# CVEs published 2024-02-15

103 CVEs were published on February 15, 2024: 22 critical, 42 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-40124](https://cve.now/CVE-2023-40124.md): In multiple locations, there is a possible cross-user read due to a confused deputy. (CVSS 5.5, Google Android)
- [CVE-2023-40115](https://cve.now/CVE-2023-40115.md): In readLogs of StatsService.cpp, there is a possible memory corruption due to a use after free. (CVSS 9.8, Google Android)
- [CVE-2023-40114](https://cve.now/CVE-2023-40114.md): In multiple functions of MtpFfsHandle.cpp , there is a possible out of bounds write due to a use after free. (CVSS 8.4, Google Android)
- [CVE-2023-40113](https://cve.now/CVE-2023-40113.md): In multiple locations, there is a possible way for apps to access cross-user message data due to a missing permission check. (CVSS 5.5, Google Android)
- [CVE-2023-40112](https://cve.now/CVE-2023-40112.md): In ippSetValueTag of ipp.c, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.1, Google Android)
- [CVE-2023-40111](https://cve.now/CVE-2023-40111.md): In setMediaButtonReceiver of MediaSessionRecord.java, there is a possible way to send a pending intent on behalf of system\_server due to a c (CVSS 7.8, Google Android)
- [CVE-2023-40110](https://cve.now/CVE-2023-40110.md): In multiple functions of MtpPacket.cpp, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 6.2, Google Android)
- [CVE-2023-40109](https://cve.now/CVE-2023-40109.md): In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass. (CVSS 7.3, Google Android)
- [CVE-2023-40107](https://cve.now/CVE-2023-40107.md): In ARTPWriter of ARTPWriter.cpp, there is a possible use after free due to uninitialized data. (CVSS 7.4, Google Android)
- [CVE-2023-40106](https://cve.now/CVE-2023-40106.md): In sanitizeSbn of NotificationManagerService.java, there is a possible way to launch an activity from the background due to BAL Bypass. (CVSS 7.8, Google Android)
- [CVE-2023-40105](https://cve.now/CVE-2023-40105.md): In backupAgentCreated of ActivityManagerService.java, there is a possible way to leak sensitive data due to a missing permission check. (CVSS 5.5, Google Android)
- [CVE-2023-40104](https://cve.now/CVE-2023-40104.md): In ca-certificates, there is a possible way to read encrypted TLS data due to untrusted cryptographic certificates. (CVSS 7.5, Google Android)
- [CVE-2023-40100](https://cve.now/CVE-2023-40100.md): In discovery\_thread of Dns64Configuration.cpp, there is a possible memory corruption due to a use after free. (CVSS 8.4, Google Android)
- [CVE-2024-25123](https://cve.now/CVE-2024-25123.md): Path Manipulation in file mslib/index.py in MSS (CVSS 7.3, Open-MSS MSS)
- [CVE-2023-6123](https://cve.now/CVE-2023-6123.md): Improper Neutralization vulnerability affects OpenText ALM Octane. (CVSS 7.5, OpenText ALM Octane.)
- [CVE-2024-0622](https://cve.now/CVE-2024-0622.md): Local privilege escalation vulnerability could affect OpenText Operations Agent on Non-Windows platforms. (CVSS 8.8, opentext Operations Agent)
- [CVE-2023-40057](https://cve.now/CVE-2023-40057.md): SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution (CVSS 9.0, SolarWinds Access Rights Manager)
- [CVE-2024-23477](https://cve.now/CVE-2024-23477.md): SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability (CVSS 7.9, SolarWinds Access Rights Manager)
- [CVE-2024-23476](https://cve.now/CVE-2024-23476.md): SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-23478](https://cve.now/CVE-2024-23478.md): SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution (CVSS 8.0, SolarWinds Access Rights Manager)
- [CVE-2024-23479](https://cve.now/CVE-2024-23479.md): SolarWinds Access Rights Manager (ARM) Directory Traversal Remote Code Execution Vulnerability (CVSS 9.6, SolarWinds Access Rights Manager)
- [CVE-2024-0240](https://cve.now/CVE-2024-0240.md): Silicon Labs EFR32 Bluetooth stack denial of service when sending notifications to multiple clients (CVSS 6.5, silabs.com GSDK)
- [CVE-2024-21728](https://cve.now/CVE-2024-21728.md): Extension - smartcalc.es - Open redirect vulnerability in osTicky component for Joomla \<= 2.2.8 (CVSS 6.1, smartcalc.es osTicky component for Joomla)
- [CVE-2023-6937](https://cve.now/CVE-2023-6937.md): Improper (D)TLS key boundary enforcement (CVSS 5.3, wolfSSL)
- [CVE-2023-6255](https://cve.now/CVE-2023-6255.md): Hardcoded Credentals in SoliClub Mobile App (CVSS 7.5, Utarit Information Technologies SoliPay Mobile App)
- [CVE-2023-5155](https://cve.now/CVE-2023-5155.md): SQLi in Utarit's Smart Deposit System (CVSS 9.8, Utarit Information Technologies SoliPay Mobile App)
- [CVE-2023-4993](https://cve.now/CVE-2023-4993.md): Sensetive Data Exposure in Utarit's Soliclub (CVSS 7.5, Utarit Information Technologies SoliPay Mobile App)
- [CVE-2023-7081](https://cve.now/CVE-2023-7081.md): SQLi in PosTahsil's Online Payment System (CVSS 9.8, POSTAHSİL Online Payment System)
- [CVE-2024-23113](https://cve.now/CVE-2024-23113.md): A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, Fo (CVSS 9.8, KEV, Fortinet FortiSwitchManager · Fortinet FortiOS +2)
- [CVE-2023-47537](https://cve.now/CVE-2023-47537.md): An improper certificate validation vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.6, FortiOS 7.0.0 through (CVSS 4.4, Fortinet FortiOS)
- [CVE-2023-44253](https://cve.now/CVE-2023-44253.md): An exposure of sensitive information to an unauthorized actor vulnerability \[CWE-200\] in Fortinet FortiManager version 7.4.0 through 7.4.1 a (CVSS 4.7, Fortinet FortiManager · Fortinet FortiAnalyzer)
- [CVE-2023-45581](https://cve.now/CVE-2023-45581.md): An improper privilege management vulnerability \[CWE-269\] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.6 (CVSS 7.9, Fortinet FortiClientEMS)
- [CVE-2023-26206](https://cve.now/CVE-2023-26206.md): An improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC 9.4.0 - 9.4.2, 9.2.0 - 9.2.8, 9 (CVSS 6.8, Fortinet FortiNAC)
- [CVE-2024-20716](https://cve.now/CVE-2024-20716.md): Force high-usage of resources by generating unlimited coupons: Adobe Commerce (CVSS 4.9, Adobe Commerce · magento/community-edition +1)
- [CVE-2024-20717](https://cve.now/CVE-2024-20717.md): Stored admin XSS via PayPal authentication certificate (CVSS 5.4, Adobe Commerce)
- [CVE-2024-20718](https://cve.now/CVE-2024-20718.md): \[Spain\] CSRF to delete Requisition Lists at Adobe Commerce (CVSS 4.3, Adobe Commerce · magento/community-edition +1)
- [CVE-2024-20719](https://cve.now/CVE-2024-20719.md): \[Adobe Commerce\] Stored XSS from low privileged admin user on every admin page, bypassing CVE-2023-29297 (CVSS 9.1, Adobe Commerce · magento/community-edition +1)
- [CVE-2024-20720](https://cve.now/CVE-2024-20720.md): Command injection in data collector backup due to insufficient patching of CVE-2023-38208 (CVSS 9.1, Adobe Commerce · magento/community-edition +1)
- [CVE-2023-39245](https://cve.now/CVE-2023-39245.md): DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. (CVSS 9.8, Dell ESI (Enterprise Storage Integrator) for SAP LAMA)
- [CVE-2023-39244](https://cve.now/CVE-2023-39244.md): DELL ESI (Enterprise Storage Integrator) for SAP LAMA, version 10.0, contains an information disclosure vulnerability in EHAC component. (CVSS 7.3, Dell ESI (Enterprise Storage Integrator) for SAP LAMA)
- [CVE-2023-32484](https://cve.now/CVE-2023-32484.md): Dell Networking Switches running Enterprise SONiC versions 4.1.0, 4.0.5, 3.5.4 and below contains an improper input validation vulnerabilit (CVSS 9.8, Dell Enterprise SONiC OS)
- [CVE-2024-1530](https://cve.now/CVE-2024-1530.md): ECshop view\_sendlist.php sql injection (CVSS 6.3, ECshop)
- [CVE-2023-32462](https://cve.now/CVE-2023-32462.md): Dell OS10 Networking Switches running 10.5.2.x and above contain an OS command injection vulnerability when using remote user authenticatio (CVSS 9.8, Dell SmartFabric OS10)
- [CVE-2023-28078](https://cve.now/CVE-2023-28078.md): Dell OS10 Networking Switches running 10.5.2.x and above contain a vulnerability with zeroMQ when VLT is configured. (CVSS 9.1, Dell SmartFabric OS10)
- [CVE-2024-20750](https://cve.now/CVE-2024-20750.md): Adobe Substance 3D Designer PICT Parsing Out-Of-Bounds Read Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2024-20739](https://cve.now/CVE-2024-20739.md): ZDI-CAN-22647: Adobe Audition AVI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Audition)
- [CVE-2024-20738](https://cve.now/CVE-2024-20738.md): Adobe FrameMaker Publishing Server Authentication Bypass Vulnerability | CVE-2023-44324 bypass (CVSS 9.8, Adobe Framemaker Publishing Server)
- [CVE-2024-20726](https://cve.now/CVE-2024-20726.md): \[TianfuCup\] JP2K Image Parsing Out-Of-Bounds Write (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-20730](https://cve.now/CVE-2024-20730.md): TALOS-2023-1906 - Adobe Acrobat Reader Font CPAL integer overflow vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-20731](https://cve.now/CVE-2024-20731.md): TALOS-2023-1901 - Adobe Acrobat Reader FileAttachment PDAnnot destroy use-after-free vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-20727](https://cve.now/CVE-2024-20727.md): \[TianfuCup\] out-of-bounds access vulnerability when parsing jpeg2000 (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-20747](https://cve.now/CVE-2024-20747.md): TALOS-2023-1908 - Adobe Acrobat Reader Font CharStrings INDEX out-of-bounds read vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-20733](https://cve.now/CVE-2024-20733.md): \[ZS-VR-23-360\] Adobe Acrobat Reader Parsing OTF font Denial-of-Service Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-20748](https://cve.now/CVE-2024-20748.md): TALOS-2023-1909 - Adobe Acrobat Reader Font avar SegmentMaps out-of-bounds read vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-20734](https://cve.now/CVE-2024-20734.md): ZDI-CAN-22516: Adobe Acrobat Pro DC AcroForm Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-20728](https://cve.now/CVE-2024-20728.md): ZDI-CAN-22727: Adobe Acrobat Pro DC Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-20736](https://cve.now/CVE-2024-20736.md): ZDI-CAN-22822: Adobe Acrobat Pro DC AcroForm Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-20749](https://cve.now/CVE-2024-20749.md): TALOS-2023-1910 - Adobe Acrobat Reader Font CharStrings CharStringsOffset out-of-bounds read vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-20729](https://cve.now/CVE-2024-20729.md): TALOS-2023-1890 - Adobe Acrobat Reader Annot3D object zoom event use-after-free vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-20735](https://cve.now/CVE-2024-20735.md): TALOS-2023-1905 - Adobe Acrobat Reader Font CPAL numColorRecords out-of-bounds read vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2024-20744](https://cve.now/CVE-2024-20744.md): Adobe Substance 3D Paint PICT Parsing Access Violation Write Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-20724](https://cve.now/CVE-2024-20724.md): Adobe Substance 3D Painter v9.0.1Build2822 OOBR Vulnerability II (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2024-20743](https://cve.now/CVE-2024-20743.md): Adobe Substance 3D Paint PSD Parsing Out-Of-Bounds Write Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-20722](https://cve.now/CVE-2024-20722.md): Adobe Substance 3D Painter v9.0.1Build2822 OOBR Vulnerability III (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2024-20740](https://cve.now/CVE-2024-20740.md): Adobe Substance 3D Paint PSD Parsing Out-Of-Bounds Write Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-20742](https://cve.now/CVE-2024-20742.md): Adobe Substance 3D Paint RAS File Parsing Out-Of-Bounds Read Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-20741](https://cve.now/CVE-2024-20741.md): Adobe Substance 3D Paint ICO Parsing Access Violation Write Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-20723](https://cve.now/CVE-2024-20723.md): Adobe Substance 3D Painter v9.0.1Build2822 Buffer Overflow Vulnerability (CVSS 7.8, Adobe Substance3D - Painter)
- [CVE-2024-20725](https://cve.now/CVE-2024-20725.md): Adobe Substance 3D Painter v9.0.1Build2822 OOBR Vulnerability I (CVSS 5.5, Adobe Substance3D - Painter)
- [CVE-2024-0390](https://cve.now/CVE-2024-0390.md): Hard-coded credentials in iZZi connect application (CVSS 6.2, INPRAX iZZi connect)
- [CVE-2023-4539](https://cve.now/CVE-2023-4539.md): Hardcoded password in Comarch ERP XL (CVSS 7.5, Comarch ERP XL)
- [CVE-2023-4538](https://cve.now/CVE-2023-4538.md): Shared Key in Comarch ERP XL (CVSS 6.2, Comarch ERP XL)
- [CVE-2023-4537](https://cve.now/CVE-2023-4537.md): Protocol Downgrade in Comarch ERP XL (CVSS 7.4, Comarch ERP XL)
- [CVE-2024-0353](https://cve.now/CVE-2024-0353.md): Local privilege escalation in Windows products (CVSS 7.8, ESET, spol. s r.o. ESET NOD32 Antivirus · ESET, spol. s… +9)
- [CVE-2024-21727](https://cve.now/CVE-2024-21727.md): Extension - digtal-peak.com - XSS vulnerability in DP Calendar component for Joomla 8.0.0-8.0.14 (CVSS 6.1, digital-peak.com DP Calendar for Joomla)
- [CVE-2024-0708](https://cve.now/CVE-2024-0708.md): Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages \<= 1.7.2 - Unauthenticated Information Exposure (CVSS 5.3, fatcatapps Landing Page Cat – Coming Soon & Maintenance Pag…)
- [CVE-2023-46596](https://cve.now/CVE-2023-46596.md): Improper input validation in FireFlow’s VisualFlow workflow editor (CVSS 5.1, Algosec FireFlow)
- [CVE-2022-23093](https://cve.now/CVE-2022-23093.md): Stack overflow in ping(8) (CVSS 6.5, FreeBSD)
- [CVE-2022-23092](https://cve.now/CVE-2022-23092.md): Missing bounds check in 9p message handling (CVSS 8.8, FreeBSD)
- [CVE-2022-23091](https://cve.now/CVE-2022-23091.md): Memory disclosure by stale virtual memory mapping (CVSS 4.0, FreeBSD)
- [CVE-2022-23090](https://cve.now/CVE-2022-23090.md): AIO credential reference count leak (CVSS 7.7, FreeBSD)
- [CVE-2022-23089](https://cve.now/CVE-2022-23089.md): Out of bound read in elf\_note\_prpsinfo() (CVSS 4.7, FreeBSD)
- [CVE-2024-1488](https://cve.now/CVE-2024-1488.md): Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation (CVSS 8.0, unbound · Red Hat Enterprise Linux)
- [CVE-2022-23088](https://cve.now/CVE-2022-23088.md): 802.11 heap buffer overflow (CVSS 9.8, FreeBSD)
- [CVE-2022-23087](https://cve.now/CVE-2022-23087.md): Bhyve e82545 device emulation out-of-bounds write (CVSS 8.8, FreeBSD)
- [CVE-2022-23086](https://cve.now/CVE-2022-23086.md): mpr/mps/mpt driver ioctl heap out-of-bounds write (CVSS 9.8, FreeBSD)
- [CVE-2022-23085](https://cve.now/CVE-2022-23085.md): Potential jail escape vulnerabilities in netmap (CVSS 9.8, FreeBSD)
- [CVE-2022-23084](https://cve.now/CVE-2022-23084.md): Potential jail escape vulnerabilities in netmap (CVSS 7.8, FreeBSD)
- [CVE-2024-25559](https://cve.now/CVE-2024-25559.md): URL spoofing vulnerability exists in a-blog cms Ver.3.1.0 to Ver.3.1.8. (CVSS 4.7, appleple a-blog cms)
- [CVE-2024-25941](https://cve.now/CVE-2024-25941.md): jail(2) information leak (CVSS 3.3, FreeBSD)
- [CVE-2024-25940](https://cve.now/CVE-2024-25940.md): bhyveload(8) host file access (CVSS 6.3, FreeBSD)
- [CVE-2024-26264](https://cve.now/CVE-2024-26264.md): EBM Technologies RISWEB - SQL Injection (CVSS 9.8, EBM Technologies RISWEB)
- [CVE-2024-26263](https://cve.now/CVE-2024-26263.md): EBM Technologies RISWEB - Improper Access Control (CVSS 5.3, EBM Technologies RISWEB)
- [CVE-2024-26262](https://cve.now/CVE-2024-26262.md): EBM Technologies Uniweb/SoliPACS WebServer - SQL Injection (CVSS 8.8, EBM Technologies Uniweb/SoliPACS WebServer)
- [CVE-2024-26261](https://cve.now/CVE-2024-26261.md): Hgiga OAKlouds - Arbitrary File Read And Delete (CVSS 9.8, Hgiga OAKlouds)
- [CVE-2024-26260](https://cve.now/CVE-2024-26260.md): Hgiga OAKlouds - Command Injection (CVSS 9.8, Hgiga OAKlouds)
- [CVE-2024-1523](https://cve.now/CVE-2024-1523.md): EC-WEB FS-EZViewer(Web) - SQL Injection (CVSS 8.8, EC-WEB FS-EZViewer)
- [CVE-2023-51787](https://cve.now/CVE-2023-51787.md): An issue was discovered in Wind River VxWorks 7 22.09 and 23.03. (CVSS 7.5)
- [CVE-2024-23674](https://cve.now/CVE-2024-23674.md): The Online-Ausweis-Funktion eID scheme in the German National Identity card through 2024-02-15 allows authentication bypass by spoofing. (CVSS 9.6)
- [CVE-2024-24256](https://cve.now/CVE-2024-24256.md): SQL Injection vulnerability in Yonyou space-time enterprise information integration platform v.9.0 and before allows an attacker to obtain s (CVSS 5.9)
- [CVE-2024-24386](https://cve.now/CVE-2024-24386.md): An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder. (CVSS 7.2)
- [CVE-2024-25373](https://cve.now/CVE-2024-25373.md): Tenda AC10V4.0 V16.03.10.20 was discovered to contain a stack overflow via the page parameter in the sub\_49B384 function. (CVSS 4.6)
- [CVE-2024-25502](https://cve.now/CVE-2024-25502.md): Directory Traversal vulnerability in flusity CMS v.2.4 allows a remote attacker to execute arbitrary code and obtain sensitive information v (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.