# CVEs published 2024-02-08

85 CVEs were published on February 8, 2024: 30 critical, 28 high. Days are UTC.

- [CVE-2024-24821](https://cve.now/CVE-2024-24821.md): Code execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer (CVSS 8.8, composer · composer/composer)
- [CVE-2024-24829](https://cve.now/CVE-2024-24829.md): SSRF in Sentry via Phabricator integration (CVSS 4.3, getsentry sentry)
- [CVE-2024-24825](https://cve.now/CVE-2024-24825.md): TokenManager not checking permissions on cached tokens in DIRAC (CVSS 9.1, DIRACGrid DIRAC · dirac)
- [CVE-2024-24830](https://cve.now/CVE-2024-24830.md): OpenObserve Privilege Escalation Vulnerability in Users API (CVSS 10.0, openobserve)
- [CVE-2024-25106](https://cve.now/CVE-2024-25106.md): OpenObserve Unauthorized Access Vulnerability in Users API (CVSS 9.1, openobserve)
- [CVE-2024-25107](https://cve.now/CVE-2024-25107.md): Cross-Site Scripting in WikiDiscover (CVSS 4.9, miraheze WikiDiscover)
- [CVE-2023-51630](https://cve.now/CVE-2023-51630.md): Paessler PRTG Network Monitor Cross-Site Scripting Authentication Bypass Vulnerability (CVSS 8.8, Paessler PRTG Network Monitor)
- [CVE-2024-0242](https://cve.now/CVE-2024-0242.md): Unauthorized access to settings in Qolsys IQ Panel 4 and IQ4 Hub (CVSS 7.3, Qolsys IQ Panel · Qolsys IQ4 Hub)
- [CVE-2024-1329](https://cve.now/CVE-2024-1329.md): Nomad Vulnerable to Arbitrary Write Through Symlink Attack (CVSS 7.7, HashiCorp Nomad · github.com/hashicorp/nomad)
- [CVE-2024-24834](https://cve.now/CVE-2024-24834.md): WordPress BEAR Plugin \<= 1.1.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, realmag777 BEAR – Bulk Editor and Products Manager Professi…)
- [CVE-2024-24836](https://cve.now/CVE-2024-24836.md): WordPress GDPR Data Request Form Plugin \<= 1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Audrasjb GDPR Data Request Form)
- [CVE-2024-24871](https://cve.now/CVE-2024-24871.md): WordPress Blocksy theme \<= 2.0.19 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, creativethemeshq Blocksy)
- [CVE-2024-1150](https://cve.now/CVE-2024-1150.md): Improper validation of update packages (CVSS 7.8, Snow Software Inventory Agent)
- [CVE-2024-24877](https://cve.now/CVE-2024-24877.md): WordPress Wonder Slider Lite Plugin \<= 13.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Magic Hills Pty Wonder Slider Lite)
- [CVE-2024-1149](https://cve.now/CVE-2024-1149.md): Improper validation of update packages (CVSS 7.8, Snow Software Inventory Agent)
- [CVE-2024-0985](https://cve.now/CVE-2024-0985.md): PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL (CVSS 8.0, PostgreSQL)
- [CVE-2023-7169](https://cve.now/CVE-2023-7169.md): Impersonate vendor signed Powershell scripts (CVSS 6.0, Snow Software Snow Inventory Agent)
- [CVE-2024-24878](https://cve.now/CVE-2024-24878.md): WordPress Portugal CTT Tracking for WooCommerce plugin \<= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Marco Almeida | Webdados Portugal CTT Tracking for WooComme…)
- [CVE-2024-1312](https://cve.now/CVE-2024-1312.md): Kernel: race condition leads to use after free during vma lock in lock\_vma\_under\_rcu (CVSS 5.1, kernel · Red Hat Enterprise Linux +1)
- [CVE-2024-24879](https://cve.now/CVE-2024-24879.md): WordPress Link Library Plugin \<= 7.5.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Yannick Lefebvre Link Library)
- [CVE-2024-24880](https://cve.now/CVE-2024-24880.md): WordPress Apollo13 Framework Extensions Plugin \<= 1.9.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Apollo13Themes Apollo13 Framework Extensions)
- [CVE-2023-6519](https://cve.now/CVE-2023-6519.md): Seeing admin password hash value in Mia Technology's Mia-Med (CVSS 7.5, Mia Technology MİA-MED)
- [CVE-2023-6518](https://cve.now/CVE-2023-6518.md): Password Disclosure in Mia Technology's Mia-Med (CVSS 7.5, Mia Technology MİA-MED)
- [CVE-2023-6517](https://cve.now/CVE-2023-6517.md): Seeing the SMS Verification Code in Mia Technology's Mia-Med (CVSS 7.5, Mia Technology MİA-MED)
- [CVE-2023-6564](https://cve.now/CVE-2023-6564.md): Incorrect Authorization in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-24881](https://cve.now/CVE-2024-24881.md): WordPress WP SMS Plugin \<= 6.5.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, VeronaLabs WP SMS – Messaging & SMS Notification for WordPr…)
- [CVE-2024-24885](https://cve.now/CVE-2024-24885.md): WordPress Woocommerce Vietnam Checkout Plugin \<= 2.0.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Lê Văn Toản Woocommerce Vietnam Checkout)
- [CVE-2024-24886](https://cve.now/CVE-2024-24886.md): WordPress Product Labels For Woocommerce Plugin \<= 1.5.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Acowebs Product Labels For Woocommerce)
- [CVE-2023-6515](https://cve.now/CVE-2023-6515.md): IDOR in Mia Technology's Mia-Med (CVSS 8.8, Mia Technology MİA-MED)
- [CVE-2024-22464](https://cve.now/CVE-2024-22464.md): Dell EMC AppSync, versions from 4.2.0.0 to 4.6.0.0 including all Service Pack releases, contain an exposure of sensitive information vulner (CVSS 6.2, Dell AppSync)
- [CVE-2024-23452](https://cve.now/CVE-2024-23452.md): Apache bRPC: HTTP request smuggling vulnerability (CVSS 7.5, Apache Software Foundation Apache bRPC)
- [CVE-2024-0965](https://cve.now/CVE-2024-0965.md): Simple Page Access Restriction \<= 1.0.21 - Improper Access Control to Sensitive Information Exposure via REST API (CVSS 5.3, pluginsandsnippets Simple Page Access Restriction)
- [CVE-2024-1207](https://cve.now/CVE-2024-1207.md): Booking Calendar \<= 9.9 - Unauthenticated SQL Injection (CVSS 9.8, wpdevelop Booking Calendar)
- [CVE-2024-0511](https://cve.now/CVE-2024-0511.md): Royal Elementor Addons and Templates \<= 1.3.87 - Cross-Site Request Forgery via wpr\_update\_form\_action\_meta (CVSS 4.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2024-25148](https://cve.now/CVE-2024-25148.md): In Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, an (CVSS 5.4, Liferay Portal · Liferay DXP +2)
- [CVE-2024-25146](https://cve.now/CVE-2024-25146.md): Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 18, and o (CVSS 5.3, Liferay Portal · Liferay DXP +2)
- [CVE-2023-5665](https://cve.now/CVE-2023-5665.md): Payment Forms for Paystack \<= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, kendysond Payment Forms for Paystack)
- [CVE-2024-25144](https://cve.now/CVE-2024-25144.md): The IFrame widget in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 27, 7.3 before (CVSS 4.1, Liferay Portal · Liferay DXP +2)
- [CVE-2023-47798](https://cve.now/CVE-2023-47798.md): Account lockout in Liferay Portal 7.2.0 through 7.3.0, and older unsupported versions, and Liferay DXP 7.2 before fix pack 5, and older unsu (CVSS 5.4, Liferay Portal · Liferay DXP +2)
- [CVE-2024-22394](https://cve.now/CVE-2024-22394.md): An improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature, which in specific conditions could allow (CVSS 9.8, SonicWall SonicOS)
- [CVE-2023-25365](https://cve.now/CVE-2023-25365.md): Cross Site Scripting vulnerability found in October CMS v.3.2.0 allows local attacker to execute arbitrary code via the file type .mp3 (CVSS 7.8, october/october)
- [CVE-2023-27001](https://cve.now/CVE-2023-27001.md): An issue discovered in Egerie Risk Manager v4.0.5 allows attackers to bypass the signature mechanism and tamper with the values inside the J (CVSS 8.8)
- [CVE-2023-40262](https://cve.now/CVE-2023-40262.md): An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. (CVSS 6.1)
- [CVE-2023-40263](https://cve.now/CVE-2023-40263.md): An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. (CVSS 8.8)
- [CVE-2023-40264](https://cve.now/CVE-2023-40264.md): An issue was discovered in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. (CVSS 4.3)
- [CVE-2023-40265](https://cve.now/CVE-2023-40265.md): An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. (CVSS 8.8)
- [CVE-2023-40266](https://cve.now/CVE-2023-40266.md): An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. (CVSS 9.8)
- [CVE-2023-42282](https://cve.now/CVE-2023-42282.md): The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally r (CVSS 9.8, ip)
- [CVE-2023-47020](https://cve.now/CVE-2023-47020.md): Multiple Cross-Site Request Forgery (CSRF) chaining in NCR Terminal Handler v.1.5.1 allows privileges to be escalated by an attacker through (CVSS 8.8)
- [CVE-2023-47131](https://cve.now/CVE-2023-47131.md): The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file. (CVSS 7.5)
- [CVE-2023-47132](https://cve.now/CVE-2023-47132.md): An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls. (CVSS 9.8)
- [CVE-2023-48974](https://cve.now/CVE-2023-48974.md): Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script (CVSS 9.6)
- [CVE-2023-49101](https://cve.now/CVE-2023-49101.md): WebAdmin in Axigen 10.3.x before 10.3.3.61, 10.4.x before 10.4.24, and 10.5.x before 10.5.10 allows XSS attacks against admins because of mi (CVSS 6.1)
- [CVE-2023-50061](https://cve.now/CVE-2023-50061.md): PrestaShop Op'art Easy Redirect \>= 1.3.8 and \<= 1.3.12 is vulnerable to SQL Injection via Oparteasyredirect::hookActionDispatcher(). (CVSS 9.8)
- [CVE-2024-22795](https://cve.now/CVE-2024-22795.md): Insecure Permissions vulnerability in Forescout SecureConnector v.11.3.06.0063 allows a local attacker to escalate privileges via the Rechec (CVSS 7.0)
- [CVE-2024-22836](https://cve.now/CVE-2024-22836.md): An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier. (CVSS 9.8)
- [CVE-2024-23660](https://cve.now/CVE-2024-23660.md): The Binance Trust Wallet app for iOS in commit 3cd6e8f647fbba8b5d8844fcd144365a086b629f, git tag 0.0.4 misuses the trezor-crypto library and (CVSS 7.5)
- [CVE-2024-23756](https://cve.now/CVE-2024-23756.md): The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execut (CVSS 7.5)
- [CVE-2024-23764](https://cve.now/CVE-2024-23764.md): Certain WithSecure products allow Local Privilege Escalation. (CVSS 6.7)
- [CVE-2024-24003](https://cve.now/CVE-2024-24003.md): jshERP v3.3 is vulnerable to SQL Injection. (CVSS 9.8)
- [CVE-2024-24014](https://cve.now/CVE-2024-24014.md): A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. (CVSS 9.8)
- [CVE-2024-24017](https://cve.now/CVE-2024-24017.md): A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. (CVSS 7.5)
- [CVE-2024-24018](https://cve.now/CVE-2024-24018.md): A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions. (CVSS 9.8)
- [CVE-2024-24021](https://cve.now/CVE-2024-24021.md): A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. (CVSS 9.8)
- [CVE-2024-24023](https://cve.now/CVE-2024-24023.md): A SQL injection vulnerability exists in Novel-Plus v4.3.0-RC1 and prior. (CVSS 9.8)
- [CVE-2024-24024](https://cve.now/CVE-2024-24024.md): An arbitrary File download vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: fileDown (CVSS 9.8)
- [CVE-2024-24025](https://cve.now/CVE-2024-24025.md): An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior at com.java2nb.common.controller.FileController: upload(). (CVSS 9.8)
- [CVE-2024-24026](https://cve.now/CVE-2024-24026.md): An arbitrary File upload vulnerability exists in Novel-Plus v4.3.0-RC1 and prior versions at com.java2nb.system.controller.SysUserController (CVSS 9.8)
- [CVE-2024-24034](https://cve.now/CVE-2024-24034.md): Setor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary (CVSS 6.1)
- [CVE-2024-24091](https://cve.now/CVE-2024-24091.md): Yealink Meeting Server before v26.0.0.66 was discovered to contain an OS command injection vulnerability via the file upload interface. (CVSS 9.8)
- [CVE-2024-24113](https://cve.now/CVE-2024-24113.md): xxl-job =\< 2.4.1 has a Server-Side Request Forgery (SSRF) vulnerability, which causes low-privileged users to control executor to RCE. (CVSS 8.8, com.xuxueli:xxl-job)
- [CVE-2024-24115](https://cve.now/CVE-2024-24115.md): A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti CMS v0.9.24 allows authenticated attackers to execute (CVSS 5.4)
- [CVE-2024-24202](https://cve.now/CVE-2024-24202.md): An arbitrary file upload vulnerability in /upgrade/control.php of ZenTao Community Edition v18.10, ZenTao Biz v8.10, and ZenTao Max v4.10 al (CVSS 9.8)
- [CVE-2024-24213](https://cve.now/CVE-2024-24213.md): Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg\_meta/default/query. (CVSS 9.8)
- [CVE-2024-24215](https://cve.now/CVE-2024-24215.md): An issue in the component /cgi-bin/GetJsonValue.cgi of Cellinx NVT Web Server 5.0.0.014 allows attackers to leak configuration information v (CVSS 5.3)
- [CVE-2024-24216](https://cve.now/CVE-2024-24216.md): Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/m (CVSS 9.8)
- [CVE-2024-24321](https://cve.now/CVE-2024-24321.md): An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4\_ssid\_2 parameter in the sub\_4 (CVSS 9.8)
- [CVE-2024-24350](https://cve.now/CVE-2024-24350.md): File Upload vulnerability in Software Publico e-Sic Livre v.2.0 and before allows a remote attacker to execute arbitrary code via the extens (CVSS 8.8)
- [CVE-2024-24393](https://cve.now/CVE-2024-24393.md): File Upload vulnerability index.php in Pichome v.1.1.01 allows a remote attacker to execute arbitrary code via crafted POST request. (CVSS 9.8)
- [CVE-2024-24494](https://cve.now/CVE-2024-24494.md): Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pr (CVSS 6.1)
- [CVE-2024-24495](https://cve.now/CVE-2024-24495.md): SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafte (CVSS 9.8)
- [CVE-2024-24496](https://cve.now/CVE-2024-24496.md): An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php, (CVSS 9.8)
- [CVE-2024-25189](https://cve.now/CVE-2024-25189.md): libjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing (CVSS 9.8)
- [CVE-2024-25190](https://cve.now/CVE-2024-25190.md): l8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing (CVSS 9.8)
- [CVE-2024-25191](https://cve.now/CVE-2024-25191.md): php-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it easier to bypass authentication via a timing (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.