# CVEs published 2024-02-12

89 CVEs were published on February 12, 2024: 8 critical, 26 high. Days are UTC.

- [CVE-2023-28018](https://cve.now/CVE-2023-28018.md): HCL Connections s vulnerable to possible denial of service for certain users (CVSS 5.5, HCL Software HCL Connections)
- [CVE-2024-1454](https://cve.now/CVE-2024-1454.md): Opensc: memory use after free in authentic driver when updating token info (CVSS 3.4, opensc · Red Hat Enterprise Linux)
- [CVE-2024-24826](https://cve.now/CVE-2024-24826.md): Out-of-bounds read in QuickTimeVideo::NikonTagsDecoder in Exiv2 (CVSS 5.5, exiv2)
- [CVE-2024-25112](https://cve.now/CVE-2024-25112.md): Denial of service due to unbounded recursion in QuickTimeVideo::multipleEntriesDecoder in Exiv2 (CVSS 5.5, exiv2)
- [CVE-2024-1250](https://cve.now/CVE-2024-1250.md): Privilege Chaining in GitLab (CVSS 6.5, GitLab)
- [CVE-2024-1459](https://cve.now/CVE-2024-1459.md): Undertow: directory traversal vulnerability (CVSS 5.3, undertow · Red Hat JBoss Enterprise Application Platfor… +11)
- [CVE-2024-23833](https://cve.now/CVE-2024-23833.md): OpenRefine JDBC Attack Vulnerability (CVSS 7.5, OpenRefine · org.openrefine:database)
- [CVE-2024-25108](https://cve.now/CVE-2024-25108.md): Insufficient authorization allowing elevated access to resources in pixelfed (CVSS 9.9, pixelfed · pixelfed/pixelfed)
- [CVE-2024-25110](https://cve.now/CVE-2024-25110.md): Azure IoT Platform Device SDK Remote Code Execution Vulnerability (CVSS 9.8, azure-uamqp-c)
- [CVE-2021-4437](https://cve.now/CVE-2021-4437.md): dbartholomae lambda-middleware frameguard JSON Mime-Type JsonDeserializer.ts redos (CVSS 3.5, dbartholomae lambda-middleware frameguard · @lambda-middlew…)
- [CVE-2022-22506](https://cve.now/CVE-2022-22506.md): IBM Robotic Process Automation information disclosure (CVSS 4.6, IBM Robotic Process Automation)
- [CVE-2024-22223](https://cve.now/CVE-2024-22223.md): Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc\_cbr utility. (CVSS 7.8, Dell Unity)
- [CVE-2022-34309](https://cve.now/CVE-2022-34309.md): IBM CICS TX information disclosure (CVSS 5.9, IBM CICS TX Standard · IBM CICS TX Advanced)
- [CVE-2024-22222](https://cve.now/CVE-2024-22222.md): Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability within its svc\_udoctor utility. (CVSS 7.8, Dell Unity)
- [CVE-2024-22221](https://cve.now/CVE-2024-22221.md): Dell Unity, versions prior to 5.4, contains SQL Injection vulnerability. (CVSS 4.5, Dell Unity)
- [CVE-2024-22226](https://cve.now/CVE-2024-22226.md): Dell Unity, versions prior to 5.4, contain a path traversal vulnerability in its svc\_supportassist utility. (CVSS 3.3, Dell Unity)
- [CVE-2024-22225](https://cve.now/CVE-2024-22225.md): Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc\_supportassist utility. (CVSS 7.8, Dell Unity)
- [CVE-2024-22224](https://cve.now/CVE-2024-22224.md): Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc\_nas utility. (CVSS 7.8, Dell Unity)
- [CVE-2024-22230](https://cve.now/CVE-2024-22230.md): Dell Unity, versions prior to 5.4, contains a Cross-site scripting vulnerability. (CVSS 6.4, Dell Unity)
- [CVE-2024-22228](https://cve.now/CVE-2024-22228.md): Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc\_cifssupport utility. (CVSS 7.8, Dell Unity)
- [CVE-2024-22227](https://cve.now/CVE-2024-22227.md): Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc\_dc utility. (CVSS 7.8, Dell Unity)
- [CVE-2024-0164](https://cve.now/CVE-2024-0164.md): Dell Unity, versions prior to 5.4, contain an OS Command Injection Vulnerability in its svc\_topstats utility. (CVSS 7.8, Dell Unity)
- [CVE-2024-0165](https://cve.now/CVE-2024-0165.md): Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc\_acldb\_dump utility. (CVSS 7.8, Dell Unity)
- [CVE-2024-0166](https://cve.now/CVE-2024-0166.md): Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc\_tcpdump utility. (CVSS 7.8, Dell Unity)
- [CVE-2024-0167](https://cve.now/CVE-2024-0167.md): Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in the svc\_topstats utility. (CVSS 7.8, Dell Unity)
- [CVE-2024-0168](https://cve.now/CVE-2024-0168.md): Dell Unity, versions prior to 5.4, contains a Command Injection Vulnerability in svc\_oscheck utility. (CVSS 7.8, Dell Unity)
- [CVE-2024-0169](https://cve.now/CVE-2024-0169.md): Dell Unity, version(s) 5.3 and prior, contain(s) an Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vul (CVSS 5.7, Dell Unity)
- [CVE-2022-34311](https://cve.now/CVE-2022-34311.md): IBM CICS TX session fixation (CVSS 4.3, IBM CICS TX Standard · IBM CICS TX Advanced)
- [CVE-2024-0170](https://cve.now/CVE-2024-0170.md): Dell Unity, versions prior to 5.4, contains an OS Command Injection Vulnerability in its svc\_cava utility. (CVSS 7.8, Dell Unity)
- [CVE-2022-34310](https://cve.now/CVE-2022-34310.md): IBM CICS TX information disclosure (CVSS 5.9, IBM CICS TX Standard · IBM CICS TX Advanced)
- [CVE-2022-38714](https://cve.now/CVE-2022-38714.md): IBM DataStage on Cloud Pak for Data information disclosure (CVSS 4.9, IBM DataStage on Cloud Pak for Data)
- [CVE-2023-6081](https://cve.now/CVE-2023-6081.md): Chart.js for WordPress \<= 2023.2 - Editor+ Stored Cross-Site Scripting in New Chart (CVSS 5.4, chartjs)
- [CVE-2023-6294](https://cve.now/CVE-2023-6294.md): popup-builder \< 4.2.6 - Admin+ SSRF & File Read (CVSS 7.5, Popup Builder)
- [CVE-2023-6036](https://cve.now/CVE-2023-6036.md): Web3 – Crypto wallet Login & NFT token gating \< 3.0.0 - Authentication Bypass (CVSS 9.8, Web3)
- [CVE-2023-6082](https://cve.now/CVE-2023-6082.md): Chart.js for WordPress \<= 2023.2 - Editor+ Stored Cross-Site Scripting (CVSS 5.4, chartjs)
- [CVE-2023-6591](https://cve.now/CVE-2023-6591.md): Popup Box Pro \< 20.9.0 - Admin+ Stored XSS (CVSS 4.8, Popup Box)
- [CVE-2024-0566](https://cve.now/CVE-2024-0566.md): Smart Manager \< 8.28.0 - Admin+ SQL Injection (CVSS 7.2, Smart Manager)
- [CVE-2024-0248](https://cve.now/CVE-2024-0248.md): EazyDocs \< 2.4.0 - Subscriber+ Arbitrary Posts Deletion and Document Management (CVSS 4.3, EazyDocs)
- [CVE-2023-6499](https://cve.now/CVE-2023-6499.md): lasTunes \<= 3.6.1 - Settings Update via CSRF (CVSS 5.4, lasTunes)
- [CVE-2024-0420](https://cve.now/CVE-2024-0420.md): MapPress Maps for WordPress \< 2.88.15 - Contributor+ Stored XSS (CVSS 6.1, MapPress Maps for WordPress)
- [CVE-2023-7233](https://cve.now/CVE-2023-7233.md): GigPress \<= 2.3.29 - Admin+ Stored Cross Site Scripting (CVSS 4.8, GigPress)
- [CVE-2024-0250](https://cve.now/CVE-2024-0250.md): Analytics Insights for Google Analytics 4 \< 6.3 - Open Redirect (CVSS 6.1, Analytics Insights for Google Analytics)
- [CVE-2024-0421](https://cve.now/CVE-2024-0421.md): MapPress Maps for WordPress \< 2.88.16 - Unauthenticated Arbitrary Private/Draft Post Disclosure (CVSS 5.3, MapPress Maps for WordPress)
- [CVE-2023-6501](https://cve.now/CVE-2023-6501.md): Splashscreen \<= 0.20 - Settings Update via CSRF (CVSS 4.3, Splashscreen)
- [CVE-2023-6681](https://cve.now/CVE-2023-6681.md): Jwcrypto: denail of service via specifically crafted jwe (CVSS 5.3, Red Hat Enterprise Linux · Red Hat Ansible Automation Pl… +1)
- [CVE-2024-1062](https://cve.now/CVE-2024-1062.md): 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log\_entry\_attr) (CVSS 5.5, 389-ds-base · Red Hat Directory Server 11.5 E4S for RHEL +5)
- [CVE-2024-1439](https://cve.now/CVE-2024-1439.md): Inadequate access control vulnerability in Moodle (CVSS 6.5, Moodle LMS · moodle/moodle)
- [CVE-2024-24875](https://cve.now/CVE-2024-24875.md): WordPress Link Library Plugin \<= 7.5.13 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Yannick Lefebvre Link Library)
- [CVE-2024-24884](https://cve.now/CVE-2024-24884.md): WordPress Contact Form 7 Connector Plugin \<= 1.2.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, ARI Soft Contact Form 7 Connector)
- [CVE-2024-24887](https://cve.now/CVE-2024-24887.md): WordPress Contest Gallery Plugin \<= 21.2.8.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Photos and Files Contest Gallery – Contact Form, Upload For…)
- [CVE-2024-24929](https://cve.now/CVE-2024-24929.md): WordPress WP Contact Form Plugin \<= 1.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Ryan Duff, Peter Westwood WP Contact Form)
- [CVE-2024-24935](https://cve.now/CVE-2024-24935.md): WordPress Basic Log Viewer Plugin \<= 1.0.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WpSimpleTools Basic Log Viewer)
- [CVE-2023-46615](https://cve.now/CVE-2023-46615.md): WordPress KD Coming Soon Plugin \<= 1.7 is vulnerable to PHP Object Injection (CVSS 5.4, Kalli Dan. KD Coming Soon)
- [CVE-2024-23512](https://cve.now/CVE-2024-23512.md): WordPress ProductX – Gutenberg WooCommerce Blocks Plugin \<= 3.1.4 is vulnerable to PHP Object Injection (CVSS 8.7, wpxpo ProductX – WooCommerce Builder & Gutenberg WooCommerc…)
- [CVE-2023-41708](https://cve.now/CVE-2023-41708.md): References to the "app loader" functionality could contain redirects to unexpected locations. (CVSS 5.4, Open-Xchange OX App Suite)
- [CVE-2023-41707](https://cve.now/CVE-2023-41707.md): Processing of user-defined mail search expressions is not limited. (CVSS 6.5, Open-Xchange OX App Suite)
- [CVE-2023-41706](https://cve.now/CVE-2023-41706.md): Processing time of drive search expressions now gets monitored, and the related request is terminated if a resource threshold is reached. (CVSS 6.5, Open-Xchange OX App Suite)
- [CVE-2023-41705](https://cve.now/CVE-2023-41705.md): Processing of user-defined DAV user-agent strings is not limited. (CVSS 6.5, Open-Xchange OX App Suite)
- [CVE-2023-41704](https://cve.now/CVE-2023-41704.md): Processing of CID references at E-Mail can be abused to inject malicious script code that passes the sanitization engine. (CVSS 7.1, Open-Xchange OX App Suite)
- [CVE-2023-41703](https://cve.now/CVE-2023-41703.md): User ID references at mentions in document comments were not correctly sanitized. (CVSS 6.1, Open-Xchange OX App Suite)
- [CVE-2024-23513](https://cve.now/CVE-2024-23513.md): WordPress PropertyHive Plugin \<= 2.0.5 is vulnerable to PHP Object Injection (CVSS 8.7, PropertyHive)
- [CVE-2024-24796](https://cve.now/CVE-2024-24796.md): WordPress Event Manager for WooCommerce Plugin \<= 4.1.1 is vulnerable to PHP Object Injection (CVSS 8.2, MagePeople Team Event Manager and Tickets Selling Plugin fo…)
- [CVE-2024-24797](https://cve.now/CVE-2024-24797.md): WordPress ERE Recently Viewed Plugin \<= 1.3 is vulnerable to PHP Object Injection (CVSS 9.8, G5Theme ERE Recently Viewed – Essential Real Estate Add-On)
- [CVE-2024-24926](https://cve.now/CVE-2024-24926.md): WordPress Brooklyn Theme \<= 4.9.7.6 is vulnerable to PHP Object Injection (CVSS 7.5, UnitedThemes Brooklyn | Creative Multi-Purpose Responsive W…)
- [CVE-2024-25100](https://cve.now/CVE-2024-25100.md): WordPress Coupon Referral Program plugin \< 1.8.4 - Unauthenticated PHP Object Injection vulnerability (CVSS 10.0, WP Swings Coupon Referral Program)
- [CVE-2023-47526](https://cve.now/CVE-2023-47526.md): WordPress Chartify Plugin \<= 2.0.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Chart Builder Team Chartify – WordPress Chart Plugin)
- [CVE-2023-50875](https://cve.now/CVE-2023-50875.md): WordPress Sensei LMS Plugin \<= 4.17.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Automattic Sensei LMS – Online Courses, Quizzes, & Learning)
- [CVE-2023-51370](https://cve.now/CVE-2023-51370.md): WordPress WP Chat App Plugin \<= 3.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, NinjaTeam WP Chat App)
- [CVE-2023-51403](https://cve.now/CVE-2023-51403.md): WordPress Restaurant Reservations Plugin \<= 1.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Nicdark Restaurant Reservations)
- [CVE-2024-24889](https://cve.now/CVE-2024-24889.md): WordPress All 404 Pages Redirect to Homepage Plugin \<= 1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1, Geek Code Lab All 404 Pages Redirect to Homepage)
- [CVE-2024-24927](https://cve.now/CVE-2024-24927.md): WordPress Brooklyn Theme \<= 4.9.7.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, UnitedThemes Brooklyn | Creative Multi-Purpose Responsive W…)
- [CVE-2024-24928](https://cve.now/CVE-2024-24928.md): WordPress Content Cards Plugin \<= 0.9.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Arunas Liuiza Content Cards)
- [CVE-2024-24930](https://cve.now/CVE-2024-24930.md): WordPress Buttons Shortcode and Widget Plugin \<= 1.16 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, OTWthemes.com Buttons Shortcode and Widget)
- [CVE-2024-24931](https://cve.now/CVE-2024-24931.md): WordPress Before After Image Slider WP Plugin \<= 2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, swadeshswain Before After Image Slider WP)
- [CVE-2024-24932](https://cve.now/CVE-2024-24932.md): WordPress VK Poster Group Plugin \<= 2.0.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Djo VK Poster Group)
- [CVE-2024-24933](https://cve.now/CVE-2024-24933.md): WordPress Honeypot for WP Comment Plugin \<= 2.2.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Prasidhda Malla Honeypot for WP Comment)
- [CVE-2023-52429](https://cve.now/CVE-2023-52429.md): dm\_table\_create in drivers/md/dm-table.c in the Linux kernel through 6.7.4 can attempt to (in alloc\_targets) allocate more than INT\_MAX byte (CVSS 5.5)
- [CVE-2023-52430](https://cve.now/CVE-2023-52430.md): The caddy-security plugin 1.1.20 for Caddy allows reflected XSS via a GET request to a URL that contains an XSS payload and begins with eith (CVSS 5.4, github.com/greenpau/caddy-security)
- [CVE-2024-23759](https://cve.now/CVE-2024-23759.md): Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopf (CVSS 9.8)
- [CVE-2024-23760](https://cve.now/CVE-2024-23760.md): Cleartext Storage of Sensitive Information in Gambio 4.9.2.0 allows attackers to obtain sensitive information via error-handler.log.json and (CVSS 2.7)
- [CVE-2024-23761](https://cve.now/CVE-2024-23761.md): Server Side Template Injection in Gambio 4.9.2.0 allows attackers to run arbitrary code via crafted smarty email template. (CVSS 9.8)
- [CVE-2024-23762](https://cve.now/CVE-2024-23762.md): Unrestricted File Upload vulnerability in Content Manager feature in Gambio 4.9.2.0 allows attackers to execute arbitrary code via upload of (CVSS 7.8)
- [CVE-2024-23763](https://cve.now/CVE-2024-23763.md): SQL Injection vulnerability in Gambio through 4.9.2.0 allows attackers to run arbitrary SQL commands via crafted GET request using modifiers (CVSS 9.8)
- [CVE-2024-24337](https://cve.now/CVE-2024-24337.md): CSV Injection vulnerability in '/members/moremember.pl' and '/admin/aqbudgets.pl' endpoints in Koha Library Management System version 23.05. (CVSS 8.8)
- [CVE-2024-25360](https://cve.now/CVE-2024-25360.md): A hidden interface in Motorola CX2L Router firmware v1.0.1 leaks information regarding the SystemWizardStatus component via sending a crafte (CVSS 5.3)
- [CVE-2024-25739](https://cve.now/CVE-2024-25739.md): create\_empty\_lvol in drivers/mtd/ubi/vtbl.c in the Linux kernel through 6.7.4 can attempt to allocate zero bytes, and crash, because of a mi (CVSS 5.5)
- [CVE-2024-25740](https://cve.now/CVE-2024-25740.md): A memory leak flaw was found in the UBI driver in drivers/mtd/ubi/attach.c in the Linux kernel through 6.7.4 for UBI\_IOCATT, because kobj-\>n (CVSS 5.5)
- [CVE-2024-25741](https://cve.now/CVE-2024-25741.md): printer\_write in drivers/usb/gadget/function/f\_printer.c in the Linux kernel through 6.7.4 does not properly call usb\_ep\_queue, which might (CVSS 5.5)
- [CVE-2024-25744](https://cve.now/CVE-2024-25744.md): In the Linux kernel before 6.6.7, an untrusted VMM can trigger int80 syscall handling at any given point. (CVSS 8.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.