Skip to content
OpenAdvisories

Archive

23 January 2024

Vulnerabilities first published on this day (UTC), newest first.

← December 2023 2024 / January /23 February 2024 →
  1. 115
  2. 2107
  3. 395
  4. 459
  5. 574
  6. 68
  7. 735
  8. 8197
  9. 9159
  10. 10178
  11. 11139
  12. 12129
  13. 1352
  14. 144
  15. 1566
  16. 16228
  17. 1785
  18. 1890
  19. 19108
  20. 2015
  21. 2114
  22. 2258
  23. 23147
  24. 2476
  25. 2574
  26. 26111
  27. 2717
  28. 2810
  29. 2994
  30. 3076
  31. 3192
All Critical High Medium Low Exploited only Public exploit

14 results · Clear filters · Feed

  • Critical 9.8
    CVE-2024-0808

    Integer underflow in WebUI in Google Chrome prior to 121.0.6167.85 allowed a remote attacker to potentially exploit hea…

    Google Chrome chromium qt6-qtwebengine Browsers Debian Alpine
  • Critical 9.8
    CVE-2024-23636

    SOFARPC Remote Command Execution(RCE) Vulnerbility

    SOFARPC is a Java RPC framework. SOFARPC defaults to using the SOFA Hessian protocol to deserialize received data, while the SOFA Hessian protocol uses a blacklist mechanism to restrict deserialization of potentially dangerous classes for security protection.…

    sofastack sofa-rpc com.alipay.sofa:rpc-sofa-boot-starter Maven
  • Critical 9.1
    CVE-2024-22205

    Whoogle Search Server Side Request Forgery vulnerability

    Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input from the `location` variable and passes it to the `send` method which sends a `GET` request on lines 339-343 in `reques…

    benbusby whoogle-search whoogle-search PyPI
  • Critical 9.1
    CVE-2024-22203 Public exploit

    Whoogle Search Server Side Request Forgery vulnerability

    Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the user-controlled `src_type` and `element_url` variables and passes them to the `send` method which sends a GET request …

    benbusby whoogle-search whoogle-search PyPI
  • Critical 9.6
    CVE-2023-49657

    Apache Superset: Stored XSS in Dashboard Title and Chart Title

    A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For …

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Critical 9.8
    CVE-2023-35837

    An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. Authentication for web interface is completed via an u…

  • Critical 9.8
    CVE-2023-35835

    An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. The device provides a WiFi access point for initial co…

  • Critical 9.8
    CVE-2023-36177 EPSS 28%

    An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain s…

    snapcast snapcast Debian Ubuntu
  • Critical 9.8
    CVE-2023-31654

    Redis raft master-1b8bd86 to master-7b46079 was discovered to contain an ODR violation via the component hiredisAllocFn…

  • Critical 9.8
    CVE-2023-51210

    SQL injection vulnerability in Webkul Bundle Product 6.0.1 allows a remote attacker to execute arbitrary code via the i…

  • Critical 9.8
    CVE-2024-22662

    TOTOLINK A3700R_V9.1.2u.6165_20211012 has a stack overflow vulnerability via setParentalRules

  • Critical 9.8
    CVE-2024-22663

    TOTOLINK_A3700R_V9.1.2u.6165_20211012has a command Injection vulnerability via setOpModeCfg

  • Critical 9.8
    CVE-2024-22076

    MyQ Print Server before 8.2 patch 43 allows remote authenticated administrators to execute arbitrary code via PHP scrip…

  • Critical 9.8
    CVE-2024-22660

    TOTOLINK_A3700R_V9.1.2u.6165_20211012has a stack overflow vulnerability via setLanguageCfg