By publication date

Exploited and new serious CVEs: January 2024

185 records · 15 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
77This week	CVE-2023-6549Weaponized	Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denialcitrix · netscaler application delivery controller · CWE-119 Pre-auth Memory safety Denial of service	High7.5	KEV	57.6%	Jan 17, 2024
35Monitor	CVE-2024-22416Proof of concept	Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalationpyload-ng project · pyload-ng · CWE-352 Pre-auth CSRF	High8.8	—	0.9%	Jan 17, 2024
42Plan	CVE-2023-6184No exploit	Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scriptingcitrix · virtual apps and desktops · CWE-913	High7.2	—	46.6%	Jan 17, 2024
24Monitor	CVE-2023-6970Proof of concept	WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Refererbootstrapped · wp recipe maker · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	Jan 18, 2024
24Monitor	CVE-2024-23659Proof of concept	SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file.spip · spip · CWE-79 Pre-auth XSS	Medium6.1	—	0.4%	Jan 19, 2024
31Monitor	CVE-2024-0705Proof of concept	Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injectionwebtoffee · stripe payment plugin for woocommerce · CWE-89 Pre-auth SQL injection	High7.5	—	2.6%	Jan 19, 2024
25Monitor	CVE-2024-21733Proof of concept	Apache Tomcat: Leaking of unrelated request bodies in default error pageapache · tomcat · CWE-209 Pre-auth Info leak	Medium5.3	—	14.2%	Jan 19, 2024
26Monitor	CVE-2024-0717No exploit	D-Link Good Line Router v2 HTTP GET Request devinfo information disclosuredlink · dir-825acg1 firmware · CWE-200 Pre-auth Info leak	Medium5.3	—	18.1%	Jan 19, 2024
31Monitor	CVE-2024-0723Proof of concept	freeSSHd denial of servicefreesshd · freesshd · CWE-404 Pre-auth Denial of service	High7.5	—	3.6%	Jan 19, 2024
31Monitor	CVE-2024-0725Proof of concept	ProSSHD denial of serviceprosshd · prosshd · CWE-404 Pre-auth Denial of service	High7.5	—	3.6%	Jan 19, 2024
31Monitor	CVE-2024-0737Proof of concept	Xlightftpd Xlight FTP Server Login denial of servicexlightftpd · xlight ftp server · CWE-404 Pre-auth Denial of service	High7.5	—	4.1%	Jan 19, 2024
17Monitor	CVE-2023-46447Proof of concept	The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements overpopsdiabetes · rebel · CWE-319 Pre-auth Weak crypto	Medium4.3	—	0.3%	Jan 20, 2024
17Monitor	CVE-2024-0623Proof of concept	VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgeryvektor-inc · vk block patterns · CWE-352 Pre-auth CSRF	Medium4.3	—	0.6%	Jan 20, 2024
26Monitor	CVE-2024-0679Proof of concept	ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installationthemegrill · colormag · CWE-862 Broken access control (IDOR)	Medium6.5	—	1.3%	Jan 20, 2024
94Now	CVE-2024-0769Weaponized	D-Link DIR-859 HTTP POST Request hedwig.cgi path traversaldlink · dir-859 firmware · CWE-22 Pre-auth Path traversal	Critical9.8	KEV	82.7%	Jan 21, 2024
35Monitor	CVE-2024-22895No exploit	DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.dedecms · dedecms · CWE-434 File upload	High8.8	—	0.7%	Jan 22, 2024
49Plan	CVE-2024-0778No exploit	Uniview ISC 2500-S VM.php setNatConfig os command injectionuniview · isc 2500-s firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	32.0%	Jan 22, 2024
68This week	CVE-2024-0204Weaponized	Authentication Bypass in GoAnywhere MFTfortra · goanywhere managed file transfer · CWE-425 Pre-auth Auth bypass	Critical9.8	—	95.0%	Jan 22, 2024
39Monitor	CVE-2024-0783Proof of concept	Project Worlds Online Admission System documents.php unrestricted uploadonline admission system project · online admission system · CWE-434 Pre-auth File upload	Critical9.8	—	1.2%	Jan 22, 2024
26Monitor	CVE-2024-23339Proof of concept	hoolock does not block Prototype pollution with object-path related utilitieselijahharry · hoolock · CWE-1321 Pre-auth Prototype pollution	Medium6.5	—	1.0%	Jan 22, 2024
31Monitor	CVE-2024-23208Proof of concept	The issue was addressed with improved memory handling.apple · ipados · CWE-94 RCE Local privilege escalation	High7.8	—	1.4%	Jan 22, 2024
68This week	CVE-2024-23222Weaponized	A type confusion issue was addressed with improved checks.apple · safari · CWE-843 pre-auth RCE	High8.8	KEV	10.5%	Jan 22, 2024
27Monitor	CVE-2024-0741Proof of concept	An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash.mozilla · firefox · CWE-787 Pre-auth Memory safety Denial of service	Medium6.5	—	2.1%	Jan 23, 2024
47Plan	CVE-2023-36177No exploit	An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information badaix · snapcast · CWE-94 pre-auth RCE	Critical9.8	—	27.5%	Jan 23, 2024
21Monitor	CVE-2023-47115Proof of concept	Label Studio XSS Vulnerability on Avatar Uploadhumansignal · label studio · CWE-79 XSS	Medium5.4	—	1.4%	Jan 23, 2024
44Plan	CVE-2024-23638No exploit	SQUID-2023:11 Denial of Service in Cache Managersquid-cache · squid · CWE-825 Denial of service	Medium6.5	—	60.0%	Jan 23, 2024
35Monitor	CVE-2023-43317Proof of concept	An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storagcoign · coign · CWE-269	High8.8	—	1.0%	Jan 24, 2024
24Monitor	CVE-2023-6697Proof of concept	WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scriptingwpgmaps · wp go maps · CWE-79 Pre-auth XSS	Medium6.1	—	1.0%	Jan 24, 2024
45Plan	CVE-2024-22651No exploit	There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04.dlink · dir-815 firmware · CWE-77 pre-auth RCE Command injection	Critical9.8	—	20.1%	Jan 24, 2024
99Now	CVE-2024-23897Weaponized	Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character follojenkins · jenkins · CWE-22 Pre-auth Path traversal	Critical9.8	KEV	99.9%	Jan 24, 2024
55Plan	CVE-2024-23898Proof of concept	Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests majenkins · jenkins · CWE-346 Pre-auth	High8.8	—	67.1%	Jan 24, 2024
21Monitor	CVE-2024-0624Proof of concept	Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Updatestrangerstudios · paid memberships pro · CWE-352 Pre-auth CSRF	Medium5.3	—	0.9%	Jan 24, 2024
60This week	CVE-2024-23985Weaponized	EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command.ezhometech · ezserver Pre-auth Denial of service	High7.5	—	3.5%	Jan 25, 2024
60This week	CVE-2024-22729Weaponized	NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.netis-systems · mw5360 firmware · CWE-77 pre-auth RCE Command injection	Critical9.8	—	70.7%	Jan 25, 2024
31Monitor	CVE-2023-52076Proof of concept	Remote Code Execution Vulnerability in Atril's EPUB ebook parsingmate-desktop · atril · CWE-22 RCE Path traversal	High7.8	—	1.0%	Jan 25, 2024
37Monitor	CVE-2023-41474Proof of concept	Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via tivanti · avalanche · CWE-22 Path traversal	Medium6.5	—	37.6%	Jan 25, 2024
31Monitor	CVE-2023-52356Proof of concept	Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of servicelibtiff · libtiff · CWE-122 Pre-auth Memory safety Denial of service	High7.5	—	2.1%	Jan 25, 2024
61This week	CVE-2023-52251Weaponized	An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/provectus · ui · CWE-94 RCE	High8.8	—	86.8%	Jan 25, 2024
33Monitor	CVE-2024-24399No exploit	An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code lepton-cms · leptoncms · CWE-434 RCE File upload	High7.2	—	15.5%	Jan 25, 2024
39Monitor	CVE-2024-22922Proof of concept	An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the lprojectworlds · visitor management system · CWE-269 Pre-auth	Critical9.8	—	0.7%	Jan 25, 2024
24Monitor	CVE-2024-23055Proof of concept	An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of inputplone · plone docker official image pre-auth RCE	Medium6.1	—	0.9%	Jan 25, 2024
47Plan	CVE-2024-23624No exploit	D-Link DAP-1650 gena.cgi SUBSCRIBE Command Injection Vulnerabilitydlink · dap-1650 firmware · CWE-77 pre-auth RCE Command injection	Critical9.8	—	25.9%	Jan 25, 2024
40Plan	CVE-2024-0402Proof of concept	Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLabgitlab · gitlab · CWE-22 Path traversal	Critical9.9	—	3.7%	Jan 25, 2024
60This week	CVE-2023-5612Weaponized	Missing Authorization in GitLabgitlab · gitlab · CWE-862 Pre-auth Broken access control (IDOR)	Medium5.3	—	4.8%	Jan 25, 2024
36Monitor	CVE-2024-0918No exploit	TRENDnet TEW-800MB POST Request os command injectiontrendnet · tew-800mb firmware · CWE-78 RCE Command injection	High7.2	—	25.4%	Jan 26, 2024
35Monitor	CVE-2024-0919No exploit	TRENDnet TEW-815DAP POST Request do_setNTP command injectiontrendnet · tew-815dap firmware · CWE-77 RCE Command injection	High7.2	—	22.5%	Jan 26, 2024
50Plan	CVE-2024-0921No exploit	D-Link DIR-816 A2 Web Interface setDeviceSettings os command injectiondlink · dir-816 a2 firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	37.5%	Jan 26, 2024
44Plan	CVE-2024-0930No exploit	Tenda AC10U fromSetWirelessRepeat stack-based overflowtendacn · ac10u firmware · CWE-121 Pre-auth Memory safety	Critical9.8	—	15.2%	Jan 26, 2024
39Monitor	CVE-2024-0932No exploit	Tenda AC10U setSmartPowerManagement stack-based overflowtendacn · ac10u firmware · CWE-121 Pre-auth Memory safety	Critical9.8	—	0.8%	Jan 26, 2024
52Plan	CVE-2024-0939Proof of concept	Byzoro Smart S210 Management Platform uploadfile.php unrestricted uploadbyzoro · smart s210 firmware · CWE-434 Pre-auth File upload	Critical9.8	—	43.7%	Jan 26, 2024
39Monitor	CVE-2024-23738Proof of concept	An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClipostman · postman pre-auth RCE	Critical9.8	—	1.4%	Jan 27, 2024
13Monitor	CVE-2024-23743Proof of concept	Notion through 3.1.0 on macOS might allow code execution because of RunAsNode and enableNodeClilnspectArguments.notion · notion · CWE-250 Local privilege escalation	Low3.3	—	0.3%	Jan 27, 2024
40Plan	CVE-2024-23739Proof of concept	An issue in Discord for macOS version 0.0.291 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodediscord · discord pre-auth RCE	Critical9.8	—	1.7%	Jan 27, 2024
39Monitor	CVE-2024-23741Proof of concept	An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnvercel · hyper · CWE-94 pre-auth RCE	Critical9.8	—	1.5%	Jan 27, 2024
40Plan	CVE-2024-23742Proof of concept	An issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilloom · loom · CWE-94 pre-auth RCE	Critical9.8	—	1.6%	Jan 27, 2024
39Monitor	CVE-2024-23740Proof of concept	An issue in Kap for macOS version 3.6.0 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnsgetkap · kap pre-auth RCE	Critical9.8	—	1.4%	Jan 28, 2024
56Plan	CVE-2024-0986Proof of concept	Issabel PBX Asterisk-Cli os command injectionissabel · pbx · CWE-78 pre-auth RCE Command injection	Critical9.8	—	58.1%	Jan 28, 2024
30Monitor	CVE-2024-23747Proof of concept	The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability.modernasistemas · modernanet hospital management system 2024 · CWE-639 Pre-auth Broken access control (IDOR)	High7.5	—	0.6%	Jan 29, 2024
32Monitor	CVE-2023-6389Proof of concept	WordPress Toolbar <= 2.2.6 - Open Redirectabhinavsingh · wordpress toolbar · CWE-601 Pre-auth Open redirect	Medium6.1	—	26.7%	Jan 29, 2024
19Monitor	CVE-2024-24134Proof of concept	Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update Mremyandrade · online food menu · CWE-79 XSS	Medium4.8	—	0.7%	Jan 29, 2024
24Monitor	CVE-2024-24135Proof of concept	Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XSremyandrade · product inventory with export to excel · CWE-79 Pre-auth XSS	Medium6.1	—	0.6%	Jan 29, 2024
24Monitor	CVE-2024-24136Proof of concept	The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting (Xremyandrade · math game · CWE-79 Pre-auth XSS	Medium6.1	—	0.5%	Jan 29, 2024
28Monitor	CVE-2024-24139Proof of concept	Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter.remyandrade · login system with email verification · CWE-89 SQL injection	High7.2	—	1.1%	Jan 29, 2024
28Monitor	CVE-2024-24140Proof of concept	Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'remyandrade · daily habit tracker · CWE-89 SQL injection	High7.2	—	1.1%	Jan 29, 2024
39Monitor	CVE-2024-24141Proof of concept	Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter.remyandrade · school task manager · CWE-89 Pre-auth SQL injection	Critical9.8	—	1.1%	Jan 29, 2024
49Plan	CVE-2024-1021Proof of concept	Rebuild HTTP Request readRawText server-side request forgeryruifang-tech · rebuild · CWE-918 Pre-auth SSRF	Critical9.8	—	34.7%	Jan 29, 2024
53Plan	CVE-2024-23334Proof of concept	aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversalaiohttp · aiohttp · CWE-22 Pre-auth Path traversal	High7.5	—	76.8%	Jan 29, 2024
37Monitor	CVE-2023-5372No exploit	The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versizyxel · nas326 firmware · CWE-78 RCE Command injection	High7.2	—	28.4%	Jan 29, 2024
42Plan	CVE-2024-1061Proof of concept	The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' paramebplugins · html5 video player · CWE-89 Pre-auth SQL injection	Critical9.8	—	11.1%	Jan 30, 2024
27Monitor	CVE-2024-22894Proof of concept	An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3novelan · heat pumps firmware · CWE-326 RCE Weak crypto	Medium6.8	—	0.7%	Jan 30, 2024
41Plan	CVE-2024-24328Proof of concept	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFitotolink · a3300r firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	6.1%	Jan 30, 2024
41Plan	CVE-2024-24329Proof of concept	TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortFtotolink · a3300r firmware · CWE-78 pre-auth RCE Command injection	Critical9.8	—	6.1%	Jan 30, 2024
27Monitor	CVE-2024-24565Proof of concept	CrateDB database has an arbitrary file read vulnerabilitycratedb · cratedb · CWE-22 Path traversal	Medium6.5	—	3.0%	Jan 30, 2024
36Monitor	CVE-2024-21388Proof of concept	Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerabilitymicrosoft · edge chromium · CWE-20 Pre-auth	Medium6.5	—	31.9%	Jan 30, 2024
40Plan	CVE-2024-23745Proof of concept	In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack.notion · web clipper · CWE-77 pre-auth RCE Command injection	Critical9.8	—	1.9%	Jan 30, 2024
69This week	CVE-2024-1086Weaponized	Use-after-free in Linux kernel's netfilter: nf_tables componentlinux · linux kernel · CWE-416 Local privilege escalation Memory safety	High7.8	KEV	28.0%	Jan 31, 2024
32Monitor	CVE-2023-6246Proof of concept	Glibc: heap-based buffer overflow in __vsyslog_internal()gnu · glibc · CWE-122 Local privilege escalation Memory safety	High7.8	—	4.7%	Jan 31, 2024
39Monitor	CVE-2024-1112Proof of concept	Buffer Overflow Vulnerability in Resource Hackerangusj · resource hacker · CWE-119 pre-auth RCE Memory safety	Critical9.8	—	1.5%	Jan 31, 2024
61This week	CVE-2024-21888No exploit	A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a useivanti · connect secure · CWE-269	High8.8	—	85.4%	Jan 31, 2024
92Now	CVE-2024-21893Weaponized	A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) ivanti · connect secure · CWE-918 Pre-auth Auth bypass SSRF	High8.2	KEV	99.9%	Jan 31, 2024
40Plan	CVE-2024-21626Weaponized	runc container breakout through process.cwd trickery and leaked fdslinuxfoundation · runc · CWE-403	High8.6	—	18.9%	Jan 31, 2024
29Monitor	CVE-2024-23651No exploit	BuildKit possible race condition with accessing subpaths from cache mountsmobyproject · buildkit · CWE-362 Pre-auth Race condition	High7.4	—	0.9%	Jan 31, 2024
37Monitor	CVE-2024-23652Proof of concept	BuildKit possible host system access from mount stub cleanermobyproject · buildkit · CWE-22 Pre-auth Path traversal	Critical9.1	—	2.4%	Jan 31, 2024
40Plan	CVE-2024-23653Proof of concept	BuildKit interactive containers API does not validate entitlements checkmobyproject · buildkit · CWE-863 Pre-auth Broken access control (IDOR)	Critical9.8	—	3.4%	Jan 31, 2024
45Plan	CVE-2024-24747Proof of concept	MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalationminio · minio · CWE-269	High8.8	—	34.0%	Jan 31, 2024

CVE-2023-6549
77This week
Improper Restriction of Operations within the Bounds of a Memory Buffer in NetScaler ADC and NetScaler Gateway allows Unauthenticated Denial
HighCVSS 7.5KEVWeaponizedEPSS 57%
- Pre-auth
- Memory safety
- Denial of service
citrix · netscaler application delivery controllerJan 17, 2024
CVE-2024-22416
35Monitor
Cross-Site Request Forgery on any API call in pyLoad may lead to admin privilege escalation
HighCVSS 8.8Proof of conceptEPSS 0%
- Pre-auth
- CSRF
pyload-ng project · pyload-ngJan 17, 2024
CVE-2023-6184
42Plan
Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting
HighCVSS 7.2No exploitEPSS 46%
citrix · virtual apps and desktopsJan 17, 2024
CVE-2023-6970
24Monitor
WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
bootstrapped · wp recipe makerJan 18, 2024
CVE-2024-23659
24Monitor
SPIP before 4.1.14 and 4.2.x before 4.2.8 allows XSS via the name of an uploaded file.
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
spip · spipJan 19, 2024
CVE-2024-0705
31Monitor
Stripe Payment Plugin for WooCommerce <= 3.7.9 - Unauthenticated SQL Injection
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
- SQL injection
webtoffee · stripe payment plugin for woocommerceJan 19, 2024
CVE-2024-21733
25Monitor
Apache Tomcat: Leaking of unrelated request bodies in default error page
MediumCVSS 5.3Proof of conceptEPSS 14%
- Pre-auth
- Info leak
apache · tomcatJan 19, 2024
CVE-2024-0717
26Monitor
D-Link Good Line Router v2 HTTP GET Request devinfo information disclosure
MediumCVSS 5.3No exploitEPSS 18%
- Pre-auth
- Info leak
dlink · dir-825acg1 firmwareJan 19, 2024
CVE-2024-0723
31Monitor
freeSSHd denial of service
HighCVSS 7.5Proof of conceptEPSS 3%
- Pre-auth
- Denial of service
freesshd · freesshdJan 19, 2024
CVE-2024-0725
31Monitor
ProSSHD denial of service
HighCVSS 7.5Proof of conceptEPSS 3%
- Pre-auth
- Denial of service
prosshd · prosshdJan 19, 2024
CVE-2024-0737
31Monitor
Xlightftpd Xlight FTP Server Login denial of service
HighCVSS 7.5Proof of conceptEPSS 4%
- Pre-auth
- Denial of service
xlightftpd · xlight ftp serverJan 19, 2024
CVE-2023-46447
17Monitor
The POPS! Rebel application 5.0 for Android, in POPS! Rebel Bluetooth Glucose Monitoring System, sends unencrypted glucose measurements over
MediumCVSS 4.3Proof of conceptEPSS 0%
- Pre-auth
- Weak crypto
popsdiabetes · rebelJan 20, 2024
CVE-2024-0623
17Monitor
VK Block Patterns <= 1.31.1.1 - Cross-Site Request Forgery
MediumCVSS 4.3Proof of conceptEPSS 0%
- Pre-auth
- CSRF
vektor-inc · vk block patternsJan 20, 2024
CVE-2024-0679
26Monitor
ColorMag <= 3.1.2 - Missing Authorization to Arbitrary Plugin Installation
MediumCVSS 6.5Proof of conceptEPSS 1%
- Broken access control (IDOR)
themegrill · colormagJan 20, 2024
CVE-2024-0769
94Now
D-Link DIR-859 HTTP POST Request hedwig.cgi path traversal
CriticalCVSS 9.8KEVWeaponizedEPSS 82%
- Pre-auth
- Path traversal
dlink · dir-859 firmwareJan 21, 2024
CVE-2024-22895
35Monitor
DedeCMS 5.7.112 has a File Upload vulnerability via uploads/dede/module_upload.php.
HighCVSS 8.8No exploitEPSS 0%
- File upload
dedecms · dedecmsJan 22, 2024
CVE-2024-0778
49Plan
Uniview ISC 2500-S VM.php setNatConfig os command injection
CriticalCVSS 9.8No exploitEPSS 32%
- pre-auth RCE
- Command injection
uniview · isc 2500-s firmwareJan 22, 2024
CVE-2024-0204
68This week
Authentication Bypass in GoAnywhere MFT
CriticalCVSS 9.8WeaponizedEPSS 95%
- Pre-auth
- Auth bypass
fortra · goanywhere managed file transferJan 22, 2024
CVE-2024-0783
39Monitor
Project Worlds Online Admission System documents.php unrestricted upload
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- File upload
online admission system project · online admission systemJan 22, 2024
CVE-2024-23339
26Monitor
hoolock does not block Prototype pollution with object-path related utilities
MediumCVSS 6.5Proof of conceptEPSS 1%
- Pre-auth
- Prototype pollution
elijahharry · hoolockJan 22, 2024
CVE-2024-23208
31Monitor
The issue was addressed with improved memory handling.
HighCVSS 7.8Proof of conceptEPSS 1%
- RCE
- Local privilege escalation
apple · ipadosJan 22, 2024
CVE-2024-23222
68This week
A type confusion issue was addressed with improved checks.
HighCVSS 8.8KEVWeaponizedEPSS 10%
- pre-auth RCE
apple · safariJan 22, 2024
CVE-2024-0741
27Monitor
An out of bounds write in ANGLE could have allowed an attacker to corrupt memory leading to a potentially exploitable crash.
MediumCVSS 6.5Proof of conceptEPSS 2%
- Pre-auth
- Memory safety
- Denial of service
mozilla · firefoxJan 23, 2024
CVE-2023-36177
47Plan
An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information
CriticalCVSS 9.8No exploitEPSS 27%
- pre-auth RCE
badaix · snapcastJan 23, 2024
CVE-2023-47115
21Monitor
Label Studio XSS Vulnerability on Avatar Upload
MediumCVSS 5.4Proof of conceptEPSS 1%
- XSS
humansignal · label studioJan 23, 2024
CVE-2024-23638
44Plan
SQUID-2023:11 Denial of Service in Cache Manager
MediumCVSS 6.5No exploitEPSS 60%
- Denial of service
squid-cache · squidJan 23, 2024
CVE-2023-43317
35Monitor
An issue in Coign CRM Portal v.06.06 allows a remote attacker to escalate privileges via the userPermissionsList parameter in Session Storag
HighCVSS 8.8Proof of conceptEPSS 1%
coign · coignJan 24, 2024
CVE-2023-6697
24Monitor
WP Go Maps (formerly WP Google Maps) <= 9.0.28 - Reflected Cross-Site Scripting
MediumCVSS 6.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
wpgmaps · wp go mapsJan 24, 2024
CVE-2024-22651
45Plan
There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04.
CriticalCVSS 9.8No exploitEPSS 20%
- pre-auth RCE
- Command injection
dlink · dir-815 firmwareJan 24, 2024
CVE-2024-23897
99Now
Jenkins 2.441 and earlier, LTS 2.426.2 and earlier does not disable a feature of its CLI command parser that replaces an '@' character follo
CriticalCVSS 9.8KEVWeaponizedEPSS 99%
- Pre-auth
- Path traversal
jenkins · jenkinsJan 24, 2024
CVE-2024-23898
55Plan
Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests ma
HighCVSS 8.8Proof of conceptEPSS 67%
- Pre-auth
jenkins · jenkinsJan 24, 2024
CVE-2024-0624
21Monitor
Paid Memberships Pro <= 2.12.7 - Cross-Site Request Forgery to Level Orders Update
MediumCVSS 5.3Proof of conceptEPSS 0%
- Pre-auth
- CSRF
strangerstudios · paid memberships proJan 24, 2024
CVE-2024-23985
60This week
EzServer 6.4.017 allows a denial of service (daemon crash) via a long string, such as one for the RNTO command.
HighCVSS 7.5WeaponizedEPSS 3%
- Pre-auth
- Denial of service
ezhometech · ezserverJan 25, 2024
CVE-2024-22729
60This week
NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.
CriticalCVSS 9.8WeaponizedEPSS 70%
- pre-auth RCE
- Command injection
netis-systems · mw5360 firmwareJan 25, 2024
CVE-2023-52076
31Monitor
Remote Code Execution Vulnerability in Atril's EPUB ebook parsing
HighCVSS 7.8Proof of conceptEPSS 1%
- RCE
- Path traversal
mate-desktop · atrilJan 25, 2024
CVE-2023-41474
37Monitor
Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via t
MediumCVSS 6.5Proof of conceptEPSS 37%
- Path traversal
ivanti · avalancheJan 25, 2024
CVE-2023-52356
31Monitor
Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service
HighCVSS 7.5Proof of conceptEPSS 2%
- Pre-auth
- Memory safety
- Denial of service
libtiff · libtiffJan 25, 2024
CVE-2023-52251
61This week
An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/
HighCVSS 8.8WeaponizedEPSS 86%
- RCE
provectus · uiJan 25, 2024
CVE-2024-24399
33Monitor
An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code
HighCVSS 7.2No exploitEPSS 15%
- RCE
- File upload
lepton-cms · leptoncmsJan 25, 2024
CVE-2024-22922
39Monitor
An issue in Projectworlds Vistor Management Systemin PHP v.1.0 allows a remtoe attacker to escalate privileges via a crafted script to the l
CriticalCVSS 9.8Proof of conceptEPSS 0%
- Pre-auth
projectworlds · visitor management systemJan 25, 2024
CVE-2024-23055
24Monitor
An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input
MediumCVSS 6.1Proof of conceptEPSS 0%
- pre-auth RCE
plone · plone docker official imageJan 25, 2024
CVE-2024-23624
47Plan
D-Link DAP-1650 gena.cgi SUBSCRIBE Command Injection Vulnerability
CriticalCVSS 9.8No exploitEPSS 25%
- pre-auth RCE
- Command injection
dlink · dap-1650 firmwareJan 25, 2024
CVE-2024-0402
40Plan
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in GitLab
CriticalCVSS 9.9Proof of conceptEPSS 3%
- Path traversal
gitlab · gitlabJan 25, 2024
CVE-2023-5612
60This week
Missing Authorization in GitLab
MediumCVSS 5.3WeaponizedEPSS 4%
- Pre-auth
- Broken access control (IDOR)
gitlab · gitlabJan 25, 2024
CVE-2024-0918
36Monitor
TRENDnet TEW-800MB POST Request os command injection
HighCVSS 7.2No exploitEPSS 25%
- RCE
- Command injection
trendnet · tew-800mb firmwareJan 26, 2024
CVE-2024-0919
35Monitor
TRENDnet TEW-815DAP POST Request do_setNTP command injection
HighCVSS 7.2No exploitEPSS 22%
- RCE
- Command injection
trendnet · tew-815dap firmwareJan 26, 2024
CVE-2024-0921
50Plan
D-Link DIR-816 A2 Web Interface setDeviceSettings os command injection
CriticalCVSS 9.8No exploitEPSS 37%
- pre-auth RCE
- Command injection
dlink · dir-816 a2 firmwareJan 26, 2024
CVE-2024-0930
44Plan
Tenda AC10U fromSetWirelessRepeat stack-based overflow
CriticalCVSS 9.8No exploitEPSS 15%
- Pre-auth
- Memory safety
tendacn · ac10u firmwareJan 26, 2024
CVE-2024-0932
39Monitor
Tenda AC10U setSmartPowerManagement stack-based overflow
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
- Memory safety
tendacn · ac10u firmwareJan 26, 2024
CVE-2024-0939
52Plan
Byzoro Smart S210 Management Platform uploadfile.php unrestricted upload
CriticalCVSS 9.8Proof of conceptEPSS 43%
- Pre-auth
- File upload
byzoro · smart s210 firmwareJan 26, 2024
CVE-2024-23738
39Monitor
An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeCli
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
postman · postmanJan 27, 2024
CVE-2024-23743
13Monitor
Notion through 3.1.0 on macOS might allow code execution because of RunAsNode and enableNodeClilnspectArguments.
LowCVSS 3.3Proof of conceptEPSS 0%
- Local privilege escalation
notion · notionJan 27, 2024
CVE-2024-23739
40Plan
An issue in Discord for macOS version 0.0.291 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNode
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
discord · discordJan 27, 2024
CVE-2024-23741
39Monitor
An issue in Hyper on macOS version 3.4.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeCliln
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
vercel · hyperJan 27, 2024
CVE-2024-23742
40Plan
An issue in Loom on macOS version 0.196.1 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClil
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
loom · loomJan 27, 2024
CVE-2024-23740
39Monitor
An issue in Kap for macOS version 3.6.0 and before, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilns
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
getkap · kapJan 28, 2024
CVE-2024-0986
56Plan
Issabel PBX Asterisk-Cli os command injection
CriticalCVSS 9.8Proof of conceptEPSS 58%
- pre-auth RCE
- Command injection
issabel · pbxJan 28, 2024
CVE-2024-23747
30Monitor
The Moderna Sistemas ModernaNet Hospital Management System 2024 is susceptible to an Insecure Direct Object Reference (IDOR) vulnerability.
HighCVSS 7.5Proof of conceptEPSS 0%
- Pre-auth
- Broken access control (IDOR)
modernasistemas · modernanet hospital management system 2024Jan 29, 2024
CVE-2023-6389
32Monitor
WordPress Toolbar <= 2.2.6 - Open Redirect
MediumCVSS 6.1Proof of conceptEPSS 26%
- Pre-auth
- Open redirect
abhinavsingh · wordpress toolbarJan 29, 2024
CVE-2024-24134
19Monitor
Sourcecodester Online Food Menu 1.0 is vulnerable to Cross Site Scripting (XSS) via the 'Menu Name' and 'Description' fields in the Update M
MediumCVSS 4.8Proof of conceptEPSS 0%
- XSS
remyandrade · online food menuJan 29, 2024
CVE-2024-24135
24Monitor
Product Name and Product Code in the 'Add Product' section of Sourcecodester Product Inventory with Export to Excel 1.0 are vulnerable to XS
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
remyandrade · product inventory with export to excelJan 29, 2024
CVE-2024-24136
24Monitor
The 'Your Name' field in the Submit Score section of Sourcecodester Math Game with Leaderboard v1.0 is vulnerable to Cross-Site Scripting (X
MediumCVSS 6.1Proof of conceptEPSS 0%
- Pre-auth
- XSS
remyandrade · math gameJan 29, 2024
CVE-2024-24139
28Monitor
Sourcecodester Login System with Email Verification 1.0 allows SQL Injection via the 'user' parameter.
HighCVSS 7.2Proof of conceptEPSS 1%
- SQL injection
remyandrade · login system with email verificationJan 29, 2024
CVE-2024-24140
28Monitor
Sourcecodester Daily Habit Tracker App 1.0 allows SQL Injection via the parameter 'tracker.'
HighCVSS 7.2Proof of conceptEPSS 1%
- SQL injection
remyandrade · daily habit trackerJan 29, 2024
CVE-2024-24141
39Monitor
Sourcecodester School Task Manager App 1.0 allows SQL Injection via the 'task' parameter.
CriticalCVSS 9.8Proof of conceptEPSS 1%
- Pre-auth
- SQL injection
remyandrade · school task managerJan 29, 2024
CVE-2024-1021
49Plan
Rebuild HTTP Request readRawText server-side request forgery
CriticalCVSS 9.8Proof of conceptEPSS 34%
- Pre-auth
- SSRF
ruifang-tech · rebuildJan 29, 2024
CVE-2024-23334
53Plan
aiohttp.web.static(follow_symlinks=True) is vulnerable to directory traversal
HighCVSS 7.5Proof of conceptEPSS 76%
- Pre-auth
- Path traversal
aiohttp · aiohttpJan 29, 2024
CVE-2023-5372
37Monitor
The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versi
HighCVSS 7.2No exploitEPSS 28%
- RCE
- Command injection
zyxel · nas326 firmwareJan 29, 2024
CVE-2024-1061
42Plan
The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parame
CriticalCVSS 9.8Proof of conceptEPSS 11%
- Pre-auth
- SQL injection
bplugins · html5 video playerJan 30, 2024
CVE-2024-22894
27Monitor
An issue fixed in AIT-Deutschland Alpha Innotec Heatpumps V2.88.3 or later, V3.89.0 or later, V4.81.3 or later and Novelan Heatpumps V2.88.3
MediumCVSS 6.8Proof of conceptEPSS 0%
- RCE
- Weak crypto
novelan · heat pumps firmwareJan 30, 2024
CVE-2024-24328
41Plan
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFi
CriticalCVSS 9.8Proof of conceptEPSS 6%
- pre-auth RCE
- Command injection
totolink · a3300r firmwareJan 30, 2024
CVE-2024-24329
41Plan
TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortF
CriticalCVSS 9.8Proof of conceptEPSS 6%
- pre-auth RCE
- Command injection
totolink · a3300r firmwareJan 30, 2024
CVE-2024-24565
27Monitor
CrateDB database has an arbitrary file read vulnerability
MediumCVSS 6.5Proof of conceptEPSS 3%
- Path traversal
cratedb · cratedbJan 30, 2024
CVE-2024-21388
36Monitor
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
MediumCVSS 6.5Proof of conceptEPSS 31%
- Pre-auth
microsoft · edge chromiumJan 30, 2024
CVE-2024-23745
40Plan
In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack.
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- Command injection
notion · web clipperJan 30, 2024
CVE-2024-1086
69This week
Use-after-free in Linux kernel's netfilter: nf_tables component
HighCVSS 7.8KEVWeaponizedEPSS 28%
- Local privilege escalation
- Memory safety
linux · linux kernelJan 31, 2024
CVE-2023-6246
32Monitor
Glibc: heap-based buffer overflow in __vsyslog_internal()
HighCVSS 7.8Proof of conceptEPSS 4%
- Local privilege escalation
- Memory safety
gnu · glibcJan 31, 2024
CVE-2024-1112
39Monitor
Buffer Overflow Vulnerability in Resource Hacker
CriticalCVSS 9.8Proof of conceptEPSS 1%
- pre-auth RCE
- Memory safety
angusj · resource hackerJan 31, 2024
CVE-2024-21888
61This week
A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a use
HighCVSS 8.8No exploitEPSS 85%
ivanti · connect secureJan 31, 2024
CVE-2024-21893
92Now
A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x)
HighCVSS 8.2KEVWeaponizedEPSS 99%
- Pre-auth
- Auth bypass
- SSRF
ivanti · connect secureJan 31, 2024
CVE-2024-21626
40Plan
runc container breakout through process.cwd trickery and leaked fds
HighCVSS 8.6WeaponizedEPSS 18%
linuxfoundation · runcJan 31, 2024
CVE-2024-23651
29Monitor
BuildKit possible race condition with accessing subpaths from cache mounts
HighCVSS 7.4No exploitEPSS 0%
- Pre-auth
- Race condition
mobyproject · buildkitJan 31, 2024
CVE-2024-23652
37Monitor
BuildKit possible host system access from mount stub cleaner
CriticalCVSS 9.1Proof of conceptEPSS 2%
- Pre-auth
- Path traversal
mobyproject · buildkitJan 31, 2024
CVE-2024-23653
40Plan
BuildKit interactive containers API does not validate entitlements check
CriticalCVSS 9.8Proof of conceptEPSS 3%
- Pre-auth
- Broken access control (IDOR)
mobyproject · buildkitJan 31, 2024
CVE-2024-24747
45Plan
MinIO unsafe default: Access keys inherit `admin` of root user, allowing privilege escalation
HighCVSS 8.8Proof of conceptEPSS 34%
minio · minioJan 31, 2024