CVE-2024 records published in January 2024
Page two of two: records 1,001 to 1,130 of the 1,130 published in January 2024, newest first. The first page carries the figures for January 2024.
| CVE | Summary | CVSS | EPSS | Published | Signals |
|---|---|---|---|---|---|
| CVE-2024-0342 | Inis Sqlite.php SQL injection | 9.8v3.1 | 0.6% | 2024-01-09 | |
| CVE-2024-0341 | Inis GET Request File.php path traversal | 7.5v3.1 | 0.6% | 2024-01-09 | |
| CVE-2024-0340 | Kernel: Information disclosure in vhost/vhost.c:vhost_new_msg | 5.5NVD v3.1 | 0.2% | 2024-01-09 | Fix |
| CVE-2024-0226 | Stored cross-site scripting in Synopsys Seeker | 5.4v3.1 | 0.3% | 2024-01-09 | Fix |
| CVE-2024-0213 | Trellix Agent (TA) buffer overflow | 8.2CNA v3.1 | 0.2% | 2024-01-09 | Fix |
| CVE-2024-0206 | Trellix Anti-Malware Engine link following | 7.1CNA v3.1 | 0.2% | 2024-01-09 | Fix |
| CVE-2024-0057 | Microsoft NET, .NET Framework, and Visual Studio security feature bypass | 9.1CNA v3.1 | 2.8% | 2024-01-09 | Fix |
| CVE-2024-0056 | Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider security feature bypass | 8.7CNA v3.1 | 1.2% | 2024-01-09 | Fix |
| CVE-2024-22216 | Microchip Maxview Storage Manager unauthorized access | 10.0v3.1 | 0.5% | 2024-01-08 | Fix |
| CVE-2024-21747 | WP ERP WordPress plugin SQL injection | 4.9NVD v3.1 | 0.6% | 2024-01-08 | Fix |
| CVE-2024-21745 | Laybuy Payment Extension for WooCommerce WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.4% | 2024-01-08 | |
| CVE-2024-21744 | Mapster WP Maps WordPress plugin cross-site scripting (XSS) | 5.4v3.1 | 0.3% | 2024-01-08 | Fix |
| CVE-2024-21650 | XWiki remote code execution vulnerability via user registration | 10.0CNA v3.1 | 93.5% | 2024-01-08 | NucleiFix |
| CVE-2024-21647 | HTTP Request/Response Smuggling in puma | 5.9CNA v3.1 | 1.0% | 2024-01-08 | Fix |
| CVE-2024-21645 | pyLoad log injection | 5.3CNA v3.1 | 24.7% | 2024-01-08 | NucleiFix |
| CVE-2024-21644 | pyLoad unauthenticated flask configuration leakage | 7.5CNA v3.1 | 42.4% | 2024-01-08 | NucleiExploit codeFix |
| CVE-2024-0322 | Out-of-bounds read in gpac/gpac | 9.1v3.1 | 0.9% | 2024-01-08 | Fix |
| CVE-2024-0321 | Stack-based buffer overflow in gpac/gpac | 9.8v3.1 | 1.0% | 2024-01-08 | Fix |
| CVE-2024-0308 | Inis Proxy.php server-side request forgery | 8.8v3.1 | 0.5% | 2024-01-08 | |
| CVE-2024-0307 | Kashipara Dynamic Lab Management System login_process.php SQL injection | 7.5v3.1 | 0.7% | 2024-01-08 | |
| CVE-2024-0306 | Kashipara Dynamic Lab Management System admin_login_process.php SQL injection | 7.5v3.1 | 0.7% | 2024-01-08 | |
| CVE-2024-0305 | Guangzhou Yingke Electronic Technology Ncast Guest Login IPSetup.php information disclosure | 7.5v3.1 | 66.9% | 2024-01-08 | NucleiEmerging ThreatsExploit code |
| CVE-2024-0304 | Youke365 collect.php server-side request forgery | 9.8v3.1 | 0.5% | 2024-01-08 | |
| CVE-2024-0303 | Youke365 parameter caiji.php server-side request forgery | 9.8v3.1 | 0.5% | 2024-01-08 | |
| CVE-2024-0302 | fhs-opensource iparking vueLogin deserialization | 9.8v3.1 | 0.9% | 2024-01-08 | |
| CVE-2024-0301 | fhs-opensource iparking PayTempOrderAction.java getData SQL injection | 9.8v3.1 | 0.7% | 2024-01-08 | |
| CVE-2024-0300 | Byzoro Smart S150 Management Platform HTTP POST request userattestation.php unrestricted upload | 9.8v3.1 | 5.7% | 2024-01-08 | |
| CVE-2024-0299 | Totolink N200RE cstecgi.cgi setTracerouteCfg os command injection | 9.8v3.1 | 3.8% | 2024-01-08 | |
| CVE-2024-0298 | Totolink N200RE cstecgi.cgi setDiagnosisCfg os command injection | 9.8v3.1 | 3.8% | 2024-01-08 | |
| CVE-2024-0297 | Totolink N200RE cstecgi.cgi UploadFirmwareFile os command injection | 9.8v3.1 | 3.8% | 2024-01-08 | |
| CVE-2024-0296 | Totolink N200RE cstecgi.cgi NTPSyncWithHost os command injection | 9.8v3.1 | 3.8% | 2024-01-08 | |
| CVE-2024-0295 | Totolink LR1200GB cstecgi.cgi setWanCfg os command injection | 9.8v3.1 | 3.8% | 2024-01-08 | |
| CVE-2024-0294 | Totolink LR1200GB cstecgi.cgi setUssd os command injection | 9.8v3.1 | 3.8% | 2024-01-08 | |
| CVE-2024-0293 | Totolink LR1200GB cstecgi.cgi setUploadSetting os command injection | 9.8v3.1 | 4.8% | 2024-01-08 | |
| CVE-2024-0292 | Totolink LR1200GB cstecgi.cgi setOpModeCfg os command injection | 9.8v3.1 | 4.9% | 2024-01-08 | |
| CVE-2024-0291 | Totolink LR1200GB cstecgi.cgi UploadFirmwareFile command injection | 8.8v3.1 | 4.4% | 2024-01-08 | |
| CVE-2024-0290 | Kashipara Food Management System stock_edit.php SQL injection | 9.8v3.1 | 0.7% | 2024-01-08 | |
| CVE-2024-0289 | Kashipara Food Management System stock_entry_submit.php SQL injection | 9.8v3.1 | 0.6% | 2024-01-08 | |
| CVE-2024-0288 | Kashipara Food Management System rawstock_used_damaged_submit.php SQL injection | 9.8v3.1 | 0.7% | 2024-01-08 | |
| CVE-2024-0287 | Kashipara Food Management System itemBillPdf.php SQL injection | 9.8v3.1 | 0.7% | 2024-01-07 | |
| CVE-2024-0286 | PHPGurukul Hospital Management System Contact form index.php#contact_us cross-site scripting | 6.1v3.1 | 0.9% | 2024-01-07 | |
| CVE-2024-0284 | Kashipara Food Management System party_submit.php cross-site scripting | 6.1v3.1 | 0.5% | 2024-01-07 | |
| CVE-2024-0283 | Kashipara Food Management System party_details.php cross-site scripting | 6.1v3.1 | 0.6% | 2024-01-07 | |
| CVE-2024-0282 | Kashipara Food Management System addmaterialsubmit.php cross-site scripting | 6.1v3.1 | 0.9% | 2024-01-07 | |
| CVE-2024-0281 | Kashipara Food Management System loginCheck.php SQL injection | 6.5v3.1 | 0.5% | 2024-01-07 | |
| CVE-2024-0280 | Kashipara Food Management System item_type_submit.php SQL injection | 6.5v3.1 | 0.6% | 2024-01-07 | |
| CVE-2024-0279 | Kashipara Food Management System item_list_edit.php SQL injection | 6.5v3.1 | 0.6% | 2024-01-07 | |
| CVE-2024-0278 | Kashipara Food Management System partylist_edit_submit.php SQL injection | 6.5v3.1 | 0.6% | 2024-01-07 | |
| CVE-2024-0277 | Kashipara Food Management System party_submit.php SQL injection | 6.5v3.1 | 0.6% | 2024-01-07 | |
| CVE-2024-0276 | Kashipara Food Management System rawstock_used_damaged_smt.php SQL injection | 6.5v3.1 | 0.5% | 2024-01-07 | |
| CVE-2024-0275 | Kashipara Food Management System item_edit_submit.php SQL injection | 6.5v3.1 | 0.6% | 2024-01-07 | |
| CVE-2024-0274 | Kashipara Food Management System billAjax.php SQL injection | 6.5v3.1 | 0.5% | 2024-01-07 | |
| CVE-2024-0273 | Kashipara Food Management System addwaste_entry.php SQL injection | 6.5v3.1 | 0.6% | 2024-01-07 | |
| CVE-2024-0272 | Kashipara Food Management System addmaterialsubmit.php SQL injection | 6.5v3.1 | 0.5% | 2024-01-07 | |
| CVE-2024-0271 | Kashipara Food Management System addmaterial_edit.php SQL injection | 6.5v3.1 | 0.6% | 2024-01-07 | |
| CVE-2024-0270 | Kashipara Food Management System item_list_submit.php SQL injection | 6.5v3.1 | 0.6% | 2024-01-07 | |
| CVE-2024-0268 | Kashipara Hospital Management System registration.php SQL injection | 9.8v3.1 | 0.9% | 2024-01-07 | |
| CVE-2024-0267 | Kashipara Hospital Management System parameter login.php SQL injection | 9.8v3.1 | 0.7% | 2024-01-07 | |
| CVE-2024-0266 | Project Worlds Online Lawyer Management System User Registration cross-site scripting | 5.4v3.1 | 0.7% | 2024-01-07 | |
| CVE-2024-0265 | SourceCodester Clinic Queuing System GET parameter index.php file inclusion | 8.8v3.1 | 20.9% | 2024-01-07 | KCV |
| CVE-2024-0264 | SourceCodester Clinic Queuing System LoginRegistration.php authorization | 9.8v3.1 | 18.2% | 2024-01-07 | KCV |
| CVE-2024-0263 | ACME Ultra Mini HTTPd HTTP GET request denial of service | 7.5v3.1 | 1.4% | 2024-01-07 | |
| CVE-2024-0262 | Online Job Portal Create News Page News.php cross-site scripting | 4.8v3.1 | 0.5% | 2024-01-07 | |
| CVE-2024-0261 | Sentex FTPDMIN RNFR command denial of service | 7.5v3.1 | 1.3% | 2024-01-07 | |
| CVE-2024-0260 | SourceCodester Engineers Online Portal change_password_teacher.php insufficient session expiration | 7.5v3.1 | 0.5% | 2024-01-07 | |
| CVE-2024-22088 | Chendotjs Lotos Webserver use-after-free | 9.8v3.1 | 0.7% | 2024-01-05 | |
| CVE-2024-22087 | Alekseykurepin Pico HTTP Server In C out-of-bounds write | 9.8v3.1 | 1.6% | 2024-01-05 | |
| CVE-2024-22086 | Hayyp Cherry out-of-bounds write | 9.8v3.1 | 1.1% | 2024-01-05 | |
| CVE-2024-22075 | firefly-iii firefly III allows webhooks HTML injection | 6.1v3.1 | 0.3% | 2024-01-05 | Fix |
| CVE-2024-21642 | man-group dtale D-Tale server-side request forgery through Web uploads | 7.5CNA v3.1 | 0.7% | 2024-01-05 | Fix |
| CVE-2024-21641 | Flarum's Logout route allows open redirects | 6.5CNA v3.1 | 1.1% | 2024-01-05 | NucleiFix |
| CVE-2024-0247 | CodeAstro Online Food Ordering System Admin Panel SQL injection | 9.8v3.1 | 0.8% | 2024-01-05 | |
| CVE-2024-0246 | IceWarp Utility Download cross-site scripting | 6.1v3.1 | 0.4% | 2024-01-05 | |
| CVE-2024-22051 | CommonMarker integer overflow | 9.8v3.1 | 1.5% | 2024-01-04 | Fix |
| CVE-2024-22050 | Iodine Static File Server path traversal | 7.5v3.1 | 0.9% | 2024-01-04 | Fix |
| CVE-2024-22049 | httparty Multipart/Form-data request tampering | 5.3v3.1 | 1.3% | 2024-01-04 | Fix |
| CVE-2024-22048 | Govuk Tech Docs govuk_tech_docs XSS | 6.1v3.1 | 0.5% | 2024-01-04 | Fix |
| CVE-2024-22047 | Audited Log Integrity Errors due to race condition | 3.1v3.1 | 0.5% | 2024-01-04 | Fix |
| CVE-2024-21636 | view_component cross-site scripting | 6.1CNA v3.1 | 0.5% | 2024-01-04 | Fix |
| CVE-2024-21625 | SideQuestVR SideQuest one-click remote code execution via malicious deep link | 8.8CNA v3.1 | 0.8% | 2024-01-04 | Fix |
| CVE-2024-20809 | Samsung Mobile Nearby device scanning improper access control | 4.0CNA v3.1 | 0.1% | 2024-01-04 | Fix |
| CVE-2024-20808 | Samsung Mobile Nearby device scanning improper access control | 4.0CNA v3.1 | 0.1% | 2024-01-04 | Fix |
| CVE-2024-20807 | Implicit intent hijacking vulnerability in Samsung Email prior to version 6.1.90.16 allows local attacker to get sensitive information. | 3.3CNA v3.1 | 0.2% | 2024-01-04 | Fix |
| CVE-2024-20806 | Samsung Mobile Devices Notification service improper access control | 6.2CNA v3.1 | 0.1% | 2024-01-04 | Fix |
| CVE-2024-20805 | Samsung MyFiles ZipCompressor path traversal | 3.3CNA v3.1 | 0.2% | 2024-01-04 | Fix |
| CVE-2024-20804 | Samsung MyFiles FileUriConverter path traversal | 4.0CNA v3.1 | 0.2% | 2024-01-04 | Fix |
| CVE-2024-20803 | Samsung Mobile Devices Bluetooth pairing process improper authentication | 6.8CNA v3.1 | 0.3% | 2024-01-04 | Fix |
| CVE-2024-20802 | Samsung Mobile Devices improper access control | 4.6CNA v3.1 | 0.2% | 2024-01-04 | Fix |
| CVE-2024-0241 | Diaconou Encodedid encoded_id-rails denial of service | 7.5v3.1 | 1.1% | 2024-01-04 | Fix |
| CVE-2024-0225 | Google Chrome WebGPU use-after-free | 8.8v3.1 | 1.0% | 2024-01-04 | Fix |
| CVE-2024-0224 | Google Chrome WebAudio use-after-free | 8.8v3.1 | 1.0% | 2024-01-04 | Fix |
| CVE-2024-0223 | Google Chrome ANGLE heap-based buffer overflow | 8.8v3.1 | 10.1% | 2024-01-04 | Fix |
| CVE-2024-0222 | Google Chrome ANGLE use-after-free | 8.8v3.1 | 1.1% | 2024-01-04 | Fix |
| CVE-2024-21911 | Cross-site scripting vulnerability in TinyMCE | 6.1v3.1 | 1.2% | 2024-01-03 | Fix |
| CVE-2024-21910 | Cross-site scripting vulnerability in TinyMCE plugins | 6.1v3.1 | 1.0% | 2024-01-03 | Fix |
| CVE-2024-21909 | Denial of service in Cbor library | 7.5v3.1 | 1.1% | 2024-01-03 | Fix |
| CVE-2024-21908 | Cross-site scripting vulnerability in TinyMCE | 6.1v3.1 | 1.1% | 2024-01-03 | Fix |
| CVE-2024-21907 | Newtonsoft Json.net improper handling of exceptional conditions in Newtonsoft.Json | 7.5v3.1 | 32.9% | 2024-01-03 | Exploit codeFix |
| CVE-2024-21634 | Amazon Ion Java IonValue denial of service | 7.5CNA v3.1 | 0.8% | 2024-01-03 | Fix |
| CVE-2024-21633 | iBotPeaches Apktool arbitrary file write on Decoding | 7.8CNA v3.1 | 1.3% | 2024-01-03 | NucleiExploit codeFix |
| CVE-2024-21631 | vapor integer overflow in URI leading to potential host spoofing | 6.5CNA v3.1 | 0.6% | 2024-01-03 | Fix |
| CVE-2024-21622 | Craft CMS privilege escalation | 5.4CNA v3.1 | 0.6% | 2024-01-03 | Fix |
| CVE-2024-0217 | PackageKit packagekitd: Use-after-free in idle function callback | 3.3NVD v3.1 | 0.2% | 2024-01-03 | Fix |
| CVE-2024-0211 | Loop with unreachable exit condition (infinite loop) in Wireshark | 7.8CNA v3.1 | 0.5% | 2024-01-03 | Fix |
| CVE-2024-0210 | Uncontrolled recursion in Wireshark | 7.8CNA v3.1 | 0.5% | 2024-01-03 | Fix |
| CVE-2024-0209 | Null pointer dereference in Wireshark | 7.8CNA v3.1 | 0.6% | 2024-01-03 | Fix |
| CVE-2024-0208 | Improper Handling of Missing Values in Wireshark | 7.8CNA v3.1 | 1.8% | 2024-01-03 | Fix |
| CVE-2024-0207 | Out-of-bounds read in Wireshark | 7.8CNA v3.1 | 0.5% | 2024-01-03 | Fix |
| CVE-2024-0201 | Product Expiry for WooCommerce WordPress plugin unauthorized access | 4.3v3.1 | 0.4% | 2024-01-03 | Fix |
| CVE-2024-21632 | omniauth-microsoft_graph vulnerable to account takeover (nOAuth) | 8.6CNA v3.1 | 0.9% | 2024-01-02 | Fix |
| CVE-2024-21629 | rust-ethereum evm erroneous handling of `record_external_operation` error return | 5.9CNA v3.1 | 0.6% | 2024-01-02 | Fix |
| CVE-2024-21628 | PrestaShop XSS can be stored in DB from add a message form in order detail page (FO) | 5.4CNA v3.1 | 0.4% | 2024-01-02 | Fix |
| CVE-2024-21627 | PrestaShop some attribute not escaped in Validate::isCleanHTML method | 8.1CNA v3.1 | 0.5% | 2024-01-02 | Fix |
| CVE-2024-21623 | mehah otclient injection | 9.8CNA v3.1 | 1.2% | 2024-01-02 | |
| CVE-2024-0196 | Magic-Api code injection | 8.8v3.1 | 0.8% | 2024-01-02 | |
| CVE-2024-0195 | spider-flow FunctionController.java FunctionService.saveFunction code injection | 9.8v3.1 | 19.4% | 2024-01-02 | NucleiExploit code |
| CVE-2024-0194 | CodeAstro Internet Banking System Profile Picture pages_account.php unrestricted upload | 9.8v3.1 | 0.7% | 2024-01-02 | |
| CVE-2024-0193 | Linux kernel netfilter subsystem of the use-after-free | 6.7NVD v3.1 | 0.8% | 2024-01-02 | Fix |
| CVE-2024-0192 | RRJ Nueva Ecija Engineer Online Portal Add Downloadable downloadable.php unrestricted upload | 5.4v3.1 | 0.5% | 2024-01-02 | |
| CVE-2024-0191 | RRJ Nueva Ecija Engineer Online Portal file information disclosure | 5.3v3.1 | 0.8% | 2024-01-02 | |
| CVE-2024-0190 | RRJ Nueva Ecija Engineer Online Portal Quiz add_quiz.php cross-site scripting | 5.4v3.1 | 0.6% | 2024-01-02 | |
| CVE-2024-0189 | RRJ Nueva Ecija Engineer Online Portal Create message teacher_message.php cross-site scripting | 5.4v3.1 | 0.5% | 2024-01-02 | |
| CVE-2024-0188 | RRJ Nueva Ecija Engineer Online Portal change_password_teacher.php weak password | 8.1v3.1 | 0.7% | 2024-01-02 | |
| CVE-2024-0186 | HuiRan Host Reseller System HTTP POST request password recovery | 8.1v3.1 | 0.6% | 2024-01-02 | |
| CVE-2024-0185 | RRJ Nueva Ecija Engineer Online Portal Avatar dasboard_teacher.php unrestricted upload | 8.8v3.1 | 0.8% | 2024-01-02 | |
| CVE-2024-0184 | RRJ Nueva Ecija Engineer Online Portal Add Enginer edit_teacher.php cross-site scripting | 4.8v3.1 | 0.5% | 2024-01-02 | |
| CVE-2024-21732 | FlyCMS cross-site scripting | 6.1v3.1 | 0.4% | 2024-01-01 | |
| CVE-2024-0183 | RRJ Nueva Ecija Engineer Online Portal Nia Office students.php cross-site scripting | 4.8v3.1 | 0.6% | 2024-01-01 | |
| CVE-2024-0182 | SourceCodester Engineers Online Portal Admin Login SQL injection | 9.8v3.1 | 0.6% | 2024-01-01 | |
| CVE-2024-0181 | RRJ Nueva Ecija Engineer Online Portal Admin Panel admin_user.php cross-site scripting | 4.8v3.1 | 0.6% | 2024-01-01 |