CVEs published February 12, 2024
89 CVEs were published on February 12, 2024: 8 critical, 26 high.
- Published
- 89
- Critical
- 8
- High
- 26
- Medium
- 51
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- Dell Unity
- 16
- Open-Xchange OX App Suite
- 6
- IBM CICS TX Standard · IBM CICS TX Advanced
- 3
- chartjs
- 2
- exiv2
- 2
- MapPress Maps for WordPress
- 2
- UnitedThemes Brooklyn | Creative Multi-Purpose Responsive W…
- 2
- 389-ds-base · Red Hat Directory Server 11.5 E4S for RHEL +5
- 1
- Analytics Insights for Google Analytics
- 1
- ARI Soft Contact Form 7 Connector
- 1
Critical 8
- CVE-2024-25108Insufficient authorization allowing elevated access to resources in pixelfedpixelfed · pixelfed/pixelfed
- CVE-2024-25110Azure IoT Platform Device SDK Remote Code Execution Vulnerabilityazure-uamqp-c
- CVE-2023-6036Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication BypassWeb3
- CVE-2024-24797WordPress ERE Recently Viewed Plugin <= 1.3 is vulnerable to PHP Object InjectionG5Theme ERE Recently Viewed – Essential Real Estate Add-On
- CVE-2024-25100WordPress Coupon Referral Program plugin < 1.8.4 - Unauthenticated PHP Object Injection vulnerabilityWP Swings Coupon Referral Program
- CVE-2024-23759Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopf
- CVE-2024-23761Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template.
- CVE-2024-23763SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiers
High 26
- CVE-2024-23833OpenRefine JDBC Attack VulnerabilityOpenRefine · org.openrefine:database
- CVE-2024-22223 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc_cbr utility.Dell Unity
- CVE-2024-22222 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc_udoctor utility.Dell Unity
- CVE-2024-22225 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_supportassist utility.Dell Unity
- CVE-2024-22224 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_nas utility.Dell Unity
- CVE-2024-22228 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cifssupport utility.Dell Unity
- CVE-2024-22227 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_dc utility.Dell Unity
- CVE-2024-0164 Dell Unity, versions prior to 5.4, contain an OS Command Injection Vulnerability in its svc_topstats utility.Dell Unity
- CVE-2024-0165 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_acldb_dump utility.Dell Unity
- CVE-2024-0166 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_tcpdump utility.Dell Unity
- CVE-2024-0167 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svc_topstats utility.Dell Unity
- CVE-2024-0168 Dell Unity, versions prior to 5.4, contains a Command Injection Vulnerability in svc_oscheck utility.Dell Unity
- CVE-2024-0170 Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc_cava utility.Dell Unity
- CVE-2023-6294popup-builder < 4.2.6 - Admin+ SSRF & File ReadPopup Builder
- CVE-2024-0566Smart Manager < 8.28.0 - Admin+ SQL InjectionSmart Manager
- CVE-2024-23512WordPress ProductX – Gutenberg WooCommerce Blocks Plugin <= 3.1.4 is vulnerable to PHP Object Injectionwpxpo ProductX – WooCommerce Builder & Gutenberg WooCommerc…
- CVE-2023-41704Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine.Open-Xchange OX App Suite
- CVE-2024-23513WordPress PropertyHive Plugin <= 2.0.5 is vulnerable to PHP Object InjectionPropertyHive
- CVE-2024-24796WordPress Event Manager for WooCommerce Plugin <= 4.1.1 is vulnerable to PHP Object InjectionMagePeople Team Event Manager and Tickets Selling Plugin fo…
- CVE-2024-24926WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object InjectionUnitedThemes Brooklyn | Creative Multi-Purpose Responsive W…
- CVE-2024-24927WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to Cross Site Scripting (XSS)UnitedThemes Brooklyn | Creative Multi-Purpose Responsive W…
- CVE-2024-24932WordPress VK Poster Group Plugin <= 2.0.3 is vulnerable to Cross Site Scripting (XSS)Djo VK Poster Group
- CVE-2024-24933WordPress Honeypot for WP Comment Plugin <= 2.2.3 is vulnerable to Cross Site Scripting (XSS)Prasidhda Malla Honeypot for WP Comment
- CVE-2024-23762Unrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0 allows attackers to execute arbitrary code via upload of
- CVE-2024-24337CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05.
- CVE-2024-25744In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point.
Medium, low and unrated 55
- CVE-2023-28018HCL Connections s vulnerable to possible denial of service for certain usersHCL Software HCL Connections
- CVE-2024-1454Opensc: memory use after free in authentic driver when updating token infoopensc · Red Hat Enterprise Linux
- CVE-2024-24826Out-of-bounds read in QuickTimeVideo::NikonTagsDecoder in Exiv2exiv2
- CVE-2024-25112Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2exiv2
- CVE-2024-1250Privilege Chaining in GitLabGitLab
- CVE-2024-1459Undertow: directory traversal vulnerabilityundertow · Red Hat JBoss Enterprise Application Platfor… +11
- CVE-2021-4437dbartholomae lambda-middleware frameguard JSON Mime-Type JsonDeserializer.ts redosdbartholomae lambda-middleware frameguard · @lambda-middlew…
- CVE-2022-22506IBM Robotic Process Automation information disclosureIBM Robotic Process Automation
- CVE-2022-34309IBM CICS TX information disclosureIBM CICS TX Standard · IBM CICS TX Advanced
- CVE-2024-22221 Dell Unity, versions prior to 5.4, contains SQL Injection vulnerability.Dell Unity
- CVE-2024-22226 Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc_supportassist utility.Dell Unity
- CVE-2024-22230 Dell Unity, versions prior to 5.4, contains a Cross-site scripting vulnerability.Dell Unity
- CVE-2024-0169Dell Unity, version(s) 5.3 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulDell Unity
- CVE-2022-34311IBM CICS TX session fixationIBM CICS TX Standard · IBM CICS TX Advanced
- CVE-2022-34310IBM CICS TX information disclosureIBM CICS TX Standard · IBM CICS TX Advanced
- CVE-2022-38714IBM DataStage on Cloud Pak for Data information disclosureIBM DataStage on Cloud Pak for Data
- CVE-2023-6081Chart.js for WordPress <= 2023.2 - Editor+ Stored Cross-Site Scripting in New Chartchartjs
- CVE-2023-6082Chart.js for WordPress <= 2023.2 - Editor+ Stored Cross-Site Scriptingchartjs
- CVE-2023-6591Popup Box Pro < 20.9.0 - Admin+ Stored XSSPopup Box
- CVE-2024-0248EazyDocs < 2.4.0 - Subscriber+ Arbitrary Posts Deletion and Document ManagementEazyDocs
- CVE-2023-6499lasTunes <= 3.6.1 - Settings Update via CSRFlasTunes
- CVE-2024-0420MapPress Maps for WordPress < 2.88.15 - Contributor+ Stored XSSMapPress Maps for WordPress
- CVE-2023-7233GigPress <= 2.3.29 - Admin+ Stored Cross Site ScriptingGigPress
- CVE-2024-0250Analytics Insights for Google Analytics 4 < 6.3 - Open RedirectAnalytics Insights for Google Analytics
- CVE-2024-0421MapPress Maps for WordPress < 2.88.16 - Unauthenticated Arbitrary Private/Draft Post DisclosureMapPress Maps for WordPress
- CVE-2023-6501Splashscreen <= 0.20 - Settings Update via CSRFSplashscreen
- CVE-2023-6681Jwcrypto: denail of service via specifically crafted jweRed Hat Enterprise Linux · Red Hat Ansible Automation Pl… +1
- CVE-2024-1062389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)389-ds-base · Red Hat Directory Server 11.5 E4S for RHEL +5
- CVE-2024-1439Inadequate access control vulnerability in MoodleMoodle LMS · moodle/moodle
- CVE-2024-24875WordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Request Forgery (CSRF)Yannick Lefebvre Link Library
- CVE-2024-24884WordPress Contact Form 7 Connector Plugin <= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF)ARI Soft Contact Form 7 Connector
- CVE-2024-24887WordPress Contest Gallery Plugin <= 21.2.8.4 is vulnerable to Cross Site Request Forgery (CSRF)Photos and Files Contest Gallery – Contact Form, Upload For…
- CVE-2024-24929WordPress WP Contact Form Plugin <= 1.6 is vulnerable to Cross Site Request Forgery (CSRF)Ryan Duff, Peter Westwood WP Contact Form
- CVE-2024-24935WordPress Basic Log Viewer Plugin <= 1.0.4 is vulnerable to Cross Site Request Forgery (CSRF)WpSimpleTools Basic Log Viewer
- CVE-2023-46615WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object InjectionKalli Dan. KD Coming Soon
- CVE-2023-41708References to the "app loader" functionality could contain redirects to unexpected locations.Open-Xchange OX App Suite
- CVE-2023-41707Processing of user-defined mail search expressions is not limited.Open-Xchange OX App Suite
- CVE-2023-41706Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached.Open-Xchange OX App Suite
- CVE-2023-41705Processing of user-defined DAV user-agent strings is not limited.Open-Xchange OX App Suite
- CVE-2023-41703User ID references at mentions in document comments were not correctly sanitized.Open-Xchange OX App Suite
- CVE-2023-47526WordPress Chartify Plugin <= 2.0.6 is vulnerable to Cross Site Scripting (XSS)Chart Builder Team Chartify – WordPress Chart Plugin
- CVE-2023-50875WordPress Sensei LMS Plugin <= 4.17.0 is vulnerable to Cross Site Scripting (XSS)Automattic Sensei LMS – Online Courses, Quizzes, & Learning
- CVE-2023-51370WordPress WP Chat App Plugin <= 3.4.4 is vulnerable to Cross Site Scripting (XSS)NinjaTeam WP Chat App
- CVE-2023-51403WordPress Restaurant Reservations Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)Nicdark Restaurant Reservations
- CVE-2024-24889WordPress All 404 Pages Redirect to Homepage Plugin <= 1.9 is vulnerable to Cross Site Scripting (XSS)Geek Code Lab All 404 Pages Redirect to Homepage
- CVE-2024-24928WordPress Content Cards Plugin <= 0.9.7 is vulnerable to Cross Site Scripting (XSS)Arunas Liuiza Content Cards
- CVE-2024-24930WordPress Buttons Shortcode and Widget Plugin <= 1.16 is vulnerable to Cross Site Scripting (XSS)OTWthemes.com Buttons Shortcode and Widget
- CVE-2024-24931WordPress Before After Image Slider WP Plugin <= 2.2 is vulnerable to Cross Site Scripting (XSS)swadeshswain Before After Image Slider WP
- CVE-2023-52429dm_table_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc_targets) allocate more than INT_MAX byte
- CVE-2023-52430The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with eithgithub.com/greenpau/caddy-security
- CVE-2024-23760Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json and
- CVE-2024-25360A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component via sending a crafte
- CVE-2024-25739create_empty_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a mi
- CVE-2024-25740A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI_IOCATT, because kobj->n
- CVE-2024-25741printer_write in drivers/usb/gadget/function/f_printer.c in the Linux kernel through 6.7.4 does not properly call usb_ep_queue, which might