CVEs published February 27, 2024
164 CVEs were published on February 27, 2024: 11 critical, 51 high.
- Published
- 164
- Critical
- 11
- High
- 51
- Medium
- 54
- Low
- 6
- Unrated
- 42
- Now in CISA KEV
- 0
- Fix available
- 42
Most affected products
- Linux
- 67
- frenify Categorify – WordPress Media Library Category & Fil…
- 9
- Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- 9
- Acronis Cyber Protect
- 5
- mintplex-labs/anything-llm
- 3
- Apache Software Foundation Apache Ambari · org.apache.ambar…
- 2
- Apache Software Foundation Apache James server · org.apache…
- 2
- osuuu LightPicture
- 2
- rails · actionpack
- 2
- SourceCodester Online Job Portal
- 2
Critical 11
- CVE-2024-27099Azure IoT Platform Device SDK Double Free Vulnerabilityazure-uamqp-c
- CVE-2024-1403Authentication Bypass in OpenEdge Authentication Gateway and AdminServerProgress OpenEdge
- CVE-2024-27905Apache Aurora: padding oracle can allow construction an authentication cookieApache Software Foundation Apache Aurora
- CVE-2023-51518Apache James server: Privilege escalation via JMX pre-authentication deserialisationApache Software Foundation Apache James server · org.apache…
- CVE-2021-46911ch_ktls: Fix kernel panicLinux
- CVE-2024-1698NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injectionwpdevteam NotificationX – FOMO, Live Sales Notification, Wo…
- CVE-2023-41506An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attack
- CVE-2024-24095Code-projects Simple Stock System 1.0 is vulnerable to SQL Injection.
- CVE-2024-25400Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php.
- CVE-2024-25843In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a
- CVE-2024-25846In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload f
High 51
- CVE-2024-26298Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2024-26297Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2024-26296Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2024-26295Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2024-26294Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2024-0763Improper validation of document removal parametermintplex-labs/anything-llm
- CVE-2021-46974bpf: Fix masking negation logic upon negative dst registerLinux
- CVE-2021-46973net: qrtr: Avoid potential use after free in MHI sendLinux
- CVE-2021-46969bus: mhi: core: Fix invalid error returning in mhi_queueLinux
- CVE-2021-46967vhost-vdpa: fix vm_flags for virtqueue doorbell mappingLinux
- CVE-2021-46963scsi: qla2xxx: Fix crash in qla2xxx_mqueuecommand()Linux
- CVE-2021-46960cifs: Return correct error code from smb2_get_enc_keyLinux
- CVE-2021-46958btrfs: fix race between transaction aborts and fsyncs leading to use-after-freeLinux
- CVE-2021-46955openvswitch: fix stack OOB read while fragmenting IPv4 packetsLinux
- CVE-2021-46950md/raid1: properly indicate failure when ending a failed write requestLinux
- CVE-2021-46948sfc: farch: fix TX queue lookup in TX event handlingLinux
- CVE-2024-26142Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatchrails · actionpack
- CVE-2024-0551Download and export of file via default user rolemintplex-labs/anything-llm
- CVE-2024-0819Incomplete protection of personal password settingsTeamViewer Remote Full Client · TeamViewer Remote Host
- CVE-2023-51747SMTP smuggling in Apache JamesApache Software Foundation Apache James server · org.apache…
- CVE-2024-0197Privilege Escalation in Thales SafeNet Sentinel HASP LDKThales Sentinel HASP LDK
- CVE-2023-7016Privilege Escalation in SafeNet Authentication Client Thales SafeNet Authentication Client
- CVE-2023-5993Privilege Escalation in SafeNet Authentication Client InstallerThales SafeNet Authentication Client
- CVE-2021-46936net: fix use-after-free in tw_timer_handlerLinux
- CVE-2021-46933usb: gadget: f_fs: Clear ffs_eventfd in ffs_data_clear.Linux
- CVE-2021-46929sctp: use call_rcu to free endpointLinux
- CVE-2021-46925net/smc: fix kernel panic caused by race of smc_sockLinux
- CVE-2021-46922KEYS: trusted: Fix TPM reservation for seal/unsealLinux
- CVE-2021-46921locking/qrwlock: Fix ordering in queued_write_lock_slowpath()Linux
- CVE-2023-7165JetBackup < 2.0.9.9 - Directory Listing Exposing BackupsJetBackup
- CVE-2023-6584JobSearch WP Job Board < 2.3.4 - Authentication BypassWP JobSearch
- CVE-2023-6585JobSearch WP Job Board < 2.3.4 - Arbitrary File Upload to RCEWP JobSearch
- CVE-2023-50379Apache Ambari: authenticated users could perform command injection to perform RCEApache Software Foundation Apache Ambari · org.apache.ambar…
- CVE-2021-46913netfilter: nftables: clone set element expression templateLinux
- CVE-2021-46912net: Make tcp_allowed_congestion_control readonly in non-init netnsLinux
- CVE-2021-46910ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG_KMAP_LOCAL is enabledLinux
- CVE-2021-46908bpf: Use correct permission flag for mixed signed bounds arithmeticLinux
- CVE-2024-0759Collection of internally resolving IPsmintplex-labs/anything-llm
- CVE-2024-22544An issue was discovered in Linksys Router E1700 version 1.0.04 (build 3), allows authenticated attackers to execute arbitrary code via the s
- CVE-2024-22917SQL injection vulnerability in Dynamic Lab Management System Project in PHP v.1.0 allows a remote attacker to execute arbitrary code via a c
- CVE-2024-24027SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function DistributionMemberLogic:
- CVE-2024-24096Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via BookSBIN.
- CVE-2024-24100Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via PublisherID.
- CVE-2024-24323SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consig
- CVE-2024-25398In Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt t
- CVE-2024-25723ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{uszenml
- CVE-2024-25840In the module "Account Manager | Sales Representative & Dealers | CRM" (prestasalesmanager) up to 9.0 from Presta World for PrestaShop, a gu
- CVE-2024-26470A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attackeFullStackHero.WebAPI.Boilerplate
- CVE-2024-27356An issue was discovered on certain GL-iNet devices.
- CVE-2024-27507libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp.
- CVE-2024-27508Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c.
Medium, low and unrated 102
- CVE-2024-26302A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low priviHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2024-26301A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low priviHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2024-26300A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-siHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2024-26299A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2021-46972ovl: fix leaked dentryLinux
- CVE-2021-46971perf/core: Fix unconditional security_locked_down() callLinux
- CVE-2021-46970bus: mhi: pci_generic: Remove WQ_MEM_RECLAIM flag from state workqueueLinux
- CVE-2021-46968s390/zcrypt: fix zcard and zqueue hot-unplug memleakLinux
- CVE-2021-46966ACPI: custom_method: fix potential use-after-free issueLinux
- CVE-2021-46965mtd: physmap: physmap-bt1-rom: Fix unintentional stack accessLinux
- CVE-2021-46964scsi: qla2xxx: Reserve extra IRQ vectorsLinux
- CVE-2021-46962mmc: uniphier-sd: Fix a resource leak in the remove functionLinux
- CVE-2021-46961irqchip/gic-v3: Do not enable irqs when handling spurious interrupsLinux
- CVE-2021-46957riscv/kprobe: fix kernel panic when invoking sys_read traced by kprobeLinux
- CVE-2021-46956virtiofs: fix memory leak in virtio_fs_probe()Linux
- CVE-2021-46954net/sched: sch_frag: fix stack OOB read while fragmenting IPv4 packetsLinux
- CVE-2021-46953ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failureLinux
- CVE-2021-46952NFS: fs_context: validate UDP retrans to prevent shift out-of-boundsLinux
- CVE-2021-46951tpm: efi: Use local variable for calculating final log sizeLinux
- CVE-2021-46949sfc: farch: fix TX queue lookup in TX flush done handlingLinux
- CVE-2021-46947sfc: adjust efx->xdp_tx_queue_count with the real number of initialized queuesLinux
- CVE-2021-46945ext4: always panic when errors=panic is specifiedLinux
- CVE-2021-46944media: staging/intel-ipu3: Fix memory leak in imu_fmtLinux
- CVE-2021-46943media: staging/intel-ipu3: Fix set_fmt error handlingLinux
- CVE-2021-46942io_uring: fix shared sqpoll cancellation hangsLinux
- CVE-2021-46941usb: dwc3: core: Do core softreset when switch modeLinux
- CVE-2021-46940tools/power turbostat: Fix offset overflow issue in index convertingLinux
- CVE-2021-46939tracing: Restructure trace_clock_global() to never blockLinux
- CVE-2021-46938dm rq: fix double free of blk_mq_tag_set in dev remove after table load failsLinux
- CVE-2020-36777media: dvbdev: Fix memory leak in dvb_media_device_free()Linux
- CVE-2020-36776thermal/drivers/cpufreq_cooling: Fix slab OOB issueLinux
- CVE-2024-1722Keycloak-core: dos via account lockoutkeycloak-core · Red Hat Build of Keycloak +2
- CVE-2024-22251Out-of-bounds read vulnerability VMware Workstation · VMware Fusion
- CVE-2024-1928SourceCodester Web-Based Student Clearance System Edit User Profile Page edit-admin.php sql injectionSourceCodester Web-Based Student Clearance System
- CVE-2024-1927SourceCodester Web-Based Student Clearance System login.php sql injectionSourceCodester Web-Based Student Clearance System
- CVE-2024-1926SourceCodester Free and Open Source Inventory Management System search_sales_report.php sql injectionSourceCodester Free and Open Source Inventory Management Sy…
- CVE-2024-1925Ctcms Upsys.php unrestricted uploadCtcms
- CVE-2023-48682Stored cross-site scripting (XSS) vulnerability in unit name.Acronis Cyber Protect
- CVE-2023-48681Self cross-site scripting (XSS) vulnerability in storage nodes search field.Acronis Cyber Protect
- CVE-2023-50380Apache Ambari: authenticated users could perform XXE to read arbitrary files on the serverApache Software Foundation Apache Ambari · org.apache.ambar…
- CVE-2023-48680Sensitive information disclosure due to excessive collection of system information.Acronis Cyber Protect
- CVE-2023-48679Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage.Acronis Cyber Protect
- CVE-2023-48678Sensitive information disclosure due to insecure folder permissions.Acronis Cyber Protect
- CVE-2024-1924CodeAstro Membership Management System get_membership_amount.php sql injectionCodeAstro Membership Management System
- CVE-2024-21742Apache James Mime4J: Mime4J DOM header injectionApache Software Foundation Apache James Mime4J · org.apache…
- CVE-2024-1923SourceCodester Simple Student Attendance System List of Classes Page ajax-api.php delete_student sql injectionSourceCodester Simple Student Attendance System
- CVE-2024-26144Possible Sensitive Session Information Leak in Active Storagerails · activestorage
- CVE-2024-26143Rails Possible XSS Vulnerability in Action Controllerrails · actionpack
- CVE-2024-1922SourceCodester Online Job Portal Manage Job Page ManageJob.php cross site scriptingSourceCodester Online Job Portal
- CVE-2024-1921osuuu LightPicture Setup.php unrestricted uploadosuuu LightPicture
- CVE-2024-1920osuuu LightPicture TokenVerify.php handle hard-coded keyosuuu LightPicture
- CVE-2024-1919SourceCodester Online Job Portal Manage Walkin Page ManageWalkin.php cross site scriptingSourceCodester Online Job Portal
- CVE-2024-1918Byzoro Smart S42 Management Platform userattestation.php unrestricted uploadByzoro Smart S42 Management Platform
- CVE-2024-1650Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategoryfrenify Categorify – WordPress Media Library Category & Fil…
- CVE-2024-1649Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategoryfrenify Categorify – WordPress Media Library Category & Fil…
- CVE-2024-1910Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxClearCategoryfrenify Categorify – WordPress Media Library Category & Fil…
- CVE-2024-1652Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategoryfrenify Categorify – WordPress Media Library Category & Fil…
- CVE-2024-1906Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxAddCategoryfrenify Categorify – WordPress Media Library Category & Fil…
- CVE-2024-1912Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxUpdateFolderPositionfrenify Categorify – WordPress Media Library Category & Fil…
- CVE-2024-1909Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxRenameCategoryfrenify Categorify – WordPress Media Library Category & Fil…
- CVE-2024-1653Categorify <= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPositionfrenify Categorify – WordPress Media Library Category & Fil…
- CVE-2024-1907Categorify <= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxDeleteCategoryfrenify Categorify – WordPress Media Library Category & Fil…
- CVE-2021-46937mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs_target_ids_write()'Linux
- CVE-2021-46935binder: fix async_free_space accounting for empty parcelsLinux
- CVE-2021-46934i2c: validate user data in compat ioctlLinux
- CVE-2021-46932Input: appletouch - initialize work before device registrationLinux
- CVE-2021-46931net/mlx5e: Wrap the tx reporter dump callback to extract the sqLinux
- CVE-2021-46930usb: mtu3: fix list_head check warningLinux
- CVE-2021-46928parisc: Clear stale IIR value on instruction access rights trapLinux
- CVE-2021-46927nitro_enclaves: Use get_user_pages_unlocked() call to handle mmap assertLinux
- CVE-2021-46926ALSA: hda: intel-sdw-acpi: harden detection of controllerLinux
- CVE-2021-46924NFC: st21nfca: Fix memory leak in device probe and removeLinux
- CVE-2021-46923fs/mount_setattr: always cleanup mount_kattrLinux
- CVE-2024-1106Shariff Wrapper < 4.6.10 - Admin+ Stored XSSShariff Wrapper
- CVE-2024-0855Spiffy Calendar < 4.9.9 - Broken Access ControlSpiffy Calendar
- CVE-2023-7115PageLayer < 1.8.1 - Admin+ Stored XSSPage Builder: Pagelayer
- CVE-2023-7198WPDashboardNotes < 1.0.11 - Unauthorised Deletion of Private NotesWP Dashboard Notes
- CVE-2023-7203Smart Forms < 2.6.87 - Subscriber+ Arbitrary Entry DeletionSmart Forms
- CVE-2023-7167Persian Fonts <= 1.6 - Admin+ Stored XSSPersian Fonts
- CVE-2023-7202Fatal Error Notify < 1.5.3 - Subscriber+ Test Error Email SendingFatal Error Notify
- CVE-2021-46920dmaengine: idxd: Fix clobbering of SWERR overflow bit on writebackLinux
- CVE-2021-46919dmaengine: idxd: fix wq size store permission stateLinux
- CVE-2021-46918dmaengine: idxd: clear MSIX permission entry on shutdownLinux
- CVE-2021-46917dmaengine: idxd: fix wq cleanup of WQCFG registersLinux
- CVE-2021-46916ixgbe: Fix NULL pointer dereference in ethtool loopback testLinux
- CVE-2021-46915netfilter: nft_limit: avoid possible divide error in nft_limit_initLinux
- CVE-2021-46914ixgbe: fix unbalanced device enable/disable in suspend/resumeLinux
- CVE-2021-46909ARM: footbridge: fix PCI interrupt mappingLinux
- CVE-2024-1687Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Executionvillatheme Thank You Page Customizer for WooCommerce – Incr…
- CVE-2024-1686Thank You Page Customizer for WooCommerce – Increase Your Sales <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Exportvillatheme Thank You Page Customizer for WooCommerce – Incr…
- CVE-2024-1323Orbit Fox by ThemeIsle <= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…
- CVE-2023-7033Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-R series CPU module, MELSEC iQ-L Mitsubishi Electric MELSEC iQ-R series CPU module R00C… +162
- CVE-2024-22543An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges via a crafted GET re
- CVE-2024-24099Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Employment Status Information Update.
- CVE-2024-24720An issue was discovered in the Forgot password function in Innovaphone PBX before 14r1 devices.
- CVE-2024-25166Cross Site Scripting vulnerability in 71CMS v.1.0.0 allows a remote attacker to execute arbitrary code via the uploadfile action parameter i
- CVE-2024-25399Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php.intelliants/subrion
- CVE-2024-25841In the module "So Flexibilite" (soflexibilite) from Common-Services for PrestaShop < 4.1.26, a guest (authenticated customer) can perform Cr
- CVE-2024-26471A reflected cross-site scripting (XSS) vulnerability in zhimengzhe iBarn v1.5 allows attackers to inject malicious JavaScript into the web b
- CVE-2024-26472KLiK SocialMediaWebsite version 1.0.1 from msaad1999 has a reflected cross-site scripting (XSS) vulnerability which may allow remote attacke
- CVE-2024-26473A reflected cross-site scripting (XSS) vulnerability in SocialMediaWebsite v1.0.1 allows attackers to inject malicious JavaScript into the w
- CVE-2024-26542Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14.