# CVEs published 2024-02-01

98 CVEs were published on February 1, 2024: 10 critical, 20 high. Days are UTC.

- [CVE-2023-50939](https://cve.now/CVE-2023-50939.md): IBM PowerSC information Disclosure (CVSS 5.9, IBM PowerSC)
- [CVE-2024-21866](https://cve.now/CVE-2024-21866.md): Generation of Error Message Containing Sensitive Information in Rapid SCADA (CVSS 5.3, Rapid Software Rapid SCADA)
- [CVE-2024-21869](https://cve.now/CVE-2024-21869.md): Plaintext Storage of a Password in Rapid SCADA (CVSS 6.2, Rapid Software Rapid SCADA)
- [CVE-2024-21764](https://cve.now/CVE-2024-21764.md): Use of Hard-Coded Credentials in Rapid SCADA (CVSS 9.8, Rapid Software Rapid SCADA)
- [CVE-2024-21794](https://cve.now/CVE-2024-21794.md): Open Redirect in Rapid SCADA (CVSS 5.4, Rapid Software Rapid SCADA)
- [CVE-2024-22016](https://cve.now/CVE-2024-22016.md): Incorrect Permission Assignment for Critical Resource in Rapid SCADA (CVSS 7.8, Rapid Software Rapid SCADA)
- [CVE-2024-22096](https://cve.now/CVE-2024-22096.md): Relative Path Traversal in Rapid SCADA (CVSS 6.5, Rapid Software Rapid SCADA)
- [CVE-2024-21852](https://cve.now/CVE-2024-21852.md): Rapid SCADA Path Traversal (CVSS 8.8, Rapid Software Rapid SCADA)
- [CVE-2023-36496](https://cve.now/CVE-2023-36496.md): Delegated Admin Virtual Attribute Provider Privilege Escalation (CVSS 7.7, Ping Identity PingDirectory)
- [CVE-2024-24756](https://cve.now/CVE-2024-24756.md): Crafatar path traversal vulnerability (CVSS 7.5, crafatar)
- [CVE-2023-49610](https://cve.now/CVE-2023-49610.md): MachineSense FeverWarn Improper Input Validation (CVSS 8.1, MachineSense FeverWarn)
- [CVE-2023-47867](https://cve.now/CVE-2023-47867.md): MachineSense FeverWarn Improper Access Control (CVSS 8.8, MachineSense FeverWarn)
- [CVE-2023-49115](https://cve.now/CVE-2023-49115.md): MachineSense FeverWarn Missing Authentication for Critical Function (CVSS 7.5, MachineSense FeverWarn)
- [CVE-2023-49617](https://cve.now/CVE-2023-49617.md): MachineSense FeverWarn Missing Authentication for Critical Function (CVSS 10.0, MachineSense FeverWarn)
- [CVE-2023-46706](https://cve.now/CVE-2023-46706.md): MachineSense FeverWarn Use of Hard-coded Credentials (CVSS 9.1, MachineSense FeverWarn)
- [CVE-2023-6221](https://cve.now/CVE-2023-6221.md): MachineSense FeverWarn Missing Authentication for Critical Function (CVSS 7.7, MachineSense FeverWarn)
- [CVE-2024-24755](https://cve.now/CVE-2024-24755.md): discourse-group-membership-ip-block is exposing potentially sensitive custom fields (CVSS 4.3, discourse-group-membership-ip-block)
- [CVE-2023-4472](https://cve.now/CVE-2023-4472.md): Cryptographically weak PRNG in Opinio 7.22 (CVSS 9.8, Objectplanet Opinio)
- [CVE-2024-0325](https://cve.now/CVE-2024-0325.md): Command Injection in Helix Sync (CVSS 3.6, Helix Sync)
- [CVE-2024-1040](https://cve.now/CVE-2024-1040.md): Use of a Broken or Risky Cryptographic Algorithm in Gessler GmbH WEB-MASTER (CVSS 4.4, Gessler WEB-MASTER)
- [CVE-2024-1039](https://cve.now/CVE-2024-1039.md): Use of Hard-coded Credentials in Gessler GmbH WEB-MASTER (CVSS 9.8, Gessler WEB-MASTER)
- [CVE-2024-24569](https://cve.now/CVE-2024-24569.md): \`ZipSecurity#isBelowCurrentDirectory\` is vulnerable to partial-path traversal vulnerability (CVSS 5.4, pixee java-security-toolkit)
- [CVE-2023-5841](https://cve.now/CVE-2023-5841.md): OpenEXR Heap Overflow in Scanline Deep Data Parsing (CVSS 9.1, Academy Software Foundation OpenEXR)
- [CVE-2024-1167](https://cve.now/CVE-2024-1167.md): SEW-EURODRIVE MOVITOOLS MotionStudio Improper Restriction of XML External Entity Reference (CVSS 5.5, SEW-EURODRIVE MOVITOOLS MotionStudio)
- [CVE-2024-24570](https://cve.now/CVE-2024-24570.md): Statamic account takeover via XSS and password reset link (CVSS 8.2, statamic cms · statamic/cms)
- [CVE-2024-24561](https://cve.now/CVE-2024-24561.md): Vyper bounds check on built-in \`slice()\` function can be overflowed (CVSS 9.8, vyperlang vyper · vyper)
- [CVE-2024-24557](https://cve.now/CVE-2024-24557.md): Moby classic builder cache poisoning (CVSS 6.9, moby · github.com/docker/docker +1)
- [CVE-2024-23832](https://cve.now/CVE-2024-23832.md): Mastodon Remote user impersonation and takeover (CVSS 9.4, mastodon)
- [CVE-2024-24754](https://cve.now/CVE-2024-24754.md): Bref Body Parsing Inconsistency in Event-Driven Functions (CVSS 3.7, brefphp bref · bref/bref)
- [CVE-2024-24752](https://cve.now/CVE-2024-24752.md): Bref Uploaded Files Not Deleted in Event-Driven Functions (CVSS 6.5, brefphp bref · bref/bref)
- [CVE-2024-24753](https://cve.now/CVE-2024-24753.md): Bref Multiple Value Headers Not Supported in ApiGatewayFormatV2 (CVSS 4.8, brefphp bref · bref/bref)
- [CVE-2024-22433](https://cve.now/CVE-2024-22433.md): Dell Data Protection Search 19.2.0 and above contain an exposed password opportunity in plain text when using LdapSettings.get\_ldap\_info in (CVSS 8.8, Dell Data Protection Search)
- [CVE-2024-23328](https://cve.now/CVE-2024-23328.md): The Dataease datasource exists deserialization and arbitrary file read vulnerability (CVSS 9.1, dataease)
- [CVE-2023-51446](https://cve.now/CVE-2023-51446.md): GLPI LDAP Injection during authentication (CVSS 5.9, glpi-project glpi)
- [CVE-2024-23645](https://cve.now/CVE-2024-23645.md): GLPI reflected XSS in reports pages (CVSS 6.5, glpi-project glpi)
- [CVE-2024-1141](https://cve.now/CVE-2024-1141.md): Glance-store: glance store access key logged in debug log level (CVSS 5.5, glance-store · Red Hat OpenStack Platform 17.1 for RHEL +1)
- [CVE-2024-0935](https://cve.now/CVE-2024-0935.md): Insertion of Sensitive Information into Log File vulnerabilities affecting DELMIA Apriso Release 2019 through Release 2024 (CVSS 4.4, Dassault Systèmes DELMIA Apriso)
- [CVE-2023-6078](https://cve.now/CVE-2023-6078.md): OS Command Injection vulnerability affecting BIOVIA Materials Studio products from Release BIOVIA 2021 through Release BIOVIA 2023 (CVSS 8.8, Dassault Systèmes BIOVIA Materials Studio products)
- [CVE-2023-51509](https://cve.now/CVE-2023-51509.md): WordPress RegistrationMagic Plugin \<= 5.2.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Metagauss RegistrationMagic – Custom Registration Forms, Us…)
- [CVE-2023-51506](https://cve.now/CVE-2023-51506.md): WordPress WPCS Plugin \<= 1.2.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.5, realmag777 WPCS – WordPress Currency Switcher Professional)
- [CVE-2023-51514](https://cve.now/CVE-2023-51514.md): WordPress CBX Bookmark & Favorite Plugin \<= 1.7.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Codeboxr Team CBX Bookmark & Favorite)
- [CVE-2023-51520](https://cve.now/CVE-2023-51520.md): WordPress Booking Calendar Plugin \< 9.7.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WPdevelop / Oplugins WP Booking Calendar)
- [CVE-2023-51695](https://cve.now/CVE-2023-51695.md): WordPress Everest Forms Plugin \<= 2.0.4.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, WPEverest Everest Forms – Build Contact Forms, Surveys, Pol…)
- [CVE-2023-51694](https://cve.now/CVE-2023-51694.md): WordPress Embed Privacy Plugin \<= 1.8.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Epiphyt Embed Privacy)
- [CVE-2023-51693](https://cve.now/CVE-2023-51693.md): WordPress Themify Icons Plugin \<= 2.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Themify Icons)
- [CVE-2023-51532](https://cve.now/CVE-2023-51532.md): WordPress Icegram Plugin \<= 3.1.19 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Icegram Engage – WordPress Lead Generation, Popup Builder,…)
- [CVE-2023-51691](https://cve.now/CVE-2023-51691.md): WordPress wpDiscuz Plugin \<= 7.6.12 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, gVectors Team Comments – wpDiscuz)
- [CVE-2023-51690](https://cve.now/CVE-2023-51690.md): WordPress Advanced iFrame Plugin \<= 2023.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Advanced iFrame)
- [CVE-2023-51689](https://cve.now/CVE-2023-51689.md): WordPress Easy Video Player Plugin \<= 1.2.2.10 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, naa986 Easy Video Player)
- [CVE-2023-51685](https://cve.now/CVE-2023-51685.md): WordPress WP Review Slider Plugin \<= 12.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, LJ Apps WP Review Slider)
- [CVE-2023-51684](https://cve.now/CVE-2023-51684.md): WordPress Easy Digital Downloads Plugin \<= 3.2.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Easy Digital Downloads – Sell Digital Files)
- [CVE-2023-51534](https://cve.now/CVE-2023-51534.md): WordPress Brave Popup Builder Plugin \<= 0.6.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Brave – Create Popup, Optins, Lead Generation, Survey, Stic…)
- [CVE-2023-51677](https://cve.now/CVE-2023-51677.md): WordPress Schema & Structured Data for WP & AMP Plugin \<= 1.23 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Magazine3 Schema & Structured Data for WP & AMP)
- [CVE-2023-51536](https://cve.now/CVE-2023-51536.md): WordPress CRM Perks Forms Plugin \<= 1.1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, CRM Perks Forms – WordPress Form Builder)
- [CVE-2023-51674](https://cve.now/CVE-2023-51674.md): WordPress Advanced Access Manager Plugin \<= 6.9.18 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, AAM Advanced Access Manager – Restricted Content, Users & R…)
- [CVE-2023-51669](https://cve.now/CVE-2023-51669.md): WordPress Product Code for WooCommerce Plugin \<= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Artios Media Product Code for WooCommerce)
- [CVE-2023-51666](https://cve.now/CVE-2023-51666.md): WordPress Related Post Plugin \<= 2.0.53 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, PickPlugins Related Post)
- [CVE-2023-51548](https://cve.now/CVE-2023-51548.md): WordPress SlickNav Mobile Menu Plugin \<= 1.9.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Neil Gee SlickNav Mobile Menu)
- [CVE-2023-51540](https://cve.now/CVE-2023-51540.md): WordPress Custom 404 Pro Plugin \<= 3.10.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Kunal Nagar Custom 404 Pro)
- [CVE-2023-52118](https://cve.now/CVE-2023-52118.md): WordPress WP User Profile Avatar Plugin \<= 1.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WP Event Manager WP User Profile Avatar)
- [CVE-2023-52175](https://cve.now/CVE-2023-52175.md): WordPress Auto Amazon Links Plugin \<= 5.1.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Michael Uno (miunosoft) Auto Amazon Links – Amazon Associat…)
- [CVE-2023-52188](https://cve.now/CVE-2023-52188.md): WordPress Footer Putter Plugin \<= 1.17 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Russell Jamieson Footer Putter)
- [CVE-2023-52189](https://cve.now/CVE-2023-52189.md): WordPress Ideal Interactive Map Plugin \<= 1.2.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Jhayghost Ideal Interactive Map)
- [CVE-2023-52191](https://cve.now/CVE-2023-52191.md): WordPress Infogram Plugin \<= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Torbjon Infogram – Add charts, maps and infographics)
- [CVE-2023-52192](https://cve.now/CVE-2023-52192.md): WordPress Keap Official Opt-in Forms Plugin \<= 1.0.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Keap Official Opt-in Forms)
- [CVE-2024-22430](https://cve.now/CVE-2024-22430.md): Dell PowerScale OneFS versions 8.2.x through 9.6.0.x contains an incorrect default permissions vulnerability. (CVSS 5.5, Dell PowerScale OneFS)
- [CVE-2023-52193](https://cve.now/CVE-2023-52193.md): WordPress Page Builder: Live Composer Plugin \<= 1.5.23 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Live Composer Team Page Builder: Live Composer)
- [CVE-2024-22449](https://cve.now/CVE-2024-22449.md): Dell PowerScale OneFS versions 9.0.0.x through 9.6.0.x contains a missing authentication for critical function vulnerability. (CVSS 6.6, Dell PowerScale OneFS)
- [CVE-2023-52194](https://cve.now/CVE-2023-52194.md): WordPress oEmbed Gist Plugin \<= 4.9.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Takayuki Miyauchi oEmbed Gist)
- [CVE-2023-52195](https://cve.now/CVE-2023-52195.md): WordPress Posts to Page Plugin \<= 1.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Posts to Page Kerry James)
- [CVE-2024-21750](https://cve.now/CVE-2024-21750.md): WordPress Shortcodes Finder Plugin \<= 1.5.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Scribit Shortcodes Finder)
- [CVE-2024-22148](https://cve.now/CVE-2024-22148.md): WordPress WP Smart Editor Plugin \<= 1.3.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WP Smart Editor JoomUnited)
- [CVE-2024-24548](https://cve.now/CVE-2024-24548.md): Payment EX Ver1.1.5b and earlier allows a remote unauthenticated attacker to obtain the information of the user who purchases merchandise us (CVSS 7.5, Simplesite Payment EX)
- [CVE-2024-1130](https://cve.now/CVE-2024-1130.md): NEX-Forms – Ultimate Form Builder – Contact forms and much more \<= 8.5.6 - Missing Authorization via set\_read() (CVSS 5.3, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2024-1129](https://cve.now/CVE-2024-1129.md): NEX-Forms – Ultimate Form Builder – Contact forms and much more \<= 8.5.6 - Missing Authorization via set\_starred() (CVSS 5.3, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2024-0907](https://cve.now/CVE-2024-0907.md): NEX-Forms – Ultimate Form Builder – Contact forms and much more \<= 8.5.6 - Missing Authorization via restore\_records() (CVSS 5.3, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2024-23941](https://cve.now/CVE-2024-23941.md): Cross-site scripting vulnerability exists in Group Office prior to v6.6.182, prior to v6.7.64 and prior to v6.8.31, which may allow a remote (CVSS 5.4, Intermesh BV Group Office)
- [CVE-2023-7069](https://cve.now/CVE-2023-7069.md): Advanced iFrame \<= 2023.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, mdempfle Advanced iFrame)
- [CVE-2024-0831](https://cve.now/CVE-2024-0831.md): Vault May Expose Sensitive Information When Configuring An Audit Log Device (CVSS 4.5, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2023-47256](https://cve.now/CVE-2023-47256.md): ConnectWise ScreenConnect through 23.8.4 allows local users to connect to arbitrary relay servers via implicit trust of proxy settings (CVSS 5.5)
- [CVE-2023-47257](https://cve.now/CVE-2023-47257.md): ConnectWise ScreenConnect through 23.8.4 allows man-in-the-middle attackers to achieve remote code execution via crafted messages. (CVSS 8.1)
- [CVE-2023-51835](https://cve.now/CVE-2023-51835.md): An issue in TRENDnet TEW-822DRE v.1.03B02 allows a local attacker to execute arbitrary code via the parameters ipv4\_ping in the /boafrm/form (CVSS 6.8)
- [CVE-2023-51939](https://cve.now/CVE-2023-51939.md): An issue in the cp\_bbs\_sig function in relic/src/cp/relic\_cp\_bbs.c of Relic relic-toolkit 0.6.0 allows a remote attacker to obtain sensitive (CVSS 8.8)
- [CVE-2024-22859](https://cve.now/CVE-2024-22859.md): Cross-Site Request Forgery (CSRF) vulnerability in livewire before v3.0.4, allows remote attackers to execute arbitrary code getCsrfToken fu (CVSS 8.8)
- [CVE-2024-22927](https://cve.now/CVE-2024-22927.md): Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted (CVSS 6.1)
- [CVE-2024-22936](https://cve.now/CVE-2024-22936.md): Cross-site scripting (XSS) vulnerability in Parents & Student Portal in Genesis School Management Systems in Genesis AIMS Student Informatio (CVSS 6.1)
- [CVE-2024-22939](https://cve.now/CVE-2024-22939.md): Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category\_ (CVSS 8.8)
- [CVE-2024-23031](https://cve.now/CVE-2024-23031.md): Cross Site Scripting (XSS) vulnerability in is\_water parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted (CVSS 6.1)
- [CVE-2024-23032](https://cve.now/CVE-2024-23032.md): Cross Site Scripting vulnerability in num parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. (CVSS 6.1)
- [CVE-2024-23033](https://cve.now/CVE-2024-23033.md): Cross Site Scripting vulnerability in the path parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. (CVSS 6.1)
- [CVE-2024-23034](https://cve.now/CVE-2024-23034.md): Cross Site Scripting vulnerability in the input parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted URL. (CVSS 6.1)
- [CVE-2024-23052](https://cve.now/CVE-2024-23052.md): An issue in WuKongOpenSource WukongCRM v.72crm\_9.0.1\_20191202 allows a remote attacker to execute arbitrary code via the parseObject() funct (CVSS 9.8)
- [CVE-2024-24041](https://cve.now/CVE-2024-24041.md): A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute ar (CVSS 6.1)
- [CVE-2024-24059](https://cve.now/CVE-2024-24059.md): springboot-manager v1.6 is vulnerable to Arbitrary File Upload. (CVSS 6.1)
- [CVE-2024-24060](https://cve.now/CVE-2024-24060.md): springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/user. (CVSS 5.4)
- [CVE-2024-24061](https://cve.now/CVE-2024-24061.md): springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sysContent/add. (CVSS 5.4)
- [CVE-2024-24062](https://cve.now/CVE-2024-24062.md): springboot-manager v1.6 is vulnerable to Cross Site Scripting (XSS) via /sys/role. (CVSS 5.4)
- [CVE-2024-24945](https://cve.now/CVE-2024-24945.md): A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute ar (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.