# CVEs published 2024-02-04

14 CVEs were published on February 4, 2024: 2 critical, 4 high. Days are UTC.

- [CVE-2021-4435](https://cve.now/CVE-2021-4435.md): Yarn: untrusted search path (CVSS 7.7, yarn · Fedora)
- [CVE-2018-25098](https://cve.now/CVE-2018-25098.md): blockmason credit-protocol UCAC CreditProtocol.sol executeUcacTx denial of service (CVSS 4.3, blockmason credit-protocol)
- [CVE-2023-6240](https://cve.now/CVE-2023-6240.md): Kernel: marvin vulnerability side-channel leakage in the rsa decryption operation (CVSS 6.5, Red Hat Enterprise Linux)
- [CVE-2019-25159](https://cve.now/CVE-2019-25159.md): mpedraza2020 Intranet del Monterroso cargos.php sql injection (CVSS 5.5, mpedraza2020 Intranet del Monterroso)
- [CVE-2015-10129](https://cve.now/CVE-2015-10129.md): planet-freo auth.inc.php comparison (CVSS 3.7, planet-freo)
- [CVE-2023-33851](https://cve.now/CVE-2023-33851.md): IBM PowerVM Hypervisor information disclosure (CVSS 5.3, IBM PowerVM Hypervisor)
- [CVE-2023-50947](https://cve.now/CVE-2023-50947.md): IBM Business Automation Workflow cross-site scripting (CVSS 5.4, IBM Business Automation Workflow)
- [CVE-2020-36773](https://cve.now/CVE-2020-36773.md): Artifex Ghostscript before 9.53.0 has an out-of-bounds write and use-after-free in devices/vector/gdevtxtw.c (for txtwrite) because a single (CVSS 9.8)
- [CVE-2021-46902](https://cve.now/CVE-2021-46902.md): An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. (CVSS 7.2)
- [CVE-2021-46903](https://cve.now/CVE-2021-46903.md): An issue was discovered in LTOS-Web-Interface in Meinberg LANTIME-Firmware before 6.24.029 MBGID-9343 and 7 before 7.04.008 MBGID-6303. (CVSS 6.5)
- [CVE-2023-52425](https://cve.now/CVE-2023-52425.md): libexpat through 2.5.0 allows a denial of service (resource consumption) because many full reparsings are required in the case of a large to (CVSS 7.5)
- [CVE-2023-52426](https://cve.now/CVE-2023-52426.md): libexpat through 2.5.0 allows recursive XML Entity Expansion if XML\_DTD is undefined at compile time. (CVSS 5.5)
- [CVE-2024-25062](https://cve.now/CVE-2024-25062.md): An issue was discovered in libxml2 before 2.11.7 and 2.12.x before 2.12.5. (CVSS 7.5, java · java-min +1)
- [CVE-2024-25089](https://cve.now/CVE-2024-25089.md): Malwarebytes Binisoft Windows Firewall Control before 6.9.9.2 allows remote attackers to execute arbitrary code via gRPC named pipes. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.