CVEs published February 23, 2024
79 CVEs were published on February 23, 2024: 5 critical, 30 high.
- Published
- 79
- Critical
- 5
- High
- 30
- Medium
- 27
- Low
- 4
- Unrated
- 13
- Now in CISA KEV
- 0
- Fix available
- 22
Most affected products
- Linux
- 19
- code-projects Library System
- 5
- zestardtechnologies Admin side data storage for Contact Form
- 4
- silabs.com Ember ZNet SDK
- 3
- code-projects Crime Reporting System
- 2
- CodeAstro House Rental Management System
- 2
- CodeAstro Membership Management System
- 2
- extendthemes Colibri Page Builder
- 2
- Microsoft Edge
- 2
- mlflow
- 2
Critical 5
- CVE-2024-26594ksmbd: validate mech token in session setupLinux
- CVE-2024-1783Totolink LR1200GB Web Interface cstecgi.cgi loginAuth stack-based overflowTotolink LR1200GB
- CVE-2024-22988ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the
- CVE-2024-24681An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2).
- CVE-2024-25730Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring,
High 30
- CVE-2024-26192Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2024-27133Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset.mlflow
- CVE-2024-27132Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe.mlflow
- CVE-2024-1832SourceCodester Complete File Management System Admin Login Form sql injectionSourceCodester Complete File Management System
- CVE-2024-1831SourceCodester Complete File Management System Login Form index.php sql injectionSourceCodester Complete File Management System
- CVE-2022-43842IBM Aspera Console SQL injectionIBM Aspera Console
- CVE-2024-1830code-projects Library System lost-password.php sql injectioncode-projects Library System
- CVE-2024-1829code-projects Library System registration.php sql injectioncode-projects Library System
- CVE-2024-1828code-projects Library System registration.php sql injectioncode-projects Library System
- CVE-2024-27318Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external_data field of the tensor protonnx
- CVE-2024-1827code-projects Library System login.php sql injectioncode-projects Library System
- CVE-2024-1826code-projects Library System login.php sql injectioncode-projects Library System
- CVE-2024-23320Apache DolphinScheduler: Arbitrary js execution as root for authenticated usersApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2024-1824CodeAstro House Rental Management System signing.php sql injectionCodeAstro House Rental Management System
- CVE-2024-26150`@backstage/backend-common` vulnerable to path traversal through symlinksbackstage · @backstage/backend-common
- CVE-2024-1820code-projects Crime Reporting System inchargelogin.php sql injectioncode-projects Crime Reporting System
- CVE-2024-26598KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cacheLinux
- CVE-2024-26597net: qualcomm: rmnet: fix global oob in rmnet_policyLinux
- CVE-2023-52461drm/sched: Fix bounds limiting when given a malformed entityLinux
- CVE-2023-52454nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU lengthLinux
- CVE-2023-52453hisi_acc_vfio_pci: Update migration data pointer correctly on saving/resumeLinux
- CVE-2024-1817Demososo DM Enterprise Website Building System Cookie indexDM_load.php dmlogin improper authenticationDemososo DM Enterprise Website Building System
- CVE-2024-25928WordPress Sitepact's Contact Form 7 Extension For Klaviyo Plugin <= 1.0.5 is vulnerable to SQL InjectionSitepact
- CVE-2024-1776Admin side data storage for Contact Form 7 <= 1.1.1 - Authenticated (Admin+) SQL Injectionzestardtechnologies Admin side data storage for Contact Form
- CVE-2024-22243CVE-2024-22243: Spring Framework URL Parsing with Host ValidationSpring Framework · org.springframework:spring-web
- CVE-2024-1786D-Link DIR-600M C1 Telnet Service buffer overflowD-Link DIR-600M C1
- CVE-2024-1683DLL Injection in Tenable Identity Exposure Secure RelayTenable Identity Exposure Secure Relay
- CVE-2024-24309In the module "Survey TMA" (ecomiz_survey_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information wit
- CVE-2024-24310In the module "Generate barcode on invoice / delivery slip" (ecgeneratebarcode) from Ether Creation <= 1.2.0 for PrestaShop, a guest can per
- CVE-2024-25469SQL Injection vulnerability in CRMEB crmeb_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude
Medium, low and unrated 44
- CVE-2024-22395Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could poSonicWall SMA100
- CVE-2024-26188Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2024-21423Microsoft Edge (Chromium-based) Information Disclosure VulnerabilityMicrosoft Edge
- CVE-2024-1834SourceCodester Simple Student Attendance System ?page=attendance&class_id=1 cross site scriptingSourceCodester Simple Student Attendance System
- CVE-2024-1833SourceCodester Employee Management System login.php sql injectionSourceCodester Employee Management System
- CVE-2023-51393Potential DoS due to BusFault and Assert in Ember ZNet legacy packet buffersilabs.com Ember ZNet SDK
- CVE-2023-51394Potential DoS for EFR32xxx parts in high traffic environments due to null buffer dereference / crashsilabs.com Ember ZNet SDK
- CVE-2024-27319Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX_ASSERT and ONNX_ASSERTM functions onnx
- CVE-2024-1825CodeAstro House Rental Management System User Registration Page cross site scriptingCodeAstro House Rental Management System
- CVE-2023-51392Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCMsilabs.com Ember ZNet SDK
- CVE-2024-1823CodeAstro Simple Voting System Backend users.php access controlCodeAstro Simple Voting System
- CVE-2024-1822PHPGurukul Tourism Management System user-bookings.php cross site scriptingPHPGurukul Tourism Management System
- CVE-2024-1821code-projects Crime Reporting System police_add.php sql injectioncode-projects Crime Reporting System
- CVE-2024-25629c-ares out of bounds read in ares__read_line()c-ares
- CVE-2024-26599pwm: Fix out-of-bounds access in of_pwm_single_xlate()Linux
- CVE-2024-26596net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice eventsLinux
- CVE-2024-26595mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error pathLinux
- CVE-2023-52464EDAC/thunderx: Fix possible out-of-bounds string accessLinux
- CVE-2023-52463efivarfs: force RO when remounting if SetVariable is not supportedLinux
- CVE-2023-52462bpf: fix check for attempt to corrupt spilled pointerLinux
- CVE-2023-52460drm/amd/display: Fix NULL pointer dereference at hibernateLinux
- CVE-2023-52459media: v4l: async: Fix duplicated list deletionLinux
- CVE-2023-52458block: add check that partition length needs to be aligned with block sizeLinux
- CVE-2023-52457serial: 8250: omap: Don't skip resource freeing if pm_runtime_resume_and_get() failedLinux
- CVE-2023-52456serial: imx: fix tx statemachine deadlockLinux
- CVE-2023-52455iommu: Don't reserve 0-length IOVA regionLinux
- CVE-2024-1819CodeAstro Membership Management System Add Members Tab unrestricted uploadCodeAstro Membership Management System
- CVE-2024-1818CodeAstro Membership Management System Logo unrestricted uploadCodeAstro Membership Management System
- CVE-2024-25915WordPress Pexels: Free Stock Photos Plugin <= 1.2.2 is vulnerable to Server Side Request Forgery (SSRF)Raaj Trambadia Pexels: Free Stock Photos
- CVE-2023-24416WordPress All In One Favicon Plugin <= 4.7 is vulnerable to Arbitrary File DeletionArne Franken All In One Favicon
- CVE-2024-1360Colibri WP <= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installationextendthemes Colibri WP
- CVE-2024-1362Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via cp_shortcode_refreshextendthemes Colibri Page Builder
- CVE-2024-1361Colibri Page Builder <= 1.0.253 - Cross-Site Request Fogery via extend_builderextendthemes Colibri Page Builder
- CVE-2024-1590Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Buttonsoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2023-4826Socialdriver < 2024 - Prototype Pollution to XSSsocialdriver
- CVE-2024-26593i2c: i801: Fix block process call transactionsLinux
- CVE-2024-0563Denial of service condition in M-Files ServerM-Files Server
- CVE-2023-37540HCL Sametime Chat is affected by an unimplemented feature in the UI HCL Software HCL Sametime Chat
- CVE-2024-1778Admin side data storage for Contact Form 7 <= 1.1.1 - Missing Authorization to Unauthenticated Bookmark Status Alterationzestardtechnologies Admin side data storage for Contact Form
- CVE-2024-1777Admin side data storage for Contact Form 7 <= 1.1.1 - Cross-Site Request Forgeryzestardtechnologies Admin side data storage for Contact Form
- CVE-2024-1779Admin side data storage for Contact Form 7 plugin <= 1.1.1 - Missing Authorization to Unauthenticated Read Status Updatezestardtechnologies Admin side data storage for Contact Form
- CVE-2024-1784Limbas main_admin.php sql injectionLimbas
- CVE-2024-1781Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injectionTotolink X6000R AX3000
- CVE-2024-22776Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring s