CVEs published February 7, 2024
73 CVEs were published on February 7, 2024: 13 critical, 18 high.
- Published
- 73
- Critical
- 13
- High
- 18
- Medium
- 37
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- IBM Security Verify Access Appliance · IBM Security Verify…
- 5
- Cisco TelePresence Video Communication Server (VCS) Express…
- 3
- GitLab
- 3
- Red Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- 3
- ays-pro Quiz Maker
- 2
- CodeAstro Restaurant POS System
- 2
- CodeAstro University Management System
- 2
- eteubert Podlove Podcast Publisher
- 2
- graylog2-server · org.graylog2:graylog2-server
- 2
- Apache Software Foundation Apache Ozone · org.apache.ozone:…
- 1
Critical 13
- CVE-2024-24563Vyper array negative index vulnerabilityvyperlang vyper · vyper
- CVE-2024-20254Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, Cisco TelePresence Video Communication Server (VCS) Express…
- CVE-2024-20252Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, Cisco TelePresence Video Communication Server (VCS) Express…
- CVE-2024-25145Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, anLiferay Portal · Liferay DXP +2
- CVE-2024-24811Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query executionzopefoundation Products.SQLAlchemyDA · products-sqlalchemyda
- CVE-2023-38995An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command.
- CVE-2023-46914SQL Injection vulnerability in RM bookingcalendar module for PrestaShop versions 2.7.9 and before, allows remote attackers to execute arbitr
- CVE-2024-24019A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
- CVE-2024-24133Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page.
- CVE-2024-24186Jsish v3.5.0 (commit 42c694c) was discovered to contain a stack-overflow via the component IterGetKeysCallback at /jsish/src/jsiValue.c.
- CVE-2024-24188Jsish v3.5.0 was discovered to contain a heap-buffer-overflow in ./src/jsiUtils.c.
- CVE-2024-24189Jsish v3.5.0 (commit 42c694c) was discovered to contain a use-after-free via the SplitChar at ./src/jsiUtils.c.
- CVE-2024-24303SQL Injection vulnerability in HiPresta "Gift Wrapping Pro" (hiadvancedgiftwrapping) module for PrestaShop before version 1.4.1, allows remo
High 18
- CVE-2024-24806Improper Domain Lookup that potentially leads to SSRF attacks in libuvlibuv
- CVE-2024-24824graylog2-server vulnerable to instantiation of arbitrary classes triggered by API requestgraylog2-server · org.graylog2:graylog2-server
- CVE-2024-20290A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) Cisco Secure Endpoint
- CVE-2024-20255A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated,Cisco TelePresence Video Communication Server (VCS) Express…
- CVE-2023-43017IBM Security Verify Access man in the middleIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2023-32330IBM Security Verify Access man in the middleIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2023-32328IBM Security Verify Access information disclosureIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2024-22012there is a possible out of bounds write due to a missing bounds check.Google Android
- CVE-2024-24771Open Forms potential multi-factor authentication bypassopen-formulieren open-forms
- CVE-2024-1118Podlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injectionchemiker Podlove Subscribe button
- CVE-2023-51437Apache Pulsar: Timing attack in SASL token signature verificationApache Software Foundation Apache Pulsar · org.apache.pulsa…
- CVE-2024-24810WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privilegeswixtoolset issues · wix
- CVE-2024-22022Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash Veeam Recovery Orchestrator · Veeam Availability Orchestrat…
- CVE-2024-23769Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 (for Windows) allows a local attacker to read privileged
- CVE-2024-24304In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical information without rest
- CVE-2024-24311Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" (lgsitemaps) module for PrestaShop before vers
- CVE-2024-25200Espruino 2v20 (commit fcc9ba4) was discovered to contain a Stack Overflow via the jspeFactorFunctionCall at src/jsparse.c.
- CVE-2024-25201Espruino 2v20 (commit fcc9ba4) was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at src/jsvar.c.
Medium, low and unrated 42
- CVE-2023-6736Inefficient Regular Expression Complexity in GitLabGitLab
- CVE-2023-6840Missing Authorization in GitLabGitLab
- CVE-2024-1066Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2024-23448APM Server Insertion of Sensitive Information into Log FileElastic APM Server · github.com/elastic/apm-server
- CVE-2023-6536Kernel: null pointer dereference in __nvmet_req_completeRed Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- CVE-2023-6535Kernel: null pointer dereference in nvmet_tcp_execute_requestRed Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- CVE-2023-6356Kernel: null pointer dereference in nvmet_tcp_build_iovecRed Hat Enterprise Linux · Red Hat Virtualization 4 for… +1
- CVE-2024-24823graylog2-server Session Fixation vulnerability through cookie injectiongraylog2-server · org.graylog2:graylog2-server
- CVE-2024-24822Pimcore Admin Classic Bundle permissions are not getting checked when working with tagspimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…
- CVE-2024-24816Cross-site scripting (XSS) vulnerability in samples with enabled the preview featureckeditor4
- CVE-2024-24706WordPress WP-CFM Plugin <= 1.7.8 is vulnerable to Cross Site Request Forgery (CSRF)Forum One WP-CFM
- CVE-2024-23806HID Global Reader Configuration Cards Improper AuthorizationHID Global HID iCLASS SE reader configuration cards · HID G…
- CVE-2023-47700IBM Storage Virtualize improper certificate validationIBM Storage Virtualize
- CVE-2023-38369IBM Security Access Manager Container information disclosureIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2023-31002IBM Security Access Manager Container information disclosureIBM Security Verify Access Appliance · IBM Security Verify…
- CVE-2024-24815CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detectionckeditor4 · ckeditor/ckeditor
- CVE-2024-24812Frappe Authenticated Reflected Cross site scripting (XSS) in portal pagesfrappe
- CVE-2024-25143The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service packLiferay DXP · Liferay Portal +1
- CVE-2023-39196Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpointsApache Software Foundation Apache Ozone · org.apache.ozone:…
- CVE-2024-1109Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data Exporteteubert Podlove Podcast Publisher
- CVE-2024-1110Podlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Importeteubert Podlove Podcast Publisher
- CVE-2024-1078Quiz Maker <= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & Modificationays-pro Quiz Maker
- CVE-2024-1079Quiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrievalays-pro Quiz Maker
- CVE-2024-0977Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingnarinder-singh Timeline Widget For Elementor
- CVE-2024-1037All-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scriptingdavidanderson All-In-One Security (AIOS) – Security and Fir…
- CVE-2024-0628The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via thejeangalea WP RSS Aggregator – RSS Import, News Feeds, Feed…
- CVE-2024-1055PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scriptingideaboxcreations PowerPack Addons for Elementor
- CVE-2024-0256Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settingscifi Starbox – the Author Box for Humans
- CVE-2024-23447Elastic Network Drive Connector Improper Access ControlElastic Network Drive Connector
- CVE-2024-23446Kibana Broken Access Control issueElastic Kibana
- CVE-2024-0849Leanote 2.7.0 - Local File ReadLeanote
- CVE-2023-6388Suite CRM v7.14.2 - SSRFSuite CRM
- CVE-2024-1269SourceCodester Product Management System supplier.php cross site scriptingSourceCodester Product Management System
- CVE-2024-1268CodeAstro Restaurant POS System update_product.php unrestricted uploadCodeAstro Restaurant POS System
- CVE-2024-1267CodeAstro Restaurant POS System create_account.php cross site scriptingCodeAstro Restaurant POS System
- CVE-2024-22021Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a ScoVeeam Recovery Orchestrator · Veeam Disaster Recovery Or… +1
- CVE-2024-1266CodeAstro University Management System Student Registration Form st_reg.php cross site scriptingCodeAstro University Management System
- CVE-2024-1265CodeAstro University Management System Attendance Management att_add.php cross site scriptingCodeAstro University Management System
- CVE-2023-40355Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allo
- CVE-2024-24130Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Usr parameter
- CVE-2024-24131SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.
- CVE-2024-24488An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password c