CVEs published February 15, 2024
103 CVEs were published on February 15, 2024: 22 critical, 42 high. 1 is now in CISA KEV.
- Published
- 103
- Critical
- 22
- High
- 42
- Medium
- 38
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 29
Most affected products
- Adobe Acrobat Reader
- 13
- Google Android
- 13
- FreeBSD
- 12
- Adobe Substance3D - Painter
- 9
- SolarWinds Access Rights Manager
- 5
- Adobe Commerce · magento/community-edition +1
- 4
- Comarch ERP XL
- 3
- Utarit Information Technologies SoliPay Mobile App
- 3
- Dell ESI (Enterprise Storage Integrator) for SAP LAMA
- 2
- Dell SmartFabric OS10
- 2
Critical 22
- CVE-2023-40115In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free.Google Android
- CVE-2023-40057SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code ExecutionSolarWinds Access Rights Manager
- CVE-2024-23476SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-23479SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution VulnerabilitySolarWinds Access Rights Manager
- CVE-2023-5155SQLi in Utarit's Smart Deposit SystemUtarit Information Technologies SoliPay Mobile App
- CVE-2023-7081SQLi in PosTahsil's Online Payment SystemPOSTAHSİL Online Payment System
- CVE-2024-23113A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, FoFortinet FortiSwitchManager · Fortinet FortiOS +2
- CVE-2024-20719[Adobe Commerce] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297Adobe Commerce · magento/community-edition +1
- CVE-2024-20720Command injection in data collector backup due to insufficient patching of CVE-2023-38208Adobe Commerce · magento/community-edition +1
- CVE-2023-39245 DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component.Dell ESI (Enterprise Storage Integrator) for SAP LAMA
- CVE-2023-32484 Dell Networking Switches running Enterprise SONiC versions 4.1.0, 4.0.5, 3.5.4 and below contains an improper input validation vulnerabilitDell Enterprise SONiC OS
- CVE-2023-32462 Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authenticatioDell SmartFabric OS10
- CVE-2023-28078 Dell OS10 Networking Switches running 10.5.2.x and above contain a vulnerability with zeroMQ when VLT is configured.Dell SmartFabric OS10
- CVE-2024-20738Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability | CVE-2023-44324 bypassAdobe Framemaker Publishing Server
- CVE-2022-23088802.11 heap buffer overflowFreeBSD
- CVE-2022-23086mpr/mps/mpt driver ioctl heap out-of-bounds writeFreeBSD
- CVE-2022-23085Potential jail escape vulnerabilities in netmapFreeBSD
- CVE-2024-26264EBM Technologies RISWEB - SQL InjectionEBM Technologies RISWEB
- CVE-2024-26261Hgiga OAKlouds - Arbitrary File Read And DeleteHgiga OAKlouds
- CVE-2024-26260Hgiga OAKlouds - Command InjectionHgiga OAKlouds
- CVE-2024-23674The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing.
- CVE-2024-25502Directory Traversal vulnerability in flusity CMS v.2.4 allows a remote attacker to execute arbitrary code and obtain sensitive information v
High 42
- CVE-2023-40114In multiple functions of MtpFfsHandle.cpp , there is a possible out of bounds write due to a use after free.Google Android
- CVE-2023-40111In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system_server due to a cGoogle Android
- CVE-2023-40109In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass.Google Android
- CVE-2023-40107In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data.Google Android
- CVE-2023-40106In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass.Google Android
- CVE-2023-40104In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates.Google Android
- CVE-2023-40100In discovery_thread of Dns64Configuration.cpp, there is a possible memory corruption due to a use after free.Google Android
- CVE-2024-25123Path Manipulation in file mslib/index.py in MSSOpen-MSS MSS
- CVE-2023-6123Improper Neutralization vulnerability affects OpenText ALM Octane.OpenText ALM Octane.
- CVE-2024-0622Local privilege escalation vulnerability could affect OpenText Operations Agent on Non-Windows platforms. opentext Operations Agent
- CVE-2024-23477SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution VulnerabilitySolarWinds Access Rights Manager
- CVE-2024-23478SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code ExecutionSolarWinds Access Rights Manager
- CVE-2023-6255Hardcoded Credentals in SoliClub Mobile AppUtarit Information Technologies SoliPay Mobile App
- CVE-2023-4993Sensetive Data Exposure in Utarit's SoliclubUtarit Information Technologies SoliPay Mobile App
- CVE-2023-45581An improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.6 Fortinet FortiClientEMS
- CVE-2023-39244DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component.Dell ESI (Enterprise Storage Integrator) for SAP LAMA
- CVE-2024-20750Adobe Substance 3D Designer PICT Parsing Out-Of-Bounds Read VulnerabilityAdobe Substance3D - Designer
- CVE-2024-20739ZDI-CAN-22647: Adobe Audition AVI File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Audition
- CVE-2024-20726[TianfuCup] JP2K Image Parsing Out-Of-Bounds WriteAdobe Acrobat Reader
- CVE-2024-20730TALOS-2023-1906 - Adobe Acrobat Reader Font CPAL integer overflow vulnerabilityAdobe Acrobat Reader
- CVE-2024-20731TALOS-2023-1901 - Adobe Acrobat Reader FileAttachment PDAnnot destroy use-after-free vulnerabilityAdobe Acrobat Reader
- CVE-2024-20727[TianfuCup] out-of-bounds access vulnerability when parsing jpeg2000Adobe Acrobat Reader
- CVE-2024-20728ZDI-CAN-22727: Adobe Acrobat Pro DC Annotation Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2024-20729TALOS-2023-1890 - Adobe Acrobat Reader Annot3D object zoom event use-after-free vulnerabilityAdobe Acrobat Reader
- CVE-2024-20744Adobe Substance 3D Paint PICT Parsing Access Violation Write VulnerabilityAdobe Substance3D - Painter
- CVE-2024-20743Adobe Substance 3D Paint PSD Parsing Out-Of-Bounds Write VulnerabilityAdobe Substance3D - Painter
- CVE-2024-20740Adobe Substance 3D Paint PSD Parsing Out-Of-Bounds Write VulnerabilityAdobe Substance3D - Painter
- CVE-2024-20742Adobe Substance 3D Paint RAS File Parsing Out-Of-Bounds Read VulnerabilityAdobe Substance3D - Painter
- CVE-2024-20741Adobe Substance 3D Paint ICO Parsing Access Violation Write VulnerabilityAdobe Substance3D - Painter
- CVE-2024-20723Adobe Substance 3D Painter v9.0.1Build2822 Buffer Overflow VulnerabilityAdobe Substance3D - Painter
- CVE-2023-4539Hardcoded password in Comarch ERP XLComarch ERP XL
- CVE-2023-4537Protocol Downgrade in Comarch ERP XLComarch ERP XL
- CVE-2024-0353Local privilege escalation in Windows productsESET, spol. s r.o. ESET NOD32 Antivirus · ESET, spol. s… +9
- CVE-2022-23092Missing bounds check in 9p message handlingFreeBSD
- CVE-2022-23090AIO credential reference count leakFreeBSD
- CVE-2024-1488Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalationunbound · Red Hat Enterprise Linux
- CVE-2022-23087Bhyve e82545 device emulation out-of-bounds writeFreeBSD
- CVE-2022-23084Potential jail escape vulnerabilities in netmapFreeBSD
- CVE-2024-26262EBM Technologies Uniweb/SoliPACS WebServer - SQL InjectionEBM Technologies Uniweb/SoliPACS WebServer
- CVE-2024-1523EC-WEB FS-EZViewer(Web) - SQL InjectionEC-WEB FS-EZViewer
- CVE-2023-51787An issue was discovered in Wind River VxWorks 7 22.09 and 23.03.
- CVE-2024-24386An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.
Medium, low and unrated 39
- CVE-2023-40124In multiple locations, there is a possible cross-user read due to a confused deputy.Google Android
- CVE-2023-40113In multiple locations, there is a possible way for apps to access cross-user message data due to a missing permission check.Google Android
- CVE-2023-40112In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2023-40110In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow.Google Android
- CVE-2023-40105In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check.Google Android
- CVE-2024-0240Silicon Labs EFR32 Bluetooth stack denial of service when sending notifications to multiple clientssilabs.com GSDK
- CVE-2024-21728Extension - smartcalc.es - Open redirect vulnerability in osTicky component for Joomla <= 2.2.8smartcalc.es osTicky component for Joomla
- CVE-2023-6937Improper (D)TLS key boundary enforcementwolfSSL
- CVE-2023-47537An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 throughFortinet FortiOS
- CVE-2023-44253An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in Fortinet FortiManager version 7.4.0 through 7.4.1 aFortinet FortiManager · Fortinet FortiAnalyzer
- CVE-2023-26206An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9Fortinet FortiNAC
- CVE-2024-20716Force high-usage of resources by generating unlimited coupons: Adobe CommerceAdobe Commerce · magento/community-edition +1
- CVE-2024-20717Stored admin XSS via PayPal authentication certificate Adobe Commerce
- CVE-2024-20718[Spain] CSRF to delete Requisition Lists at Adobe CommerceAdobe Commerce · magento/community-edition +1
- CVE-2024-1530ECshop view_sendlist.php sql injectionECshop
- CVE-2024-20747TALOS-2023-1908 - Adobe Acrobat Reader Font CharStrings INDEX out-of-bounds read vulnerabilityAdobe Acrobat Reader
- CVE-2024-20733[ZS-VR-23-360] Adobe Acrobat Reader Parsing OTF font Denial-of-Service VulnerabilityAdobe Acrobat Reader
- CVE-2024-20748TALOS-2023-1909 - Adobe Acrobat Reader Font avar SegmentMaps out-of-bounds read vulnerabilityAdobe Acrobat Reader
- CVE-2024-20734ZDI-CAN-22516: Adobe Acrobat Pro DC AcroForm Use-After-Free Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2024-20736ZDI-CAN-22822: Adobe Acrobat Pro DC AcroForm Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2024-20749TALOS-2023-1910 - Adobe Acrobat Reader Font CharStrings CharStringsOffset out-of-bounds read vulnerabilityAdobe Acrobat Reader
- CVE-2024-20735TALOS-2023-1905 - Adobe Acrobat Reader Font CPAL numColorRecords out-of-bounds read vulnerabilityAdobe Acrobat Reader
- CVE-2024-20724Adobe Substance 3D Painter v9.0.1Build2822 OOBR Vulnerability IIAdobe Substance3D - Painter
- CVE-2024-20722Adobe Substance 3D Painter v9.0.1Build2822 OOBR Vulnerability IIIAdobe Substance3D - Painter
- CVE-2024-20725Adobe Substance 3D Painter v9.0.1Build2822 OOBR Vulnerability IAdobe Substance3D - Painter
- CVE-2024-0390Hard-coded credentials in iZZi connect applicationINPRAX iZZi connect
- CVE-2023-4538Shared Key in Comarch ERP XLComarch ERP XL
- CVE-2024-21727Extension - digtal-peak.com - XSS vulnerability in DP Calendar component for Joomla 8.0.0-8.0.14digital-peak.com DP Calendar for Joomla
- CVE-2024-0708Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.2 - Unauthenticated Information Exposurefatcatapps Landing Page Cat – Coming Soon & Maintenance Pag…
- CVE-2023-46596Improper input validation in FireFlow’s VisualFlow workflow editorAlgosec FireFlow
- CVE-2022-23093Stack overflow in ping(8)FreeBSD
- CVE-2022-23091Memory disclosure by stale virtual memory mappingFreeBSD
- CVE-2022-23089Out of bound read in elf_note_prpsinfo()FreeBSD
- CVE-2024-25559URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8.appleple a-blog cms
- CVE-2024-25941jail(2) information leakFreeBSD
- CVE-2024-25940bhyveload(8) host file accessFreeBSD
- CVE-2024-26263EBM Technologies RISWEB - Improper Access ControlEBM Technologies RISWEB
- CVE-2024-24256SQL Injection vulnerability in Yonyou space-time enterprise information integration platform v.9.0 and before allows an attacker to obtain s
- CVE-2024-25373Tenda AC10V4.0 V16.03.10.20 was discovered to contain a stack overflow via the page parameter in the sub_49B384 function.