CVEs published February 22, 2024
101 CVEs were published on February 22, 2024: 7 critical, 48 high.
- Published
- 101
- Critical
- 7
- High
- 48
- Medium
- 35
- Low
- 2
- Unrated
- 9
- Now in CISA KEV
- 0
- Fix available
- 45
Most affected products
- Autodesk AutoCAD · Autodesk Civil +1
- 17
- Linux
- 17
- Apache Software Foundation Apache Answer · github.com/apach…
- 3
- baserproject basercms · baserproject/basercms
- 3
- dromara hertzbeat
- 3
- enhavo/enhavo-app
- 3
- Mozilla Firefox for iOS
- 3
- getkirby/cms
- 2
- Mozilla Focus for iOS
- 2
- appwrite/server-ce
- 1
Critical 7
- CVE-2024-26592ksmbd: fix UAF issue in ksmbd_tcp_new_connection()Linux
- CVE-2023-51389HertzBeat SnakeYAML Deser RCEdromara hertzbeat
- CVE-2023-51388HertzBeat AviatorScript Inject RCEdromara hertzbeat
- CVE-2023-51653Hertzbeat JMX JNDI RCEdromara hertzbeat
- CVE-2024-22393Apache Answer: Pixel Flood Attack by uploading the large pixel fileApache Software Foundation Apache Answer · github.com/apach…
- CVE-2024-25802SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function.
- CVE-2024-25850Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter
High 48
- CVE-2024-26151Potentially untrusted input is rendered as HTML in final outputFelixSchwarz mjml-python · mjml
- CVE-2023-52447bpf: Defer the free of inner map when necessaryLinux
- CVE-2023-52446bpf: Fix a race condition between btf_put() and map_free()Linux
- CVE-2023-52444f2fs: fix to avoid dirent corruptionLinux
- CVE-2024-26589bpf: Reject variable offset alu on PTR_TO_FLOW_KEYSLinux
- CVE-2024-26588LoongArch: BPF: Prevent out-of-bounds memory accessLinux
- CVE-2024-26586mlxsw: spectrum_acl_tcam: Fix stack corruptionLinux
- CVE-2024-26282Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page.Mozilla Firefox for iOS
- CVE-2024-26283An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom FMozilla Firefox for iOS
- CVE-2024-1563An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom FMozilla Focus for iOS
- CVE-2023-3966Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packetopenvswitch · Red Hat Fast Datapath for RHEL +4
- CVE-2024-25021IBM AIX command executionIBM AIX
- CVE-2024-1104Temporary denial of service during a brute force attackAreal Topkapi Webserv2
- CVE-2024-0220B&R products use insufficient communication encryptionB&R Industrial Automation Automation Studio · B&R Industria…
- CVE-2023-29180A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12Fortinet FortiOS · Fortinet FortiProxy
- CVE-2023-29181A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.Fortinet FortiOS · Fortinet FortiPAM +1
- CVE-2024-23137Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23136Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23135Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23134Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23133Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23132Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23131Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23130Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23129Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23128Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23127Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23126Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23125Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23124Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23123Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23122Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2024-23121Multiple Vulnerabilities in the Autodesk AutoCAD Desktop SoftwareAutodesk AutoCAD · Autodesk Civil +1
- CVE-2022-25377The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ dirappwrite/server-ce
- CVE-2023-52161The Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauth
- CVE-2024-23094Flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /cover/addons/info_media_gallery/action/ed
- CVE-2024-25251code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control.
- CVE-2024-25423An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execute arbitrary code via a crafted c4d_base.xdl64 file.
- CVE-2024-25746Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute a
- CVE-2024-25748A Stack Based Buffer Overflow vulnerability in tenda AC9 AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to exe
- CVE-2024-25753Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute a
- CVE-2024-25756A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42_multi allows a remote attacker to execute
- CVE-2024-25851Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config_sequence parameter in other_para of cgite
- CVE-2024-26350flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_contact_form_settings.p
- CVE-2024-26352flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add_places.php
- CVE-2024-26482An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0.
- CVE-2024-26483An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafgetkirby/cms
- CVE-2024-27283A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5.
Medium, low and unrated 46
- CVE-2024-26152Label Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config HumanSignal label-studio · label-studio
- CVE-2024-1750TemmokuMVC Image Download images_get_down.php img_replace deserializationTemmokuMVC
- CVE-2024-1749Bdtask Bhojon Best Restaurant Management Software Message Page message cross site scriptingBdtask Bhojon Best Restaurant Management Software
- CVE-2024-1748van_der_Schaar LAB AutoPrognosis Release Note load_model_from_file deserializationvan_der_Schaar LAB AutoPrognosis
- CVE-2024-26128baserCMS Cross-site Scripting vulnerability in Content Managementbaserproject basercms · baserproject/basercms
- CVE-2024-25130Tuleap's mass update clears the permissions on artifact fieldEnalean tuleap
- CVE-2024-25129Limited data exfiltration in CodeQL CLIgithub codeql-cli-binaries
- CVE-2024-24817User can see invitees in events created in PMs and private categoriesdiscourse-calendar
- CVE-2024-26591bpf: Fix re-attachment branch in bpf_tracing_prog_attachLinux
- CVE-2023-52452bpf: Fix accesses to uninit stack slotsLinux
- CVE-2023-52451powerpc/pseries/memhp: Fix access beyond end of drmem arrayLinux
- CVE-2023-52450perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()Linux
- CVE-2023-52449mtd: Fix gluebi NULL pointer dereference caused by ftl notifierLinux
- CVE-2023-52448gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dumpLinux
- CVE-2023-52445media: pvrusb2: fix use after free on context disconnectionLinux
- CVE-2024-26590erofs: fix inconsistent per-file compression formatLinux
- CVE-2024-26587net: netdevsim: don't try to destroy PHC on VFsLinux
- CVE-2023-52443apparmor: avoid crash when parsed profile name is emptyLinux
- CVE-2024-26281Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin siteMozilla Firefox for iOS
- CVE-2024-26284Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a Mozilla Focus for iOS
- CVE-2023-51450baserCMS OS command injection vulnerability in Installerbaserproject basercms · baserproject/basercms
- CVE-2023-44379baserCMS Cross-site Scripting vulnerability in Site search Featurebaserproject basercms · baserproject/basercms
- CVE-2024-23349Apache Answer: XSS vulnerability when submitting summaryApache Software Foundation Apache Answer · github.com/apach…
- CVE-2023-29179A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, Fortiproxy version 7Fortinet FortiProxy · Fortinet FortiOS
- CVE-2024-26578Apache Answer: Repeated submission at registration created duplicate users with the same nameApache Software Foundation Apache Answer · github.com/apach…
- CVE-2024-1053Event Tickets and Registration <= 5.8.1 - Missing Authorizationstellarwp Event Tickets and Registration
- CVE-2024-0903User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds <= 1.0.13 - Unauthenticated Stored Cross-Site Scriptingsmub UserFeedback – Create Interactive Feedback Form, User…
- CVE-2023-4895Missing Authorization in GitLabGitLab
- CVE-2023-52160The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass.
- CVE-2024-22547WayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-25369A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the gr
- CVE-2024-25385An issue in flvmeta v.1.2.2 allows a local attacker to cause a denial of service via the flvmeta/src/flv.c:375:21 function in flv_close.
- CVE-2024-25801SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file.
- CVE-2024-25828cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template_admin.php.
- CVE-2024-25873Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module.
- CVE-2024-25874A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scenhavo/enhavo-app
- CVE-2024-25875A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or Henhavo/enhavo-app
- CVE-2024-25876A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or Henhavo/enhavo-app
- CVE-2024-26349flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_translation.php
- CVE-2024-26351flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update_place.php
- CVE-2024-26445flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete_place.php
- CVE-2024-26481Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.getkirby/cms
- CVE-2024-26484A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrar
- CVE-2024-26489A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Social block links' module of flusity-CMS v2.33 allows attackers to exec
- CVE-2024-26490A cross-site scripting (XSS) vulnerability in the Addon JD Simple module of flusity-CMS v2.33 allows attackers to execute arbitrary web scri
- CVE-2024-26491A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attac