Skip to content
OpenAdvisories

Archive

7 February 2024

Vulnerabilities first published on this day (UTC), newest first.

← January 2024 2024 / February /7 March 2024 →
  1. 198
  2. 2153
  3. 331
  4. 414
  5. 5157
  6. 6156
  7. 773
  8. 888
  9. 987
  10. 1030
  11. 1121
  12. 1291
  13. 13182
  14. 14170
  15. 15103
  16. 1652
  17. 1766
  18. 1829
  19. 1940
  20. 20203
  21. 21145
  22. 22105
  23. 2379
  24. 2420
  25. 2520
  26. 2676
  27. 27167
  28. 28226
  29. 29144
All Critical High Medium Low Exploited only Public exploit

18 results · Clear filters · Feed

  • High 7.3
    CVE-2024-24806

    Improper Domain Lookup that potentially leads to SSRF attacks in libuv

    libuv is a multi-platform support library with a focus on asynchronous I/O. The `uv_getaddrinfo` function in `src/unix/getaddrinfo.c` (and its windows counterpart `src/win/getaddrinfo.c`), truncates hostnames to 256 characters before calling `getaddrinfo`. Th…

    libuv libuv nodejs cmake Debian Ubuntu Azure Linux Alpine Wolfi
  • High 8.8
    CVE-2024-24824 Public exploit EPSS 35%

    graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

    Graylog is a free and open log management platform. Starting in version 2.0.0 and prior to versions 5.1.11 and 5.2.4, arbitrary classes can be loaded and instantiated using a HTTP PUT request to the `/api/system/cluster_config/` endpoint. Graylog's cluster co…

    Graylog2 graylog2-server org.graylog2:graylog2-server Maven
  • High 7.5
    CVE-2024-20290 EPSS 33%

    A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a den…

    Cisco Cisco Secure Endpoint Cisco Secure Endpoint Private Cloud Console Cisco Secure Endpoint Private Cloud Administration Portal Network devices Debian Ubuntu Alpine
  • High 8.2
    CVE-2024-20255

    A vulnerability in the SOAP API of Cisco Expressway Series and Cisco TelePresence Video Communication Server could allo…

    Cisco Cisco TelePresence Video Communication Server (VCS) Expressway Network devices
  • High 8.2
    CVE-2023-43017

    IBM Security Verify Access man in the middle

    IBM Security Verify Access 10.0.0.0 through 10.0.6.1 could allow a privileged user to install a configuration file that could allow remote access. IBM X-Force ID: 266155.

    IBM Security Verify Access Docker Security Verify Access Appliance
  • High 7.5
    CVE-2023-32330

    IBM Security Verify Access man in the middle

    IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure calls that could allow an attacker on the network to take control of the server. IBM X-Force ID: 254977.

    IBM Security Verify Access Docker Security Verify Access Appliance
  • High 7.5
    CVE-2023-32328

    IBM Security Verify Access information disclosure

    IBM Security Verify Access 10.0.0.0 through 10.0.6.1 uses insecure protocols in some instances that could allow an attacker on the network to take control of the server. IBM X-Force Id: 254957.

    IBM Security Verify Access Docker Security Verify Access Appliance
  • High 7.8
    CVE-2024-22012

    there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege…

    Google Android Android
  • High 7.7
    CVE-2024-24771

    Open Forms potential multi-factor authentication bypass

    Open Forms allows users create and publish smart forms. Versions prior to 2.2.9, 2.3.7, 2.4.5, and 2.5.2 contain a non-exploitable multi-factor authentication weakness. Superusers who have their credentials (username + password) compromised could potentially …

    open-formulieren open-forms
  • High 8.8
    CVE-2024-1118

    Podlove Subscribe button <= 1.3.10 - Authenticated (Contributor+) SQL Injection

    The Podlove Subscribe button plugin for WordPress is vulnerable to UNION-based SQL Injection via the 'button' attribute of the podlove-subscribe-button shortcode in all versions up to, and including, 1.3.10 due to insufficient escaping on the user supplied pa…

    chemiker Podlove Subscribe button Web / CMS
  • High 7.4
    CVE-2023-51437

    Apache Pulsar: Timing attack in SASL token signature verification

    Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge a SASL Role Token that will pass signature verification. Users are recommended to upgrade to version 2.11.3, 3.0.2, or 3.1.1 which fixes t…

    Apache Software Foundation Apache Pulsar org.apache.pulsar:pulsar-broker-auth-sasl Maven
  • High 8.3
    CVE-2024-24810

    WiX is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges

    WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX in…

    wixtoolset issues wix NuGet
  • High 8.8
    CVE-2024-22022

    Vulnerability CVE-2024-22022 allows a Veeam Recovery Orchestrator user that has been assigned a low-privileged role to …

    Veeam Recovery Orchestrator Availability Orchestrator
  • High 7.5
    CVE-2024-24304

    In the module "Mailjet" (mailjet) from Mailjet for PrestaShop before versions 3.5.1, a guest can download technical inf…

  • High 7.5
    CVE-2024-24311

    Path Traversal vulnerability in Linea Grafica "Multilingual and Multistore Sitemap Pro - SEO" (lgsitemaps) module for P…

  • High 7.3
    CVE-2024-23769

    Improper privilege control for the named pipe in Samsung Magician PC Software 8.0.0 (for Windows) allows a local attack…

  • High 7.5
    CVE-2024-25201

    Espruino 2v20 (commit fcc9ba4) was discovered to contain an Out-of-bounds Read via jsvStringIteratorPrintfCallback at s…

  • High 7.5
    CVE-2024-25200

    Espruino 2v20 (commit fcc9ba4) was discovered to contain a Stack Overflow via the jspeFactorFunctionCall at src/jsparse…