CVEs published February 2, 2024
146 CVEs were published on February 2, 2024: 17 critical, 41 high.
- Published
- 146
- Critical
- 17
- High
- 41
- Medium
- 62
- Low
- 26
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 56
Most affected products
- QNAP Systems QTS · QNAP Systems QuTS hero +1
- 25
- IBM PowerSC
- 12
- OpenHarmony
- 8
- HCL Software BigFix Platform
- 5
- National Keep Cyber Security Services CyberMath
- 4
- IBM SOAR QRadar Plugin App
- 3
- IBM Tivoli Application Dependency Discovery Manager
- 3
- B&R Industrial Automation Automation Studio
- 2
- B&R Industrial Automation Automation Studio · B&R Industria…
- 2
- IBM Operational Decision Manager
- 2
Critical 17
- CVE-2023-45025QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2022-34381 Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J versions prior to 6.2.6.1 contain an unmaintained thirdDell BSAFE Crypto-J · Dell BSAFE SSL-J
- CVE-2023-47143IBM Tivoli Application Dependency Discovery Manager HOST header injectionIBM Tivoli Application Dependency Discovery Manager
- CVE-2023-6675Malicious File Upload in National Keep's CyberMathNational Keep Cyber Security Services CyberMath
- CVE-2024-23978Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier.KDDI HOME SPOT CUBE2
- CVE-2024-1143Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and sLINE Central Dogma · com.linecorp.centraldogma:centraldogma…
- CVE-2024-22320IBM Operational Decision Manager code executionIBM Operational Decision Manager
- CVE-2023-48792Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option.
- CVE-2023-48793Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature.
- CVE-2023-50488An issue in Blurams Lumi Security Camera (A31C) v23.0406.435.4120 allows attackers to execute arbitrary code.
- CVE-2024-22108An issue was discovered in GTB Central Console 15.17.1-30814.NG.
- CVE-2024-22533Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability.com.ibeetl:beetl-core
- CVE-2024-22901Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.
- CVE-2024-22902Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.
- CVE-2024-23746Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (b
- CVE-2024-24029JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.
- CVE-2024-24482Aprktool before 2.9.3 on Windows allows ../ and /..
High 41
- CVE-2024-1197SourceCodester Testimonial Page Manager HTTP GET Request delete-testimonial.php sql injectionSourceCodester Testimonial Page Manager
- CVE-2023-47568QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-47564Qsync CentralQNAP Systems Qsync Central
- CVE-2023-47562Photo StationQNAP Systems Photo Station
- CVE-2023-39297QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2020-29504 Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Missing RequDell BSAFE Crypto-C Micro Edition · Dell BSAFE Micro Editio…
- CVE-2024-24757open-irs .env ExposureDegamisu open-irs
- CVE-2024-23831Privilege escalation through CSRF attack on 'setup.pl'LedgerSMB
- CVE-2024-24760Mailcow Docker Container Exposure to Local Networkmailcow-dockerized
- CVE-2023-6387Incorrect buffer parsing in Bluetooth LE sample code may lead to buffer overflowsilabs.com GSDK
- CVE-2023-38273IBM Cloud Pak System information disclosureIBM Cloud Pak System
- CVE-2023-47142IBM Tivoli Application Dependency Discovery Manager privilege escalationIBM Tivoli Application Dependency Discovery Manager
- CVE-2023-6676Cross Site Request Forgery in National Keep's CyberMathNational Keep Cyber Security Services CyberMath
- CVE-2024-0269SQL InjectionManageEngine ADAudit Plus
- CVE-2024-0253SQL InjectionManageEngine ADAudit Plus
- CVE-2024-1201PanteraSoft HDD Health search path or unquoted item vulnerabilityPanteraSoft HDD Health
- CVE-2024-23895Cross-Site Scripting (XSS) vulnerability in Cups EasyCups Easy
- CVE-2024-0338Buffer Overflow Vulnerability in XAMPPApachefriends XAMPP
- CVE-2020-24682Automation Studio and PVI Multiple unquoted service path vulnerabilitiesB&R Industrial Automation Automation Studio · B&R Industria…
- CVE-2020-24681Automation Studio and PVI Multiple incorrect permission assignments for servicesB&R Industrial Automation Automation Studio · B&R Industria…
- CVE-2021-22282RCE in B&R Automation Studio with crafted project filesB&R Industrial Automation Automation Studio
- CVE-2024-21780Stack-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier.KDDI HOME SPOT CUBE2
- CVE-2024-21860Dsoftbus has a use after free vulnerabilityOpenHarmony
- CVE-2023-38019IBM SOAR QRadar Plugin App directory traversalIBM SOAR QRadar Plugin App
- CVE-2024-22319IBM Operational Decision Manager JDNI injectionIBM Operational Decision Manager
- CVE-2024-21399Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2023-50326IBM PowerSC information DisclosureIBM PowerSC
- CVE-2023-39611An issue in Software FX Chart FX 7 version 7.0.4962.20829 allows attackers to enumerate and read files from the local filesystem by sending
- CVE-2023-46045Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file.
- CVE-2023-48645An issue was discovered in the Archibus app 4.0.3 for iOS.
- CVE-2023-51838Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm.meshcentral
- CVE-2024-22107An issue was discovered in GTB Central Console 15.17.1-30814.NG.
- CVE-2024-22779Directory Traversal vulnerability in Kihron ServerRPExposer v.1.0.2 and before allows a remote attacker to execute arbitrary code via the lo
- CVE-2024-22851Directory Traversal Vulnerability in LiveConfig before v.2.5.2 allows a remote attacker to obtain sensitive information via a crafted reques
- CVE-2024-22899Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime func
- CVE-2024-22900Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardIn
- CVE-2024-22903Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK
- CVE-2024-24161MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered.
- CVE-2024-24470Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the update_post.php co
- CVE-2024-24524Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add_menu.ph
- CVE-2024-25006XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and
Medium, low and unrated 88
- CVE-2024-1198openBI Phar User.php addxinzhi deserializationopenBI
- CVE-2024-1196SourceCodester Testimonial Page Manager HTTP POST Request add-testimonial.php cross site scriptingSourceCodester Testimonial Page Manager
- CVE-2024-1195iTop VPN IOCTL ITopVpnCallbackProcess.sys denial of serviceiTop VPN
- CVE-2024-23553A cross-site scripting (XSS) vulnerability affects HCL BigFix PlatformHCL Software BigFix Platform
- CVE-2024-1194Armcode AlienIP Locate Host denial of serviceArmcode AlienIP
- CVE-2024-1193Navicat MySQL Conecction denial of serviceNavicat
- CVE-2023-37531A cross-site scripting (XSS) vulnerability affects HCL BigFix PlatformHCL Software BigFix Platform
- CVE-2023-37530A cross-site scripting (XSS) vulnerability affects HCL BigFix PlatformHCL Software BigFix Platform
- CVE-2024-1192South River WebDrive New Secure WebDAV denial of serviceSouth River WebDrive
- CVE-2023-37529A cross-site scripting (XSS) vulnerability affects HCL BigFix PlatformHCL Software BigFix Platform
- CVE-2024-1191Hyper CdCatalog HCF File denial of serviceHyper CdCatalog
- CVE-2024-1190Global Scape CuteFTP denial of serviceGlobal Scape CuteFTP
- CVE-2024-1189AMPPS Encryption Passphrase denial of serviceAMPPS
- CVE-2023-37527A cross-site scripting (XSS) vulnerability affects HCL BigFix PlatformHCL Software BigFix Platform
- CVE-2024-1188Rizone Soft Notepad3 Encryption Passphrase denial of serviceRizone Soft Notepad3
- CVE-2024-1187Munsoft Easy Outlook Express Recovery Registration Key denial of serviceMunsoft Easy Outlook Express Recovery
- CVE-2024-1186Munsoft Easy Archive Recovery Registration Key denial of serviceMunsoft Easy Archive Recovery
- CVE-2024-23635AntiSamy malicious input can provoke XSS when preserving commentsnahsra antisamy · org.owasp.antisamy:antisamy
- CVE-2024-24560Vyper external calls can overflow return data to return input buffervyperlang vyper · vyper
- CVE-2023-50359QTS, QuTS heroQNAP Systems QTS · QNAP Systems QuTS hero
- CVE-2023-47567QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-47566QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-47561Photo StationQNAP Systems Photo Station
- CVE-2023-45037QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-45036QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-45035QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-45028QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-45027QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-45026QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41292QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41283QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41282QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41281QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41280QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41279QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41278QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41277QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41276QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41275QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41274QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-41273QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-39303QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-39302QTS, QuTS hero, QuTScloudQNAP Systems QTS · QNAP Systems QuTS hero +1
- CVE-2023-32967QTS, QuTScloudQNAP Systems QuTScloud · QNAP Systems QTS +1
- CVE-2021-21575 Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability.Dell BSAFE Micro Edition Suite
- CVE-2024-1185Nsasoft NBMonitor Network Bandwidth Monitor Registration denial of serviceNsasoft NBMonitor Network Bandwidth Monitor
- CVE-2024-23824mailcow ipixel flood attack leads to Denial of Service in admin pagemailcow-dockerized
- CVE-2023-47144IBM Tivoli Application Dependency Discovery Manager cross-site scriptingIBM Tivoli Application Dependency Discovery Manager
- CVE-2024-1184Nsasoft Network Sleuth Registration denial of serviceNsasoft Network Sleuth
- CVE-2023-47148IBM Storage Protect Plus Server information disclosureIBM Storage Protect Plus Server
- CVE-2023-6673Reflected XSS in National Keep's CyberMathNational Keep Cyber Security Services CyberMath
- CVE-2023-6672Stored XSS in National Keep's CyberMathNational Keep Cyber Security Services CyberMath
- CVE-2024-0963Calculated Fields Form <= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scriptingcodepeople Calculated Fields Form
- CVE-2024-0844The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via thdevfelixmoira Popup More Popups, Lightboxes, and more popup…
- CVE-2021-22281Zip Slip Vulnerability in B&R Automation Studio Project ImportB&R Industrial Automation Automation Studio
- CVE-2024-21863Dsoftbus has an improper input validation vulnerabilityOpenHarmony
- CVE-2024-21851Dsoftbus has an integer overflow vulnerabilityOpenHarmony
- CVE-2024-0285Dsoftbus has an improper input validation vulnerabilityOpenHarmony
- CVE-2023-45734Dsoftbus has an out-of-bounds write vulnerabilityOpenHarmony
- CVE-2024-21845Dsoftbus has an integer overflow vulnerabilityOpenHarmony
- CVE-2023-49118Dsoftbus has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2023-43756Dsoftbus has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2024-1162Orbit Fox by ThemeIsle <= 2.10.29 - Cross-Site Request Forgerythemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2024-1047ThemeIsle SDK <= Various Versions - Missing AuthorizationMenu Icons by ThemeIsle · themeisle Starter Sites & Tem… +10
- CVE-2024-21485Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the packadash-core-components · dash +1
- CVE-2024-0685Ninja Forms Contact Form <= 3.7.1 - Unauthenticated Second Order SQL Injectionkstover Ninja Forms – The Contact Form Builder That Grows W…
- CVE-2024-1073SlimStat Analytics <= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scriptingveronalabs SlimStat Analytics
- CVE-2023-38020IBM SOAR QRadar Plugin App log injectionIBM SOAR QRadar Plugin App
- CVE-2023-38263IBM SOAR QRadar Plugin App improper access controlsIBM SOAR QRadar Plugin App
- CVE-2022-40744IBM Aspera Faspex cross-site scriptingIBM Aspera Faspex
- CVE-2023-46159IBM Storage Ceph denial of serviceIBM Storage Ceph
- CVE-2023-32333IBM Maximo Asset Management improper access controlIBM Maximo Asset Management
- CVE-2023-50962IBM PowerSC information disclosureIBM PowerSC
- CVE-2023-50328IBM PowerSC information disclosureIBM PowerSC
- CVE-2023-50938IBM PowerSC clickjackingIBM PowerSC
- CVE-2023-50935IBM PowerSC forced browsingIBM PowerSC
- CVE-2023-50941IBM PowerSC session fixationIBM PowerSC
- CVE-2023-50934IBM PowerSC improper authenticationIBM PowerSC
- CVE-2023-50940IBM PowerSC cross-resource origin sharingIBM PowerSC
- CVE-2023-50936IBM PowerSC session fixationIBM PowerSC
- CVE-2023-50327IBM PowerSC weak securityIBM PowerSC
- CVE-2023-50937IBM PowerSC information disclosureIBM PowerSC
- CVE-2023-50933IBM PowerSC HTML injectionIBM PowerSC
- CVE-2023-46344A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an attacker to escalate th
- CVE-2023-51072A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 allows low-privileged
- CVE-2023-51820An issue in Blurams Lumi Security Camera (A31C) v.2.3.38.12558 allows a physically proximate attackers to execute arbitrary code.
- CVE-2024-24160MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do.
- CVE-2024-24388Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information vi