# CVEs published 2024-02-02

146 CVEs were published on February 2, 2024: 17 critical, 41 high. Days are UTC.

- [CVE-2024-1198](https://cve.now/CVE-2024-1198.md): openBI Phar User.php addxinzhi deserialization (CVSS 6.3, openBI)
- [CVE-2024-1197](https://cve.now/CVE-2024-1197.md): SourceCodester Testimonial Page Manager HTTP GET Request delete-testimonial.php sql injection (CVSS 7.3, SourceCodester Testimonial Page Manager)
- [CVE-2024-1196](https://cve.now/CVE-2024-1196.md): SourceCodester Testimonial Page Manager HTTP POST Request add-testimonial.php cross site scripting (CVSS 4.3, SourceCodester Testimonial Page Manager)
- [CVE-2024-1195](https://cve.now/CVE-2024-1195.md): iTop VPN IOCTL ITopVpnCallbackProcess.sys denial of service (CVSS 5.5, iTop VPN)
- [CVE-2024-23553](https://cve.now/CVE-2024-23553.md): A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform (CVSS 3.0, HCL Software BigFix Platform)
- [CVE-2024-1194](https://cve.now/CVE-2024-1194.md): Armcode AlienIP Locate Host denial of service (CVSS 3.3, Armcode AlienIP)
- [CVE-2024-1193](https://cve.now/CVE-2024-1193.md): Navicat MySQL Conecction denial of service (CVSS 3.3, Navicat)
- [CVE-2023-37531](https://cve.now/CVE-2023-37531.md): A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform (CVSS 3.3, HCL Software BigFix Platform)
- [CVE-2023-37530](https://cve.now/CVE-2023-37530.md): A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform (CVSS 3.0, HCL Software BigFix Platform)
- [CVE-2024-1192](https://cve.now/CVE-2024-1192.md): South River WebDrive New Secure WebDAV denial of service (CVSS 3.3, South River WebDrive)
- [CVE-2023-37529](https://cve.now/CVE-2023-37529.md): A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform (CVSS 3.0, HCL Software BigFix Platform)
- [CVE-2024-1191](https://cve.now/CVE-2024-1191.md): Hyper CdCatalog HCF File denial of service (CVSS 3.3, Hyper CdCatalog)
- [CVE-2024-1190](https://cve.now/CVE-2024-1190.md): Global Scape CuteFTP denial of service (CVSS 3.3, Global Scape CuteFTP)
- [CVE-2024-1189](https://cve.now/CVE-2024-1189.md): AMPPS Encryption Passphrase denial of service (CVSS 5.3, AMPPS)
- [CVE-2023-37527](https://cve.now/CVE-2023-37527.md): A cross-site scripting (XSS) vulnerability affects HCL BigFix Platform (CVSS 5.4, HCL Software BigFix Platform)
- [CVE-2024-1188](https://cve.now/CVE-2024-1188.md): Rizone Soft Notepad3 Encryption Passphrase denial of service (CVSS 3.3, Rizone Soft Notepad3)
- [CVE-2024-1187](https://cve.now/CVE-2024-1187.md): Munsoft Easy Outlook Express Recovery Registration Key denial of service (CVSS 3.3, Munsoft Easy Outlook Express Recovery)
- [CVE-2024-1186](https://cve.now/CVE-2024-1186.md): Munsoft Easy Archive Recovery Registration Key denial of service (CVSS 3.3, Munsoft Easy Archive Recovery)
- [CVE-2024-23635](https://cve.now/CVE-2024-23635.md): AntiSamy malicious input can provoke XSS when preserving comments (CVSS 6.1, nahsra antisamy · org.owasp.antisamy:antisamy)
- [CVE-2024-24560](https://cve.now/CVE-2024-24560.md): Vyper external calls can overflow return data to return input buffer (CVSS 3.7, vyperlang vyper · vyper)
- [CVE-2023-50359](https://cve.now/CVE-2023-50359.md): QTS, QuTS hero (CVSS 3.4, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-47568](https://cve.now/CVE-2023-47568.md): QTS, QuTS hero, QuTScloud (CVSS 8.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-47567](https://cve.now/CVE-2023-47567.md): QTS, QuTS hero, QuTScloud (CVSS 4.7, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-47566](https://cve.now/CVE-2023-47566.md): QTS, QuTS hero, QuTScloud (CVSS 6.7, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-47564](https://cve.now/CVE-2023-47564.md): Qsync Central (CVSS 8.0, QNAP Systems Qsync Central)
- [CVE-2023-47562](https://cve.now/CVE-2023-47562.md): Photo Station (CVSS 7.4, QNAP Systems Photo Station)
- [CVE-2023-47561](https://cve.now/CVE-2023-47561.md): Photo Station (CVSS 5.5, QNAP Systems Photo Station)
- [CVE-2023-45037](https://cve.now/CVE-2023-45037.md): QTS, QuTS hero, QuTScloud (CVSS 3.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-45036](https://cve.now/CVE-2023-45036.md): QTS, QuTS hero, QuTScloud (CVSS 3.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-45035](https://cve.now/CVE-2023-45035.md): QTS, QuTS hero, QuTScloud (CVSS 3.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-45028](https://cve.now/CVE-2023-45028.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-45027](https://cve.now/CVE-2023-45027.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-45026](https://cve.now/CVE-2023-45026.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-45025](https://cve.now/CVE-2023-45025.md): QTS, QuTS hero, QuTScloud (CVSS 9.0, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41292](https://cve.now/CVE-2023-41292.md): QTS, QuTS hero, QuTScloud (CVSS 3.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41283](https://cve.now/CVE-2023-41283.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41282](https://cve.now/CVE-2023-41282.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41281](https://cve.now/CVE-2023-41281.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41280](https://cve.now/CVE-2023-41280.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41279](https://cve.now/CVE-2023-41279.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41278](https://cve.now/CVE-2023-41278.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41277](https://cve.now/CVE-2023-41277.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41276](https://cve.now/CVE-2023-41276.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41275](https://cve.now/CVE-2023-41275.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41274](https://cve.now/CVE-2023-41274.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-41273](https://cve.now/CVE-2023-41273.md): QTS, QuTS hero, QuTScloud (CVSS 5.5, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-39303](https://cve.now/CVE-2023-39303.md): QTS, QuTS hero, QuTScloud (CVSS 5.3, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-39297](https://cve.now/CVE-2023-39297.md): QTS, QuTS hero, QuTScloud (CVSS 8.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-39302](https://cve.now/CVE-2023-39302.md): QTS, QuTS hero, QuTScloud (CVSS 6.6, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-32967](https://cve.now/CVE-2023-32967.md): QTS, QuTScloud (CVSS 5.0, QNAP Systems QuTScloud · QNAP Systems QTS +1)
- [CVE-2020-29504](https://cve.now/CVE-2020-29504.md): Dell BSAFE Crypto-C Micro Edition, versions before 4.1.5, and Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain a Missing Requ (CVSS 7.4, Dell BSAFE Crypto-C Micro Edition · Dell BSAFE Micro Editio…)
- [CVE-2021-21575](https://cve.now/CVE-2021-21575.md): Dell BSAFE Micro Edition Suite, versions before 4.5.2, contain an Observable Timing Discrepancy Vulnerability. (CVSS 5.9, Dell BSAFE Micro Edition Suite)
- [CVE-2024-24757](https://cve.now/CVE-2024-24757.md): open-irs .env Exposure (CVSS 7.6, Degamisu open-irs)
- [CVE-2024-23831](https://cve.now/CVE-2024-23831.md): Privilege escalation through CSRF attack on 'setup.pl' (CVSS 7.5, LedgerSMB)
- [CVE-2024-1185](https://cve.now/CVE-2024-1185.md): Nsasoft NBMonitor Network Bandwidth Monitor Registration denial of service (CVSS 3.3, Nsasoft NBMonitor Network Bandwidth Monitor)
- [CVE-2022-34381](https://cve.now/CVE-2022-34381.md): Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J versions prior to 6.2.6.1 contain an unmaintained third (CVSS 9.1, Dell BSAFE Crypto-J · Dell BSAFE SSL-J)
- [CVE-2024-24760](https://cve.now/CVE-2024-24760.md): Mailcow Docker Container Exposure to Local Network (CVSS 8.8, mailcow-dockerized)
- [CVE-2024-23824](https://cve.now/CVE-2024-23824.md): mailcow ipixel flood attack leads to Denial of Service in admin page (CVSS 4.7, mailcow-dockerized)
- [CVE-2023-6387](https://cve.now/CVE-2023-6387.md): Incorrect buffer parsing in Bluetooth LE sample code may lead to buffer overflow (CVSS 7.5, silabs.com GSDK)
- [CVE-2023-38273](https://cve.now/CVE-2023-38273.md): IBM Cloud Pak System information disclosure (CVSS 7.5, IBM Cloud Pak System)
- [CVE-2023-47142](https://cve.now/CVE-2023-47142.md): IBM Tivoli Application Dependency Discovery Manager privilege escalation (CVSS 7.5, IBM Tivoli Application Dependency Discovery Manager)
- [CVE-2023-6676](https://cve.now/CVE-2023-6676.md): Cross Site Request Forgery in National Keep's CyberMath (CVSS 8.8, National Keep Cyber Security Services CyberMath)
- [CVE-2024-0269](https://cve.now/CVE-2024-0269.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2023-47144](https://cve.now/CVE-2023-47144.md): IBM Tivoli Application Dependency Discovery Manager cross-site scripting (CVSS 6.1, IBM Tivoli Application Dependency Discovery Manager)
- [CVE-2023-47143](https://cve.now/CVE-2023-47143.md): IBM Tivoli Application Dependency Discovery Manager HOST header injection (CVSS 10.0, IBM Tivoli Application Dependency Discovery Manager)
- [CVE-2024-1184](https://cve.now/CVE-2024-1184.md): Nsasoft Network Sleuth Registration denial of service (CVSS 3.3, Nsasoft Network Sleuth)
- [CVE-2023-6675](https://cve.now/CVE-2023-6675.md): Malicious File Upload in National Keep's CyberMath (CVSS 9.8, National Keep Cyber Security Services CyberMath)
- [CVE-2023-47148](https://cve.now/CVE-2023-47148.md): IBM Storage Protect Plus Server information disclosure (CVSS 5.3, IBM Storage Protect Plus Server)
- [CVE-2023-6673](https://cve.now/CVE-2023-6673.md): Reflected XSS in National Keep's CyberMath (CVSS 6.1, National Keep Cyber Security Services CyberMath)
- [CVE-2024-0253](https://cve.now/CVE-2024-0253.md): SQL Injection (CVSS 8.3, ManageEngine ADAudit Plus)
- [CVE-2023-6672](https://cve.now/CVE-2023-6672.md): Stored XSS in National Keep's CyberMath (CVSS 5.4, National Keep Cyber Security Services CyberMath)
- [CVE-2024-1201](https://cve.now/CVE-2024-1201.md): PanteraSoft HDD Health search path or unquoted item vulnerability (CVSS 7.8, PanteraSoft HDD Health)
- [CVE-2024-0963](https://cve.now/CVE-2024-0963.md): Calculated Fields Form \<= 1.2.52 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, codepeople Calculated Fields Form)
- [CVE-2024-0844](https://cve.now/CVE-2024-0844.md): The Popup More Popups, Lightboxes, and more popup modules plugin for WordPress is vulnerable to Local File Inclusion in version 2.1.6 via th (CVSS 4.7, devfelixmoira Popup More Popups, Lightboxes, and more popup…)
- [CVE-2024-23895](https://cve.now/CVE-2024-23895.md): Cross-Site Scripting (XSS) vulnerability in Cups Easy (CVSS 8.2, Cups Easy)
- [CVE-2024-0338](https://cve.now/CVE-2024-0338.md): Buffer Overflow Vulnerability in XAMPP (CVSS 7.3, Apachefriends XAMPP)
- [CVE-2021-22281](https://cve.now/CVE-2021-22281.md): Zip Slip Vulnerability in B&R Automation Studio Project Import (CVSS 6.3, B&R Industrial Automation Automation Studio)
- [CVE-2020-24682](https://cve.now/CVE-2020-24682.md): Automation Studio and PVI Multiple unquoted service path vulnerabilities (CVSS 7.2, B&R Industrial Automation Automation Studio · B&R Industria…)
- [CVE-2020-24681](https://cve.now/CVE-2020-24681.md): Automation Studio and PVI Multiple incorrect permission assignments for services (CVSS 8.2, B&R Industrial Automation Automation Studio · B&R Industria…)
- [CVE-2024-23978](https://cve.now/CVE-2024-23978.md): Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. (CVSS 9.8, KDDI HOME SPOT CUBE2)
- [CVE-2021-22282](https://cve.now/CVE-2021-22282.md): RCE in B&R Automation Studio with crafted project files (CVSS 8.3, B&R Industrial Automation Automation Studio)
- [CVE-2024-21780](https://cve.now/CVE-2024-21780.md): Stack-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. (CVSS 7.5, KDDI HOME SPOT CUBE2)
- [CVE-2024-21863](https://cve.now/CVE-2024-21863.md): Dsoftbus has an improper input validation vulnerability (CVSS 4.7, OpenHarmony)
- [CVE-2024-21851](https://cve.now/CVE-2024-21851.md): Dsoftbus has an integer overflow vulnerability (CVSS 2.9, OpenHarmony)
- [CVE-2024-0285](https://cve.now/CVE-2024-0285.md): Dsoftbus has an improper input validation vulnerability (CVSS 4.7, OpenHarmony)
- [CVE-2023-45734](https://cve.now/CVE-2023-45734.md): Dsoftbus has an out-of-bounds write vulnerability (CVSS 4.2, OpenHarmony)
- [CVE-2024-21860](https://cve.now/CVE-2024-21860.md): Dsoftbus has a use after free vulnerability (CVSS 8.2, OpenHarmony)
- [CVE-2024-21845](https://cve.now/CVE-2024-21845.md): Dsoftbus has an integer overflow vulnerability (CVSS 2.9, OpenHarmony)
- [CVE-2023-49118](https://cve.now/CVE-2023-49118.md): Dsoftbus has an out-of-bounds read vulnerability (CVSS 2.9, OpenHarmony)
- [CVE-2023-43756](https://cve.now/CVE-2023-43756.md): Dsoftbus has an out-of-bounds read vulnerability (CVSS 2.9, OpenHarmony)
- [CVE-2024-1143](https://cve.now/CVE-2024-1143.md): Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and s (CVSS 9.3, LINE Central Dogma · com.linecorp.centraldogma:centraldogma…)
- [CVE-2024-1162](https://cve.now/CVE-2024-1162.md): Orbit Fox by ThemeIsle \<= 2.10.29 - Cross-Site Request Forgery (CVSS 4.3, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2024-1047](https://cve.now/CVE-2024-1047.md): ThemeIsle SDK \<= Various Versions - Missing Authorization (CVSS 5.3, Menu Icons by ThemeIsle · themeisle Starter Sites & Tem… +10)
- [CVE-2024-21485](https://cve.now/CVE-2024-21485.md): Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the packa (CVSS 6.5, dash-core-components · dash +1)
- [CVE-2024-0685](https://cve.now/CVE-2024-0685.md): Ninja Forms Contact Form \<= 3.7.1 - Unauthenticated Second Order SQL Injection (CVSS 5.9, kstover Ninja Forms – The Contact Form Builder That Grows W…)
- [CVE-2024-1073](https://cve.now/CVE-2024-1073.md): SlimStat Analytics \<= 5.1.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting (CVSS 6.4, veronalabs SlimStat Analytics)
- [CVE-2023-38020](https://cve.now/CVE-2023-38020.md): IBM SOAR QRadar Plugin App log injection (CVSS 4.3, IBM SOAR QRadar Plugin App)
- [CVE-2023-38019](https://cve.now/CVE-2023-38019.md): IBM SOAR QRadar Plugin App directory traversal (CVSS 8.1, IBM SOAR QRadar Plugin App)
- [CVE-2023-38263](https://cve.now/CVE-2023-38263.md): IBM SOAR QRadar Plugin App improper access controls (CVSS 6.5, IBM SOAR QRadar Plugin App)
- [CVE-2022-40744](https://cve.now/CVE-2022-40744.md): IBM Aspera Faspex cross-site scripting (CVSS 4.8, IBM Aspera Faspex)
- [CVE-2023-46159](https://cve.now/CVE-2023-46159.md): IBM Storage Ceph denial of service (CVSS 2.6, IBM Storage Ceph)
- [CVE-2024-22320](https://cve.now/CVE-2024-22320.md): IBM Operational Decision Manager code execution (CVSS 9.8, IBM Operational Decision Manager)
- [CVE-2024-22319](https://cve.now/CVE-2024-22319.md): IBM Operational Decision Manager JDNI injection (CVSS 8.1, IBM Operational Decision Manager)
- [CVE-2023-32333](https://cve.now/CVE-2023-32333.md): IBM Maximo Asset Management improper access control (CVSS 6.5, IBM Maximo Asset Management)
- [CVE-2023-50962](https://cve.now/CVE-2023-50962.md): IBM PowerSC information disclosure (CVSS 5.9, IBM PowerSC)
- [CVE-2023-50328](https://cve.now/CVE-2023-50328.md): IBM PowerSC information disclosure (CVSS 3.7, IBM PowerSC)
- [CVE-2023-50938](https://cve.now/CVE-2023-50938.md): IBM PowerSC clickjacking (CVSS 6.5, IBM PowerSC)
- [CVE-2023-50935](https://cve.now/CVE-2023-50935.md): IBM PowerSC forced browsing (CVSS 6.5, IBM PowerSC)
- [CVE-2023-50941](https://cve.now/CVE-2023-50941.md): IBM PowerSC session fixation (CVSS 6.3, IBM PowerSC)
- [CVE-2023-50934](https://cve.now/CVE-2023-50934.md): IBM PowerSC improper authentication (CVSS 5.3, IBM PowerSC)
- [CVE-2023-50940](https://cve.now/CVE-2023-50940.md): IBM PowerSC cross-resource origin sharing (CVSS 5.3, IBM PowerSC)
- [CVE-2023-50936](https://cve.now/CVE-2023-50936.md): IBM PowerSC session fixation (CVSS 6.3, IBM PowerSC)
- [CVE-2023-50327](https://cve.now/CVE-2023-50327.md): IBM PowerSC weak security (CVSS 5.3, IBM PowerSC)
- [CVE-2023-50937](https://cve.now/CVE-2023-50937.md): IBM PowerSC information disclosure (CVSS 5.9, IBM PowerSC)
- [CVE-2024-21399](https://cve.now/CVE-2024-21399.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2023-50933](https://cve.now/CVE-2023-50933.md): IBM PowerSC HTML injection (CVSS 6.1, IBM PowerSC)
- [CVE-2023-50326](https://cve.now/CVE-2023-50326.md): IBM PowerSC information Disclosure (CVSS 7.5, IBM PowerSC)
- [CVE-2023-39611](https://cve.now/CVE-2023-39611.md): An issue in Software FX Chart FX 7 version 7.0.4962.20829 allows attackers to enumerate and read files from the local filesystem by sending (CVSS 7.5)
- [CVE-2023-46045](https://cve.now/CVE-2023-46045.md): Graphviz 2.36.0 through 9.x before 10.0.1 has an out-of-bounds read via a crafted config6a file. (CVSS 7.8)
- [CVE-2023-46344](https://cve.now/CVE-2023-46344.md): A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an attacker to escalate th (CVSS 5.4)
- [CVE-2023-48645](https://cve.now/CVE-2023-48645.md): An issue was discovered in the Archibus app 4.0.3 for iOS. (CVSS 7.8)
- [CVE-2023-48792](https://cve.now/CVE-2023-48792.md): Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option. (CVSS 9.8)
- [CVE-2023-48793](https://cve.now/CVE-2023-48793.md): Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature. (CVSS 9.8)
- [CVE-2023-50488](https://cve.now/CVE-2023-50488.md): An issue in Blurams Lumi Security Camera (A31C) v23.0406.435.4120 allows attackers to execute arbitrary code. (CVSS 9.8)
- [CVE-2023-51072](https://cve.now/CVE-2023-51072.md): A stored cross-site scripting (XSS) vulnerability in the NOC component of Nagios XI version up to and including 2024R1 allows low-privileged (CVSS 5.4)
- [CVE-2023-51820](https://cve.now/CVE-2023-51820.md): An issue in Blurams Lumi Security Camera (A31C) v.2.3.38.12558 allows a physically proximate attackers to execute arbitrary code. (CVSS 6.8)
- [CVE-2023-51838](https://cve.now/CVE-2023-51838.md): Ylianst MeshCentral 1.1.16 suffers from Use of a Broken or Risky Cryptographic Algorithm. (CVSS 7.5, meshcentral)
- [CVE-2024-22107](https://cve.now/CVE-2024-22107.md): An issue was discovered in GTB Central Console 15.17.1-30814.NG. (CVSS 7.2)
- [CVE-2024-22108](https://cve.now/CVE-2024-22108.md): An issue was discovered in GTB Central Console 15.17.1-30814.NG. (CVSS 9.8)
- [CVE-2024-22533](https://cve.now/CVE-2024-22533.md): Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. (CVSS 9.8, com.ibeetl:beetl-core)
- [CVE-2024-22779](https://cve.now/CVE-2024-22779.md): Directory Traversal vulnerability in Kihron ServerRPExposer v.1.0.2 and before allows a remote attacker to execute arbitrary code via the lo (CVSS 8.8)
- [CVE-2024-22851](https://cve.now/CVE-2024-22851.md): Directory Traversal Vulnerability in LiveConfig before v.2.5.2 allows a remote attacker to obtain sensitive information via a crafted reques (CVSS 7.5)
- [CVE-2024-22899](https://cve.now/CVE-2024-22899.md): Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime func (CVSS 8.8)
- [CVE-2024-22900](https://cve.now/CVE-2024-22900.md): Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardIn (CVSS 8.8)
- [CVE-2024-22901](https://cve.now/CVE-2024-22901.md): Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials. (CVSS 9.8)
- [CVE-2024-22902](https://cve.now/CVE-2024-22902.md): Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials. (CVSS 9.8)
- [CVE-2024-22903](https://cve.now/CVE-2024-22903.md): Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the deleteUpdateAPK (CVSS 8.8)
- [CVE-2024-23746](https://cve.now/CVE-2024-23746.md): Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (b (CVSS 9.8)
- [CVE-2024-24029](https://cve.now/CVE-2024-24029.md): JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data. (CVSS 9.8)
- [CVE-2024-24160](https://cve.now/CVE-2024-24160.md): MRCMS 3.0 contains a Cross-Site Scripting (XSS) vulnerability via /admin/system/saveinfo.do. (CVSS 6.1)
- [CVE-2024-24161](https://cve.now/CVE-2024-24161.md): MRCMS 3.0 contains an Arbitrary File Read vulnerability in /admin/file/edit.do as the incoming path parameter is not filtered. (CVSS 7.5)
- [CVE-2024-24388](https://cve.now/CVE-2024-24388.md): Cross-site scripting (XSS) vulnerability in XunRuiCMS versions v4.6.2 and before, allows remote attackers to obtain sensitive information vi (CVSS 6.1)
- [CVE-2024-24470](https://cve.now/CVE-2024-24470.md): Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the update\_post.php co (CVSS 8.8)
- [CVE-2024-24482](https://cve.now/CVE-2024-24482.md): Aprktool before 2.9.3 on Windows allows ../ and /.. (CVSS 9.8)
- [CVE-2024-24524](https://cve.now/CVE-2024-24524.md): Cross Site Request Forgery (CSRF) vulnerability in flusity-CMS v.2.33, allows remote attackers to execute arbitrary code via the add\_menu.ph (CVSS 8.8)
- [CVE-2024-25006](https://cve.now/CVE-2024-25006.md): XenForo before 2.2.14 allows Directory Traversal (with write access) by an authenticated user who has permissions to administer styles, and (CVSS 8.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.