# CVEs published 2024-02-25

20 CVEs were published on February 25, 2024: 2 critical, 6 high. Days are UTC.

- [CVE-2024-1875](https://cve.now/CVE-2024-1875.md): SourceCodester Complaint Management System Lodge Complaint Section register-complaint.php unrestricted upload (CVSS 6.3, SourceCodester Complaint Management System)
- [CVE-2024-0439](https://cve.now/CVE-2024-0439.md): User can manually send request at manager permission to modify system configurations (CVSS 7.1, mintplex-labs/anything-llm)
- [CVE-2024-0440](https://cve.now/CVE-2024-0440.md): SSRF - file:// unsanitized access to underlying host files (CVSS 9.6, mintplex-labs/anything-llm)
- [CVE-2024-0435](https://cve.now/CVE-2024-0435.md): User can submit message to self-XSS (CVSS 8.1, mintplex-labs/anything-llm)
- [CVE-2024-0798](https://cve.now/CVE-2024-0798.md): Privilege Escalation in mintplex-labs/anything-llm (CVSS 8.1, mintplex-labs/anything-llm)
- [CVE-2024-0436](https://cve.now/CVE-2024-0436.md): Prevent timing attack for single-user password check (CVSS 7.1, mintplex-labs/anything-llm)
- [CVE-2022-48626](https://cve.now/CVE-2022-48626.md): moxart: fix potential use-after-free on remove path (no CVSS, Linux)
- [CVE-2021-46905](https://cve.now/CVE-2021-46905.md): net: hso: fix NULL-deref on disconnect regression (no CVSS, Linux)
- [CVE-2021-46904](https://cve.now/CVE-2021-46904.md): net: hso: fix null-ptr-deref during tty device unregistration (no CVSS, Linux)
- [CVE-2023-52473](https://cve.now/CVE-2023-52473.md): thermal: core: Fix NULL pointer dereference in zone registration error path (no CVSS, Linux)
- [CVE-2023-52472](https://cve.now/CVE-2023-52472.md): crypto: rsa - add a check for allocation failure (no CVSS, Linux)
- [CVE-2023-52471](https://cve.now/CVE-2023-52471.md): ice: Fix some null pointer dereference issues in ice\_ptp.c (no CVSS, Linux)
- [CVE-2023-52470](https://cve.now/CVE-2023-52470.md): drm/radeon: check the alloc\_workqueue return value in radeon\_crtc\_init() (no CVSS, Linux)
- [CVE-2023-52469](https://cve.now/CVE-2023-52469.md): drivers/amd/pm: fix a use-after-free in kv\_parse\_power\_table (CVSS 7.8, Linux)
- [CVE-2023-52468](https://cve.now/CVE-2023-52468.md): class: fix use-after-free in class\_register() (no CVSS, Linux)
- [CVE-2023-52467](https://cve.now/CVE-2023-52467.md): mfd: syscon: Fix null pointer dereference in of\_syscon\_register() (no CVSS, Linux)
- [CVE-2023-52465](https://cve.now/CVE-2023-52465.md): power: supply: Fix null pointer dereference in smb2\_probe (no CVSS, Linux)
- [CVE-2024-0455](https://cve.now/CVE-2024-0455.md): SSRF on AWS deployed instances of AnythingLLM via /metadata (CVSS 9.9, mintplex-labs/anything-llm)
- [CVE-2024-27350](https://cve.now/CVE-2024-27350.md): Amazon Fire OS 7 before 7.6.6.9 and 8 before 8.1.0.3 allows Fire TV applications to establish local ADB (Android Debug Bridge) connections. (CVSS 5.9)
- [CVE-2024-27359](https://cve.now/CVE-2024-27359.md): Certain WithSecure products allow a Denial of Service because the engine scanner can go into an infinite loop when processing an archive fil (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.