Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2024

177 records · 11 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 1 of 2

  • CVE-2024-24945
    24Monitor

    A stored cross-site scripting (XSS) vulnerability in Travel Journal Using PHP and MySQL with Source Code v1.0 allows attackers to execute ar

    MediumCVSS 6.1Proof of conceptEPSS 0%

    remyandrade · travel journal using php and mysql with source codeFeb 1, 2024

  • CVE-2024-22927
    24Monitor

    Cross Site Scripting (XSS) vulnerability in the func parameter in eyoucms v.1.6.5 allows a remote attacker to run arbitrary code via crafted

    MediumCVSS 6.1Proof of conceptEPSS 1%

    eyoucms · eyoucmsFeb 1, 2024

  • CVE-2023-46344
    21Monitor

    A vulnerability in Solar-Log Base 15 Firmware 6.0.1 Build 161, and possibly other Solar-Log Base products, allows an attacker to escalate th

    MediumCVSS 5.4Proof of conceptEPSS 0%

    solar-log · 2000 pm\+ firmwareFeb 1, 2024

  • CVE-2024-22899
    36Monitor

    Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the syncNtpTime func

    HighCVSS 8.8Proof of conceptEPSS 2%

    vinchin · vinchin backup and recoveryFeb 1, 2024

  • CVE-2024-23746
    39Monitor

    Miro Desktop 0.8.18 on macOS allows local Electron code injection via a complex series of steps that might be usable in some environments (b

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    miro · miroFeb 1, 2024

  • CVE-2024-22319
    62This week

    IBM Operational Decision Manager JDNI injection

    CriticalCVSS 9.8Proof of conceptEPSS 76%

    ibm · operational decision managerFeb 1, 2024

  • CVE-2024-22320
    57Plan

    IBM Operational Decision Manager code execution

    HighCVSS 8.8Proof of conceptEPSS 73%

    ibm · operational decision managerFeb 1, 2024

  • CVE-2024-21485
    21Monitor

    Versions of the package dash-core-components before 2.13.0; versions of the package dash-core-components before 2.0.0; versions of the packa

    MediumCVSS 5.4Proof of conceptEPSS 1%

    plotly · dashFeb 2, 2024

  • CVE-2023-47564
    32Monitor

    An incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central.

    HighCVSS 8.1Proof of conceptEPSS 1%

    qnap · qsync centralFeb 2, 2024

  • CVE-2023-6387
    30Monitor

    Incorrect buffer parsing in Bluetooth LE sample code may lead to buffer overflow

    HighCVSS 7.5Proof of conceptEPSS 0%

    silabs · gecko software development kitFeb 2, 2024

  • CVE-2024-24760
    29Monitor

    Mailcow Docker Container Exposure to Local Network

    HighCVSS 7.3Proof of conceptEPSS 0%

    mailcow · mailcow\Feb 2, 2024

  • CVE-2023-49950
    21Monitor

    The Jinja templating in Logpoint SIEM 6.10.0 through 7.x before 7.3.0 does not correctly sanitize log data being displayed when using a cust

    MediumCVSS 5.4Proof of conceptEPSS 0%

    logpoint · siemFeb 3, 2024

  • CVE-2023-51504
    21Monitor

    WordPress Dan's Embedder for Google Calendar Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)

    MediumCVSS 5.4Proof of conceptEPSS 0%

    dandulaney · dan\'s embedder for google calendarFeb 5, 2024

  • CVE-2021-4436
    41Plan

    3DPrint Lite < 1.9.1.5 - Unauthenticated Arbitrary File Upload

    CriticalCVSS 9.8Proof of conceptEPSS 6%

    wp3dprinting · 3dprint liteFeb 5, 2024

  • CVE-2024-23108
    63This week

    An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to

    CriticalCVSS 9.8Proof of conceptEPSS 80%

    fortinet · fortisiemFeb 5, 2024

  • CVE-2023-47355
    30Monitor

    The com.eypcnnapps.quickreboot (aka Eyuep Can Yilmaz {ROOT] Quick Reboot) application 1.0.8 for Android has exposed broadcast receivers for

    HighCVSS 7.5Proof of conceptEPSS 0%

    eyuepcanyilmaz · root quick rebootFeb 5, 2024

  • CVE-2024-24397
    21Monitor

    Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrar

    MediumCVSS 5.4Proof of conceptEPSS 0%

    stimulsoft · dashboards.jsFeb 5, 2024

  • CVE-2024-24396
    24Monitor

    Cross Site Scripting vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrar

    MediumCVSS 6.1Proof of conceptEPSS 0%

    stimulsoft · dashboard.jsFeb 5, 2024

  • CVE-2024-22567
    40Plan

    File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do.

    HighCVSS 8.8No exploitEPSS 17%

    mingsoft · mcmsFeb 5, 2024

  • CVE-2023-6700
    35Monitor

    Cookie Information | Free GDPR Consent Solution <= 2.0.22 - Authenticated (Subscriber+) Arbitrary Options Update

    HighCVSS 8.8Proof of conceptEPSS 1%

    cookieinformation · wp-gdpr-complianceFeb 5, 2024

  • CVE-2023-6846
    40Plan

    File Manager Pro <= 8.3.4 - Authenticated (Subscriber+) Arbitrary File Upload

    HighCVSS 8.8No exploitEPSS 15%

    filemanagerpro · file managerFeb 5, 2024

  • CVE-2023-6933
    55Plan

    Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection

    HighCVSS 8.8Proof of conceptEPSS 68%

    wpengine · better search replaceFeb 5, 2024

  • CVE-2023-6985
    35Monitor

    10Web AI Assistant – AI content writing assistant <= 1.0.18 - Missing Authorization to Arbitrary Plugin Installation

    HighCVSS 8.8Proof of conceptEPSS 1%

    10web · ai assistantFeb 5, 2024

  • CVE-2023-6989
    56Plan

    Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion

    CriticalCVSS 9.8Proof of conceptEPSS 56%

    getshieldsecurity · shield securityFeb 5, 2024

  • CVE-2024-0324
    31Monitor

    User Profile Builder <= 3.10.8 - Missing Authorization to Plugin Settings Change via wppb_two_factor_authentication_settings_update

    HighCVSS 7.5Proof of conceptEPSS 2%

    cozmoslabs · profile builderFeb 5, 2024

  • CVE-2024-0509
    24Monitor

    WP 404 Auto Redirect to Similar Post <= 1.0.3 - Reflected Cross-Site Scripting via request

    MediumCVSS 6.1Proof of conceptEPSS 1%

    hwk · wp 404 auto redirect to similar postFeb 5, 2024

  • CVE-2024-1208
    23Monitor

    LearnDash LMS <= 4.10.2 - Sensitive Information Exposure via API

    MediumCVSS 5.3Proof of conceptEPSS 5%

    learndash · learndashFeb 5, 2024

  • CVE-2024-1209
    22Monitor

    LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via assignments

    MediumCVSS 5.3Proof of conceptEPSS 2%

    learndash · learndashFeb 5, 2024

  • CVE-2024-1210
    22Monitor

    LearnDash LMS <= 4.10.1 - Sensitive Information Exposure via API

    MediumCVSS 5.3Proof of conceptEPSS 2%

    learndash · learndashFeb 5, 2024

  • CVE-2024-24398
    40Plan

    Directory Traversal vulnerability in Stimulsoft GmbH Stimulsoft Dashboard.JS before v.2024.1.2 allows a remote attacker to execute arbitrary

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    stimulsoft · dashboards.phpFeb 5, 2024

  • CVE-2023-46359
    65This week

    An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attac

    CriticalCVSS 9.8Proof of conceptEPSS 87%

    hardy-barth · cph2 echarge firmwareFeb 5, 2024

  • CVE-2023-47889
    31Monitor

    The Android application BINHDRM26 com.bdrm.superreboot 1.0.3, exposes several critical actions through its exported broadcast receivers.

    HighCVSS 7.8Proof of conceptEPSS 0%

    binhdrm26 · super rebootFeb 5, 2024

  • CVE-2024-24112
    40Plan

    xmall v1.1 was discovered to contain a SQL injection vulnerability via the orderDir parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    exrick · xmallFeb 5, 2024

  • CVE-2024-22853
    40Plan

    D-LINK Go-RT-AC750 GORTAC750_A1_FW_v101b03 has a hardcoded password for the Alphanetworks account, which allows remote attackers to obtain r

    CriticalCVSS 9.8Proof of conceptEPSS 4%

    dlink · go-rt-ac750 firmwareFeb 5, 2024

  • CVE-2024-23673
    30Monitor

    Apache Sling Servlets Resolver: Malicious code execution via path traversal

    HighCVSS 7.5Proof of conceptEPSS 1%

    apache · sling servlets resolverFeb 6, 2024

  • CVE-2024-23917
    55Plan

    In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible

    CriticalCVSS 9.8Proof of conceptEPSS 54%

    jetbrains · teamcityFeb 6, 2024

  • CVE-2024-24942
    31Monitor

    In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives

    MediumCVSS 5.3No exploitEPSS 31%

    jetbrains · teamcityFeb 6, 2024

  • CVE-2024-0684
    22Monitor

    Coreutils: heap overflow in split --line-bytes with very long lines

    MediumCVSS 5.5Proof of conceptEPSS 0%

    gnu · coreutilsFeb 6, 2024

  • CVE-2024-24590
    36Monitor

    Deserialization of untrusted data can occur in versions 0.17.0 to 1.14.2 of the client SDK of Allegro AI’s ClearML platform, enabling a mali

    HighCVSS 8.8Proof of conceptEPSS 2%

    clear · clearmlFeb 6, 2024

  • CVE-2023-43482
    29Monitor

    A command execution vulnerability exists in the guest resource functionality of Tp-Link ER7206 Omada Gigabit VPN Router 1.3.0 build 20230322

    HighCVSS 7.2Proof of conceptEPSS 3%

    tp-link · er7206 firmwareFeb 6, 2024

  • CVE-2024-22241
    30Monitor

    Aria Operations for Networks contains a cross site scripting vulnerability.

    MediumCVSS 4.8No exploitEPSS 37%

    vmware · aria operations for networksFeb 6, 2024

  • CVE-2024-22514
    35Monitor

    An issue discovered in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to run arbitrary files by restoring a crafted backup file.

    HighCVSS 8.8Proof of conceptEPSS 1%

    ispyconnect · agent dvrFeb 6, 2024

  • CVE-2024-22515
    35Monitor

    Unrestricted File Upload vulnerability in iSpyConnect.com Agent DVR 5.1.6.0 allows attackers to upload arbitrary files via the upload audio

    HighCVSS 8.8Proof of conceptEPSS 1%

    ispyconnect · agent dvrFeb 6, 2024

  • CVE-2024-1283
    45Plan

    Heap buffer overflow in Skia in Google Chrome prior to 121.0.6167.160 allowed a remote attacker to potentially exploit heap corruption via a

    CriticalCVSS 9.8No exploitEPSS 21%

    google · chromeFeb 6, 2024

  • CVE-2024-1269
    24Monitor

    SourceCodester Product Management System supplier.php cross site scripting

    MediumCVSS 6.1Proof of conceptEPSS 0%

    remyandrade · product management systemFeb 6, 2024

  • CVE-2023-40355
    21Monitor

    Cross Site Scripting (XSS) vulnerability in Axigen versions 10.3.3.0 before 10.3.3.59, 10.4.0 before 10.4.19, and 10.5.0 before 10.5.5, allo

    MediumCVSS 5.4Proof of conceptEPSS 1%

    axigen · axigen mobile webmailFeb 7, 2024

  • CVE-2024-24131
    24Monitor

    SuperWebMailer v9.31.0.01799 was discovered to contain a reflected cross-site scripting (XSS) vulenrability via the component api.php.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    superwebmailer · superwebmailerFeb 7, 2024

  • CVE-2024-20290
    40Plan

    A vulnerability in the OLE2 file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a denial of service (DoS)

    HighCVSS 7.5No exploitEPSS 33%

    cisco · secure endpointFeb 7, 2024

  • CVE-2024-24816
    24Monitor

    Cross-site scripting (XSS) vulnerability in samples with enabled the preview feature

    MediumCVSS 6.1Proof of conceptEPSS 1%

    ckeditor · ckeditorFeb 7, 2024

  • CVE-2024-24824
    45Plan

    graylog2-server vulnerable to instantiation of arbitrary classes triggered by API request

    HighCVSS 8.8Proof of conceptEPSS 34%

    graylog · graylogFeb 7, 2024

  • CVE-2024-24488
    22Monitor

    An issue in Shenzen Tenda Technology CP3V2.0 V11.10.00.2311090948 allows a local attacker to obtain sensitive information via the password c

    MediumCVSS 5.5Proof of conceptEPSS 0%

    tendacn · cp3 firmwareFeb 7, 2024

  • CVE-2023-48974
    39Monitor

    Cross Site Scripting vulnerability in Axigen WebMail prior to 10.3.3.61 allows a remote attacker to escalate privileges via a crafted script

    CriticalCVSS 9.6Proof of conceptEPSS 2%

    axigen · axigen mail serverFeb 7, 2024

  • CVE-2024-24034
    24Monitor

    Setor Informatica S.I.L version 3.0 is vulnerable to Open Redirect via the hprinter parameter, allows remote attackers to execute arbitrary

    MediumCVSS 6.1Proof of conceptEPSS 0%

    setorinformatica · s.i.lFeb 8, 2024

  • CVE-2024-24871
    21Monitor

    WordPress Blocksy theme <= 2.0.19 - Cross Site Scripting (XSS) vulnerability

    MediumCVSS 5.4No exploitEPSS 0%

    creativethemes · blocksyFeb 8, 2024

  • CVE-2024-22836
    48Plan

    An OS command injection vulnerability exists in Akaunting v3.1.3 and earlier.

    CriticalCVSS 9.8Proof of conceptEPSS 30%

    akaunting · akauntingFeb 8, 2024

  • CVE-2024-24494
    32Monitor

    Cross Site Scripting vulnerability in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via the day, exercise, pr

    MediumCVSS 6.1Proof of conceptEPSS 25%

    remyandrade · daily habit trackerFeb 8, 2024

  • CVE-2024-24495
    39Monitor

    SQL Injection vulnerability in delete-tracker.php in Daily Habit Tracker v.1.0 allows a remote attacker to execute arbitrary code via crafte

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    remyandrade · daily habit trackerFeb 8, 2024

  • CVE-2024-24496
    45Plan

    An issue in Daily Habit Tracker v.1.0 allows a remote attacker to manipulate trackers via the home.php, add-tracker.php, delete-tracker.php,

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    remyandrade · daily habit trackerFeb 8, 2024

  • CVE-2024-22318
    22Monitor

    IBM i Access Client Solutions information disclosure

    MediumCVSS 5.5Proof of conceptEPSS 0%

    ibm · i access client solutionsFeb 8, 2024

  • CVE-2024-25003
    32Monitor

    KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the hostname, occurs due to insufficient bounds check

    HighCVSS 7.8Proof of conceptEPSS 1%

    9bis · kittyFeb 9, 2024

  • CVE-2024-25004
    32Monitor

    KiTTY versions 0.76.1.13 and before is vulnerable to a stack-based buffer overflow via the username, occurs due to insufficient bounds check

    HighCVSS 7.8Proof of conceptEPSS 1%

    9bis · kittyFeb 9, 2024

  • CVE-2024-23749
    32Monitor

    KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitizat

    HighCVSS 7.8Proof of conceptEPSS 4%

    9bis · kittyFeb 9, 2024

  • CVE-2024-21762
    94Now

    A out-of-bounds write in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, 6.4.0 through 6.4.14, 6.2

    CriticalCVSS 9.8KEVWeaponizedEPSS 83%

    fortinet · fortiproxyFeb 9, 2024

  • CVE-2023-50386
    60This week

    Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets

    HighCVSS 8.8WeaponizedEPSS 83%

    apache · solrFeb 9, 2024

  • CVE-2024-1247
    19Monitor

    Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field

    MediumCVSS 4.8Proof of conceptEPSS 1%

    concretecms · concrete cmsFeb 9, 2024

  • CVE-2024-21490
    31Monitor

    This affects versions of the package angular from 1.3.0; versions of the package angularjs from 1.3.0.

    HighCVSS 7.5Proof of conceptEPSS 1%

    angularjs · angular.jsFeb 10, 2024

  • CVE-2024-23724
    37Monitor

    Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG prof

    CriticalCVSS 9.0Proof of conceptEPSS 3%

    ghost · ghostFeb 10, 2024

  • CVE-2024-24926
    35Monitor

    WordPress Brooklyn Theme <= 4.9.7.6 is vulnerable to PHP Object Injection

    HighCVSS 8.8Proof of conceptEPSS 1%

    unitedthemes · brooklynFeb 12, 2024

  • CVE-2023-46615
    39Monitor

    WordPress KD Coming Soon Plugin <= 1.7 is vulnerable to PHP Object Injection

    CriticalCVSS 9.8Proof of conceptEPSS 0%

    kallidan · kd coming soonFeb 12, 2024

  • CVE-2023-6036
    40Plan

    Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    miniorange · web3 - crypto wallet login \& nft token gatingFeb 12, 2024

  • CVE-2024-0250
    24Monitor

    Analytics Insights for Google Analytics 4 < 6.3 - Open Redirect

    MediumCVSS 6.1Proof of conceptEPSS 1%

    deconf · analytics insightsFeb 12, 2024

  • CVE-2024-0566
    29Monitor

    Smart Manager < 8.28.0 - Admin+ SQL Injection

    HighCVSS 7.2Proof of conceptEPSS 3%

    storeapps · smart managerFeb 12, 2024

  • CVE-2024-23759
    60This week

    Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopf

    CriticalCVSS 9.8WeaponizedEPSS 47%

    gambio · gambioFeb 12, 2024

  • CVE-2023-49339
    26Monitor

    Ellucian Banner 9.17 allows Insecure Direct Object Reference (IDOR) via a modified bannerId to the /StudentSelfService/ssb/studentCard/retri

    MediumCVSS 6.5Proof of conceptEPSS 0%

    ellucian · bannerFeb 12, 2024

  • CVE-2023-47218
    60This week

    QTS, QuTS hero, QuTScloud

    HighCVSS 8.3WeaponizedEPSS 89%

    qnap · qtsFeb 12, 2024

  • CVE-2023-50358
    27Monitor

    QTS, QuTS hero, QuTScloud

    MediumCVSS 5.8No exploitEPSS 13%

    qnap · qtsFeb 12, 2024

  • CVE-2024-22024
    61This week

    An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and

    HighCVSS 8.3Proof of conceptEPSS 94%

    ivanti · connect secureFeb 13, 2024

  • CVE-2023-45206
    24Monitor

    An issue was discovered in Zimbra Collaboration (ZCS) 8.8.15, 9.0, and 10.0.

    MediumCVSS 6.1No exploitEPSS 0%

    zimbra · collaborationFeb 13, 2024

  • CVE-2024-21338
    79This week

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.8KEVWeaponizedEPSS 59%

    microsoft · windows 10 1809Feb 13, 2024

  • CVE-2024-21345
    41Plan

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 20%

    microsoft · windows server 2022 23h2Feb 13, 2024

  • CVE-2024-21351
    68This week

    Windows SmartScreen Security Feature Bypass Vulnerability

    HighCVSS 7.6KEVWeaponizedEPSS 27%

    microsoft · windows 10 1507Feb 13, 2024

  • CVE-2024-21357
    40Plan

    Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

    HighCVSS 8.1No exploitEPSS 26%

    microsoft · windows 10 1507Feb 13, 2024

  • CVE-2024-21371
    31Monitor

    Windows Kernel Elevation of Privilege Vulnerability

    HighCVSS 7.0No exploitEPSS 10%

    microsoft · windows 10 1507Feb 13, 2024

  • CVE-2024-21378
    38Monitor

    Microsoft Outlook Remote Code Execution Vulnerability

    HighCVSS 8.8Proof of conceptEPSS 10%

    microsoft · 365 appsFeb 13, 2024

  • CVE-2024-21410
    73This week

    Microsoft Exchange Server Elevation of Privilege Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 12%

    microsoft · exchange serverFeb 13, 2024

  • CVE-2024-21412
    92Now

    Internet Shortcut Files Security Feature Bypass Vulnerability

    HighCVSS 8.1KEVWeaponizedEPSS 99%

    microsoft · windows 10 1809Feb 13, 2024

  • CVE-2024-21413
    97Now

    Microsoft Outlook Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 94%

    microsoft · 365 appsFeb 13, 2024

  • CVE-2023-31346
    24Monitor

    Failure to initialize memory in SEV Firmware may allow a privileged attacker to access stale data from other guests.

    MediumCVSS 6.0Proof of conceptEPSS 0%

    amd · epyc 7773x firmwareFeb 13, 2024

  • CVE-2024-24142
    39Monitor

    Sourcecodester School Task Manager 1.0 allows SQL Injection via the 'subject' parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    rems · school task managerFeb 13, 2024

  • CVE-2024-25125
    30Monitor

    Absolute path traversal vulnerability in digdag server

    MediumCVSS 5.3No exploitEPSS 29%

    treasuredata · digdagFeb 13, 2024

  • CVE-2023-50387
    60This week

    Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of ser

    HighCVSS 7.5Proof of conceptEPSS 99%

    redhat · enterprise linuxFeb 14, 2024

  • CVE-2023-50868
    52Plan

    The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a den

    HighCVSS 7.5Proof of conceptEPSS 73%

    netapp · hci baseboard management controllerFeb 14, 2024

  • CVE-2024-25617
    56Plan

    Denial of Service in HTTP Header parser in squid proxy

    HighCVSS 7.5No exploitEPSS 88%

    squid-cache · squidFeb 14, 2024

  • CVE-2022-23093
    27Monitor

    Stack overflow in ping(8)

    MediumCVSS 6.5Proof of conceptEPSS 2%

    freebsd · freebsdFeb 15, 2024

  • CVE-2024-24386
    28Monitor

    An issue in VitalPBX v.3.2.4-5 allows an attacker to execute arbitrary code via a crafted payload to the /var/lib/vitalpbx/scripts folder.

    HighCVSS 7.2Proof of conceptEPSS 1%

    vitalpbx · vitalpbxFeb 15, 2024

  • CVE-2024-23113
    88Now

    A use of externally-controlled format string in Fortinet FortiOS versions 7.4.0 through 7.4.2, 7.2.0 through 7.2.6, 7.0.0 through 7.0.13, Fo

    CriticalCVSS 9.8KEVWeaponizedEPSS 61%

    fortinet · fortiproxyFeb 15, 2024

  • CVE-2024-23478
    56Plan

    SolarWinds Access Rights Manager (ARM) Deserialization of Untrusted Data Remote Code Execution

    HighCVSS 8.0No exploitEPSS 81%

    solarwinds · access rights managerFeb 15, 2024

  • CVE-2023-40109
    31Monitor

    In createFromParcel of UsbConfiguration.java, there is a possible background activity launch (BAL) due to a permissions bypass.

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidFeb 15, 2024

  • CVE-2024-0030
    22Monitor

    In btif_to_bta_response of btif_gatt_util.cc, there is a possible out of bounds read due to an incorrect bounds check.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    google · androidFeb 15, 2024

  • CVE-2024-0040
    31Monitor

    In setParameter of MtpPacket.cpp, there is a possible out of bounds read due to a heap buffer overflow.

    HighCVSS 7.5Proof of conceptEPSS 1%

    google · androidFeb 15, 2024