# CVEs published 2024-02-11

20 CVEs were published on February 11, 2024: 3 critical, 7 high. Days are UTC.

- [CVE-2024-1433](https://cve.now/CVE-2024-1433.md): KDE Plasma Workspace Theme File eventpluginsmanager.cpp enabledPlugins path traversal (CVSS 3.1, KDE Plasma Workspace)
- [CVE-2024-1151](https://cve.now/CVE-2024-1151.md): Kernel: stack overflow problem in open vswitch kernel module leading to dos (CVSS 5.5, Red Hat Enterprise Linux)
- [CVE-2024-21875](https://cve.now/CVE-2024-21875.md): DoS attack when broadcasting billboard messages (CVSS 6.5, Badge.team Hacker Hotel Badge)
- [CVE-2024-1432](https://cve.now/CVE-2024-1432.md): DeepFaceLab main.py apply\_xseg deserialization (CVSS 5.0, DeepFaceLab)
- [CVE-2024-1431](https://cve.now/CVE-2024-1431.md): Netgear R7000 Web Management Interface debuginfo.htm information disclosure (CVSS 4.3, Netgear R7000)
- [CVE-2024-1430](https://cve.now/CVE-2024-1430.md): Netgear R7000 Web Management Interface currentsetting.htm information disclosure (CVSS 5.3, Netgear R7000)
- [CVE-2023-52427](https://cve.now/CVE-2023-52427.md): In OpenDDS through 3.27, there is a segmentation fault for a DataWriter with a large value of resource\_limits.max\_samples. (no CVSS)
- [CVE-2023-52428](https://cve.now/CVE-2023-52428.md): In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service (resource consumption) via a large JWE p2c header val (CVSS 7.5, com.nimbusds:nimbus-jose-jwt)
- [CVE-2024-23724](https://cve.now/CVE-2024-23724.md): Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG prof (no CVSS, ghost)
- [CVE-2024-25417](https://cve.now/CVE-2024-25417.md): flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add\_translation.php. (CVSS 8.8)
- [CVE-2024-25418](https://cve.now/CVE-2024-25418.md): flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete\_menu.php. (CVSS 8.8)
- [CVE-2024-25419](https://cve.now/CVE-2024-25419.md): flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update\_menu.php. (CVSS 8.8)
- [CVE-2024-25711](https://cve.now/CVE-2024-25711.md): diffoscope before 256 allows directory traversal via an embedded filename in a GPG file. (CVSS 7.1, diffoscope)
- [CVE-2024-25712](https://cve.now/CVE-2024-25712.md): http-swagger before 1.2.6 allows XSS via PUT requests, because a file that has been uploaded (via httpSwagger.WrapHandler and \*webdav.memFil (CVSS 6.1, github.com/swaggo/http-swagger)
- [CVE-2024-25713](https://cve.now/CVE-2024-25713.md): yyjson through 0.8.0 has a double free, leading to remote code execution in some cases, because the pool\_free function lacks loop checks. (CVSS 8.6)
- [CVE-2024-25714](https://cve.now/CVE-2024-25714.md): In Rhonabwy through 1.1.13, HMAC signature verification uses a strcmp function that is vulnerable to side-channel attacks, because it stops (CVSS 9.1)
- [CVE-2024-25715](https://cve.now/CVE-2024-25715.md): Glewlwyd SSO server 2.x through 2.7.6 allows open redirection via redirect\_uri. (CVSS 6.1)
- [CVE-2024-25718](https://cve.now/CVE-2024-25718.md): In the Samly package before 1.4.0 for Elixir, Samly.State.Store.get\_assertion/3 can return an expired session, which interferes with access (CVSS 9.1)
- [CVE-2024-25722](https://cve.now/CVE-2024-25722.md): qanything\_kernel/connector/database/mysql/mysql\_client.py in qanything.ai QAnything before 1.2.0 allows SQL Injection. (CVSS 9.8)
- [CVE-2024-25728](https://cve.now/CVE-2024-25728.md): ExpressVPN before 12.73.0 on Windows, when split tunneling is used, sends DNS requests according to the Windows configuration (e.g., sends t (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-11
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.