CVE List - 2024 / January
Showing 1901 - 2000 of 2591 CVEs for January 2024 (Page 20 of 26)
| CVE ID | Date | Title |
|---|---|---|
| CVE-2023-51042 | 2024-01-23 | In the Linux kernel before 6.4.12, amdgpu_cs_wait_all_fences in drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c has a fence use-after-free. |
| CVE-2023-51043 | 2024-01-23 | In the Linux kernel before 6.4.5, drivers/gpu/drm/drm_atomic.c has a use-after-free during a race condition between a nonblocking atomic commit and a driver unload. |
| CVE-2024-22490 | 2024-01-23 | Cross Site Scripting (XSS) vulnerability in beetl-bbs 2.0 allows attackers to run arbitrary code via the /index keyword parameter. |
| CVE-2021-42142 | 2024-01-23 | An issue was discovered in Contiki-NG tinyDTLS through master branch 53a0d97. DTLS servers mishandle the early use of a large epoch number. This vulnerability allows remote attackers to cause a... |
| CVE-2023-31654 | 2024-01-23 | Redis raft master-1b8bd86 to master-7b46079 was discovered to contain an ODR violation via the component hiredisAllocFns at /opt/fs/redisraft/deps/hiredis/alloc.c. |
| CVE-2023-35835 | 2024-01-23 | An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. The device provides a WiFi access point for initial configuration. The WiFi network provided has no network authentication (such... |
| CVE-2023-35836 | 2024-01-23 | An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. An attacker within RF range can obtain a cleartext copy of the network configuration of the device, including the... |
| CVE-2023-35837 | 2024-01-23 | An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. Authentication for web interface is completed via an unauthenticated WiFi AP. The administrative password for the web interface has... |
| CVE-2023-36177 | 2024-01-23 | An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API. |
| CVE-2023-42143 | 2024-01-23 | Missing Integrity Check in Shelly TRV 20220811-152343/v2.1.8@5afc928c allows malicious users to create a backdoor by redirecting the device to an attacker-controlled machine which serves the manipulated firmware file. The device... |
| CVE-2023-42144 | 2024-01-23 | Cleartext Transmission during initial setup in Shelly TRV 20220811-15234 v.2.1.8 allows a local attacker to obtain the Wi-Fi password. |
| CVE-2023-45889 | 2024-01-23 | A Universal Cross Site Scripting (UXSS) vulnerability in ClassLink OneClick Extension through 10.8 allows remote attackers to inject JavaScript into any webpage. NOTE: this issue exists because of an incomplete... |
| CVE-2023-46343 | 2024-01-23 | In the Linux kernel before 6.5.9, there is a NULL pointer dereference in send_acknowledge in net/nfc/nci/spi.c. |
| CVE-2023-46889 | 2024-01-23 | Meross MSH30Q 4.5.23 is vulnerable to Cleartext Transmission of Sensitive Information. During the device setup phase, the MSH30Q creates an unprotected Wi-Fi access point. In this phase, MSH30Q needs to... |
| CVE-2023-46892 | 2024-01-23 | The radio frequency communication protocol being used by Meross MSH30Q 4.5.23 is vulnerable to replay attacks, allowing attackers to record and replay previously captured communication to execute unauthorized commands or... |
| CVE-2023-51210 | 2024-01-23 | SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the id_product parameters in the UpdateProductQuantity function. |
| CVE-2024-22076 | 2024-01-23 | MyQ Print Server before 8.2 patch 43 allows remote authenticated administrators to execute arbitrary code via PHP scripts that are reached through the administrative interface. |
| CVE-2024-22496 | 2024-01-23 | Cross Site Scripting (XSS) vulnerability in JFinalcms 5.0.0 allows attackers to run arbitrary code via the /admin/login username parameter. |
| CVE-2024-22497 | 2024-01-23 | Cross Site Scripting (XSS) vulnerability in /admin/login password parameter in JFinalcms 5.0.0 allows attackers to run arbitrary code via crafted URL. |
| CVE-2024-22660 | 2024-01-23 | TOTOLINK_A3700R_V9.1.2u.6165_20211012has a stack overflow vulnerability via setLanguageCfg |
| CVE-2024-22662 | 2024-01-23 | TOTOLINK A3700R_V9.1.2u.6165_20211012 has a stack overflow vulnerability via setParentalRules |
| CVE-2024-22663 | 2024-01-23 | TOTOLINK_A3700R_V9.1.2u.6165_20211012has a command Injection vulnerability via setOpModeCfg |
| CVE-2024-22705 | 2024-01-23 | An issue was discovered in ksmbd in the Linux kernel before 6.6.10. smb2_get_data_area_len in fs/smb/server/smb2misc.c can cause an smb_strndup_from_utf16 out-of-bounds access because the relationship between Name data and CreateContexts data... |
| CVE-2024-23848 | 2024-01-23 | In the Linux kernel through 6.7.1, there is a use-after-free in cec_queue_msg_fh, related to drivers/media/cec/core/cec-adap.c and drivers/media/cec/core/cec-api.c. |
| CVE-2024-23849 | 2024-01-23 | In rds_recv_track_latency in net/rds/af_rds.c in the Linux kernel through 6.7.1, there is an off-by-one error for an RDS_MSG_RX_DGRAM_TRACE_MAX comparison, resulting in out-of-bounds access. |
| CVE-2024-23850 | 2024-01-23 | In btrfs_get_root_ref in fs/btrfs/disk-io.c in the Linux kernel through 6.7.1, there can be an assertion failure and crash because a subvolume can be read out too soon after its root... |
| CVE-2024-23851 | 2024-01-23 | copy_params in drivers/md/dm-ioctl.c in the Linux kernel through 6.7.1 can attempt to allocate more than INT_MAX bytes, and crash, because of a missing param_kernel->data_size check. This is related to ctl_ioctl. |
| CVE-2024-23217 | 2024-01-23 | A privacy issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, iOS 17.3 and iPadOS 17.3. An app may be... |
| CVE-2023-42888 | 2024-01-23 | The issue was addressed with improved checks. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma 14.2, macOS Monterey 12.7.3, iOS 17.2... |
| CVE-2023-42935 | 2024-01-23 | An authentication issue was addressed with improved state management. This issue is fixed in macOS Ventura 13.6.4. A local attacker may be able to view the previous logged in user’s... |
| CVE-2023-40528 | 2024-01-23 | This issue was addressed by removing the vulnerable code. This issue is fixed in tvOS 17, watchOS 10, macOS Sonoma 14, iOS 17 and iPadOS 17, macOS Ventura 13.6.4. An... |
| CVE-2024-23211 | 2024-01-23 | A privacy issue was addressed with improved handling of user preferences. This issue is fixed in watchOS 10.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS... |
| CVE-2024-23207 | 2024-01-23 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in watchOS 10.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, macOS Ventura 13.6.4, macOS Monterey... |
| CVE-2024-23206 | 2024-01-23 | An access issue was addressed with improved access restrictions. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS... |
| CVE-2024-23210 | 2024-01-23 | This issue was addressed with improved redaction of sensitive information. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may... |
| CVE-2024-23213 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5,... |
| CVE-2024-23209 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3. Processing web content may lead to arbitrary code execution. |
| CVE-2024-23224 | 2024-01-23 | The issue was addressed with improved checks. This issue is fixed in macOS Sonoma 14.3, macOS Ventura 13.6.4. An app may be able to access sensitive user data. |
| CVE-2023-42881 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.2. Processing a file may lead to unexpected app termination or arbitrary code execution. |
| CVE-2024-23208 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may be able... |
| CVE-2024-23212 | 2024-01-23 | The issue was addressed with improved memory handling. This issue is fixed in watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5,... |
| CVE-2024-23204 | 2024-01-23 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, iOS 17.3 and iPadOS 17.3. A shortcut may be able to use... |
| CVE-2024-23219 | 2024-01-23 | The issue was addressed with improved authentication. This issue is fixed in iOS 17.3 and iPadOS 17.3. Stolen Device Protection may be unexpectedly disabled. |
| CVE-2024-23223 | 2024-01-23 | A privacy issue was addressed with improved handling of files. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may... |
| CVE-2024-23203 | 2024-01-23 | The issue was addressed with additional permissions checks. This issue is fixed in macOS Sonoma 14.3, iOS 17.3 and iPadOS 17.3. A shortcut may be able to use sensitive data... |
| CVE-2024-23215 | 2024-01-23 | An issue was addressed with improved handling of temporary files. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS 17.3. An app may... |
| CVE-2024-23214 | 2024-01-23 | Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in macOS Sonoma 14.3, iOS 16.7.5 and iPadOS 16.7.5, iOS 17.3 and iPadOS 17.3. Processing maliciously... |
| CVE-2023-42937 | 2024-01-23 | A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.5 and iPadOS 16.7.5, watchOS 10.2, macOS Ventura 13.6.4, macOS Sonoma... |
| CVE-2024-23222 | 2024-01-23 | A type confusion issue was addressed with improved checks. This issue is fixed in iOS 17.3 and iPadOS 17.3, macOS Sonoma 14.3, tvOS 17.3. Processing maliciously crafted web content may... |
| CVE-2023-42887 | 2024-01-23 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Ventura 13.6.4, macOS Sonoma 14.2. An app may be able to read arbitrary files. |
| CVE-2024-23218 | 2024-01-23 | A timing side-channel issue was addressed with improvements to constant-time computation in cryptographic functions. This issue is fixed in macOS Sonoma 14.3, watchOS 10.3, tvOS 17.3, iOS 17.3 and iPadOS... |
| CVE-2023-39197 | 2024-01-23 | Kernel: dccp: conntrack out-of-bounds read in nf_conntrack_dccp_packet() |
| CVE-2024-22768 | 2024-01-23 | Hitron Systems DVR HVR-4781 Improper Input Validation Vulnerability |
| CVE-2024-22769 | 2024-01-23 | Hitron Systems DVR HVR-8781 Improper Input Validation Vulnerability |
| CVE-2024-22770 | 2024-01-23 | Hitron Systems DVR HVR-16781 Improper Input Validation Vulnerability |
| CVE-2024-22771 | 2024-01-23 | Hitron Systems DVR LGUVR-4H Improper Input Validation Vulnerability |
| CVE-2024-22772 | 2024-01-23 | Hitron Systems DVR LGUVR-8H Improper Input Validation Vulnerability |
| CVE-2024-23842 | 2024-01-23 | Hitron Systems DVR LGUVR-16H Improper Input Validation Vulnerability |
| CVE-2024-0587 | 2024-01-23 | The AMP for WP – Accelerated Mobile Pages plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'disqus_name' parameter in all versions up to, and including, 1.0.92.1 due... |
| CVE-2024-23180 | 2024-01-23 | Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to... |
| CVE-2024-23181 | 2024-01-23 | Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50,... |
| CVE-2024-23182 | 2024-01-23 | Relative path traversal vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to... |
| CVE-2024-23183 | 2024-01-23 | Cross-site scripting vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to Ver.2.10.50,... |
| CVE-2024-23348 | 2024-01-23 | Improper input validation vulnerability in a-blog cms Ver.3.1.x series versions prior to Ver.3.1.7, Ver.3.0.x series versions prior to Ver.3.0.29, Ver.2.11.x series versions prior to Ver.2.11.58, Ver.2.10.x series versions prior to... |
| CVE-2024-0703 | 2024-01-23 | The Sticky Buttons – floating buttons builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via sticky URLs in all versions up to, and including, 3.2.2 due to insufficient... |
| CVE-2023-44401 | 2024-01-23 | Silverstripe GraqhQL's view permissions are bypassed for paginated lists of ORM data |
| CVE-2024-0741 | 2024-01-23 | An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR <... |
| CVE-2024-0742 | 2024-01-23 | It was possible for certain browser prompts and dialogs to be activated or dismissed unintentionally by the user due to an incorrect timestamp used to prevent input after page load.... |
| CVE-2024-0746 | 2024-01-23 | A Linux user opening the print preview dialog could have caused the browser to crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. |
| CVE-2024-0747 | 2024-01-23 | When a parent page loaded a child in an iframe with `unsafe-inline`, the parent Content Security Policy could have overridden the child Content Security Policy. This vulnerability affects Firefox <... |
| CVE-2024-0749 | 2024-01-23 | A phishing site could have repurposed an `about:` dialog to show phishing content with an incorrect origin in the address bar. This vulnerability affects Firefox < 122 and Thunderbird <... |
| CVE-2024-0750 | 2024-01-23 | A bug in popup notifications delay calculation could have made it possible for an attacker to trick a user into granting permissions. This vulnerability affects Firefox < 122, Firefox ESR... |
| CVE-2024-0751 | 2024-01-23 | A malicious devtools extension could have been used to escalate privileges. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. |
| CVE-2024-0753 | 2024-01-23 | In specific HSTS configurations an attacker could have bypassed HSTS on a subdomain. This vulnerability affects Firefox < 122, Firefox ESR < 115.7, and Thunderbird < 115.7. |
| CVE-2024-0755 | 2024-01-23 | Memory safety bugs present in Firefox 121, Firefox ESR 115.6, and Thunderbird 115.6. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some... |
| CVE-2024-0743 | 2024-01-23 | An unchecked return value in TLS handshake code could have caused a potentially exploitable crash. This vulnerability affects Firefox < 122, Firefox ESR < 115.9, and Thunderbird < 115.9. |
| CVE-2024-0744 | 2024-01-23 | In some circumstances, JIT compiled code could have dereferenced a wild pointer value. This could have led to an exploitable crash. This vulnerability affects Firefox < 122. |
| CVE-2024-0745 | 2024-01-23 | The WebAudio `OscillatorNode` object was susceptible to a stack buffer overflow. This could have led to a potentially exploitable crash. This vulnerability affects Firefox < 122. |
| CVE-2024-0748 | 2024-01-23 | A compromised content process could have updated the document URI. This could have allowed an attacker to set an arbitrary URI in the address bar or history. This vulnerability affects... |
| CVE-2024-0752 | 2024-01-23 | A use-after-free crash could have occurred on macOS if a Firefox update were being applied on a very busy system. This could have resulted in an exploitable crash. This vulnerability... |
| CVE-2024-0754 | 2024-01-23 | Some WASM source files could have caused a crash when loaded in devtools. This vulnerability affects Firefox < 122. |
| CVE-2023-48714 | 2024-01-23 | Record titles for restricted records can be viewed if exposed by GridFieldAddExistingAutocompleter |
| CVE-2023-49783 | 2024-01-23 | No permission checks for editing/deleting records with CSV import form |
| CVE-2023-49657 | 2024-01-23 | Apache Superset: Stored XSS in Dashboard Title and Chart Title |
| CVE-2023-50274 | 2024-01-23 | HPE OneView may allow command injection with local privilege escalation. |
| CVE-2023-50275 | 2024-01-23 | HPE OneView may allow clusterService Authentication Bypass resulting in denial of service. |
| CVE-2023-6573 | 2024-01-23 | HPE OneView may have a missing passphrase during restore. |
| CVE-2024-22203 | 2024-01-23 | Whoogle Search Server Side Request Forgery vulnerability |
| CVE-2024-22204 | 2024-01-23 | Whoogle Search Limited File Write vulnerability |
| CVE-2024-22205 | 2024-01-23 | Whoogle Search Server Side Request Forgery vulnerability |
| CVE-2024-22417 | 2024-01-23 | Whoogle Search Cross-site Scripting vulnerability |
| CVE-2024-23330 | 2024-01-23 | Tuta loads images from external resources |
| CVE-2024-23341 | 2024-01-23 | TuiTse-TsuSin html injection vulnerability in `tuitse_html` function |
| CVE-2024-23636 | 2024-01-23 | SOFARPC Remote Command Execution(RCE) Vulnerbility |
| CVE-2023-7238 | 2024-01-23 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Orthanc Osimis DICOM Web Viewer |
| CVE-2023-6926 | 2024-01-23 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in Crestron AM-300 |
| CVE-2023-38624 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please... |
| CVE-2023-38625 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please... |
| CVE-2023-38626 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please... |
| CVE-2023-38627 | 2024-01-23 | A post-authenticated server-side request forgery (SSRF) vulnerability in Trend Micro Apex Central 2019 (lower than build 6481) could allow an attacker to interact with internal or local services directly. Please... |