CVEs published in February 2024
2,905 vulnerabilities, 342 critical, 12 exploited.
- thedaylightstudio fuel cmsA reflected Cross-Site Scripting (XSS) vulnerability in FUEL CMS 1.5.2allows attackers to run...6.1 Medium
- carmelo agro-school management system, code-projects agro-school-management-system +1 morecode-projects Agro-School Management System 1.0 is suffers from Incorrect Access Control.8.8 High
- flusity cms, flusity +1 moreFlusity-CMS v2.33 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component...8.8 High
- wayos ibr-7150, ibr-7150 firmware +1 moreWayOS IBR-7150 <17.06.23 is vulnerable to Cross Site Scripting (XSS).4.7 Medium
- intel inet wireless daemonThe Access Point functionality in eapol_auth_key_handle in eapol.c in iNet wireless daemon (IWD)...7.5 High
- appwriteAppwrite Directory Traversal vulnerability7.5 High
- autodesk autocad, advance steel, autocad architecture +9 more +11 moreMultiple Vulnerabilities in the Autodesk AutoCAD Desktop Software7.8 High
- gitlabIncorrect Privilege Assignment in GitLab6.7 Medium
- gitlabImproper Enforcement of Behavioral Workflow in GitLab7.7 High
- gitlabImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab8.7 High
- gitlabAuthentication Bypass Using an Alternate Path or Channel in GitLab5.3 Medium
- gitlabDirect Request ('Forced Browsing') in GitLab4.3 Medium
- autodesk autocad, advance steel, autocad architecture +9 more +11 moreMultiple Vulnerabilities in the Autodesk AutoCAD Desktop Software7.8 High
- gitlabIncorrect Authorization in GitLab3.7 Low
- pinterest querybookQuerybook's Stored Cross-Site Scripting vulnerability allows Privilege Elevation6.1 Medium
- helmHelm's Missing YAML Content Leads To Panic7.5 High
- gofiber fiberFiber has Insecure CORS Configuration, Allowing Wildcard Origin with Credentials9.4 Critical
- discourse ai, discourse-ai +1 morediscourse-ai admin-initiated SSRF when interacting with AI services4.1 Medium
- silabs.com pc controller, silabs z-wave pc-based controller +1 moreSilicon Labs PC Controller v5.54.0 and Earlier Denial of Service Vulnerability6.5 Medium
- silabs.com pc controller, silabs z-wave pc-based controller +1 moreSilicon Labs PC Controller Denial of Service Vulnerability6.5 Medium
- garo wallbox glb+ t2ev7, wallbox glb\+ t2ev7 firmware +1 moreGARO WALLBOX GLB+ T2EV7 Software Update index.jsp#settings cross site scripting4.3 Medium
- silabs gecko software development kit, silabs.com gsdk +1 moreUninitialized TRNG used for ECDSA after EM2/EM3 sleep for VSE devices6.8 Medium
- zkteco zkbio access ivsZKTeco ZKBio Access IVS Department Name Search Bar cross site scripting5.1 Medium
- kemptechnologies loadmaster, progress kemp loadmaster +1 moreLoadMaster Pre-Authenticated OS Command Injection10.0 Critical
- shopwindShopwind Installation DefaultController.php actionCreate code injection5.6 Medium
- crmebZhongBangKeJi CRMEB crud delete path traversal5.5 Medium
- discourse calendar, discourse-calendar +1 moreUninvited user is able to join and mark the attendance of the the private event6.5 Medium
- crmebZhongBangKeJi CRMEB openfile absolute path traversal3.5 Low
- drupal node access rebuild progressive, node access rebuild progressive project access rebuild progressive +1 moreNode Access Rebuild Progressive - Less critical - Access bypass - SA-CONTRIB-2024-0105.3 Medium
- sailpoint identityiqAccess Request for Entitlement Values with Leading/Trailing Whitespace7.1 High
- xwiki application licensing, xwikisas application-licensing +1 moreLicense information is public, exposing instance id and license holder details5.3 Medium
- eventstore, kurrent eventstoredb +1 moreEventStoreDB Projections Subsystem has potential password leak5.5 Medium
- keerti1924 php-mysql-user-login-system, php mysql user signup login system +1 morekeerti1924 PHP-MYSQL-User-Login-System edit.php sql injection6.3 Medium
- cryptography.io cryptographycryptography NULL pointer deference with pkcs12.serialize_key_and_certificates when called with a non-matching certificate and private key and an hmac_hash override7.5 High
- dompdf php-svg-libphp-svg-lib lacks path validation on font through SVG inline styles6.8 Medium
- materialsproject pymatgenpymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string9.4 Critical
- cisco unified intelligence centerA vulnerability in the Live Data server of Cisco Unified Intelligence Center could allow an...5.1 Medium
- discourse, discourse discourse-microsoft-auth, microsoft authentication +2 morePotential account take over due to unverified emails from Microsoft Identity Platform9.1 Critical
- connectwise screenconnectAuthentication bypass using an alternate path or channel10.0 Critical
- progress ws ftp serverWS_FTP Server Reflected Cross-Site Scripting in Administrative Interface7.5 High
- keerti1924 php-mysql-user-login-system, php mysql user signup login system +1 morekeerti1924 PHP-MYSQL-User-Login-System edit.php access control5.3 Medium
- keerti1924 php-mysql-user-login-system, php mysql user signup login system +1 morekeerti1924 PHP-MYSQL-User-Login-System signup.php cross site scripting4.3 Medium
- connectwise screenconnectImproper limitation of a pathname to a restricted directory (“path traversal”)8.4 High
- linux, linux kernel +1 moretls: fix race between tx work scheduling and socket close9.8 Critical
- linux, linux kernel +1 morenet: tls: handle backlogging of crypto requests9.8 Critical
- linux, linux kernel +1 moretls: fix race between async notify and socket close9.8 Critical
- linux, linux kernel +1 morenet: tls: fix use-after-free with partial reads and async decrypt9.8 Critical
- ibm infosphere information serverIBM InfoSphere Information Server information disclosure2.4 Low
- ibm infosphere information serverIBM InfoSphere Information Server cross-site scripting5.4 Medium
- liferay dxp, portal, digital experience platform +2 moreLiferay Portal Document and Media widget and Liferay DXP vulnerable to stored Cross-site Scripting9.0 Critical
- Show moreLoading…