# CVEs published 2024-02-13

182 CVEs were published on February 13, 2024: 19 critical, 98 high. 5 are now in CISA KEV. Days are UTC.

- [CVE-2024-24699](https://cve.now/CVE-2024-24699.md): Zoom Clients - Business Logic Error (CVSS 6.5, Zoom Video Communications Zoom Clients)
- [CVE-2024-24698](https://cve.now/CVE-2024-24698.md): Zoom Clients - Improper Authentication (CVSS 4.9, Zoom Video Communications Zoom Clients)
- [CVE-2024-24697](https://cve.now/CVE-2024-24697.md): Zoom Clients - Untrusted Search Path (CVSS 7.2, Zoom Video Communications Zoom Clients)
- [CVE-2024-24696](https://cve.now/CVE-2024-24696.md): Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation (CVSS 6.8, Zoom Video Communications Zoom Desktop Client for Windows,…)
- [CVE-2024-24695](https://cve.now/CVE-2024-24695.md): Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom Meeting SDK for Windows - Improper Input Validation (CVSS 6.8, Zoom Video Communications Zoom Desktop Client for Windows,…)
- [CVE-2024-1485](https://cve.now/CVE-2024-1485.md): Registry-support: decompress can delete files outside scope via relative paths (CVSS 8.0, registry-support · Red Hat OpenShift Developer Tools and… +2)
- [CVE-2024-25118](https://cve.now/CVE-2024-25118.md): Information Disclosure of Hashed Passwords in TYPO3 Backend Forms (CVSS 4.3, typo3 · typo3/cms-core)
- [CVE-2024-25119](https://cve.now/CVE-2024-25119.md): Information Disclosure of Encryption Key in TYPO3 Install Tool (CVSS 4.9, typo3 · typo3/cms-core)
- [CVE-2024-25120](https://cve.now/CVE-2024-25120.md): Improper Access Control of Resources Referenced by t3:// URI Scheme in TYPO3 (CVSS 4.3, typo3 · typo3/cms-core)
- [CVE-2024-25121](https://cve.now/CVE-2024-25121.md): Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3 (CVSS 7.1, typo3 · typo3/cms-core)
- [CVE-2023-6152](https://cve.now/CVE-2023-6152.md): A user changing their email after signing up and verifying it can change it without verification in profile settings. (CVSS 5.4, Grafana · github.com/grafana/grafana)
- [CVE-2023-20579](https://cve.now/CVE-2023-20579.md): Improper Access Control in the AMD SPI protection feature may allow a user with Ring0 (kernel mode) privileged access to bypass protections (CVSS 3.4, AMD Ryzen™ 5000 Series Desktop Processor with Radeon™ G… +11)
- [CVE-2023-20587](https://cve.now/CVE-2023-20587.md): Improper Access Control in System Management Mode (SMM) may allow an attacker access to the SPI flash potentially leading to arbitrary code (CVSS 7.1, 3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Process… +3)
- [CVE-2021-46757](https://cve.now/CVE-2021-46757.md): Insufficient checking of memory buffer in ASP Secure OS may allow an attacker with a malicious TA to read/write to the ASP Secure OS kernel (CVSS 7.8, AMD Ryzen™ Embedded)
- [CVE-2023-31347](https://cve.now/CVE-2023-31347.md): Due to a code bug in Secure\_TSC, SEV firmware may allow an attacker with high privileges to cause a guest to observe an incorrect TSC when S (CVSS 4.9, 3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Processors)
- [CVE-2023-31346](https://cve.now/CVE-2023-31346.md): Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests. (CVSS 6.0, 3rd Gen AMD EPYC™ Processors · 4th Gen AMD EPYC™ Processors)
- [CVE-2024-25122](https://cve.now/CVE-2024-25122.md): Cross-site Scripting sidekiq-unique-jobs UI server vulnerability (CVSS 7.1, mhenrixon sidekiq-unique-jobs · sidekiq-unique-jobs)
- [CVE-2024-1378](https://cve.now/CVE-2024-1378.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1, GitHub Enterprise Server)
- [CVE-2024-1374](https://cve.now/CVE-2024-1374.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1, GitHub Enterprise Server)
- [CVE-2024-1372](https://cve.now/CVE-2024-1372.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1, GitHub Enterprise Server)
- [CVE-2024-1369](https://cve.now/CVE-2024-1369.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1, GitHub Enterprise Server)
- [CVE-2024-1359](https://cve.now/CVE-2024-1359.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1, GitHub Enterprise Server)
- [CVE-2024-1355](https://cve.now/CVE-2024-1355.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 9.1, GitHub Enterprise Server)
- [CVE-2024-1354](https://cve.now/CVE-2024-1354.md): Command injection vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Mangement Console (CVSS 8.0, GitHub Enterprise Server)
- [CVE-2024-1082](https://cve.now/CVE-2024-1082.md): Path traversal vulnerability in GitHub Enterprise Server that allowed arbitrary file read with a specially crafted GitHub Pages artifact upload (CVSS 6.3, GitHub Enterprise Server)
- [CVE-2024-24814](https://cve.now/CVE-2024-24814.md): Denial of service when manipulating mod\_auth\_openidc\_session\_chunks cookie in mod\_auth\_openidc (CVSS 7.5, mod\_auth\_openidc)
- [CVE-2024-1084](https://cve.now/CVE-2024-1084.md): Cross-site Scripting in the tag name pattern field in the tag protections UI in GitHub Enterprise Server allows a malicious website that req (CVSS 6.5, GitHub Enterprise Server)
- [CVE-2024-24751](https://cve.now/CVE-2024-24751.md): Broken Access Control in Backend Module in sf\_event\_mgt (CVSS 4.3, derhansen sf\_event\_mgt · derhansen/sf\_event\_mgt)
- [CVE-2024-21412](https://cve.now/CVE-2024-21412.md): Internet Shortcut Files Security Feature Bypass Vulnerability (CVSS 8.1, KEV, Microsoft Windows)
- [CVE-2024-21410](https://cve.now/CVE-2024-21410.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 9.8, KEV, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2024-21406](https://cve.now/CVE-2024-21406.md): Windows Printing Service Spoofing Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-21405](https://cve.now/CVE-2024-21405.md): Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-21403](https://cve.now/CVE-2024-21403.md): Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability (CVSS 9.0, Microsoft Azure Kubernetes Service)
- [CVE-2024-21397](https://cve.now/CVE-2024-21397.md): Microsoft Azure File Sync Elevation of Privilege Vulnerability (CVSS 5.3, Microsoft Azure File Sync)
- [CVE-2024-21395](https://cve.now/CVE-2024-21395.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 8.2, Microsoft Dynamics 365 (on-premises))
- [CVE-2024-21391](https://cve.now/CVE-2024-21391.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21384](https://cve.now/CVE-2024-21384.md): Microsoft Office OneNote Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office LTSC)
- [CVE-2024-21380](https://cve.now/CVE-2024-21380.md): Microsoft Dynamics Business Central/NAV Information Disclosure Vulnerability (CVSS 8.0, Microsoft Dynamics 365 Business Central 2022 Release Wave ·…)
- [CVE-2024-21378](https://cve.now/CVE-2024-21378.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 8.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2024-21377](https://cve.now/CVE-2024-21377.md): Windows DNS Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-21376](https://cve.now/CVE-2024-21376.md): Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability (CVSS 9.0, Microsoft Azure Kubernetes Service)
- [CVE-2024-21374](https://cve.now/CVE-2024-21374.md): Microsoft Teams for Android Information Disclosure Vulnerability (CVSS 5.0, Microsoft Teams for Android)
- [CVE-2024-21370](https://cve.now/CVE-2024-21370.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21368](https://cve.now/CVE-2024-21368.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21367](https://cve.now/CVE-2024-21367.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21365](https://cve.now/CVE-2024-21365.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21364](https://cve.now/CVE-2024-21364.md): Microsoft Azure Site Recovery Elevation of Privilege Vulnerability (CVSS 9.3, Microsoft Azure Site Recovery)
- [CVE-2024-21363](https://cve.now/CVE-2024-21363.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-21362](https://cve.now/CVE-2024-21362.md): Windows Kernel Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-21359](https://cve.now/CVE-2024-21359.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21356](https://cve.now/CVE-2024-21356.md): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-21355](https://cve.now/CVE-2024-21355.md): Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-21353](https://cve.now/CVE-2024-21353.md): Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server 2022, 23H2 Edition)
- [CVE-2024-21348](https://cve.now/CVE-2024-21348.md): Internet Connection Sharing (ICS) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-21347](https://cve.now/CVE-2024-21347.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-21346](https://cve.now/CVE-2024-21346.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-21345](https://cve.now/CVE-2024-21345.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows Server 2022, 23H2 Edition)
- [CVE-2024-21344](https://cve.now/CVE-2024-21344.md): Windows Network Address Translation (NAT) Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2024-21343](https://cve.now/CVE-2024-21343.md): Windows Network Address Translation (NAT) Denial of Service Vulnerability (CVSS 5.9, Microsoft Windows)
- [CVE-2024-21342](https://cve.now/CVE-2024-21342.md): Windows DNS Client Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-21341](https://cve.now/CVE-2024-21341.md): Windows Kernel Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-21339](https://cve.now/CVE-2024-21339.md): Windows USB Generic Parent Driver Remote Code Execution Vulnerability (CVSS 6.4, Microsoft Windows)
- [CVE-2024-20684](https://cve.now/CVE-2024-20684.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-21328](https://cve.now/CVE-2024-21328.md): Dynamics 365 Sales Spoofing Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2024-20695](https://cve.now/CVE-2024-20695.md): Skype for Business Information Disclosure Vulnerability (CVSS 5.7, Microsoft Skype for Business Server 2019 CU7)
- [CVE-2024-21315](https://cve.now/CVE-2024-21315.md): Microsoft Defender for Endpoint Protection Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Defender for Endpoint for Windows)
- [CVE-2024-21304](https://cve.now/CVE-2024-21304.md): Trusted Compute Base Elevation of Privilege Vulnerability (CVSS 4.1, Microsoft Windows)
- [CVE-2024-20679](https://cve.now/CVE-2024-20679.md): Azure Stack Hub Spoofing Vulnerability (CVSS 6.5, Microsoft Azure Stack Hub)
- [CVE-2024-20673](https://cve.now/CVE-2024-20673.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Excel · Microsoft Office +5)
- [CVE-2024-21420](https://cve.now/CVE-2024-21420.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21413](https://cve.now/CVE-2024-21413.md): Microsoft Outlook Remote Code Execution Vulnerability (CVSS 9.8, KEV, Microsoft 365 Apps for Enterprise · Microsoft Office)
- [CVE-2024-21404](https://cve.now/CVE-2024-21404.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft Visual Studio)
- [CVE-2024-21402](https://cve.now/CVE-2024-21402.md): Microsoft Outlook Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft 365 Apps for Enterprise)
- [CVE-2024-21401](https://cve.now/CVE-2024-21401.md): Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability (CVSS 9.8, Microsoft Entra)
- [CVE-2024-21396](https://cve.now/CVE-2024-21396.md): Dynamics 365 Sales Spoofing Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2024-21394](https://cve.now/CVE-2024-21394.md): Dynamics 365 Field Service Spoofing Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2024-21393](https://cve.now/CVE-2024-21393.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2024-21389](https://cve.now/CVE-2024-21389.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2024-21386](https://cve.now/CVE-2024-21386.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft ASP.NET Core · Microsoft Visual Studio +12)
- [CVE-2024-21381](https://cve.now/CVE-2024-21381.md): Microsoft Azure Active Directory B2C Spoofing Vulnerability (CVSS 6.8, Microsoft Entra)
- [CVE-2024-21379](https://cve.now/CVE-2024-21379.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise · Microsoft Office +1)
- [CVE-2024-21375](https://cve.now/CVE-2024-21375.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21372](https://cve.now/CVE-2024-21372.md): Windows OLE Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21371](https://cve.now/CVE-2024-21371.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-21369](https://cve.now/CVE-2024-21369.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21366](https://cve.now/CVE-2024-21366.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21361](https://cve.now/CVE-2024-21361.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21360](https://cve.now/CVE-2024-21360.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21358](https://cve.now/CVE-2024-21358.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21357](https://cve.now/CVE-2024-21357.md): Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-21354](https://cve.now/CVE-2024-21354.md): Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-21352](https://cve.now/CVE-2024-21352.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21351](https://cve.now/CVE-2024-21351.md): Windows SmartScreen Security Feature Bypass Vulnerability (CVSS 7.6, KEV, Microsoft Windows)
- [CVE-2024-21350](https://cve.now/CVE-2024-21350.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21349](https://cve.now/CVE-2024-21349.md): Microsoft ActiveX Data Objects Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21340](https://cve.now/CVE-2024-21340.md): Windows Kernel Information Disclosure Vulnerability (CVSS 4.6, Microsoft Windows)
- [CVE-2024-21338](https://cve.now/CVE-2024-21338.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2024-21329](https://cve.now/CVE-2024-21329.md): Azure Connected Machine Agent Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Azure Connected Machine Agent)
- [CVE-2024-21327](https://cve.now/CVE-2024-21327.md): Microsoft Dynamics 365 Customer Engagement Cross-Site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 Customer Engagement)
- [CVE-2024-20667](https://cve.now/CVE-2024-20667.md): Azure DevOps Server Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Azure DevOps Server)
- [CVE-2023-20570](https://cve.now/CVE-2023-20570.md): Insufficient verification of data authenticity in the configuration state machine may allow a local attacker to potentially load arbitrary b (CVSS 3.3, AMD Alveo™ Card · AMD Kintex™ UltraScale™ FPGA +4)
- [CVE-2024-1140](https://cve.now/CVE-2024-1140.md): Twister Antivirus v8.17 - Out-of-bounds Read (CVSS 6.1, Filseclab Twister Antivirus)
- [CVE-2024-23440](https://cve.now/CVE-2024-23440.md): Vba32 Antivirus v3.36.0 - Arbitrary Memory Read (CVSS 7.1, VirusBlokAda Vba32 Antivirus)
- [CVE-2024-23439](https://cve.now/CVE-2024-23439.md): Vba32 Antivirus v3.36.0 - Arbitrary Memory Read (CVSS 7.1, VirusBlokAda Vba32 Antivirus)
- [CVE-2024-1096](https://cve.now/CVE-2024-1096.md): Twister Antivirus v8.17 - Denial of Service (CVSS 5.5, Filseclab Twister Antivirus)
- [CVE-2024-1163](https://cve.now/CVE-2024-1163.md): Path traversal vulnerability in mapshaper (CVSS 7.7, mbloch/mapshaper · mapshaper)
- [CVE-2023-6516](https://cve.now/CVE-2023-6516.md): Specific recursive query patterns may lead to an out-of-memory condition (CVSS 7.5, ISC BIND)
- [CVE-2023-5680](https://cve.now/CVE-2023-5680.md): Cleaning an ECS-enabled cache may cause excessive CPU load (CVSS 5.3, ISC BIND)
- [CVE-2023-5679](https://cve.now/CVE-2023-5679.md): Enabling both DNS64 and serve-stale may cause an assertion failure during recursive resolution (CVSS 7.5, ISC BIND)
- [CVE-2023-5517](https://cve.now/CVE-2023-5517.md): Querying RFC 1918 reverse zones may cause an assertion failure when "nxdomain-redirect" is enabled (CVSS 7.5, ISC BIND)
- [CVE-2023-4408](https://cve.now/CVE-2023-4408.md): Parsing large DNS messages may cause excessive CPU load (CVSS 7.5, ISC BIND)
- [CVE-2024-24782](https://cve.now/CVE-2024-24782.md): HIMA: Origin Validation Error in multiple products (CVSS 4.3, HIMA F30 03X YY · HIMA F35 03X YY +6)
- [CVE-2024-24781](https://cve.now/CVE-2024-24781.md): Hima: Uncontrolled Resource Consumption in multiple products (CVSS 7.5, HIMA F30 03X YY · HIMA F35 03X YY +7)
- [CVE-2024-1309](https://cve.now/CVE-2024-1309.md): Resource Consumption Identified in NTP before 4.2.4p8 and 4.2.5 (CVSS 6.5, Honeywell Niagara Framework)
- [CVE-2023-6072](https://cve.now/CVE-2023-6072.md): A cross-site scripting vulnerability in Trellix Central Management (CM) prior to 9.1.3.97129 allows a remote authenticated attacker to craf (CVSS 4.6, Trellix Central Management)
- [CVE-2024-1159](https://cve.now/CVE-2024-1159.md): Bold Page Builder \<= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Raw Content (CVSS 6.4, boldthemes Bold Page Builder)
- [CVE-2024-1157](https://cve.now/CVE-2024-1157.md): Bold Page Builder \<= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button URL (CVSS 5.4, boldthemes Bold Page Builder)
- [CVE-2024-1160](https://cve.now/CVE-2024-1160.md): Bold Page Builder \<= 4.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Icon Link (CVSS 5.4, boldthemes Bold Page Builder)
- [CVE-2024-24925](https://cve.now/CVE-2024-24925.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2306.0000). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-24924](https://cve.now/CVE-2024-24924.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2306.0000). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-24923](https://cve.now/CVE-2024-24923.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2401.0000), Simcenter Femap (All versions \< V2306.0001). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-24922](https://cve.now/CVE-2024-24922.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2401.0000). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-24921](https://cve.now/CVE-2024-24921.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2401.0000). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-24920](https://cve.now/CVE-2024-24920.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2401.0000). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-23816](https://cve.now/CVE-2024-23816.md): A vulnerability has been identified in Location Intelligence Perpetual Large (9DE5110-8CA13-1AX0) (All versions \< V4.3), Location Intelligen (CVSS 9.8, Siemens Location Intelligence Perpetual Large · Siemens… +6)
- [CVE-2024-23813](https://cve.now/CVE-2024-23813.md): A vulnerability has been identified in Polarion ALM (All versions \< V2404.0). (CVSS 7.3, Siemens Polarion ALM)
- [CVE-2024-23812](https://cve.now/CVE-2024-23812.md): A vulnerability has been identified in SINEC NMS (All versions \< V2.0 SP1). (CVSS 8.0, Siemens SINEC NMS)
- [CVE-2024-23811](https://cve.now/CVE-2024-23811.md): A vulnerability has been identified in SINEC NMS (All versions \< V2.0 SP1). (CVSS 8.8, Siemens SINEC NMS)
- [CVE-2024-23810](https://cve.now/CVE-2024-23810.md): A vulnerability has been identified in SINEC NMS (All versions \< V2.0 SP1). (CVSS 8.8, Siemens SINEC NMS)
- [CVE-2024-23804](https://cve.now/CVE-2024-23804.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0012), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-23803](https://cve.now/CVE-2024-23803.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions \< V (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-23802](https://cve.now/CVE-2024-23802.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0012), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-23801](https://cve.now/CVE-2024-23801.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions \< V (CVSS 3.3, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-23800](https://cve.now/CVE-2024-23800.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions \< V (CVSS 3.3, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-23799](https://cve.now/CVE-2024-23799.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions), Tecnomatix Plant Simulation V2302 (All versions \< V (CVSS 3.3, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-23798](https://cve.now/CVE-2024-23798.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0012), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-23797](https://cve.now/CVE-2024-23797.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0012), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-23796](https://cve.now/CVE-2024-23796.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0012), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-23795](https://cve.now/CVE-2024-23795.md): A vulnerability has been identified in Tecnomatix Plant Simulation V2201 (All versions \< V2201.0012), Tecnomatix Plant Simulation V2302 (All (CVSS 7.8, Siemens Tecnomatix Plant Simulation)
- [CVE-2024-22043](https://cve.now/CVE-2024-22043.md): A vulnerability has been identified in Parasolid V35.0 (All versions \< V35.0.251), Parasolid V35.1 (All versions \< V35.1.170). (CVSS 3.3, Siemens Parasolid)
- [CVE-2024-22042](https://cve.now/CVE-2024-22042.md): A vulnerability has been identified in Unicam FX (All versions). (CVSS 7.8, Siemens Unicam FX)
- [CVE-2023-51440](https://cve.now/CVE-2023-51440.md): A vulnerability has been identified in SIMATIC CP 343-1 (6GK7343-1EX30-0XE0) (All versions), SIMATIC CP 343-1 Lean (6GK7343-1CX10-0XE0) (All (CVSS 7.5, Siemens SIMATIC CP 343-1 · Siemens SIPLUS NET CP 343-1)
- [CVE-2023-50236](https://cve.now/CVE-2023-50236.md): A vulnerability has been identified in Polarion ALM (All versions \< V2404.0). (CVSS 7.8, Siemens Polarion ALM)
- [CVE-2023-49125](https://cve.now/CVE-2023-49125.md): A vulnerability has been identified in Parasolid V35.0 (All versions \< V35.0.263), Parasolid V35.1 (All versions \< V35.1.252), Parasolid V36 (CVSS 7.8, Siemens Parasolid · Siemens Solid Edge SE2023 +1)
- [CVE-2023-48364](https://cve.now/CVE-2023-48364.md): A vulnerability has been identified in OpenPCS 7 V9.1 (All versions \< V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions \< V9.1 SP2 UC05), SIM (CVSS 6.5, Siemens OpenPCS 7 · Siemens SIMATIC BATCH +4)
- [CVE-2023-48363](https://cve.now/CVE-2023-48363.md): A vulnerability has been identified in OpenPCS 7 V9.1 (All versions \< V9.1 SP2 UC05), SIMATIC BATCH V9.1 (All versions \< V9.1 SP2 UC05), SIM (CVSS 6.5, Siemens OpenPCS 7 · Siemens SIMATIC BATCH +4)
- [CVE-2024-22445](https://cve.now/CVE-2024-22445.md): Dell PowerProtect Data Manager, version 19.15 and prior versions, contain an OS command injection vulnerability. (CVSS 7.2, Dell PowerProtect Data Manager)
- [CVE-2024-22454](https://cve.now/CVE-2024-22454.md): Dell PowerProtect Data Manager, version 19.15 and prior versions, contain a weak password recovery mechanism for forgotten passwords. (CVSS 8.8, Dell PowerProtect Data Manager)
- [CVE-2023-6815](https://cve.now/CVE-2023-6815.md): Incorrect Privilege Assignment vulnerability in Mitsubishi Electric Corporation MELSEC iQ-R Series Safety CPU R08/16/32/120SFCPU all version (CVSS 6.5, Mitsubishi Electric MELSEC iQ-R Series Safety CPU R08SFC… +6)
- [CVE-2024-25914](https://cve.now/CVE-2024-25914.md): WordPress SMTP Mail Plugin \<= 1.3.20 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Photoboxone SMTP Mail)
- [CVE-2024-21491](https://cve.now/CVE-2024-21491.md): Versions of the package svix before 1.17.0 are vulnerable to Authentication Bypass due to an issue in the verify function where signatures o (CVSS 5.9, svix)
- [CVE-2024-22024](https://cve.now/CVE-2024-22024.md): An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and (CVSS 8.3, Ivanti ICS · Ivant ICS +1)
- [CVE-2024-24741](https://cve.now/CVE-2024-24741.md): Missing Authorization check in SAP Master Data Governance Material (CVSS 4.3, SAP\_SE SAP Master Data Governance Material)
- [CVE-2024-22129](https://cve.now/CVE-2024-22129.md): Cross-Site Scripting (XSS) vulnerability in SAP Companion (CVSS 5.4, SAP\_SE SAP Companion)
- [CVE-2024-25643](https://cve.now/CVE-2024-25643.md): Missing authorization check in SAP Fiori app (My Overtime Requests) (CVSS 4.3, SAP\_SE SAP Fiori app)
- [CVE-2023-50358](https://cve.now/CVE-2023-50358.md): QTS, QuTS hero, QuTScloud (CVSS 5.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2024-25642](https://cve.now/CVE-2024-25642.md): Improper Certificate Validation in SAP Cloud Connector (CVSS 7.4, SAP\_SE SAP Cloud Connector)
- [CVE-2023-47218](https://cve.now/CVE-2023-47218.md): QTS, QuTS hero, QuTScloud (CVSS 5.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2024-24743](https://cve.now/CVE-2024-24743.md): XXE vulnerability in SAP NetWeaver AS Java (Guided Procedures) (CVSS 8.6, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2024-24742](https://cve.now/CVE-2024-24742.md): Cross-Site Scripting (XSS) vulnerability in SAP CRM (WebClient UI) (CVSS 4.1, SAP\_SE SAP CRM)
- [CVE-2024-24740](https://cve.now/CVE-2024-24740.md): Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (SAP Kernel) (CVSS 5.3, SAP\_SE SAP NetWeaver Application Server ABAP)
- [CVE-2024-24739](https://cve.now/CVE-2024-24739.md): Missing authorization check in SAP BAM (Bank Account Management) (CVSS 6.3, SAP\_SE SAP BAM)
- [CVE-2024-22132](https://cve.now/CVE-2024-22132.md): Code Injection vulnerability in SAP IDES Systems (CVSS 7.4, SAP\_SE SAP IDES Systems)
- [CVE-2024-22131](https://cve.now/CVE-2024-22131.md): Code Injection vulnerability in SAP ABA (Application Basis) (CVSS 9.1, SAP\_SE SAP ABA)
- [CVE-2024-22130](https://cve.now/CVE-2024-22130.md): Cross-Site Scripting (XSS) vulnerability in SAP CRM WebClient UI (CVSS 7.6, SAP\_SE SAP CRM WebClient UI)
- [CVE-2024-22128](https://cve.now/CVE-2024-22128.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Business Client for HTML (CVSS 4.7, SAP\_SE SAP NetWeaver Business Client for HTML)
- [CVE-2024-22126](https://cve.now/CVE-2024-22126.md): Cross Site Scripting vulnerability in SAP NetWeaver AS Java (User Admin Application) (CVSS 6.1, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2022-48623](https://cve.now/CVE-2022-48623.md): The Cpanel::JSON::XS package before 4.33 for Perl performs out-of-bounds accesses in a way that allows attackers to obtain sensitive informa (CVSS 9.1)
- [CVE-2023-26562](https://cve.now/CVE-2023-26562.md): In Zimbra Collaboration (ZCS) 8.8.15 and 9.0, a closed account (with 2FA and generated passwords) can send e-mail messages when configured f (CVSS 6.5)
- [CVE-2023-38960](https://cve.now/CVE-2023-38960.md): Insecure Permissions issue in Raiden Professional Server RaidenFTPD v.2.4 build 4005 allows a local attacker to gain privileges and execute (CVSS 7.3)
- [CVE-2023-42374](https://cve.now/CVE-2023-42374.md): An issue in mystenlabs Sui Blockchain before v.1.6.3 allow a remote attacker to execute arbitrary code and cause a denial of service via a c (CVSS 9.8)
- [CVE-2023-45206](https://cve.now/CVE-2023-45206.md): An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. (CVSS 6.1)
- [CVE-2023-45207](https://cve.now/CVE-2023-45207.md): An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. (CVSS 6.1)
- [CVE-2023-48432](https://cve.now/CVE-2023-48432.md): An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0. (CVSS 6.1)
- [CVE-2023-49339](https://cve.now/CVE-2023-49339.md): Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retri (CVSS 6.5)
- [CVE-2023-50808](https://cve.now/CVE-2023-50808.md): Zimbra Collaboration before Kepler 9.0.0 Patch 38 GA allows DOM-based JavaScript injection in the Modern UI. (CVSS 9.1)
- [CVE-2023-52059](https://cve.now/CVE-2023-52059.md): A cross-site scripting (XSS) vulnerability in Gestsup v3.2.46 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa (CVSS 5.4)
- [CVE-2023-52060](https://cve.now/CVE-2023-52060.md): A Cross-Site Request Forgery (CSRF) in Gestsup v3.2.46 allows attackers to arbitrarily edit user profile information via a crafted request. (CVSS 4.3)
- [CVE-2023-52431](https://cve.now/CVE-2023-52431.md): The Plack::Middleware::XSRFBlock package before 0.0.19 for Perl allows attackers to bypass a CSRF protection mechanism via an empty form val (CVSS 8.8)
- [CVE-2024-22923](https://cve.now/CVE-2024-22923.md): SQL injection vulnerability in adv radius v.2.2.5 allows a local attacker to execute arbitrary code via a crafted script. (CVSS 9.8)
- [CVE-2024-24142](https://cve.now/CVE-2024-24142.md): Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter. (CVSS 9.8)
- [CVE-2024-25407](https://cve.now/CVE-2024-25407.md): SteVe v3.6.0 was discovered to use predictable transaction ID's when receiving a StartTransaction request. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.