CVEs published February 8, 2024
85 CVEs were published on February 8, 2024: 30 critical, 28 high.
- Published
- 85
- Critical
- 30
- High
- 28
- Medium
- 27
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Liferay Portal · Liferay DXP +2
- 4
- Mia Technology MİA-MED
- 4
- openobserve
- 2
- Snow Software Inventory Agent
- 2
- Acowebs Product Labels For Woocommerce
- 1
- Apache Software Foundation Apache bRPC
- 1
- Apollo13Themes Apollo13 Framework Extensions
- 1
- Audrasjb GDPR Data Request Form
- 1
- com.xuxueli:xxl-job
- 1
- composer · composer/composer
- 1
Critical 30
- CVE-2024-24825TokenManager not checking permissions on cached tokens in DIRACDIRACGrid DIRAC · dirac
- CVE-2024-24830OpenObserve Privilege Escalation Vulnerability in Users APIopenobserve
- CVE-2024-25106OpenObserve Unauthorized Access Vulnerability in Users APIopenobserve
- CVE-2024-1207Booking Calendar <= 9.9 - Unauthenticated SQL Injectionwpdevelop Booking Calendar
- CVE-2024-22394An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow SonicWall SonicOS
- CVE-2023-40266An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911.
- CVE-2023-42282The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally rip
- CVE-2023-47132An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls.
- CVE-2023-48974Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script
- CVE-2023-50061PrestaShop Op'art Easy Redirect >= 1.3.8 and <= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher().
- CVE-2024-22836An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier.
- CVE-2024-24003jshERP v3.3 is vulnerable to SQL Injection.
- CVE-2024-24014A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
- CVE-2024-24018A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
- CVE-2024-24021A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.
- CVE-2024-24023A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior.
- CVE-2024-24024An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDown
- CVE-2024-24025An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload().
- CVE-2024-24026An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController
- CVE-2024-24091Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface.
- CVE-2024-24202An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 al
- CVE-2024-24213Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query.
- CVE-2024-24216Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/m
- CVE-2024-24321An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_4
- CVE-2024-24393File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request.
- CVE-2024-24495SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafte
- CVE-2024-24496An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php,
- CVE-2024-25189libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing
- CVE-2024-25190l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing
- CVE-2024-25191php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing
High 28
- CVE-2024-24821Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composercomposer · composer/composer
- CVE-2023-51630Paessler PRTG Network Monitor Cross-Site Scripting Authentication Bypass VulnerabilityPaessler PRTG Network Monitor
- CVE-2024-0242Unauthorized access to settings in Qolsys IQ Panel 4 and IQ4 HubQolsys IQ Panel · Qolsys IQ4 Hub
- CVE-2024-1329Nomad Vulnerable to Arbitrary Write Through Symlink AttackHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2024-1150Improper validation of update packagesSnow Software Inventory Agent
- CVE-2024-24877WordPress Wonder Slider Lite Plugin <= 13.9 is vulnerable to Cross Site Scripting (XSS)Magic Hills Pty Wonder Slider Lite
- CVE-2024-1149Improper validation of update packagesSnow Software Inventory Agent
- CVE-2024-0985PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQLPostgreSQL
- CVE-2024-24878WordPress Portugal CTT Tracking for WooCommerce plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityMarco Almeida | Webdados Portugal CTT Tracking for WooComme…
- CVE-2024-24879WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Scripting (XSS)Yannick Lefebvre Link Library
- CVE-2023-6519Seeing admin password hash value in Mia Technology's Mia-MedMia Technology MİA-MED
- CVE-2023-6518Password Disclosure in Mia Technology's Mia-MedMia Technology MİA-MED
- CVE-2023-6517Seeing the SMS Verification Code in Mia Technology's Mia-MedMia Technology MİA-MED
- CVE-2024-24881WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)VeronaLabs WP SMS – Messaging & SMS Notification for WordPr…
- CVE-2023-6515IDOR in Mia Technology's Mia-MedMia Technology MİA-MED
- CVE-2024-23452Apache bRPC: HTTP request smuggling vulnerabilityApache Software Foundation Apache bRPC
- CVE-2023-25365Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3october/october
- CVE-2023-27001An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the J
- CVE-2023-40263An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11.
- CVE-2023-40265An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911.
- CVE-2023-47020Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through
- CVE-2023-47131The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file.
- CVE-2024-22795Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Rechec
- CVE-2024-23660The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and
- CVE-2024-23756The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execut
- CVE-2024-24017A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions.
- CVE-2024-24113xxl-job =< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE.com.xuxueli:xxl-job
- CVE-2024-24350File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extens
Medium, low and unrated 27
- CVE-2024-24829SSRF in Sentry via Phabricator integrationgetsentry sentry
- CVE-2024-25107Cross-Site Scripting in WikiDiscovermiraheze WikiDiscover
- CVE-2024-24834WordPress BEAR Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)realmag777 BEAR – Bulk Editor and Products Manager Professi…
- CVE-2024-24836WordPress GDPR Data Request Form Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)Audrasjb GDPR Data Request Form
- CVE-2024-24871WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerabilitycreativethemeshq Blocksy
- CVE-2023-7169Impersonate vendor signed Powershell scriptsSnow Software Snow Inventory Agent
- CVE-2024-1312Kernel: race condition leads to use after free during vma lock in lock_vma_under_rcukernel · Red Hat Enterprise Linux +1
- CVE-2024-24880WordPress Apollo13 Framework Extensions Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)Apollo13Themes Apollo13 Framework Extensions
- CVE-2023-6564Incorrect Authorization in GitLabGitLab
- CVE-2024-24885WordPress Woocommerce Vietnam Checkout Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)Lê Văn Toản Woocommerce Vietnam Checkout
- CVE-2024-24886WordPress Product Labels For Woocommerce Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)Acowebs Product Labels For Woocommerce
- CVE-2024-22464 Dell EMC AppSync, versions from 4.2.0.0 to 4.6.0.0 including all Service Pack releases, contain an exposure of sensitive information vulnerDell AppSync
- CVE-2024-0965Simple Page Access Restriction <= 1.0.21 - Improper Access Control to Sensitive Information Exposure via REST APIpluginsandsnippets Simple Page Access Restriction
- CVE-2024-0511Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_metawproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-25148In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, anLiferay Portal · Liferay DXP +2
- CVE-2024-25146Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and oLiferay Portal · Liferay DXP +2
- CVE-2023-5665Payment Forms for Paystack <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodekendysond Payment Forms for Paystack
- CVE-2024-25144The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 beforeLiferay Portal · Liferay DXP +2
- CVE-2023-47798Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsuLiferay Portal · Liferay DXP +2
- CVE-2023-40262An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11.
- CVE-2023-40264An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11.
- CVE-2023-49101WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mi
- CVE-2024-23764Certain WithSecure products allow Local Privilege Escalation.
- CVE-2024-24034Setor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary
- CVE-2024-24115A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute
- CVE-2024-24215An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information v
- CVE-2024-24494Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pr