# CVEs published 2024-02-07

73 CVEs were published on February 7, 2024: 13 critical, 18 high. Days are UTC.

- [CVE-2023-6736](https://cve.now/CVE-2023-6736.md): Inefficient Regular Expression Complexity in GitLab (CVSS 6.5, GitLab)
- [CVE-2023-6840](https://cve.now/CVE-2023-6840.md): Missing Authorization in GitLab (CVSS 6.7, GitLab)
- [CVE-2024-1066](https://cve.now/CVE-2024-1066.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-24806](https://cve.now/CVE-2024-24806.md): Improper Domain Lookup that potentially leads to SSRF attacks in libuv (CVSS 7.3, libuv)
- [CVE-2024-23448](https://cve.now/CVE-2024-23448.md): APM Server Insertion of Sensitive Information into Log File (CVSS 5.7, Elastic APM Server · github.com/elastic/apm-server)
- [CVE-2023-6536](https://cve.now/CVE-2023-6536.md): Kernel: null pointer dereference in \_\_nvmet\_req\_complete (CVSS 6.5, Red Hat Enterprise Linux · Red Hat Virtualization 4 for… +1)
- [CVE-2023-6535](https://cve.now/CVE-2023-6535.md): Kernel: null pointer dereference in nvmet\_tcp\_execute\_request (CVSS 6.5, Red Hat Enterprise Linux · Red Hat Virtualization 4 for… +1)
- [CVE-2023-6356](https://cve.now/CVE-2023-6356.md): Kernel: null pointer dereference in nvmet\_tcp\_build\_iovec (CVSS 6.5, Red Hat Enterprise Linux · Red Hat Virtualization 4 for… +1)
- [CVE-2024-24824](https://cve.now/CVE-2024-24824.md): graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request (CVSS 8.8, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2024-24823](https://cve.now/CVE-2024-24823.md): graylog2-server Session Fixation vulnerability through cookie injection (CVSS 5.7, graylog2-server · org.graylog2:graylog2-server)
- [CVE-2024-24822](https://cve.now/CVE-2024-24822.md): Pimcore Admin Classic Bundle permissions are not getting checked when working with tags (CVSS 6.5, pimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…)
- [CVE-2024-24563](https://cve.now/CVE-2024-24563.md): Vyper array negative index vulnerability (CVSS 9.8, vyperlang vyper · vyper)
- [CVE-2024-24816](https://cve.now/CVE-2024-24816.md): Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature (CVSS 6.1, ckeditor4)
- [CVE-2024-24706](https://cve.now/CVE-2024-24706.md): WordPress WP-CFM Plugin \<= 1.7.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Forum One WP-CFM)
- [CVE-2024-23806](https://cve.now/CVE-2024-23806.md): HID Global Reader Configuration Cards Improper Authorization (CVSS 5.3, HID Global HID iCLASS SE reader configuration cards · HID G…)
- [CVE-2023-47700](https://cve.now/CVE-2023-47700.md): IBM Storage Virtualize improper certificate validation (CVSS 5.9, IBM Storage Virtualize)
- [CVE-2024-20290](https://cve.now/CVE-2024-20290.md): A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS) (CVSS 7.5, Cisco Secure Endpoint)
- [CVE-2024-20255](https://cve.now/CVE-2024-20255.md): A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allow an unauthenticated, (CVSS 8.2, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2024-20254](https://cve.now/CVE-2024-20254.md): Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, (CVSS 9.6, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2024-20252](https://cve.now/CVE-2024-20252.md): Multiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, (CVSS 9.6, Cisco TelePresence Video Communication Server (VCS) Express…)
- [CVE-2023-38369](https://cve.now/CVE-2023-38369.md): IBM Security Access Manager Container information disclosure (CVSS 6.2, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2023-31002](https://cve.now/CVE-2023-31002.md): IBM Security Access Manager Container information disclosure (CVSS 5.1, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2023-43017](https://cve.now/CVE-2023-43017.md): IBM Security Verify Access man in the middle (CVSS 8.2, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2023-32330](https://cve.now/CVE-2023-32330.md): IBM Security Verify Access man in the middle (CVSS 7.5, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2023-32328](https://cve.now/CVE-2023-32328.md): IBM Security Verify Access information disclosure (CVSS 7.5, IBM Security Verify Access Appliance · IBM Security Verify…)
- [CVE-2024-22012](https://cve.now/CVE-2024-22012.md): there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Google Android)
- [CVE-2024-24815](https://cve.now/CVE-2024-24815.md): CKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection (CVSS 6.1, ckeditor4 · ckeditor/ckeditor)
- [CVE-2024-24812](https://cve.now/CVE-2024-24812.md): Frappe Authenticated Reflected Cross site scripting (XSS) in portal pages (CVSS 5.4, frappe)
- [CVE-2024-25145](https://cve.now/CVE-2024-25145.md): Stored cross-site scripting (XSS) vulnerability in the Portal Search module's Search Result app in Liferay Portal 7.2.0 through 7.4.3.11, an (CVSS 9.6, Liferay Portal · Liferay DXP +2)
- [CVE-2024-24811](https://cve.now/CVE-2024-24811.md): Products.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution (CVSS 9.8, zopefoundation Products.SQLAlchemyDA · products-sqlalchemyda)
- [CVE-2024-24771](https://cve.now/CVE-2024-24771.md): Open Forms potential multi-factor authentication bypass (CVSS 7.7, open-formulieren open-forms)
- [CVE-2024-25143](https://cve.now/CVE-2024-25143.md): The Document and Media widget In Liferay Portal 7.2.0 through 7.3.6, and older unsupported versions, and Liferay DXP 7.3 before service pack (CVSS 6.5, Liferay DXP · Liferay Portal +1)
- [CVE-2023-39196](https://cve.now/CVE-2023-39196.md): Apache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints (CVSS 5.3, Apache Software Foundation Apache Ozone · org.apache.ozone:…)
- [CVE-2024-1118](https://cve.now/CVE-2024-1118.md): Podlove Subscribe button \<= 1.3.10 - Authenticated (Contributor+) SQL Injection (CVSS 8.8, chemiker Podlove Subscribe button)
- [CVE-2024-1109](https://cve.now/CVE-2024-1109.md): Podlove Podcast Publisher \<= 4.0.11 - Missing Authorization to Unauthenticated Data Export (CVSS 5.3, eteubert Podlove Podcast Publisher)
- [CVE-2024-1110](https://cve.now/CVE-2024-1110.md): Podlove Podcast Publisher \<= 4.0.11 - Missing Authorization to Settings Import (CVSS 5.3, eteubert Podlove Podcast Publisher)
- [CVE-2023-51437](https://cve.now/CVE-2023-51437.md): Apache Pulsar: Timing attack in SASL token signature verification (CVSS 7.4, Apache Software Foundation Apache Pulsar · org.apache.pulsa…)
- [CVE-2024-1078](https://cve.now/CVE-2024-1078.md): Quiz Maker \<= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & Modification (CVSS 4.3, ays-pro Quiz Maker)
- [CVE-2024-1079](https://cve.now/CVE-2024-1079.md): Quiz Maker \<= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval (CVSS 5.3, ays-pro Quiz Maker)
- [CVE-2024-0977](https://cve.now/CVE-2024-0977.md): Timeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) \<= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 4.4, narinder-singh Timeline Widget For Elementor)
- [CVE-2024-1037](https://cve.now/CVE-2024-1037.md): All-In-One Security (AIOS) – Security and Firewall \<= 5.2.5 - Reflected Cross-Site Scripting (CVSS 6.1, davidanderson All-In-One Security (AIOS) – Security and Fir…)
- [CVE-2024-0628](https://cve.now/CVE-2024-0628.md): The WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.23.5 via the (CVSS 3.8, jeangalea WP RSS Aggregator – RSS Import, News Feeds, Feed…)
- [CVE-2024-1055](https://cve.now/CVE-2024-1055.md): PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) \<= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, ideaboxcreations PowerPack Addons for Elementor)
- [CVE-2024-0256](https://cve.now/CVE-2024-0256.md): Starbox \<= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings (CVSS 6.4, cifi Starbox – the Author Box for Humans)
- [CVE-2024-23447](https://cve.now/CVE-2024-23447.md): Elastic Network Drive Connector Improper Access Control (CVSS 5.3, Elastic Network Drive Connector)
- [CVE-2024-23446](https://cve.now/CVE-2024-23446.md): Kibana Broken Access Control issue (CVSS 6.5, Elastic Kibana)
- [CVE-2024-0849](https://cve.now/CVE-2024-0849.md): Leanote 2.7.0 - Local File Read (CVSS 5.0, Leanote)
- [CVE-2023-6388](https://cve.now/CVE-2023-6388.md): Suite CRM v7.14.2 - SSRF (CVSS 5.0, Suite CRM)
- [CVE-2024-24810](https://cve.now/CVE-2024-24810.md): WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges (CVSS 8.3, wixtoolset issues · wix)
- [CVE-2024-1269](https://cve.now/CVE-2024-1269.md): SourceCodester Product Management System supplier.php cross site scripting (CVSS 2.4, SourceCodester Product Management System)
- [CVE-2024-1268](https://cve.now/CVE-2024-1268.md): CodeAstro Restaurant POS System update\_product.php unrestricted upload (CVSS 6.3, CodeAstro Restaurant POS System)
- [CVE-2024-1267](https://cve.now/CVE-2024-1267.md): CodeAstro Restaurant POS System create\_account.php cross site scripting (CVSS 3.5, CodeAstro Restaurant POS System)
- [CVE-2024-22022](https://cve.now/CVE-2024-22022.md): Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to access the NTLM hash (CVSS 8.8, Veeam Recovery Orchestrator · Veeam Availability Orchestrat…)
- [CVE-2024-22021](https://cve.now/CVE-2024-22021.md): Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Sco (CVSS 6.5, Veeam Recovery Orchestrator · Veeam Disaster Recovery Or… +1)
- [CVE-2024-1266](https://cve.now/CVE-2024-1266.md): CodeAstro University Management System Student Registration Form st\_reg.php cross site scripting (CVSS 2.4, CodeAstro University Management System)
- [CVE-2024-1265](https://cve.now/CVE-2024-1265.md): CodeAstro University Management System Attendance Management att\_add.php cross site scripting (CVSS 2.4, CodeAstro University Management System)
- [CVE-2023-38995](https://cve.now/CVE-2023-38995.md): An issue in SCHUHFRIED v.8.22.00 allows remote attacker to obtain the database password via crafted curl command. (CVSS 9.8)
- [CVE-2023-40355](https://cve.now/CVE-2023-40355.md): Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allo (CVSS 5.4)
- [CVE-2023-46914](https://cve.now/CVE-2023-46914.md): SQL Injection vulnerability in RM bookingcalendar module for PrestaShop versions 2.7.9 and before, allows remote attackers to execute arbitr (CVSS 9.8)
- [CVE-2024-23769](https://cve.now/CVE-2024-23769.md): Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 (for Windows) allows a local attacker to read privileged (CVSS 7.3)
- [CVE-2024-24019](https://cve.now/CVE-2024-24019.md): A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. (CVSS 9.8)
- [CVE-2024-24130](https://cve.now/CVE-2024-24130.md): Mail2World v12 Business Control Center was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Usr parameter (CVSS 6.1)
- [CVE-2024-24131](https://cve.now/CVE-2024-24131.md): SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php. (CVSS 6.1)
- [CVE-2024-24133](https://cve.now/CVE-2024-24133.md): Atmail v6.6.0 was discovered to contain a SQL injection vulnerability via the username parameter on the login page. (CVSS 9.8)
- [CVE-2024-24186](https://cve.now/CVE-2024-24186.md): Jsish v3.5.0 (commit 42c694c) was discovered to contain a stack-overflow via the component IterGetKeysCallback at /jsish/src/jsiValue.c. (CVSS 9.8)
- [CVE-2024-24188](https://cve.now/CVE-2024-24188.md): Jsish v3.5.0 was discovered to contain a heap-buffer-overflow in ./src/jsiUtils.c. (CVSS 9.8)
- [CVE-2024-24189](https://cve.now/CVE-2024-24189.md): Jsish v3.5.0 (commit 42c694c) was discovered to contain a use-after-free via the SplitChar at ./src/jsiUtils.c. (CVSS 9.8)
- [CVE-2024-24303](https://cve.now/CVE-2024-24303.md): SQL Injection vulnerability in HiPresta "Gift Wrapping Pro" (hiadvancedgiftwrapping) module for PrestaShop before version 1.4.1, allows remo (CVSS 9.8)
- [CVE-2024-24304](https://cve.now/CVE-2024-24304.md): In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical information without rest (CVSS 7.5)
- [CVE-2024-24311](https://cve.now/CVE-2024-24311.md): Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" (lgsitemaps) module for PrestaShop before vers (CVSS 7.5)
- [CVE-2024-24488](https://cve.now/CVE-2024-24488.md): An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password c (CVSS 5.5)
- [CVE-2024-25200](https://cve.now/CVE-2024-25200.md): Espruino 2v20 (commit fcc9ba4) was discovered to contain a Stack Overflow via the jspeFactorFunctionCall at src/jsparse.c. (CVSS 7.5)
- [CVE-2024-25201](https://cve.now/CVE-2024-25201.md): Espruino 2v20 (commit fcc9ba4) was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at src/jsvar.c. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.