# CVEs published 2024-02-17

66 CVEs were published on February 17, 2024: 2 critical, 12 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2022-41737](https://cve.now/CVE-2022-41737.md): IBM Spectrum Scale security bypass (CVSS 7.1, IBM Storage Scale Container Native Storage Access)
- [CVE-2022-41738](https://cve.now/CVE-2022-41738.md): IBM Spectrum Scale security bypass (CVSS 7.5, IBM Storage Scale Container Native Storage Access)
- [CVE-2022-42443](https://cve.now/CVE-2022-42443.md): Trusteer for mobile file upload (CVSS 2.2, IBM Trusteer iOS SDK · IBM Trusteer Android SDK)
- [CVE-2023-50951](https://cve.now/CVE-2023-50951.md): IBM QRadar Suite information disclosure (CVSS 4.0, IBM QRadar Suite Software · IBM Cloud Pak for Security)
- [CVE-2024-22337](https://cve.now/CVE-2024-22337.md): IBM QRadar Suite information disclosure (CVSS 5.1, IBM QRadar Suite Software · IBM Cloud Pak for Security)
- [CVE-2024-22336](https://cve.now/CVE-2024-22336.md): IBM QRadar Suite information disclosure (CVSS 5.1, IBM QRadar Suite Software · IBM Cloud Pak for Security)
- [CVE-2024-22335](https://cve.now/CVE-2024-22335.md): IBM QRadar Suite information disclosure (CVSS 5.1, IBM QRadar Suite Software · IBM Cloud Pak for Security)
- [CVE-2024-0610](https://cve.now/CVE-2024-0610.md): Piraeus Bank WooCommerce Payment Gateway \<= 1.6.5.1 - Unauthenticated SQL Injection (CVSS 9.8, enartia Piraeus Bank WooCommerce Payment Gateway)
- [CVE-2024-1512](https://cve.now/CVE-2024-1512.md): MasterStudy LMS WordPress Plugin – for Online Courses and Education \<= 3.2.5 - Unauthenticated SQL Injection (CVSS 9.8, stylemix MasterStudy LMS WordPress Plugin – for Online Cour…)
- [CVE-2024-21493](https://cve.now/CVE-2024-21493.md): All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Validation of Array Index when parsing a Caddyfile (CVSS 5.3, github.com/greenpau/caddy-security)
- [CVE-2024-21495](https://cve.now/CVE-2024-21495.md): Versions of the package github.com/greenpau/caddy-security before 1.0.42 are vulnerable to Insecure Randomness due to using an insecure rand (CVSS 6.5, github.com/greenpau/caddy-security)
- [CVE-2024-21494](https://cve.now/CVE-2024-21494.md): All versions of the package github.com/greenpau/caddy-security are vulnerable to Authentication Bypass by Spoofing via the X-Forwarded-For h (CVSS 5.4, github.com/greenpau/caddy-security)
- [CVE-2024-21500](https://cve.now/CVE-2024-21500.md): All versions of the package github.com/greenpau/caddy-security are vulnerable to Improper Restriction of Excessive Authentication Attempts v (CVSS 4.8, github.com/greenpau/caddy-security)
- [CVE-2024-21499](https://cve.now/CVE-2024-21499.md): All versions of the package github.com/greenpau/caddy-security are vulnerable to HTTP Header Injection via the X-Forwarded-Proto header due (CVSS 4.3, github.com/greenpau/caddy-security)
- [CVE-2024-21498](https://cve.now/CVE-2024-21498.md): All versions of the package github.com/greenpau/caddy-security are vulnerable to Server-side Request Forgery (SSRF) via X-Forwarded-Host hea (CVSS 5.3, github.com/greenpau/caddy-security)
- [CVE-2024-21497](https://cve.now/CVE-2024-21497.md): Versions of the package github.com/greenpau/caddy-security are vulnerable to Open Redirect via the redirect\_url parameter. (CVSS 5.4, github.com/greenpau/caddy-security)
- [CVE-2024-21492](https://cve.now/CVE-2024-21492.md): All versions of the package github.com/greenpau/caddy-security are vulnerable to Insufficient Session Expiration due to improper user sessio (CVSS 4.8, github.com/greenpau/caddy-security)
- [CVE-2024-21496](https://cve.now/CVE-2024-21496.md): All versions of the package github.com/greenpau/caddy-security are vulnerable to Cross-site Scripting (XSS) via the Referer header, due to i (CVSS 6.1, github.com/greenpau/caddy-security)
- [CVE-2024-20986](https://cve.now/CVE-2024-20986.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 6.1, Oracle WebLogic Server)
- [CVE-2024-20984](https://cve.now/CVE-2024-20984.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server : Security : Firewall). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2024-20982](https://cve.now/CVE-2024-20982.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-20980](https://cve.now/CVE-2024-20980.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). (CVSS 5.4, Oracle BI Publisher)
- [CVE-2024-20978](https://cve.now/CVE-2024-20978.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-20976](https://cve.now/CVE-2024-20976.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-20974](https://cve.now/CVE-2024-20974.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-20972](https://cve.now/CVE-2024-20972.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-20970](https://cve.now/CVE-2024-20970.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-20968](https://cve.now/CVE-2024-20968.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Options). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2024-20966](https://cve.now/CVE-2024-20966.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2024-20964](https://cve.now/CVE-2024-20964.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 5.3, Oracle MySQL Server)
- [CVE-2024-20962](https://cve.now/CVE-2024-20962.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2024-20960](https://cve.now/CVE-2024-20960.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: RAPID). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2024-20958](https://cve.now/CVE-2024-20958.md): Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). (CVSS 5.4, Oracle Installed Base)
- [CVE-2024-20956](https://cve.now/CVE-2024-20956.md): Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: Installation). (CVSS 7.3, Oracle Agile Product Lifecycle Management for Process)
- [CVE-2024-20953](https://cve.now/CVE-2024-20953.md): Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export). (CVSS 8.8, KEV, Oracle Agile PLM Framework)
- [CVE-2024-20951](https://cve.now/CVE-2024-20951.md): Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). (CVSS 6.1, Oracle Customer Interaction History)
- [CVE-2024-20949](https://cve.now/CVE-2024-20949.md): Vulnerability in the Oracle Customer Interaction History product of Oracle E-Business Suite (component: Outcome-Result). (CVSS 6.1, Oracle Customer Interaction History)
- [CVE-2024-20947](https://cve.now/CVE-2024-20947.md): Vulnerability in the Oracle Common Applications product of Oracle E-Business Suite (component: CRM User Management Framework). (CVSS 5.4, Oracle Common Applications)
- [CVE-2024-20945](https://cve.now/CVE-2024-20945.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Securit (CVSS 4.7, Oracle Java SE JDK and JRE)
- [CVE-2024-20943](https://cve.now/CVE-2024-20943.md): Vulnerability in the Oracle Knowledge Management product of Oracle E-Business Suite (component: Internal Operations). (CVSS 5.4, Oracle Knowledge Management)
- [CVE-2024-20941](https://cve.now/CVE-2024-20941.md): Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: HTML UI). (CVSS 6.1, Oracle Installed Base)
- [CVE-2024-20939](https://cve.now/CVE-2024-20939.md): Vulnerability in the Oracle CRM Technical Foundation product of Oracle E-Business Suite (component: Admin Console). (CVSS 4.3, Oracle CRM Technical Foundation)
- [CVE-2024-20937](https://cve.now/CVE-2024-20937.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics SEC). (CVSS 4.3, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2024-20935](https://cve.now/CVE-2024-20935.md): Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). (CVSS 6.1, Oracle Installed Base)
- [CVE-2024-20933](https://cve.now/CVE-2024-20933.md): Vulnerability in the Oracle Installed Base product of Oracle E-Business Suite (component: Engineering Change Order). (CVSS 6.1, Oracle Installed Base)
- [CVE-2024-20931](https://cve.now/CVE-2024-20931.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2024-20929](https://cve.now/CVE-2024-20929.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: DB Privileges). (CVSS 6.5, Oracle Application Object Library)
- [CVE-2024-20927](https://cve.now/CVE-2024-20927.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 8.6, Oracle WebLogic Server)
- [CVE-2024-20925](https://cve.now/CVE-2024-20925.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). (CVSS 3.1, Oracle Java SE JDK and JRE · org.openjfx:javafx-media)
- [CVE-2024-20923](https://cve.now/CVE-2024-20923.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JavaFX). (CVSS 3.1, Oracle Java SE JDK and JRE)
- [CVE-2024-20921](https://cve.now/CVE-2024-20921.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot (CVSS 5.9, Oracle Java SE JDK and JRE)
- [CVE-2024-20919](https://cve.now/CVE-2024-20919.md): Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot (CVSS 5.9, Oracle Java SE JDK and JRE)
- [CVE-2024-20917](https://cve.now/CVE-2024-20917.md): Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Log Management). (CVSS 7.5, Oracle Enterprise Manager Base Platform)
- [CVE-2024-20915](https://cve.now/CVE-2024-20915.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Login - SSO). (CVSS 5.3, Oracle Application Object Library)
- [CVE-2024-20913](https://cve.now/CVE-2024-20913.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security). (CVSS 5.4, Oracle Business Intelligence Enterprise Edition)
- [CVE-2024-20911](https://cve.now/CVE-2024-20911.md): Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). (CVSS 2.6, Oracle Audit Vault and Database Firewall)
- [CVE-2024-20909](https://cve.now/CVE-2024-20909.md): Vulnerability in Oracle Audit Vault and Database Firewall (component: Firewall). (CVSS 7.5, Oracle Audit Vault and Database Firewall)
- [CVE-2024-20907](https://cve.now/CVE-2024-20907.md): Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: File download). (CVSS 6.1, Oracle Web Applications Desktop Integrator)
- [CVE-2024-20905](https://cve.now/CVE-2024-20905.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Enterprise Infrastructure SEC). (CVSS 2.7, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2024-20903](https://cve.now/CVE-2024-20903.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 6.5, Oracle Database - Enterprise Edition)
- [CVE-2023-21833](https://cve.now/CVE-2023-21833.md): Vulnerability in the Oracle ZFS Storage Appliance Kit product of Oracle Systems (component: Object Store). (CVSS 4.3, Oracle Sun ZFS Storage Appliance Kit (AK) Software)
- [CVE-2023-31728](https://cve.now/CVE-2023-31728.md): Teltonika RUT240 devices with firmware before 07.04.2, when bridge mode is used, sometimes make SSH and HTTP services available on the IPv6 (CVSS 7.0)
- [CVE-2024-22727](https://cve.now/CVE-2024-22727.md): Teltonika TRB1-series devices with firmware before TRB1\_R\_00.07.05.2 allow attackers to exploit a firmware vulnerability via Ethernet LAN or (CVSS 8.3)
- [CVE-2024-25297](https://cve.now/CVE-2024-25297.md): Cross Site Scripting (XSS) vulnerability in Bludit CMS version 3.15, allows remote attackers to execute arbitrary code and obtain sensitive (CVSS 4.8)
- [CVE-2024-25298](https://cve.now/CVE-2024-25298.md): An issue was discovered in REDAXO version 5.15.1, allows attackers to execute arbitrary code and obtain sensitive information via modules.mo (CVSS 7.2, redaxo/source)
- [CVE-2024-25468](https://cve.now/CVE-2024-25468.md): An issue in TOTOLINK X5000R V.9.1.0u.6369\_B20230113 allows a remote attacker to cause a denial of service via the host\_time parameter of the (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.