CVEs published February 11, 2024
20 CVEs were published on February 11, 2024: 3 critical, 7 high.
- Published
- 20
- Critical
- 3
- High
- 7
- Medium
- 7
- Low
- 1
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Netgear R7000
- 2
- Badge.team Hacker Hotel Badge
- 1
- com.nimbusds:nimbus-jose-jwt
- 1
- DeepFaceLab
- 1
- diffoscope
- 1
- ghost
- 1
- github.com/swaggo/http-swagger
- 1
- KDE Plasma Workspace
- 1
- Red Hat Enterprise Linux
- 1
Critical 3
- CVE-2024-25714In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops
- CVE-2024-25718In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get_assertion/3 can return an expired session, which interferes with access
- CVE-2024-25722qanything_kernel/connector/database/mysql/mysql_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection.
High 7
- CVE-2023-52428In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header valcom.nimbusds:nimbus-jose-jwt
- CVE-2024-25417flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_translation.php.
- CVE-2024-25418flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_menu.php.
- CVE-2024-25419flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_menu.php.
- CVE-2024-25711diffoscope before 256 allows directory traversal via an embedded filename in a GPG file.diffoscope
- CVE-2024-25713yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool_free function lacks loop checks.
- CVE-2024-25728ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends t
Medium, low and unrated 10
- CVE-2024-1433KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversalKDE Plasma Workspace
- CVE-2024-1151Kernel: stack overflow problem in open vswitch kernel module leading to dosRed Hat Enterprise Linux
- CVE-2024-21875DoS attack when broadcasting billboard messagesBadge.team Hacker Hotel Badge
- CVE-2024-1432DeepFaceLab main.py apply_xseg deserializationDeepFaceLab
- CVE-2024-1431Netgear R7000 Web Management Interface debuginfo.htm information disclosureNetgear R7000
- CVE-2024-1430Netgear R7000 Web Management Interface currentsetting.htm information disclosureNetgear R7000
- CVE-2023-52427In OpenDDS through 3.27, there is a segmentation fault for a DataWriter with a large value of resource_limits.max_samples.
- CVE-2024-23724Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profghost
- CVE-2024-25712http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and *webdav.memFilgithub.com/swaggo/http-swagger
- CVE-2024-25715Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirect_uri.