Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: January 2024

185 records · 15 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2023-6000
    25Monitor

    Popup Builder < 4.2.3 - Unauthenticated Stored XSS

    MediumCVSS 6.1Proof of conceptEPSS 1%

    sygnoos · popup builderJan 1, 2024

  • CVE-2023-6421
    31Monitor

    Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak

    HighCVSS 7.5Proof of conceptEPSS 2%

    w3eden · download managerJan 1, 2024

  • CVE-2023-50094
    39Monitor

    reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID.

    HighCVSS 8.8Proof of conceptEPSS 13%

    yogeshojha · rengineJan 1, 2024

  • CVE-2024-0195
    45Plan

    spider-flow FunctionController.java FunctionService.saveFunction code injection

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    ssssssss · spider-flowJan 2, 2024

  • CVE-2024-21907
    40Plan

    Improper Handling of Exceptional Conditions in Newtonsoft.Json

    HighCVSS 7.5Proof of conceptEPSS 32%

    newtonsoft · json.netJan 3, 2024

  • CVE-2024-21633
    31Monitor

    Arbitrary file write on Decoding

    HighCVSS 7.8Proof of conceptEPSS 1%

    apktool · apktoolJan 3, 2024

  • CVE-2023-49442
    51Plan

    Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POS

    CriticalCVSS 9.8No exploitEPSS 38%

    jeecg · jeecgJan 3, 2024

  • CVE-2024-0223
    38Monitor

    Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via

    HighCVSS 8.8No exploitEPSS 10%

    google · chromeJan 3, 2024

  • CVE-2024-21641
    18Monitor

    Flarum's Logout Route allows open redirects

    MediumCVSS 4.7Proof of conceptEPSS 1%

    flarum · flarumJan 5, 2024

  • CVE-2024-0264
    44Plan

    SourceCodester Clinic Queuing System LoginRegistration.php authorization

    CriticalCVSS 9.8No exploitEPSS 18%

    oretnom23 · clinic queuing systemJan 7, 2024

  • CVE-2024-0265
    41Plan

    SourceCodester Clinic Queuing System GET Parameter index.php file inclusion

    HighCVSS 8.8No exploitEPSS 20%

    oretnom23 · clinic queuing systemJan 7, 2024

  • CVE-2023-7212
    39Monitor

    DeDeCMS Backend file_class.php unrestricted upload

    CriticalCVSS 9.8No exploitEPSS 0%

    dedecms · dedecmsJan 7, 2024

  • CVE-2024-0287
    39Monitor

    Kashipara Food Management System itemBillPdf.php sql injection

    CriticalCVSS 9.8No exploitEPSS 0%

    kashipara · food management systemJan 7, 2024

  • CVE-2024-0305
    50Plan

    Guangzhou Yingke Electronic Technology Ncast Guest Login IPSetup.php information disclosure

    HighCVSS 7.5Proof of conceptEPSS 66%

    ncast project · ncastJan 8, 2024

  • CVE-2024-21644
    43Plan

    pyLoad unauthenticated flask configuration leakage

    HighCVSS 7.5Proof of conceptEPSS 42%

    pyload · pyloadJan 8, 2024

  • CVE-2024-21645
    28Monitor

    pyLoad Log Injection

    MediumCVSS 5.3Proof of conceptEPSS 24%

    pyload · pyloadJan 8, 2024

  • CVE-2023-47211
    48Plan

    A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258.

    HighCVSS 8.6Proof of conceptEPSS 47%

    zohocorp · manageengine firewall analyzerJan 8, 2024

  • CVE-2024-21650
    67This week

    XWiki Remote Code Execution vulnerability via user registration

    CriticalCVSS 9.8Proof of conceptEPSS 93%

    xwiki · xwikiJan 8, 2024

  • CVE-2022-3328
    28Monitor

    Race condition in snap-confine's must_mkdir_and_open_with_perms()

    HighCVSS 7.0Proof of conceptEPSS 0%

    canonical · snapdJan 8, 2024

  • CVE-2023-6505
    42Plan

    Prime Mover < 1.9.3 - Directory Listing to Sensitive Data Exposure

    HighCVSS 7.5Proof of conceptEPSS 39%

    codexonics · prime moverJan 8, 2024

  • CVE-2023-6750
    31Monitor

    Clone < 2.4.3 - Unauthenticated Backup Download

    HighCVSS 7.5Proof of conceptEPSS 1%

    backupbliss · cloneJan 8, 2024

  • CVE-2023-52271
    26Monitor

    The wsftprm.sys kernel driver 2.0.0.0 in Topaz Antifraud allows low-privileged attackers to kill any (Protected Process Light) process via a

    MediumCVSS 6.5Proof of conceptEPSS 0%

    topazevolution · antifraudJan 8, 2024

  • CVE-2022-45354
    41Plan

    WordPress Download Monitor Plugin <= 4.7.60 is vulnerable to Sensitive Data Exposure

    HighCVSS 7.5Proof of conceptEPSS 38%

    wpchill · download monitorJan 8, 2024

  • CVE-2022-2586
    64This week

    It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that

    HighCVSS 7.8KEVWeaponizedEPSS 10%

    siemens · simatic s7-1500 tm mfp firmwareJan 8, 2024

  • CVE-2022-2588
    33Monitor

    It was discovered that the cls_route filter implementation in the Linux kernel would not remove an old filter from the hashtable before free

    HighCVSS 7.8Proof of conceptEPSS 5%

    linux · linux kernelJan 8, 2024

  • CVE-2022-2602
    28Monitor

    io_uring UAF, Unix SCM garbage collection

    HighCVSS 7.0Proof of conceptEPSS 1%

    linux · linux kernelJan 8, 2024

  • CVE-2023-50643
    40Plan

    An issue in Evernote Evernote for MacOS v.10.68.2 allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnsp

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    evernote · evernoteJan 8, 2024

  • CVE-2023-49237
    45Plan

    An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices.

    CriticalCVSS 9.8No exploitEPSS 18%

    trendnet · tv-ip1314pi firmwareJan 9, 2024

  • CVE-2022-48618
    58Plan

    The issue was addressed with improved checks.

    HighCVSS 7.0KEVWeaponizedEPSS 0%

    apple · ipadosJan 9, 2024

  • CVE-2024-20656
    32Monitor

    Visual Studio Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 3%

    microsoft · visual studioJan 9, 2024

  • CVE-2024-20666
    27Monitor

    BitLocker Security Feature Bypass Vulnerability

    MediumCVSS 6.6Proof of conceptEPSS 3%

    microsoft · windows 10 1507Jan 9, 2024

  • CVE-2024-20674
    40Plan

    Windows Kerberos Security Feature Bypass Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 17%

    microsoft · windows 10 1507Jan 9, 2024

  • CVE-2024-20696
    30Monitor

    Windows libarchive Remote Code Execution Vulnerability

    HighCVSS 7.3Proof of conceptEPSS 3%

    microsoft · windows 10 1809Jan 9, 2024

  • CVE-2024-20697
    51Plan

    Windows libarchive Remote Code Execution Vulnerability

    HighCVSS 7.3No exploitEPSS 72%

    microsoft · windows 11 22h2Jan 9, 2024

  • CVE-2024-20698
    34Monitor

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.8Proof of conceptEPSS 8%

    microsoft · windows 10 1809Jan 9, 2024

  • CVE-2024-21305
    17Monitor

    Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability

    MediumCVSS 4.4Proof of conceptEPSS 1%

    microsoft · windows 10 1809Jan 9, 2024

  • CVE-2024-21306
    24Monitor

    Microsoft Bluetooth Driver Spoofing Vulnerability

    MediumCVSS 5.7Proof of conceptEPSS 5%

    microsoft · windows 10 21h2Jan 9, 2024

  • CVE-2024-21310
    34Monitor

    Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

    HighCVSS 7.8No exploitEPSS 11%

    microsoft · windows 10 1809Jan 9, 2024

  • CVE-2024-21318
    44Plan

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    HighCVSS 8.8No exploitEPSS 30%

    microsoft · sharepoint serverJan 9, 2024

  • CVE-2024-21320
    33Monitor

    Windows Themes Spoofing Vulnerability

    MediumCVSS 6.5Proof of conceptEPSS 22%

    microsoft · windows 10 1507Jan 9, 2024

  • CVE-2024-0352
    61This week

    Likeshop HTTP POST Request File.php userFormImage unrestricted upload

    CriticalCVSS 9.8Proof of conceptEPSS 72%

    likeshop · likeshopJan 9, 2024

  • CVE-2023-31446
    57Plan

    In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized.

    CriticalCVSS 9.8Proof of conceptEPSS 61%

    cassianetworks · xc1000 firmwareJan 9, 2024

  • CVE-2024-0364
    39Monitor

    PHPGurukul Hospital Management System query-details.php sql injection

    CriticalCVSS 9.8No exploitEPSS 0%

    phpgurukul · hospital management systemJan 9, 2024

  • CVE-2023-49471
    35Monitor

    Blind Server-Side Request Forgery (SSRF) vulnerability in karlomikus Bar Assistant before version 3.2.0 does not validate a parameter before

    HighCVSS 8.8Proof of conceptEPSS 1%

    barassistant · bar assistantJan 10, 2024

  • CVE-2023-48728
    25Monitor

    A cross-site scripting (xss) vulnerability exists in the functiongetOpenGraph videoName functionality of WWBN AVideo 11.6 and dev master com

    MediumCVSS 6.1Proof of conceptEPSS 2%

    wwbn · avideoJan 10, 2024

  • CVE-2023-48783
    28Monitor

    An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and

    MediumCVSS 5.4No exploitEPSS 22%

    fortinet · fortiportalJan 10, 2024

  • CVE-2023-31488
    39Monitor

    Hyland Perceptive Filters releases before 2023-12-08 (e.g., 11.4.0.2647), as used in Cisco IronPort Email Security Appliance Software, Cisco

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    cisco · ironport email security applianceJan 10, 2024

  • CVE-2023-51126
    48Plan

    Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value param

    CriticalCVSS 9.8Proof of conceptEPSS 31%

    flir · flir ax8 firmwareJan 10, 2024

  • CVE-2023-51127
    30Monitor

    FLIR AX8 thermal sensor cameras up to and including 1.46.16 are vulnerable to Directory Traversal due to improper access restriction.

    HighCVSS 7.5Proof of conceptEPSS 1%

    flir · flir ax8 firmwareJan 10, 2024

  • CVE-2023-28197
    13Monitor

    An access issue was addressed with additional sandbox restrictions.

    LowCVSS 3.3Proof of conceptEPSS 0%

    apple · macosJan 10, 2024

  • CVE-2023-41974
    62This week

    A use-after-free issue was addressed with improved memory management.

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    apple · ipadosJan 10, 2024

  • CVE-2023-42829
    22Monitor

    The issue was addressed with additional restrictions on the observability of app states.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    apple · macosJan 10, 2024

  • CVE-2023-51123
    46Plan

    An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the se

    CriticalCVSS 9.8No exploitEPSS 24%

    dlink · dir-815 firmwareJan 10, 2024

  • CVE-2023-51073
    32Monitor

    An issue in Buffalo LS210D v.1.78-0.03 allows a remote attacker to execute arbitrary code via the Firmware Update Script at /etc/init.d/upda

    HighCVSS 8.1Proof of conceptEPSS 1%

    buffalo · ls210d firmwareJan 10, 2024

  • CVE-2023-4372
    26Monitor

    LiteSpeed Cache <= 5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    MediumCVSS 5.4No exploitEPSS 16%

    litespeedtech · litespeed cacheJan 11, 2024

  • CVE-2023-6266
    31Monitor

    Backup Migration <= 1.3.6 - Unauthenticated Arbitrary Backup Download to Sensitive Information Exposure

    HighCVSS 7.5Proof of conceptEPSS 2%

    backupbliss · backup migrationJan 11, 2024

  • CVE-2023-6567
    45Plan

    LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by

    HighCVSS 7.5Proof of conceptEPSS 51%

    thimpress · learnpressJan 11, 2024

  • CVE-2023-6634
    42Plan

    LearnPress <= 4.2.5.7 - Command Injection

    CriticalCVSS 9.8Proof of conceptEPSS 8%

    thimpress · learnpressJan 11, 2024

  • CVE-2023-6875
    66This week

    POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API

    CriticalCVSS 9.8WeaponizedEPSS 90%

    wpexperts · post smtpJan 11, 2024

  • CVE-2023-20573
    12Monitor

    Debug Exception Delivery in Secure Nested Paging

    LowCVSS 3.2Proof of conceptEPSS 0%

    amd · epyc 7763 firmwareJan 11, 2024

  • CVE-2024-22198
    36Monitor

    Authenticated (user role) arbitrary command execution by modifying `start_cmd` setting (GHSL-2023-268)

    HighCVSS 8.8Proof of conceptEPSS 4%

    nginxui · nginx uiJan 11, 2024

  • CVE-2023-46474
    34Monitor

    File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uplo

    HighCVSS 7.2Proof of conceptEPSS 21%

    sigb · pmbJan 11, 2024

  • CVE-2024-21591
    44Plan

    Junos OS: SRX Series and EX Series: Security Vulnerability in J-web allows a preAuth Remote Code Execution

    CriticalCVSS 9.8No exploitEPSS 17%

    juniper · junosJan 11, 2024

  • CVE-2023-40362
    17Monitor

    An issue was discovered in CentralSquare Click2Gov Building Permit before October 2023.

    MediumCVSS 4.3Proof of conceptEPSS 0%

    centralsquare · click2gov building permitJan 12, 2024

  • CVE-2023-50919
    60This week

    An issue was discovered on GL.iNet devices before version 4.5.0.

    CriticalCVSS 9.8WeaponizedEPSS 47%

    gl-inet · gl-ax1800 firmwareJan 12, 2024

  • CVE-2023-7028
    97Now

    Weak Password Recovery Mechanism for Forgotten Password in GitLab

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    gitlab · gitlabJan 12, 2024

  • CVE-2024-21887
    96Now

    A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an aut

    CriticalCVSS 9.1KEVWeaponizedEPSS 99%

    ivanti · connect secureJan 12, 2024

  • CVE-2023-46805
    92Now

    An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to acc

    HighCVSS 8.2KEVWeaponizedEPSS 99%

    ivanti · connect secureJan 12, 2024

  • CVE-2024-0230
    9Monitor

    A session management issue was addressed with improved checks.

    LowCVSS 2.4Proof of conceptEPSS 1%

    apple · magic keyboard firmwareJan 12, 2024

  • CVE-2023-50072
    21Monitor

    A Stored Cross-Site Scripting (XSS) vulnerability exists in OpenKM version 7.1.40 (dbb6e88) With Professional Extension that allows an authe

    MediumCVSS 5.4Proof of conceptEPSS 0%

    openkm · openkmJan 12, 2024

  • CVE-2024-0522
    35Monitor

    Allegro RomPager HTTP POST Request cross-site request forgery

    HighCVSS 8.8No exploitEPSS 0%

    allegrosoft · rompagerJan 14, 2024

  • CVE-2024-0527
    39Monitor

    CXBSoft Url-shorting HTTP POST Request update_go.php sql injection

    CriticalCVSS 9.8No exploitEPSS 0%

    cxbsoft · url-shortingJan 14, 2024

  • CVE-2024-0546
    60This week

    EasyFTP LIST Command denial of service

    HighCVSS 7.5WeaponizedEPSS 6%

    easyftp · easyftpJan 15, 2024

  • CVE-2023-50290
    47Plan

    Apache Solr: Host environment variables are published via the Metrics API

    MediumCVSS 6.5Proof of conceptEPSS 68%

    apache · solrJan 15, 2024

  • CVE-2023-6620
    32Monitor

    Post SMTP < 2.8.7 - Admin+ SQL Injection

    HighCVSS 7.2No exploitEPSS 14%

    wpexperts · post smtpJan 15, 2024

  • CVE-2023-6623
    54Plan

    Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion

    CriticalCVSS 9.8Proof of conceptEPSS 50%

    wpdeveloper · essential blocksJan 15, 2024

  • CVE-2024-22207
    22Monitor

    Default swagger-ui configuration exposes all files in the module

    MediumCVSS 5.3Proof of conceptEPSS 2%

    smartbear · swagger uiJan 15, 2024

  • CVE-2023-47459
    26Monitor

    An issue in Knovos Discovery v.22.67.0 allows a remote attacker to obtain sensitive information via the /DiscoveryReview/Service/CaseManagem

    MediumCVSS 6.5Proof of conceptEPSS 0%

    knovos · discoveryJan 15, 2024

  • CVE-2023-47460
    35Monitor

    SQL injection vulnerability in Knovos Discovery v.22.67.0 allows a remote attacker to execute arbitrary code via the /DiscoveryProcess/Servi

    HighCVSS 8.8Proof of conceptEPSS 1%

    knovos · discoveryJan 15, 2024

  • CVE-2023-48104
    24Monitor

    Alinto SOGo before 5.9.1 is vulnerable to HTML Injection.

    MediumCVSS 6.1Proof of conceptEPSS 1%

    alinto · sogoJan 15, 2024

  • CVE-2023-51810
    30Monitor

    SQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain sensitive information

    HighCVSS 7.5Proof of conceptEPSS 1%

    stackideas · easydiscussJan 15, 2024

  • CVE-2023-22527
    99Now

    A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated attacker to achieve RCE

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    atlassian · confluence data centerJan 16, 2024

  • CVE-2011-10005
    40Plan

    EasyFTP MKD Command buffer overflow

    HighCVSS 8.8WeaponizedEPSS 3%

    easyftp server project · easyftp serverJan 16, 2024

  • CVE-2024-0569
    21Monitor

    Totolink T8 Setting cstecgi.cgi getSysStatusCfg information disclosure

    MediumCVSS 5.3No exploitEPSS 0%

    totolink · t8 firmwareJan 16, 2024

  • CVE-2024-0582
    35Monitor

    Kernel: io_uring: page use-after-free vulnerability via buffer ring mmap

    HighCVSS 7.8Proof of conceptEPSS 12%

    linux · linux kernelJan 16, 2024

  • CVE-2022-1609
    58Plan

    The School Management < 9.9.7 - Unauthenticated RCE via REST api

    CriticalCVSS 9.8Proof of conceptEPSS 64%

    weblizar · school managementJan 16, 2024

  • CVE-2023-1405
    30Monitor

    Formidable Forms < 6.2 - Unauthenticated PHP Object Injection

    HighCVSS 7.5Proof of conceptEPSS 0%

    strategy11 · formidable formsJan 16, 2024

  • CVE-2023-2252
    10Monitor

    Directorist < 7.5.4 - Admin+ LFI

    LowCVSS 2.7Proof of conceptEPSS 1%

    wpwax · directoristJan 16, 2024

  • CVE-2023-5558
    24Monitor

    LearnPress < 4.2.5.5 - Reflected Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 0%

    thimpress · learnpressJan 16, 2024

  • CVE-2023-6592
    21Monitor

    FastDup – Fastest WordPress Migration & Duplicator < 2.2 - Directory Listing to Account Takeover and Sensitive Data Exposure

    MediumCVSS 5.3Proof of conceptEPSS 0%

    ninjateam · fastdupJan 16, 2024

  • CVE-2024-0235
    32Monitor

    EventON (Free < 2.2.8, Premium < 4.5.5) - Unauthenticated Email Address Disclosure

    MediumCVSS 5.3Proof of conceptEPSS 37%

    myeventon · eventonJan 16, 2024

  • CVE-2023-22512
    34Monitor

    This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server.

    HighCVSS 7.5No exploitEPSS 14%

    atlassian · confluence data centerJan 16, 2024

  • CVE-2024-0200
    61This week

    Unsafe Reflection in Github Enterprise Server leading to Command Injection

    CriticalCVSS 9.8Proof of conceptEPSS 71%

    github · enterprise serverJan 16, 2024

  • CVE-2024-0507
    55Plan

    Privilege Escalation by Code Injection in the Management Console in GitHub Enterprise Server

    HighCVSS 8.8Proof of conceptEPSS 65%

    github · enterprise serverJan 16, 2024

  • CVE-2024-0517
    42Plan

    Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a cr

    HighCVSS 8.8No exploitEPSS 21%

    google · chromeJan 16, 2024

  • CVE-2024-0519
    66This week

    Out of bounds memory access in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption

    HighCVSS 8.8KEVWeaponizedEPSS 3%

    google · chromeJan 16, 2024

  • CVE-2024-22411
    21Monitor

    Cross site scripting in Action messages on Avo

    MediumCVSS 5.4Proof of conceptEPSS 0%

    avohq · avoJan 16, 2024

  • CVE-2023-48858
    24Monitor

    A Cross-site scripting (XSS) vulnerability in login page php code in Armex ABO.CMS 5.9 allows remote attackers to inject arbitrary web scrip

    MediumCVSS 6.1Proof of conceptEPSS 0%

    abocms · abo.cmsJan 17, 2024

  • CVE-2023-6548
    66This week

    Improper Control of Generation of Code ('Code Injection') in NetScaler ADC and NetScaler Gateway allows an attacker with access to NSIP, CLI

    HighCVSS 8.8KEVWeaponizedEPSS 3%

    citrix · netscaler application delivery controllerJan 17, 2024

  • CVE-2023-5914
    47Plan

      Cross-site scripting (XSS)

    MediumCVSS 6.1Proof of conceptEPSS 75%

    cloud · citrix storefrontJan 17, 2024