproper Certificate Validation in AREAL Topkapi Vision (Server)6.5 Medium
- apache servicecomb, apache software foundation servicecomb service-center +1 moreApache ServiceComb Service-Center: attacker can perform SSRF through the frontend API7.6 High
- apache servicecomb, apache software foundation servicecomb service-center +1 moreApache ServiceComb Service-Center: attacker can query all environment variables of the service-center server5.8 Medium
- radiustheme review schema, techlabpro1 review schema – review & structure data schema plugin +1 moreWordPress Review & Structure Data Schema Plugin – Review Schema <= 2.1.14 - Missing Authorization to Arbitrary Review Update4.3 Medium
- wanhu ezofficeWanhu ezOFFICE wf_printnum.jsp sql injection6.3 Medium
- spring cloud contract, vmware spring cloud contract +1 moreSpring Cloud Contract vulnerable to local information disclosure3.3 Low
- opensc project opensc, red hat enterprise linux 7, enterprise linux 8 +11 more +13 moreOpensc: side-channel leaks while stripping encryption pkcs#1 padding5.6 Medium
- opencryptoki project opencryptoki, red hat enterprise linux 6, enterprise linux 7 +6 more +8 moreOpencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin)5.9 Medium
- userproplugin userproThe UserPro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'userpro'...6.4 Medium
- crmperks database for contact form 7, wpforms, elementor forms, database for contact form 7\, wpforms\, elementor forms +1 moreContact Form Entries <= 1.3.2 - Authenticated (Administrator+) Arbitrary File Upload7.2 High
debian-security-supportDebiandebian-security-support - security updateNo score- arm mbed tlsInteger Overflow vulnerability in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2, allows...7.5 High
- notion web clipperIn Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can...9.8 Critical
- arm mbed tlsAn issue was discovered in Mbed TLS 2.x before 2.28.7 and 3.x before 3.5.2. There was a timing...5.5 Medium
- poscmsStored Cross-Site Scripting (XSS) vulnerability in POSCMS v4.6.2, allows attackers to execute...5.4 Medium
- curlOCSP verification bypass with TLS session reuse5.3 Medium
- schlix cmsAn arbitrary file upload vulnerability in Schlix CMS v2.2.8-1, allows remote authenticated...7.2 High
- sparxsystems enterprise architectSQL injection vulnerability in Enterprise Architect 16.0.1605 32-bit allows attackers to run...9.8 Critical
- discourseDiscourse improperly sanitized user input leads to XSS6.3 Medium
- google chrome, fedoraproject fedora +1 moreUse after free in Network in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in Canvas in Google Chrome prior to 121.0.6167.139 allowed a remote attacker to...8.8 High
- google chrome, fedoraproject fedora +1 moreUse after free in Peer Connection in Google Chrome prior to 121.0.6167.139 allowed a remote...8.8 High
- honeywell controledge uoc, controledge unit operations controller firmware, controledge virtual unit operations controller firmware +2 moreAn attacker could potentially exploit this vulnerability, leading to the ability to modify files...9.1 Critical
- tanstack query, react-query-next-experimental +1 morereact-query-streamed-hydration xss8.2 High
- vyperlang vyperraw_call `value=` kwargs not disabled for static and delegate calls4.8 Medium
- Show moreLoading…