Skip to content
OpenAdvisories

Archive

19 February 2024

Vulnerabilities first published on this day (UTC), newest first.

← January 2024 2024 / February /19 March 2024 →
  1. 198
  2. 2153
  3. 331
  4. 414
  5. 5157
  6. 6156
  7. 773
  8. 888
  9. 987
  10. 1030
  11. 1121
  12. 1291
  13. 13182
  14. 14170
  15. 15103
  16. 1652
  17. 1766
  18. 1829
  19. 1940
  20. 20203
  21. 21145
  22. 22105
  23. 2379
  24. 2420
  25. 2520
  26. 2676
  27. 27167
  28. 28226
  29. 29144
All Critical High Medium Low Exploited only Public exploit

16 results · Clear filters · Feed

  • Medium 5.8
    CVE-2024-26129

    Prestashop vulnerable to path disclosure in JavaScript variable

    PrestaShop is an open-source e-commerce platform. Starting in version 8.1.0 and prior to version 8.1.4, PrestaShop is vulnerable to path disclosure in a JavaScript variable. A patch is available in version 8.1.4.

    PrestaShop PrestaShop prestashop/prestashop Web / CMS Packagist
  • Medium 4.6
    CVE-2024-25640

    Improper Neutralization of Alternate XSS Syntax in iris-web

    Iris is a web collaborative platform that helps incident responders share technical details during investigations. A stored Cross-Site Scripting (XSS) vulnerability has been identified in iris-web, affecting multiple locations in versions prior to v2.4.0. The…

    dfir-iris iris-web
  • Medium 4.3
    CVE-2024-25982

    Msa-24-0005: csrf risk in language import utility

    The link to update all installed language packs did not include the necessary token to prevent a CSRF risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2024-25981

    Msa-24-0004: forum export did not respect activity group settings

    Separate Groups mode restrictions were not honored when performing a forum export, which would export forum data for all groups. By default this only provided additional access to non-editing teachers.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 4.3
    CVE-2024-25980

    Msa-24-0003: h5p attempts report did not respect activity group settings

    Separate Groups mode restrictions were not honored in the H5P attempts report, which would display users from other groups. By default this only provided additional access to non-editing teachers.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 5.3
    CVE-2024-25979

    Msa-24-0002: forum search accepted random parameters in its url

    The URL parameters accepted by forum search were not limited to the allowed parameters.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.8
    CVE-2024-1346 Public exploit

    Weak MySQL database root password in LaborOfficeFree

    Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to calculate the root password of the MySQL database used by LaborOfficeFree using two constants.

    LaborOfficeFree LaborOfficeFree
  • Medium 6.8
    CVE-2024-1345

    Weak MySQL database root password in LaborOfficeFree

    Weak MySQL database root password in LaborOfficeFree affects version 19.10. This vulnerability allows an attacker to perform a brute force attack and easily discover the root password.

    LaborOfficeFree LaborOfficeFree
  • Medium 6.8
    CVE-2024-1344

    Encrypted database credentials in LaborOfficeFree

    Encrypted database credentials in LaborOfficeFree affecting version 19.10. This vulnerability allows an attacker to read and extract the username and password from the database of 'LOF_service.exe' and 'LaborOfficeFree.exe' located in the '%programfiles(x86)%…

    LaborOfficeFree LaborOfficeFree
  • Medium 4.7
    CVE-2024-1343

    Weak permission vulnerability in LaborOfficeFree

    A weak permission was found in the backup directory in LaborOfficeFree affecting version 19.10. This vulnerability allows any authenticated user to read backup files in the directory '%programfiles(x86)% LaborOfficeFree BackUp'.

    LaborOfficeFree LaborOfficeFree
  • Medium 5.9
    CVE-2024-1580

    Integer overflow in VideoLAN dav1d

    An integer overflow in dav1d AV1 decoder that can occur when decoding videos with large frame size. This can lead to memory corruption within the AV1 decoder. We recommend upgrading past version 1.4.0 of dav1d.

    VideoLAN dav1d dav1d dav1d Debian Ubuntu Alpine
  • Medium 5.5
    CVE-2024-26308 Public exploit

    Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

    Allocation of Resources Without Limits or Throttling vulnerability in Apache Commons Compress.This issue affects Apache Commons Compress: from 1.21 before 1.26. Users are recommended to upgrade to version 1.26, which fixes the issue.

    Apache Software Foundation Apache Commons Compress druid trino Debian Ubuntu Wolfi Maven
  • Medium 5.5
    CVE-2020-36774

    plugins/gtk+/glade-gtk-box.c in GNOME Glade before 3.38.1 and 3.39.x before 3.40.0 mishandles widget rebuilding for Gla…

    glade glade Debian Ubuntu
  • Medium 5.3
    CVE-2024-26327

    An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c mishandles the situation where…

    qemu qemu qemu Debian Ubuntu Azure Linux
  • Medium 6.0
    CVE-2024-26328

    An issue was discovered in QEMU 7.1.0 through 8.2.1. register_vfs in hw/pci/pcie_sriov.c does not set NumVFs to PCI_SRI…

    qemu qemu qemu Debian Ubuntu Azure Linux
  • Medium 6.1
    CVE-2024-26318

    Cross-site Scripting in Serenity

    Serenity before 6.8.0 allows XSS via an email link because LoginPage.tsx permits return URLs that do not begin with a / character.

    Serenity.Net.Core @serenity-is/corelib npm NuGet