# CVEs published 2024-02-23

79 CVEs were published on February 23, 2024: 5 critical, 30 high. Days are UTC.

- [CVE-2024-22395](https://cve.now/CVE-2024-22395.md): Improper access control vulnerability has been identified in the SMA100 SSL-VPN virtual office portal, which in specific conditions could po (CVSS 6.3, SonicWall SMA100)
- [CVE-2024-26192](https://cve.now/CVE-2024-26192.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 8.2, Microsoft Edge)
- [CVE-2024-26188](https://cve.now/CVE-2024-26188.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.3, Microsoft Edge for Android)
- [CVE-2024-27133](https://cve.now/CVE-2024-27133.md): Insufficient sanitization in MLflow leads to XSS when running a recipe that uses an untrusted dataset. (CVSS 7.5, mlflow)
- [CVE-2024-27132](https://cve.now/CVE-2024-27132.md): Insufficient sanitization in MLflow leads to XSS when running an untrusted recipe. (CVSS 7.5, mlflow)
- [CVE-2024-21423](https://cve.now/CVE-2024-21423.md): Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVSS 4.8, Microsoft Edge)
- [CVE-2024-1834](https://cve.now/CVE-2024-1834.md): SourceCodester Simple Student Attendance System ?page=attendance&class\_id=1 cross site scripting (CVSS 3.5, SourceCodester Simple Student Attendance System)
- [CVE-2024-1833](https://cve.now/CVE-2024-1833.md): SourceCodester Employee Management System login.php sql injection (CVSS 6.9, SourceCodester Employee Management System)
- [CVE-2024-1832](https://cve.now/CVE-2024-1832.md): SourceCodester Complete File Management System Admin Login Form sql injection (CVSS 7.3, SourceCodester Complete File Management System)
- [CVE-2023-51393](https://cve.now/CVE-2023-51393.md): Potential DoS due to BusFault and Assert in Ember ZNet legacy packet buffer (CVSS 5.3, silabs.com Ember ZNet SDK)
- [CVE-2023-51394](https://cve.now/CVE-2023-51394.md): Potential DoS for EFR32xxx parts in high traffic environments due to null buffer dereference / crash (CVSS 5.3, silabs.com Ember ZNet SDK)
- [CVE-2024-1831](https://cve.now/CVE-2024-1831.md): SourceCodester Complete File Management System Login Form index.php sql injection (CVSS 7.3, SourceCodester Complete File Management System)
- [CVE-2022-43842](https://cve.now/CVE-2022-43842.md): IBM Aspera Console SQL injection (CVSS 8.6, IBM Aspera Console)
- [CVE-2024-1830](https://cve.now/CVE-2024-1830.md): code-projects Library System lost-password.php sql injection (CVSS 7.3, code-projects Library System)
- [CVE-2024-1829](https://cve.now/CVE-2024-1829.md): code-projects Library System registration.php sql injection (CVSS 7.3, code-projects Library System)
- [CVE-2024-1828](https://cve.now/CVE-2024-1828.md): code-projects Library System registration.php sql injection (CVSS 7.3, code-projects Library System)
- [CVE-2024-27319](https://cve.now/CVE-2024-27319.md): Versions of the package onnx before and including 1.15.0 are vulnerable to Out-of-bounds Read as the ONNX\_ASSERT and ONNX\_ASSERTM functions (CVSS 4.4, onnx)
- [CVE-2024-27318](https://cve.now/CVE-2024-27318.md): Versions of the package onnx before and including 1.15.0 are vulnerable to Directory Traversal as the external\_data field of the tensor prot (CVSS 7.5, onnx)
- [CVE-2024-1827](https://cve.now/CVE-2024-1827.md): code-projects Library System login.php sql injection (CVSS 7.3, code-projects Library System)
- [CVE-2024-1826](https://cve.now/CVE-2024-1826.md): code-projects Library System login.php sql injection (CVSS 7.3, code-projects Library System)
- [CVE-2024-23320](https://cve.now/CVE-2024-23320.md): Apache DolphinScheduler: Arbitrary js execution as root for authenticated users (CVSS 8.8, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2024-1825](https://cve.now/CVE-2024-1825.md): CodeAstro House Rental Management System User Registration Page cross site scripting (CVSS 4.3, CodeAstro House Rental Management System)
- [CVE-2023-51392](https://cve.now/CVE-2023-51392.md): Silicon Labs EFR32xxx parts with classic key storage do not use hardware accelerated AES-CCM (CVSS 6.2, silabs.com Ember ZNet SDK)
- [CVE-2024-1824](https://cve.now/CVE-2024-1824.md): CodeAstro House Rental Management System signing.php sql injection (CVSS 7.3, CodeAstro House Rental Management System)
- [CVE-2024-26150](https://cve.now/CVE-2024-26150.md): \`@backstage/backend-common\` vulnerable to path traversal through symlinks (CVSS 8.7, backstage · @backstage/backend-common)
- [CVE-2024-1823](https://cve.now/CVE-2024-1823.md): CodeAstro Simple Voting System Backend users.php access control (CVSS 5.3, CodeAstro Simple Voting System)
- [CVE-2024-1822](https://cve.now/CVE-2024-1822.md): PHPGurukul Tourism Management System user-bookings.php cross site scripting (CVSS 2.4, PHPGurukul Tourism Management System)
- [CVE-2024-1821](https://cve.now/CVE-2024-1821.md): code-projects Crime Reporting System police\_add.php sql injection (CVSS 5.5, code-projects Crime Reporting System)
- [CVE-2024-1820](https://cve.now/CVE-2024-1820.md): code-projects Crime Reporting System inchargelogin.php sql injection (CVSS 7.3, code-projects Crime Reporting System)
- [CVE-2024-25629](https://cve.now/CVE-2024-25629.md): c-ares out of bounds read in ares\_\_read\_line() (CVSS 4.4, c-ares)
- [CVE-2024-26599](https://cve.now/CVE-2024-26599.md): pwm: Fix out-of-bounds access in of\_pwm\_single\_xlate() (no CVSS, Linux)
- [CVE-2024-26598](https://cve.now/CVE-2024-26598.md): KVM: arm64: vgic-its: Avoid potential UAF in LPI translation cache (CVSS 8.8, Linux)
- [CVE-2024-26597](https://cve.now/CVE-2024-26597.md): net: qualcomm: rmnet: fix global oob in rmnet\_policy (CVSS 7.8, Linux)
- [CVE-2024-26596](https://cve.now/CVE-2024-26596.md): net: dsa: fix netdev\_priv() dereference before check on non-DSA netdevice events (no CVSS, Linux)
- [CVE-2024-26595](https://cve.now/CVE-2024-26595.md): mlxsw: spectrum\_acl\_tcam: Fix NULL pointer dereference in error path (no CVSS, Linux)
- [CVE-2023-52464](https://cve.now/CVE-2023-52464.md): EDAC/thunderx: Fix possible out-of-bounds string access (no CVSS, Linux)
- [CVE-2023-52463](https://cve.now/CVE-2023-52463.md): efivarfs: force RO when remounting if SetVariable is not supported (no CVSS, Linux)
- [CVE-2023-52462](https://cve.now/CVE-2023-52462.md): bpf: fix check for attempt to corrupt spilled pointer (no CVSS, Linux)
- [CVE-2023-52461](https://cve.now/CVE-2023-52461.md): drm/sched: Fix bounds limiting when given a malformed entity (CVSS 7.8, Linux)
- [CVE-2023-52460](https://cve.now/CVE-2023-52460.md): drm/amd/display: Fix NULL pointer dereference at hibernate (no CVSS, Linux)
- [CVE-2023-52459](https://cve.now/CVE-2023-52459.md): media: v4l: async: Fix duplicated list deletion (no CVSS, Linux)
- [CVE-2023-52458](https://cve.now/CVE-2023-52458.md): block: add check that partition length needs to be aligned with block size (no CVSS, Linux)
- [CVE-2023-52457](https://cve.now/CVE-2023-52457.md): serial: 8250: omap: Don't skip resource freeing if pm\_runtime\_resume\_and\_get() failed (no CVSS, Linux)
- [CVE-2023-52456](https://cve.now/CVE-2023-52456.md): serial: imx: fix tx statemachine deadlock (no CVSS, Linux)
- [CVE-2023-52455](https://cve.now/CVE-2023-52455.md): iommu: Don't reserve 0-length IOVA region (no CVSS, Linux)
- [CVE-2023-52454](https://cve.now/CVE-2023-52454.md): nvmet-tcp: Fix a kernel panic when host sends an invalid H2C PDU length (CVSS 7.5, Linux)
- [CVE-2023-52453](https://cve.now/CVE-2023-52453.md): hisi\_acc\_vfio\_pci: Update migration data pointer correctly on saving/resume (CVSS 7.1, Linux)
- [CVE-2024-1819](https://cve.now/CVE-2024-1819.md): CodeAstro Membership Management System Add Members Tab unrestricted upload (CVSS 4.7, CodeAstro Membership Management System)
- [CVE-2024-1818](https://cve.now/CVE-2024-1818.md): CodeAstro Membership Management System Logo unrestricted upload (CVSS 4.7, CodeAstro Membership Management System)
- [CVE-2024-1817](https://cve.now/CVE-2024-1817.md): Demososo DM Enterprise Website Building System Cookie indexDM\_load.php dmlogin improper authentication (CVSS 7.3, Demososo DM Enterprise Website Building System)
- [CVE-2024-26594](https://cve.now/CVE-2024-26594.md): ksmbd: validate mech token in session setup (CVSS 9.1, Linux)
- [CVE-2024-25928](https://cve.now/CVE-2024-25928.md): WordPress Sitepact's Contact Form 7 Extension For Klaviyo Plugin \<= 1.0.5 is vulnerable to SQL Injection (CVSS 7.1, Sitepact)
- [CVE-2024-25915](https://cve.now/CVE-2024-25915.md): WordPress Pexels: Free Stock Photos Plugin \<= 1.2.2 is vulnerable to Server Side Request Forgery (SSRF) (CVSS 4.9, Raaj Trambadia Pexels: Free Stock Photos)
- [CVE-2023-24416](https://cve.now/CVE-2023-24416.md): WordPress All In One Favicon Plugin \<= 4.7 is vulnerable to Arbitrary File Deletion (CVSS 6.8, Arne Franken All In One Favicon)
- [CVE-2024-1360](https://cve.now/CVE-2024-1360.md): Colibri WP \<= 1.0.94 - Cross-Site Request Forgery to Limited Plugin Installation (CVSS 4.3, extendthemes Colibri WP)
- [CVE-2024-1362](https://cve.now/CVE-2024-1362.md): Colibri Page Builder \<= 1.0.253 - Cross-Site Request Fogery via cp\_shortcode\_refresh (CVSS 4.3, extendthemes Colibri Page Builder)
- [CVE-2024-1361](https://cve.now/CVE-2024-1361.md): Colibri Page Builder \<= 1.0.253 - Cross-Site Request Fogery via extend\_builder (CVSS 4.3, extendthemes Colibri Page Builder)
- [CVE-2024-1590](https://cve.now/CVE-2024-1590.md): Page Builder: Pagelayer – Drag and Drop website builder \<= 1.8.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button (CVSS 4.6, softaculous Page Builder: Pagelayer – Drag and Drop website…)
- [CVE-2023-4826](https://cve.now/CVE-2023-4826.md): Socialdriver \< 2024 - Prototype Pollution to XSS (CVSS 6.1, socialdriver)
- [CVE-2024-26593](https://cve.now/CVE-2024-26593.md): i2c: i801: Fix block process call transactions (no CVSS, Linux)
- [CVE-2024-0563](https://cve.now/CVE-2024-0563.md): Denial of service condition in M-Files Server (CVSS 4.3, M-Files Server)
- [CVE-2023-37540](https://cve.now/CVE-2023-37540.md): HCL Sametime Chat is affected by an unimplemented feature in the UI (CVSS 3.9, HCL Software HCL Sametime Chat)
- [CVE-2024-1778](https://cve.now/CVE-2024-1778.md): Admin side data storage for Contact Form 7 \<= 1.1.1 - Missing Authorization to Unauthenticated Bookmark Status Alteration (CVSS 4.3, zestardtechnologies Admin side data storage for Contact Form)
- [CVE-2024-1777](https://cve.now/CVE-2024-1777.md): Admin side data storage for Contact Form 7 \<= 1.1.1 - Cross-Site Request Forgery (CVSS 4.3, zestardtechnologies Admin side data storage for Contact Form)
- [CVE-2024-1776](https://cve.now/CVE-2024-1776.md): Admin side data storage for Contact Form 7 \<= 1.1.1 - Authenticated (Admin+) SQL Injection (CVSS 7.2, zestardtechnologies Admin side data storage for Contact Form)
- [CVE-2024-1779](https://cve.now/CVE-2024-1779.md): Admin side data storage for Contact Form 7 plugin \<= 1.1.1 - Missing Authorization to Unauthenticated Read Status Update (CVSS 5.3, zestardtechnologies Admin side data storage for Contact Form)
- [CVE-2024-22243](https://cve.now/CVE-2024-22243.md): CVE-2024-22243: Spring Framework URL Parsing with Host Validation (CVSS 8.1, Spring Framework · org.springframework:spring-web)
- [CVE-2024-1786](https://cve.now/CVE-2024-1786.md): D-Link DIR-600M C1 Telnet Service buffer overflow (CVSS 7.5, D-Link DIR-600M C1)
- [CVE-2024-1784](https://cve.now/CVE-2024-1784.md): Limbas main\_admin.php sql injection (CVSS 3.9, Limbas)
- [CVE-2024-1683](https://cve.now/CVE-2024-1683.md): DLL Injection in Tenable Identity Exposure Secure Relay (CVSS 7.3, Tenable Identity Exposure Secure Relay)
- [CVE-2024-1783](https://cve.now/CVE-2024-1783.md): Totolink LR1200GB Web Interface cstecgi.cgi loginAuth stack-based overflow (CVSS 9.8, Totolink LR1200GB)
- [CVE-2024-1781](https://cve.now/CVE-2024-1781.md): Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection (CVSS 6.3, Totolink X6000R AX3000)
- [CVE-2024-22776](https://cve.now/CVE-2024-22776.md): Wallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without proper validation, excluding those requiring s (CVSS 4.7)
- [CVE-2024-22988](https://cve.now/CVE-2024-22988.md): ZKteco ZKBio WDMS before 9.0.2 Build 20250526 allows an attacker to download a database backup via the /files/backup/ component because the (CVSS 9.8)
- [CVE-2024-24309](https://cve.now/CVE-2024-24309.md): In the module "Survey TMA" (ecomiz\_survey\_tma) up to version 2.0.0 from Ecomiz for PrestaShop, a guest can download personal information wit (CVSS 7.5)
- [CVE-2024-24310](https://cve.now/CVE-2024-24310.md): In the module "Generate barcode on invoice / delivery slip" (ecgeneratebarcode) from Ether Creation \<= 1.2.0 for PrestaShop, a guest can per (CVSS 8.8)
- [CVE-2024-24681](https://cve.now/CVE-2024-24681.md): An issue was discovered in Yealink Configuration Encrypt Tool (AES version) and Yealink Configuration Encrypt Tool (RSA version before 1.2). (CVSS 9.8)
- [CVE-2024-25469](https://cve.now/CVE-2024-25469.md): SQL Injection vulnerability in CRMEB crmeb\_java v.1.3.4 and before allows a remote attacker to obtain sensitive information via the latitude (CVSS 7.5)
- [CVE-2024-25730](https://cve.now/CVE-2024-25730.md): Hitron CODA-4582 and CODA-4589 devices have default PSKs that are generated from 5-digit hex values concatenated with a "Hitron" substring, (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.