CVEs published February 16, 2024
50 CVEs were published on February 16, 2024: 5 critical, 22 high.
- Published
- 50
- Critical
- 5
- High
- 22
- Medium
- 17
- Low
- 6
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Google Android
- 25
- alfio-event alf.io
- 2
- Dell RecoverPoint for VMs
- 2
- NetApp StorageGRID
- 2
- nodejs undici · undici
- 2
- AlayaCare Procura Portal
- 1
- BeyondTrust Privilege Management for Windows
- 1
- com.hazelcast:hazelcast · com.hazelcast:hazelcast-enterprise
- 1
- Lenovo ThinkSystem SR670
- 1
- ManageEngine Exchange Reporter Plus
- 1
Critical 5
- CVE-2024-21915Rockwell Automation FactoryTalk® Service Platform Elevated Privileges Vulnerability Through Web Service FunctionalityRockwell Automation FactoryTalk® Service Platform
- CVE-2024-0031In attp_build_read_by_type_value_cmd of att_protocol.cc , there is a possible out of bounds write due to improper input validation.Google Android
- CVE-2024-25320Tongda OA v2017 and up to v11.9 was discovered to contain a SQL injection vulnerability via the $AFF_ID parameter at /affair/delete.php.
- CVE-2024-25413A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to exe
- CVE-2024-25414An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafte
High 22
- CVE-2024-25628Insufficient Session Expiration in alf.ioalfio-event alf.io
- CVE-2024-0023In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check.Google Android
- CVE-2024-0021In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way for an app in the work profile to enable notification liGoogle Android
- CVE-2024-0018In convertYUV420Planar16ToY410 of ColorConverter.cpp, there is a possible out of bounds write due to a heap buffer overflow.Google Android
- CVE-2024-0015In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection.Google Android
- CVE-2023-21165In DevmemIntUnmapPMR of devicemem_server.c, there is a possible arbitrary code execution due to a use after free.Google Android
- CVE-2024-21775SQL InjectionManageEngine Exchange Reporter Plus
- CVE-2024-22426Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability.Dell RecoverPoint for VMs
- CVE-2023-6451Publicly Known Cryptographic Machine Key In Procura Portal ApplicationAlayaCare Procura Portal
- CVE-2024-0041In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code.Google Android
- CVE-2024-0040In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow.Google Android
- CVE-2024-0038In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing pGoogle Android
- CVE-2024-0036In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities fGoogle Android
- CVE-2024-0035In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null checkGoogle Android
- CVE-2024-0034In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass.Google Android
- CVE-2024-0033In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow.Google Android
- CVE-2024-0029In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code.Google Android
- CVE-2024-0014In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error.Google Android
- CVE-2023-51931An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function.
- CVE-2024-24377An issue in idocv v.14.1.3_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script
- CVE-2024-25415A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP
- CVE-2024-25466Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arbreact-native-document-picker
Medium, low and unrated 23
- CVE-2024-21984Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale)NetApp StorageGRID
- CVE-2024-21983Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) NetApp StorageGRID
- CVE-2024-24750Backpressure request ignored in fetch() in Undicinodejs undici · undici
- CVE-2024-24758Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undicinodejs undici · undici
- CVE-2024-25627Cross-Site Scripting (XSS) via File Upload in Alf.ioalfio-event alf.io
- CVE-2024-21987Improper Authorization Vulnerability in SnapCenterNetApp SnapCenter
- CVE-2024-0020In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a Google Android
- CVE-2024-0019In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due Google Android
- CVE-2024-0017In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass.Google Android
- CVE-2024-0016In multiple locations, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-1591Privilege Management for Windows < 24.1 Information LeakBeyondTrust Privilege Management for Windows
- CVE-2023-40085In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check.Google Android
- CVE-2024-23591ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an atLenovo ThinkSystem SR670
- CVE-2024-22425Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability.Dell RecoverPoint for VMs
- CVE-2024-0037In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission cGoogle Android
- CVE-2024-0032In multiple locations, there is a possible way to request access to directories that should be hidden due to improper input validation.Google Android
- CVE-2024-0030In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check.Google Android
- CVE-2023-40122In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy.Google Android
- CVE-2023-40093In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code.Google Android
- CVE-2023-45860In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector.com.hazelcast:hazelcast · com.hazelcast:hazelcast-enterprise
- CVE-2023-49508Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtaiyetiforce/yetiforce-crm
- CVE-2024-22854DOM-based HTML injection vulnerability in the main page of Darktrace Threat Visualizer version 6.1.27 (bundle version 61050) and before has
- CVE-2024-25083An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1.