CVEs published February 6, 2024
156 CVEs were published on February 6, 2024: 25 critical, 55 high.
- Published
- 156
- Critical
- 25
- High
- 55
- Medium
- 68
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 26
Most affected products
- Qualcomm Snapdragon
- 26
- Samsung Mobile Devices
- 11
- Tp-Link ER7206 Omada Gigabit VPN Router
- 8
- Westermo Lynx
- 8
- Juanpao JPShop
- 7
- Canon Satera LBP670C Series · Canon Satera MF750C Series +8
- 6
- JetBrains TeamCity
- 5
- VMware Aria Operations for Networks
- 5
- Samsung Mobile Galaxy Store
- 4
- Allegro.AI ClearML
- 3
Critical 25
- CVE-2024-1284Use after free in Mojo in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-24594A cross-site scripting (XSS) vulnerability in all versions of the web server component of Allegro AI’s ClearML platform allows a remote attaAllegro.AI ClearML
- CVE-2024-24593A cross-site request forgery (CSRF) vulnerability in all versions up to 1.14.1 of the api server component of Allegro AI’s ClearML platform Allegro.AI ClearML
- CVE-2024-24592Lack of authentication in all versions of the fileserver component of Allegro AI’s ClearML platform allows a remote attacker to arbitrarily Allegro.AI ClearML
- CVE-2024-23917In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possibleJetBrains TeamCity
- CVE-2023-33072Buffer copy without checking size of Input in CoreQualcomm Snapdragon
- CVE-2024-0244Buffer overflow in CPCA PCFAX number process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the netwoCanon Satera MF750C Series · Canon Color imageCLASS MF75… +3
- CVE-2023-6234Buffer overflow in CPCA Color LUT Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attackCanon Satera LBP670C Series · Canon Satera MF750C Series +8
- CVE-2023-6233Buffer overflow in SLP attribute request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the nCanon Satera LBP670C Series · Canon Satera MF750C Series +8
- CVE-2023-6232Buffer overflow in the Address Book username process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Canon Satera LBP670C Series · Canon Satera MF750C Series +8
- CVE-2023-6231Buffer overflow in WSD probe request process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on the netwoCanon Satera LBP670C Series · Canon Satera MF750C Series +8
- CVE-2023-6230Buffer overflow in the Address Book password process in authentication of Mobile Device Function of Office Multifunction Printers and Laser Canon Satera LBP670C Series · Canon Satera MF750C Series +8
- CVE-2023-6229Buffer overflow in CPCA PDL Resource Download process of Office Multifunction Printers and Laser Printers(*) which may allow an attacker on Canon Satera LBP670C Series · Canon Satera MF750C Series +8
- CVE-2023-46359An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attac
- CVE-2024-22852D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function genacgi_main.
- CVE-2024-22853D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain r
- CVE-2024-24000jshERP v3.3 is vulnerable to Arbitrary File Upload.
- CVE-2024-24001jshERP v3.3 is vulnerable to SQL Injection.
- CVE-2024-24002jshERP v3.3 is vulnerable to SQL Injection.
- CVE-2024-24004jshERP v3.3 is vulnerable to SQL Injection.
- CVE-2024-24013A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
- CVE-2024-24015A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
- CVE-2024-24112xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.
- CVE-2024-24398Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrarystimulsoft-dashboards-js
- CVE-2024-25140A default installation of RustDesk 1.2.3 on Windows places a WDKTestCert certificate under Trusted Root Certification Authorities with Enhan
High 55
- CVE-2024-1283Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2023-45735Westermo Lynx Code InjectionWestermo Lynx
- CVE-2024-24577libgit2 is vulnerable to arbitrary code execution due to heap corruption in `git_index_add`libgit2
- CVE-2024-24575libgit2 is vulnerable to a denial of service attack in `git_revparse_single`libgit2
- CVE-2023-38579Westermo Lynx 206-F2G Cross-Site Request ForgeryWestermo Lynx
- CVE-2024-22237Aria Operations for Networks contains a local privilege escalation vulnerability.VMware Aria Operations for Networks
- CVE-2023-40545PingFederate OAuth client_secret_jwt Authentication BypassPing Identity PingFederate
- CVE-2023-43482A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322Tp-Link ER7206 Omada Gigabit VPN Router
- CVE-2023-36498A post-authentication command injection vulnerability exists in the PPTP client functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3Tp-Link ER7206 Omada Gigabit VPN Router
- CVE-2023-47209A post authentication command injection vulnerability exists in the ipsec policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.Tp-Link ER7206 Omada Gigabit VPN Router
- CVE-2023-47167A post authentication command injection vulnerability exists in the GRE policy functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.Tp-Link ER7206 Omada Gigabit VPN Router
- CVE-2023-42664A post authentication command injection vulnerability exists when setting up the PPTP global configuration of Tp-Link ER7206 Omada Gigabit VTp-Link ER7206 Omada Gigabit VPN Router
- CVE-2023-46683A post authentication command injection vulnerability exists when configuring the wireguard VPN functionality of Tp-Link ER7206 Omada GigabTp-Link ER7206 Omada Gigabit VPN Router
- CVE-2023-47617A post authentication command injection vulnerability exists when configuring the web group member of Tp-Link ER7206 Omada Gigabit VPN RouteTp-Link ER7206 Omada Gigabit VPN Router
- CVE-2023-47618A post authentication command execution vulnerability exists in the web filtering functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1Tp-Link ER7206 Omada Gigabit VPN Router
- CVE-2023-35188SQL Injection Remote Code Execution VulnerabilitySolarWinds Platform
- CVE-2023-50395SQL Injection Remote Code Execution VulnerabilitySolarWinds Platform
- CVE-2024-24591A path traversal vulnerability in versions 1.4.0 to 1.14.1 of the client SDK of Allegro AI’s ClearML platform enables a maliciously uploadedAllegro.AI ClearML · clearml
- CVE-2024-24590Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a maliAllegro.AI ClearML · clearml
- CVE-2024-23673Apache Sling Servlets Resolver: Malicious code execution via path traversalApache Software Foundation Apache Sling Servlets Resolver ·…
- CVE-2023-32451 Dell Display Manager application, version 2.1.1.17, contains a vulnerability that low privilege user can execute malicious code during instDell Display Manager
- CVE-2023-25543 Dell Power Manager, versions prior to 3.14, contain an Improper Authorization vulnerability in DPM service.Dell Power Manager
- CVE-2023-43536Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-43535Improper Validation of Array Index in DisplayQualcomm Snapdragon
- CVE-2023-43534Use of Out-of-range Pointer Offset in WLAN HOSTQualcomm Snapdragon
- CVE-2023-43533Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-43532Untrusted Pointer Dereference in DisplayQualcomm Snapdragon
- CVE-2023-43523Reachable Assertion in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-43522NULL Pointer Dereference in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-43520Stack-based Buffer Overflow in WLAN HOSTQualcomm Snapdragon
- CVE-2023-43519Buffer Copy without Checking Size of Input (`Classic Buffer Overflow`) in VideoQualcomm Snapdragon
- CVE-2023-43518Untrusted Pointer Dereference in VideoQualcomm Snapdragon
- CVE-2023-43517Improper Access Control in Automotive MultimediaQualcomm Snapdragon
- CVE-2023-43516Use of out-of-range pointer offset in VideoQualcomm Snapdragon
- CVE-2023-43513Use of Out-of-range Pointer Offset in PCIeQualcomm Snapdragon
- CVE-2023-33060Buffer Over-read in CoreQualcomm Snapdragon
- CVE-2023-33058Buffer Copy Without Checking Size of Input in ModemQualcomm Snapdragon
- CVE-2023-33057Improper Input Validation in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2023-33049Improper Release of Memory Before Removing Last Reference in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2023-33046Time-of-check Time-of-use (TOCTOU) Race Condition in Trusted Execution EnvironmentQualcomm Snapdragon
- CVE-2024-23304Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performinCybozu KUNAI for Android
- CVE-2024-20816Improper authentication vulnerability in onCharacteristicWriteRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackSamsung Mobile Devices
- CVE-2024-20815Improper authentication vulnerability in onCharacteristicReadRequest in Auto Hotspot prior to SMR Feb-2024 Release 1 allows adjacent attackeSamsung Mobile Devices
- CVE-2024-20813Out-of-bounds Write in padmd_vld_qtbl of libpadm.so prior to SMR Feb-2024 Release 1 allows local attacker to execute arbitrary code.Samsung Mobile Devices
- CVE-2024-20812Out-of-bounds Write in padmd_vld_htbl of libpadm.so prior to SMR Feb-2024 Release 1 allows local attacker to execute arbitrary code.Samsung Mobile Devices
- CVE-2023-46360Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier is vulnerable to Execution with Unnecessary Privileges.
- CVE-2023-47353An issue in the com.oneed.dvr.service.DownloadFirmwareService component of IMOU GO v1.0.11 allows attackers to force the download of arbitra
- CVE-2023-47354An issue in the PowerOffWidgetReceiver function of Super Reboot (Root) Recovery v1.0.3 allows attackers to arbitrarily reset or power off th
- CVE-2023-47889The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers.
- CVE-2024-22514An issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files by restoring a crafted backup file.
- CVE-2024-22515Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to upload arbitrary files via the upload audio
- CVE-2024-22519An issue discovered in OpenDroneID OSM 3.5.1 allows attackers to impersonate other drones via transmission of crafted data packets.
- CVE-2024-22520An issue discovered in Dronetag Drone Scanner 1.5.2 allows attackers to impersonate other drones via transmission of crafted data packets.
- CVE-2024-22773Intelbras Action RF 1200 routers 1.2.2 and earlier and Action RG 1200 routers 2.1.7 and earlier expose the Password in Cookie resulting in L
- CVE-2024-24680An issue was discovered in Django 3.2 before 3.2.24, 4.2 before 4.2.10, and Django 5.0 before 5.0.2.django
Medium, low and unrated 76
- CVE-2024-0971 A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially alter scan DB content.Tenable Nessus
- CVE-2024-0955Stored XSS vulnerabilityTenable Nessus
- CVE-2024-1264Juanpao JPShop UploadsController.php actionUpdate unrestricted uploadJuanpao JPShop
- CVE-2024-22388Insecure Default Initialization of Resource in HID GlobalHID Global iCLASS SE CP1000 Encoder · HID Global iCLASS… +6
- CVE-2024-1263Juanpao JPShop API PosterController.php actionUpdate unrestricted uploadJuanpao JPShop
- CVE-2024-1262Juanpao JPShop API MaterialController.php actionUpdate unrestricted uploadJuanpao JPShop
- CVE-2024-1261Juanpao JPShop API ComboController.php actionIndex unrestricted uploadJuanpao JPShop
- CVE-2023-40143Westermo Lynx Westermo Lynx
- CVE-2023-45222Westermo Lynx Cross-site ScriptingWestermo Lynx
- CVE-2023-45213 Westermo Lynx Permissive Cross-domain Policy with Untrusted DomainsWestermo Lynx
- CVE-2023-42765Westermo Lynx Cross-site ScriptingWestermo Lynx
- CVE-2024-1260Juanpao JPShop API ComboController.php actionIndex unrestricted uploadJuanpao JPShop
- CVE-2023-40544Westermo Lynx Cleartext Transmission of Sensitive InformationWestermo Lynx
- CVE-2023-45227Westermo Lynx Cross-site ScriptingWestermo Lynx
- CVE-2024-1259Juanpao JPShop API AppController.php unrestricted uploadJuanpao JPShop
- CVE-2024-1258Juanpao JPShop API params.php hard-coded keyJuanpao JPShop
- CVE-2024-1257Jspxcms find_text.do cross site scriptingJspxcms
- CVE-2024-22241Aria Operations for Networks contains a cross site scripting vulnerability.VMware Aria Operations for Networks
- CVE-2024-22240Aria Operations for Networks contains a local file read vulnerability.VMware Aria Operations for Networks
- CVE-2024-22239Aria Operations for Networks contains a local privilege escalation vulnerability.VMware Aria Operations for Networks
- CVE-2024-22238Aria Operations for Networks contains a cross site scripting vulnerability.VMware Aria Operations for Networks
- CVE-2024-1256Jspxcms filter_text.do cross site scriptingJspxcms
- CVE-2024-1255sepidz SepidzDigitalMenu Waiters information disclosureSepidzDigitalMenu
- CVE-2024-1254Byzoro Smart S20 Management Platform sysmanageajax.php sql injectionByzoro Smart S20 Management Platform
- CVE-2024-1048Grub2: grub2-set-bootflag can be abused by local (pseudo-)usersgrub2 · Red Hat Enterprise Linux
- CVE-2024-1253Byzoro Smart S40 Management Platform Import web.php unrestricted uploadByzoro Smart S40 Management Platform
- CVE-2024-1252Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2024-22331IBM UrbanCode Deploy information disclosureIBM UrbanCode Deploy · IBM DevOps Deploy
- CVE-2023-46183IBM PowerVM Hypervisor information disclosureIBM PowerVM Hypervisor
- CVE-2024-1251Tongda OA 2017 delete.php sql injectionTongda OA
- CVE-2024-23344Tuleap's content of artifacts might be readable by unauthorized usersEnalean tuleap
- CVE-2024-0911Indent: heap-based buffer overflow in set_buf_break()indent
- CVE-2024-0690Ansible-core: possible information leak in tasks that ignore ansible_no_log configurationansible · Red Hat Ansible Automation Platform 2.4 for RH… +2
- CVE-2024-24943In JetBrains Toolbox App before 2.2 a DoS attack was possible via a malicious SVG imageJetBrains Toolbox App
- CVE-2024-24942In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archivesJetBrains TeamCity
- CVE-2024-24941In JetBrains IntelliJ IDEA before 2023.3.3 a plugin for JetBrains Space was able to send an authentication token to an inappropriate URLJetBrains IntelliJ IDEA
- CVE-2024-24940In JetBrains IntelliJ IDEA before 2023.3.3 path traversal was possible when unpacking archivesJetBrains IntelliJ IDEA
- CVE-2024-24939In JetBrains Rider before 2023.3.3 logging of environment variables containing secret values was possibleJetBrains Rider
- CVE-2024-24938In JetBrains TeamCity before 2023.11.2 limited directory traversal was possible in the Kotlin DSL documentationJetBrains TeamCity
- CVE-2024-24937In JetBrains TeamCity before 2023.11.2 stored XSS via agent distribution was possibleJetBrains TeamCity
- CVE-2024-24936In JetBrains TeamCity before 2023.11.2 access control at the S3 Artifact Storage plugin endpoint was missedJetBrains TeamCity
- CVE-2023-4503Eap-galleon: custom provisioning creates unsecured http-invokerRed Hat EAP · Red Hat JBoss Enterprise Application Platf… +2
- CVE-2024-0684Coreutils: heap overflow in split --line-bytes with very long linescoreutils
- CVE-2023-32479 Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege esDell Encryption · Dell Endpoint Security Suite Enterprise +1
- CVE-2023-32454 DUP framework version 4.9.4.36 and prior contains insecure operation on Windows junction/Mount point vulnerability.Dell DUP Framework
- CVE-2023-32474 Dell Display Manager application, version 2.1.1.17 and prior, contain an insecure operation on windows junction/mount point.Dell Display Manager
- CVE-2023-28063 Dell BIOS contains a Signed to Unsigned Conversion Error vulnerability.Dell CPG BIOS
- CVE-2023-28049 Dell Command | Monitor, versions prior to 10.9, contain an arbitrary folder deletion vulnerability.Dell Command Monitor
- CVE-2023-33077Buffer Copy Without Checking Size of Input in HLOSQualcomm Snapdragon
- CVE-2023-33076Configuration Issue in CoreQualcomm Snapdragon
- CVE-2023-33069Buffer Copy Without Checking Size of Input in AudioQualcomm Snapdragon
- CVE-2023-33068Buffer Copy Without Checking Size of Input in AudioQualcomm Snapdragon
- CVE-2023-33067Use of Out-of-range Pointer Offset in AudioQualcomm Snapdragon
- CVE-2023-33065Buffer Over-read in AudioQualcomm Snapdragon
- CVE-2023-33064Buffer Over-read in AudioQualcomm Snapdragon
- CVE-2024-24808pyLoad open redirect vulnerability due to improper validation of the is_safe_url functionpyload · pyload-ng
- CVE-2024-20828Improper authorization verification vulnerability in Samsung Internet prior to version 24.0 allows physical attackers to access files downloSamsung Mobile Samsung Internet
- CVE-2024-20827Improper access control vulnerability in Samsung Gallery prior to version 14.5.04.4 allows physical attackers to access the picture using phSamsung Mobile Gallery
- CVE-2024-20826Implicit intent hijacking vulnerability in UPHelper library prior to version 4.0.0 allows local attackers to access sensitive information viSamsung Mobile UPHelper
- CVE-2024-20825Implicit intent hijacking vulnerability in IAP of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive informatSamsung Mobile Galaxy Store
- CVE-2024-20824Implicit intent hijacking vulnerability in VoiceSearch of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitive Samsung Mobile Galaxy Store
- CVE-2024-20823Implicit intent hijacking vulnerability in SamsungAccount of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitiSamsung Mobile Galaxy Store
- CVE-2024-20822Implicit intent hijacking vulnerability in AccountActivity of Galaxy Store prior to version 4.5.63.6 allows local attackers to access sensitSamsung Mobile Galaxy Store
- CVE-2024-20820Improper input validation in bootloader prior to SMR Feb-2024 Release 1 allows local privileged attackers to cause an Out-Of-Bounds read.Samsung Mobile Devices
- CVE-2024-20819Out-of-bounds Write vulnerabilities in svc1td_vld_plh_ap of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger bSamsung Mobile Devices
- CVE-2024-20818Out-of-bounds Write vulnerabilities in svc1td_vld_elh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffSamsung Mobile Devices
- CVE-2024-20817Out-of-bounds Write vulnerabilities in svc1td_vld_slh of libsthmbc.so prior to SMR Feb-2024 Release 1 allows local attackers to trigger buffSamsung Mobile Devices
- CVE-2024-20814Out-of-bounds Read in padmd_vld_ac_prog_refine of libpadm.so prior to SMR Feb-2024 Release 1 allows local attackers access unauthorized infoSamsung Mobile Devices
- CVE-2024-20811Improper caller verification in GameOptimizer prior to SMR Feb-2024 Release 1 allows local attackers to configure GameOptimizer.Samsung Mobile Devices
- CVE-2024-20810Implicit intent hijacking vulnerability in Smart Suggestions prior to SMR Feb-2024 Release 1 allows local attackers to get sensitive informaSamsung Mobile Devices
- CVE-2023-47022Insecure Direct Object Reference in NCR Terminal Handler v.1.5.1 allows an unprivileged user to edit the audit logs for any user and can lea
- CVE-2023-52239The XML parser in Magic xpi Integration Platform 4.13.4 allows XXE attacks, e.g., via onItemImport.
- CVE-2024-22365linux-pam (aka Linux PAM) before 1.6.0 allows attackers to cause a denial of service (blocked login process) via mkfifo because the openat c
- CVE-2024-24254PX4 Autopilot 1.14 and earlier, due to the lack of synchronization mechanism for loading geofence data, has a Race Condition vulnerability i
- CVE-2024-24255A Race Condition discovered in geofence.cpp and mission_feasibility_checker.cpp in PX4 Autopilot 1.14 and earlier allows attackers to send d
- CVE-2024-24291An issue in the component /member/index/login of yzmcms v7.0 allows attackers to direct users to malicious sites via a crafted URL.