# CVEs published 2024-02-19

40 CVEs were published on February 19, 2024: 5 critical, 17 high. Days are UTC.

- [CVE-2024-1647](https://cve.now/CVE-2024-1647.md): pyhtml2pdf 0.0.6 - Local File Read via Server Side XSS (CVSS 7.5, pyhtml2pdf)
- [CVE-2024-1644](https://cve.now/CVE-2024-1644.md): Suite CRM v7.14.2 - RCE via Local File Inclusion (CVSS 9.9, Suite CRM)
- [CVE-2024-1651](https://cve.now/CVE-2024-1651.md): Torrentpier 2.4.1 - RCE (CVSS 10.0, Torrentpier · torrentpier/torrentpier)
- [CVE-2024-1297](https://cve.now/CVE-2024-1297.md): Loomio 2.22.0 - Code injection (CVSS 7.2, Loomio)
- [CVE-2024-26134](https://cve.now/CVE-2024-26134.md): CBOR2 decoder has potential buffer overflow (CVSS 7.5, agronholm cbor2 · cbor2)
- [CVE-2024-26129](https://cve.now/CVE-2024-26129.md): Prestashop vulnerable to path disclosure in JavaScript variable (CVSS 5.8, PrestaShop · prestashop/prestashop)
- [CVE-2023-6260](https://cve.now/CVE-2023-6260.md): Web UI OS Command Injection in Brivo ACS100, ACS300 (CVSS 7.4, Brivo ACS100, ACS300)
- [CVE-2023-6259](https://cve.now/CVE-2023-6259.md): Local Access to Sensitive Data in Brivo ACS100 and ACS300 (CVSS 7.1, Brivo ACS100, ACS300)
- [CVE-2024-1635](https://cve.now/CVE-2024-1635.md): Undertow: out-of-memory error after several closed connections with wildfly-http-client protocol (CVSS 7.5, undertow · Red Hat build of Apache Camel 4.4.1 for Spri… +22)
- [CVE-2024-1638](https://cve.now/CVE-2024-1638.md): Bluetooth characteristic LESC security requirement not enforced without additional flags (CVSS 8.2, zephyrproject-rtos Zephyr)
- [CVE-2024-25640](https://cve.now/CVE-2024-25640.md): Improper Neutralization of Alternate XSS Syntax in iris-web (CVSS 4.6, dfir-iris iris-web)
- [CVE-2024-25634](https://cve.now/CVE-2024-25634.md): IDOR make user can read e-mail log sent by other events (CVSS 7.2, alfio-event alf.io)
- [CVE-2024-25635](https://cve.now/CVE-2024-25635.md): IDOR Vulnerability: Allowing Organization Owner to view the other Organizations API KEY and USERS (CVSS 8.8, alfio-event alf.io)
- [CVE-2024-25636](https://cve.now/CVE-2024-25636.md): Lack of media type verification of Activity Streams objects allows impersonation and takeover of remote accounts (CVSS 7.1, misskey-dev misskey)
- [CVE-2024-25626](https://cve.now/CVE-2024-25626.md): Yocto Project Security Advisory - BitBake/Toaster (CVSS 8.8, yoctoproject poky)
- [CVE-2023-50257](https://cve.now/CVE-2023-50257.md): Disconnect Vulnerability in RTPS Packets Used by SROS2 (CVSS 9.7, eProsima Fast-DDS)
- [CVE-2024-1633](https://cve.now/CVE-2024-1633.md): FIP Header Integer Overflow (CVSS 2.0, Renesas rcar\_gen3\_v2.5)
- [CVE-2024-25983](https://cve.now/CVE-2024-25983.md): Msa-24-0006: idor on dashboard comments block (CVSS 3.5, moodle · moodle/moodle)
- [CVE-2024-25982](https://cve.now/CVE-2024-25982.md): Msa-24-0005: csrf risk in language import utility (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2024-25981](https://cve.now/CVE-2024-25981.md): Msa-24-0004: forum export did not respect activity group settings (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2024-25980](https://cve.now/CVE-2024-25980.md): Msa-24-0003: h5p attempts report did not respect activity group settings (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2024-25979](https://cve.now/CVE-2024-25979.md): Msa-24-0002: forum search accepted random parameters in its url (CVSS 5.3, moodle · moodle/moodle)
- [CVE-2024-25978](https://cve.now/CVE-2024-25978.md): Msa-24-0001: denial of service risk in file picker unzip functionality (CVSS 7.5, moodle · moodle/moodle)
- [CVE-2024-25625](https://cve.now/CVE-2024-25625.md): Pimcore Host Header Injection in user invitation link (CVSS 8.1, pimcore admin-ui-classic-bundle · pimcore/admin-ui-classic-…)
- [CVE-2024-25623](https://cve.now/CVE-2024-25623.md): Lack of media type verification of Activity Streams objects allows impersonation of remote accounts (CVSS 8.5, mastodon)
- [CVE-2024-1597](https://cve.now/CVE-2024-1597.md): pgjdbc SQL Injection via line comment generation (CVSS 10.0, pgjdbc · org.postgresql:postgresql)
- [CVE-2024-1346](https://cve.now/CVE-2024-1346.md): Weak MySQL database root password in LaborOfficeFree (CVSS 6.8, LaborOfficeFree)
- [CVE-2024-1345](https://cve.now/CVE-2024-1345.md): Weak MySQL database root password in LaborOfficeFree (CVSS 6.8, LaborOfficeFree)
- [CVE-2024-1344](https://cve.now/CVE-2024-1344.md): Encrypted database credentials in LaborOfficeFree (CVSS 6.8, LaborOfficeFree)
- [CVE-2024-1343](https://cve.now/CVE-2024-1343.md): Weak permission vulnerability in LaborOfficeFree (CVSS 4.7, LaborOfficeFree)
- [CVE-2024-1580](https://cve.now/CVE-2024-1580.md): Integer overflow in VideoLAN dav1d (CVSS 5.9, VideoLAN dav1d)
- [CVE-2024-25710](https://cve.now/CVE-2024-25710.md): Apache Commons Compress: Denial of service caused by an infinite loop for a corrupted DUMP file (CVSS 8.1, Apache Software Foundation Apache Commons Compress · org.ap…)
- [CVE-2024-26308](https://cve.now/CVE-2024-26308.md): Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file (CVSS 5.5, Apache Software Foundation Apache Commons Compress · org.ap…)
- [CVE-2020-36774](https://cve.now/CVE-2020-36774.md): plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for GladeGtkBox, leading to (CVSS 5.5)
- [CVE-2022-48624](https://cve.now/CVE-2022-48624.md): close\_altfile in filename.c in less before 606 omits shell\_quote calls for LESSCLOSE. (CVSS 7.8)
- [CVE-2022-48625](https://cve.now/CVE-2022-48625.md): Yealink Config Encrypt Tool add RSA before 1.2 has a built-in RSA key pair, and thus there is a risk of decryption by an adversary. (CVSS 7.5)
- [CVE-2024-24722](https://cve.now/CVE-2024-24722.md): An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an attacker to gain elevat (CVSS 9.1)
- [CVE-2024-26318](https://cve.now/CVE-2024-26318.md): Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character. (CVSS 6.1, Serenity.Net.Core · @serenity-is/corelib)
- [CVE-2024-26327](https://cve.now/CVE-2024-26327.md): An issue was discovered in QEMU 7.1.0 through 8.2.1. (CVSS 5.3)
- [CVE-2024-26328](https://cve.now/CVE-2024-26328.md): An issue was discovered in QEMU 7.1.0 through 8.2.1. (CVSS 6.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.