# CVEs published 2024-02-27

164 CVEs were published on February 27, 2024: 11 critical, 51 high. Days are UTC.

- [CVE-2024-26302](https://cve.now/CVE-2024-26302.md): A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privi (CVSS 4.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2024-26301](https://cve.now/CVE-2024-26301.md): A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privi (CVSS 6.5, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2024-26300](https://cve.now/CVE-2024-26300.md): A vulnerability in the guest interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a stored cross-si (CVSS 6.6, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2024-26299](https://cve.now/CVE-2024-26299.md): A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a (CVSS 6.6, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2024-26298](https://cve.now/CVE-2024-26298.md): Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2024-26297](https://cve.now/CVE-2024-26297.md): Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2024-26296](https://cve.now/CVE-2024-26296.md): Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2024-26295](https://cve.now/CVE-2024-26295.md): Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2024-26294](https://cve.now/CVE-2024-26294.md): Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2024-0763](https://cve.now/CVE-2024-0763.md): Improper validation of document removal parameter (CVSS 8.1, mintplex-labs/anything-llm)
- [CVE-2024-27099](https://cve.now/CVE-2024-27099.md): Azure IoT Platform Device SDK Double Free Vulnerability (CVSS 9.8, azure-uamqp-c)
- [CVE-2021-46974](https://cve.now/CVE-2021-46974.md): bpf: Fix masking negation logic upon negative dst register (CVSS 7.1, Linux)
- [CVE-2021-46973](https://cve.now/CVE-2021-46973.md): net: qrtr: Avoid potential use after free in MHI send (CVSS 7.8, Linux)
- [CVE-2021-46972](https://cve.now/CVE-2021-46972.md): ovl: fix leaked dentry (no CVSS, Linux)
- [CVE-2021-46971](https://cve.now/CVE-2021-46971.md): perf/core: Fix unconditional security\_locked\_down() call (no CVSS, Linux)
- [CVE-2021-46970](https://cve.now/CVE-2021-46970.md): bus: mhi: pci\_generic: Remove WQ\_MEM\_RECLAIM flag from state workqueue (no CVSS, Linux)
- [CVE-2021-46969](https://cve.now/CVE-2021-46969.md): bus: mhi: core: Fix invalid error returning in mhi\_queue (CVSS 7.8, Linux)
- [CVE-2021-46968](https://cve.now/CVE-2021-46968.md): s390/zcrypt: fix zcard and zqueue hot-unplug memleak (no CVSS, Linux)
- [CVE-2021-46967](https://cve.now/CVE-2021-46967.md): vhost-vdpa: fix vm\_flags for virtqueue doorbell mapping (CVSS 7.8, Linux)
- [CVE-2021-46966](https://cve.now/CVE-2021-46966.md): ACPI: custom\_method: fix potential use-after-free issue (no CVSS, Linux)
- [CVE-2021-46965](https://cve.now/CVE-2021-46965.md): mtd: physmap: physmap-bt1-rom: Fix unintentional stack access (no CVSS, Linux)
- [CVE-2021-46964](https://cve.now/CVE-2021-46964.md): scsi: qla2xxx: Reserve extra IRQ vectors (no CVSS, Linux)
- [CVE-2021-46963](https://cve.now/CVE-2021-46963.md): scsi: qla2xxx: Fix crash in qla2xxx\_mqueuecommand() (CVSS 7.8, Linux)
- [CVE-2021-46962](https://cve.now/CVE-2021-46962.md): mmc: uniphier-sd: Fix a resource leak in the remove function (no CVSS, Linux)
- [CVE-2021-46961](https://cve.now/CVE-2021-46961.md): irqchip/gic-v3: Do not enable irqs when handling spurious interrups (CVSS 5.5, Linux)
- [CVE-2021-46960](https://cve.now/CVE-2021-46960.md): cifs: Return correct error code from smb2\_get\_enc\_key (CVSS 7.5, Linux)
- [CVE-2021-46958](https://cve.now/CVE-2021-46958.md): btrfs: fix race between transaction aborts and fsyncs leading to use-after-free (CVSS 7.8, Linux)
- [CVE-2021-46957](https://cve.now/CVE-2021-46957.md): riscv/kprobe: fix kernel panic when invoking sys\_read traced by kprobe (CVSS 5.5, Linux)
- [CVE-2021-46956](https://cve.now/CVE-2021-46956.md): virtiofs: fix memory leak in virtio\_fs\_probe() (no CVSS, Linux)
- [CVE-2021-46955](https://cve.now/CVE-2021-46955.md): openvswitch: fix stack OOB read while fragmenting IPv4 packets (CVSS 8.2, Linux)
- [CVE-2021-46954](https://cve.now/CVE-2021-46954.md): net/sched: sch\_frag: fix stack OOB read while fragmenting IPv4 packets (no CVSS, Linux)
- [CVE-2021-46953](https://cve.now/CVE-2021-46953.md): ACPI: GTDT: Don't corrupt interrupt mappings on watchdow probe failure (no CVSS, Linux)
- [CVE-2021-46952](https://cve.now/CVE-2021-46952.md): NFS: fs\_context: validate UDP retrans to prevent shift out-of-bounds (no CVSS, Linux)
- [CVE-2021-46951](https://cve.now/CVE-2021-46951.md): tpm: efi: Use local variable for calculating final log size (no CVSS, Linux)
- [CVE-2021-46950](https://cve.now/CVE-2021-46950.md): md/raid1: properly indicate failure when ending a failed write request (CVSS 7.8, Linux)
- [CVE-2021-46949](https://cve.now/CVE-2021-46949.md): sfc: farch: fix TX queue lookup in TX flush done handling (no CVSS, Linux)
- [CVE-2021-46948](https://cve.now/CVE-2021-46948.md): sfc: farch: fix TX queue lookup in TX event handling (CVSS 7.5, Linux)
- [CVE-2021-46947](https://cve.now/CVE-2021-46947.md): sfc: adjust efx-\>xdp\_tx\_queue\_count with the real number of initialized queues (no CVSS, Linux)
- [CVE-2021-46945](https://cve.now/CVE-2021-46945.md): ext4: always panic when errors=panic is specified (no CVSS, Linux)
- [CVE-2021-46944](https://cve.now/CVE-2021-46944.md): media: staging/intel-ipu3: Fix memory leak in imu\_fmt (no CVSS, Linux)
- [CVE-2021-46943](https://cve.now/CVE-2021-46943.md): media: staging/intel-ipu3: Fix set\_fmt error handling (no CVSS, Linux)
- [CVE-2021-46942](https://cve.now/CVE-2021-46942.md): io\_uring: fix shared sqpoll cancellation hangs (no CVSS, Linux)
- [CVE-2021-46941](https://cve.now/CVE-2021-46941.md): usb: dwc3: core: Do core softreset when switch mode (no CVSS, Linux)
- [CVE-2021-46940](https://cve.now/CVE-2021-46940.md): tools/power turbostat: Fix offset overflow issue in index converting (no CVSS, Linux)
- [CVE-2021-46939](https://cve.now/CVE-2021-46939.md): tracing: Restructure trace\_clock\_global() to never block (CVSS 5.5, Linux)
- [CVE-2021-46938](https://cve.now/CVE-2021-46938.md): dm rq: fix double free of blk\_mq\_tag\_set in dev remove after table load fails (no CVSS, Linux)
- [CVE-2020-36777](https://cve.now/CVE-2020-36777.md): media: dvbdev: Fix memory leak in dvb\_media\_device\_free() (no CVSS, Linux)
- [CVE-2020-36776](https://cve.now/CVE-2020-36776.md): thermal/drivers/cpufreq\_cooling: Fix slab OOB issue (no CVSS, Linux)
- [CVE-2024-1722](https://cve.now/CVE-2024-1722.md): Keycloak-core: dos via account lockout (CVSS 3.7, keycloak-core · Red Hat Build of Keycloak +2)
- [CVE-2024-22251](https://cve.now/CVE-2024-22251.md): Out-of-bounds read vulnerability (CVSS 5.9, VMware Workstation · VMware Fusion)
- [CVE-2024-1928](https://cve.now/CVE-2024-1928.md): SourceCodester Web-Based Student Clearance System Edit User Profile Page edit-admin.php sql injection (CVSS 4.7, SourceCodester Web-Based Student Clearance System)
- [CVE-2024-1927](https://cve.now/CVE-2024-1927.md): SourceCodester Web-Based Student Clearance System login.php sql injection (CVSS 6.3, SourceCodester Web-Based Student Clearance System)
- [CVE-2024-1926](https://cve.now/CVE-2024-1926.md): SourceCodester Free and Open Source Inventory Management System search\_sales\_report.php sql injection (CVSS 6.3, SourceCodester Free and Open Source Inventory Management Sy…)
- [CVE-2024-1925](https://cve.now/CVE-2024-1925.md): Ctcms Upsys.php unrestricted upload (CVSS 5.0, Ctcms)
- [CVE-2023-48682](https://cve.now/CVE-2023-48682.md): Stored cross-site scripting (XSS) vulnerability in unit name. (CVSS 6.1, Acronis Cyber Protect)
- [CVE-2023-48681](https://cve.now/CVE-2023-48681.md): Self cross-site scripting (XSS) vulnerability in storage nodes search field. (CVSS 1.9, Acronis Cyber Protect)
- [CVE-2023-50380](https://cve.now/CVE-2023-50380.md): Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server (CVSS 6.5, Apache Software Foundation Apache Ambari · org.apache.ambar…)
- [CVE-2023-48680](https://cve.now/CVE-2023-48680.md): Sensitive information disclosure due to excessive collection of system information. (CVSS 3.3, Acronis Cyber Protect)
- [CVE-2023-48679](https://cve.now/CVE-2023-48679.md): Stored cross-site scripting (XSS) vulnerability due to missing origin validation in postMessage. (CVSS 3.1, Acronis Cyber Protect)
- [CVE-2023-48678](https://cve.now/CVE-2023-48678.md): Sensitive information disclosure due to insecure folder permissions. (CVSS 5.5, Acronis Cyber Protect)
- [CVE-2024-1924](https://cve.now/CVE-2024-1924.md): CodeAstro Membership Management System get\_membership\_amount.php sql injection (CVSS 6.3, CodeAstro Membership Management System)
- [CVE-2024-21742](https://cve.now/CVE-2024-21742.md): Apache James Mime4J: Mime4J DOM header injection (CVSS 5.3, Apache Software Foundation Apache James Mime4J · org.apache…)
- [CVE-2024-1923](https://cve.now/CVE-2024-1923.md): SourceCodester Simple Student Attendance System List of Classes Page ajax-api.php delete\_student sql injection (CVSS 6.3, SourceCodester Simple Student Attendance System)
- [CVE-2024-26144](https://cve.now/CVE-2024-26144.md): Possible Sensitive Session Information Leak in Active Storage (CVSS 5.3, rails · activestorage)
- [CVE-2024-1403](https://cve.now/CVE-2024-1403.md): Authentication Bypass in OpenEdge Authentication Gateway and AdminServer (CVSS 10.0, Progress OpenEdge)
- [CVE-2024-26143](https://cve.now/CVE-2024-26143.md): Rails Possible XSS Vulnerability in Action Controller (CVSS 6.1, rails · actionpack)
- [CVE-2024-1922](https://cve.now/CVE-2024-1922.md): SourceCodester Online Job Portal Manage Job Page ManageJob.php cross site scripting (CVSS 3.5, SourceCodester Online Job Portal)
- [CVE-2024-26142](https://cve.now/CVE-2024-26142.md): Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch (CVSS 7.5, rails · actionpack)
- [CVE-2024-1921](https://cve.now/CVE-2024-1921.md): osuuu LightPicture Setup.php unrestricted upload (CVSS 4.7, osuuu LightPicture)
- [CVE-2024-27905](https://cve.now/CVE-2024-27905.md): Apache Aurora: padding oracle can allow construction an authentication cookie (CVSS 9.1, Apache Software Foundation Apache Aurora)
- [CVE-2024-0551](https://cve.now/CVE-2024-0551.md): Download and export of file via default user role (CVSS 7.1, mintplex-labs/anything-llm)
- [CVE-2024-0819](https://cve.now/CVE-2024-0819.md): Incomplete protection of personal password settings (CVSS 7.3, TeamViewer Remote Full Client · TeamViewer Remote Host)
- [CVE-2024-1920](https://cve.now/CVE-2024-1920.md): osuuu LightPicture TokenVerify.php handle hard-coded key (CVSS 5.6, osuuu LightPicture)
- [CVE-2024-1919](https://cve.now/CVE-2024-1919.md): SourceCodester Online Job Portal Manage Walkin Page ManageWalkin.php cross site scripting (CVSS 3.5, SourceCodester Online Job Portal)
- [CVE-2023-51747](https://cve.now/CVE-2023-51747.md): SMTP smuggling in Apache James (CVSS 7.1, Apache Software Foundation Apache James server · org.apache…)
- [CVE-2024-1918](https://cve.now/CVE-2024-1918.md): Byzoro Smart S42 Management Platform userattestation.php unrestricted upload (CVSS 4.7, Byzoro Smart S42 Management Platform)
- [CVE-2024-0197](https://cve.now/CVE-2024-0197.md): Privilege Escalation in Thales SafeNet Sentinel HASP LDK (CVSS 7.8, Thales Sentinel HASP LDK)
- [CVE-2024-1650](https://cve.now/CVE-2024-1650.md): Categorify \<= 1.0.7.4 - Missing Authorization in categorifyAjaxRenameCategory (CVSS 4.3, frenify Categorify – WordPress Media Library Category & Fil…)
- [CVE-2024-1649](https://cve.now/CVE-2024-1649.md): Categorify \<= 1.0.7.4 - Missing Authorization in categorifyAjaxDeleteCategory (CVSS 4.3, frenify Categorify – WordPress Media Library Category & Fil…)
- [CVE-2024-1910](https://cve.now/CVE-2024-1910.md): Categorify \<= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxClearCategory (CVSS 4.3, frenify Categorify – WordPress Media Library Category & Fil…)
- [CVE-2024-1652](https://cve.now/CVE-2024-1652.md): Categorify \<= 1.0.7.4 - Missing Authorization in categorifyAjaxClearCategory (CVSS 4.3, frenify Categorify – WordPress Media Library Category & Fil…)
- [CVE-2024-1906](https://cve.now/CVE-2024-1906.md): Categorify \<= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxAddCategory (CVSS 4.3, frenify Categorify – WordPress Media Library Category & Fil…)
- [CVE-2024-1912](https://cve.now/CVE-2024-1912.md): Categorify \<= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxUpdateFolderPosition (CVSS 4.3, frenify Categorify – WordPress Media Library Category & Fil…)
- [CVE-2024-1909](https://cve.now/CVE-2024-1909.md): Categorify \<= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxRenameCategory (CVSS 4.3, frenify Categorify – WordPress Media Library Category & Fil…)
- [CVE-2024-1653](https://cve.now/CVE-2024-1653.md): Categorify \<= 1.0.7.4 - Missing Authorization in categorifyAjaxUpdateFolderPosition (CVSS 4.3, frenify Categorify – WordPress Media Library Category & Fil…)
- [CVE-2024-1907](https://cve.now/CVE-2024-1907.md): Categorify \<= 1.0.7.4 - Cross-Site Request Forgery via categorifyAjaxDeleteCategory (CVSS 4.3, frenify Categorify – WordPress Media Library Category & Fil…)
- [CVE-2023-7016](https://cve.now/CVE-2023-7016.md): Privilege Escalation in SafeNet Authentication Client (CVSS 7.8, Thales SafeNet Authentication Client)
- [CVE-2023-5993](https://cve.now/CVE-2023-5993.md): Privilege Escalation in SafeNet Authentication Client Installer (CVSS 7.8, Thales SafeNet Authentication Client)
- [CVE-2021-46937](https://cve.now/CVE-2021-46937.md): mm/damon/dbgfs: fix 'struct pid' leaks in 'dbgfs\_target\_ids\_write()' (no CVSS, Linux)
- [CVE-2021-46936](https://cve.now/CVE-2021-46936.md): net: fix use-after-free in tw\_timer\_handler (CVSS 7.8, Linux)
- [CVE-2021-46935](https://cve.now/CVE-2021-46935.md): binder: fix async\_free\_space accounting for empty parcels (no CVSS, Linux)
- [CVE-2021-46934](https://cve.now/CVE-2021-46934.md): i2c: validate user data in compat ioctl (no CVSS, Linux)
- [CVE-2021-46933](https://cve.now/CVE-2021-46933.md): usb: gadget: f\_fs: Clear ffs\_eventfd in ffs\_data\_clear. (CVSS 7.8, Linux)
- [CVE-2021-46932](https://cve.now/CVE-2021-46932.md): Input: appletouch - initialize work before device registration (no CVSS, Linux)
- [CVE-2021-46931](https://cve.now/CVE-2021-46931.md): net/mlx5e: Wrap the tx reporter dump callback to extract the sq (no CVSS, Linux)
- [CVE-2021-46930](https://cve.now/CVE-2021-46930.md): usb: mtu3: fix list\_head check warning (no CVSS, Linux)
- [CVE-2021-46929](https://cve.now/CVE-2021-46929.md): sctp: use call\_rcu to free endpoint (CVSS 7.8, Linux)
- [CVE-2021-46928](https://cve.now/CVE-2021-46928.md): parisc: Clear stale IIR value on instruction access rights trap (no CVSS, Linux)
- [CVE-2021-46927](https://cve.now/CVE-2021-46927.md): nitro\_enclaves: Use get\_user\_pages\_unlocked() call to handle mmap assert (no CVSS, Linux)
- [CVE-2021-46926](https://cve.now/CVE-2021-46926.md): ALSA: hda: intel-sdw-acpi: harden detection of controller (no CVSS, Linux)
- [CVE-2021-46925](https://cve.now/CVE-2021-46925.md): net/smc: fix kernel panic caused by race of smc\_sock (CVSS 7.8, Linux)
- [CVE-2021-46924](https://cve.now/CVE-2021-46924.md): NFC: st21nfca: Fix memory leak in device probe and remove (no CVSS, Linux)
- [CVE-2021-46923](https://cve.now/CVE-2021-46923.md): fs/mount\_setattr: always cleanup mount\_kattr (no CVSS, Linux)
- [CVE-2021-46922](https://cve.now/CVE-2021-46922.md): KEYS: trusted: Fix TPM reservation for seal/unseal (CVSS 7.8, Linux)
- [CVE-2021-46921](https://cve.now/CVE-2021-46921.md): locking/qrwlock: Fix ordering in queued\_write\_lock\_slowpath() (CVSS 7.8, Linux)
- [CVE-2023-51518](https://cve.now/CVE-2023-51518.md): Apache James server: Privilege escalation via JMX pre-authentication deserialisation (CVSS 9.8, Apache Software Foundation Apache James server · org.apache…)
- [CVE-2024-1106](https://cve.now/CVE-2024-1106.md): Shariff Wrapper \< 4.6.10 - Admin+ Stored XSS (CVSS 6.1, Shariff Wrapper)
- [CVE-2023-7165](https://cve.now/CVE-2023-7165.md): JetBackup \< 2.0.9.9 - Directory Listing Exposing Backups (CVSS 7.5, JetBackup)
- [CVE-2024-0855](https://cve.now/CVE-2024-0855.md): Spiffy Calendar \< 4.9.9 - Broken Access Control (CVSS 5.3, Spiffy Calendar)
- [CVE-2023-7115](https://cve.now/CVE-2023-7115.md): PageLayer \< 1.8.1 - Admin+ Stored XSS (CVSS 4.8, Page Builder: Pagelayer)
- [CVE-2023-7198](https://cve.now/CVE-2023-7198.md): WPDashboardNotes \< 1.0.11 - Unauthorised Deletion of Private Notes (CVSS 4.3, WP Dashboard Notes)
- [CVE-2023-6584](https://cve.now/CVE-2023-6584.md): JobSearch WP Job Board \< 2.3.4 - Authentication Bypass (CVSS 7.5, WP JobSearch)
- [CVE-2023-6585](https://cve.now/CVE-2023-6585.md): JobSearch WP Job Board \< 2.3.4 - Arbitrary File Upload to RCE (CVSS 7.5, WP JobSearch)
- [CVE-2023-7203](https://cve.now/CVE-2023-7203.md): Smart Forms \< 2.6.87 - Subscriber+ Arbitrary Entry Deletion (CVSS 6.1, Smart Forms)
- [CVE-2023-7167](https://cve.now/CVE-2023-7167.md): Persian Fonts \<= 1.6 - Admin+ Stored XSS (CVSS 6.1, Persian Fonts)
- [CVE-2023-7202](https://cve.now/CVE-2023-7202.md): Fatal Error Notify \< 1.5.3 - Subscriber+ Test Error Email Sending (CVSS 6.1, Fatal Error Notify)
- [CVE-2023-50379](https://cve.now/CVE-2023-50379.md): Apache Ambari: authenticated users could perform command injection to perform RCE (CVSS 8.8, Apache Software Foundation Apache Ambari · org.apache.ambar…)
- [CVE-2021-46920](https://cve.now/CVE-2021-46920.md): dmaengine: idxd: Fix clobbering of SWERR overflow bit on writeback (CVSS 5.5, Linux)
- [CVE-2021-46919](https://cve.now/CVE-2021-46919.md): dmaengine: idxd: fix wq size store permission state (no CVSS, Linux)
- [CVE-2021-46918](https://cve.now/CVE-2021-46918.md): dmaengine: idxd: clear MSIX permission entry on shutdown (no CVSS, Linux)
- [CVE-2021-46917](https://cve.now/CVE-2021-46917.md): dmaengine: idxd: fix wq cleanup of WQCFG registers (no CVSS, Linux)
- [CVE-2021-46916](https://cve.now/CVE-2021-46916.md): ixgbe: Fix NULL pointer dereference in ethtool loopback test (no CVSS, Linux)
- [CVE-2021-46915](https://cve.now/CVE-2021-46915.md): netfilter: nft\_limit: avoid possible divide error in nft\_limit\_init (no CVSS, Linux)
- [CVE-2021-46914](https://cve.now/CVE-2021-46914.md): ixgbe: fix unbalanced device enable/disable in suspend/resume (no CVSS, Linux)
- [CVE-2021-46913](https://cve.now/CVE-2021-46913.md): netfilter: nftables: clone set element expression template (CVSS 7.8, Linux)
- [CVE-2021-46912](https://cve.now/CVE-2021-46912.md): net: Make tcp\_allowed\_congestion\_control readonly in non-init netns (CVSS 7.3, Linux)
- [CVE-2021-46911](https://cve.now/CVE-2021-46911.md): ch\_ktls: Fix kernel panic (CVSS 9.8, Linux)
- [CVE-2021-46910](https://cve.now/CVE-2021-46910.md): ARM: 9063/1: mm: reduce maximum number of CPUs if DEBUG\_KMAP\_LOCAL is enabled (CVSS 7.0, Linux)
- [CVE-2021-46909](https://cve.now/CVE-2021-46909.md): ARM: footbridge: fix PCI interrupt mapping (no CVSS, Linux)
- [CVE-2021-46908](https://cve.now/CVE-2021-46908.md): bpf: Use correct permission flag for mixed signed bounds arithmetic (CVSS 7.1, Linux)
- [CVE-2024-1698](https://cve.now/CVE-2024-1698.md): NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor \<= 2.8.2 - Unauthenticated SQL Injection (CVSS 9.8, wpdevteam NotificationX – FOMO, Live Sales Notification, Wo…)
- [CVE-2024-1687](https://cve.now/CVE-2024-1687.md): Thank You Page Customizer for WooCommerce – Increase Your Sales \<= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution (CVSS 5.4, villatheme Thank You Page Customizer for WooCommerce – Incr…)
- [CVE-2024-1686](https://cve.now/CVE-2024-1686.md): Thank You Page Customizer for WooCommerce – Increase Your Sales \<= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Data Export (CVSS 4.3, villatheme Thank You Page Customizer for WooCommerce – Incr…)
- [CVE-2024-0759](https://cve.now/CVE-2024-0759.md): Collection of internally resolving IPs (CVSS 7.7, mintplex-labs/anything-llm)
- [CVE-2024-1323](https://cve.now/CVE-2024-1323.md): Orbit Fox by ThemeIsle \<= 2.10.30 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, themeisle Orbit Fox: Duplicate Page, Menu Icons, SVG Suppor…)
- [CVE-2023-7033](https://cve.now/CVE-2023-7033.md): Insufficient Resource Pool vulnerability in Ethernet function of Mitsubishi Electric Corporation MELSEC iQ-R series CPU module, MELSEC iQ-L (CVSS 5.3, Mitsubishi Electric MELSEC iQ-R series CPU module R00C… +162)
- [CVE-2023-41506](https://cve.now/CVE-2023-41506.md): An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In PHP v1.0 allows attack (CVSS 9.8)
- [CVE-2024-22543](https://cve.now/CVE-2024-22543.md): An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges via a crafted GET re (CVSS 6.1)
- [CVE-2024-22544](https://cve.now/CVE-2024-22544.md): An issue was discovered in Linksys Router E1700 version 1.0.04 (build 3), allows authenticated attackers to execute arbitrary code via the s (CVSS 8.0)
- [CVE-2024-22917](https://cve.now/CVE-2024-22917.md): SQL injection vulnerability in Dynamic Lab Management System Project in PHP v.1.0 allows a remote attacker to execute arbitrary code via a c (CVSS 8.6)
- [CVE-2024-24027](https://cve.now/CVE-2024-24027.md): SQL Injection vulnerability in Likeshop before 2.5.7 allows attackers to run abitrary SQL commands via the function DistributionMemberLogic: (CVSS 7.2)
- [CVE-2024-24095](https://cve.now/CVE-2024-24095.md): Code-projects Simple Stock System 1.0 is vulnerable to SQL Injection. (CVSS 9.8)
- [CVE-2024-24096](https://cve.now/CVE-2024-24096.md): Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via BookSBIN. (CVSS 7.8)
- [CVE-2024-24099](https://cve.now/CVE-2024-24099.md): Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Employment Status Information Update. (CVSS 5.4)
- [CVE-2024-24100](https://cve.now/CVE-2024-24100.md): Code-projects Computer Book Store 1.0 is vulnerable to SQL Injection via PublisherID. (CVSS 8.3)
- [CVE-2024-24323](https://cve.now/CVE-2024-24323.md): SQL injection vulnerability in linlinjava litemall v.1.8.0 allows a remote attacker to obtain sensitive information via the nickname, consig (CVSS 7.2)
- [CVE-2024-24720](https://cve.now/CVE-2024-24720.md): An issue was discovered in the Forgot password function in Innovaphone PBX before 14r1 devices. (CVSS 5.3)
- [CVE-2024-25166](https://cve.now/CVE-2024-25166.md): Cross Site Scripting vulnerability in 71CMS v.1.0.0 allows a remote attacker to execute arbitrary code via the uploadfile action parameter i (CVSS 6.1)
- [CVE-2024-25398](https://cve.now/CVE-2024-25398.md): In Srelay (the SOCKS proxy and Relay) v.0.4.8p3, a specially crafted network payload can trigger a denial of service condition and disrupt t (CVSS 7.5)
- [CVE-2024-25399](https://cve.now/CVE-2024-25399.md): Subrion CMS 4.2.1 is vulnerable to Cross Site Scripting (XSS) via adminer.php. (CVSS 6.1, intelliants/subrion)
- [CVE-2024-25400](https://cve.now/CVE-2024-25400.md): Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php. (CVSS 9.8)
- [CVE-2024-25723](https://cve.now/CVE-2024-25723.md): ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{us (CVSS 8.8, zenml)
- [CVE-2024-25840](https://cve.now/CVE-2024-25840.md): In the module "Account Manager | Sales Representative & Dealers | CRM" (prestasalesmanager) up to 9.0 from Presta World for PrestaShop, a gu (CVSS 7.5)
- [CVE-2024-25841](https://cve.now/CVE-2024-25841.md): In the module "So Flexibilite" (soflexibilite) from Common-Services for PrestaShop \< 4.1.26, a guest (authenticated customer) can perform Cr (CVSS 5.9)
- [CVE-2024-25843](https://cve.now/CVE-2024-25843.md): In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba\_importer) up to version 1.1.28 from Buy Addons for PrestaShop, a (CVSS 9.8)
- [CVE-2024-25846](https://cve.now/CVE-2024-25846.md): In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) \<= 6.7.0 from MyPrestaModules for PrestaShop, a guest can upload f (CVSS 9.1)
- [CVE-2024-26470](https://cve.now/CVE-2024-26470.md): A host header injection vulnerability in the forgot password function of FullStackHero's WebAPI Boilerplate v1.0.0 and v1.0.1 allows attacke (CVSS 8.1, FullStackHero.WebAPI.Boilerplate)
- [CVE-2024-26471](https://cve.now/CVE-2024-26471.md): A reflected cross-site scripting (XSS) vulnerability in zhimengzhe iBarn v1.5 allows attackers to inject malicious JavaScript into the web b (CVSS 5.4)
- [CVE-2024-26472](https://cve.now/CVE-2024-26472.md): KLiK SocialMediaWebsite version 1.0.1 from msaad1999 has a reflected cross-site scripting (XSS) vulnerability which may allow remote attacke (CVSS 6.1)
- [CVE-2024-26473](https://cve.now/CVE-2024-26473.md): A reflected cross-site scripting (XSS) vulnerability in SocialMediaWebsite v1.0.1 allows attackers to inject malicious JavaScript into the w (CVSS 6.1)
- [CVE-2024-26542](https://cve.now/CVE-2024-26542.md): Cross Site Scripting vulnerability in Bonitasoft, S.A v.7.14. (CVSS 6.1)
- [CVE-2024-27356](https://cve.now/CVE-2024-27356.md): An issue was discovered on certain GL-iNet devices. (CVSS 7.5)
- [CVE-2024-27507](https://cve.now/CVE-2024-27507.md): libLAS 1.8.1 contains a memory leak vulnerability in /libLAS/apps/ts2las.cpp. (CVSS 7.5)
- [CVE-2024-27508](https://cve.now/CVE-2024-27508.md): Atheme 7.2.12 contains a memory leak vulnerability in /atheme/src/crypto-benchmark/main.c. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.