CVEs published in February 2024
2,905 vulnerabilities, 342 critical, 12 exploited.
- drupal migrate tools, migrate tools project tools +1 moreMigrate Tools - Moderately critical - Cross Site Request Forgery - SA-CONTRIB-2024-0088.8 High
- graylog, graylog2 graylog2-server +1 moregraylog2-server vulnerable to instantiation of arbitrary classes triggered by API request8.8 High
- graylog, graylog2 graylog2-server +1 moregraylog2-server Session Fixation vulnerability through cookie injection5.7 Medium
- pimcore admin classic bundle, admin-ui-classic-bundle +1 morePimcore Admin Classic Bundle permissions are not getting checked when working with tags6.5 Medium
- vyperlang vyperVyper array negative index vulnerability9.8 Critical
- ckeditor, ckeditor ckeditor4 +1 moreCross-site scripting (XSS) vulnerability in samples with enabled the preview feature6.1 Medium
- forum one wp-cfmWordPress WP-CFM Plugin <= 1.7.8 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- hid global iclass se reader configuration cards, omnikey secure elements reader configuration cards, hidglobal iclass se reader configuration cards firmware +1 more +3 moreHID Global Reader Configuration Cards Improper Authorization5.3 Medium
- ibm storage virtualizeIBM Storage Virtualize improper certificate validation5.9 Medium
- cisco secure endpoint, secure endpoint private cloud administration portal, secure endpoint private cloud console +2 more +4 moreA vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote...7.5 High
- cisco expressway, telepresence video communication server (vcs) expressway +1 moreA vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video...8.2 High
- cisco expressway, telepresence video communication server (vcs) expressway, tele presence video communication serve\/vcs\/ expressway +2 moreMultiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication...9.6 Critical
- cisco expressway, telepresence video communication server (vcs) expressway, telepresence video communication server software +2 moreMultiple vulnerabilities in Cisco Expressway Series and Cisco TelePresence Video Communication...9.6 Critical
- ibm security access manager container, security verify access appliance, security verify access docker +2 moreIBM Security Access Manager Container information disclosure6.2 Medium
- ibm security access manager container, security verify access appliance, security verify access docker +2 moreIBM Security Access Manager Container information disclosure5.1 Medium
- ibm security verify access, security verify access appliance, security verify access docker +2 moreIBM Security Verify Access man in the middle8.2 High
- ibm security verify access, security verify access appliance, security verify access docker +2 moreIBM Security Verify Access man in the middle7.5 High
- ibm security verify access, security verify access appliance, security verify access docker +2 moreIBM Security Verify Access information disclosure7.5 High
- ckeditor, ckeditor ckeditor4 +1 moreCKEditor4 Cross-site scripting (XSS) vulnerability caused by incorrect CDATA detection6.1 Medium
- elated-themes frappeFrappe Authenticated Reflected Cross site scripting (XSS) in portal pages5.4 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal stored cross-site scripting (XSS) vulnerability9.6 Critical
- zope sqlalchemyda, zopefoundation products.sqlalchemyda +1 moreProducts.SQLAlchemyDA vulnerable to unauthenticated arbitrary SQL query execution9.8 Critical
- maykinmedia open forms, open-formulieren open-forms +1 moreOpen Forms potential multi-factor authentication bypass7.7 High
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal denial of service (memory consumption)6.5 Medium
- apache ozoneApache Ozone: Missing mutual TLS authentication in one of the service internal Ozone Storage Container Manager endpoints5.3 Medium
- alexander lueken podlove subscribe button, podlove subscribe button +1 morePodlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injection8.8 High
- eric teubert podlove podcast publisher, podlove podcast publisher +1 morePodlove Podcast Publisher <= 4.0.11 - Missing Authorization to Unauthenticated Data Export5.3 Medium
- eric teubert podlove podcast publisher, podlove podcast publisher +1 morePodlove Podcast Publisher <= 4.0.11 - Missing Authorization to Settings Import5.3 Medium
- apache pulsarApache Pulsar: Timing attack in SASL token signature verification7.4 High
- ays pro quiz makerQuiz Maker <= 6.5.2.4 - Missing Authorization to Unauthenticated Quiz Data Retrieval5.3 Medium
- ays pro quiz makerQuiz Maker <= 6.5.2.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Creation & Modification4.3 Medium
- coolplugins timeline widget for elementor, narinder-singh timeline widget for elementor (elementor timeline, vertical & horizontal timeline) +1 moreTimeline Widget For Elementor (Elementor Timeline, Vertical & Horizontal Timeline) <= 1.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting4.4 Medium
- davidanderson all-in-one security (aios) – security and firewall, updraftplus all-in-one security +1 moreAll-In-One Security (AIOS) – Security and Firewall <= 5.2.5 - Reflected Cross-Site Scripting6.1 Medium
- wprssaggregator wp rss aggregator, jeangalea wp rss aggregator – rss import, news feeds, feed to post, and autoblogging +1 moreThe WP RSS Aggregator plugin for WordPress is vulnerable to Server-Side Request Forgery in all...3.8 Low
- ideabox powerpack addons for elementor, ideaboxcreations powerpack addons for elementor (free widgets, extensions and templates) +1 morePowerPack Addons for Elementor (Free Widgets, Extensions and Templates) <= 2.7.14 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
firefoxUbuntufirefox regressionsNo score- squirrly starbox, cifi starbox – the author box for humans +1 moreStarbox <= 3.4.8 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Display Name and Social Settings6.4 Medium
- elastic network drive connectorElastic Network Drive Connector Improper Access Control5.3 Medium
- elastic kibanaKibana Broken Access Control issue6.5 Medium
- leanote, leanote desktop +1 moreLeanote 2.7.0 - Local File Read5.0 Medium
- suite crm crm, salesagility suitecrm +1 moreSuite CRM v7.14.2 - SSRF5.0 Medium
- firegiant wix toolset, haxtheweb issues +1 moreWiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges8.3 High
- remyandrade product management systemSourceCodester Product Management System supplier.php cross site scripting2.4 Low
- codeastro restaurant pos system, restaurant pos system project pos system +1 moreCodeAstro Restaurant POS System update_product.php unrestricted upload6.3 Medium
- codeastro restaurant pos systemCodeAstro Restaurant POS System create_account.php cross site scripting3.5 Low
- veeam recovery orchestrator, availability orchestrator +1 moreVulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a...8.8 High
- veeam recovery orchestrator, availability orchestrator, disaster recovery orchestrator +2 moreVulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role...6.5 Medium
- codeastro university management systemCodeAstro University Management System Student Registration Form st_reg.php cross site scripting2.4 Low
ghostscriptOSS-FuzzStack-buffer-overflow in line_join_pointsNo scorecrasOSS-FuzzHeap-double-free in supported_featuresNo score- Show moreLoading…