CVEs published in February 2024
2,905 vulnerabilities, 342 critical, 12 exploited.
- envoyproxy envoyEnvoy ext auth can be bypassed when Proxy protocol filter sets invalid UTF-8 metadata8.6 High
- envoyproxy envoyEnvoy crashes when using an address type that isn’t supported by the OS7.5 High
- envoyproxy envoyCrash in proxy protocol when command type of LOCAL in Envoy7.5 High
- linksys wrt54gl, wrt54gl firmware +1 moreLinksys WRT54GL Web Management Interface SysInfo.htm information disclosure4.3 Medium
- miraheze managewikiCross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki6.5 Medium
- wolfsslMarvin Attack vulnerability in SP Math All RSA5.9 Medium
- hcl software sametimeHCL Sametime is impacted by a failure to invalidate sessions3.9 Low
- hcl software sametimeHCL Sametime is impacted by a sensitive information disclosure1.7 Low
- hcl software sametimeHCL Sametime is impacted by a Cross Site Request Forgery (CSRF) vulnerability5.9 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 before 9.2.5 is vulnerable to stored XSS in file tags and description attributes2.4 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature2.0 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field2.0 Low
- apache solrApache Solr: System Property redaction logic inconsistency can lead to leaked passwords7.5 High
- apache solrApache Solr: Solr Schema Designer blindly "trusts" all configsets, possibly leading to RCE by unauthenticated users7.5 High
- apache solrApache Solr: Solr can expose ZooKeeper credentials via Streaming Expressions7.5 High
- apache solrApache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets8.8 High
commonground-api-commonPyPI,vng-api-commonPyPI,vng-api-common-utrechtPyPI +2 morecommonground-api-common unexploitable privilege escalation in JWT authentication middlewareNo scoresuse-build-keyopenSUSESecurity update for suse-build-keyNo scorecontainerized-data-importeropenSUSESecurity update for cdi-apiserver-container, cdi-cloner-container, cdi-controller-container, cdi-importer-container, cdi-operator-container, cdi-uploadproxy-container, cdi-uploadserver-container, cont…No scorekubevirtopenSUSESecurity update for kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-t…No score- vercel pkgLocal Privilege Escalation in execuatables bundled by pkg6.6 Medium
- mattermost, mattermost server +1 moreDenial of service in mattermost mobile apps and server via emoji reactions4.3 Medium
- nonebot, nonebot nonebot2 +1 morePotential Information Leak in User-Constructed Message Templates in nonebot25.7 Medium
- mattermost, mattermost server +1 moreIncorrect Authorization leads to Channel Member Count Leak3.1 Low
- mattermost, mattermost server +1 moreMissing authorization allows users to access arbitrary security levels on Jira through webhooks (Jira Plugin)3.4 Low
- mattermost, mattermost server +1 moreCSRF issue allows disconnecting a user's Jira connection through a simple post message (Jira Plugin)3.5 Low
- oduyo online collectionSQLi in Oduyo Online Collection Software9.8 Critical
- simgesel hearing tracking systemIDOR in Simgesel Software's Hearing Tracking System (Barosel)8.8 High
- zabbixStored XSS in graph items select form5.5 Medium
- fortinet fortios, fortiproxy +1 moreA out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0...9.6 Critical
- davidanderson internal link juicer: seo auto linker for wordpress, internallinkjuicer internal link juicer +1 moreInternal Link Juicer <= 2.23.4 - Authenticated (Admin+) Stored Cross-Site Scripting4.4 Medium
- softaculous backuply, backuply – backup, restore, migrate and clone +1 moreBackuply - Backup, Restore, Migrate and Clone <= 1.2.6 - Denial of Service7.5 High
- themewinter eventin, arraytics eventin – event calendar, event registration, tickets & booking (ai powered) +1 moreEvent Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export5.3 Medium
- emerson rosemount gc370xa, gc1500xa firmware, gc370xa firmware +3 more +5 moreEmerson Rosemount GC370XA, GC700XA, GC1500XA Improper Authorization6.9 Medium
- emerson rosemount gc370xa, gc1500xa firmware, gc370xa firmware +3 more +5 moreEmerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection9.8 Critical
- emerson rosemount gc370xa, gc1500xa firmware, gc370xa firmware +3 more +5 moreEmerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection6.9 Medium
- emerson rosemount gc370xa, gc1500xa firmware, gc370xa firmware +3 more +5 moreEmerson Rosemount GC370XA, GC700XA, GC1500XA Improper Authentication8.3 High
- ibm sterling b2b integratorIBM Sterling B2B Integrator information disclosure4.3 Medium
- ibm sterling b2b integratorIBM Sterling B2B Integrator denial of service6.5 Medium
- ibm integration bus for z/os, integration bus +1 moreIBM Integration Bus for z/OS denial of service6.5 Medium
- ibm engineering lifecycle optimization, engineering lifecycle optimization - publishing +1 moreIBM Engineering Lifecycle Optimization information disclosure7.5 High
- ibm engineering lifecycle optimization, engineering lifecycle optimization - publishing +1 moreIBM Engineering Lifecycle Optimization HTTP header injection5.1 Medium
- phpemsPHPEMS index.api.php index deserialization6.3 Medium
- ibm engineering lifecycle optimization - publishing, engineering lifecycle optimization +1 moreIBM Engineering Lifecycle Optimization - Publishing session fixation6.3 Medium
- ibm i access client solutionsIBM i Access Client Solutions information disclosure5.1 Medium
- micronaut-projects micronaut-core, objectcomputing micronaut +1 moremicronaut-core management endpoints vulnerable to drive-by localhost attack5.1 Medium
- icinga icingaweb2-module-incubatoricingaweb2-module-incubator base implementation for HTML forms is susceptible to CSRF5.3 Medium
checkstyleOSS-FuzzSecurity exception in com.puppycrawl.tools.checkstyle.JavaAstVisitor.getInnerBopAstNo scorephpOSS-FuzzHeap-use-after-free in fuzzer_execute_exNo scorethreetenbpOSS-FuzzSecurity exception in org.threeten.bp.format.DateTimeFormatterBuilder$CompositePrinterParser.parseNo score- Show moreLoading…