# CVEs published 2024-02-29

144 CVEs were published on February 29, 2024: 11 critical, 37 high. Days are UTC.

- [CVE-2024-2045](https://cve.now/CVE-2024-2045.md): Session 1.17.5 - LFR via chat attachment (CVSS 5.5, Session)
- [CVE-2024-0403](https://cve.now/CVE-2024-0403.md): Recipes 1.5.10 - Blind SSRF (CVSS 6.5, Recipes)
- [CVE-2024-2021](https://cve.now/CVE-2024-2021.md): Netentsec NS-ASG Application Security Gateway list\_localuser.php sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-27294](https://cve.now/CVE-2024-27294.md): dp-golang Go installation could be owned by wrong user (CVSS 7.3, danielparks puppet-golang)
- [CVE-2021-47068](https://cve.now/CVE-2021-47068.md): net/nfc: fix use-after-free llcp\_sock\_bind/connect (CVSS 7.8, Linux)
- [CVE-2021-47067](https://cve.now/CVE-2021-47067.md): soc/tegra: regulators: Fix locking up when voltage-spread is out of range (no CVSS, Linux)
- [CVE-2021-47066](https://cve.now/CVE-2021-47066.md): async\_xor: increase src\_offs when dropping destination page (CVSS 7.1, Linux)
- [CVE-2021-47065](https://cve.now/CVE-2021-47065.md): rtw88: Fix array overrun in rtw\_get\_tx\_power\_params() (no CVSS, Linux)
- [CVE-2021-47064](https://cve.now/CVE-2021-47064.md): mt76: fix potential DMA mapping leak (CVSS 5.3, Linux)
- [CVE-2021-47063](https://cve.now/CVE-2021-47063.md): drm: bridge/panel: Cleanup connector on bridge detach (no CVSS, Linux)
- [CVE-2021-47062](https://cve.now/CVE-2021-47062.md): KVM: SVM: Use online\_vcpus, not created\_vcpus, to iterate over vCPUs (no CVSS, Linux)
- [CVE-2021-47061](https://cve.now/CVE-2021-47061.md): KVM: Destroy I/O bus devices on unregister failure \_after\_ sync'ing SRCU (CVSS 7.8, Linux)
- [CVE-2021-47060](https://cve.now/CVE-2021-47060.md): KVM: Stop looking for coalesced MMIO zones if the bus is destroyed (CVSS 7.8, Linux)
- [CVE-2021-47059](https://cve.now/CVE-2021-47059.md): crypto: sun8i-ss - fix result memory leak on error path (no CVSS, Linux)
- [CVE-2021-47058](https://cve.now/CVE-2021-47058.md): regmap: set debugfs\_name to NULL after it is freed (no CVSS, Linux)
- [CVE-2021-47057](https://cve.now/CVE-2021-47057.md): crypto: sun8i-ss - Fix memory leak of object d when dma\_iv fails to map (CVSS 5.5, Linux)
- [CVE-2021-47056](https://cve.now/CVE-2021-47056.md): crypto: qat - ADF\_STATUS\_PF\_RUNNING should be set after adf\_dev\_init (no CVSS, Linux)
- [CVE-2021-47055](https://cve.now/CVE-2021-47055.md): mtd: require write permissions for locking and badblock ioctls (CVSS 7.1, Linux)
- [CVE-2021-47054](https://cve.now/CVE-2021-47054.md): bus: qcom: Put child node before return (no CVSS, Linux)
- [CVE-2021-47020](https://cve.now/CVE-2021-47020.md): soundwire: stream: fix memory leak in stream config error path (no CVSS, Linux)
- [CVE-2021-47016](https://cve.now/CVE-2021-47016.md): m68k: mvme147,mvme16x: Don't wipe PCC timer config bits (no CVSS, Linux)
- [CVE-2021-46959](https://cve.now/CVE-2021-46959.md): spi: Fix use-after-free with devm\_spi\_alloc\_\* (no CVSS, Linux)
- [CVE-2024-27292](https://cve.now/CVE-2024-27292.md): Docassemble unauthorized access through URL manipulation (CVSS 7.5, jhpyle docassemble · docassemble-base +1)
- [CVE-2024-27291](https://cve.now/CVE-2024-27291.md): Docassemble open redirect (CVSS 6.1, jhpyle docassemble · docassemble-webapp)
- [CVE-2024-27290](https://cve.now/CVE-2024-27290.md): Docassemble HTML and javascript injection (CVSS 6.1, jhpyle docassemble · docassemble-webapp)
- [CVE-2024-2016](https://cve.now/CVE-2024-2016.md): ZhiCms setcontroller.php index code injection (CVSS 6.3, ZhiCms)
- [CVE-2024-2015](https://cve.now/CVE-2024-2015.md): ZhiCms mcontroller.php getindexdata sql injection (CVSS 6.3, ZhiCms)
- [CVE-2024-2014](https://cve.now/CVE-2024-2014.md): Panabit Panalog sprog\_upstatus.php sql injection (CVSS 7.3, Panabit Panalog)
- [CVE-2024-26196](https://cve.now/CVE-2024-26196.md): Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability (CVSS 4.3, Microsoft Edge for Android)
- [CVE-2024-0068](https://cve.now/CVE-2024-0068.md): Improper Link Resolution Before File Access ('Link Following') vulnerability in HYPR Workforce Access on MacOS allows File Manipulation.This (CVSS 5.5, HYPR Workforce Access)
- [CVE-2024-1595](https://cve.now/CVE-2024-1595.md): Delta Electronics CNCSoft-B DOPSoft Uncontrolled Search Path Element (CVSS 7.8, Delta Electronics CNCSoft-B v1.0.0.4 DOPSoft)
- [CVE-2024-2009](https://cve.now/CVE-2024-2009.md): Nway Pro Argument index.php ajax\_login\_submit\_form information exposure (CVSS 5.3, Nway Pro)
- [CVE-2024-2007](https://cve.now/CVE-2024-2007.md): OpenBMB XAgent Privileged Mode sandbox (CVSS 5.3, OpenBMB XAgent)
- [CVE-2024-1908](https://cve.now/CVE-2024-1908.md): Improper Privilege Management vulnerability was identified in GitHub Enterprise Server that allowed Privilege Escalation (CVSS 6.3, GitHub Enterprise Server)
- [CVE-2024-27094](https://cve.now/CVE-2024-27094.md): OpenZeppelin Contracts base64 encoding may read from potentially dirty memory (CVSS 6.5, openzeppelin-contracts · @openzeppelin/contracts +1)
- [CVE-2023-6132](https://cve.now/CVE-2023-6132.md): AVEVA Edge products Uncontrolled Search Path Element (CVSS 7.3, AVEVA Edge)
- [CVE-2024-20765](https://cve.now/CVE-2024-20765.md): ZDI-CAN-22674: Adobe Acrobat Reader DC PDF File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2024-26620](https://cve.now/CVE-2024-26620.md): s390/vfio-ap: always filter entire AP matrix (CVSS 8.2, Linux)
- [CVE-2024-26619](https://cve.now/CVE-2024-26619.md): riscv: Fix module loading free order (no CVSS, Linux)
- [CVE-2024-26618](https://cve.now/CVE-2024-26618.md): arm64/sme: Always exit sme\_alloc() early with existing storage (no CVSS, Linux)
- [CVE-2024-26617](https://cve.now/CVE-2024-26617.md): fs/proc/task\_mmu: move mmu notification mechanism inside mm lock (CVSS 7.8, Linux)
- [CVE-2024-26616](https://cve.now/CVE-2024-26616.md): btrfs: scrub: avoid use-after-free when chunk length is not 64K aligned (no CVSS, Linux)
- [CVE-2024-26615](https://cve.now/CVE-2024-26615.md): net/smc: fix illegal rmb\_desc access in SMC-D connection dump (no CVSS, Linux)
- [CVE-2024-26614](https://cve.now/CVE-2024-26614.md): tcp: make sure init the accept\_queue's spinlocks once (CVSS 7.8, Linux)
- [CVE-2024-26612](https://cve.now/CVE-2024-26612.md): netfs, fscache: Prevent Oops in fscache\_put\_cache() (CVSS 5.5, Linux)
- [CVE-2024-26611](https://cve.now/CVE-2024-26611.md): xsk: fix usage of multi-buffer BPF helpers for ZC XDP (CVSS 7.5, Linux)
- [CVE-2024-26610](https://cve.now/CVE-2024-26610.md): wifi: iwlwifi: fix a memory corruption (CVSS 7.8, Linux)
- [CVE-2024-26608](https://cve.now/CVE-2024-26608.md): ksmbd: fix global oob in ksmbd\_nl\_policy (CVSS 7.8, Linux)
- [CVE-2023-52498](https://cve.now/CVE-2023-52498.md): PM: sleep: Fix possible deadlocks in core system-wide PM code (no CVSS, Linux)
- [CVE-2023-52497](https://cve.now/CVE-2023-52497.md): erofs: fix lz4 inplace decompression (CVSS 7.1, Linux)
- [CVE-2023-52495](https://cve.now/CVE-2023-52495.md): soc: qcom: pmic\_glink\_altmode: fix port sanity check (no CVSS, Linux)
- [CVE-2023-52494](https://cve.now/CVE-2023-52494.md): bus: mhi: host: Add alignment check for event ring read pointer (no CVSS, Linux)
- [CVE-2023-52493](https://cve.now/CVE-2023-52493.md): bus: mhi: host: Drop chan lock before queuing buffers (no CVSS, Linux)
- [CVE-2023-52492](https://cve.now/CVE-2023-52492.md): dmaengine: fix NULL pointer in channel unregistration function (CVSS 4.4, Linux)
- [CVE-2023-52491](https://cve.now/CVE-2023-52491.md): media: mtk-jpeg: Fix use after free bug due to error path handling in mtk\_jpeg\_dec\_device\_run (CVSS 7.8, Linux)
- [CVE-2023-52490](https://cve.now/CVE-2023-52490.md): mm: migrate: fix getting incorrect page mapping during page migration (CVSS 5.5, Linux)
- [CVE-2023-52489](https://cve.now/CVE-2023-52489.md): mm/sparsemem: fix race in accessing memory\_section-\>usage (no CVSS, Linux)
- [CVE-2023-52488](https://cve.now/CVE-2023-52488.md): serial: sc16is7xx: convert from \_raw\_ to \_noinc\_ regmap functions for FIFO (no CVSS, Linux)
- [CVE-2023-52487](https://cve.now/CVE-2023-52487.md): net/mlx5e: Fix peer flow lists handling (no CVSS, Linux)
- [CVE-2023-52486](https://cve.now/CVE-2023-52486.md): drm: Don't unref the same fb many times by mistake due to deadlock handling (CVSS 7.8, Linux)
- [CVE-2024-24818](https://cve.now/CVE-2024-24818.md): EspoCRM weakness in "Forgot password" (CVSS 5.9, espocrm)
- [CVE-2023-52485](https://cve.now/CVE-2023-52485.md): drm/amd/display: Wake DMCUB before sending a command (no CVSS, Linux)
- [CVE-2024-2001](https://cve.now/CVE-2024-2001.md): Cross-Site Scripting vulnerability in Cockpit CMS (CVSS 5.5, Cockpit CMS · cockpit-hq/cockpit)
- [CVE-2024-0864](https://cve.now/CVE-2024-0864.md): RCE in Laragon (CVSS 9.8, Leo Khoa Laragon)
- [CVE-2024-26607](https://cve.now/CVE-2024-26607.md): drm/bridge: sii902x: Fix probing race issue (no CVSS, Linux)
- [CVE-2024-27906](https://cve.now/CVE-2024-27906.md): Apache Airflow: Dag Code and Import Error Permissions Ignored (CVSS 5.9, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-1953](https://cve.now/CVE-2024-1953.md): Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, 9.3.0, and 9.4.x before 9.4.2 fail to limit the number of role names requested f (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-1952](https://cve.now/CVE-2024-1952.md): Mattermost version 8.1.x before 8.1.9 fails to sanitize data associated with permalinks when a plugin updates an ephemeral post, allowing an (CVSS 3.1, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-1949](https://cve.now/CVE-2024-1949.md): A race condition in Mattermost versions 8.1.x before 8.1.9, and 9.4.x before 9.4.2 allows an authenticated attacker to gain unauthorized acc (CVSS 2.6, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-1942](https://cve.now/CVE-2024-1942.md): Mattermost versions 8.1.x before 8.1.9, 9.2.x before 9.2.5, and 9.3.0 fail to sanitize the metadata on posts containing permalinks under spe (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-1619](https://cve.now/CVE-2024-1619.md): Kaspersky has fixed a security issue in the Kaspersky Security 8.0 for Linux Mail Server. (CVSS 6.1, Kaspersky Security for Linux Mail Server)
- [CVE-2024-1888](https://cve.now/CVE-2024-1888.md): Existing server guests invited to the team by members without "invite\_guest" permission (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-24988](https://cve.now/CVE-2024-24988.md): Excessive resource consumption when sending long emoji names in user custom status (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +3)
- [CVE-2024-1887](https://cve.now/CVE-2024-1887.md): Public channel post content accessible without membership when compliance export is enabled (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-23488](https://cve.now/CVE-2024-23488.md): Files of archived channels accessible with the “Allow users to view archived channels” option disabled (CVSS 3.1, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-23493](https://cve.now/CVE-2024-23493.md): Team associated AD/LDAP Groups Leaked due to missing authorization (CVSS 4.3, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-1981](https://cve.now/CVE-2024-1981.md): The Migration, Backup, Staging – WPvivid plugin for WordPress is vulnerable to SQL Injection via the 'table\_prefix' parameter in version 0.9 (CVSS 9.8, wpvividplugins Migration, Backup, Staging – WPvivid)
- [CVE-2024-1978](https://cve.now/CVE-2024-1978.md): Friends \<= 2.8.5 - Authenticated (Admin+) Blind Server-Side Request Forgery (CVSS 5.5, akirk Friends)
- [CVE-2024-1982](https://cve.now/CVE-2024-1982.md): WPvivid Backup and Migration \<= 0.9.68 - Missing Authorization (CVSS 6.5, wpvividplugins WPvivid — Backup, Migration & Staging)
- [CVE-2024-25594](https://cve.now/CVE-2024-25594.md): WordPress MyWaze Plugin \<= 1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Savvy Wordpress Development MyWaze)
- [CVE-2024-25098](https://cve.now/CVE-2024-25098.md): WordPress PB oEmbed HTML5 Audio Plugin \<= 2.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Pascal Bajorat PB oEmbed HTML5 Audio – with Cache Support)
- [CVE-2024-25094](https://cve.now/CVE-2024-25094.md): WordPress PJ News Ticker Plugin \<= 1.9.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Paul Jura & Nicolas Montigny PJ News Ticker)
- [CVE-2024-25093](https://cve.now/CVE-2024-25093.md): WordPress GD Rating System Plugin \<= 3.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Milan Petrovic GD Rating System)
- [CVE-2023-52484](https://cve.now/CVE-2023-52484.md): iommu/arm-smmu-v3: Fix soft lockup triggered by arm\_smmu\_mm\_invalidate\_range (no CVSS, Linux)
- [CVE-2023-52483](https://cve.now/CVE-2023-52483.md): mctp: perform route lookups under a RCU read-side lock (CVSS 7.8, Linux)
- [CVE-2023-52482](https://cve.now/CVE-2023-52482.md): x86/srso: Add SRSO mitigation for Hygon processors (no CVSS, Linux)
- [CVE-2023-52481](https://cve.now/CVE-2023-52481.md): arm64: errata: Add Cortex-A520 speculative unprivileged load workaround (CVSS 4.7, Linux)
- [CVE-2023-52480](https://cve.now/CVE-2023-52480.md): ksmbd: fix race condition between session lookup and expire (CVSS 9.8, Linux)
- [CVE-2023-52479](https://cve.now/CVE-2023-52479.md): ksmbd: fix uaf in smb20\_oplock\_break\_ack (CVSS 8.8, Linux)
- [CVE-2023-52478](https://cve.now/CVE-2023-52478.md): HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CVSS 8.8, Linux)
- [CVE-2023-52477](https://cve.now/CVE-2023-52477.md): usb: hub: Guard against accesses to uninitialized BOS descriptors (no CVSS, Linux)
- [CVE-2023-52476](https://cve.now/CVE-2023-52476.md): perf/x86/lbr: Filter vsyscall addresses (no CVSS, Linux)
- [CVE-2023-52475](https://cve.now/CVE-2023-52475.md): Input: powermate - fix use-after-free in powermate\_config\_complete (no CVSS, Linux)
- [CVE-2024-23501](https://cve.now/CVE-2024-23501.md): WordPress Ebook Store Plugin \<= 5.788 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Shopfiles Ebook Store)
- [CVE-2023-50905](https://cve.now/CVE-2023-50905.md): WordPress WP Activity Log Plugin \<= 4.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Melapress WP Activity Log)
- [CVE-2024-1976](https://cve.now/CVE-2024-1976.md): Marketing Optimizer \<= 20200925 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 4.3, activeim Marketing Optimizer)
- [CVE-2024-1977](https://cve.now/CVE-2024-1977.md): The Restaurant Solutions – Checklist plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Checklist points in version 1 (CVSS 4.4, foucciano Restaurant Solutions – Checklist)
- [CVE-2023-47874](https://cve.now/CVE-2023-47874.md): WordPress Perfmatters Plugin \<= 2.1.6 is vulnerable to Broken Access Control (CVSS 5.4, Perfmatters)
- [CVE-2023-6090](https://cve.now/CVE-2023-6090.md): WordPress Mollie Payments for WooCommerce Plugin \<= 7.3.11 is vulnerable to Arbitrary File Upload (CVSS 9.1, Mollie Payments for WooCommerce)
- [CVE-2024-21752](https://cve.now/CVE-2024-21752.md): WordPress Ajax Search Lite Plugin \<= 4.11.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Ernest Marcinko Ajax Search Lite)
- [CVE-2024-1437](https://cve.now/CVE-2024-1437.md): WordPress Adsmonetizer Plugin \<= 3.1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, José Fernandez Adsmonetizer)
- [CVE-2024-1434](https://cve.now/CVE-2024-1434.md): WordPress Media Alt Renamer Plugin 0.0.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Jordy Meow Media Alt Renamer)
- [CVE-2023-1841](https://cve.now/CVE-2023-1841.md): Honeywell MPA2 Web Application XSS vulnerability (CVSS 8.1, Honeywell MPA2 Access Panel)
- [CVE-2024-1435](https://cve.now/CVE-2024-1435.md): WordPress Tainacan plugin \<= 0.20.6 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, Tainacan)
- [CVE-2023-51531](https://cve.now/CVE-2023-51531.md): WordPress Thrive Automator Plugin \<= 1.17 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Thrive Themes Thrive Automator)
- [CVE-2023-51530](https://cve.now/CVE-2023-51530.md): WordPress GS Logo Slider Plugin \<= 3.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, GS Plugins Logo Slider – Logo Showcase, Logo Carousel, Logo…)
- [CVE-2023-51529](https://cve.now/CVE-2023-51529.md): WordPress HT Mega Plugin \<= 2.3.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, HasThemes HT Mega – Absolute Addons For Elementor)
- [CVE-2023-51528](https://cve.now/CVE-2023-51528.md): WordPress GPT3 AI Content Writer Plugin \<= 1.8.12 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Senol Sahin AI Power: Complete AI Pack – Powered by GPT-4)
- [CVE-2023-51696](https://cve.now/CVE-2023-51696.md): WordPress Spam protection, AntiSpam, FireWall by CleanTalk Plugin \<= 6.20 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, СleanTalk - Anti-Spam Protection Spam protection, Anti-Spam…)
- [CVE-2024-1341](https://cve.now/CVE-2024-1341.md): Advanced iFrame \<= 2024.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 4.9, mdempfle Advanced iFrame)
- [CVE-2024-1468](https://cve.now/CVE-2024-1468.md): Avada | Website Builder For WordPress & WooCommerce \<= 7.11.4 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, ThemeFusion Avada | Website Builder For WordPress & WooComm…)
- [CVE-2021-39090](https://cve.now/CVE-2021-39090.md): IBM Cloud Pak for Security information disclosure (CVSS 5.9, IBM Cloud Pak for Security)
- [CVE-2024-0689](https://cve.now/CVE-2024-0689.md): Custom Field Suite \<= 2.6.4 - Authenticated (Admin+) Stored Cross-Site Scripting (CVSS 4.4, mgibbs189 Custom Field Suite)
- [CVE-2023-38367](https://cve.now/CVE-2023-38367.md): IBM Cloud Pak for Automation authentication bypass (CVSS 6.5, IBM Cloud Pak for Automation)
- [CVE-2023-27545](https://cve.now/CVE-2023-27545.md): IBM Watson CloudPak for Data Data Stores information disclosure (CVSS 4.0, IBM Watson CloudPak for Data Data Stores)
- [CVE-2023-25921](https://cve.now/CVE-2023-25921.md): IBM Security Guardium Key Lifecycle Manager file upload (CVSS 8.5, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2023-25926](https://cve.now/CVE-2023-25926.md): IBM Security Guardium Key Lifecycle Manager XML external entity injection (CVSS 5.5, IBM Security Guardium Key Lifecycle Manager)
- [CVE-2024-1939](https://cve.now/CVE-2024-1939.md): Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2024-1938](https://cve.now/CVE-2024-1938.md): Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit object corruption via a crafte (CVSS 7.1, Google Chrome)
- [CVE-2023-38372](https://cve.now/CVE-2023-38372.md): IBM Watson IoT Platform information disclosure (CVSS 5.9, IBM Watson IoT Platform)
- [CVE-2023-51800](https://cve.now/CVE-2023-51800.md): Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a cra (CVSS 6.1)
- [CVE-2023-51801](https://cve.now/CVE-2023-51801.md): SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted p (CVSS 9.8)
- [CVE-2023-51802](https://cve.now/CVE-2023-51802.md): Cross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code vi (CVSS 6.1)
- [CVE-2024-22871](https://cve.now/CVE-2024-22871.md): An issue in Clojure versions 1.20 to 1.12.0-alpha5 allows an attacker to cause a denial of service (DoS) via the clojure.core$partial$fn\_\_59 (CVSS 7.5, org.clojure:clojure)
- [CVE-2024-24028](https://cve.now/CVE-2024-24028.md): Server Side Request Forgery (SSRF) vulnerability in Likeshop before 2.5.7 allows attackers to view sensitive information via the avatar para (CVSS 5.9)
- [CVE-2024-24110](https://cve.now/CVE-2024-24110.md): SQL Injection vulnerability in crmeb\_java before v1.3.4 allows attackers to run arbitrary SQL commands via crafted GET request to the compon (CVSS 6.5)
- [CVE-2024-24246](https://cve.now/CVE-2024-24246.md): Heap Buffer Overflow vulnerability in qpdf 11.9.0 allows attackers to crash the application via the std::\_\_shared\_count() function at /bits/ (CVSS 5.5)
- [CVE-2024-24520](https://cve.now/CVE-2024-24520.md): An issue in Lepton CMS v.7.0.0 allows a local attacker to execute arbitrary code via the upgrade.php file in the languages place. (CVSS 7.8)
- [CVE-2024-24525](https://cve.now/CVE-2024-24525.md): An issue in EpointWebBuilder 5.1.0-sp1, 5.2.1-sp1, 5.4.1 and 5.4.2 allows a remote attacker to execute arbitrary code via the infoid paramet (CVSS 9.8)
- [CVE-2024-25167](https://cve.now/CVE-2024-25167.md): Cross Site Scripting vulnerability in eblog v1.0 allows a remote attacker to execute arbitrary code via a crafted script to the argument des (CVSS 6.1)
- [CVE-2024-25180](https://cve.now/CVE-2024-25180.md): An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint. (CVSS 9.8)
- [CVE-2024-25239](https://cve.now/CVE-2024-25239.md): SQL Injection vulnerability in Sourcecodester Employee Management System v1.0 allows attackers to run arbitrary SQL commands via crafted POS (CVSS 9.8)
- [CVE-2024-25291](https://cve.now/CVE-2024-25291.md): Deskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin. (CVSS 9.8)
- [CVE-2024-25292](https://cve.now/CVE-2024-25292.md): Cross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa (CVSS 9.6)
- [CVE-2024-25811](https://cve.now/CVE-2024-25811.md): An access control issue in Dreamer CMS v4.0.1 allows attackers to download backup files and leak sensitive information. (CVSS 6.5)
- [CVE-2024-26548](https://cve.now/CVE-2024-26548.md): An issue in vivotek Network Camera v.FD8166A-VVTK-0204j allows a remote attacker to execute arbitrary code via a crafted payload to the uplo (CVSS 9.8)
- [CVE-2024-27655](https://cve.now/CVE-2024-27655.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the SOAPACTION parameter. (CVSS 8.8)
- [CVE-2024-27656](https://cve.now/CVE-2024-27656.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the Cookie parameter. (CVSS 8.8)
- [CVE-2024-27657](https://cve.now/CVE-2024-27657.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a buffer overflow via the User-Agent parameter. (CVSS 8.8)
- [CVE-2024-27658](https://cve.now/CVE-2024-27658.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain Null-pointer dereferences in sub\_4484A8(). (CVSS 6.5)
- [CVE-2024-27659](https://cve.now/CVE-2024-27659.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain Null-pointer dereferences in sub\_42AF30(). (CVSS 6.5)
- [CVE-2024-27660](https://cve.now/CVE-2024-27660.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a Null-pointer dereferences in sub\_41C488(). (CVSS 6.5)
- [CVE-2024-27661](https://cve.now/CVE-2024-27661.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain Null-pointer dereferences in sub\_4484A8(). (CVSS 6.5)
- [CVE-2024-27662](https://cve.now/CVE-2024-27662.md): D-Link DIR-823G A1V1.0.2B05 was discovered to contain a Null-pointer dereferences in sub\_4110f4(). (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-02-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.