# CVEs published 2024-02-16

50 CVEs were published on February 16, 2024: 5 critical, 22 high. Days are UTC.

- [CVE-2024-21984](https://cve.now/CVE-2024-21984.md): Reflected Cross-Site Scripting Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 5.9, NetApp StorageGRID)
- [CVE-2024-21983](https://cve.now/CVE-2024-21983.md): Denial of Service Vulnerability in StorageGRID (formerly StorageGRID Webscale) (CVSS 6.5, NetApp StorageGRID)
- [CVE-2024-24750](https://cve.now/CVE-2024-24750.md): Backpressure request ignored in fetch() in Undici (CVSS 6.5, nodejs undici · undici)
- [CVE-2024-24758](https://cve.now/CVE-2024-24758.md): Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici (CVSS 3.9, nodejs undici · undici)
- [CVE-2024-25627](https://cve.now/CVE-2024-25627.md): Cross-Site Scripting (XSS) via File Upload in Alf.io (CVSS 3.5, alfio-event alf.io)
- [CVE-2024-21987](https://cve.now/CVE-2024-21987.md): Improper Authorization Vulnerability in SnapCenter (CVSS 5.4, NetApp SnapCenter)
- [CVE-2024-25628](https://cve.now/CVE-2024-25628.md): Insufficient Session Expiration in alf.io (CVSS 7.6, alfio-event alf.io)
- [CVE-2024-0023](https://cve.now/CVE-2024-0023.md): In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.4, Google Android)
- [CVE-2024-0021](https://cve.now/CVE-2024-0021.md): In onCreate of NotificationAccessConfirmationActivity.java, there is a possible way for an app in the work profile to enable notification li (CVSS 7.0, Google Android)
- [CVE-2024-0020](https://cve.now/CVE-2024-0020.md): In onActivityResult of NotificationSoundPreference.java, there is a possible way to hear audio files belonging to a different user due to a (CVSS 5.5, Google Android)
- [CVE-2024-0019](https://cve.now/CVE-2024-0019.md): In setListening of AppOpsControllerImpl.java, there is a possible way to hide the microphone privacy indicator when restarting systemUI due (CVSS 6.2, Google Android)
- [CVE-2024-0018](https://cve.now/CVE-2024-0018.md): In convertYUV420Planar16ToY410 of ColorConverter.cpp, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 8.4, Google Android)
- [CVE-2024-0017](https://cve.now/CVE-2024-0017.md): In shouldUseNoOpLocation of CameraActivity.java, there is a possible confused deputy due to a permissions bypass. (CVSS 5.5, Google Android)
- [CVE-2024-0016](https://cve.now/CVE-2024-0016.md): In multiple locations, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.5, Google Android)
- [CVE-2024-1591](https://cve.now/CVE-2024-1591.md): Privilege Management for Windows \< 24.1 Information Leak (CVSS 3.3, BeyondTrust Privilege Management for Windows)
- [CVE-2024-0015](https://cve.now/CVE-2024-0015.md): In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection. (CVSS 7.8, Google Android)
- [CVE-2023-40085](https://cve.now/CVE-2023-40085.md): In convertSubgraphFromHAL of ShimConverter.cpp, there is a possible out of bounds read due to a missing bounds check. (CVSS 3.3, Google Android)
- [CVE-2023-21165](https://cve.now/CVE-2023-21165.md): In DevmemIntUnmapPMR of devicemem\_server.c, there is a possible arbitrary code execution due to a use after free. (CVSS 8.4, Google Android)
- [CVE-2024-21915](https://cve.now/CVE-2024-21915.md): Rockwell Automation FactoryTalk® Service Platform Elevated Privileges Vulnerability Through Web Service Functionality (CVSS 9.0, Rockwell Automation FactoryTalk® Service Platform)
- [CVE-2024-23591](https://cve.now/CVE-2024-23591.md): ThinkSystem SR670V2 servers manufactured from approximately June 2021 to July 2023 were left in Manufacturing Mode which could allow an at (CVSS 2.0, Lenovo ThinkSystem SR670)
- [CVE-2024-21775](https://cve.now/CVE-2024-21775.md): SQL Injection (CVSS 8.3, ManageEngine Exchange Reporter Plus)
- [CVE-2024-22426](https://cve.now/CVE-2024-22426.md): Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains an OS Command injection vulnerability. (CVSS 7.2, Dell RecoverPoint for VMs)
- [CVE-2024-22425](https://cve.now/CVE-2024-22425.md): Dell RecoverPoint for Virtual Machines 5.3.x, 6.0.SP1 contains a brute force/dictionary attack vulnerability. (CVSS 6.5, Dell RecoverPoint for VMs)
- [CVE-2023-6451](https://cve.now/CVE-2023-6451.md): Publicly Known Cryptographic Machine Key In Procura Portal Application (CVSS 8.6, AlayaCare Procura Portal)
- [CVE-2024-0041](https://cve.now/CVE-2024-0041.md): In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. (CVSS 8.4, Google Android)
- [CVE-2024-0040](https://cve.now/CVE-2024-0040.md): In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow. (CVSS 7.5, Google Android)
- [CVE-2024-0038](https://cve.now/CVE-2024-0038.md): In injectInputEventToInputFilter of AccessibilityManagerService.java, there is a possible arbitrary input event injection due to a missing p (CVSS 8.4, Google Android)
- [CVE-2024-0037](https://cve.now/CVE-2024-0037.md): In applyCustomDescription of SaveUi.java, there is a possible way to view images belonging to a different user due to a missing permission c (CVSS 3.3, Google Android)
- [CVE-2024-0036](https://cve.now/CVE-2024-0036.md): In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities f (CVSS 7.4, Google Android)
- [CVE-2024-0035](https://cve.now/CVE-2024-0035.md): In onNullBinding of TileLifecycleManager.java, there is a possible way to launch an activity from the background due to a missing null check (CVSS 7.4, Google Android)
- [CVE-2024-0034](https://cve.now/CVE-2024-0034.md): In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. (CVSS 7.8, Google Android)
- [CVE-2024-0033](https://cve.now/CVE-2024-0033.md): In multiple functions of ashmem-dev.cpp, there is a possible missing seal due to a heap buffer overflow. (CVSS 8.4, Google Android)
- [CVE-2024-0032](https://cve.now/CVE-2024-0032.md): In multiple locations, there is a possible way to request access to directories that should be hidden due to improper input validation. (CVSS 6.8, Google Android)
- [CVE-2024-0031](https://cve.now/CVE-2024-0031.md): In attp\_build\_read\_by\_type\_value\_cmd of att\_protocol.cc , there is a possible out of bounds write due to improper input validation. (CVSS 9.8, Google Android)
- [CVE-2024-0030](https://cve.now/CVE-2024-0030.md): In btif\_to\_bta\_response of btif\_gatt\_util.cc, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 5.5, Google Android)
- [CVE-2024-0029](https://cve.now/CVE-2024-0029.md): In multiple files, there is a possible way to capture the device screen when disallowed by device policy due to a logic error in the code. (CVSS 7.1, Google Android)
- [CVE-2024-0014](https://cve.now/CVE-2024-0014.md): In startInstall of UpdateFetcher.java, there is a possible way to trigger a malicious config update due to a logic error. (CVSS 8.4, Google Android)
- [CVE-2023-40122](https://cve.now/CVE-2023-40122.md): In applyCustomDescription of SaveUi.java, there is a possible way to view other user's images due to a confused deputy. (CVSS 5.3, Google Android)
- [CVE-2023-40093](https://cve.now/CVE-2023-40093.md): In multiple files, there is a possible way that trimmed content could be included in PDF output due to a logic error in the code. (CVSS 5.5, Google Android)
- [CVE-2023-45860](https://cve.now/CVE-2023-45860.md): In Hazelcast Platform through 5.3.4, a security issue exists within the SQL mapping for the CSV File Source connector. (CVSS 6.5, com.hazelcast:hazelcast · com.hazelcast:hazelcast-enterprise)
- [CVE-2023-49508](https://cve.now/CVE-2023-49508.md): Directory Traversal vulnerability in YetiForceCompany YetiForceCRM versions 6.4.0 and before allows a remote authenticated attacker to obtai (CVSS 6.5, yetiforce/yetiforce-crm)
- [CVE-2023-51931](https://cve.now/CVE-2023-51931.md): An issue in alanclarke URLite v.3.1.0 allows an attacker to cause a denial of service (DoS) via a crafted payload to the parsing function. (CVSS 7.5)
- [CVE-2024-22854](https://cve.now/CVE-2024-22854.md): DOM-based HTML injection vulnerability in the main page of Darktrace Threat Visualizer version 6.1.27 (bundle version 61050) and before has (CVSS 4.6)
- [CVE-2024-24377](https://cve.now/CVE-2024-24377.md): An issue in idocv v.14.1.3\_20231228 allows a remote attacker to execute arbitrary code and obtain sensitive information via a crafted script (CVSS 8.1)
- [CVE-2024-25083](https://cve.now/CVE-2024-25083.md): An issue was discovered in BeyondTrust Privilege Management for Windows before 24.1. (CVSS 6.3)
- [CVE-2024-25320](https://cve.now/CVE-2024-25320.md): Tongda OA v2017 and up to v11.9 was discovered to contain a SQL injection vulnerability via the $AFF\_ID parameter at /affair/delete.php. (CVSS 9.8)
- [CVE-2024-25413](https://cve.now/CVE-2024-25413.md): A XSLT Server Side injection vulnerability in the Import Jobs function of FireBear Improved Import And Export v3.8.6 allows attackers to exe (CVSS 9.1)
- [CVE-2024-25414](https://cve.now/CVE-2024-25414.md): An arbitrary file upload vulnerability in /admin/upgrade of CSZ CMS v1.3.0 allows attackers to execute arbitrary code via uploading a crafte (CVSS 9.8)
- [CVE-2024-25415](https://cve.now/CVE-2024-25415.md): A remote code execution (RCE) vulnerability in /admin/define\_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP (CVSS 7.2)
- [CVE-2024-25466](https://cve.now/CVE-2024-25466.md): Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arb (CVSS 7.3, react-native-document-picker)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.