CVEs published February 28, 2024
225 CVEs were published on February 28, 2024: 23 critical, 53 high.
- Published
- 225
- Critical
- 23
- High
- 53
- Medium
- 92
- Low
- 4
- Unrated
- 53
- Now in CISA KEV
- 0
- Fix available
- 43
Most affected products
- Linux
- 86
- Apache Software Foundation Apache Superset · apache-superset
- 5
- Cisco NX-OS Software
- 3
- easynolo Ecommerce Fabrick
- 3
- envothemes Envo's Templates & Widgets for Elementor and Woo…
- 3
- rack
- 3
- Apache Software Foundation Apache OFBiz
- 2
- dpgaspar Flask-AppBuilder · flask-appbuilder
- 2
- IBM Security Guardium Key Lifecycle Manager
- 2
- justinsainton WP eCommerce
- 2
Critical 23
- CVE-2024-25065Apache OFBiz: Path traversal allowing authentication bypass.Apache Software Foundation Apache OFBiz
- CVE-2024-25128Flask-AppBuilder incorrect authentication when using auth type OpenID dpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2024-25910WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL InjectionSkymoonlabs MoveTo
- CVE-2024-25927WordPress postMash – custom post order Plugin <= 1.2.0 is vulnerable to SQL InjectionJoel Starnes postMash – custom post order
- CVE-2024-1514WP eCommerce <= 3.15.1 - Unauthenticated SQL Injectionjustinsainton WP eCommerce
- CVE-2021-47036udp: skip L4 aggregation for UDP tunnel packetsLinux
- CVE-2021-47013net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_sendLinux
- CVE-2021-46999sctp: do asoc update earlier in sctp_sf_do_dupcook_aLinux
- CVE-2024-0550Privileged User using traversal to read system filesmintplex-labs/anything-llm
- CVE-2023-50737An input validation vulnerability in the SE Menu allows an attacker to execute arbitrary code.
- CVE-2023-50736A vulnerability has been identified in the PostScript interpreter in various Lexmark devices.
- CVE-2023-50735A vulnerability has been identified in the PostScript interpreter in various Lexmark devices.
- CVE-2023-50734A vulnerability has been identified in the PostScript interpreter in various Lexmark devices.
- CVE-2023-49930An issue was discovered in Couchbase Server before 7.2.4.
- CVE-2023-49931An issue was discovered in Couchbase Server before 7.2.4.
- CVE-2024-25169An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.mezzanine
- CVE-2024-25170An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.mezzanine
- CVE-2024-25350SQL Injection vulnerability in /zms/admin/edit-ticket.php in PHPGurukul Zoo Management System 1.0 via tickettype and tprice parameters.
- CVE-2024-25422SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMC
- CVE-2024-25830F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction.
- CVE-2024-25833F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbit
- CVE-2024-25867A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL comma
- CVE-2024-27516Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and obremdex/livehelperchat
High 53
- CVE-2023-25925IBM Security Guardium Key Lifecycle Manager command injectionIBM Security Guardium Key Lifecycle Manager
- CVE-2024-1971Surya2Developer Online Shopping System POST Parameter login.php sql injectionSurya2Developer Online Shopping System
- CVE-2024-1847Multiple vulnerabilities exist in file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024Dassault Systèmes eDrawings
- CVE-2024-20267A vulnerability with the handling of MPLS traffic for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the netsCisco NX-OS Software
- CVE-2024-20321A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remoteCisco NX-OS Software
- CVE-2024-27284cassandra-rs non-idiomatic use of iterators leads to use after freeMetaswitch cassandra-rs · cassandra-cpp
- CVE-2024-23807Apache Xerces C++: Use-after-free on external DTD scanApache Software Foundation Apache Xerces C++
- CVE-2024-24868WordPress SP Project & Document Manager Plugin <= 4.69 is vulnerable to SQL InjectionSmartypants SP Project & Document Manager
- CVE-2024-25902WordPress Malware Scanner Plugin <= 4.7.2 is vulnerable to SQL Injectionminiorange Malware Scanner
- CVE-2024-21886Xorg-x11-server: heap buffer overflow in disabledevicexorg-server · Red Hat Enterprise Linux 6 Extended Lifecy… +1
- CVE-2024-21885Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyeventxorg-server · xwayland +2
- CVE-2024-1636Potential Cross-Site Scripting (XSS) in the page editing areaProgress Software Sitefinity
- CVE-2024-1632Incorrect access control in the Sitefinity backendProgress Software Sitefinity
- CVE-2024-0786Conversios <= 7.0.7 - Authenticated (Subscriber+) SQL Injection via ee_syncProductCategorytatvic Conversios: Google Analytics (GA4), Google Ads, Conv…
- CVE-2021-47049Drivers: hv: vmbus: Use after free in __vmbus_open()Linux
- CVE-2021-47048spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp_qspi_exec_opLinux
- CVE-2021-47044sched/fair: Fix shift-out-of-bounds in load_balance()Linux
- CVE-2021-47041nvmet-tcp: fix incorrect locking in state_change sk callbackLinux
- CVE-2021-47040io_uring: fix overflows checks in provide buffersLinux
- CVE-2021-47035iommu/vt-d: Remove WO permissions on second-level paging entriesLinux
- CVE-2021-47028mt76: mt7915: fix txrate reportingLinux
- CVE-2021-47023net: marvell: prestera: fix port event handling on initLinux
- CVE-2021-47017ath10k: Fix a use after free in ath10k_htc_send_bundleLinux
- CVE-2021-47014net/sched: act_ct: fix wild memory access when clearing fragmentsLinux
- CVE-2021-47012RDMA/siw: Fix a use after free in siw_alloc_mrLinux
- CVE-2021-47011mm: memcontrol: slab: fix obtain a reference to a freeing memcgLinux
- CVE-2021-47010net: Only allow init netns to set default tcp cong to a restricted algoLinux
- CVE-2021-47004f2fs: fix to avoid touching checkpointed data in get_victim()Linux
- CVE-2021-47001xprtrdma: Fix cwnd update orderingLinux
- CVE-2021-46998ethernet:enic: Fix a use after free bug in enic_hard_start_xmitLinux
- CVE-2021-46993sched: Fix out-of-bound access in uclampLinux
- CVE-2021-46992netfilter: nftables: avoid overflows in nft_hash_buckets()Linux
- CVE-2021-46989hfsplus: prevent corruption in shrinking truncateLinux
- CVE-2021-46984kyber: fix out of bounds access when preemptedLinux
- CVE-2021-46983nvmet-rdma: Fix NULL deref when SEND is completed with errorLinux
- CVE-2021-46978KVM: nVMX: Always make an attempt to map eVMCS after migrationLinux
- CVE-2021-46977KVM: VMX: Disable preemption when probing user return MSRsLinux
- CVE-2020-36787media: aspeed: fix clock handling logicLinux
- CVE-2020-36785media: atomisp: Fix use after free in atomisp_alloc_css_stat_bufs()Linux
- CVE-2024-1892ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpiderscrapy/scrapy · scrapy
- CVE-2023-45859In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client com.hazelcast:hazelcast · com.hazelcast:hazelcast-all
- CVE-2023-49338Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8
- CVE-2023-50437An issue was discovered in Couchbase Server before 7.2.x before 7.2.4.
- CVE-2023-52047Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager.
- CVE-2024-22983SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the
- CVE-2024-23302Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.
- CVE-2024-24148A memory leak issue discovered in parseSWF_FREECHARACTER in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF f
- CVE-2024-25832F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dan
- CVE-2024-25859A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and exe
- CVE-2024-25866A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL comma
- CVE-2024-25869An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitra
- CVE-2024-26342A Null pointer dereference in usr/sbin/httpd in ASUS AC68U 3.0.0.4.384.82230 allows remote attackers to trigger DoS via network packet.
- CVE-2024-27515Osclass 5.1.2 is vulnerable to SQL Injection.
Medium, low and unrated 149
- CVE-2024-26141Possible DoS Vulnerability with Range Header in Rackrack
- CVE-2024-25126Rack ReDos in content type parsing (2nd degree polynomial)rack
- CVE-2024-26146Possible Denial of Service Vulnerability in Rack Header Parsingrack
- CVE-2024-25579OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to exeELECOM CO. WRC-1167GS2-B · ELECOM CO. WRC-1167GS2H-B +11
- CVE-2024-23910Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated attELECOM CO. WRC-1167GS2-B · ELECOM CO. WRC-1167GS2H-B +9
- CVE-2024-21798ELECOM wireless LAN routers contain a cross-site scripting vulnerability.ELECOM CO. WRC-1167GS2-B · ELECOM CO. WRC-1167GS2H-B +8
- CVE-2023-5617Hitachi Vantara Pentaho Data Integration & Analytics - Server-generated Error Message Containing Sensitive InformationHitachi Vantara Pentaho Data Integration & Analytics
- CVE-2023-25922IBM Security Guardium Key Lifecycle Manager file uploadIBM Security Guardium Key Lifecycle Manager
- CVE-2024-1972SourceCodester Online Job Portal EditProfile.php cross site scriptingSourceCodester Online Job Portal
- CVE-2024-1970SourceCodester Online Learning System V2 index.php cross site scriptingSourceCodester Online Learning System
- CVE-2024-27285YARD's default template vulnerable to Cross-site Scripting in generated frames.htmllsegal yard · yard
- CVE-2023-51692WordPress Customer Reviews for WooCommerce Plugin <= 5.38.1 is vulnerable to Broken Access ControlCusRev Customer Reviews for WooCommerce
- CVE-2023-51533WordPress Ecwid Shopping Cart Plugin <= 6.12.4 is vulnerable to Cross Site Request Forgery (CSRF)Ecwid Ecommerce Shopping Cart
- CVE-2024-27948WordPress Atahualpa Theme <= 3.7.24 is vulnerable to Cross Site Request Forgery (CSRF)bytesforall Atahualpa
- CVE-2024-27103Querybook Stored Cross-Site Scripting allows Privilege Elevationpinterest querybook
- CVE-2023-51683WordPress Easy PayPal Buy Now Button Plugin <= 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF)Scott Paterson Easy PayPal & Stripe Buy Now Button
- CVE-2023-51681WordPress Duplicator Plugin <= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF)Duplicator – WordPress Migration & Backup Plugin
- CVE-2023-52223WordPress MailerLite – WooCommerce integration Plugin <= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)MailerLite – WooCommerce integration
- CVE-2024-0560Apicast: use_3scale_oidc_issuer_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versionsAPIcast · Red Hat 3scale API Management Platform
- CVE-2023-52226WordPress Advanced Flamingo plugin <= 1.0 - Cross Site Request Forgery (CSRF) vulnerabilityAdvanced Flamingo
- CVE-2024-21749WordPress 1 click disable all Plugin <= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF)Atakan Au 1 click disable all
- CVE-2024-23519WordPress Email Before Download Plugin <= 6.9.7 is vulnerable to Cross Site Request Forgery (CSRF)M&S Consulting Email Before Download
- CVE-2024-20294A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthentCisco NX-OS Software · Cisco Unified Computing System +2
- CVE-2024-20291A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in Cisco NX-OS Software
- CVE-2024-24701WordPress Setka Editor Plugin <= 2.1.20 is vulnerable to Cross Site Request Forgery (CSRF)Native Grid A no-code page builder for beautiful performanc…
- CVE-2024-20344A vulnerability in system resource management in Cisco UCS 6400 and 6500 Series Fabric Interconnects that are in Intersight Managed Mode (IMCisco Unified Computing System
- CVE-2024-23946Apache OFBiz: Path traversal or file inclusionApache Software Foundation Apache OFBiz
- CVE-2024-27083Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS)dpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2023-6917Pcp: unsafe use of directories allows pcp to root privilege escalationRed Hat Enterprise Linux
- CVE-2024-24702WordPress Page Restrict Plugin <= 2.5.5 is vulnerable to Cross Site Request Forgery (CSRF)Matt Martz & Andy Stratton Page Restrict
- CVE-2024-24705WordPress Accessibility Plugin <= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF)Octa Code Accessibility
- CVE-2024-24708WordPress W3SPEEDSTER Plugin <= 7.19 is vulnerable to Cross Site Request Forgery (CSRF)W3SPEEDSTER
- CVE-2024-25930WordPress Custom Order Statuses for WooCommerce Plugin <= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF)Nuggethon Custom Order Statuses for WooCommerce
- CVE-2024-25931WordPress Heureka Plugin <= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF)Heureka Group Heureka
- CVE-2024-25932WordPress Change Table Prefix plugin <= 2.0 - Cross Site Request Forgery (CSRF) vulnerabilityManish Kumar Agarwal Change Table Prefix
- CVE-2024-1808WP Shortcodes Plugin — Shortcodes Ultimate <= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su_qrcode Shortcodegn_themes WP Shortcodes Plugin — Shortcodes Ultimate
- CVE-2024-1965Server-Side Request Forgery Vulnerability in Haivision ProductsHaivision Aviwest Manager · Haivision Aviwest Streamhub
- CVE-2024-26016Apache Superset: Improper authorization validation on dashboards and charts importApache Software Foundation Apache Superset · apache-superset
- CVE-2024-24779Apache Superset: Improper data authorization when creating a new datasetApache Software Foundation Apache Superset · apache-superset
- CVE-2024-24772Apache Superset: Improper Neutralisation of custom SQL on embedded contextApache Software Foundation Apache Superset · apache-superset
- CVE-2024-24773Apache Superset: Improper validation of SQL statements allows for unauthorized access to dataApache Software Foundation Apache Superset · apache-superset
- CVE-2024-27315Apache Superset: Improper error handling on alertsApache Software Foundation Apache Superset · apache-superset
- CVE-2024-1861Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table Truncationsminozzi Disable Json API, Login Lockdown, XMLRPC, Pingback…
- CVE-2024-1719Easy PayPal & Stripe Buy Now Button <= 1.8.3 & Contact Form 7 – PayPal & Stripe Add-on <= 2.1 - Cross-Site Request Forgery to Settings Updatescottpaterson Easy PayPal & Stripe Buy Now Button · scottpa…
- CVE-2024-1860Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan <= 4.51 - Missing Authorization to Unauthenticated IP Address Whitelistsminozzi Disable Json API, Login Lockdown, XMLRPC, Pingback…
- CVE-2024-1476Under Construction / Maintenance Mode from Acurax <= 2.6 - Information ExposureUnder Construction / Maintenance Mode from Acurax
- CVE-2024-1136Coming Soon Page & Maintenance Mode <= 2.2.1 - Maintenance Mode Bypasswpshopmart Coming Soon Page & Maintenance Mode
- CVE-2024-0767Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_plugin_activationenvothemes Envo's Templates & Widgets for Elementor and Woo…
- CVE-2024-1368Page Duplicator <= 0.1.1 - Missing Authorization to Unauthenticated Post/Page Duplicationsamuelkwle Page Duplicator
- CVE-2024-1516WP eCommerce <= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creationjustinsainton WP eCommerce
- CVE-2024-0766Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_requestenvothemes Envo's Templates & Widgets for Elementor and Woo…
- CVE-2024-1954Oliver POS – A WooCommerce Point of Sale (POS) <= 2.4.1.8 - Cross-Site Request Forgeryoliverpos Oliver POS – A WooCommerce Point of Sale
- CVE-2024-0431Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_set_default_cardeasynolo Ecommerce Fabrick
- CVE-2024-1566Redirects <= 1.2.1 - Missing Authorization via savemattdeclaire Redirects
- CVE-2024-0432Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_delete_cardeasynolo Ecommerce Fabrick
- CVE-2024-0768Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_theme_activationenvothemes Envo's Templates & Widgets for Elementor and Woo…
- CVE-2024-0682Page Restrict <= 2.5.5 - Protection Mechanism Bypasssivel Page Restrict
- CVE-2024-1791CodeMirror Blocks <= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingvickyagravat CodeMirror Blocks
- CVE-2024-0433Gestpay for WooCommerce <= 20221130 - Cross-Site Request Forgery (CSRF) via ajax_unset_default_cardeasynolo Ecommerce Fabrick
- CVE-2024-0680WP Private Content Plus <= 3.6 - Protection Mechanism Bypassnimeshrmr WP Private Content Plus
- CVE-2024-0975WordPress Access Control <= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST APIbrandonwamboldt WordPress Access Control
- CVE-2023-6922Under Construction / Maintenance Mode from Acurax <= 2.6 - Authenticated (Subscriber+) Sensitive Information ExposureUnder Construction / Maintenance Mode from Acurax
- CVE-2024-22459Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper access control vulnerDell ECS
- CVE-2021-47053crypto: sun8i-ss - Fix memory leak of padLinux
- CVE-2021-47052crypto: sa2ul - Fix memory leak of rxdLinux
- CVE-2021-47051spi: fsl-lpspi: Fix PM reference leak in lpspi_prepare_xfer_hardware()Linux
- CVE-2021-47050memory: renesas-rpc-if: fix possible NULL pointer dereference of resourceLinux
- CVE-2021-47047spi: spi-zynqmp-gqspi: return -ENOMEM if dma_map_single failsLinux
- CVE-2021-47046drm/amd/display: Fix off by one in hdmi_14_process_transaction()Linux
- CVE-2021-47045scsi: lpfc: Fix null pointer dereference in lpfc_prep_els_iocb()Linux
- CVE-2021-47043media: venus: core: Fix some resource leaks in the error path of 'venus_probe()'Linux
- CVE-2021-47042drm/amd/display: Free local data after useLinux
- CVE-2021-47039ataflop: potential out of bounds in do_format()Linux
- CVE-2021-47038Bluetooth: avoid deadlock between hci_dev->lock and socket lockLinux
- CVE-2021-47037ASoC: q6afe-clocks: fix reprobing of the driverLinux
- CVE-2021-47034powerpc/64s: Fix pte update for kernel memory on radixLinux
- CVE-2021-47033mt76: mt7615: fix tx skb dma unmapLinux
- CVE-2021-47032mt76: mt7915: fix tx skb dma unmapLinux
- CVE-2021-47031mt76: mt7921: fix memory leak in mt7921_coredump_workLinux
- CVE-2021-47030mt76: mt7615: fix memory leak in mt7615_coredump_workLinux
- CVE-2021-47029mt76: connac: fix kernel warning adding monitor interfaceLinux
- CVE-2021-47027mt76: mt7921: fix kernel crash when the firmware fails to downloadLinux
- CVE-2021-47026RDMA/rtrs-clt: destroy sysfs after removing session from active listLinux
- CVE-2021-47025iommu/mediatek: Always enable the clk on resumeLinux
- CVE-2021-47024vsock/virtio: free queued packets when closing socketLinux
- CVE-2021-47022mt76: mt7615: fix memleak when mt7615_unregister_device()Linux
- CVE-2021-47021mt76: mt7915: fix memleak when mt7915_unregister_device()Linux
- CVE-2021-47019mt76: mt7921: fix possible invalid register accessLinux
- CVE-2021-47018powerpc/64: Fix the definition of the fixmap areaLinux
- CVE-2021-47015bnxt_en: Fix RX consumer index logic in the error path.Linux
- CVE-2021-47009KEYS: trusted: Fix memory leak on object tdLinux
- CVE-2021-47008KVM: SVM: Make sure GHCB is mapped before updatingLinux
- CVE-2021-47007f2fs: fix panic during f2fs_resize_fs()Linux
- CVE-2021-47006ARM: 9064/1: hw_breakpoint: Do not directly check the event's overflow_handler hookLinux
- CVE-2021-47005PCI: endpoint: Fix NULL pointer dereference for ->get_features()Linux
- CVE-2021-47003dmaengine: idxd: Fix potential null dereference on pointer statusLinux
- CVE-2021-47002SUNRPC: Fix null pointer dereference in svc_rqst_free()Linux
- CVE-2021-47000ceph: fix inode leak on getattr error in __fh_to_dentryLinux
- CVE-2021-46997arm64: entry: always set GIC_PRIO_PSR_I_SET during entryLinux
- CVE-2021-46996netfilter: nftables: Fix a memleak from userdata error path in new objectsLinux
- CVE-2021-46995can: mcp251xfd: mcp251xfd_probe(): fix an error pointer dereference in probeLinux
- CVE-2021-46994can: mcp251x: fix resume from sleep before interface was brought upLinux
- CVE-2021-46991i40e: Fix use-after-free in i40e_client_subtask()Linux
- CVE-2021-46990powerpc/64s: Fix crashes when toggling entry flush barrierLinux
- CVE-2021-46988userfaultfd: release page in error path to avoid BUG_ONLinux
- CVE-2021-46987btrfs: fix deadlock when cloning inline extents and using qgroupsLinux
- CVE-2021-46986usb: dwc3: gadget: Free gadget structure only after freeing endpointsLinux
- CVE-2021-46985ACPI: scan: Fix a memory leak in an error handling pathLinux
- CVE-2021-46982f2fs: compress: fix race condition of overwrite vs truncateLinux
- CVE-2021-46981nbd: Fix NULL pointer in flush_workqueueLinux
- CVE-2021-46980usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4Linux
- CVE-2021-46979iio: core: fix ioctl handlers removalLinux
- CVE-2021-46976drm/i915: Fix crash in auto_retireLinux
- CVE-2020-36786media: [next] staging: media: atomisp: fix memory leak of object flashLinux
- CVE-2020-36784i2c: cadence: fix reference leak when pm_runtime_get_sync failsLinux
- CVE-2020-36783i2c: img-scb: fix reference leak when pm_runtime_get_sync failsLinux
- CVE-2020-36782i2c: imx-lpi2c: fix reference leak when pm_runtime_get_sync failsLinux
- CVE-2020-36781i2c: imx: fix reference leak when pm_runtime_get_sync failsLinux
- CVE-2020-36780i2c: sprd: fix reference leak when pm_runtime_get_sync failsLinux
- CVE-2020-36779i2c: stm32f7: fix reference leak when pm_runtime_get_sync failsLinux
- CVE-2020-36778i2c: xiic: fix reference leak when pm_runtime_get_sync failsLinux
- CVE-2024-1943Yuki <= 1.3.14 - Cross-Site Request Forgery to Theme Setting Resetwpmoose Yuki
- CVE-2024-1388Yuki <= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Resetwpmoose Yuki
- CVE-2024-1568Seraphinite Accelerator <= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi_HtmlCheckseraphinitesoft Seraphinite Accelerator
- CVE-2023-50303IBM InfoSphere Information Server cross-site scriptingIBM InfoSphere Information Server
- CVE-2024-1932Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescoutfreescout-helpdesk/freescout
- CVE-2023-43769An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1.
- CVE-2023-45873An issue was discovered in Couchbase Server through 7.2.2.
- CVE-2023-45874An issue was discovered in Couchbase Server through 7.2.2.
- CVE-2023-49932An issue was discovered in Couchbase Server before 7.2.4.
- CVE-2023-50436An issue was discovered in Couchbase Server before 7.2.4.
- CVE-2023-52048RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/.
- CVE-2024-22532Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x86) allows attackers to cause a denial of service via crafted xwd file.
- CVE-2024-22723Webtrees 2.1.18 is vulnerable to Directory Traversal.fisharebest/webtrees
- CVE-2024-24146A memory leak issue discovered in parseSWF_DEFINEBUTTON in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF fi
- CVE-2024-24147A memory leak issue discovered in parseSWF_FILLSTYLEARRAY in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF
- CVE-2024-24149A memory leak issue discovered in parseSWF_GLYPHENTRY in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file
- CVE-2024-24150A memory leak issue discovered in parseSWF_TEXTRECORD in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file
- CVE-2024-24155Bento4 v1.5.1-628 contains a Memory leak on AP4_Movie::AP4_Movie, parsing tracks and added into m_Tracks list, but mp42aac cannot correctly
- CVE-2024-25202Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attackers to run arbitrary
- CVE-2024-25351SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to run arbitrary SQL comm
- CVE-2024-25435A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a cr
- CVE-2024-25831F-logic DataCube3 Version 1.0 is affected by a reflected cross-site scripting (XSS) vulnerability due to improper input sanitization.
- CVE-2024-25868A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitr
- CVE-2024-26450An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application.
- CVE-2024-26476An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq
- CVE-2024-26559An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information.
- CVE-2024-27517Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permi
- CVE-2024-27913ospf_te_parse_te in ospfd/ospf_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash)