CVEs published February 1, 2024
98 CVEs were published on February 1, 2024: 10 critical, 20 high.
- Published
- 98
- Critical
- 10
- High
- 20
- Medium
- 66
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Rapid Software Rapid SCADA
- 7
- MachineSense FeverWarn
- 6
- brefphp bref · bref/bref
- 3
- webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- 3
- Dell PowerScale OneFS
- 2
- Gessler WEB-MASTER
- 2
- glpi-project glpi
- 2
- AAM Advanced Access Manager – Restricted Content, Users & R…
- 1
- Academy Software Foundation OpenEXR
- 1
- Advanced iFrame
- 1
Critical 10
- CVE-2024-21764Use of Hard-Coded Credentials in Rapid SCADARapid Software Rapid SCADA
- CVE-2023-49617MachineSense FeverWarn Missing Authentication for Critical FunctionMachineSense FeverWarn
- CVE-2023-46706MachineSense FeverWarn Use of Hard-coded CredentialsMachineSense FeverWarn
- CVE-2023-4472Cryptographically weak PRNG in Opinio 7.22Objectplanet Opinio
- CVE-2024-1039Use of Hard-coded Credentials in Gessler GmbH WEB-MASTERGessler WEB-MASTER
- CVE-2023-5841OpenEXR Heap Overflow in Scanline Deep Data ParsingAcademy Software Foundation OpenEXR
- CVE-2024-24561Vyper bounds check on built-in `slice()` function can be overflowedvyperlang vyper · vyper
- CVE-2024-23832Mastodon Remote user impersonation and takeovermastodon
- CVE-2024-23328The Dataease datasource exists deserialization and arbitrary file read vulnerabilitydataease
- CVE-2024-23052An issue in WuKongOpenSource WukongCRM v.72crm_9.0.1_20191202 allows a remote attacker to execute arbitrary code via the parseObject() funct
High 20
- CVE-2024-22016Incorrect Permission Assignment for Critical Resource in Rapid SCADARapid Software Rapid SCADA
- CVE-2024-21852Rapid SCADA Path TraversalRapid Software Rapid SCADA
- CVE-2023-36496Delegated Admin Virtual Attribute Provider Privilege EscalationPing Identity PingDirectory
- CVE-2024-24756Crafatar path traversal vulnerabilitycrafatar
- CVE-2023-49610MachineSense FeverWarn Improper Input ValidationMachineSense FeverWarn
- CVE-2023-47867MachineSense FeverWarn Improper Access ControlMachineSense FeverWarn
- CVE-2023-49115MachineSense FeverWarn Missing Authentication for Critical FunctionMachineSense FeverWarn
- CVE-2023-6221MachineSense FeverWarn Missing Authentication for Critical FunctionMachineSense FeverWarn
- CVE-2024-24570Statamic account takeover via XSS and password reset linkstatamic cms · statamic/cms
- CVE-2024-22433 Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get_ldap_info inDell Data Protection Search
- CVE-2023-6078OS Command Injection vulnerability affecting BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023Dassault Systèmes BIOVIA Materials Studio products
- CVE-2023-51509WordPress RegistrationMagic Plugin <= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS)Metagauss RegistrationMagic – Custom Registration Forms, Us…
- CVE-2023-51540WordPress Custom 404 Pro Plugin <= 3.10.0 is vulnerable to Cross Site Scripting (XSS)Kunal Nagar Custom 404 Pro
- CVE-2024-21750WordPress Shortcodes Finder Plugin <= 1.5.5 is vulnerable to Cross Site Scripting (XSS)Scribit Shortcodes Finder
- CVE-2024-22148WordPress WP Smart Editor Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)WP Smart Editor JoomUnited
- CVE-2024-24548Payment EX Ver1.1.5b and earlier allows a remote unauthenticated attacker to obtain the information of the user who purchases merchandise usSimplesite Payment EX
- CVE-2023-47257ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages.
- CVE-2023-51939An issue in the cp_bbs_sig function in relic/src/cp/relic_cp_bbs.c of Relic relic-toolkit 0.6.0 allows a remote attacker to obtain sensitive
- CVE-2024-22859Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken fu
- CVE-2024-22939Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_
Medium, low and unrated 68
- CVE-2023-50939IBM PowerSC information DisclosureIBM PowerSC
- CVE-2024-21866Generation of Error Message Containing Sensitive Information in Rapid SCADARapid Software Rapid SCADA
- CVE-2024-21869Plaintext Storage of a Password in Rapid SCADARapid Software Rapid SCADA
- CVE-2024-21794Open Redirect in Rapid SCADARapid Software Rapid SCADA
- CVE-2024-22096Relative Path Traversal in Rapid SCADARapid Software Rapid SCADA
- CVE-2024-24755discourse-group-membership-ip-block is exposing potentially sensitive custom fieldsdiscourse-group-membership-ip-block
- CVE-2024-0325Command Injection in Helix SyncHelix Sync
- CVE-2024-1040Use of a Broken or Risky Cryptographic Algorithm in Gessler GmbH WEB-MASTERGessler WEB-MASTER
- CVE-2024-24569`ZipSecurity#isBelowCurrentDirectory` is vulnerable to partial-path traversal vulnerabilitypixee java-security-toolkit
- CVE-2024-1167SEW-EURODRIVE MOVITOOLS MotionStudio Improper Restriction of XML External Entity ReferenceSEW-EURODRIVE MOVITOOLS MotionStudio
- CVE-2024-24557Moby classic builder cache poisoningmoby · github.com/docker/docker +1
- CVE-2024-24754Bref Body Parsing Inconsistency in Event-Driven Functionsbrefphp bref · bref/bref
- CVE-2024-24752Bref Uploaded Files Not Deleted in Event-Driven Functionsbrefphp bref · bref/bref
- CVE-2024-24753Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2brefphp bref · bref/bref
- CVE-2023-51446GLPI LDAP Injection during authenticationglpi-project glpi
- CVE-2024-23645GLPI reflected XSS in reports pagesglpi-project glpi
- CVE-2024-1141Glance-store: glance store access key logged in debug log levelglance-store · Red Hat OpenStack Platform 17.1 for RHEL +1
- CVE-2024-0935Insertion of Sensitive Information into Log File vulnerabilities affecting DELMIA Apriso Release 2019 through Release 2024Dassault Systèmes DELMIA Apriso
- CVE-2023-51506WordPress WPCS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)realmag777 WPCS – WordPress Currency Switcher Professional
- CVE-2023-51514WordPress CBX Bookmark & Favorite Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)Codeboxr Team CBX Bookmark & Favorite
- CVE-2023-51520WordPress Booking Calendar Plugin < 9.7.4 is vulnerable to Cross Site Scripting (XSS)WPdevelop / Oplugins WP Booking Calendar
- CVE-2023-51695WordPress Everest Forms Plugin <= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS)WPEverest Everest Forms – Build Contact Forms, Surveys, Pol…
- CVE-2023-51694WordPress Embed Privacy Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)Epiphyt Embed Privacy
- CVE-2023-51693WordPress Themify Icons Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)Themify Icons
- CVE-2023-51532WordPress Icegram Plugin <= 3.1.19 is vulnerable to Cross Site Scripting (XSS)Icegram Engage – WordPress Lead Generation, Popup Builder,…
- CVE-2023-51691WordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS)gVectors Team Comments – wpDiscuz
- CVE-2023-51690WordPress Advanced iFrame Plugin <= 2023.8 is vulnerable to Cross Site Scripting (XSS)Advanced iFrame
- CVE-2023-51689WordPress Easy Video Player Plugin <= 1.2.2.10 is vulnerable to Cross Site Scripting (XSS)naa986 Easy Video Player
- CVE-2023-51685WordPress WP Review Slider Plugin <= 12.7 is vulnerable to Cross Site Scripting (XSS)LJ Apps WP Review Slider
- CVE-2023-51684WordPress Easy Digital Downloads Plugin <= 3.2.5 is vulnerable to Cross Site Scripting (XSS)Easy Digital Downloads – Sell Digital Files
- CVE-2023-51534WordPress Brave Popup Builder Plugin <= 0.6.2 is vulnerable to Cross Site Scripting (XSS)Brave – Create Popup, Optins, Lead Generation, Survey, Stic…
- CVE-2023-51677WordPress Schema & Structured Data for WP & AMP Plugin <= 1.23 is vulnerable to Cross Site Scripting (XSS)Magazine3 Schema & Structured Data for WP & AMP
- CVE-2023-51536WordPress CRM Perks Forms Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)CRM Perks Forms – WordPress Form Builder
- CVE-2023-51674WordPress Advanced Access Manager Plugin <= 6.9.18 is vulnerable to Cross Site Scripting (XSS)AAM Advanced Access Manager – Restricted Content, Users & R…
- CVE-2023-51669WordPress Product Code for WooCommerce Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)Artios Media Product Code for WooCommerce
- CVE-2023-51666WordPress Related Post Plugin <= 2.0.53 is vulnerable to Cross Site Scripting (XSS)PickPlugins Related Post
- CVE-2023-51548WordPress SlickNav Mobile Menu Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)Neil Gee SlickNav Mobile Menu
- CVE-2023-52118WordPress WP User Profile Avatar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)WP Event Manager WP User Profile Avatar
- CVE-2023-52175WordPress Auto Amazon Links Plugin <= 5.1.1 is vulnerable to Cross Site Scripting (XSS)Michael Uno (miunosoft) Auto Amazon Links – Amazon Associat…
- CVE-2023-52188WordPress Footer Putter Plugin <= 1.17 is vulnerable to Cross Site Scripting (XSS)Russell Jamieson Footer Putter
- CVE-2023-52189WordPress Ideal Interactive Map Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)Jhayghost Ideal Interactive Map
- CVE-2023-52191WordPress Infogram Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)Torbjon Infogram – Add charts, maps and infographics
- CVE-2023-52192WordPress Keap Official Opt-in Forms Plugin <= 1.0.11 is vulnerable to Cross Site Scripting (XSS)Keap Official Opt-in Forms
- CVE-2024-22430 Dell PowerScale OneFS versions 8.2.x through 9.6.0.x contains an incorrect default permissions vulnerability.Dell PowerScale OneFS
- CVE-2023-52193WordPress Page Builder: Live Composer Plugin <= 1.5.23 is vulnerable to Cross Site Scripting (XSS)Live Composer Team Page Builder: Live Composer
- CVE-2024-22449 Dell PowerScale OneFS versions 9.0.0.x through 9.6.0.x contains a missing authentication for critical function vulnerability.Dell PowerScale OneFS
- CVE-2023-52194WordPress oEmbed Gist Plugin <= 4.9.1 is vulnerable to Cross Site Scripting (XSS)Takayuki Miyauchi oEmbed Gist
- CVE-2023-52195WordPress Posts to Page Plugin <= 1.7 is vulnerable to Cross Site Scripting (XSS)Posts to Page Kerry James
- CVE-2024-1130NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_read()webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2024-1129NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via set_starred()webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2024-0907NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.5.6 - Missing Authorization via restore_records()webaways NEX-Forms – Ultimate Forms Plugin for WordPress
- CVE-2024-23941Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remoteIntermesh BV Group Office
- CVE-2023-7069Advanced iFrame <= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scriptingmdempfle Advanced iFrame
- CVE-2024-0831Vault May Expose Sensitive Information When Configuring An Audit Log DeviceHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-47256ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings
- CVE-2023-51835An issue in TRENDnet TEW-822DRE v.1.03B02 allows a local attacker to execute arbitrary code via the parameters ipv4_ping in the /boafrm/form
- CVE-2024-22927Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted
- CVE-2024-22936Cross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student Informatio
- CVE-2024-23031Cross Site Scripting (XSS) vulnerability in is_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted
- CVE-2024-23032Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
- CVE-2024-23033Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
- CVE-2024-23034Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL.
- CVE-2024-24041A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute ar
- CVE-2024-24059springboot-manager v1.6 is vulnerable to Arbitrary File Upload.
- CVE-2024-24060springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user.
- CVE-2024-24061springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add.
- CVE-2024-24062springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role.
- CVE-2024-24945A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute ar