# CVEs published 2024-02-05

157 CVEs were published on February 5, 2024: 13 critical, 43 high. Days are UTC.

- [CVE-2024-0964](https://cve.now/CVE-2024-0964.md): LFI in Gradio (CVSS 7.5, gradio-app/gradio · gradio)
- [CVE-2023-34042](https://cve.now/CVE-2023-34042.md): The spring-security.xsd file inside the spring-security-config jar is world writable which means that if it were extracted it could be wri (CVSS 4.1, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2023-6807](https://cve.now/CVE-2023-6807.md): GeneratePress Premium \<= 2.3.2 - Authenticated(Contributor+) Stored Cross-Site Scripting via Custom Meta (CVSS 6.4, GeneratePress Premium)
- [CVE-2023-6846](https://cve.now/CVE-2023-6846.md): File Manager Pro \<= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, File Manager Pro)
- [CVE-2023-22819](https://cve.now/CVE-2023-22819.md): Uncontrolled resource consumption vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products (CVSS 4.9, Western Digital My Cloud OS · Western Digital My Cloud H… +1)
- [CVE-2023-22817](https://cve.now/CVE-2023-22817.md): Server-side Request Forgery vulnerability in Western Digital My Cloud, My Cloud Home and SanDisk ibi products (CVSS 5.5, Western Digital My Cloud OS · Western Digital My Cloud H… +1)
- [CVE-2023-6557](https://cve.now/CVE-2023-6557.md): The Events Calendar \<= 6.2.8.2 - Unauthenticated Sensitive Information Exposure (CVSS 5.3, stellarwp The Events Calendar)
- [CVE-2024-0508](https://cve.now/CVE-2024-0508.md): Orbit Fox by ThemeIsle \<= 2.10.27 - Authenticated(Contributor+) Stored Cross-site Scripting via Pricing Table Elementor Widget (CVSS 6.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2024-0969](https://cve.now/CVE-2024-0969.md): ARMember \<= 4.0.24 - Improper Access Control to Sensitive Information Exposure via REST API (CVSS 5.3, reputeinfosystems ARMember – Membership Plugin, Content Res…)
- [CVE-2024-0701](https://cve.now/CVE-2024-0701.md): UserPro \<= 5.1.6 - Disabled Membership Registration Bypass (CVSS 5.3, UserPro - Community and User Profile WordPress Plugin)
- [CVE-2023-6701](https://cve.now/CVE-2023-6701.md): Advanced Custom Fields \<= 6.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Field (CVSS 6.4, wpengine Advanced Custom Fields · Delicious Brains Advanced…)
- [CVE-2024-0373](https://cve.now/CVE-2024-0373.md): Views for WPForms \<= 3.2.2 - Cross-Site Request Forgery via save\_view (CVSS 4.3, aman086 Views for WPForms – Display & Edit WPForms Entries…)
- [CVE-2024-0668](https://cve.now/CVE-2024-0668.md): Advanced Database Cleaner \<= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process\_bulk\_action (CVSS 6.6, symptote Advanced Database Cleaner – Optimize & Clean Datab…)
- [CVE-2023-6996](https://cve.now/CVE-2023-6996.md): Display custom fields in the frontend – Post and User Profile Fields \<= 1.2.1 - Authenticated (Contributor+) Code Injection (CVSS 8.8, josevega Display custom fields in the frontend – Post and U…)
- [CVE-2023-6963](https://cve.now/CVE-2023-6963.md): Getwid – Gutenberg Blocks \<= 2.0.4 - Captcha Bypass (CVSS 5.3, jetmonsters Getwid – Gutenberg Blocks)
- [CVE-2024-0428](https://cve.now/CVE-2024-0428.md): Index Now \<= 2.6.3 - Cross-Site Request Forgery via reset\_form (CVSS 7.1, properfraction CrawlWP SEO – Instant Search Engine Indexing…)
- [CVE-2024-0366](https://cve.now/CVE-2024-0366.md): Starbox – the Author Box for Humans \<= 3.4.7 - Insecure Direct Object Reference (CVSS 4.3, cifi Starbox – the Author Box for Humans)
- [CVE-2024-0586](https://cve.now/CVE-2024-0586.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scritping (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2023-7029](https://cve.now/CVE-2023-7029.md): WordPress Button Plugin MaxButtons \<= 9.7.6 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 6.4, maxfoundry MaxButtons – Create buttons)
- [CVE-2023-4637](https://cve.now/CVE-2023-4637.md): WPvivid \<= 0.9.94 - Missing Authorization (CVSS 4.3, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2024-0660](https://cve.now/CVE-2024-0660.md): Formidable Forms \<= 6.7.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 6.1, strategy11team Formidable Forms – Contact Form Plugin, Surv…)
- [CVE-2023-6953](https://cve.now/CVE-2023-6953.md): PDF Generator For Fluent Forms \<= 1.1.7 - Cross-Site Scripting (CVSS 4.9, wpmanageninja Fluent PDF Generator)
- [CVE-2024-0709](https://cve.now/CVE-2024-0709.md): The Cryptocurrency Widgets – Price Ticker & Coins List plugin for WordPress is vulnerable to SQL Injection via the 'coinslist' parameter in (CVSS 9.8, narinder-singh Cryptocurrency Widgets – Price Ticker & Coin…)
- [CVE-2024-1208](https://cve.now/CVE-2024-1208.md): LearnDash LMS \<= 4.10.2 - Sensitive Information Exposure via API (CVSS 5.3, StellarWP LearnDash LMS)
- [CVE-2023-6808](https://cve.now/CVE-2023-6808.md): Booking for Appointments and Events Calendar – Amelia \<= 1.0.93 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 6.4, ameliabooking Booking for Appointments and Events Calendar…)
- [CVE-2024-0612](https://cve.now/CVE-2024-0612.md): Content Views \<= 3.6.2 - Authenticated(Administrator+) Stored Cross-Site Scripting via settings (CVSS 4.4, pt-guy Content Views – Post Grid & Filter, Recent Posts, Ca…)
- [CVE-2024-0371](https://cve.now/CVE-2024-0371.md): Views for WPForms \<= 3.2.2 - Missing Authorization via create\_view (CVSS 4.3, aman086 Views for WPForms – Display & Edit WPForms Entries…)
- [CVE-2023-6884](https://cve.now/CVE-2023-6884.md): Plugin for Google Reviews \<= 3.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcode (CVSS 6.4, widgetpack Rich Showcase for Google Reviews)
- [CVE-2023-6925](https://cve.now/CVE-2023-6925.md): Unlimited Addons for WPBakery Page Builder \<= 1.0.42 - Authenticated (Editor+) Arbitrary File Upload (CVSS 7.2, unitecms Unlimited Addons for WPBakery Page Builder)
- [CVE-2024-0597](https://cve.now/CVE-2024-0597.md): SEO Plugin by Squirrly SEO \<= 12.3.15 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings (CVSS 4.4, cifi SEO Plugin by Squirrly SEO)
- [CVE-2024-1092](https://cve.now/CVE-2024-1092.md): RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator \<= 4.4.1 - Missing Authorization (CVSS 4.3, themeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…)
- [CVE-2024-0630](https://cve.now/CVE-2024-0630.md): WP RSS Aggregator \<= 4.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting via RSS Feed Source (CVSS 4.4, rebelcode RSS Aggregator – RSS Import, News Feeds, Feed to…)
- [CVE-2023-6933](https://cve.now/CVE-2023-6933.md): Better Search Replace \<= 1.4.4 - Unauthenticated PHP Object Injection (CVSS 8.8, wpengine Better Search Replace)
- [CVE-2024-0954](https://cve.now/CVE-2024-0954.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-1121](https://cve.now/CVE-2024-1121.md): Advanced Forms for ACF \<= 1.9.3.2 - Missing Authorization to Unauthenticated Form Settings Export (CVSS 5.3, philkurth Advanced Forms for ACF)
- [CVE-2024-1046](https://cve.now/CVE-2024-1046.md): Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress \<= 4.14.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, properfraction Paid Membership Plugin, Ecommerce, User Regi…)
- [CVE-2024-1072](https://cve.now/CVE-2024-1072.md): Website Builder by SeedProd — Theme Builder, Landing Page Builder, Coming Soon Page, Maintenance Mode \<= 6.15.21 - Missing Authorization via seedprod\_lite\_new\_lpage (CVSS 8.2, Website Builder by SeedProd — Theme Builder, Landing Page B…)
- [CVE-2024-1075](https://cve.now/CVE-2024-1075.md): Minimal Coming Soon – Coming Soon Page \<= 2.37 - Unauthenticated Maintenance Mode Bypass (CVSS 3.7, webfactory Minimal Coming Soon – Coming Soon Page)
- [CVE-2023-6959](https://cve.now/CVE-2023-6959.md): Getwid – Gutenberg Blocks \<= 2.0.4 - Missing Authorization to Recaptcha API Key Modification (CVSS 4.3, jetmonsters Getwid – Gutenberg Blocks)
- [CVE-2024-0384](https://cve.now/CVE-2024-0384.md): WP Recipe Maker \<= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe Notes (CVSS 6.4, brechtvds WP Recipe Maker)
- [CVE-2024-0678](https://cve.now/CVE-2024-0678.md): Order Delivery Date for WP e-Commerce \<= 1.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.5, tychesoftwares Order Delivery Date for WP e-Commerce)
- [CVE-2024-1209](https://cve.now/CVE-2024-1209.md): LearnDash LMS \<= 4.10.1 - Sensitive Information Exposure via assignments (CVSS 5.3, StellarWP LearnDash LMS)
- [CVE-2024-0961](https://cve.now/CVE-2024-0961.md): SiteOrigin Widgets Bundle \<= 1.58.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, gpriday SiteOrigin Widgets Bundle)
- [CVE-2024-0509](https://cve.now/CVE-2024-0509.md): WP 404 Auto Redirect to Similar Post \<= 1.0.3 - Reflected Cross-Site Scripting via request (CVSS 6.1, hwk-fr WP 404 Auto Redirect to Similar Post)
- [CVE-2024-0834](https://cve.now/CVE-2024-0834.md): The Elementor Addon Elements plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the link\_to parameter in all versions up (CVSS 6.4, webtechstreet Elementor Addon Elements)
- [CVE-2024-0790](https://cve.now/CVE-2024-0790.md): WOLF – WordPress Posts Bulk Editor and Manager Professional \<= 1.0.8.1 - Cross-Site Request Forgery (CVSS 5.4, realmag777 WOLF – WordPress Posts Bulk Editor and Manager P…)
- [CVE-2024-1177](https://cve.now/CVE-2024-1177.md): WP Club Manager – WordPress Sports Club Plugin \<= 2.2.10 - Missing Authorization to Unauthenticated Event Permalink Update (CVSS 5.3, wpclubmanager WP Club Manager – WordPress Sports Club Plugin)
- [CVE-2024-1210](https://cve.now/CVE-2024-1210.md): LearnDash LMS \<= 4.10.1 - Sensitive Information Exposure via API (CVSS 5.3, StellarWP LearnDash LMS)
- [CVE-2024-0835](https://cve.now/CVE-2024-0835.md): Royal Elementor Kit \<= 1.0.116 - Missing Authorization to Arbitrary Transient Update (CVSS 4.3, wproyal Royal Elementor Kit)
- [CVE-2024-0255](https://cve.now/CVE-2024-0255.md): WP Recipe Maker \<= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon\_color (CVSS 6.4, brechtvds WP Recipe Maker)
- [CVE-2023-7014](https://cve.now/CVE-2023-7014.md): Author Box, Guest Author and Co-Authors for Your Posts – Molongui \<= 4.7.4 - Information Exposure via ma\_debug (CVSS 5.3, Molongui Authorship – Author Boxes, Guest Authors & Co-Auth…)
- [CVE-2024-0796](https://cve.now/CVE-2024-0796.md): Active Products Tables for WooCommerce. Professional products tables for WooCommerce store \<= 1.0.6.1 - Cross-Site Request Forgery (CVSS 4.3, realmag777 Active Products Tables for WooCommerce. Use cons…)
- [CVE-2024-0691](https://cve.now/CVE-2024-0691.md): FileBird \<= 5.6.0 - Authenticated(Administrator+) Stored Cross-Site Scripting via Folder Import (CVSS 5.5, ninjateam FileBird – WordPress Media Library Folders & File…)
- [CVE-2024-0380](https://cve.now/CVE-2024-0380.md): WP Recipe Maker \<= 9.1.0 - Directory Traversal (CVSS 5.4, brechtvds WP Recipe Maker)
- [CVE-2023-6635](https://cve.now/CVE-2023-6635.md): EditorsKit \<= 1.40.3 - Authenticated (Administrator+) Arbitrary File Upload (CVSS 7.2, munirkamal Gutenberg Block Editor Toolkit – EditorsKit)
- [CVE-2024-0859](https://cve.now/CVE-2024-0859.md): Affiliates Manager \<= 2.9.34 - Cross-Site Request Forgery (CVSS 4.3, wpinsider-1 Affiliates Manager)
- [CVE-2023-6700](https://cve.now/CVE-2023-6700.md): Cookie Information | Free GDPR Consent Solution \<= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update (CVSS 8.8, cookieinformation Cookie Information | Free GDPR Consent So…)
- [CVE-2024-0585](https://cve.now/CVE-2024-0585.md): Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders \<= 5.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image URl (CVSS 5.4, wpdevteam Essential Addons for Elementor – Popular Elemento…)
- [CVE-2024-0370](https://cve.now/CVE-2024-0370.md): Views for WPForms \<= 3.2.2 - Missing Authorization via save\_view (CVSS 4.3, aman086 Views for WPForms – Display & Edit WPForms Entries…)
- [CVE-2024-0221](https://cve.now/CVE-2024-0221.md): Photo Gallery by 10Web - Mobile-Friendly Image Gallery \<= 1.8.19 - Directory Traversal to Arbitrary File Rename (CVSS 9.1, Photo Gallery by 10Web – Mobile-Friendly Image Gallery)
- [CVE-2024-0374](https://cve.now/CVE-2024-0374.md): Views for WPForms \<= 3.2.2 - Cross-Site Request Forgery via create\_view (CVSS 4.3, aman086 Views for WPForms – Display & Edit WPForms Entries…)
- [CVE-2023-6982](https://cve.now/CVE-2023-6982.md): Display custom fields in the frontend – Post and User Profile Fields \<= 1.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via vg\_display\_data (CVSS 6.4, josevega Display custom fields in the frontend – Post and U…)
- [CVE-2024-0823](https://cve.now/CVE-2024-0823.md): Exclusive Addons for Elementor \<= 2.6.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, timstrifler Exclusive Addons for Elementor)
- [CVE-2024-0372](https://cve.now/CVE-2024-0372.md): Views for WPForms \<= 3.2.2 - Missing Authorization via get\_form\_fields (CVSS 4.3, aman086 Views for WPForms – Display & Edit WPForms Entries…)
- [CVE-2023-6526](https://cve.now/CVE-2023-6526.md): Meta Box – WordPress Custom Fields Framework \<= 5.9.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, metabox Meta Box)
- [CVE-2024-0324](https://cve.now/CVE-2024-0324.md): User Profile Builder \<= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb\_two\_factor\_authentication\_settings\_update (CVSS 8.2, cozmoslabs User Profile Builder – Beautiful User Registrati…)
- [CVE-2023-6985](https://cve.now/CVE-2023-6985.md): 10Web AI Assistant – AI content writing assistant \<= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation (CVSS 6.5, 10Web AI Assistant – AI content writing assistant)
- [CVE-2024-0382](https://cve.now/CVE-2024-0382.md): WP Recipe Maker \<= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header\_tag (CVSS 6.4, brechtvds WP Recipe Maker)
- [CVE-2024-0659](https://cve.now/CVE-2024-0659.md): Easy Digital Downloads \<= 3.2.6 - Authenticated(Shop Manager+) Stored Cross-Site Scripting via variable pricing options (CVSS 5.5, smub Easy Digital Downloads – eCommerce Payments and Subscr…)
- [CVE-2024-0761](https://cve.now/CVE-2024-0761.md): File Manager \<= 7.2.1 - Sensitive Information Exposure via Backup Filenames (CVSS 8.1, mndpsingh287 File Manager)
- [CVE-2024-0869](https://cve.now/CVE-2024-0869.md): Instant Images \<= 6.1.0 - Authenticated (Author+) Arbitrary Options Update (CVSS 8.8, connekthq Instant Images – One-click Image Uploads from Uns…)
- [CVE-2024-0791](https://cve.now/CVE-2024-0791.md): WOLF – WordPress Posts Bulk Editor and Manager Professional \<= 1.0.8.1 - Missing Authorization (CVSS 4.3, realmag777 WOLF – WordPress Posts Bulk Editor and Manager P…)
- [CVE-2024-0254](https://cve.now/CVE-2024-0254.md): (Simply) Guest Author Name \<= 4.34 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, nomadcoder (Simply) Guest Author Name)
- [CVE-2024-0797](https://cve.now/CVE-2024-0797.md): Active Products Tables for WooCommerce. Professional products tables for WooCommerce store \<= 1.0.6.1 - Missing Authorization (CVSS 4.3, realmag777 Active Products Tables for WooCommerce. Use cons…)
- [CVE-2024-0699](https://cve.now/CVE-2024-0699.md): AI Engine \<= 2.1.4 - Authenticated(Editor+) Arbitrary File Upload via add\_image\_from\_url (CVSS 6.6, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2023-6983](https://cve.now/CVE-2023-6983.md): Display custom fields in the frontend – Post and User Profile Fields \<= 1.2.1 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure (CVSS 4.3, josevega Display custom fields in the frontend – Post and U…)
- [CVE-2023-6989](https://cve.now/CVE-2023-6989.md): Shield Security – Smart Bot Blocking & Intrusion Prevention Security \<= 18.5.9 - Unauthenticated Local File Inclusion (CVSS 9.8, paultgoodchild Shield: Blocks Bots, Protects Users, and Pre…)
- [CVE-2024-0448](https://cve.now/CVE-2024-0448.md): Elementor Addons by Livemesh \<= 8.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, Livemesh Addons by Elementor)
- [CVE-2024-24595](https://cve.now/CVE-2024-24595.md): Allegro AI’s open-source version of ClearML stores passwords in plaintext within the MongoDB instance, resulting in a compromised server lea (CVSS 6.0, Allegro.AI ClearML · clearml)
- [CVE-2024-24559](https://cve.now/CVE-2024-24559.md): Vyper SHA3 code generation bug (CVSS 3.7, vyperlang vyper · vyper)
- [CVE-2024-24574](https://cve.now/CVE-2024-24574.md): phpMyFAQ vulnerable to stored XSS on attachments filename (CVSS 6.5, thorsten phpMyFAQ · phpmyfaq/phpmyfaq)
- [CVE-2023-50782](https://cve.now/CVE-2023-50782.md): Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659 (CVSS 7.5, python-cryptography · Red Hat Ansible Automation Platform +4)
- [CVE-2023-50781](https://cve.now/CVE-2023-50781.md): M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657 (CVSS 7.5, m2crypto · Red Hat Enterprise Linux +2)
- [CVE-2024-0202](https://cve.now/CVE-2024-0202.md): Cryptlib: rsa key exchange ciphersuites in tls vulnerable to marvin attack (CVSS 5.9, cryptlib)
- [CVE-2024-22208](https://cve.now/CVE-2024-22208.md): phpMyFAQ sharing FAQ functionality can easily be abused for phishing purposes (CVSS 6.5, thorsten phpMyFAQ · phpmyfaq/phpmyfaq)
- [CVE-2024-1052](https://cve.now/CVE-2024-1052.md): Boundary Vulnerable to Session Hijacking Through TLS Certificate Tampering (CVSS 8.0, HashiCorp Boundary · github.com/hashicorp/boundary)
- [CVE-2023-27318](https://cve.now/CVE-2023-27318.md): Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 6.5, NetApp StorageGRID)
- [CVE-2024-24807](https://cve.now/CVE-2024-24807.md): Sulu is vulnerable to HTML Injection via Autocomplete Suggestion (CVSS 2.7, sulu · sulu/sulu)
- [CVE-2024-22202](https://cve.now/CVE-2024-22202.md): User Removal Page Allows Spoofing Of User Details (CVSS 5.7, thorsten phpMyFAQ · phpmyfaq/phpmyfaq)
- [CVE-2023-6874](https://cve.now/CVE-2023-6874.md): Zigbee Unauthenticated DoS via NWK Sequence number manipulation (CVSS 7.5, silabs.com GSDK)
- [CVE-2023-6028](https://cve.now/CVE-2023-6028.md): SDM Web interface vulnerable to XSS (CVSS 6.1, B&R Industrial Automation Automation Runtime)
- [CVE-2024-0953](https://cve.now/CVE-2024-0953.md): When a user scans a QR Code with the QR Code Scanner feature, the user is not prompted before being navigated to the page specified in the c (CVSS 6.1, Mozilla Firefox for iOS)
- [CVE-2024-0323](https://cve.now/CVE-2024-0323.md): FTP uses unsecure encryption mechanisms (CVSS 9.8, B&R Industrial Automation Automation Runtime)
- [CVE-2023-7216](https://cve.now/CVE-2023-7216.md): Cpio: extraction allows symlinks which enables remote command execution (CVSS 5.3, Red Hat Enterprise Linux)
- [CVE-2024-24768](https://cve.now/CVE-2024-24768.md): 1Panel set-cookie is missing the Secure keyword (CVSS 6.5, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2023-52138](https://cve.now/CVE-2023-52138.md): Path traversal via crafted cpio archives in Engrampa archivers (CVSS 8.2, mate-desktop engrampa)
- [CVE-2024-24762](https://cve.now/CVE-2024-24762.md): python-multipart vulnerable to content-type header Regular expression Denial of Service (CVSS 7.5, Kludex python-multipart · tiangolo fastapi +3)
- [CVE-2024-23108](https://cve.now/CVE-2024-23108.md): An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to (CVSS 9.7, Fortinet FortiSIEM)
- [CVE-2024-23109](https://cve.now/CVE-2024-23109.md): An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to (CVSS 9.7, Fortinet FortiSIEM)
- [CVE-2024-1225](https://cve.now/CVE-2024-1225.md): QiboSoft QiboCMS X1 Pay.php rmb\_pay deserialization (CVSS 7.3, QiboSoft QiboCMS X1)
- [CVE-2023-5249](https://cve.now/CVE-2023-5249.md): Mali GPU Kernel Driver allows improper GPU memory processing operations (CVSS 7.0, Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel Driv…)
- [CVE-2023-5643](https://cve.now/CVE-2023-5643.md): Mali GPU Kernel Driver allows improper GPU memory processing operations (CVSS 7.8, Arm Bifrost GPU Kernel Driver · Arm Valhall GPU Kernel D… +1)
- [CVE-2021-4436](https://cve.now/CVE-2021-4436.md): 3DPrint Lite \< 1.9.1.5 - Unauthenticated Arbitrary File Upload (CVSS 9.8, 3DPrint Lite)
- [CVE-2024-24864](https://cve.now/CVE-2024-24864.md): Race condition vulnerability in Linux kernel media/dvb-core in dvbdmx\_write() (CVSS 5.3, Linux kernel)
- [CVE-2024-24857](https://cve.now/CVE-2024-24857.md): Race condition vulnerability in Linux kernel bluetooth in conn\_info\_{min,max}\_age\_set() (CVSS 4.6, Linux kernel)
- [CVE-2024-24858](https://cve.now/CVE-2024-24858.md): Race condition vulnerability in Linux kernel net/bluetooth in {conn,adv}\_{min,max}\_interval\_set() (CVSS 4.6, Linux kernel)
- [CVE-2024-24859](https://cve.now/CVE-2024-24859.md): Race condition vulnerability in Linux kernel bluetooth sniff\_{min,max}\_interval\_set() (CVSS 4.6, Linux kernel)
- [CVE-2024-24860](https://cve.now/CVE-2024-24860.md): Race condition vulnerability in Linux kernel bluetooth driver in {min,max}\_key\_size\_set() (CVSS 4.6, Linux kernel)
- [CVE-2024-24861](https://cve.now/CVE-2024-24861.md): Race condition vulnerability in Linux kernel media/xc4000 xc4000\_get\_frequency() (CVSS 3.3, Linux kernel)
- [CVE-2024-24855](https://cve.now/CVE-2024-24855.md): Race condition vulnerability in Linux kernel scsi device driver lpfc\_unregister\_fcf\_rescan() (CVSS 5.0, Linux kernel)
- [CVE-2024-23196](https://cve.now/CVE-2024-23196.md): Race condition vulnerability in Linux kernel sound/hda snd\_hdac\_regmap\_sync (CVSS 5.3, Linux kernel)
- [CVE-2024-22386](https://cve.now/CVE-2024-22386.md): Race condition vulnerability in Linux kernel drm/exynos exynos\_drm\_crtc\_atomic\_disable (CVSS 5.3, Linux kernel)
- [CVE-2023-7077](https://cve.now/CVE-2023-7077.md): Sharp NEC Displays (P403, P463, P553, P703, P801, X554UN, X464UN, X554UNS, X464UNV, X474HB, X464UNS, X554UNV, X555UNS, X555UNV, X754HB, X554 (CVSS 9.8, Sharp Display Solutions P403, P463, P553, P703, P801, X554U…)
- [CVE-2024-24838](https://cve.now/CVE-2024-24838.md): WordPress Five Star Restaurant Reviews Plugin \<= 2.3.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Five Star Plugins Five Star Restaurant Reviews)
- [CVE-2024-24839](https://cve.now/CVE-2024-24839.md): WordPress Structured Content Plugin \<= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Gordon Böhme, Antonio Leutsch Structured Content (JSON-LD)…)
- [CVE-2024-24841](https://cve.now/CVE-2024-24841.md): WordPress Add Customer for WooCommerce Plugin \<= 1.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Dan's Art Add Customer for WooCommerce)
- [CVE-2024-24846](https://cve.now/CVE-2024-24846.md): WordPress Mighty Addons for Elementor Plugin \<= 1.9.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, MightyThemes Mighty Addons for Elementor)
- [CVE-2024-24847](https://cve.now/CVE-2024-24847.md): WordPress CalculatorPro Calculators Plugin \<= 1.1.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, jgadbois CalculatorPro Calculators)
- [CVE-2024-24848](https://cve.now/CVE-2024-24848.md): WordPress PT Sign Ups Plugin \<= 1.0.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, MJS Software PT Sign Ups – Beautiful volunteer sign ups and…)
- [CVE-2024-24865](https://cve.now/CVE-2024-24865.md): WordPress Scroll Triggered Box Plugin \<= 2.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Noah Kagan Scroll Triggered Box)
- [CVE-2024-24866](https://cve.now/CVE-2024-24866.md): WordPress Biteship Plugin \<= 2.2.24 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Biteship: Plugin Ongkos Kirim Kurir Instant, Reguler, Kargo)
- [CVE-2024-20004](https://cve.now/CVE-2024-20004.md): In Modem NL1, there is a possible system crash due to an improper input validation. (CVSS 7.5, MediaTek MT2735, MT6297, MT6833, MT6853, MT6855, MT6873, MT…)
- [CVE-2024-20002](https://cve.now/CVE-2024-20002.md): In TVAPI, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT5583, MT5586, MT5691, MT5695, MT5696, MT9010, MT…)
- [CVE-2024-20001](https://cve.now/CVE-2024-20001.md): In TVAPI, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT5583, MT5586, MT5691, MT5695, MT5696, MT9010, MT…)
- [CVE-2024-20016](https://cve.now/CVE-2024-20016.md): In ged, there is a possible out of bounds write due to an integer overflow. (CVSS 4.4, MediaTek MT6735, MT6737, MT6739, MT6753, MT6757, MT6761, MT…)
- [CVE-2024-20015](https://cve.now/CVE-2024-20015.md): In telephony, there is a possible escalation of privilege due to a permissions bypass. (CVSS 7.4, MediaTek MT6739, MT6753, MT6757, MT6761, MT6762, MT6763, MT…)
- [CVE-2024-20013](https://cve.now/CVE-2024-20013.md): In keyInstall, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2024-20012](https://cve.now/CVE-2024-20012.md): In keyInstall, there is a possible escalation of privilege due to type confusion. (CVSS 6.7, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2024-20003](https://cve.now/CVE-2024-20003.md): In Modem NL1, there is a possible system crash due to an improper input validation. (CVSS 7.5, MediaTek MT2735, MT6297, MT6833, MT6853, MT6855, MT6873, MT…)
- [CVE-2024-20011](https://cve.now/CVE-2024-20011.md): In alac decoder, there is a possible information disclosure due to an incorrect bounds check. (CVSS 9.8, MediaTek MT6985, MT8127, MT8135, MT8167, MT8167S, MT8168, M…)
- [CVE-2024-20010](https://cve.now/CVE-2024-20010.md): In keyInstall, there is a possible escalation of privilege due to type confusion. (CVSS 6.7, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2024-20009](https://cve.now/CVE-2024-20009.md): In alac decoder, there is a possible out of bounds write due to an incorrect error handling. (CVSS 8.8, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6779, MT…)
- [CVE-2024-20007](https://cve.now/CVE-2024-20007.md): In mp3 decoder, there is a possible out of bounds write due to a race condition. (CVSS 7.5, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6779, MT…)
- [CVE-2024-20006](https://cve.now/CVE-2024-20006.md): In da, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.6, MediaTek MT2713, MT6781, MT6880, MT6890, MT8188T)
- [CVE-2024-24870](https://cve.now/CVE-2024-24870.md): WordPress Advanced iFrame Plugin \<= 2023.10 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Michael Dempfle Advanced iFrame)
- [CVE-2023-51504](https://cve.now/CVE-2023-51504.md): WordPress Dan's Embedder for Google Calendar Plugin \<= 1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Dan Dulaney Dan's Embedder for Google Calendar)
- [CVE-2023-5800](https://cve.now/CVE-2023-5800.md): Insufficient input validation in VAPIX API create\_overlay.cgi (CVSS 5.4, Axis Communications AB AXIS OS)
- [CVE-2023-5677](https://cve.now/CVE-2023-5677.md): Brandon Rothel from QED Secure Solutions and Sam Hanson of Dragos have found that the VAPIX API tcptest.cgi did not have a sufficient input (CVSS 6.3, Axis Communications AB AXIS OS)
- [CVE-2023-47355](https://cve.now/CVE-2023-47355.md): The com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT\] Quick Reboot) application 1.0.8 for Android has exposed broadcast receivers for (CVSS 7.5)
- [CVE-2023-51951](https://cve.now/CVE-2023-51951.md): SQL Injection vulnerability in Stock Management System 1.0 allows a remote attacker to execute arbitrary code via the id parameter in the ma (CVSS 9.8)
- [CVE-2024-22567](https://cve.now/CVE-2024-22567.md): File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do. (CVSS 8.8, net.mingsoft:ms-mcms)
- [CVE-2024-22667](https://cve.now/CVE-2024-22667.md): Vim before 9.0.2142 has a stack-based buffer overflow because did\_set\_langmap in map.c calls sprintf to write to the error buffer that is pa (CVSS 7.8)
- [CVE-2024-23049](https://cve.now/CVE-2024-23049.md): An issue in symphony v.3.6.3 and before allows a remote attacker to execute arbitrary code via the log4j component. (CVSS 9.8)
- [CVE-2024-23054](https://cve.now/CVE-2024-23054.md): An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package liste (CVSS 9.8)
- [CVE-2024-24258](https://cve.now/CVE-2024-24258.md): freeglut 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddSubMenu function. (CVSS 7.5)
- [CVE-2024-24259](https://cve.now/CVE-2024-24259.md): freeglut through 3.4.0 was discovered to contain a memory leak via the menuEntry variable in the glutAddMenuEntry function. (CVSS 7.5)
- [CVE-2024-24260](https://cve.now/CVE-2024-24260.md): media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip\_subscribe\_remove function at /uac/sip-uac-sub (CVSS 7.5)
- [CVE-2024-24262](https://cve.now/CVE-2024-24262.md): media-server v1.0.0 was discovered to contain a Use-After-Free (UAF) vulnerability via the sip\_uac\_stop\_timer function at /uac/sip-uac-trans (CVSS 7.5)
- [CVE-2024-24263](https://cve.now/CVE-2024-24263.md): Lotos WebServer v0.1.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the response\_append\_status\_line function at /lotos (CVSS 7.5)
- [CVE-2024-24265](https://cve.now/CVE-2024-24265.md): gpac v2.2.1 was discovered to contain a memory leak via the dst\_props variable in the gf\_filter\_pid\_merge\_properties\_internal function. (CVSS 7.5)
- [CVE-2024-24266](https://cve.now/CVE-2024-24266.md): gpac v2.2.1 was discovered to contain a Use-After-Free (UAF) vulnerability via the dasher\_configure\_pid function at /src/filters/dasher.c. (CVSS 7.5)
- [CVE-2024-24267](https://cve.now/CVE-2024-24267.md): gpac v2.2.1 (fixed in v2.4.0) was discovered to contain a memory leak via the gfio\_blob variable in the gf\_fileio\_from\_blob function. (CVSS 7.5)
- [CVE-2024-24396](https://cve.now/CVE-2024-24396.md): Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrar (CVSS 6.1, stimulsoft-dashboards-js)
- [CVE-2024-24397](https://cve.now/CVE-2024-24397.md): Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrar (CVSS 5.4, stimulsoft-dashboards-js)
- [CVE-2024-24468](https://cve.now/CVE-2024-24468.md): Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the add\_customblock.ph (CVSS 8.8)
- [CVE-2024-24469](https://cve.now/CVE-2024-24469.md): Cross Site Request Forgery vulnerability in flusity-CMS v.2.33 allows a remote attacker to execute arbitrary code via the delete\_post .php. (CVSS 8.8)
- [CVE-2024-24543](https://cve.now/CVE-2024-24543.md): Buffer Overflow vulnerability in the function setSchedWifi in Tenda AC9 v.3.0, firmware version v.15.03.06.42\_multi allows a remote attacker (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.