CVEs published in February 2024
2,905 vulnerabilities, 342 critical, 12 exploited.
- rancherRancher 'Audit Log' leaks sensitive information8.4 High
- rancherRancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'8.6 High
kinto-attachmentPyPIKinto Attachment's attachments can be replaced on read-only records8.6 HighPanelSwWix4.SdkNuGetPanelSwWix4.Sdk .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges8.2 HighPanelSW.Custom.WiXNuGetPanel::Software Customized WiX .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges8.2 High- diracgrid diracTokenManager not checking permissions on cached tokens in DIRAC9.1 Critical
- composerCode execution and possible privilege escalation via compromised InstalledVersions.php or installed.php in Composer8.8 High
- realmag777 bear – bulk editor and products manager professional for woocommerce by pluginus.net, pluginus bear - woocommerce bulk editor and products manager professional +1 moreWordPress BEAR Plugin <= 1.1.4 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- audrasjb gdpr data request formWordPress GDPR Data Request Form Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- creativethemes blocksyWordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- snow software inventory agent, snowsoftware snow inventory agent +1 moreImproper validation of update packages7.8 High
- magic hills pty ltd wonder slider liteWordPress Wonder Slider Lite Plugin <= 13.9 is vulnerable to Cross Site Scripting (XSS)7.1 High
- snow software inventory agent, snowsoftware snow inventory agent +1 moreImproper validation of update packages7.8 High
- postgresqlPostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL8.0 High
- snow software inventory agent, snowsoftware snow inventory agent +1 moreImpersonate vendor signed Powershell scripts6.0 Medium
- marco almeida | webdados portugal ctt tracking for woocommerceWordPress Portugal CTT Tracking for WooCommerce plugin <= 2.1 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- linux kernel, fedora, red hat enterprise linux 6 +3 more +5 moreKernel: race condition leads to use after free during vma lock in lock_vma_under_rcu5.1 Medium
- yannick lefebvre link libraryWordPress Link Library Plugin <= 7.5.13 is vulnerable to Cross Site Scripting (XSS)7.1 High
- apollo13themes apollo13 framework extensionsWordPress Apollo13 Framework Extensions Plugin <= 1.9.2 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- mia technology mia-medSeeing admin password hash value in Mia Technology's Mia-Med7.5 High
- mia technology mia-medPassword Disclosure in Mia Technology's Mia-Med7.5 High
- mia technology mia-medSeeing the SMS Verification Code in Mia Technology's Mia-Med7.5 High
- gitlabIncorrect Authorization in GitLab6.5 Medium
- mostafas1990 wp sms – messaging & sms notification for wordpress, woocommerce, gravityforms, etc, veronalabs wp sms +1 moreWordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)7.1 High
- levantoan woocommerce vietnam checkoutWordPress Woocommerce Vietnam Checkout Plugin <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- openeuler aops-ceres, aops-zeus +1 moreCommand Injection in aops-ceres7.3 High
- fedoraproject fedora, red hat directory server 11.5 e4s for rhel 8, directory server 11.7 for rhel 8 +22 more +24 more389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)5.5 Medium
- acowebs product labels for woocommerce (sale badges), product labels for woocommerce \(sale badges\) +1 moreWordPress Product Labels For Woocommerce Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- mia technology mia-medIDOR in Mia Technology's Mia-Med8.8 High
- dell appsync, emc appsync +1 moreDell EMC AppSync, versions from 4.2.0.0 to 4.6.0.0 including all Service Pack releases, contain...6.2 Medium
- apache brpcApache bRPC: HTTP request smuggling vulnerability7.5 High
- plugins and snippets simple page access restrictionSimple Page Access Restriction <= 1.0.21 - Improper Access Control to Sensitive Information Exposure via REST API5.3 Medium
- wpbookingcalendar booking calendarBooking Calendar <= 9.9 - Unauthenticated SQL Injection9.8 Critical
libnss3TuxCare,libnss3-devTuxCare,libnss3-toolsTuxCare +2 moreUpdate of alt-phpNo scorelibnss3TuxCare,libnss3-1dTuxCare,libnss3-devTuxCare +2 more +4 moreUpdate of alt-phpNo score- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.3.87 - Cross-Site Request Forgery via wpr_update_form_action_meta4.3 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal vulnerable to user impersonation5.4 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal allows attackers to discover the existence of sites5.3 Medium
- kendysond payment forms for paystackPayment Forms for Paystack <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal denial-of-service vulnerability4.1 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal's account lockout does not invalidate existing user sessions5.4 Medium
- sonicwall sonicosAn improper authentication vulnerability has been identified in SonicWall SonicOS SSL-VPN feature...9.8 Critical
javaparserOSS-FuzzSecurity exception in com.github.javaparser.ast.validator.TreeVisitorValidator.acceptNo scorelibxml2OSS-FuzzHeap-use-after-free in xmlValidatePopElementNo scorelibxml2OSS-FuzzHeap-use-after-free in xmlRemoveIDNo score- zihanggao php-jwtphp-jwt 1.0.0 uses strcmp (which is not constant time) to verify authentication, which makes it...9.8 Critical
- glitchedpolygons l8w8jwtl8w8jwt 2.2.1 uses memcmp (which is not constant time) to verify authentication, which makes it...9.8 Critical
- libjwt, bencollins jwt c library, debian linux +2 morelibjwt 1.15.3 uses strcmp (which is not constant time) to verify authentication, which makes it...9.8 Critical
- remyandrade daily habit trackerAn issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the...9.8 Critical
- remyandrade daily habit trackerSQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote...9.8 Critical
- Show moreLoading…