CVEs published February 20, 2024
203 CVEs were published on February 20, 2024: 20 critical, 52 high.
- Published
- 203
- Critical
- 20
- High
- 52
- Medium
- 127
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 62
Most affected products
- ImageRecycle pdf & image compression
- 10
- Liferay Portal · Liferay DXP +2
- 10
- Mozilla Firefox · Mozilla Thunderbird
- 8
- The Biosig Project libbiosig
- 8
- Linux
- 7
- wproyal Royal Addons for Elementor – Addons and Templates K…
- 6
- Joomla! Project Joomla! CMS
- 5
- NodeJS Node
- 5
- Apache Software Foundation Apache DolphinScheduler · org.ap…
- 4
- Mozilla Firefox
- 4
Critical 20
- CVE-2024-25141Apache Airflow Mongo Provider: Certificate validation isn't respected even if SSL is enabled for apache-airflow-providers-mongoApache Software Foundation Apache Airflow Mongo Provider ·…
- CVE-2024-22245Arbitrary Authentication Relay Vulnerability in Deprecated EAP Browser PluginVMware Enhanced Authentication Plug-in
- CVE-2024-0794Certain LaserJet Pro, HP Enterprise LaserJet, HP LaserJet Managed Printers – Potential Buffer Overflow, Potential Remote Code ExecutionCertain LaserJet Pro, HP Enterprise LaserJet, HP LaserJet M…
- CVE-2024-22097A double-free vulnerability exists in the BrainVision Header Parsing functionality of The Biosig Project libbiosig Master Branch (ab0ee111) The Biosig Project libbiosig
- CVE-2024-23305An out-of-bounds write vulnerability exists in the BrainVisionMarker Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master The Biosig Project libbiosig
- CVE-2024-23809A double-free vulnerability exists in the BrainVision ASCII Header Parsing functionality of The Biosig Project libbiosig 2.5.0 and Master BrThe Biosig Project libbiosig
- CVE-2024-21795A heap-based buffer overflow vulnerability exists in the .egi parsing functionality of The Biosig Project libbiosig 2.5.0 and Master Branch The Biosig Project libbiosig
- CVE-2024-21812An integer overflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0eThe Biosig Project libbiosig
- CVE-2024-23313An integer underflow vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0The Biosig Project libbiosig
- CVE-2024-23310A use-after-free vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (ab0ee11The Biosig Project libbiosig
- CVE-2024-23606An out-of-bounds write vulnerability exists in the sopen_FAMOS_read functionality of The Biosig Project libbiosig 2.5.0 and Master Branch (aThe Biosig Project libbiosig
- CVE-2024-23114Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepositoryApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2023-45318A heap-based buffer overflow vulnerability exists in the HTTP Server functionality of Weston Embedded uC-HTTP git commit 80d4004.Silicon Labs Gecko Platform · Weston Embedded uC-HTTP
- CVE-2024-1554The `fetch()` API and navigation incorrectly shared the same cache, as the cache key did not include the optional headers `fetch()` may contMozilla Firefox
- CVE-2024-25610In Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 before update 4, 7.2 befoLiferay Portal · Liferay DXP +3
- CVE-2023-49109Remote Code Execution in Apache DolphinschedulerApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2024-1608OPPO Usercenter Credit sdkOPPO Usercenter Credit sdk
- CVE-2024-22824An issue in Timo v.2.0.3 allows a remote attacker to execute arbitrary code via the filetype restrictions in the UploadController.java compo
- CVE-2024-25198Inappropriate pointer order of laser_scan_filter_.reset() and tf_listener_.reset() (amcl_node.cpp) in Open Robotics Robotic Operating Sytste
- CVE-2024-25274An arbitrary file upload vulnerability in the component /sysFile/upload of Novel-Plus v4.3.0-RC1 allows attackers to execute arbitrary code
High 52
- CVE-2024-23830MantisBT Host Header Injection vulnerabilitymantisbt · mantisbt/mantisbt
- CVE-2024-26136kedi ElectronCord's Discord Token is publickedi ElectronCord
- CVE-2024-26135MeshCentral cross-site websocket hijacking (CSWSH) vulnerabilityYlianst MeshCentral · meshcentral
- CVE-2024-1317RSS Aggregator by Feedzy <= 4.4.2 - Authenticated(Contributor+) SQL Injectionthemeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…
- CVE-2024-0702Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.2.1 - Missing Authorizationoliverpos Oliver POS – A WooCommerce Point of Sale
- CVE-2024-1206WP Recipe Maker <= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injectonbrechtvds WP Recipe Maker
- CVE-2024-1217Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorization to Arbitrary Plugin Deactivationwpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2023-52439uio: Fix use-after-free in uio_openLinux
- CVE-2023-52438binder: fix use-after-free in shinker's callbackLinux
- CVE-2023-52436f2fs: explicitly null-terminate the xattr listLinux
- CVE-2023-6881fs: fuse: buffer overflow vulnerability in the Zephyr FSzephyrproject-rtos Zephyr
- CVE-2024-26131Element Android Intent Redirectionelement-hq element-android
- CVE-2023-52434smb: client: fix potential OOBs in smb2_parse_contexts()Linux
- CVE-2024-21678This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center.Atlassian Confluence Data Center
- CVE-2024-21682This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions).Atlassian Assets Discovery Data Center
- CVE-2024-22250Session Hijack Vulnerability in Deprecated EAP Browser PluginVMware Enhanced Authentication Plug-in
- CVE-2024-22054A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device maUbiquiti UniFi Access Points · Ubiquiti UniFi Switches +2
- CVE-2024-1470Elevation of Privilege attack on NetIQ Client login extensionOpenText NetIQ Client Login Extension
- CVE-2024-22369Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepositoryApache Software Foundation Apache Camel · org.apache.camel:…
- CVE-2023-38562A double-free vulnerability exists in the IP header loopback parsing functionality of Weston Embedded uC-TCP-IP v3.06.01.Weston Embedded uC-TCP-IP
- CVE-2024-1156Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration inforNI SystemLink Server · NI FlexLogger
- CVE-2024-1155Incorrect permissions for shared NI SystemLink Elixir based servicesNI SystemLink Server · NI FlexLogger
- CVE-2024-1557Memory safety bugs present in Firefox 122.Mozilla Firefox
- CVE-2024-1555When opening a website using the `firefox://` protocol handler, SameSite cookies were not properly respected.Mozilla Firefox
- CVE-2024-1553Memory safety bugs present in Firefox 122, Firefox ESR 115.7, and Thunderbird 115.7.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-1552Incorrect code generation could have led to unexpected numeric conversions and potential undefined behavior.*Note:* This issue only affects Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-1546When storing and re-accessing data on a networking channel, the length of buffers may have been confused, resulting in an out-of-bounds memoMozilla Firefox · Mozilla Thunderbird
- CVE-2023-42791A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 anFortinet FortiManager · Fortinet FortiAnalyzer
- CVE-2024-26581netfilter: nft_set_rbtree: skip end interval element from gcLinux
- CVE-2023-52433netfilter: nft_set_rbtree: skip sync GC for new elements in this transactionLinux
- CVE-2023-7245The nodejs framework in OpenVPN Connect 3.0 through 3.4.3 (Windows)/3.4.7 (macOS) was not properly configured, which allows a local user to OpenVPN Connect
- CVE-2024-24794A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5.Imaging Data Commons libdicom
- CVE-2024-24793A use-after-free vulnerability exists in the DICOM Element Parsing as implemented in Imaging Data Commons libdicom 1.0.5.Imaging Data Commons libdicom
- CVE-2023-51770Apache DolphinScheduler: Arbitrary File Read VulnerabilityApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2023-49250Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtilApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2024-25607The default password hashing algorithm (PBKDF2-HMAC-SHA1) in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and LifeLiferay Portal · Liferay DXP +3
- CVE-2024-25606XXE vulnerability in Liferay Portal 7.2.0 through 7.4.3.7, and older unsupported versions, and Liferay DXP 7.4 before update 4, 7.3 before uLiferay Portal · Liferay DXP +3
- CVE-2024-22234CVE-2024-22234: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticatedSpring Security · org.springframework.security:spring-secur…
- CVE-2023-6764 A format string vulnerability in a function of the IPSec VPN feature in Zyxel ATP series firmware versions from 4.32 through 5.3Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +2
- CVE-2023-6398A post-authentication command injection vulnerability in the file upload binary in Zyxel ATP series firmware versions from 4.32 through 5.37Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +7
- CVE-2024-21896The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user.NodeJS Node
- CVE-2024-21891Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-dNodeJS Node
- CVE-2024-22019A vulnerability in Node.js HTTP servers allows an attacker to send a specially crafted HTTP request with chunked encoding, leading to resourNodeJS Node
- CVE-2024-21892On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running withNodeJS Node
- CVE-2024-0715EL Injection Vulnerability in Hitachi Global Link ManagerHitachi Global Link Manager
- CVE-2024-1648electron-pdf 20.0.0 - Local File Read via Server Side XSSelectron-pdf
- CVE-2021-29050Cross-Site Request Forgery (CSRF) vulnerability in the terms of use page in Liferay Portal before 7.3.6, and Liferay DXP 7.3 before service com.liferay.portal:com.liferay.portal.impl · com.liferay.po…
- CVE-2023-47422An access control issue in /usr/sbin/httpd in Tenda TX9 V1 V22.03.02.54, Tenda AX3 V3 V16.03.12.11, Tenda AX9 V1 V22.03.01.46, and Tenda AX1
- CVE-2024-23758An issue discovered in Unisys Stealth 5.3.062.0 allows attackers to view sensitive information via the Enterprise ManagementInstaller_msi.lo
- CVE-2024-24474QEMU before 8.2.0 has an integer underflow, and resultant buffer overflow, via a TI command when an expected non-DMA transfer length is less
- CVE-2024-25199Inappropriate pointer order of map_sub_ and map_free(map_) (amcl_node.cpp) in Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humb
- CVE-2024-25262texlive-bin commit c515e was discovered to contain heap buffer overflow via the function ttfLoadHDMX:ttfdump.
Medium, low and unrated 131
- CVE-2023-6936 Heap-buffer over-read with WOLFSSL_CALLBACKSwolfSSL
- CVE-2024-26140com.yetanalytics/lrs has Cross-site Scripting Vulnerability in Statement Browseryetanalytics lrs · com.yetanalytics:lrs
- CVE-2024-1058SiteOrigin Widgets Bundle <= 1.58.3 - Authenticated (Contributor+) Stored Cross-Site Scriptinggpriday SiteOrigin Widgets Bundle
- CVE-2024-1043AMP for WP <= 1.0.93.1 - Authenticated(Contributor+) Arbitrary Post Deletion via amppb_remove_saved_layout_datamohammed_kaludi AMP for WP – Accelerated Mobile Pages
- CVE-2024-1171Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Filterable Gallerywpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-1090ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in stopOptimizeAllImageRecycle pdf & image compression
- CVE-2024-1172Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Accordionwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-1218Contact Form builder with drag & drop for WordPress – Kali Forms <= 2.3.41 - Missing Authorizationwpchill Kali Forms — Contact Form & Drag-and-Drop Builder
- CVE-2024-1133Tutor LMS <= 2.6.0 - Missing Authorizationthemeum Tutor LMS – eLearning and online course solution
- CVE-2024-1294Sunshine Photo Cart: Free Client Galleries for Photographers <= 3.0.24 - Unauthenticated Sensitive Information Exposure via Invoicesunshinephotocart Sunshine Photo Cart – Client Photo Galler…
- CVE-2024-0838Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingthehappymonster Happy Addons for Elementor
- CVE-2024-0516Royal Elementor Addons and Templates <= 1.3.87 - Missing Authorization via wpr_update_form_action_metawproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-0604Best WordPress Gallery Plugin – FooGallery <= 2.4.7 -Authenticated(Administrator+) Stored Cross-Site Scripting via settingsfooplugins Gallery by FooGallery
- CVE-2024-0821Cost of Goods Sold (COGS): Cost & Profit Calculator for WooCommerce <= 3.2.8 - Reflected Cross-Site Scriptingwpcodefactory Cost of Goods: Product Cost & Profit Calculat…
- CVE-2024-1389Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via pms_stripe_connect_handle_authorization_returncozmoslabs Paid Membership Subscriptions – Effortless Membe…
- CVE-2024-0984ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in disableOptimizationImageRecycle pdf & image compression
- CVE-2024-1336ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in optimizeAllOnImageRecycle pdf & image compression
- CVE-2024-0658Insert PHP Code Snippet <= 1.3.4 - Authenticated (Admin+) Stored Cross-Site Scriptingf1logic Insert PHP Code Snippet
- CVE-2024-0590Microsoft Clarity <= 0.9.3 - Cross-Site Request Forgery to Stored Cross-Site ScriptingMicrosoft Clarity
- CVE-2024-1445Page scroll to id <= 1.7.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodemalihu Page scroll to id
- CVE-2024-1054Booster for WooCommerce <= 7.1.6 - Authenticated (Contributor+) Stored Cross-Site Scriptingpluggabl Booster for WooCommerce – PDF Invoices, Abandoned…
- CVE-2024-1335ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in disableOptimizationImageRecycle pdf & image compression
- CVE-2024-0512Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_wishlistwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-0514Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via add_to_comparewproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-1276Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-1288Schema & Structured Data for WP & AMP <= 1.26 - Missing Authorization to reCaptcha Key Modificationmagazine3 Schema & Structured Data for WP & AMP
- CVE-2024-0656Password Protected <= 2.6.6 - Authenticated (Admin+) Stored Cross-Site Scriptingsaadiqbal Password Protected — Lock Entire Site, Pages, Pos…
- CVE-2024-1322Directorist <= 7.8.4 - Missing Authorization to Unauthenticated Settings Changewpwax Directorist: AI-Powered Business Directory, Listings…
- CVE-2024-1070SiteOrigin Widgets Bundle <= 1.58.2 - Authenticated (Contributor+) Stored Cross-Site Scriptinggpriday SiteOrigin Widgets Bundle
- CVE-2024-0515Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_comparewproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-0978My Private Site <= 3.0.14 - Improper Access Control to Sensitive Information Exposure via REST APIdgewirtz My Private Site
- CVE-2024-0621Simple Share Buttons Adder <= 8.4.11 - Authenticated(Administrator+) Stored Cross-Site Scripting via CSS Settingsdavidoffneal Simple Share Buttons Adder
- CVE-2024-1089ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in optimizeAllOnImageRecycle pdf & image compression
- CVE-2024-1586Schema & Structured Data for WP & AMP <= 1.26 - Authenticated (Custom) Stored Cross-Site Scriptingmagazine3 Schema & Structured Data for WP & AMP
- CVE-2024-1496Featured Image from URL (FIFU) <= 4.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via fifu_input_urlmarceljm Featured Image from URL
- CVE-2024-1282Email Encoder – Protect Email Addresses and Phone Numbers <= 2.2.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeonlineoptimisation Email Encoder – Protect Email Addresses…
- CVE-2024-1235Elementor Addons by Livemesh <= 8.3.2 - Authenticated (Contributor+) Stored Cross-Site ScriptingLivemesh Addons by Elementor
- CVE-2024-1408ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via [edit-profile-text-box] shortcodeproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2024-1472WP Maintenance <= 6.1.6 - Information Exposureflorent73 WP Maintenance
- CVE-2024-1411PowerPack Addons for Elementor <= 2.7.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widgetideaboxcreations PowerPack Addons for Elementor
- CVE-2024-1349EmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodewpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2024-1338ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in stopOptimizeAllImageRecycle pdf & image compression
- CVE-2024-1277Ocean Extra <= 2.2.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingoceanwp Ocean Extra
- CVE-2024-1519Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.14.4 - Unauthenticated Stored Cross-Site Scriptingproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2024-1425EmbedPress <= 3.9.8 - Authenticated(Contributor+) Stored Cross-Site Scripting via Google Calendar Widget Linkwpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2024-1570ProfilePress <= 4.14.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeproperfraction Paid Membership Plugin, Ecommerce, User Regi…
- CVE-2024-1492WPify Woo Czech <= 4.0.8 - Missing AuthorizationWPify Woo Czech
- CVE-2024-1475Coming Soon Maintenance Mode <= 1.0.5 - Information Exposureawordpresslife Coming Soon Maintenance Mode
- CVE-2024-0506Elementor Website Builder – More than Just a Page Builder <= 3.18.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via get_image_altelemntor Elementor Website Builder – more than just a page…
- CVE-2024-1044Customer Reviews for WooCommerce <= 5.38.10 - Improper Authorization via submit_reviewivole Customer Reviews for WooCommerce
- CVE-2024-1236Essential Addons for Elementor – Best Elementor Templates, Widgets, Kits & WooCommerce Builders <= 5.9.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Essential Addons for Elementor – Popular Elemento…
- CVE-2024-0620PPWP – Password Protect Pages <= 1.8.9 - Protection Mechanism Bypassbuildwps PPWP – Password Protect Pages
- CVE-2024-0513Royal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via remove_from_wishlistwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-1091ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Plugin Data Removal in reinitializeImageRecycle pdf & image compression
- CVE-2024-1340Login Lockdown – Protect Login Form <= 2.08 - Missing Authorizationwebfactory Login Lockdown & Protection
- CVE-2024-1337SKT Page Builder <= 4.1 - Missing Authorization to Authenticated(Subscriber+) Content Injectionsonalsinha21 SKT Page Builder
- CVE-2023-6565InfiniteWP Client <= 1.12.3 - Unauthenticated Sensitive Information Exposurerevmakx InfiniteWP Client
- CVE-2023-6923Matomo <= 4.15.3 - Reflected Cross-Site Scripting via idsitematomoteam Matomo Analytics – Powerful, Privacy-First Insig…
- CVE-2024-1339ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Plugin Data Removal in reinitializeImageRecycle pdf & image compression
- CVE-2024-0379Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Updatesmub Custom Twitter Feeds – A Tweets Widget or X Feed Widget
- CVE-2024-0438Happy Addons for Elementor <= 3.10.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingthehappymonster Happy Addons for Elementor
- CVE-2024-0442Royal Elementor Addons and Templates <= 1.3.87 - Authenticated (Contributor+) Stored Cross-Site Scriptingwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-1128Tutor LMS <= 2.6.0 - Authenticated(Student+) HTML Injection via Q&Athemeum Tutor LMS – eLearning and online course solution
- CVE-2023-6806Starbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Job Settingscifi Starbox – the Author Box for Humans
- CVE-2024-1448Sassy Social Share <= 3.3.56 - Authenticated (Contributor+) Stored Cross-Site Scriptingheateor Social Sharing Plugin – Sassy Social Share
- CVE-2024-1318RSS Aggregator by Feedzy <= 4.4.2 - Missing Authorization to Arbitrary Page Creation and Publicationthemeisle RSS Aggregator by Feedzy – Feed to Post, Autoblog…
- CVE-2024-0983ImageRecycle pdf & image compression <= 3.1.13 - Missing Authorization to Settings Update in enableOptimizationImageRecycle pdf & image compression
- CVE-2024-1447Sydney Toolbox <= 1.25 - Authenticated (Contributor+) Stored Cross-Site Scriptingsmub Sydney Toolbox
- CVE-2024-1390Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction <= 2.11.1 - Missing Authorization via creating_pricing_table_pagecozmoslabs Paid Membership Subscriptions – Effortless Membe…
- CVE-2024-0602Yet Another Related Posts Plugin (YARPP) <= 5.30.9 - Authenticated(Administrator+) Stored Cross-Site Scripting via settingsjeffparker YARPP – Yet Another Related Posts Plugin
- CVE-2024-1242Premium Addons for Elementor <= 4.10.18 - Authenticated (Contributor+) Stored Cross-Site Scriptingleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-0792WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.1 - Authenticated(Contributor+) Stored Cross-Site Scripting via shortcodegn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2024-1334ImageRecycle pdf & image compression <= 3.1.13 - Cross-Site Request Forgery to Settings Update in enableOptimizationImageRecycle pdf & image compression
- CVE-2024-0616Passster – Password Protect Pages and Content <= 4.2.6.2 - Missing Authorization to Sensitive Information Exposurewpchill Passster – Password Protect Pages and Content
- CVE-2023-6247The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the applOpenVPN 3 Core Library
- CVE-2024-0407Certain HP Enterprise LaserJet, HP LaserJet Managed Printers – Potential Information DisclosureCertain HP Enterprise LaserJet, HP LaserJet Managed Printers
- CVE-2024-26132Element Android can be asked to share internal files.element-hq element-android
- CVE-2023-52435net: prevent mss overflow in skb_segment()Linux
- CVE-2023-37495HCL Domino is susceptible to a weak cryptography vulnerabilityHCL Software HCL Domino Server
- CVE-2024-25631Unencrypted traffic between pods when using Wireguard and an external kvstorecilium · github.com/cilium/cilium
- CVE-2024-25630Cilium has unencrypted ingress/health traffic when using Wireguard transparent encryptioncilium · github.com/cilium/cilium
- CVE-2024-24763JumpServer Open Redirect Vulnerabilityjumpserver
- CVE-2023-51447Decidim vulnerable to cross-site scripting (XSS) in the dynamic file uploadsdecidim · decidim-core
- CVE-2023-48220Decidim's devise_invitable gem vulnerable to circumvention of invitation token expiry perioddecidim · decidim-admin +2
- CVE-2023-47635Decidim vulnerable to possible CSRF attack at questionnaire templates previewdecidim · decidim-templates
- CVE-2023-47634Decidim has race condition in Endorsementsdecidim
- CVE-2024-21723[20240202] - Core - Open redirect in installation applicationJoomla! Project Joomla! CMS
- CVE-2024-21725[20240204] - Core - XSS in mail address outputsJoomla! Project Joomla! CMS
- CVE-2024-21724[20240203] - Core - XSS in media selection fieldsJoomla! Project Joomla! CMS
- CVE-2024-21722[20240201] - Core - Insufficient session expiration in MFA management viewsJoomla! Project Joomla! CMS
- CVE-2024-21726[20240205] - Core - Inadequate content filtering within the filter codeJoomla! Project Joomla! CMS
- CVE-2023-39541A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01.Silicon Labs Gecko Platform · Weston Embedded uC-TCP-IP
- CVE-2023-39540A denial of service vulnerability exists in the ICMP and ICMPv6 parsing functionality of Weston Embedded uC-TCP-IP v3.06.01.Silicon Labs Gecko Platform · Weston Embedded uC-TCP-IP
- CVE-2023-50306IBM Common Licensing information disclosureIBM Common Licensing
- CVE-2024-26270The Account Settings page in Liferay Portal 7.4.3.76 through 7.4.3.99, and Liferay DXP 2023.Q3 before patch 5, and 7.4 update 76 through 92 Liferay Portal · Liferay DXP +2
- CVE-2024-1556The incorrect object was checked for NULL in the built-in profiler, potentially leading to invalid memory access and undefined behavior.Mozilla Firefox
- CVE-2024-1551Set-Cookie response headers were being incorrectly honored in multipart HTTP responses.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-1550A malicious website could have used a combination of exiting fullscreen mode and `requestPointerLock` to cause the user's mouse to be re-posMozilla Firefox · Mozilla Thunderbird
- CVE-2024-1549If a website set a large custom cursor, portions of the cursor could have overlapped with the permission dialog, potentially resulting in usMozilla Firefox · Mozilla Thunderbird
- CVE-2024-1548A website could have obscured the fullscreen notification by using a dropdown select input element.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-1547Through a series of API calls and redirects, an attacker-controlled alert dialog could have been displayed on another website (with the victMozilla Firefox · Mozilla Thunderbird
- CVE-2024-26268User enumeration vulnerability in Liferay Portal 7.2.0 through 7.4.3.26, and older unsupported versions, and Liferay DXP 7.4 before update 2Liferay Portal · Liferay DXP +2
- CVE-2024-26267In Liferay Portal 7.2.0 through 7.4.3.25, and older unsupported versions, and Liferay DXP 7.4 before update 26, 7.3 before update 5, 7.2 befLiferay Portal · Liferay DXP +2
- CVE-2024-26265The Image Uploader module in Liferay Portal 7.2.0 through 7.4.3.15, and older unsupported versions, and Liferay DXP 7.4 before update 16, 7.Liferay Portal · Liferay DXP +1
- CVE-2024-1661Totolink X6000R shadow hard-coded credentialsTotolink X6000R
- CVE-2023-50270Apache DolphinScheduler: Session do not expire after password changeApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2024-25609HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.12, and older unsupported versions, and Liferay DXP 7.4 before update 9, 7.3 sLiferay Portal · Liferay DXP +2
- CVE-2024-25608HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3 Liferay Portal · Liferay DXP +2
- CVE-2024-25605The Journal module in Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack Liferay Portal · Liferay DXP +2
- CVE-2024-25604Liferay Portal 7.2.0 through 7.4.3.4, and older unsupported versions, and Liferay DXP 7.4.13, 7.3 before service pack 3, 7.2 before fix packLiferay Portal · Liferay DXP +2
- CVE-2024-25150Information disclosure vulnerability in the Control Panel in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and LiferayLiferay Portal · Liferay DXP +2
- CVE-2024-25974Stored Cross-Site Scripting (XSS) within the Media CenterFrentix OpenOlat LMS
- CVE-2024-25973Multiple Stored Cross-Site Scripting VulnerabilitiesFrentix OpenOlat LMS
- CVE-2024-25149Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 before fix pack 15, and oLiferay Portal · Liferay DXP +2
- CVE-2023-44308Open redirect vulnerability in adaptive media administration page in Liferay DXP 2023.Q3 before patch 6, and 7.4 GA through update 92 allowsLiferay DXP · com.liferay:com.liferay.adaptive.media.web
- CVE-2023-5190Open redirect vulnerability in the Countries Management’s edit region page in Liferay Portal 7.4.3.45 through 7.4.3.101, and Liferay DXP 202Liferay Portal · Liferay DXP +2
- CVE-2024-1559Link Library <= 7.6 - Unauthenticated Stored Cross-Site Scriptingjackdewey Link Library
- CVE-2024-1510WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_tooltip Shortcodegn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2023-6399A format string vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1, USG FLEX series firmware versions from 4Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +3
- CVE-2024-21890The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path.NodeJS Node
- CVE-2023-6397 A null pointer dereference vulnerability in Zyxel ATP series firmware versions from 4.32 through 5.37 Patch 1 and USG FLEX serieZyxel ATP series firmware · Zyxel USG FLEX series firmware
- CVE-2021-29038Liferay Portal 7.2.0 through 7.3.5, and older unsupported versions, and Liferay DXP 7.3 before fix pack 1, 7.2 before fix pack 17, and oldercom.liferay.portal:portal-impl · com.liferay:com.liferay… +3
- CVE-2022-45320Liferay Portal before 7.4.3.16 and Liferay DXP before 7.2 fix pack 19, 7.3 before update 6, and 7.4 before update 16 allow remote authenticacom.liferay.portal:release.portal.bom
- CVE-2023-46967Cross Site Scripting vulnerability in the sanitize function in Enhancesoft osTicket 1.18.0 allows a remote attacker to escalate privileges v
- CVE-2023-49034Cross Site Scripting (XSS) vulnerability in ProjeQtOr 11.0.2 allows a remote attacker to execute arbitrary code via a crafted script to thec
- CVE-2023-50923In QUIC in RFC 9000, the Latency Spin Bit specification (section 17.4) does not strictly constrain the bit value when the feature is disable
- CVE-2024-25196Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions were discovered to contain a buffer overflow via the nav2_controll
- CVE-2024-25197Open Robotics Robotic Operating Sytstem 2 (ROS2) and Nav2 humble versions were discovered to contain a NULL pointer dereference via the isCu
- CVE-2024-25260elfutils v0.189 was discovered to contain a NULL pointer dereference via the handle_verdef() function at readelf.c.
- CVE-2024-25366Buffer Overflow vulnerability in mz-automation.de libiec61859 v.1.4.0 allows a remote attacker to cause a denial of service via the mmsServe
- CVE-2024-25428SQL Injection vulnerability in MRCMS v3.1.2 allows attackers to run arbitrary system commands via the status parameter.