CVEs published February 19, 2024
40 CVEs were published on February 19, 2024: 5 critical, 17 high.
- Published
- 40
- Critical
- 5
- High
- 17
- Medium
- 16
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 25
Most affected products
- moodle · moodle/moodle
- 6
- LaborOfficeFree
- 4
- alfio-event alf.io
- 2
- Apache Software Foundation Apache Commons Compress · org.ap…
- 2
- Brivo ACS100, ACS300
- 2
- agronholm cbor2 · cbor2
- 1
- dfir-iris iris-web
- 1
- eProsima Fast-DDS
- 1
- Loomio
- 1
- mastodon
- 1
Critical 5
- CVE-2024-1644Suite CRM v7.14.2 - RCE via Local File InclusionSuite CRM
- CVE-2024-1651Torrentpier 2.4.1 - RCETorrentpier · torrentpier/torrentpier
- CVE-2023-50257Disconnect Vulnerability in RTPS Packets Used by SROS2eProsima Fast-DDS
- CVE-2024-1597pgjdbc SQL Injection via line comment generationpgjdbc · org.postgresql:postgresql
- CVE-2024-24722An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an attacker to gain elevat
High 17
- CVE-2024-1647pyhtml2pdf 0.0.6 - Local File Read via Server Side XSSpyhtml2pdf
- CVE-2024-1297Loomio 2.22.0 - Code injectionLoomio
- CVE-2024-26134CBOR2 decoder has potential buffer overflowagronholm cbor2 · cbor2
- CVE-2023-6260Web UI OS Command Injection in Brivo ACS100, ACS300Brivo ACS100, ACS300
- CVE-2023-6259Local Access to Sensitive Data in Brivo ACS100 and ACS300 Brivo ACS100, ACS300
- CVE-2024-1635Undertow: out-of-memory error after several closed connections with wildfly-http-client protocolundertow · Red Hat build of Apache Camel 4.4.1 for Spri… +22
- CVE-2024-1638Bluetooth characteristic LESC security requirement not enforced without additional flagszephyrproject-rtos Zephyr
- CVE-2024-25634IDOR make user can read e-mail log sent by other eventsalfio-event alf.io
- CVE-2024-25635IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERSalfio-event alf.io
- CVE-2024-25636Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accountsmisskey-dev misskey
- CVE-2024-25626Yocto Project Security Advisory - BitBake/Toasteryoctoproject poky
- CVE-2024-25978Msa-24-0001: denial of service risk in file picker unzip functionalitymoodle · moodle/moodle
- CVE-2024-25625Pimcore Host Header Injection in user invitation linkpimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…
- CVE-2024-25623Lack of media type verification of Activity Streams objects allows impersonation of remote accountsmastodon
- CVE-2024-25710Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP fileApache Software Foundation Apache Commons Compress · org.ap…
- CVE-2022-48624close_altfile in filename.c in less before 606 omits shell_quote calls for LESSCLOSE.
- CVE-2022-48625Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an adversary.
Medium, low and unrated 18
- CVE-2024-26129Prestashop vulnerable to path disclosure in JavaScript variablePrestaShop · prestashop/prestashop
- CVE-2024-25640Improper Neutralization of Alternate XSS Syntax in iris-webdfir-iris iris-web
- CVE-2024-1633FIP Header Integer OverflowRenesas rcar_gen3_v2.5
- CVE-2024-25983Msa-24-0006: idor on dashboard comments blockmoodle · moodle/moodle
- CVE-2024-25982Msa-24-0005: csrf risk in language import utilitymoodle · moodle/moodle
- CVE-2024-25981Msa-24-0004: forum export did not respect activity group settingsmoodle · moodle/moodle
- CVE-2024-25980Msa-24-0003: h5p attempts report did not respect activity group settingsmoodle · moodle/moodle
- CVE-2024-25979Msa-24-0002: forum search accepted random parameters in its urlmoodle · moodle/moodle
- CVE-2024-1346Weak MySQL database root password in LaborOfficeFreeLaborOfficeFree
- CVE-2024-1345Weak MySQL database root password in LaborOfficeFreeLaborOfficeFree
- CVE-2024-1344Encrypted database credentials in LaborOfficeFreeLaborOfficeFree
- CVE-2024-1343Weak permission vulnerability in LaborOfficeFreeLaborOfficeFree
- CVE-2024-1580Integer overflow in VideoLAN dav1dVideoLAN dav1d
- CVE-2024-26308Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 fileApache Software Foundation Apache Commons Compress · org.ap…
- CVE-2020-36774plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to
- CVE-2024-26318Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.Serenity.Net.Core · @serenity-is/corelib
- CVE-2024-26327An issue was discovered in QEMU 7.1.0 through 8.2.1.
- CVE-2024-26328An issue was discovered in QEMU 7.1.0 through 8.2.1.