# CVEs published 2024-02-22

101 CVEs were published on February 22, 2024: 7 critical, 48 high. Days are UTC.

- [CVE-2024-26152](https://cve.now/CVE-2024-26152.md): Label Studio vulnerable to Cross-site Scripting if \`\<Choices\>\` or \`\<Labels\>\` are used in labeling config (CVSS 4.7, HumanSignal label-studio · label-studio)
- [CVE-2024-1750](https://cve.now/CVE-2024-1750.md): TemmokuMVC Image Download images\_get\_down.php img\_replace deserialization (CVSS 5.6, TemmokuMVC)
- [CVE-2024-1749](https://cve.now/CVE-2024-1749.md): Bdtask Bhojon Best Restaurant Management Software Message Page message cross site scripting (CVSS 2.4, Bdtask Bhojon Best Restaurant Management Software)
- [CVE-2024-1748](https://cve.now/CVE-2024-1748.md): van\_der\_Schaar LAB AutoPrognosis Release Note load\_model\_from\_file deserialization (CVSS 5.0, van\_der\_Schaar LAB AutoPrognosis)
- [CVE-2024-26151](https://cve.now/CVE-2024-26151.md): Potentially untrusted input is rendered as HTML in final output (CVSS 8.2, FelixSchwarz mjml-python · mjml)
- [CVE-2024-26128](https://cve.now/CVE-2024-26128.md): baserCMS Cross-site Scripting vulnerability in Content Management (CVSS 5.4, baserproject basercms · baserproject/basercms)
- [CVE-2024-25130](https://cve.now/CVE-2024-25130.md): Tuleap's mass update clears the permissions on artifact field (CVSS 5.4, Enalean tuleap)
- [CVE-2024-25129](https://cve.now/CVE-2024-25129.md): Limited data exfiltration in CodeQL CLI (CVSS 2.7, github codeql-cli-binaries)
- [CVE-2024-24817](https://cve.now/CVE-2024-24817.md): User can see invitees in events created in PMs and private categories (CVSS 4.3, discourse-calendar)
- [CVE-2024-26592](https://cve.now/CVE-2024-26592.md): ksmbd: fix UAF issue in ksmbd\_tcp\_new\_connection() (CVSS 9.8, Linux)
- [CVE-2024-26591](https://cve.now/CVE-2024-26591.md): bpf: Fix re-attachment branch in bpf\_tracing\_prog\_attach (no CVSS, Linux)
- [CVE-2023-52452](https://cve.now/CVE-2023-52452.md): bpf: Fix accesses to uninit stack slots (no CVSS, Linux)
- [CVE-2023-52451](https://cve.now/CVE-2023-52451.md): powerpc/pseries/memhp: Fix access beyond end of drmem array (no CVSS, Linux)
- [CVE-2023-52450](https://cve.now/CVE-2023-52450.md): perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi\_fill\_topology() (no CVSS, Linux)
- [CVE-2023-52449](https://cve.now/CVE-2023-52449.md): mtd: Fix gluebi NULL pointer dereference caused by ftl notifier (no CVSS, Linux)
- [CVE-2023-52448](https://cve.now/CVE-2023-52448.md): gfs2: Fix kernel NULL pointer dereference in gfs2\_rgrp\_dump (no CVSS, Linux)
- [CVE-2023-52447](https://cve.now/CVE-2023-52447.md): bpf: Defer the free of inner map when necessary (CVSS 7.8, Linux)
- [CVE-2023-52446](https://cve.now/CVE-2023-52446.md): bpf: Fix a race condition between btf\_put() and map\_free() (CVSS 7.8, Linux)
- [CVE-2023-52445](https://cve.now/CVE-2023-52445.md): media: pvrusb2: fix use after free on context disconnection (no CVSS, Linux)
- [CVE-2023-52444](https://cve.now/CVE-2023-52444.md): f2fs: fix to avoid dirent corruption (CVSS 7.8, Linux)
- [CVE-2024-26590](https://cve.now/CVE-2024-26590.md): erofs: fix inconsistent per-file compression format (CVSS 5.5, Linux)
- [CVE-2024-26589](https://cve.now/CVE-2024-26589.md): bpf: Reject variable offset alu on PTR\_TO\_FLOW\_KEYS (CVSS 7.8, Linux)
- [CVE-2024-26588](https://cve.now/CVE-2024-26588.md): LoongArch: BPF: Prevent out-of-bounds memory access (CVSS 7.8, Linux)
- [CVE-2024-26587](https://cve.now/CVE-2024-26587.md): net: netdevsim: don't try to destroy PHC on VFs (no CVSS, Linux)
- [CVE-2024-26586](https://cve.now/CVE-2024-26586.md): mlxsw: spectrum\_acl\_tcam: Fix stack corruption (CVSS 7.8, Linux)
- [CVE-2023-52443](https://cve.now/CVE-2023-52443.md): apparmor: avoid crash when parsed profile name is empty (no CVSS, Linux)
- [CVE-2023-51389](https://cve.now/CVE-2023-51389.md): HertzBeat SnakeYAML Deser RCE (CVSS 9.8, dromara hertzbeat)
- [CVE-2023-51388](https://cve.now/CVE-2023-51388.md): HertzBeat AviatorScript Inject RCE (CVSS 9.8, dromara hertzbeat)
- [CVE-2023-51653](https://cve.now/CVE-2023-51653.md): Hertzbeat JMX JNDI RCE (CVSS 9.8, dromara hertzbeat)
- [CVE-2024-26281](https://cve.now/CVE-2024-26281.md): Upon scanning a JavaScript URI with the QR code scanner, an attacker could have executed unauthorized scripts on the current top origin site (CVSS 4.7, Mozilla Firefox for iOS)
- [CVE-2024-26282](https://cve.now/CVE-2024-26282.md): Using an AMP url with a canonical element, an attacker could have executed JavaScript from an opened bookmarked page. (CVSS 7.1, Mozilla Firefox for iOS)
- [CVE-2024-26283](https://cve.now/CVE-2024-26283.md): An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom F (CVSS 7.8, Mozilla Firefox for iOS)
- [CVE-2024-1563](https://cve.now/CVE-2024-1563.md): An attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI when opening an external URL with a custom F (CVSS 8.1, Mozilla Focus for iOS)
- [CVE-2024-26284](https://cve.now/CVE-2024-26284.md): Utilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS) on a victim website, if the victim had a (CVSS 6.1, Mozilla Focus for iOS)
- [CVE-2023-51450](https://cve.now/CVE-2023-51450.md): baserCMS OS command injection vulnerability in Installer (CVSS 5.6, baserproject basercms · baserproject/basercms)
- [CVE-2023-44379](https://cve.now/CVE-2023-44379.md): baserCMS Cross-site Scripting vulnerability in Site search Feature (CVSS 6.1, baserproject basercms · baserproject/basercms)
- [CVE-2023-3966](https://cve.now/CVE-2023-3966.md): Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packet (CVSS 7.5, openvswitch · Red Hat Fast Datapath for RHEL +4)
- [CVE-2024-25021](https://cve.now/CVE-2024-25021.md): IBM AIX command execution (CVSS 8.4, IBM AIX)
- [CVE-2024-1104](https://cve.now/CVE-2024-1104.md): Temporary denial of service during a brute force attack (CVSS 7.5, Areal Topkapi Webserv2)
- [CVE-2024-0220](https://cve.now/CVE-2024-0220.md): B&R products use insufficient communication encryption (CVSS 8.3, B&R Industrial Automation Automation Studio · B&R Industria…)
- [CVE-2024-22393](https://cve.now/CVE-2024-22393.md): Apache Answer: Pixel Flood Attack by uploading the large pixel file (CVSS 9.1, Apache Software Foundation Apache Answer · github.com/apach…)
- [CVE-2024-23349](https://cve.now/CVE-2024-23349.md): Apache Answer: XSS vulnerability when submitting summary (CVSS 5.4, Apache Software Foundation Apache Answer · github.com/apach…)
- [CVE-2023-29180](https://cve.now/CVE-2023-29180.md): A null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12 (CVSS 7.3, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2023-29179](https://cve.now/CVE-2023-29179.md): A null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11, 6.4.0 through 6.4.12, Fortiproxy version 7 (CVSS 6.4, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2023-29181](https://cve.now/CVE-2023-29181.md): A use of externally-controlled format string vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6. (CVSS 8.3, Fortinet FortiOS · Fortinet FortiPAM +1)
- [CVE-2024-26578](https://cve.now/CVE-2024-26578.md): Apache Answer: Repeated submission at registration created duplicate users with the same name (CVSS 5.9, Apache Software Foundation Apache Answer · github.com/apach…)
- [CVE-2024-1053](https://cve.now/CVE-2024-1053.md): Event Tickets and Registration \<= 5.8.1 - Missing Authorization (CVSS 4.3, stellarwp Event Tickets and Registration)
- [CVE-2024-0903](https://cve.now/CVE-2024-0903.md): User Feedback – Create Interactive Feedback Form, User Surveys, and Polls in Seconds \<= 1.0.13 - Unauthenticated Stored Cross-Site Scripting (CVSS 5.4, smub UserFeedback – Create Interactive Feedback Form, User…)
- [CVE-2024-23137](https://cve.now/CVE-2024-23137.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23136](https://cve.now/CVE-2024-23136.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23135](https://cve.now/CVE-2024-23135.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23134](https://cve.now/CVE-2024-23134.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23133](https://cve.now/CVE-2024-23133.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23132](https://cve.now/CVE-2024-23132.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23131](https://cve.now/CVE-2024-23131.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23130](https://cve.now/CVE-2024-23130.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23129](https://cve.now/CVE-2024-23129.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23128](https://cve.now/CVE-2024-23128.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23127](https://cve.now/CVE-2024-23127.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23126](https://cve.now/CVE-2024-23126.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23125](https://cve.now/CVE-2024-23125.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23124](https://cve.now/CVE-2024-23124.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23123](https://cve.now/CVE-2024-23123.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23122](https://cve.now/CVE-2024-23122.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2024-23121](https://cve.now/CVE-2024-23121.md): Multiple Vulnerabilities in the Autodesk AutoCAD Desktop Software (CVSS 7.8, Autodesk AutoCAD · Autodesk Civil +1)
- [CVE-2023-4895](https://cve.now/CVE-2023-4895.md): Missing Authorization in GitLab (CVSS 4.3, GitLab)
- [CVE-2022-25377](https://cve.now/CVE-2022-25377.md): The ACME-challenge endpoint in Appwrite 0.5.0 through 0.12.x before 0.12.2 allows remote attackers to read arbitrary local files via ../ dir (CVSS 7.5, appwrite/server-ce)
- [CVE-2023-52160](https://cve.now/CVE-2023-52160.md): The implementation of PEAP in wpa\_supplicant through 2.10 allows authentication bypass. (CVSS 6.5)
- [CVE-2023-52161](https://cve.now/CVE-2023-52161.md): The Access Point functionality in eapol\_auth\_key\_handle in eapol.c in iNet wireless daemon (IWD) before 2.14 allows attackers to gain unauth (CVSS 7.5)
- [CVE-2024-22547](https://cve.now/CVE-2024-22547.md): WayOS IBR-7150 \<17.06.23 is vulnerable to Cross Site Scripting (XSS). (CVSS 4.7)
- [CVE-2024-23094](https://cve.now/CVE-2024-23094.md): Flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /cover/addons/info\_media\_gallery/action/ed (CVSS 8.8)
- [CVE-2024-25251](https://cve.now/CVE-2024-25251.md): code-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control. (CVSS 8.8)
- [CVE-2024-25369](https://cve.now/CVE-2024-25369.md): A reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run arbitrary code via crafted string after the gr (CVSS 6.1)
- [CVE-2024-25385](https://cve.now/CVE-2024-25385.md): An issue in flvmeta v.1.2.2 allows a local attacker to cause a denial of service via the flvmeta/src/flv.c:375:21 function in flv\_close. (CVSS 6.2)
- [CVE-2024-25423](https://cve.now/CVE-2024-25423.md): An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execute arbitrary code via a crafted c4d\_base.xdl64 file. (CVSS 7.0)
- [CVE-2024-25746](https://cve.now/CVE-2024-25746.md): Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42\_multi allows a remote attacker to execute a (CVSS 8.8)
- [CVE-2024-25748](https://cve.now/CVE-2024-25748.md): A Stack Based Buffer Overflow vulnerability in tenda AC9 AC9 v.3.0 with firmware version v.15.03.06.42\_multi allows a remote attacker to exe (CVSS 8.8)
- [CVE-2024-25753](https://cve.now/CVE-2024-25753.md): Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42\_multi allows a remote attacker to execute a (CVSS 8.8)
- [CVE-2024-25756](https://cve.now/CVE-2024-25756.md): A Stack Based Buffer Overflow vulnerability in Tenda AC9 v.3.0 with firmware version v.15.03.06.42\_multi allows a remote attacker to execute (CVSS 8.0)
- [CVE-2024-25801](https://cve.now/CVE-2024-25801.md): SKINsoft S-Museum 7.02.3 allows XSS via the filename of an uploaded file. (CVSS 4.6)
- [CVE-2024-25802](https://cve.now/CVE-2024-25802.md): SKINsoft S-Museum 7.02.3 allows Unrestricted File Upload via the Add Media function. (CVSS 9.8)
- [CVE-2024-25828](https://cve.now/CVE-2024-25828.md): cmseasy V7.7.7.9 has an arbitrary file deletion vulnerability in lib/admin/template\_admin.php. (CVSS 4.9)
- [CVE-2024-25850](https://cve.now/CVE-2024-25850.md): Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps\_ap\_ssid5g parameter (CVSS 9.8)
- [CVE-2024-25851](https://cve.now/CVE-2024-25851.md): Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the config\_sequence parameter in other\_para of cgite (CVSS 8.0)
- [CVE-2024-25873](https://cve.now/CVE-2024-25873.md): Enhavo v0.13.1 was discovered to contain an HTML injection vulnerability in the Author text field under the Blockquote module. (CVSS 5.4)
- [CVE-2024-25874](https://cve.now/CVE-2024-25874.md): A cross-site scripting (XSS) vulnerability in the New/Edit Article module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web sc (CVSS 5.4, enhavo/enhavo-app)
- [CVE-2024-25875](https://cve.now/CVE-2024-25875.md): A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or H (CVSS 6.1, enhavo/enhavo-app)
- [CVE-2024-25876](https://cve.now/CVE-2024-25876.md): A cross-site scripting (XSS) vulnerability in the Header module of Enhavo CMS v0.13.1 allows attackers to execute arbitrary web scripts or H (CVSS 6.1, enhavo/enhavo-app)
- [CVE-2024-26349](https://cve.now/CVE-2024-26349.md): flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete\_translation.php (CVSS 4.3)
- [CVE-2024-26350](https://cve.now/CVE-2024-26350.md): flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update\_contact\_form\_settings.p (CVSS 8.8)
- [CVE-2024-26351](https://cve.now/CVE-2024-26351.md): flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/update\_place.php (CVSS 6.1)
- [CVE-2024-26352](https://cve.now/CVE-2024-26352.md): flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/add\_places.php (CVSS 8.8)
- [CVE-2024-26445](https://cve.now/CVE-2024-26445.md): flusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /core/tools/delete\_place.php (CVSS 6.1)
- [CVE-2024-26481](https://cve.now/CVE-2024-26481.md): Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. (CVSS 4.7, getkirby/cms)
- [CVE-2024-26482](https://cve.now/CVE-2024-26482.md): An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. (CVSS 7.1)
- [CVE-2024-26483](https://cve.now/CVE-2024-26483.md): An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a craf (CVSS 8.8, getkirby/cms)
- [CVE-2024-26484](https://cve.now/CVE-2024-26484.md): A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrar (CVSS 6.1)
- [CVE-2024-26489](https://cve.now/CVE-2024-26489.md): A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Social block links' module of flusity-CMS v2.33 allows attackers to exec (CVSS 6.1)
- [CVE-2024-26490](https://cve.now/CVE-2024-26490.md): A cross-site scripting (XSS) vulnerability in the Addon JD Simple module of flusity-CMS v2.33 allows attackers to execute arbitrary web scri (CVSS 5.4)
- [CVE-2024-26491](https://cve.now/CVE-2024-26491.md): A cross-site scripting (XSS) vulnerability in the Addon JD Flusity 'Media Gallery with description' module of flusity-CMS v2.33 allows attac (CVSS 6.1)
- [CVE-2024-27283](https://cve.now/CVE-2024-27283.md): A vulnerability was discovered in Veritas eDiscovery Platform before 10.2.5. (CVSS 7.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.