# CVEs published 2024-02-09

85 CVEs were published on February 9, 2024: 13 critical, 34 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-23322](https://cve.now/CVE-2024-23322.md): Envoy crashes when idle and request per try timeout occur within the backoff interval (CVSS 7.5, envoyproxy envoy)
- [CVE-2024-23323](https://cve.now/CVE-2024-23323.md): Excessive CPU usage when URI template matcher is configured using regex in Envoy (CVSS 4.3, envoyproxy envoy)
- [CVE-2024-23324](https://cve.now/CVE-2024-23324.md): Envoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata (CVSS 8.6, envoyproxy envoy)
- [CVE-2024-23325](https://cve.now/CVE-2024-23325.md): Envoy crashes when using an address type that isn’t supported by the OS (CVSS 7.5, envoyproxy envoy)
- [CVE-2024-23327](https://cve.now/CVE-2024-23327.md): Crash in proxy protocol when command type of LOCAL in Envoy (CVSS 7.5, envoyproxy envoy)
- [CVE-2024-1404](https://cve.now/CVE-2024-1404.md): Linksys WRT54GL Web Management Interface SysInfo.htm information disclosure (CVSS 4.3, Linksys WRT54GL)
- [CVE-2024-25109](https://cve.now/CVE-2024-25109.md): Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki (CVSS 6.5, miraheze ManageWiki)
- [CVE-2023-6935](https://cve.now/CVE-2023-6935.md): Marvin Attack vulnerability in SP Math All RSA (CVSS 5.9, wolfSSL)
- [CVE-2024-24828](https://cve.now/CVE-2024-24828.md): Local Privilege Escalation in execuatables bundled by pkg (CVSS 6.6, vercel pkg · pkg)
- [CVE-2024-21624](https://cve.now/CVE-2024-21624.md): Potential Information Leak in User-Constructed Message Templates in nonebot2 (CVSS 5.7, nonebot2)
- [CVE-2023-45718](https://cve.now/CVE-2023-45718.md): HCL Sametime is impacted by a failure to invalidate sessions (CVSS 3.9, HCL Software HCL Sametime)
- [CVE-2023-45716](https://cve.now/CVE-2023-45716.md): HCL Sametime is impacted by a sensitive information disclosure (CVSS 1.7, HCL Software HCL Sametime)
- [CVE-2023-50349](https://cve.now/CVE-2023-50349.md): HCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability (CVSS 5.9, HCL Software HCL Sametime)
- [CVE-2024-1245](https://cve.now/CVE-2024-1245.md): Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes (CVSS 2.4, Concrete CMS · concrete5/concrete5)
- [CVE-2024-1246](https://cve.now/CVE-2024-1246.md): Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature (CVSS 2.0, Concrete CMS · concrete5/concrete5)
- [CVE-2024-1247](https://cve.now/CVE-2024-1247.md): Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field (CVSS 2.0, Concrete CMS · concrete5/concrete5)
- [CVE-2023-50291](https://cve.now/CVE-2023-50291.md): Apache Solr: System Property redaction logic inconsistency can lead to leaked passwords (CVSS 7.5, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2023-50292](https://cve.now/CVE-2023-50292.md): Apache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users (CVSS 7.5, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2023-50298](https://cve.now/CVE-2023-50298.md): Apache Solr: Solr can expose ZooKeeper credentials via Streaming Expressions (CVSS 7.5, Apache Software Foundation Apache Solr · org.apache.solr… +1)
- [CVE-2023-50386](https://cve.now/CVE-2023-50386.md): Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets (CVSS 8.8, Apache Software Foundation Apache Solr · org.apache.solr:so…)
- [CVE-2024-1402](https://cve.now/CVE-2024-1402.md): Denial of service in mattermost mobile apps and server via emoji reactions (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-24776](https://cve.now/CVE-2024-24776.md): Incorrect Authorization leads to Channel Member Count Leak (CVSS 3.1, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-24774](https://cve.now/CVE-2024-24774.md): Missing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin) (CVSS 3.4, Mattermost · github.com/mattermost/mattermost-plugin-jira)
- [CVE-2024-23319](https://cve.now/CVE-2024-23319.md): CSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin) (CVSS 3.5, Mattermost · github.com/mattermost/mattermost-plugin-jira)
- [CVE-2023-6677](https://cve.now/CVE-2023-6677.md): SQLi in Oduyo Online Collection Software (CVSS 9.8, Oduyo Financial Technology Online Collection)
- [CVE-2023-6724](https://cve.now/CVE-2023-6724.md): IDOR in Simgesel Software's Hearing Tracking System (Barosel) (CVSS 8.8, Software Engineering Consultancy Machine Equipment Limited…)
- [CVE-2024-22119](https://cve.now/CVE-2024-22119.md): Stored XSS in graph items select form (CVSS 5.5, Zabbix)
- [CVE-2024-21762](https://cve.now/CVE-2024-21762.md): A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.2, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through 7.0.13, Fort (CVSS 9.6, KEV, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2024-0229](https://cve.now/CVE-2024-0229.md): Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access (CVSS 7.8, xorg-server · Red Hat Enterprise Linux 6 Extended Lifecy… +1)
- [CVE-2024-0657](https://cve.now/CVE-2024-0657.md): Internal Link Juicer \<= 2.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, davidanderson Internal Link Juicer: SEO Auto Linker for Wor…)
- [CVE-2024-0842](https://cve.now/CVE-2024-0842.md): Backuply - Backup, Restore, Migrate and Clone \<= 1.2.6 - Denial of Service (CVSS 7.5, softaculous Backuply – Backup, Restore, Migrate and Clone)
- [CVE-2024-1122](https://cve.now/CVE-2024-1122.md): Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin \<= 3.3.50 - Missing Authorization to Unauthenticated Events Export (CVSS 5.3, arraytics Eventin – Event Calendar, Event Registration, Tic…)
- [CVE-2023-43609](https://cve.now/CVE-2023-43609.md): Emerson Rosemount GC370XA, GC700XA, GC1500XA Improper Authorization (CVSS 6.9, Emerson Rosemount GC370XA · Emerson Rosemount GC700XA +1)
- [CVE-2023-46687](https://cve.now/CVE-2023-46687.md): Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection (CVSS 9.8, Emerson Rosemount GC370XA · Emerson Rosemount GC700XA +1)
- [CVE-2023-49716](https://cve.now/CVE-2023-49716.md): Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection (CVSS 6.9, Emerson Rosemount GC370XA · Emerson Rosemount GC700XA +1)
- [CVE-2023-51761](https://cve.now/CVE-2023-51761.md): Emerson Rosemount GC370XA, GC700XA, GC1500XA Improper Authentication (CVSS 8.3, Emerson Rosemount GC370XA · Emerson Rosemount GC700XA +1)
- [CVE-2023-42016](https://cve.now/CVE-2023-42016.md): IBM Sterling B2B Integrator information disclosure (CVSS 4.3, IBM Sterling B2B Integrator)
- [CVE-2023-32341](https://cve.now/CVE-2023-32341.md): IBM Sterling B2B Integrator denial of service (CVSS 6.5, IBM Sterling B2B Integrator)
- [CVE-2024-22332](https://cve.now/CVE-2024-22332.md): IBM Integration Bus for z/OS denial of service (CVSS 6.5, IBM Integration Bus for z/OS)
- [CVE-2023-45191](https://cve.now/CVE-2023-45191.md): IBM Engineering Lifecycle Optimization information disclosure (CVSS 7.5, IBM Engineering Lifecycle Optimization - Publishing)
- [CVE-2023-45190](https://cve.now/CVE-2023-45190.md): IBM Engineering Lifecycle Optimization HTTP header injection (CVSS 5.1, IBM Engineering Lifecycle Optimization - Publishing)
- [CVE-2024-1353](https://cve.now/CVE-2024-1353.md): PHPEMS index.api.php index deserialization (CVSS 6.3, PHPEMS)
- [CVE-2023-45187](https://cve.now/CVE-2023-45187.md): IBM Engineering Lifecycle Optimization - Publishing session fixation (CVSS 6.3, IBM Engineering Lifecycle Optimization - Publishing)
- [CVE-2024-22318](https://cve.now/CVE-2024-22318.md): IBM i Access Client Solutions information disclosure (CVSS 5.1, IBM i Access Client Solutions)
- [CVE-2024-23639](https://cve.now/CVE-2024-23639.md): micronaut-core management endpoints vulnerable to drive-by localhost attack (CVSS 5.1, micronaut-projects micronaut-core · io.micronaut:microna… +2)
- [CVE-2024-24819](https://cve.now/CVE-2024-24819.md): icingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF (CVSS 5.3, icingaweb2-module-incubator)
- [CVE-2024-24820](https://cve.now/CVE-2024-24820.md): Icinga Director configuration is susceptible to Cross-Site Request Forgery (CVSS 8.3, icingaweb2-module-director)
- [CVE-2023-31506](https://cve.now/CVE-2023-31506.md): A cross-site scripting (XSS) vulnerability in Grav versions 1.7.44 and before, allows remote authenticated attackers to execute arbitrary we (CVSS 5.4, getgrav/grav)
- [CVE-2023-39683](https://cve.now/CVE-2023-39683.md): Cross Site Scripting (XSS) vulnerability in EasyEmail v.4.12.2 and before allows a local attacker to execute arbitrary code via the user inp (CVSS 6.1)
- [CVE-2023-46350](https://cve.now/CVE-2023-46350.md): SQL injection vulnerability in InnovaDeluxe "Manufacturer or supplier alphabetical search" (idxrmanufacturer) module for PrestaShop versions (CVSS 9.8)
- [CVE-2023-50026](https://cve.now/CVE-2023-50026.md): SQL injection vulnerability in Presta Monster "Multi Accessories Pro" (hsmultiaccessoriespro) module for PrestaShop versions 5.1.1 and befor (CVSS 9.8)
- [CVE-2024-23749](https://cve.now/CVE-2024-23749.md): KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitizat (CVSS 7.8)
- [CVE-2024-24308](https://cve.now/CVE-2024-24308.md): SQL Injection vulnerability in Boostmyshop (boostmyshopagent) module for Prestashop versions 1.1.9 and before, allows remote attackers to es (CVSS 9.8)
- [CVE-2024-25003](https://cve.now/CVE-2024-25003.md): KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds check (CVSS 7.8)
- [CVE-2024-25004](https://cve.now/CVE-2024-25004.md): KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds check (CVSS 7.8)
- [CVE-2024-25302](https://cve.now/CVE-2024-25302.md): Sourcecodester Event Student Attendance System 1.0, allows SQL Injection via the 'student' parameter. (CVSS 9.8)
- [CVE-2024-25304](https://cve.now/CVE-2024-25304.md): Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'apass' parameter at "School/index.php." (CVSS 8.8)
- [CVE-2024-25305](https://cve.now/CVE-2024-25305.md): Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/index.php. (CVSS 8.8)
- [CVE-2024-25306](https://cve.now/CVE-2024-25306.md): Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'aname' parameter at "School/index.php". (CVSS 8.8)
- [CVE-2024-25307](https://cve.now/CVE-2024-25307.md): Code-projects Cinema Seat Reservation System 1.0 allows SQL Injection via the 'id' parameter at "/Cinema-Reservation/booking.php?id=1." (CVSS 9.8)
- [CVE-2024-25308](https://cve.now/CVE-2024-25308.md): Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'name' parameter at School/teacher\_login.php. (CVSS 8.8)
- [CVE-2024-25309](https://cve.now/CVE-2024-25309.md): Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'pass' parameter at School/teacher\_login.php. (CVSS 8.8)
- [CVE-2024-25310](https://cve.now/CVE-2024-25310.md): Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'id' parameter at "School/delete.php?id=5." (CVSS 8.8)
- [CVE-2024-25312](https://cve.now/CVE-2024-25312.md): Code-projects Simple School Managment System 1.0 allows SQL Injection via the 'id' parameter at "School/sub\_delete.php?id=5." (CVSS 8.8)
- [CVE-2024-25313](https://cve.now/CVE-2024-25313.md): Code-projects Simple School Managment System 1.0 allows Authentication Bypass via the username and password parameters at School/teacher\_log (CVSS 8.8)
- [CVE-2024-25314](https://cve.now/CVE-2024-25314.md): Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'sid' parameter in Hotel/admin/show.php?sid=2. (CVSS 9.8)
- [CVE-2024-25315](https://cve.now/CVE-2024-25315.md): Code-projects Hotel Managment System 1.0, allows SQL Injection via the 'rid' parameter in Hotel/admin/roombook.php?rid=2. (CVSS 9.8)
- [CVE-2024-25316](https://cve.now/CVE-2024-25316.md): Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'eid' parameter in Hotel/admin/usersettingdel.php?eid=2. (CVSS 9.8)
- [CVE-2024-25318](https://cve.now/CVE-2024-25318.md): Code-projects Hotel Managment System 1.0 allows SQL Injection via the 'pid' parameter in Hotel/admin/print.php?pid=2. (CVSS 8.8)
- [CVE-2024-25442](https://cve.now/CVE-2024-25442.md): An issue in the HuginBase::PanoramaMemento::loadPTScript function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via pa (CVSS 7.8)
- [CVE-2024-25443](https://cve.now/CVE-2024-25443.md): An issue in the HuginBase::ImageVariable\<double\>::linkWith function of Hugin v2022.0.0 allows attackers to cause a heap-use-after-free via p (CVSS 7.8)
- [CVE-2024-25445](https://cve.now/CVE-2024-25445.md): Improper handling of values in HuginBase::PTools::Transform::transform of Hugin 2022.0.0 leads to an assertion failure. (CVSS 7.8)
- [CVE-2024-25446](https://cve.now/CVE-2024-25446.md): An issue in the HuginBase::PTools::setDestImage function of Hugin v2022.0.0 allows attackers to cause a heap buffer overflow via parsing a c (CVSS 7.8)
- [CVE-2024-25447](https://cve.now/CVE-2024-25447.md): An issue in the imlib\_load\_image\_with\_error\_return function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a (CVSS 8.8)
- [CVE-2024-25448](https://cve.now/CVE-2024-25448.md): An issue in the imlib\_free\_image\_and\_decache function of imlib2 v1.9.1 allows attackers to cause a heap buffer overflow via parsing a crafte (CVSS 8.8)
- [CVE-2024-25450](https://cve.now/CVE-2024-25450.md): imlib2 v1.9.1 was discovered to mishandle memory allocation in the function init\_imlib\_fonts(). (CVSS 8.8)
- [CVE-2024-25451](https://cve.now/CVE-2024-25451.md): Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4\_DataBuffer::ReallocateBuffer() function. (CVSS 6.5)
- [CVE-2024-25452](https://cve.now/CVE-2024-25452.md): Bento4 v1.6.0-640 was discovered to contain an out-of-memory bug via the AP4\_UrlAtom::AP4\_UrlAtom() function. (CVSS 5.5)
- [CVE-2024-25453](https://cve.now/CVE-2024-25453.md): Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4\_StszAtom::GetSampleSize() function. (CVSS 5.5)
- [CVE-2024-25454](https://cve.now/CVE-2024-25454.md): Bento4 v1.6.0-640 was discovered to contain a NULL pointer dereference via the AP4\_DescriptorFinder::Test() function. (CVSS 5.5)
- [CVE-2024-25674](https://cve.now/CVE-2024-25674.md): An issue was discovered in MISP before 2.4.184. (CVSS 9.8)
- [CVE-2024-25675](https://cve.now/CVE-2024-25675.md): An issue was discovered in MISP before 2.4.184. (CVSS 9.8)
- [CVE-2024-25677](https://cve.now/CVE-2024-25677.md): In Min before 1.31.0, local files are not correctly treated as unique security origins, which allows them to improperly request cross-origin (CVSS 8.8)
- [CVE-2024-25678](https://cve.now/CVE-2024-25678.md): In LiteSpeed QUIC (LSQUIC) Library before 4.0.4, DCID validation is mishandled. (CVSS 5.9)
- [CVE-2024-25679](https://cve.now/CVE-2024-25679.md): In PQUIC before 5bde5bb, retention of unused initial encryption keys allows attackers to disrupt a connection with a PSK configuration by se (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.