# CVEs published 2024-02-28

225 CVEs were published on February 28, 2024: 23 critical, 53 high. Days are UTC.

- [CVE-2024-26141](https://cve.now/CVE-2024-26141.md): Possible DoS Vulnerability with Range Header in Rack (CVSS 5.8, rack)
- [CVE-2024-25126](https://cve.now/CVE-2024-25126.md): Rack ReDos in content type parsing (2nd degree polynomial) (CVSS 5.3, rack)
- [CVE-2024-26146](https://cve.now/CVE-2024-26146.md): Possible Denial of Service Vulnerability in Rack Header Parsing (CVSS 5.3, rack)
- [CVE-2024-25579](https://cve.now/CVE-2024-25579.md): OS command injection vulnerability in ELECOM wireless LAN routers allows a network-adjacent attacker with an administrative privilege to exe (CVSS 6.8, ELECOM CO. WRC-1167GS2-B · ELECOM CO. WRC-1167GS2H-B +11)
- [CVE-2024-23910](https://cve.now/CVE-2024-23910.md): Cross-site request forgery (CSRF) vulnerability in ELECOM wireless LAN routers and wireless LAN repeater allows a remote unauthenticated att (CVSS 4.3, ELECOM CO. WRC-1167GS2-B · ELECOM CO. WRC-1167GS2H-B +9)
- [CVE-2024-21798](https://cve.now/CVE-2024-21798.md): ELECOM wireless LAN routers contain a cross-site scripting vulnerability. (CVSS 4.8, ELECOM CO. WRC-1167GS2-B · ELECOM CO. WRC-1167GS2H-B +8)
- [CVE-2023-5617](https://cve.now/CVE-2023-5617.md): Hitachi Vantara Pentaho Data Integration & Analytics - Server-generated Error Message Containing Sensitive Information (CVSS 5.3, Hitachi Vantara Pentaho Data Integration & Analytics)
- [CVE-2023-25925](https://cve.now/CVE-2023-25925.md): IBM Security Guardium Key Lifecycle Manager command injection (CVSS 8.5, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2023-25922](https://cve.now/CVE-2023-25922.md): IBM Security Guardium Key Lifecycle Manager file upload (CVSS 4.3, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2024-1972](https://cve.now/CVE-2024-1972.md): SourceCodester Online Job Portal EditProfile.php cross site scripting (CVSS 3.5, SourceCodester Online Job Portal)
- [CVE-2024-1971](https://cve.now/CVE-2024-1971.md): Surya2Developer Online Shopping System POST Parameter login.php sql injection (CVSS 7.3, Surya2Developer Online Shopping System)
- [CVE-2024-1970](https://cve.now/CVE-2024-1970.md): SourceCodester Online Learning System V2 index.php cross site scripting (CVSS 4.3, SourceCodester Online Learning System)
- [CVE-2024-27285](https://cve.now/CVE-2024-27285.md): YARD's default template vulnerable to Cross-site Scripting in generated frames.html (CVSS 5.4, lsegal yard · yard)
- [CVE-2023-51692](https://cve.now/CVE-2023-51692.md): WordPress Customer Reviews for WooCommerce Plugin \<= 5.38.1 is vulnerable to Broken Access Control (CVSS 4.3, CusRev Customer Reviews for WooCommerce)
- [CVE-2023-51533](https://cve.now/CVE-2023-51533.md): WordPress Ecwid Shopping Cart Plugin \<= 6.12.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Ecwid Ecommerce Shopping Cart)
- [CVE-2024-27948](https://cve.now/CVE-2024-27948.md): WordPress Atahualpa Theme \<= 3.7.24 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, bytesforall Atahualpa)
- [CVE-2024-27103](https://cve.now/CVE-2024-27103.md): Querybook Stored Cross-Site Scripting allows Privilege Elevation (CVSS 6.1, pinterest querybook)
- [CVE-2024-1847](https://cve.now/CVE-2024-1847.md): Multiple vulnerabilities exist in file reading procedure in eDrawings from Release SOLIDWORKS 2023 through Release SOLIDWORKS 2024 (CVSS 7.8, Dassault Systèmes eDrawings)
- [CVE-2023-51683](https://cve.now/CVE-2023-51683.md): WordPress Easy PayPal Buy Now Button Plugin \<= 1.8.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Scott Paterson Easy PayPal & Stripe Buy Now Button)
- [CVE-2023-51681](https://cve.now/CVE-2023-51681.md): WordPress Duplicator Plugin \<= 1.5.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 6.5, Duplicator – WordPress Migration & Backup Plugin)
- [CVE-2023-52223](https://cve.now/CVE-2023-52223.md): WordPress MailerLite – WooCommerce integration Plugin \<= 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, MailerLite – WooCommerce integration)
- [CVE-2024-0560](https://cve.now/CVE-2024-0560.md): Apicast: use\_3scale\_oidc\_issuer\_endpoint of token introspection policy isn't compatible with rh-sso 7.5 or later versions (CVSS 6.3, APIcast · Red Hat 3scale API Management Platform)
- [CVE-2023-52226](https://cve.now/CVE-2023-52226.md): WordPress Advanced Flamingo plugin \<= 1.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Advanced Flamingo)
- [CVE-2024-21749](https://cve.now/CVE-2024-21749.md): WordPress 1 click disable all Plugin \<= 1.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Atakan Au 1 click disable all)
- [CVE-2024-23519](https://cve.now/CVE-2024-23519.md): WordPress Email Before Download Plugin \<= 6.9.7 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, M&S Consulting Email Before Download)
- [CVE-2024-20294](https://cve.now/CVE-2024-20294.md): A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco FXOS Software and Cisco NX-OS Software could allow an unauthent (CVSS 6.6, Cisco NX-OS Software · Cisco Unified Computing System +2)
- [CVE-2024-20291](https://cve.now/CVE-2024-20291.md): A vulnerability in the access control list (ACL) programming for port channel subinterfaces of Cisco Nexus 3000 and 9000 Series Switches in (CVSS 5.8, Cisco NX-OS Software)
- [CVE-2024-24701](https://cve.now/CVE-2024-24701.md): WordPress Setka Editor Plugin \<= 2.1.20 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Native Grid A no-code page builder for beautiful performanc…)
- [CVE-2024-20344](https://cve.now/CVE-2024-20344.md): A vulnerability in system resource management in Cisco UCS 6400 and 6500 Series Fabric Interconnects that are in Intersight Managed Mode (IM (CVSS 5.3, Cisco Unified Computing System)
- [CVE-2024-20267](https://cve.now/CVE-2024-20267.md): A vulnerability with the handling of MPLS traffic for Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause the nets (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2024-20321](https://cve.now/CVE-2024-20321.md): A vulnerability in the External Border Gateway Protocol (eBGP) implementation of Cisco NX-OS Software could allow an unauthenticated, remote (CVSS 8.6, Cisco NX-OS Software)
- [CVE-2024-27284](https://cve.now/CVE-2024-27284.md): cassandra-rs non-idiomatic use of iterators leads to use after free (CVSS 7.5, Metaswitch cassandra-rs · cassandra-cpp)
- [CVE-2024-23946](https://cve.now/CVE-2024-23946.md): Apache OFBiz: Path traversal or file inclusion (CVSS 5.3, Apache Software Foundation Apache OFBiz)
- [CVE-2024-25065](https://cve.now/CVE-2024-25065.md): Apache OFBiz: Path traversal allowing authentication bypass. (CVSS 9.1, Apache Software Foundation Apache OFBiz)
- [CVE-2024-27083](https://cve.now/CVE-2024-27083.md): Flask-AppBuilder's OAuth login page subject to Cross Site Scripting (XSS) (CVSS 4.3, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2024-25128](https://cve.now/CVE-2024-25128.md): Flask-AppBuilder incorrect authentication when using auth type OpenID (CVSS 9.1, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2023-6917](https://cve.now/CVE-2023-6917.md): Pcp: unsafe use of directories allows pcp to root privilege escalation (CVSS 6.0, Red Hat Enterprise Linux)
- [CVE-2024-24702](https://cve.now/CVE-2024-24702.md): WordPress Page Restrict Plugin \<= 2.5.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Matt Martz & Andy Stratton Page Restrict)
- [CVE-2024-24705](https://cve.now/CVE-2024-24705.md): WordPress Accessibility Plugin \<= 1.0.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Octa Code Accessibility)
- [CVE-2024-23807](https://cve.now/CVE-2024-23807.md): Apache Xerces C++: Use-after-free on external DTD scan (CVSS 8.1, Apache Software Foundation Apache Xerces C++)
- [CVE-2024-24708](https://cve.now/CVE-2024-24708.md): WordPress W3SPEEDSTER Plugin \<= 7.19 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, W3SPEEDSTER)
- [CVE-2024-25930](https://cve.now/CVE-2024-25930.md): WordPress Custom Order Statuses for WooCommerce Plugin \<= 1.5.2 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Nuggethon Custom Order Statuses for WooCommerce)
- [CVE-2024-25931](https://cve.now/CVE-2024-25931.md): WordPress Heureka Plugin \<= 1.0.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Heureka Group Heureka)
- [CVE-2024-25932](https://cve.now/CVE-2024-25932.md): WordPress Change Table Prefix plugin \<= 2.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Manish Kumar Agarwal Change Table Prefix)
- [CVE-2024-24868](https://cve.now/CVE-2024-24868.md): WordPress SP Project & Document Manager Plugin \<= 4.69 is vulnerable to SQL Injection (CVSS 8.5, Smartypants SP Project & Document Manager)
- [CVE-2024-25902](https://cve.now/CVE-2024-25902.md): WordPress Malware Scanner Plugin \<= 4.7.2 is vulnerable to SQL Injection (CVSS 7.6, miniorange Malware Scanner)
- [CVE-2024-25910](https://cve.now/CVE-2024-25910.md): WordPress MoveTo Plugin \<= 6.2 is vulnerable to SQL Injection (CVSS 9.8, Skymoonlabs MoveTo)
- [CVE-2024-1808](https://cve.now/CVE-2024-1808.md): WP Shortcodes Plugin — Shortcodes Ultimate \<= 7.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via su\_qrcode Shortcode (CVSS 6.4, gn\_themes WP Shortcodes Plugin — Shortcodes Ultimate)
- [CVE-2024-25927](https://cve.now/CVE-2024-25927.md): WordPress postMash – custom post order Plugin \<= 1.2.0 is vulnerable to SQL Injection (CVSS 9.3, Joel Starnes postMash – custom post order)
- [CVE-2024-1965](https://cve.now/CVE-2024-1965.md): Server-Side Request Forgery Vulnerability in Haivision Products (CVSS 6.5, Haivision Aviwest Manager · Haivision Aviwest Streamhub)
- [CVE-2024-21886](https://cve.now/CVE-2024-21886.md): Xorg-x11-server: heap buffer overflow in disabledevice (CVSS 7.8, xorg-server · Red Hat Enterprise Linux 6 Extended Lifecy… +1)
- [CVE-2024-21885](https://cve.now/CVE-2024-21885.md): Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent (CVSS 7.8, xorg-server · xwayland +2)
- [CVE-2024-1636](https://cve.now/CVE-2024-1636.md): Potential Cross-Site Scripting (XSS) in the page editing area (CVSS 8.0, Progress Software Sitefinity)
- [CVE-2024-1632](https://cve.now/CVE-2024-1632.md): Incorrect access control in the Sitefinity backend (CVSS 8.8, Progress Software Sitefinity)
- [CVE-2024-26016](https://cve.now/CVE-2024-26016.md): Apache Superset: Improper authorization validation on dashboards and charts import (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-24779](https://cve.now/CVE-2024-24779.md): Apache Superset: Improper data authorization when creating a new dataset (CVSS 5.0, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-24772](https://cve.now/CVE-2024-24772.md): Apache Superset: Improper Neutralisation of custom SQL on embedded context (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-24773](https://cve.now/CVE-2024-24773.md): Apache Superset: Improper validation of SQL statements allows for unauthorized access to data (CVSS 4.9, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-27315](https://cve.now/CVE-2024-27315.md): Apache Superset: Improper error handling on alerts (CVSS 4.3, Apache Software Foundation Apache Superset · apache-superset)
- [CVE-2024-1861](https://cve.now/CVE-2024-1861.md): Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan \<= 4.52 - Missing Authorization to Authenticated (Subscriber+) Table Truncation (CVSS 4.3, sminozzi Disable Json API, Login Lockdown, XMLRPC, Pingback…)
- [CVE-2024-1719](https://cve.now/CVE-2024-1719.md): Easy PayPal & Stripe Buy Now Button \<= 1.8.3 & Contact Form 7 – PayPal & Stripe Add-on \<= 2.1 - Cross-Site Request Forgery to Settings Update (CVSS 4.3, scottpaterson Easy PayPal & Stripe Buy Now Button · scottpa…)
- [CVE-2024-1860](https://cve.now/CVE-2024-1860.md): Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan \<= 4.51 - Missing Authorization to Unauthenticated IP Address Whitelist (CVSS 6.5, sminozzi Disable Json API, Login Lockdown, XMLRPC, Pingback…)
- [CVE-2024-1476](https://cve.now/CVE-2024-1476.md): Under Construction / Maintenance Mode from Acurax \<= 2.6 - Information Exposure (CVSS 5.3, Under Construction / Maintenance Mode from Acurax)
- [CVE-2024-1136](https://cve.now/CVE-2024-1136.md): Coming Soon Page & Maintenance Mode \<= 2.2.1 - Maintenance Mode Bypass (CVSS 5.3, wpshopmart Coming Soon Page & Maintenance Mode)
- [CVE-2024-0767](https://cve.now/CVE-2024-0767.md): Envo's Elementor Templates & Widgets for WooCommerce \<= 1.4.4 - Cross-Site Request Forgery via ajax\_plugin\_activation (CVSS 4.3, envothemes Envo's Templates & Widgets for Elementor and Woo…)
- [CVE-2024-0786](https://cve.now/CVE-2024-0786.md): Conversios \<= 7.0.7 - Authenticated (Subscriber+) SQL Injection via ee\_syncProductCategory (CVSS 8.8, tatvic Conversios: Google Analytics (GA4), Google Ads, Conv…)
- [CVE-2024-1368](https://cve.now/CVE-2024-1368.md): Page Duplicator \<= 0.1.1 - Missing Authorization to Unauthenticated Post/Page Duplication (CVSS 5.3, samuelkwle Page Duplicator)
- [CVE-2024-1516](https://cve.now/CVE-2024-1516.md): WP eCommerce \<= 3.15.1 - Missing Authorization to Unauthenticated Arbitrary Post Creation (CVSS 5.3, justinsainton WP eCommerce)
- [CVE-2024-0766](https://cve.now/CVE-2024-0766.md): Envo's Elementor Templates & Widgets for WooCommerce \<= 1.4.4 - Missing Authorization via templates\_ajax\_request (CVSS 4.3, envothemes Envo's Templates & Widgets for Elementor and Woo…)
- [CVE-2024-1954](https://cve.now/CVE-2024-1954.md): Oliver POS – A WooCommerce Point of Sale (POS) \<= 2.4.1.8 - Cross-Site Request Forgery (CVSS 6.3, oliverpos Oliver POS – A WooCommerce Point of Sale)
- [CVE-2024-0431](https://cve.now/CVE-2024-0431.md): Gestpay for WooCommerce \<= 20221130 - Cross-Site Request Forgery (CSRF) via ajax\_set\_default\_card (CVSS 4.3, easynolo Ecommerce Fabrick)
- [CVE-2024-1566](https://cve.now/CVE-2024-1566.md): Redirects \<= 1.2.1 - Missing Authorization via save (CVSS 6.5, mattdeclaire Redirects)
- [CVE-2024-0432](https://cve.now/CVE-2024-0432.md): Gestpay for WooCommerce \<= 20221130 - Cross-Site Request Forgery (CSRF) via ajax\_delete\_card (CVSS 4.3, easynolo Ecommerce Fabrick)
- [CVE-2024-0768](https://cve.now/CVE-2024-0768.md): Envo's Elementor Templates & Widgets for WooCommerce \<= 1.4.4 - Cross-Site Request Forgery via ajax\_theme\_activation (CVSS 4.3, envothemes Envo's Templates & Widgets for Elementor and Woo…)
- [CVE-2024-0682](https://cve.now/CVE-2024-0682.md): Page Restrict \<= 2.5.5 - Protection Mechanism Bypass (CVSS 5.3, sivel Page Restrict)
- [CVE-2024-1791](https://cve.now/CVE-2024-1791.md): CodeMirror Blocks \<= 1.2.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, vickyagravat CodeMirror Blocks)
- [CVE-2024-0433](https://cve.now/CVE-2024-0433.md): Gestpay for WooCommerce \<= 20221130 - Cross-Site Request Forgery (CSRF) via ajax\_unset\_default\_card (CVSS 4.3, easynolo Ecommerce Fabrick)
- [CVE-2024-0680](https://cve.now/CVE-2024-0680.md): WP Private Content Plus \<= 3.6 - Protection Mechanism Bypass (CVSS 5.3, nimeshrmr WP Private Content Plus)
- [CVE-2024-0975](https://cve.now/CVE-2024-0975.md): WordPress Access Control \<= 4.0.13 - Improper Access Control to Sensitive Information Exposure via REST API (CVSS 5.3, brandonwamboldt WordPress Access Control)
- [CVE-2023-6922](https://cve.now/CVE-2023-6922.md): Under Construction / Maintenance Mode from Acurax \<= 2.6 - Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3, Under Construction / Maintenance Mode from Acurax)
- [CVE-2024-1514](https://cve.now/CVE-2024-1514.md): WP eCommerce \<= 3.15.1 - Unauthenticated SQL Injection (CVSS 9.8, justinsainton WP eCommerce)
- [CVE-2024-22459](https://cve.now/CVE-2024-22459.md): Dell ECS, versions 3.6 through 3.6.2.5, and 3.7 through 3.7.0.6, and 3.8 through 3.8.0.4 versions, contain an improper access control vulner (CVSS 6.8, Dell ECS)
- [CVE-2021-47053](https://cve.now/CVE-2021-47053.md): crypto: sun8i-ss - Fix memory leak of pad (no CVSS, Linux)
- [CVE-2021-47052](https://cve.now/CVE-2021-47052.md): crypto: sa2ul - Fix memory leak of rxd (no CVSS, Linux)
- [CVE-2021-47051](https://cve.now/CVE-2021-47051.md): spi: fsl-lpspi: Fix PM reference leak in lpspi\_prepare\_xfer\_hardware() (no CVSS, Linux)
- [CVE-2021-47050](https://cve.now/CVE-2021-47050.md): memory: renesas-rpc-if: fix possible NULL pointer dereference of resource (no CVSS, Linux)
- [CVE-2021-47049](https://cve.now/CVE-2021-47049.md): Drivers: hv: vmbus: Use after free in \_\_vmbus\_open() (CVSS 8.4, Linux)
- [CVE-2021-47048](https://cve.now/CVE-2021-47048.md): spi: spi-zynqmp-gqspi: fix use-after-free in zynqmp\_qspi\_exec\_op (CVSS 7.8, Linux)
- [CVE-2021-47047](https://cve.now/CVE-2021-47047.md): spi: spi-zynqmp-gqspi: return -ENOMEM if dma\_map\_single fails (no CVSS, Linux)
- [CVE-2021-47046](https://cve.now/CVE-2021-47046.md): drm/amd/display: Fix off by one in hdmi\_14\_process\_transaction() (no CVSS, Linux)
- [CVE-2021-47045](https://cve.now/CVE-2021-47045.md): scsi: lpfc: Fix null pointer dereference in lpfc\_prep\_els\_iocb() (no CVSS, Linux)
- [CVE-2021-47044](https://cve.now/CVE-2021-47044.md): sched/fair: Fix shift-out-of-bounds in load\_balance() (CVSS 7.7, Linux)
- [CVE-2021-47043](https://cve.now/CVE-2021-47043.md): media: venus: core: Fix some resource leaks in the error path of 'venus\_probe()' (no CVSS, Linux)
- [CVE-2021-47042](https://cve.now/CVE-2021-47042.md): drm/amd/display: Free local data after use (no CVSS, Linux)
- [CVE-2021-47041](https://cve.now/CVE-2021-47041.md): nvmet-tcp: fix incorrect locking in state\_change sk callback (CVSS 7.5, Linux)
- [CVE-2021-47040](https://cve.now/CVE-2021-47040.md): io\_uring: fix overflows checks in provide buffers (CVSS 7.8, Linux)
- [CVE-2021-47039](https://cve.now/CVE-2021-47039.md): ataflop: potential out of bounds in do\_format() (no CVSS, Linux)
- [CVE-2021-47038](https://cve.now/CVE-2021-47038.md): Bluetooth: avoid deadlock between hci\_dev-\>lock and socket lock (no CVSS, Linux)
- [CVE-2021-47037](https://cve.now/CVE-2021-47037.md): ASoC: q6afe-clocks: fix reprobing of the driver (no CVSS, Linux)
- [CVE-2021-47036](https://cve.now/CVE-2021-47036.md): udp: skip L4 aggregation for UDP tunnel packets (CVSS 9.8, Linux)
- [CVE-2021-47035](https://cve.now/CVE-2021-47035.md): iommu/vt-d: Remove WO permissions on second-level paging entries (CVSS 8.8, Linux)
- [CVE-2021-47034](https://cve.now/CVE-2021-47034.md): powerpc/64s: Fix pte update for kernel memory on radix (CVSS 4.4, Linux)
- [CVE-2021-47033](https://cve.now/CVE-2021-47033.md): mt76: mt7615: fix tx skb dma unmap (no CVSS, Linux)
- [CVE-2021-47032](https://cve.now/CVE-2021-47032.md): mt76: mt7915: fix tx skb dma unmap (no CVSS, Linux)
- [CVE-2021-47031](https://cve.now/CVE-2021-47031.md): mt76: mt7921: fix memory leak in mt7921\_coredump\_work (CVSS 4.3, Linux)
- [CVE-2021-47030](https://cve.now/CVE-2021-47030.md): mt76: mt7615: fix memory leak in mt7615\_coredump\_work (no CVSS, Linux)
- [CVE-2021-47029](https://cve.now/CVE-2021-47029.md): mt76: connac: fix kernel warning adding monitor interface (no CVSS, Linux)
- [CVE-2021-47028](https://cve.now/CVE-2021-47028.md): mt76: mt7915: fix txrate reporting (CVSS 7.1, Linux)
- [CVE-2021-47027](https://cve.now/CVE-2021-47027.md): mt76: mt7921: fix kernel crash when the firmware fails to download (no CVSS, Linux)
- [CVE-2021-47026](https://cve.now/CVE-2021-47026.md): RDMA/rtrs-clt: destroy sysfs after removing session from active list (no CVSS, Linux)
- [CVE-2021-47025](https://cve.now/CVE-2021-47025.md): iommu/mediatek: Always enable the clk on resume (no CVSS, Linux)
- [CVE-2021-47024](https://cve.now/CVE-2021-47024.md): vsock/virtio: free queued packets when closing socket (no CVSS, Linux)
- [CVE-2021-47023](https://cve.now/CVE-2021-47023.md): net: marvell: prestera: fix port event handling on init (CVSS 8.2, Linux)
- [CVE-2021-47022](https://cve.now/CVE-2021-47022.md): mt76: mt7615: fix memleak when mt7615\_unregister\_device() (no CVSS, Linux)
- [CVE-2021-47021](https://cve.now/CVE-2021-47021.md): mt76: mt7915: fix memleak when mt7915\_unregister\_device() (no CVSS, Linux)
- [CVE-2021-47019](https://cve.now/CVE-2021-47019.md): mt76: mt7921: fix possible invalid register access (no CVSS, Linux)
- [CVE-2021-47018](https://cve.now/CVE-2021-47018.md): powerpc/64: Fix the definition of the fixmap area (no CVSS, Linux)
- [CVE-2021-47017](https://cve.now/CVE-2021-47017.md): ath10k: Fix a use after free in ath10k\_htc\_send\_bundle (CVSS 8.8, Linux)
- [CVE-2021-47015](https://cve.now/CVE-2021-47015.md): bnxt\_en: Fix RX consumer index logic in the error path. (no CVSS, Linux)
- [CVE-2021-47014](https://cve.now/CVE-2021-47014.md): net/sched: act\_ct: fix wild memory access when clearing fragments (CVSS 7.8, Linux)
- [CVE-2021-47013](https://cve.now/CVE-2021-47013.md): net:emac/emac-mac: Fix a use after free in emac\_mac\_tx\_buf\_send (CVSS 9.8, Linux)
- [CVE-2021-47012](https://cve.now/CVE-2021-47012.md): RDMA/siw: Fix a use after free in siw\_alloc\_mr (CVSS 7.8, Linux)
- [CVE-2021-47011](https://cve.now/CVE-2021-47011.md): mm: memcontrol: slab: fix obtain a reference to a freeing memcg (CVSS 7.8, Linux)
- [CVE-2021-47010](https://cve.now/CVE-2021-47010.md): net: Only allow init netns to set default tcp cong to a restricted algo (CVSS 7.8, Linux)
- [CVE-2021-47009](https://cve.now/CVE-2021-47009.md): KEYS: trusted: Fix memory leak on object td (no CVSS, Linux)
- [CVE-2021-47008](https://cve.now/CVE-2021-47008.md): KVM: SVM: Make sure GHCB is mapped before updating (no CVSS, Linux)
- [CVE-2021-47007](https://cve.now/CVE-2021-47007.md): f2fs: fix panic during f2fs\_resize\_fs() (no CVSS, Linux)
- [CVE-2021-47006](https://cve.now/CVE-2021-47006.md): ARM: 9064/1: hw\_breakpoint: Do not directly check the event's overflow\_handler hook (CVSS 5.5, Linux)
- [CVE-2021-47005](https://cve.now/CVE-2021-47005.md): PCI: endpoint: Fix NULL pointer dereference for -\>get\_features() (no CVSS, Linux)
- [CVE-2021-47004](https://cve.now/CVE-2021-47004.md): f2fs: fix to avoid touching checkpointed data in get\_victim() (CVSS 7.1, Linux)
- [CVE-2021-47003](https://cve.now/CVE-2021-47003.md): dmaengine: idxd: Fix potential null dereference on pointer status (no CVSS, Linux)
- [CVE-2021-47002](https://cve.now/CVE-2021-47002.md): SUNRPC: Fix null pointer dereference in svc\_rqst\_free() (no CVSS, Linux)
- [CVE-2021-47001](https://cve.now/CVE-2021-47001.md): xprtrdma: Fix cwnd update ordering (CVSS 7.5, Linux)
- [CVE-2021-47000](https://cve.now/CVE-2021-47000.md): ceph: fix inode leak on getattr error in \_\_fh\_to\_dentry (CVSS 3.3, Linux)
- [CVE-2021-46999](https://cve.now/CVE-2021-46999.md): sctp: do asoc update earlier in sctp\_sf\_do\_dupcook\_a (CVSS 9.8, Linux)
- [CVE-2021-46998](https://cve.now/CVE-2021-46998.md): ethernet:enic: Fix a use after free bug in enic\_hard\_start\_xmit (CVSS 7.8, Linux)
- [CVE-2021-46997](https://cve.now/CVE-2021-46997.md): arm64: entry: always set GIC\_PRIO\_PSR\_I\_SET during entry (no CVSS, Linux)
- [CVE-2021-46996](https://cve.now/CVE-2021-46996.md): netfilter: nftables: Fix a memleak from userdata error path in new objects (no CVSS, Linux)
- [CVE-2021-46995](https://cve.now/CVE-2021-46995.md): can: mcp251xfd: mcp251xfd\_probe(): fix an error pointer dereference in probe (no CVSS, Linux)
- [CVE-2021-46994](https://cve.now/CVE-2021-46994.md): can: mcp251x: fix resume from sleep before interface was brought up (no CVSS, Linux)
- [CVE-2021-46993](https://cve.now/CVE-2021-46993.md): sched: Fix out-of-bound access in uclamp (CVSS 7.8, Linux)
- [CVE-2021-46992](https://cve.now/CVE-2021-46992.md): netfilter: nftables: avoid overflows in nft\_hash\_buckets() (CVSS 7.8, Linux)
- [CVE-2021-46991](https://cve.now/CVE-2021-46991.md): i40e: Fix use-after-free in i40e\_client\_subtask() (no CVSS, Linux)
- [CVE-2021-46990](https://cve.now/CVE-2021-46990.md): powerpc/64s: Fix crashes when toggling entry flush barrier (no CVSS, Linux)
- [CVE-2021-46989](https://cve.now/CVE-2021-46989.md): hfsplus: prevent corruption in shrinking truncate (CVSS 7.1, Linux)
- [CVE-2021-46988](https://cve.now/CVE-2021-46988.md): userfaultfd: release page in error path to avoid BUG\_ON (no CVSS, Linux)
- [CVE-2021-46987](https://cve.now/CVE-2021-46987.md): btrfs: fix deadlock when cloning inline extents and using qgroups (no CVSS, Linux)
- [CVE-2021-46986](https://cve.now/CVE-2021-46986.md): usb: dwc3: gadget: Free gadget structure only after freeing endpoints (no CVSS, Linux)
- [CVE-2021-46985](https://cve.now/CVE-2021-46985.md): ACPI: scan: Fix a memory leak in an error handling path (no CVSS, Linux)
- [CVE-2021-46984](https://cve.now/CVE-2021-46984.md): kyber: fix out of bounds access when preempted (CVSS 7.8, Linux)
- [CVE-2021-46983](https://cve.now/CVE-2021-46983.md): nvmet-rdma: Fix NULL deref when SEND is completed with error (CVSS 7.5, Linux)
- [CVE-2021-46982](https://cve.now/CVE-2021-46982.md): f2fs: compress: fix race condition of overwrite vs truncate (no CVSS, Linux)
- [CVE-2021-46981](https://cve.now/CVE-2021-46981.md): nbd: Fix NULL pointer in flush\_workqueue (no CVSS, Linux)
- [CVE-2021-46980](https://cve.now/CVE-2021-46980.md): usb: typec: ucsi: Retrieve all the PDOs instead of just the first 4 (no CVSS, Linux)
- [CVE-2021-46979](https://cve.now/CVE-2021-46979.md): iio: core: fix ioctl handlers removal (no CVSS, Linux)
- [CVE-2021-46978](https://cve.now/CVE-2021-46978.md): KVM: nVMX: Always make an attempt to map eVMCS after migration (CVSS 7.8, Linux)
- [CVE-2021-46977](https://cve.now/CVE-2021-46977.md): KVM: VMX: Disable preemption when probing user return MSRs (CVSS 7.8, Linux)
- [CVE-2021-46976](https://cve.now/CVE-2021-46976.md): drm/i915: Fix crash in auto\_retire (no CVSS, Linux)
- [CVE-2020-36787](https://cve.now/CVE-2020-36787.md): media: aspeed: fix clock handling logic (CVSS 7.8, Linux)
- [CVE-2020-36786](https://cve.now/CVE-2020-36786.md): media: \[next\] staging: media: atomisp: fix memory leak of object flash (no CVSS, Linux)
- [CVE-2020-36785](https://cve.now/CVE-2020-36785.md): media: atomisp: Fix use after free in atomisp\_alloc\_css\_stat\_bufs() (CVSS 7.8, Linux)
- [CVE-2020-36784](https://cve.now/CVE-2020-36784.md): i2c: cadence: fix reference leak when pm\_runtime\_get\_sync fails (no CVSS, Linux)
- [CVE-2020-36783](https://cve.now/CVE-2020-36783.md): i2c: img-scb: fix reference leak when pm\_runtime\_get\_sync fails (no CVSS, Linux)
- [CVE-2020-36782](https://cve.now/CVE-2020-36782.md): i2c: imx-lpi2c: fix reference leak when pm\_runtime\_get\_sync fails (no CVSS, Linux)
- [CVE-2020-36781](https://cve.now/CVE-2020-36781.md): i2c: imx: fix reference leak when pm\_runtime\_get\_sync fails (no CVSS, Linux)
- [CVE-2020-36780](https://cve.now/CVE-2020-36780.md): i2c: sprd: fix reference leak when pm\_runtime\_get\_sync fails (CVSS 4.7, Linux)
- [CVE-2020-36779](https://cve.now/CVE-2020-36779.md): i2c: stm32f7: fix reference leak when pm\_runtime\_get\_sync fails (no CVSS, Linux)
- [CVE-2020-36778](https://cve.now/CVE-2020-36778.md): i2c: xiic: fix reference leak when pm\_runtime\_get\_sync fails (no CVSS, Linux)
- [CVE-2024-1943](https://cve.now/CVE-2024-1943.md): Yuki \<= 1.3.14 - Cross-Site Request Forgery to Theme Setting Reset (CVSS 4.3, wpmoose Yuki)
- [CVE-2024-1388](https://cve.now/CVE-2024-1388.md): Yuki \<= 1.3.13 - Missing Authorization to Authenticated (Subscriber+) Theme Setting Reset (CVSS 4.3, wpmoose Yuki)
- [CVE-2024-1568](https://cve.now/CVE-2024-1568.md): Seraphinite Accelerator \<= 2.20.52 - Authenticated (Subscriber+) Server-Side Request Forgery in OnAdminApi\_HtmlCheck (CVSS 6.4, seraphinitesoft Seraphinite Accelerator)
- [CVE-2024-0550](https://cve.now/CVE-2024-0550.md): Privileged User using traversal to read system files (CVSS 9.6, mintplex-labs/anything-llm)
- [CVE-2023-50737](https://cve.now/CVE-2023-50737.md): An input validation vulnerability in the SE Menu allows an attacker to execute arbitrary code. (CVSS 9.1)
- [CVE-2023-50736](https://cve.now/CVE-2023-50736.md): A vulnerability has been identified in the PostScript interpreter in various Lexmark devices. (CVSS 9.0)
- [CVE-2023-50735](https://cve.now/CVE-2023-50735.md): A vulnerability has been identified in the PostScript interpreter in various Lexmark devices. (CVSS 9.0)
- [CVE-2023-50734](https://cve.now/CVE-2023-50734.md): A vulnerability has been identified in the PostScript interpreter in various Lexmark devices. (CVSS 9.0)
- [CVE-2023-50303](https://cve.now/CVE-2023-50303.md): IBM InfoSphere Information Server cross-site scripting (CVSS 6.1, IBM InfoSphere Information Server)
- [CVE-2024-1932](https://cve.now/CVE-2024-1932.md): Unrestricted Upload of File with Dangerous Type in freescout-helpdesk/freescout (CVSS 6.1, freescout-helpdesk/freescout)
- [CVE-2024-1892](https://cve.now/CVE-2024-1892.md): ReDoS Vulnerability in scrapy/scrapy's XMLFeedSpider (CVSS 7.5, scrapy/scrapy · scrapy)
- [CVE-2023-43769](https://cve.now/CVE-2023-43769.md): An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. (CVSS 6.3)
- [CVE-2023-45859](https://cve.now/CVE-2023-45859.md): In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client (CVSS 7.6, com.hazelcast:hazelcast · com.hazelcast:hazelcast-all)
- [CVE-2023-45873](https://cve.now/CVE-2023-45873.md): An issue was discovered in Couchbase Server through 7.2.2. (CVSS 6.5)
- [CVE-2023-45874](https://cve.now/CVE-2023-45874.md): An issue was discovered in Couchbase Server through 7.2.2. (CVSS 4.3)
- [CVE-2023-49338](https://cve.now/CVE-2023-49338.md): Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8 (CVSS 7.5)
- [CVE-2023-49930](https://cve.now/CVE-2023-49930.md): An issue was discovered in Couchbase Server before 7.2.4. (CVSS 9.8)
- [CVE-2023-49931](https://cve.now/CVE-2023-49931.md): An issue was discovered in Couchbase Server before 7.2.4. (CVSS 9.8)
- [CVE-2023-49932](https://cve.now/CVE-2023-49932.md): An issue was discovered in Couchbase Server before 7.2.4. (CVSS 5.4)
- [CVE-2023-50436](https://cve.now/CVE-2023-50436.md): An issue was discovered in Couchbase Server before 7.2.4. (CVSS 5.3)
- [CVE-2023-50437](https://cve.now/CVE-2023-50437.md): An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. (CVSS 8.6)
- [CVE-2023-52047](https://cve.now/CVE-2023-52047.md): Dedecms v5.7.112 was discovered to contain a Cross-Site Request Forgery (CSRF) in the file manager. (CVSS 8.8)
- [CVE-2023-52048](https://cve.now/CVE-2023-52048.md): RuoYi v4.7.8 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /system/notice/. (CVSS 4.7)
- [CVE-2024-22532](https://cve.now/CVE-2024-22532.md): Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x86) allows attackers to cause a denial of service via crafted xwd file. (CVSS 6.5)
- [CVE-2024-22723](https://cve.now/CVE-2024-22723.md): Webtrees 2.1.18 is vulnerable to Directory Traversal. (CVSS 4.9, fisharebest/webtrees)
- [CVE-2024-22983](https://cve.now/CVE-2024-22983.md): SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the (CVSS 8.1)
- [CVE-2024-23302](https://cve.now/CVE-2024-23302.md): Couchbase Server before 7.2.4 has a private key leak in goxdcr.log. (CVSS 7.5)
- [CVE-2024-24146](https://cve.now/CVE-2024-24146.md): A memory leak issue discovered in parseSWF\_DEFINEBUTTON in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF fi (CVSS 6.5)
- [CVE-2024-24147](https://cve.now/CVE-2024-24147.md): A memory leak issue discovered in parseSWF\_FILLSTYLEARRAY in libming v0.4.8 allows attackers to cause s denial of service via a crafted SWF (CVSS 6.5)
- [CVE-2024-24148](https://cve.now/CVE-2024-24148.md): A memory leak issue discovered in parseSWF\_FREECHARACTER in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF f (CVSS 7.5)
- [CVE-2024-24149](https://cve.now/CVE-2024-24149.md): A memory leak issue discovered in parseSWF\_GLYPHENTRY in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file (CVSS 6.5)
- [CVE-2024-24150](https://cve.now/CVE-2024-24150.md): A memory leak issue discovered in parseSWF\_TEXTRECORD in libming v0.4.8 allows attackers to cause a denial of service via a crafted SWF file (CVSS 6.5)
- [CVE-2024-24155](https://cve.now/CVE-2024-24155.md): Bento4 v1.5.1-628 contains a Memory leak on AP4\_Movie::AP4\_Movie, parsing tracks and added into m\_Tracks list, but mp42aac cannot correctly (CVSS 6.5)
- [CVE-2024-25169](https://cve.now/CVE-2024-25169.md): An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request. (CVSS 9.8, mezzanine)
- [CVE-2024-25170](https://cve.now/CVE-2024-25170.md): An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header. (CVSS 9.1, mezzanine)
- [CVE-2024-25202](https://cve.now/CVE-2024-25202.md): Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attackers to run arbitrary (CVSS 6.1)
- [CVE-2024-25350](https://cve.now/CVE-2024-25350.md): SQL Injection vulnerability in /zms/admin/edit-ticket.php in PHPGurukul Zoo Management System 1.0 via tickettype and tprice parameters. (CVSS 9.8)
- [CVE-2024-25351](https://cve.now/CVE-2024-25351.md): SQL Injection vulnerability in /zms/admin/changeimage.php in PHPGurukul Zoo Management System 1.0 allows attackers to run arbitrary SQL comm (CVSS 3.8)
- [CVE-2024-25422](https://cve.now/CVE-2024-25422.md): SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMC (CVSS 9.8)
- [CVE-2024-25435](https://cve.now/CVE-2024-25435.md): A cross-site scripting (XSS) vulnerability in Md1health Md1patient v2.0.0 allows attackers to execute arbitrary web scripts or HTML via a cr (CVSS 6.1)
- [CVE-2024-25830](https://cve.now/CVE-2024-25830.md): F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction. (CVSS 9.8)
- [CVE-2024-25831](https://cve.now/CVE-2024-25831.md): F-logic DataCube3 Version 1.0 is affected by a reflected cross-site scripting (XSS) vulnerability due to improper input sanitization. (CVSS 6.1)
- [CVE-2024-25832](https://cve.now/CVE-2024-25832.md): F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dan (CVSS 8.8)
- [CVE-2024-25833](https://cve.now/CVE-2024-25833.md): F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbit (CVSS 9.8)
- [CVE-2024-25859](https://cve.now/CVE-2024-25859.md): A path traversal vulnerability in the /path/to/uploads/ directory of Blesta before v5.9.2 allows attackers to takeover user accounts and exe (CVSS 7.1)
- [CVE-2024-25866](https://cve.now/CVE-2024-25866.md): A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL comma (CVSS 8.8)
- [CVE-2024-25867](https://cve.now/CVE-2024-25867.md): A SQL Injection vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitrary SQL comma (CVSS 9.1)
- [CVE-2024-25868](https://cve.now/CVE-2024-25868.md): A Cross Site Scripting (XSS) vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitr (CVSS 6.1)
- [CVE-2024-25869](https://cve.now/CVE-2024-25869.md): An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitra (CVSS 8.8)
- [CVE-2024-26342](https://cve.now/CVE-2024-26342.md): A Null pointer dereference in usr/sbin/httpd in ASUS AC68U 3.0.0.4.384.82230 allows remote attackers to trigger DoS via network packet. (CVSS 7.5)
- [CVE-2024-26450](https://cve.now/CVE-2024-26450.md): An issue exists within Piwigo before v.14.2.0 allowing a malicious user to take over the application. (CVSS 5.4)
- [CVE-2024-26476](https://cve.now/CVE-2024-26476.md): An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq (CVSS 3.5)
- [CVE-2024-26559](https://cve.now/CVE-2024-26559.md): An issue in uverif v.2.0 allows a remote attacker to obtain sensitive information. (CVSS 5.3)
- [CVE-2024-27515](https://cve.now/CVE-2024-27515.md): Osclass 5.1.2 is vulnerable to SQL Injection. (CVSS 7.2)
- [CVE-2024-27516](https://cve.now/CVE-2024-27516.md): Server-Side Template Injection (SSTI) vulnerability in livehelperchat before 4.34v, allows remote attackers to execute arbitrary code and ob (CVSS 9.8, remdex/livehelperchat)
- [CVE-2024-27517](https://cve.now/CVE-2024-27517.md): Webasyst 2.9.9 has a Cross-Site Scripting (XSS) vulnerability, Attackers can create blogs containing malicious code after gaining blog permi (CVSS 5.4)
- [CVE-2024-27913](https://cve.now/CVE-2024-27913.md): ospf\_te\_parse\_te in ospfd/ospf\_te.c in FRRouting (FRR) through 9.1 allows remote attackers to cause a denial of service (ospfd daemon crash) (CVSS 6.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.