CVEs published February 21, 2024
143 CVEs were published on February 21, 2024: 34 critical, 41 high. 3 are now in CISA KEV.
- Published
- 143
- Critical
- 34
- High
- 41
- Medium
- 63
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 69
Most affected products
- Liferay Portal · Liferay DXP +2
- 12
- Apple macOS
- 10
- Google Chrome
- 8
- Linux
- 7
- GitLab
- 6
- Apple iOS and iPadOS
- 4
- Apple iOS and iPadOS · Apple tvOS +2
- 3
- Apple tvOS · Apple macOS +2
- 3
- keerti1924 PHP-MYSQL-User-Login-System
- 3
- Apple macOS · Apple iOS and iPadOS
- 2
Critical 34
- CVE-2024-25124Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentialsgofiber fiber · github.com/gofiber/fiber/v2
- CVE-2024-1212LoadMaster Pre-Authenticated OS Command InjectionProgress Software LoadMaster
- CVE-2024-23346pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_stringmaterialsproject pymatgen · pymatgen
- CVE-2023-46241Potential account take over due to unverified emails from Microsoft Identity Platform discourse-microsoft-auth
- CVE-2024-1709Authentication bypass using an alternate path or channelConnectWise ScreenConnect
- CVE-2024-26585tls: fix race between tx work scheduling and socket closeLinux
- CVE-2024-26584net: tls: handle backlogging of crypto requestsLinux
- CVE-2024-26583tls: fix race between async notify and socket closeLinux
- CVE-2024-26582net: tls: fix use-after-free with partial reads and async decryptLinux
- CVE-2023-47795Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay DLiferay Portal · Liferay DXP +2
- CVE-2023-52442ksmbd: validate session id and tree id in compound requestLinux
- CVE-2023-52441ksmbd: fix out of bounds in init_smb2_rsp_hdr()Linux
- CVE-2023-52440ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()Linux
- CVE-2023-42945A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2024-1676Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a crafGoogle Chrome
- CVE-2023-40191Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and LiLiferay Portal · Liferay DXP +2
- CVE-2023-42498Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and LifeLiferay Portal · Liferay DXP +2
- CVE-2024-26269Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7.Liferay Portal · Liferay DXP +2
- CVE-2024-26266Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and LifLiferay Portal · Liferay DXP +2
- CVE-2023-42496Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and LiferayLiferay Portal · Liferay DXP +2
- CVE-2024-1631agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`Internet Computer agent-js · @dfinity/identity +1
- CVE-2024-25603Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and olLiferay Portal · Liferay DXP +2
- CVE-2024-25152Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versionLiferay Portal · Liferay DXP +2
- CVE-2024-25601Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and oldLiferay Portal · Liferay DXP +2
- CVE-2024-25602Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsuLiferay Portal · Liferay DXP +2
- CVE-2024-25147Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, andLiferay Portal · Liferay DXP +2
- CVE-2023-24331Command Injection vulnerability in D-Link Dir 816 with firmware version DIR-816_A2_v1.10CNB04 allows attackers to run arbitrary commands via
- CVE-2023-37177SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via th
- CVE-2023-51828A SQL Injection vulnerability in /admin/convert/export.class.php in PMB 7.4.7 and earlier versions allows remote unauthenticated attackers t
- CVE-2023-52153A SQL Injection vulnerability in /pmb/opac_css/includes/sessions.inc.php in PMB 7.4.7 and earlier allows remote unauthenticated attackers to
- CVE-2024-25249An issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectAr
- CVE-2024-25893ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.
- CVE-2024-25894ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter.
- CVE-2024-25897ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.
High 41
- CVE-2024-23120Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-0410Improper Enforcement of Behavioral Workflow in GitLabGitLab
- CVE-2024-1451Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-0446Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-26147Helm's Missing YAML Content Leads To Panichelm · helm.sh/helm/v3
- CVE-2024-1714Access Request for Entitlement Values with Leading/Trailing WhitespaceSailPoint IdentityIQ
- CVE-2024-26130cryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash overridepyca cryptography · cryptography
- CVE-2024-1474WS_FTP Server Reflected Cross-Site Scripting in Administrative InterfaceProgress Software Coproration WS_FTP Server
- CVE-2024-1708Improper limitation of a pathname to a restricted directory (“path traversal”)ConnectWise ScreenConnect
- CVE-2023-7235The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN bOpenVPN
- CVE-2024-24843WordPress PowerPack Pro for Elementor Plugin < 2.10.8 is vulnerable to Cross Site Request Forgery (CSRF)PowerPack Addons for Elementor PowerPack Pro for Elementor
- CVE-2023-42848The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-42873The issue was addressed with improved bounds checks.Apple iOS and iPadOS · Apple tvOS +1
- CVE-2023-42946This issue was addressed with improved redaction of sensitive information.Apple tvOS · Apple macOS +2
- CVE-2023-42843An inconsistent user interface issue was addressed with improved state management.Apple iOS and iPadOS · Apple Safari +1
- CVE-2023-42838An access issue was addressed with improvements to the sandbox.Apple macOS
- CVE-2023-42859The issue was addressed with improved checks.Apple macOS
- CVE-2023-42860A permissions issue was addressed with additional restrictions.Apple macOS
- CVE-2023-42928The issue was addressed with improved bounds checks.Apple iOS and iPadOS
- CVE-2023-42877The issue was addressed with improved checks.Apple macOS
- CVE-2023-42942This issue was addressed with improved handling of symlinks.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2024-1675Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restrictiGoogle Chrome
- CVE-2024-1673Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2024-1672Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content Google Chrome
- CVE-2024-1670Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2022-45177An issue was discovered in LIVEBOX Collaboration vDesk through v031.
- CVE-2023-24330Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1_FW130B06 allows attackers to run arbitrary commands via cra
- CVE-2023-24332A stack overflow vulnerability in Tenda AC6 with firmware version US_AC6V5.0re_V03.03.02.01_cn_TDC01 allows attackers to run arbitrary comma
- CVE-2023-24333A stack overflow vulnerability in Tenda AC21 with firmware version US_AC21V1.0re_V16.03.08.15_cn_TDC01 allows attackers to run arbitrary com
- CVE-2023-24334A stack overflow vulnerability in Tenda AC23 with firmware version US_AC23V1.0re_V16.03.07.45_cn_TDC01 allows attackers to run arbitrary com
- CVE-2023-38844SQL injection vulnerability in PMB v.7.4.7 and earlier allows a remote attacker to execute arbitrary code via the thesaurus parameter in exp
- CVE-2023-50975The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsR
- CVE-2023-52154File Upload vulnerability in pmb/camera_upload.php in PMB 7.4.7 and earlier allows attackers to run arbitrary code via upload of crafted PHT
- CVE-2023-52155A SQL Injection vulnerability in /admin/sauvegarde/run.php in PMB 7.4.7 and earlier allows remote authenticated attackers to execute arbitra
- CVE-2024-22778HackMD CodiMD <2.5.2 is vulnerable to Denial of Service.
- CVE-2024-24476A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr_resolv.c, and ws_manuf_lo
- CVE-2024-24478An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect_bgp_open(tvbuff_t*tvb
- CVE-2024-24479A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to_str.c, and format_fracti
- CVE-2024-25461Directory Traversal vulnerability in Terrasoft, Creatio Terrasoft CRM v.7.18.4.1532 allows a remote attacker to obtain sensitive information
- CVE-2024-25891ChurchCRM 5.5.0 FRBidSheets.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.
- CVE-2024-25892ChurchCRM 5.5.0 ConfirmReport.php is vulnerable to Blind SQL Injection (Time-based) via the familyId GET parameter.
Medium, low and unrated 68
- CVE-2023-6477Incorrect Privilege Assignment in GitLabGitLab
- CVE-2024-1525Authentication Bypass Using an Alternate Path or Channel in GitLabGitLab
- CVE-2024-0861Direct Request ('Forced Browsing') in GitLabGitLab
- CVE-2023-3509Incorrect Authorization in GitLabGitLab
- CVE-2024-26148Querybook's Stored Cross-Site Scripting vulnerability allows Privilege Elevationpinterest querybook
- CVE-2024-23654discourse-ai admin-initiated SSRF when interacting with AI servicesdiscourse-ai
- CVE-2023-6640Silicon Labs PC Controller v5.54.0 and Earlier Denial of Service Vulnerabilitysilabs.com PC Controller
- CVE-2023-6533Silicon Labs PC Controller Denial of Service Vulnerabilitysilabs.com PC Controller
- CVE-2024-1707GARO WALLBOX GLB+ T2EV7 Software Update index.jsp#settings cross site scriptingGARO WALLBOX GLB+ T2EV7
- CVE-2024-22473Uninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devicessilabs.com GSDK
- CVE-2024-1706ZKTeco ZKBio Access IVS Department Name Search Bar cross site scriptingZKTeco ZKBio Access IVS
- CVE-2024-1705Shopwind Installation DefaultController.php actionCreate code injectionShopwind
- CVE-2024-1704ZhongBangKeJi CRMEB crud delete path traversalZhongBangKeJi CRMEB
- CVE-2024-26145Uninvited user is able to join and mark the attendance of the the private eventdiscourse-calendar
- CVE-2024-1703ZhongBangKeJi CRMEB openfile absolute path traversalZhongBangKeJi CRMEB
- CVE-2024-26138License information is public, exposing instance id and license holder detailsxwikisas application-licensing · com.xwiki.licensing:applic…
- CVE-2024-26133EventStoreDB Projections Subsystem has potential password leakEventStore
- CVE-2024-1702keerti1924 PHP-MYSQL-User-Login-System edit.php sql injectionkeerti1924 PHP-MYSQL-User-Login-System
- CVE-2024-25117php-svg-lib lacks path validation on font through SVG inline styles dompdf php-svg-lib · phenx/php-svg-lib
- CVE-2024-20325A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modiCisco Unified Intelligence Center
- CVE-2024-1701keerti1924 PHP-MYSQL-User-Login-System edit.php access controlkeerti1924 PHP-MYSQL-User-Login-System
- CVE-2024-1700keerti1924 PHP-MYSQL-User-Login-System signup.php cross site scriptingkeerti1924 PHP-MYSQL-User-Login-System
- CVE-2023-50955IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2023-33843IBM InfoSphere Information Server cross-site scriptingIBM InfoSphere Information Server
- CVE-2024-24798WordPress Debug Plugin <= 1.10 is vulnerable to Cross Site Request Forgery (CSRF)SoniNow Team Debug
- CVE-2024-24802WordPress JTRT Responsive Tables Plugin <= 4.1.9 is vulnerable to Cross Site Request Forgery (CSRF)John Tendik JTRT Responsive Tables
- CVE-2024-24837Cross-Site Request Forgery (CSRF) vulnerability in FG PrestaShop, FG Drupal and FG Joomla WordPress pluginsFrédéric GILLES FG PrestaShop to WooCommerce · Frédéric… +1
- CVE-2024-24849WordPress Quicksand Post Filter jQuery Plugin Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF)Mark Stockton Quicksand Post Filter jQuery Plugin
- CVE-2024-24872WordPress Themify Builder Plugin <= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF)Themify Builder
- CVE-2024-24876WordPress Admin Menu Editor Plugin <= 1.12 is vulnerable to Cross Site Request Forgery (CSRF)Janis Elsts Admin Menu Editor
- CVE-2024-25904WordPress TinyMCE Professional Formats and Styles Plugin <= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF)David Stockl TinyMCE and TinyMCE Advanced Professsional For…
- CVE-2024-10813D FlipBook – PDF Flipbook WordPress <= 1.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Bookmarksiberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer…
- CVE-2024-0593Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosurepresstigers Simple Job Board
- CVE-2024-25905WordPress Multi Step Form Plugin <= 1.7.18 is vulnerable to Cross Site Request Forgery (CSRF)Mondula Multi Step Form
- CVE-2023-42853A logic issue was addressed with improved checks.Apple macOS
- CVE-2023-42823The issue was resolved by sanitizing logging This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 1Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-42835A logic issue was addressed with improved checks.Apple macOS
- CVE-2023-42858The issue was addressed with improved checks.Apple macOS
- CVE-2023-42878A privacy issue was addressed with improved private data redaction for log entries.Apple macOS · Apple watchOS +1
- CVE-2023-42839This issue was addressed with improved state management.Apple tvOS · Apple macOS +2
- CVE-2023-42855This issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2023-42951The issue was addressed with improved handling of caches.Apple iOS and iPadOS
- CVE-2023-42834A privacy issue was addressed with improved handling of files.Apple macOS · Apple watchOS +1
- CVE-2023-42952The issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS
- CVE-2023-42840The issue was addressed with improved checks.Apple macOS
- CVE-2023-42953A permissions issue was addressed with additional restrictions.Apple tvOS · Apple macOS +2
- CVE-2023-42836A logic issue was addressed with improved checks.Apple macOS · Apple iOS and iPadOS
- CVE-2023-42939A logic issue was addressed with improved checks.Apple iOS and iPadOS
- CVE-2023-42889The issue was addressed with improved checks.Apple macOS
- CVE-2024-22235VMware Aria Operations contains a local privilege escalation vulnerability.VMware Aria Operations
- CVE-2024-1562WooCommerce Google Sheet Connector <= 1.3.11 - Missing Authorizationwesterndeal GSheetConnector for WooCommerce – Send your Ord…
- CVE-2024-1501Database Reset <= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installationwebfactory Database Reset
- CVE-2024-25151The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 beLiferay Portal · Liferay DXP +2
- CVE-2024-1674Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass navigation restrictioGoogle Chrome
- CVE-2024-1671Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security Google Chrome
- CVE-2024-1669Out of bounds memory access in Blink in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to perform out of bounds memory accesGoogle Chrome
- CVE-2024-1108Plugin Groups <= 2.0.6 - Missing Authorization to Unauthenticated Denial of Servicedesertsnowman Plugin Groups
- CVE-2022-45169An issue was discovered in LIVEBOX Collaboration vDesk through v031.
- CVE-2022-45179An issue was discovered in LIVEBOX Collaboration vDesk through v031.
- CVE-2023-49100Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service.
- CVE-2024-22220An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL.
- CVE-2024-25288SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php.
- CVE-2024-25381There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.
- CVE-2024-25895A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web script or HTML via t
- CVE-2024-25896ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EID POST parameter.
- CVE-2024-25898A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in th
- CVE-2024-26310Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability.
- CVE-2024-26311Archer Platform 6.x before 6.14 P2 HF1 (6.14.0.2.1) contains a reflected XSS vulnerability.