# CVEs published 2024-02-21

143 CVEs were published on February 21, 2024: 34 critical, 41 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2024-23120](https://cve.now/CVE-2024-23120.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2023-6477](https://cve.now/CVE-2023-6477.md): Incorrect Privilege Assignment in GitLab (CVSS 6.7, GitLab)
- [CVE-2024-0410](https://cve.now/CVE-2024-0410.md): Improper Enforcement of Behavioral Workflow in GitLab (CVSS 7.7, GitLab)
- [CVE-2024-1451](https://cve.now/CVE-2024-1451.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2024-1525](https://cve.now/CVE-2024-1525.md): Authentication Bypass Using an Alternate Path or Channel in GitLab (CVSS 5.3, GitLab)
- [CVE-2024-0861](https://cve.now/CVE-2024-0861.md): Direct Request ('Forced Browsing') in GitLab (CVSS 4.3, GitLab)
- [CVE-2024-0446](https://cve.now/CVE-2024-0446.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2023-3509](https://cve.now/CVE-2023-3509.md): Incorrect Authorization in GitLab (CVSS 3.7, GitLab)
- [CVE-2024-26148](https://cve.now/CVE-2024-26148.md): Querybook's Stored Cross-Site Scripting vulnerability allows Privilege Elevation (CVSS 6.1, pinterest querybook)
- [CVE-2024-26147](https://cve.now/CVE-2024-26147.md): Helm's Missing YAML Content Leads To Panic (CVSS 7.5, helm · helm.sh/helm/v3)
- [CVE-2024-25124](https://cve.now/CVE-2024-25124.md): Fiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials (CVSS 9.4, gofiber fiber · github.com/gofiber/fiber/v2)
- [CVE-2024-23654](https://cve.now/CVE-2024-23654.md): discourse-ai admin-initiated SSRF when interacting with AI services (CVSS 4.1, discourse-ai)
- [CVE-2023-6640](https://cve.now/CVE-2023-6640.md): Silicon Labs PC Controller v5.54.0 and Earlier Denial of Service Vulnerability (CVSS 6.5, silabs.com PC Controller)
- [CVE-2023-6533](https://cve.now/CVE-2023-6533.md): Silicon Labs PC Controller Denial of Service Vulnerability (CVSS 6.5, silabs.com PC Controller)
- [CVE-2024-1707](https://cve.now/CVE-2024-1707.md): GARO WALLBOX GLB+ T2EV7 Software Update index.jsp#settings cross site scripting (CVSS 4.3, GARO WALLBOX GLB+ T2EV7)
- [CVE-2024-22473](https://cve.now/CVE-2024-22473.md): Uninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices (CVSS 6.8, silabs.com GSDK)
- [CVE-2024-1706](https://cve.now/CVE-2024-1706.md): ZKTeco ZKBio Access IVS Department Name Search Bar cross site scripting (CVSS 5.1, ZKTeco ZKBio Access IVS)
- [CVE-2024-1212](https://cve.now/CVE-2024-1212.md): LoadMaster Pre-Authenticated OS Command Injection (CVSS 10.0, KEV, Progress Software LoadMaster)
- [CVE-2024-1705](https://cve.now/CVE-2024-1705.md): Shopwind Installation DefaultController.php actionCreate code injection (CVSS 5.6, Shopwind)
- [CVE-2024-1704](https://cve.now/CVE-2024-1704.md): ZhongBangKeJi CRMEB crud delete path traversal (CVSS 5.5, ZhongBangKeJi CRMEB)
- [CVE-2024-26145](https://cve.now/CVE-2024-26145.md): Uninvited user is able to join and mark the attendance of the the private event (CVSS 6.5, discourse-calendar)
- [CVE-2024-1703](https://cve.now/CVE-2024-1703.md): ZhongBangKeJi CRMEB openfile absolute path traversal (CVSS 3.5, ZhongBangKeJi CRMEB)
- [CVE-2024-1714](https://cve.now/CVE-2024-1714.md): Access Request for Entitlement Values with Leading/Trailing Whitespace (CVSS 7.1, SailPoint IdentityIQ)
- [CVE-2024-26138](https://cve.now/CVE-2024-26138.md): License information is public, exposing instance id and license holder details (CVSS 5.3, xwikisas application-licensing · com.xwiki.licensing:applic…)
- [CVE-2024-26133](https://cve.now/CVE-2024-26133.md): EventStoreDB Projections Subsystem has potential password leak (CVSS 5.5, EventStore)
- [CVE-2024-1702](https://cve.now/CVE-2024-1702.md): keerti1924 PHP-MYSQL-User-Login-System edit.php sql injection (CVSS 6.3, keerti1924 PHP-MYSQL-User-Login-System)
- [CVE-2024-26130](https://cve.now/CVE-2024-26130.md): cryptography NULL pointer deference with pkcs12.serialize\_key\_and\_certificates when called with a non-matching certificate and private key and an hmac\_hash override (CVSS 7.5, pyca cryptography · cryptography)
- [CVE-2024-25117](https://cve.now/CVE-2024-25117.md): php-svg-lib lacks path validation on font through SVG inline styles (CVSS 6.8, dompdf php-svg-lib · phenx/php-svg-lib)
- [CVE-2024-23346](https://cve.now/CVE-2024-23346.md): pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation\_string (CVSS 9.4, materialsproject pymatgen · pymatgen)
- [CVE-2024-20325](https://cve.now/CVE-2024-20325.md): A vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an unauthenticated, local attacker to read and modi (CVSS 5.1, Cisco Unified Intelligence Center)
- [CVE-2023-46241](https://cve.now/CVE-2023-46241.md): Potential account take over due to unverified emails from Microsoft Identity Platform (CVSS 9.1, discourse-microsoft-auth)
- [CVE-2024-1709](https://cve.now/CVE-2024-1709.md): Authentication bypass using an alternate path or channel (CVSS 10.0, KEV, ConnectWise ScreenConnect)
- [CVE-2024-1474](https://cve.now/CVE-2024-1474.md): WS\_FTP Server Reflected Cross-Site Scripting in Administrative Interface (CVSS 7.5, Progress Software Coproration WS\_FTP Server)
- [CVE-2024-1701](https://cve.now/CVE-2024-1701.md): keerti1924 PHP-MYSQL-User-Login-System edit.php access control (CVSS 5.3, keerti1924 PHP-MYSQL-User-Login-System)
- [CVE-2024-1700](https://cve.now/CVE-2024-1700.md): keerti1924 PHP-MYSQL-User-Login-System signup.php cross site scripting (CVSS 4.3, keerti1924 PHP-MYSQL-User-Login-System)
- [CVE-2024-1708](https://cve.now/CVE-2024-1708.md): Improper limitation of a pathname to a restricted directory (“path traversal”) (CVSS 8.4, KEV, ConnectWise ScreenConnect)
- [CVE-2024-26585](https://cve.now/CVE-2024-26585.md): tls: fix race between tx work scheduling and socket close (CVSS 9.8, Linux)
- [CVE-2024-26584](https://cve.now/CVE-2024-26584.md): net: tls: handle backlogging of crypto requests (CVSS 9.8, Linux)
- [CVE-2024-26583](https://cve.now/CVE-2024-26583.md): tls: fix race between async notify and socket close (CVSS 9.8, Linux)
- [CVE-2024-26582](https://cve.now/CVE-2024-26582.md): net: tls: fix use-after-free with partial reads and async decrypt (CVSS 9.8, Linux)
- [CVE-2023-50955](https://cve.now/CVE-2023-50955.md): IBM InfoSphere Information Server information disclosure (CVSS 2.4, IBM InfoSphere Information Server)
- [CVE-2023-33843](https://cve.now/CVE-2023-33843.md): IBM InfoSphere Information Server cross-site scripting (CVSS 5.4, IBM InfoSphere Information Server)
- [CVE-2023-47795](https://cve.now/CVE-2023-47795.md): Stored cross-site scripting (XSS) vulnerability in the Document and Media widget in Liferay Portal 7.4.3.18 through 7.4.3.101, and Liferay D (CVSS 9.0, Liferay Portal · Liferay DXP +2)
- [CVE-2023-7235](https://cve.now/CVE-2023-7235.md): The OpenVPN GUI installer before version 2.6.9 did not set the proper access control restrictions to the installation directory of OpenVPN b (CVSS 8.4, OpenVPN)
- [CVE-2024-24798](https://cve.now/CVE-2024-24798.md): WordPress Debug Plugin \<= 1.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, SoniNow Team Debug)
- [CVE-2024-24802](https://cve.now/CVE-2024-24802.md): WordPress JTRT Responsive Tables Plugin \<= 4.1.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, John Tendik JTRT Responsive Tables)
- [CVE-2023-52442](https://cve.now/CVE-2023-52442.md): ksmbd: validate session id and tree id in compound request (CVSS 9.1, Linux)
- [CVE-2023-52441](https://cve.now/CVE-2023-52441.md): ksmbd: fix out of bounds in init\_smb2\_rsp\_hdr() (CVSS 9.1, Linux)
- [CVE-2023-52440](https://cve.now/CVE-2023-52440.md): ksmbd: fix slub overflow in ksmbd\_decode\_ntlmssp\_auth\_blob() (CVSS 9.8, Linux)
- [CVE-2024-24837](https://cve.now/CVE-2024-24837.md): Cross-Site Request Forgery (CSRF) vulnerability in FG PrestaShop, FG Drupal and FG Joomla WordPress plugins (CVSS 4.3, Frédéric GILLES FG PrestaShop to WooCommerce · Frédéric… +1)
- [CVE-2024-24843](https://cve.now/CVE-2024-24843.md): WordPress PowerPack Pro for Elementor Plugin \< 2.10.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, PowerPack Addons for Elementor PowerPack Pro for Elementor)
- [CVE-2024-24849](https://cve.now/CVE-2024-24849.md): WordPress Quicksand Post Filter jQuery Plugin Plugin \<= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Mark Stockton Quicksand Post Filter jQuery Plugin)
- [CVE-2024-24872](https://cve.now/CVE-2024-24872.md): WordPress Themify Builder Plugin \<= 7.0.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Themify Builder)
- [CVE-2024-24876](https://cve.now/CVE-2024-24876.md): WordPress Admin Menu Editor Plugin \<= 1.12 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Janis Elsts Admin Menu Editor)
- [CVE-2024-25904](https://cve.now/CVE-2024-25904.md): WordPress TinyMCE Professional Formats and Styles Plugin \<= 1.1.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, David Stockl TinyMCE and TinyMCE Advanced Professsional For…)
- [CVE-2024-1081](https://cve.now/CVE-2024-1081.md): 3D FlipBook – PDF Flipbook WordPress \<= 1.15.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Bookmarks (CVSS 6.4, iberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer…)
- [CVE-2024-0593](https://cve.now/CVE-2024-0593.md): Simple Job Board \<= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure (CVSS 5.3, presstigers Simple Job Board)
- [CVE-2024-25905](https://cve.now/CVE-2024-25905.md): WordPress Multi Step Form Plugin \<= 1.7.18 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Mondula Multi Step Form)
- [CVE-2023-42848](https://cve.now/CVE-2023-42848.md): The issue was addressed with improved bounds checks. (CVSS 7.8, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-42873](https://cve.now/CVE-2023-42873.md): The issue was addressed with improved bounds checks. (CVSS 7.8, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2023-42853](https://cve.now/CVE-2023-42853.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-42823](https://cve.now/CVE-2023-42823.md): The issue was resolved by sanitizing logging This issue is fixed in watchOS 10.1, macOS Sonoma 14.1, tvOS 17.1, macOS Monterey 12.7.1, iOS 1 (CVSS 2.7, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-42835](https://cve.now/CVE-2023-42835.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-42858](https://cve.now/CVE-2023-42858.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-42878](https://cve.now/CVE-2023-42878.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple macOS · Apple watchOS +1)
- [CVE-2023-42839](https://cve.now/CVE-2023-42839.md): This issue was addressed with improved state management. (CVSS 6.2, Apple tvOS · Apple macOS +2)
- [CVE-2023-42946](https://cve.now/CVE-2023-42946.md): This issue was addressed with improved redaction of sensitive information. (CVSS 7.5, Apple tvOS · Apple macOS +2)
- [CVE-2023-42855](https://cve.now/CVE-2023-42855.md): This issue was addressed with improved state management. (CVSS 4.6, Apple iOS and iPadOS)
- [CVE-2023-42951](https://cve.now/CVE-2023-42951.md): The issue was addressed with improved handling of caches. (CVSS 4.3, Apple iOS and iPadOS)
- [CVE-2023-42843](https://cve.now/CVE-2023-42843.md): An inconsistent user interface issue was addressed with improved state management. (CVSS 7.5, Apple iOS and iPadOS · Apple Safari +1)
- [CVE-2023-42838](https://cve.now/CVE-2023-42838.md): An access issue was addressed with improvements to the sandbox. (CVSS 8.2, Apple macOS)
- [CVE-2023-42859](https://cve.now/CVE-2023-42859.md): The issue was addressed with improved checks. (CVSS 7.7, Apple macOS)
- [CVE-2023-42834](https://cve.now/CVE-2023-42834.md): A privacy issue was addressed with improved handling of files. (CVSS 6.2, Apple macOS · Apple watchOS +1)
- [CVE-2023-42860](https://cve.now/CVE-2023-42860.md): A permissions issue was addressed with additional restrictions. (CVSS 7.7, Apple macOS)
- [CVE-2023-42952](https://cve.now/CVE-2023-42952.md): The issue was addressed with improved checks. (CVSS 4.4, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-42840](https://cve.now/CVE-2023-42840.md): The issue was addressed with improved checks. (CVSS 4.3, Apple macOS)
- [CVE-2023-42928](https://cve.now/CVE-2023-42928.md): The issue was addressed with improved bounds checks. (CVSS 8.4, Apple iOS and iPadOS)
- [CVE-2023-42953](https://cve.now/CVE-2023-42953.md): A permissions issue was addressed with additional restrictions. (CVSS 5.5, Apple tvOS · Apple macOS +2)
- [CVE-2023-42945](https://cve.now/CVE-2023-42945.md): A permissions issue was addressed with additional restrictions. (CVSS 9.1, Apple macOS)
- [CVE-2023-42877](https://cve.now/CVE-2023-42877.md): The issue was addressed with improved checks. (CVSS 7.7, Apple macOS)
- [CVE-2023-42836](https://cve.now/CVE-2023-42836.md): A logic issue was addressed with improved checks. (CVSS 5.3, Apple macOS · Apple iOS and iPadOS)
- [CVE-2023-42942](https://cve.now/CVE-2023-42942.md): This issue was addressed with improved handling of symlinks. (CVSS 7.8, Apple iOS and iPadOS · Apple tvOS +2)
- [CVE-2023-42939](https://cve.now/CVE-2023-42939.md): A logic issue was addressed with improved checks. (CVSS 3.3, Apple iOS and iPadOS)
- [CVE-2023-42889](https://cve.now/CVE-2023-42889.md): The issue was addressed with improved checks. (CVSS 5.3, Apple macOS)
- [CVE-2024-22235](https://cve.now/CVE-2024-22235.md): VMware Aria Operations contains a local privilege escalation vulnerability. (CVSS 6.7, VMware Aria Operations)
- [CVE-2024-1562](https://cve.now/CVE-2024-1562.md): WooCommerce Google Sheet Connector \<= 1.3.11 - Missing Authorization (CVSS 5.3, westerndeal GSheetConnector for WooCommerce – Send your Ord…)
- [CVE-2024-1501](https://cve.now/CVE-2024-1501.md): Database Reset \<= 3.22 - Cross-Site Request Forgery to WP Reset Plugin Installation (CVSS 4.7, webfactory Database Reset)
- [CVE-2024-25151](https://cve.now/CVE-2024-25151.md): The Calendar module in Liferay Portal 7.2.0 through 7.4.2, and older unsupported versions, and Liferay DXP 7.3 before service pack 3, 7.2 be (CVSS 5.4, Liferay Portal · Liferay DXP +2)
- [CVE-2024-1676](https://cve.now/CVE-2024-1676.md): Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a craf (CVSS 9.8, Google Chrome)
- [CVE-2024-1675](https://cve.now/CVE-2024-1675.md): Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restricti (CVSS 8.8, Google Chrome)
- [CVE-2024-1674](https://cve.now/CVE-2024-1674.md): Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass navigation restrictio (CVSS 6.3, Google Chrome)
- [CVE-2024-1673](https://cve.now/CVE-2024-1673.md): Use after free in Accessibility in Google Chrome prior to 122.0.6261.57 allowed a remote attacker who had compromised the renderer process t (CVSS 8.8, Google Chrome)
- [CVE-2024-1672](https://cve.now/CVE-2024-1672.md): Inappropriate implementation in Content Security Policy in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content (CVSS 8.8, Google Chrome)
- [CVE-2024-1671](https://cve.now/CVE-2024-1671.md): Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security (CVSS 6.5, Google Chrome)
- [CVE-2024-1670](https://cve.now/CVE-2024-1670.md): Use after free in Mojo in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2024-1669](https://cve.now/CVE-2024-1669.md): Out of bounds memory access in Blink in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to perform out of bounds memory acces (CVSS 6.5, Google Chrome)
- [CVE-2023-40191](https://cve.now/CVE-2023-40191.md): Reflected cross-site scripting (XSS) vulnerability in the instance settings for Accounts in Liferay Portal 7.4.3.44 through 7.4.3.97, and Li (CVSS 9.0, Liferay Portal · Liferay DXP +2)
- [CVE-2024-1108](https://cve.now/CVE-2024-1108.md): Plugin Groups \<= 2.0.6 - Missing Authorization to Unauthenticated Denial of Service (CVSS 6.5, desertsnowman Plugin Groups)
- [CVE-2023-42498](https://cve.now/CVE-2023-42498.md): Reflected cross-site scripting (XSS) vulnerability in the Language Override edit screen in Liferay Portal 7.4.3.8 through 7.4.3.97, and Life (CVSS 9.6, Liferay Portal · Liferay DXP +2)
- [CVE-2024-26269](https://cve.now/CVE-2024-26269.md): Cross-site scripting (XSS) vulnerability in the Frontend JS module's portlet.js in Liferay Portal 7.2.0 through 7.4.3.37, and Liferay DXP 7. (CVSS 9.6, Liferay Portal · Liferay DXP +2)
- [CVE-2024-26266](https://cve.now/CVE-2024-26266.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Liferay Portal 7.2.0 through 7.4.3.13, and older unsupported versions, and Lif (CVSS 9.0, Liferay Portal · Liferay DXP +2)
- [CVE-2023-42496](https://cve.now/CVE-2023-42496.md): Reflected cross-site scripting (XSS) vulnerability on the add assignees to a role page in Liferay Portal 7.3.3 through 7.4.3.97, and Liferay (CVSS 9.6, Liferay Portal · Liferay DXP +2)
- [CVE-2024-1631](https://cve.now/CVE-2024-1631.md): agent-js: Insecure Key Generation in \`Ed25519KeyIdentity.generate\` (CVSS 9.1, Internet Computer agent-js · @dfinity/identity +1)
- [CVE-2024-25603](https://cve.now/CVE-2024-25603.md): Stored cross-site scripting (XSS) vulnerability in the Dynamic Data Mapping module's DDMForm in Liferay Portal 7.2.0 through 7.4.3.4, and ol (CVSS 9.0, Liferay Portal · Liferay DXP +2)
- [CVE-2024-25152](https://cve.now/CVE-2024-25152.md): Stored cross-site scripting (XSS) vulnerability in Message Board widget in Liferay Portal 7.2.0 through 7.4.2, and older unsupported version (CVSS 9.0, Liferay Portal · Liferay DXP +2)
- [CVE-2024-25601](https://cve.now/CVE-2024-25601.md): Stored cross-site scripting (XSS) vulnerability in Expando module's geolocation custom fields in Liferay Portal 7.2.0 through 7.4.2, and old (CVSS 9.0, Liferay Portal · Liferay DXP +2)
- [CVE-2024-25602](https://cve.now/CVE-2024-25602.md): Stored cross-site scripting (XSS) vulnerability in Users Admin module's edit user page in Liferay Portal 7.2.0 through 7.4.2, and older unsu (CVSS 9.0, Liferay Portal · Liferay DXP +2)
- [CVE-2024-25147](https://cve.now/CVE-2024-25147.md): Cross-site scripting (XSS) vulnerability in HtmlUtil.escapeJsLink in Liferay Portal 7.2.0 through 7.4.1, and older unsupported versions, and (CVSS 9.6, Liferay Portal · Liferay DXP +2)
- [CVE-2022-45169](https://cve.now/CVE-2022-45169.md): An issue was discovered in LIVEBOX Collaboration vDesk through v031. (CVSS 5.9)
- [CVE-2022-45177](https://cve.now/CVE-2022-45177.md): An issue was discovered in LIVEBOX Collaboration vDesk through v031. (CVSS 7.5)
- [CVE-2022-45179](https://cve.now/CVE-2022-45179.md): An issue was discovered in LIVEBOX Collaboration vDesk through v031. (CVSS 5.4)
- [CVE-2023-24330](https://cve.now/CVE-2023-24330.md): Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1\_FW130B06 allows attackers to run arbitrary commands via cra (CVSS 8.8)
- [CVE-2023-24331](https://cve.now/CVE-2023-24331.md): Command Injection vulnerability in D-Link Dir 816 with firmware version DIR-816\_A2\_v1.10CNB04 allows attackers to run arbitrary commands via (CVSS 9.8)
- [CVE-2023-24332](https://cve.now/CVE-2023-24332.md): A stack overflow vulnerability in Tenda AC6 with firmware version US\_AC6V5.0re\_V03.03.02.01\_cn\_TDC01 allows attackers to run arbitrary comma (CVSS 8.1)
- [CVE-2023-24333](https://cve.now/CVE-2023-24333.md): A stack overflow vulnerability in Tenda AC21 with firmware version US\_AC21V1.0re\_V16.03.08.15\_cn\_TDC01 allows attackers to run arbitrary com (CVSS 8.8)
- [CVE-2023-24334](https://cve.now/CVE-2023-24334.md): A stack overflow vulnerability in Tenda AC23 with firmware version US\_AC23V1.0re\_V16.03.07.45\_cn\_TDC01 allows attackers to run arbitrary com (CVSS 8.0)
- [CVE-2023-37177](https://cve.now/CVE-2023-37177.md): SQL Injection vulnerability in PMB Services PMB v.7.4.7 and before allows a remote unauthenticated attacker to execute arbitrary code via th (CVSS 9.8)
- [CVE-2023-38844](https://cve.now/CVE-2023-38844.md): SQL injection vulnerability in PMB v.7.4.7 and earlier allows a remote attacker to execute arbitrary code via the thesaurus parameter in exp (CVSS 7.5)
- [CVE-2023-49100](https://cve.now/CVE-2023-49100.md): Trusted Firmware-A (TF-A) before 2.10 has a potential read out-of-bounds in the SDEI service. (CVSS 4.4)
- [CVE-2023-50975](https://cve.now/CVE-2023-50975.md): The TD Bank TD Advanced Dashboard client through 3.0.3 for macOS allows arbitrary code execution because of the lack of electron::fuses::IsR (CVSS 8.4)
- [CVE-2023-51828](https://cve.now/CVE-2023-51828.md): A SQL Injection vulnerability in /admin/convert/export.class.php in PMB 7.4.7 and earlier versions allows remote unauthenticated attackers t (CVSS 9.8)
- [CVE-2023-52153](https://cve.now/CVE-2023-52153.md): A SQL Injection vulnerability in /pmb/opac\_css/includes/sessions.inc.php in PMB 7.4.7 and earlier allows remote unauthenticated attackers to (CVSS 9.8)
- [CVE-2023-52154](https://cve.now/CVE-2023-52154.md): File Upload vulnerability in pmb/camera\_upload.php in PMB 7.4.7 and earlier allows attackers to run arbitrary code via upload of crafted PHT (CVSS 7.2)
- [CVE-2023-52155](https://cve.now/CVE-2023-52155.md): A SQL Injection vulnerability in /admin/sauvegarde/run.php in PMB 7.4.7 and earlier allows remote authenticated attackers to execute arbitra (CVSS 7.2)
- [CVE-2024-22220](https://cve.now/CVE-2024-22220.md): An issue was discovered in Terminalfour 7.4 through 7.4.0004 QP3 and 8 through 8.3.19, and Formbank through 2.1.10-FINAL. (CVSS 6.3)
- [CVE-2024-22778](https://cve.now/CVE-2024-22778.md): HackMD CodiMD \<2.5.2 is vulnerable to Denial of Service. (CVSS 7.5)
- [CVE-2024-24476](https://cve.now/CVE-2024-24476.md): A buffer overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the pan/addr\_resolv.c, and ws\_manuf\_lo (CVSS 7.5)
- [CVE-2024-24478](https://cve.now/CVE-2024-24478.md): An issue in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the packet-bgp.c, dissect\_bgp\_open(tvbuff\_t\*tvb (CVSS 7.5)
- [CVE-2024-24479](https://cve.now/CVE-2024-24479.md): A Buffer Overflow in Wireshark before 4.2.0 allows a remote attacker to cause a denial of service via the wsutil/to\_str.c, and format\_fracti (CVSS 7.5)
- [CVE-2024-25249](https://cve.now/CVE-2024-25249.md): An issue in He3 App for macOS version 2.0.17, allows remote attackers to execute arbitrary code via the RunAsNode and enableNodeClilnspectAr (CVSS 9.8)
- [CVE-2024-25288](https://cve.now/CVE-2024-25288.md): SLIMS (Senayan Library Management Systems) 9 Bulian v9.6.1 is vulnerable to SQL Injection via pop-scope-vocabolary.php. (CVSS 4.9)
- [CVE-2024-25381](https://cve.now/CVE-2024-25381.md): There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content. (CVSS 6.1)
- [CVE-2024-25461](https://cve.now/CVE-2024-25461.md): Directory Traversal vulnerability in Terrasoft, Creatio Terrasoft CRM v.7.18.4.1532 allows a remote attacker to obtain sensitive information (CVSS 7.5)
- [CVE-2024-25891](https://cve.now/CVE-2024-25891.md): ChurchCRM 5.5.0 FRBidSheets.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. (CVSS 7.5)
- [CVE-2024-25892](https://cve.now/CVE-2024-25892.md): ChurchCRM 5.5.0 ConfirmReport.php is vulnerable to Blind SQL Injection (Time-based) via the familyId GET parameter. (CVSS 8.1)
- [CVE-2024-25893](https://cve.now/CVE-2024-25893.md): ChurchCRM 5.5.0 FRCertificates.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. (CVSS 9.1)
- [CVE-2024-25894](https://cve.now/CVE-2024-25894.md): ChurchCRM 5.5.0 /EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EventCount POST parameter. (CVSS 9.8)
- [CVE-2024-25895](https://cve.now/CVE-2024-25895.md): A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 5.5.0 allows remote attackers to inject arbitrary web script or HTML via t (CVSS 6.1)
- [CVE-2024-25896](https://cve.now/CVE-2024-25896.md): ChurchCRM 5.5.0 EventEditor.php is vulnerable to Blind SQL Injection (Time-based) via the EID POST parameter. (CVSS 5.3)
- [CVE-2024-25897](https://cve.now/CVE-2024-25897.md): ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter. (CVSS 9.8)
- [CVE-2024-25898](https://cve.now/CVE-2024-25898.md): A XSS vulnerability was found in the ChurchCRM v.5.5.0 functionality, edit your event, where malicious JS or HTML code can be inserted in th (CVSS 6.1)
- [CVE-2024-26310](https://cve.now/CVE-2024-26310.md): Archer Platform 6.8 before 6.14 P2 (6.14.0.2) contains an improper access control vulnerability. (CVSS 4.3)
- [CVE-2024-26311](https://cve.now/CVE-2024-26311.md): Archer Platform 6.x before 6.14 P2 HF1 (6.14.0.2.1) contains a reflected XSS vulnerability. (CVSS 5.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.