Skip to content
OpenAdvisories

Archive

27 February 2024

Vulnerabilities first published on this day (UTC), newest first.

← January 2024 2024 / February /27 March 2024 →
  1. 198
  2. 2153
  3. 331
  4. 414
  5. 5157
  6. 6156
  7. 773
  8. 888
  9. 987
  10. 1030
  11. 1121
  12. 1291
  13. 13182
  14. 14170
  15. 15103
  16. 1652
  17. 1766
  18. 1829
  19. 1940
  20. 20203
  21. 21145
  22. 22105
  23. 2379
  24. 2420
  25. 2520
  26. 2676
  27. 27167
  28. 28226
  29. 29144
All Critical High Medium Low Exploited only Public exploit

12 results · Clear filters · Feed

  • Critical 9.1
    GHSA-x5r5-2qrx-rqj8

    Transparent TLS may not be applied to Marbles with certain manifest configurations

    Transparent TLS (TTLS) is a MarbleRun feature that wraps plain TCP connections between Marbles in TLS. In the manifest, a user defines the connections that should be considered. ### Impact If a Marble is configured for TTLS, but doesn't have an environment va…

    github.com/edgelesssys/marblerun Go
  • Critical 9.8
    CVE-2024-27099

    Azure IoT Platform Device SDK Double Free Vulnerability

    The uAMQP is a C library for AMQP 1.0 communication to Azure Cloud Services. When processing an incorrect `AMQP_VALUE` failed state, may cause a double free problem. This may cause a RCE. Update submodule with commit 2ca42b6e4e098af2d17e487814a91d05f6ae4987.

    Azure azure-uamqp-c azure-uamqp-python azure-uamqp-python Debian Ubuntu Azure Linux
  • Critical 10.0
    CVE-2024-1403 Public exploit

    Authentication Bypass in OpenEdge Authentication Gateway and AdminServer

    In OpenEdge Authentication Gateway and AdminServer prior to 11.7.19, 12.2.14, 12.8.1 on all platforms supported by the OpenEdge product, an authentication bypass vulnerability has been identified.  The vulnerability is a bypass to authentication based on a fa…

    Progress Software OpenEdge
  • Critical 9.1
    CVE-2024-27905

    Apache Aurora: padding oracle can allow construction an authentication cookie

    ** UNSUPPORTED WHEN ASSIGNED ** Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Aurora. An endpoint exposing internals to unauthenticated users can be used as a "padding oracle" allowing an anonymous attacker to construct a …

    Apache Software Foundation Apache Aurora
  • Critical 9.8
    CVE-2023-51518 Public exploit

    Apache James server: Privilege escalation via JMX pre-authentication deserialisation

    Apache James prior to version 3.7.5 and 3.8.0 exposes a JMX endpoint on localhost subject to pre-authentication deserialisation of untrusted data. Given a deserialisation gadjet, this could be leveraged as part of an exploit chain that could result in privile…

    Apache Software Foundation Apache James server org.apache.james:james-server Maven
  • Critical 9.8
    CVE-2021-46911

    ch_ktls: Fix kernel panic

    In the Linux kernel, the following vulnerability has been resolved: ch_ktls: Fix kernel panic Taking page refcount is not ideal and causes kernel panic sometimes. It's better to take tx_ctx lock for the complete skb transmit, to avoid page cleanup if ACK rece…

    Linux Linux linux-raspi2 linux-hwe Linux Debian Ubuntu
  • Critical 9.8
    CVE-2024-1698 Public exploit Scanner template EPSS 77%

    NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection

    The NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor plugin for WordPress is vulnerable to SQL Injection via the 'type' parameter in all versions up to, and including, 2.8.2 due to insufficient escaping…

    wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar Web / CMS
  • Critical 9.8
    CVE-2023-41506

    An arbitrary file upload vulnerability in the Update/Edit Student's Profile Picture function of Student Enrollment In P…

  • Critical 9.8
    CVE-2024-24095

    Code-projects Simple Stock System 1.0 is vulnerable to SQL Injection.

  • Critical 9.1
    CVE-2024-25846

    In the module "Product Catalog (CSV, Excel) Import" (simpleimportproduct) <= 6.7.0 from MyPrestaModules for PrestaShop,…

  • Critical 9.8
    CVE-2024-25400

    Subrion CMS 4.2.1 is vulnerable to SQL Injection via ia.core.mysqli.php. NOTE: this is disputed by multiple third parti…

  • Critical 9.8
    CVE-2024-25843

    In the module "Import/Update Bulk Product from any Csv/Excel File Pro" (ba_importer) up to version 1.1.28 from Buy Addo…