CVEs published February 9, 2024
85 CVEs were published on February 9, 2024: 13 critical, 34 high. 1 is now in CISA KEV.
- Published
- 85
- Critical
- 13
- High
- 34
- Medium
- 30
- Low
- 8
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 23
Most affected products
- envoyproxy envoy
- 5
- Emerson Rosemount GC370XA · Emerson Rosemount GC700XA +1
- 4
- Apache Software Foundation Apache Solr · org.apache.solr:so…
- 3
- Concrete CMS · concrete5/concrete5
- 3
- HCL Software HCL Sametime
- 3
- IBM Engineering Lifecycle Optimization - Publishing
- 3
- IBM Sterling B2B Integrator
- 2
- Mattermost · github.com/mattermost/mattermost-plugin-jira
- 2
- Mattermost · github.com/mattermost/mattermost/server/v8 +3
- 2
- Apache Software Foundation Apache Solr · org.apache.solr… +1
- 1
Critical 13
- CVE-2023-6677SQLi in Oduyo Online Collection SoftwareOduyo Financial Technology Online Collection
- CVE-2024-21762A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, FortFortinet FortiOS · Fortinet FortiProxy
- CVE-2023-46687Emerson Rosemount GC370XA, GC700XA, GC1500XA Command InjectionEmerson Rosemount GC370XA · Emerson Rosemount GC700XA +1
- CVE-2023-46350SQL injection vulnerability in InnovaDeluxe "Manufacturer or supplier alphabetical search" (idxrmanufacturer) module for PrestaShop versions
- CVE-2023-50026SQL injection vulnerability in Presta Monster "Multi Accessories Pro" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and befor
- CVE-2024-24308SQL Injection vulnerability in Boostmyshop (boostmyshopagent) module for Prestashop versions 1.1.9 and before, allows remote attackers to es
- CVE-2024-25302Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter.
- CVE-2024-25307Code-projects Cinema Seat Reservation System 1.0 allows SQL Injection via the 'id' parameter at "/Cinema-Reservation/booking.php?id=1."
- CVE-2024-25314Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'sid' parameter in Hotel/admin/show.php?sid=2.
- CVE-2024-25315Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2.
- CVE-2024-25316Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'eid' parameter in Hotel/admin/usersettingdel.php?eid=2.
- CVE-2024-25674An issue was discovered in MISP before 2.4.184.
- CVE-2024-25675An issue was discovered in MISP before 2.4.184.
High 34
- CVE-2024-23322Envoy crashes when idle and request per try timeout occur within the backoff intervalenvoyproxy envoy
- CVE-2024-23324Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadataenvoyproxy envoy
- CVE-2024-23325Envoy crashes when using an address type that isn’t supported by the OSenvoyproxy envoy
- CVE-2024-23327Crash in proxy protocol when command type of LOCAL in Envoyenvoyproxy envoy
- CVE-2023-50291Apache Solr: System Property redaction logic inconsistency can lead to leaked passwordsApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2023-50292Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated usersApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2023-50298Apache Solr: Solr can expose ZooKeeper credentials via Streaming ExpressionsApache Software Foundation Apache Solr · org.apache.solr… +1
- CVE-2023-50386Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsApache Software Foundation Apache Solr · org.apache.solr:so…
- CVE-2023-6724IDOR in Simgesel Software's Hearing Tracking System (Barosel)Software Engineering Consultancy Machine Equipment Limited…
- CVE-2024-0229Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory accessxorg-server · Red Hat Enterprise Linux 6 Extended Lifecy… +1
- CVE-2024-0842Backuply - Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of Servicesoftaculous Backuply – Backup, Restore, Migrate and Clone
- CVE-2023-51761Emerson Rosemount GC370XA, GC700XA, GC1500XA Improper AuthenticationEmerson Rosemount GC370XA · Emerson Rosemount GC700XA +1
- CVE-2023-45191IBM Engineering Lifecycle Optimization information disclosureIBM Engineering Lifecycle Optimization - Publishing
- CVE-2024-24820Icinga Director configuration is susceptible to Cross-Site Request Forgeryicingaweb2-module-director
- CVE-2024-23749KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitizat
- CVE-2024-25003KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds check
- CVE-2024-25004KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds check
- CVE-2024-25304Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'apass' parameter at "School/index.php."
- CVE-2024-25305Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php.
- CVE-2024-25306Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'aname' parameter at "School/index.php".
- CVE-2024-25308Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'name' parameter at School/teacher_login.php.
- CVE-2024-25309Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'pass' parameter at School/teacher_login.php.
- CVE-2024-25310Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'id' parameter at "School/delete.php?id=5."
- CVE-2024-25312Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'id' parameter at "School/sub_delete.php?id=5."
- CVE-2024-25313Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/teacher_log
- CVE-2024-25318Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'pid' parameter in Hotel/admin/print.php?pid=2.
- CVE-2024-25442An issue in the HuginBase::PanoramaMemento::loadPTScript function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via pa
- CVE-2024-25443An issue in the HuginBase::ImageVariable<double>::linkWith function of Hugin v2022.0.0 allows attackers to cause a heap-use-after-free via p
- CVE-2024-25445Improper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure.
- CVE-2024-25446An issue in the HuginBase::PTools::setDestImage function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a c
- CVE-2024-25447An issue in the imlib_load_image_with_error_return function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a
- CVE-2024-25448An issue in the imlib_free_image_and_decache function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafte
- CVE-2024-25450imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init_imlib_fonts().
- CVE-2024-25677In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin
Medium, low and unrated 38
- CVE-2024-23323Excessive CPU usage when URI template matcher is configured using regex in Envoyenvoyproxy envoy
- CVE-2024-1404Linksys WRT54GL Web Management Interface SysInfo.htm information disclosureLinksys WRT54GL
- CVE-2024-25109Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWikimiraheze ManageWiki
- CVE-2023-6935Marvin Attack vulnerability in SP Math All RSAwolfSSL
- CVE-2024-24828Local Privilege Escalation in execuatables bundled by pkgvercel pkg · pkg
- CVE-2024-21624Potential Information Leak in User-Constructed Message Templates in nonebot2nonebot2
- CVE-2023-45718HCL Sametime is impacted by a failure to invalidate sessionsHCL Software HCL Sametime
- CVE-2023-45716HCL Sametime is impacted by a sensitive information disclosureHCL Software HCL Sametime
- CVE-2023-50349HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerabilityHCL Software HCL Sametime
- CVE-2024-1245Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributesConcrete CMS · concrete5/concrete5
- CVE-2024-1246Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import FeatureConcrete CMS · concrete5/concrete5
- CVE-2024-1247Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name fieldConcrete CMS · concrete5/concrete5
- CVE-2024-1402Denial of service in mattermost mobile apps and server via emoji reactionsMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-24776 Incorrect Authorization leads to Channel Member Count LeakMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-24774Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)Mattermost · github.com/mattermost/mattermost-plugin-jira
- CVE-2024-23319CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)Mattermost · github.com/mattermost/mattermost-plugin-jira
- CVE-2024-22119Stored XSS in graph items select formZabbix
- CVE-2024-0657Internal Link Juicer <= 2.23.4 - Authenticated (Admin+) Stored Cross-Site Scriptingdavidanderson Internal Link Juicer: SEO Auto Linker for Wor…
- CVE-2024-1122Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Exportarraytics Eventin – Event Calendar, Event Registration, Tic…
- CVE-2023-43609Emerson Rosemount GC370XA, GC700XA, GC1500XA Improper AuthorizationEmerson Rosemount GC370XA · Emerson Rosemount GC700XA +1
- CVE-2023-49716Emerson Rosemount GC370XA, GC700XA, GC1500XA Command InjectionEmerson Rosemount GC370XA · Emerson Rosemount GC700XA +1
- CVE-2023-42016IBM Sterling B2B Integrator information disclosureIBM Sterling B2B Integrator
- CVE-2023-32341IBM Sterling B2B Integrator denial of serviceIBM Sterling B2B Integrator
- CVE-2024-22332IBM Integration Bus for z/OS denial of serviceIBM Integration Bus for z/OS
- CVE-2023-45190IBM Engineering Lifecycle Optimization HTTP header injectionIBM Engineering Lifecycle Optimization - Publishing
- CVE-2024-1353PHPEMS index.api.php index deserializationPHPEMS
- CVE-2023-45187IBM Engineering Lifecycle Optimization - Publishing session fixationIBM Engineering Lifecycle Optimization - Publishing
- CVE-2024-22318IBM i Access Client Solutions information disclosureIBM i Access Client Solutions
- CVE-2024-23639micronaut-core management endpoints vulnerable to drive-by localhost attackmicronaut-projects micronaut-core · io.micronaut:microna… +2
- CVE-2024-24819icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRFicingaweb2-module-incubator
- CVE-2023-31506A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary wegetgrav/grav
- CVE-2023-39683Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user inp
- CVE-2024-25451Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_DataBuffer::ReallocateBuffer() function.
- CVE-2024-25452Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4_UrlAtom::AP4_UrlAtom() function.
- CVE-2024-25453Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_StszAtom::GetSampleSize() function.
- CVE-2024-25454Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4_DescriptorFinder::Test() function.
- CVE-2024-25678In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled.
- CVE-2024-25679In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by se