Skip to content
OpenAdvisories

Archive

2 February 2024

Vulnerabilities first published on this day (UTC), newest first.

← January 2024 2024 / February /2 March 2024 →
  1. 198
  2. 2153
  3. 331
  4. 414
  5. 5157
  6. 6156
  7. 773
  8. 888
  9. 987
  10. 1030
  11. 1121
  12. 1291
  13. 13182
  14. 14170
  15. 15103
  16. 1652
  17. 1766
  18. 1829
  19. 1940
  20. 20203
  21. 21145
  22. 22105
  23. 2379
  24. 2420
  25. 2520
  26. 2676
  27. 27167
  28. 28226
  29. 29144
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • Critical —
    GHSA-84x2-2qv6-qg56

    Nervos CKB P2P DoS Attacks

    The P2P protocols lack of rate limit. For example, in relay protocol, when a node receives a broadcasted `tx_hashes`, it will mark it in memory to avoid duplicated requests. [code → ](https://github.com/nervosnetwork/ckb/blob/26e4837212c392c3c706a0da7a056131f…

    ckb crates.io
  • Critical 9.0
    CVE-2023-45025

    QTS, QuTS hero, QuTScloud

    An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: Q…

    QNAP Systems QTS QuTS hero QuTScloud
  • Critical 9.1
    CVE-2022-34381

    Dell BSAFE SSL-J version 7.0 and all versions prior to 6.5, and Dell BSAFE Crypto-J versions prior to 6.2.6.1 contain a…

    Dell Dell BSAFE SSL-J Dell BSAFE Crypto-J
  • Critical 10.0
    CVE-2023-47143

    IBM Tivoli Application Dependency Discovery Manager HOST header injection

    IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 is vulnerable to HTTP header injection, caused by improper validation of input by the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable sys…

    IBM Tivoli Application Dependency Discovery Manager
  • Critical 9.8
    CVE-2023-6675

    Malicious File Upload in National Keep's CyberMath

    Unrestricted Upload of File with Dangerous Type vulnerability in National Keep Cyber Security Services CyberMath allows Upload a Web Shell to a Web Server. This issue affects CyberMath: from v.1.4 before v.1.5.

    National Keep Cyber Security Services CyberMath
  • Critical 9.8
    CVE-2024-23978

    Heap-based buffer overflow vulnerability exists in HOME SPOT CUBE2 V102 and earlier. By processing invalid values, arbi…

    KDDI HOME SPOT CUBE2
  • Critical 9.3
    CVE-2024-1143

    Central Dogma Authentication Bypass Vulnerability via Session Leakage

    Central Dogma versions prior to 0.64.1 is vulnerable to Cross-Site Scripting (XSS), which could allow for the leakage of user sessions and subsequent authentication bypass.

    LINE Central Dogma com.linecorp.centraldogma:centraldogma-server Maven
  • Critical 9.8
    CVE-2024-22320 Scanner template EPSS 73%

    IBM Operational Decision Manager code execution

    IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. By sending specially crafted request, an attacker could exploit this vulnerability to execute arb…

    IBM Operational Decision Manager
  • Critical 9.8
    CVE-2023-50488

    An issue in Blurams Lumi Security Camera (A31C) v23.0406.435.4120 allows attackers to execute arbitrary code.

  • Critical 9.8
    CVE-2023-48793

    Zoho ManageEngine ADAudit Plus through 7250 allows SQL Injection in the aggregate report feature.

  • Critical 9.8
    CVE-2023-48792

    Zoho ManageEngine ADAudit Plus through 7250 is vulnerable to SQL Injection in the report export option.

  • Critical 9.8
    CVE-2024-24029

    JFinalCMS 5.0.0 is vulnerable to SQL injection via /admin/content/data.

  • Critical 9.8
    CVE-2024-24482

    Aprktool before 2.9.3 on Windows allows ../ and /.. directory traversal.

  • Critical 9.8
    CVE-2024-23746 Public exploit

    Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in…

  • Critical 9.8
    CVE-2024-22533

    Beetl Server-Side Template Injection vulnerability

    Before Beetl v3.15.12, the rendering template has a server-side template injection (SSTI) vulnerability. When the incoming template is controllable, it will be filtered by the DefaultNativeSecurityManager blacklist. Because blacklist filtering is not strict, …

    com.ibeetl:beetl-core Maven
  • Critical 9.8
    CVE-2024-22902

    Vinchin Backup & Recovery v7.2 was discovered to be configured with default root credentials.

  • Critical 9.8
    CVE-2024-22901

    Vinchin Backup & Recovery v7.2 was discovered to use default MYSQL credentials.

  • Critical 9.8
    CVE-2024-22108

    An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method setTermsHashAction at /opt/webapp/lib/PureA…