CVEs published in February 2024
2,905 vulnerabilities, 342 critical, 12 exploited.
- zkteco zkbio wdmsAn issue in zkteco zkbio WDMS v.8.0.5 allows an attacker to execute arbitrary code via the /files...9.8 Critical
- ellite wallosWallos 0.9 is vulnerable to Cross Site Scripting (XSS) in all text-based input fields without...4.7 Medium
- gradio-app gradio-app/gradio, gradio project gradio +1 moreTiming Attack Vulnerability in gradio-app/gradio5.9 Medium
- humansignal label-studio, label studio +1 moreLabel Studio vulnerable to Cross-site Scripting if `<Choices>` or `<Labels>` are used in labeling config4.7 Medium
pypqcPyPIpypqc private key retrieval vulnerability8.2 Highgithub.com/treeverse/lakefsGoUser with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository5.3 Medium- temmokumvcTemmokuMVC Image Download images_get_down.php img_replace deserialization5.6 Medium
- bdtask bhojon, bhojon best restaurant management software +1 moreBdtask Bhojon Best Restaurant Management Software Message Page message cross site scripting2.4 Low
- van der schaar lab autoprognosisvan_der_Schaar LAB AutoPrognosis Release Note load_model_from_file deserialization5.0 Medium
- felixschwarz mjml-pythonPotentially untrusted input is rendered as HTML in final output8.2 High
- basercmsbaserCMS Cross-site Scripting vulnerability in Content Management5.4 Medium
- enalean tuleapTuleap's mass update clears the permissions on artifact field5.4 Medium
- github codeql cli, codeql-cli-binaries +1 moreLimited data exfiltration in CodeQL CLI2.7 Low
- discourse calendar, discourse-calendar +1 moreUser can see invitees in events created in PMs and private categories4.3 Medium
- linux, linux kernel +1 moreksmbd: fix UAF issue in ksmbd_tcp_new_connection()9.8 Critical
- linux, linux kernel +1 morebpf: Fix re-attachment branch in bpf_tracing_prog_attach5.5 Medium
- linux, linux kernel +1 morebpf: Fix accesses to uninit stack slots7.8 High
- linux, linux kernel +1 morepowerpc/pseries/memhp: Fix access beyond end of drmem array7.8 High
- linux, linux kernel +1 moreperf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology()5.5 Medium
- linux, linux kernel +1 moremtd: Fix gluebi NULL pointer dereference caused by ftl notifier5.5 Medium
- linux, linux kernel +1 moregfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump5.5 Medium
- linux, linux kernel, siemens simatic s7-1500 tm mfp - gnu/linux subsystem +2 morebpf: Defer the free of inner map when necessary7.8 High
- linux, linux kernel +1 morebpf: Fix a race condition between btf_put() and map_free()7.8 High
- linux, linux kernel +1 moremedia: pvrusb2: fix use after free on context disconnection7.8 High
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moref2fs: fix to avoid dirent corruption7.8 High
- linux, linux kernel +1 moreerofs: fix inconsistent per-file compression format5.5 Medium
- linux, linux kernel +1 morebpf: Reject variable offset alu on PTR_TO_FLOW_KEYS7.8 High
- linux, linux kernel +1 moreLoongArch: BPF: Prevent out-of-bounds memory access7.8 High
- linux, linux kernel +1 morenet: netdevsim: don't try to destroy PHC on VFs5.5 Medium
- linux, linux kernel +1 moremlxsw: spectrum_acl_tcam: Fix stack corruption7.8 High
- linux, linux kernel +1 moreapparmor: avoid crash when parsed profile name is empty5.5 Medium
- apache hertzbeatHertzBeat SnakeYAML Deser RCE9.8 Critical
- apache hertzbeatHertzBeat AviatorScript Inject RCE9.8 Critical
- apache hertzbeatHertzbeat JMX JNDI RCE9.8 Critical
- mozilla firefox, firefox for ios +1 moreUpon scanning a JavaScript URI with the QR code scanner, an attacker could have executed...4.7 Medium
- mozilla firefox, firefox for ios +1 moreUsing an AMP url with a canonical element, an attacker could have executed JavaScript from an...7.1 High
- mozilla firefox, firefox for ios +1 moreAn attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI...7.8 High
- mozilla focus for ios, firefox focus +1 moreUtilizing a 302 redirect, an attacker could have conducted a Universal Cross-Site Scripting (UXSS...6.1 Medium
- mozilla focus for ios, firefox focus +1 moreAn attacker could have executed unauthorized scripts on top origin sites using a JavaScript URI...8.1 High
- basercmsbaserCMS OS command injection vulnerability in Installer5.6 Medium
- basercmsbaserCMS Cross-site Scripting vulnerability in Site search Feature6.1 Medium
- ibm aix, vios +1 moreIBM AIX command execution8.4 High
- areal topkapi webserv2Temporary denial of service during a brute force attack7.5 High
typo3/cmsPackagistPath Traversal in TYPO3 CoreNo score- b&r industrial automation automation studio, technology guarding +1 moreB&R products use insufficient communication encryption8.3 High
- apache answerApache Answer: Pixel Flood Attack by uploading the large pixel file9.1 Critical
- apache answerApache Answer: XSS vulnerability when submitting summary5.4 Medium
- fortinet fortios, fortiproxy +1 moreA null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11,...7.3 High
- fortinet fortios, fortiproxy +1 moreA null pointer dereference in Fortinet FortiOS version 7.2.0 through 7.2.4, 7.0.0 through 7.0.11,...6.4 Medium
- fortinet fortios, fortipam, fortiproxy +2 moreA use of externally-controlled format string in Fortinet FortiOS 7.2.0 through 7.2.4, 7.0.0...8.3 High
- Show moreLoading…