# CVEs published 2024-02-24

20 CVEs were published on February 24, 2024: 0 critical, 3 high. Days are UTC.

- [CVE-2024-1871](https://cve.now/CVE-2024-1871.md): SourceCodester Employee Management System Project Assignment Report assignp.php cross site scripting (CVSS 3.5, SourceCodester Employee Management System)
- [CVE-2024-0243](https://cve.now/CVE-2024-0243.md): Server-side Request Forgery In Recursive URL Loader (CVSS 3.7, langchain-ai/langchain · langchain +1)
- [CVE-2023-43051](https://cve.now/CVE-2023-43051.md): IBM Cognos Analytics cross-site scripting (CVSS 5.4, IBM Cognos Analytics)
- [CVE-2022-34357](https://cve.now/CVE-2022-34357.md): IBM Cognos Analytics Mobile Server denial of service (CVSS 6.5, IBM Cognos Analytics)
- [CVE-2023-30996](https://cve.now/CVE-2023-30996.md): IBM Cognos Analytics cross-origin resource sharing (CVSS 5.3, IBM Cognos Analytics)
- [CVE-2023-32344](https://cve.now/CVE-2023-32344.md): IBM Cognos Analytics cross-site request forgery (CVSS 4.3, IBM Cognos Analytics)
- [CVE-2023-38359](https://cve.now/CVE-2023-38359.md): IBM Cognos Analytics cross-site scripting (CVSS 6.1, IBM Cognos Analytics)
- [CVE-2024-26605](https://cve.now/CVE-2024-26605.md): PCI/ASPM: Fix deadlock when enabling ASPM (no CVSS, Linux)
- [CVE-2024-26604](https://cve.now/CVE-2024-26604.md): Revert "kobject: Remove redundant checks for whether ktype is NULL" (no CVSS, Linux)
- [CVE-2024-26603](https://cve.now/CVE-2024-26603.md): x86/fpu: Stop relying on userspace for info to fault in xsave buffer (no CVSS, Linux)
- [CVE-2024-26602](https://cve.now/CVE-2024-26602.md): sched/membarrier: reduce the ability to hammer on sys\_membarrier (no CVSS, Linux)
- [CVE-2024-26601](https://cve.now/CVE-2024-26601.md): ext4: regenerate buddy after block freeing failed if under fc replay (CVSS 7.8, Linux)
- [CVE-2024-26600](https://cve.now/CVE-2024-26600.md): phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (no CVSS, Linux)
- [CVE-2024-1165](https://cve.now/CVE-2024-1165.md): Brizy – Page Builder \<= 2.4.39 - Authenticated (Contributor+) Directory Traversal (CVSS 4.3, themefusecom Brizy – Page Builder)
- [CVE-2024-1710](https://cve.now/CVE-2024-1710.md): Addon Library \<= 1.3.76 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, unitecms Addon Library)
- [CVE-2024-1758](https://cve.now/CVE-2024-1758.md): SuperFaktura WooCommerce \<= 1.40.3 - Authenticated (Subscriber+) Blind Server-Side Request Forgery (CVSS 5.4, SuperFaktura WooCommerce)
- [CVE-2023-5775](https://cve.now/CVE-2023-5775.md): BackWPup \<= 4.0.2 - Plaintext Storage of Backup Destination Password (CVSS 2.2, wp\_media BackWPup – WordPress Backup & Restore Plugin)
- [CVE-2024-21501](https://cve.now/CVE-2024-21501.md): Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attri (CVSS 5.3, sanitize-html · org.webjars.npm:sanitize-html)
- [CVE-2024-21502](https://cve.now/CVE-2024-21502.md): Versions of the package fastecdsa before 2.3.2 are vulnerable to Use of Uninitialized Variable on the stack, via the curvemath\_mul function (CVSS 7.5, fastecdsa)
- [CVE-2024-1810](https://cve.now/CVE-2024-1810.md): Archivist – Custom Archive Templates \<= 1.7.5 - Reflected Cross-Site Scripting (CVSS 6.1, eteubert Archivist – Custom Archive Templates)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.