Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: February 2024

177 records · 11 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

Page 2 of 2

  • CVE-2024-25415
    36Monitor

    A remote code execution (RCE) vulnerability in /admin/define_language.php of CE Phoenix v1.0.8.20 allows attackers to execute arbitrary PHP

    HighCVSS 7.2No exploitEPSS 27%

    phoenixcart · ce phoenix cartFeb 15, 2024

  • CVE-2024-25466
    31Monitor

    Directory Traversal vulnerability in React Native Document Picker before v.9.1.1 and fixed in v.9.1.1 allows a local attacker to execute arb

    HighCVSS 7.8Proof of conceptEPSS 0%

    react-native-documents · document pickerFeb 16, 2024

  • CVE-2024-0015
    31Monitor

    In convertToComponentName of DreamService.java, there is a possible way to launch arbitrary protected activities due to intent redirection.

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidFeb 16, 2024

  • CVE-2024-0023
    31Monitor

    In ConvertRGBToPlanarYUV of Codec2BufferUtils.cpp, there is a possible out of bounds write due to an incorrect bounds check.

    HighCVSS 7.8Proof of conceptEPSS 0%

    google · androidFeb 16, 2024

  • CVE-2024-20931
    48Plan

    Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

    HighCVSS 7.5Proof of conceptEPSS 59%

    oracle · weblogic serverFeb 16, 2024

  • CVE-2024-20953
    66This week

    Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export).

    HighCVSS 8.8KEVWeaponizedEPSS 3%

    oracle · agile product lifecycle managementFeb 16, 2024

  • CVE-2024-1512
    62This week

    MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 77%

    stylemixthemes · masterstudy lmsFeb 17, 2024

  • CVE-2024-26308
    22Monitor

    Apache Commons Compress: OutOfMemoryError unpacking broken Pack200 file

    MediumCVSS 5.5Proof of conceptEPSS 0%

    apache · commons compressFeb 19, 2024

  • CVE-2024-1346
    22Monitor

    Weak MySQL database root password in LaborOfficeFree

    MediumCVSS 5.5Proof of conceptEPSS 0%

    laborofficefree · laborofficefreeFeb 19, 2024

  • CVE-2023-50257
    32Monitor

    Disconnect Vulnerability in RTPS Packets Used by SROS2

    HighCVSS 8.1Proof of conceptEPSS 0%

    eprosima · fast ddsFeb 19, 2024

  • CVE-2024-1651
    49Plan

    Torrentpier 2.4.1 - RCE

    CriticalCVSS 9.8Proof of conceptEPSS 34%

    torrentpier · torrentpierFeb 19, 2024

  • CVE-2023-49109
    40Plan

    Remote Code Execution in Apache Dolphinscheduler

    CriticalCVSS 9.8Proof of conceptEPSS 2%

    apache · dolphinschedulerFeb 20, 2024

  • CVE-2023-51770
    30Monitor

    Apache DolphinScheduler: Arbitrary File Read Vulnerability

    HighCVSS 7.5Proof of conceptEPSS 1%

    apache · dolphinschedulerFeb 20, 2024

  • CVE-2024-25608
    24Monitor

    HtmlUtil.escapeRedirect in Liferay Portal 7.2.0 through 7.4.3.18, and older unsupported versions, and Liferay DXP 7.4 before update 19, 7.3

    MediumCVSS 6.1Proof of conceptEPSS 0%

    liferay · digital experience platformFeb 20, 2024

  • CVE-2024-26581
    32Monitor

    netfilter: nft_set_rbtree: skip end interval element from gc

    HighCVSS 7.8Proof of conceptEPSS 2%

    linux · linux kernelFeb 20, 2024

  • CVE-2023-42791
    36Monitor

    A relative path traversal in Fortinet FortiManager version 7.4.0 and 7.2.0 through 7.2.3 and 7.0.0 through 7.0.8 and 6.4.0 through 6.4.12 an

    HighCVSS 8.8Proof of conceptEPSS 3%

    fortinet · fortimanagerFeb 20, 2024

  • CVE-2024-22369
    31Monitor

    Apache Camel: Camel-SQL: Unsafe Deserialization from JDBCAggregationRepository

    HighCVSS 7.8Proof of conceptEPSS 0%

    apache · camelFeb 20, 2024

  • CVE-2024-24763
    24Monitor

    JumpServer Open Redirect Vulnerability

    MediumCVSS 6.1Proof of conceptEPSS 1%

    fit2cloud · jumpserverFeb 20, 2024

  • CVE-2024-1675
    38Monitor

    Insufficient policy enforcement in Download in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass filesystem restricti

    HighCVSS 8.8No exploitEPSS 10%

    google · chromeFeb 21, 2024

  • CVE-2024-1676
    27Monitor

    Inappropriate implementation in Navigation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to spoof security UI via a craf

    MediumCVSS 5.4No exploitEPSS 18%

    google · chromeFeb 21, 2024

  • CVE-2023-42860
    22Monitor

    A permissions issue was addressed with additional restrictions.

    MediumCVSS 5.5Proof of conceptEPSS 0%

    apple · macosFeb 21, 2024

  • CVE-2024-0593
    21Monitor

    Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure

    MediumCVSS 5.3Proof of conceptEPSS 0%

    presstigers · simple job boardFeb 21, 2024

  • CVE-2023-52440
    38Monitor

    ksmbd: fix slub overflow in ksmbd_decode_ntlmssp_auth_blob()

    HighCVSS 7.8Proof of conceptEPSS 22%

    linux · linux kernelFeb 21, 2024

  • CVE-2023-52442
    31Monitor

    ksmbd: validate session id and tree id in compound request

    MediumCVSS 5.5No exploitEPSS 29%

    linux · linux kernelFeb 21, 2024

  • CVE-2024-1708
    92Now

    Improper limitation of a pathname to a restricted directory (“path traversal”)

    HighCVSS 8.4KEVWeaponizedEPSS 95%

    connectwise · screenconnectFeb 21, 2024

  • CVE-2024-1709
    100Now

    Authentication bypass using an alternate path or channel

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    connectwise · screenconnectFeb 21, 2024

  • CVE-2024-23346
    32Monitor

    pymatgen arbitrary code execution when parsing a maliciously crafted JonesFaithfulTransformation transformation_string

    HighCVSS 7.8Proof of conceptEPSS 3%

    materialsvirtuallab · pymatgenFeb 21, 2024

  • CVE-2024-1212
    98Now

    LoadMaster Pre-Authenticated OS Command Injection

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    progress · loadmasterFeb 21, 2024

  • CVE-2024-25897
    39Monitor

    ChurchCRM 5.5.0 FRCatalog.php is vulnerable to Blind SQL Injection (Time-based) via the CurrentFundraiser GET parameter.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    churchcrm · churchcrmFeb 21, 2024

  • CVE-2024-25381
    24Monitor

    There is a Stored XSS Vulnerability in Emlog Pro 2.2.8 Article Publishing, due to non-filtering of quoted content.

    MediumCVSS 6.1Proof of conceptEPSS 0%

    emlog · emlogFeb 21, 2024

  • CVE-2024-1451
    49Plan

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab

    HighCVSS 8.7No exploitEPSS 51%

    gitlab · gitlabFeb 21, 2024

  • CVE-2024-25423
    28Monitor

    An issue in MAXON CINEMA 4D R2024.2.0 allows a local attacker to execute arbitrary code via a crafted c4d_base.xdl64 file.

    HighCVSS 7.0Proof of conceptEPSS 0%

    nemetschek · cinema 4dFeb 21, 2024

  • CVE-2024-22393
    37Monitor

    Apache Answer: Pixel Flood Attack by uploading the large pixel file

    CriticalCVSS 9.1Proof of conceptEPSS 2%

    apache · answerFeb 22, 2024

  • CVE-2024-25850
    45Plan

    Netis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameter

    CriticalCVSS 9.8No exploitEPSS 19%

    netis-systems · wf2780 firmwareFeb 22, 2024

  • CVE-2023-52160
    26Monitor

    The implementation of PEAP in wpa_supplicant through 2.10 allows authentication bypass.

    MediumCVSS 6.5Proof of conceptEPSS 1%

    debian · debian linuxFeb 22, 2024

  • CVE-2024-1781
    43Plan

    Totolink X6000R AX3000 shttpd cstecgi.cgi setWizardCfg command injection

    CriticalCVSS 9.8Proof of conceptEPSS 14%

    totolink · x6000r firmwareFeb 22, 2024

  • CVE-2024-22243
    33Monitor

    CVE-2024-22243: Spring Framework URL Parsing with Host Validation

    HighCVSS 8.1Proof of conceptEPSS 3%

    spring · spring frameworkFeb 23, 2024

  • CVE-2024-26594
    43Plan

    ksmbd: validate mech token in session setup

    HighCVSS 7.1No exploitEPSS 51%

    linux · linux kernelFeb 23, 2024

  • CVE-2024-22371
    30Monitor

    Apache Camel issue on ExchangeCreatedEvent

    HighCVSS 7.5Proof of conceptEPSS 0%

    apache · camelFeb 26, 2024

  • CVE-2024-25081
    16Monitor

    Splinefont in FontForge through 20230101 allows command injection via crafted filenames.

    MediumCVSS 4.2Proof of conceptEPSS 1%

    fontforge · fontforgeFeb 26, 2024

  • CVE-2024-25082
    27Monitor

    Splinefont in FontForge through 20230101 allows command injection via crafted archives or compressed files.

    MediumCVSS 6.5Proof of conceptEPSS 1%

    fontforge · fontforgeFeb 26, 2024

  • CVE-2024-24401
    53Plan

    SQL Injection vulnerability in Nagios XI 2024R1.01 allows a remote attacker to execute arbitrary code via a crafted payload to the monitorin

    CriticalCVSS 9.8Proof of conceptEPSS 45%

    nagios · nagios xiFeb 26, 2024

  • CVE-2024-24402
    40Plan

    An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd compo

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    nagios · nagios xiFeb 26, 2024

  • CVE-2024-27088
    22Monitor

    es5-ext Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`

    MediumCVSS 5.5Proof of conceptEPSS 0%

    medikoo · es5-extFeb 26, 2024

  • CVE-2019-25162
    31Monitor

    i2c: Fix a potential use after free

    HighCVSS 7.8Proof of conceptEPSS 0%

    linux · linux kernelFeb 26, 2024

  • CVE-2024-27356
    37Monitor

    An issue was discovered on certain GL-iNet devices.

    HighCVSS 7.5Proof of conceptEPSS 23%

    gl-inet · mt6000 firmwareFeb 26, 2024

  • CVE-2024-1698
    62This week

    NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection

    CriticalCVSS 9.8Proof of conceptEPSS 77%

    wpdeveloper · notificationxFeb 27, 2024

  • CVE-2023-51518
    39Monitor

    Apache James server: Privilege escalation via JMX pre-authentication deserialisation

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    apache · jamesFeb 27, 2024

  • CVE-2023-7165
    31Monitor

    JetBackup < 2.0.9.9 - Directory Listing Exposing Backups

    HighCVSS 7.5Proof of conceptEPSS 1%

    jetbackup · jetbackupFeb 27, 2024

  • CVE-2023-7016
    31Monitor

    Privilege Escalation in SafeNet Authentication Client

    HighCVSS 7.8Proof of conceptEPSS 0%

    thalesgroup · safenet authentication clientFeb 27, 2024

  • CVE-2024-0197
    31Monitor

    Privilege Escalation in Thales SafeNet Sentinel HASP LDK

    HighCVSS 7.8Proof of conceptEPSS 0%

    thalesgroup · sentinel hasp ldkFeb 27, 2024

  • CVE-2024-25723
    56Plan

    ZenML Server in the ZenML machine learning package before 0.46.7 for Python allows remote privilege escalation because the /api/v1/users/{us

    HighCVSS 8.8Proof of conceptEPSS 70%

    zenml · zenmlFeb 27, 2024

  • CVE-2024-1403
    40Plan

    Authentication Bypass in OpenEdge Authentication Gateway and AdminServer

    CriticalCVSS 9.8Proof of conceptEPSS 3%

    progress · openedgeFeb 27, 2024

  • CVE-2024-26144
    21Monitor

    Possible Sensitive Session Information Leak in Active Storage

    MediumCVSS 5.3Proof of conceptEPSS 1%

    rubyonrails · railsFeb 27, 2024

  • CVE-2024-25169
    39Monitor

    An issue in Mezzanine v6.0.0 allows attackers to bypass access control mechanisms in the admin panel via a crafted request.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    jupo · mezzanineFeb 28, 2024

  • CVE-2024-25170
    36Monitor

    An issue in Mezzanine v6.0.0 allows attackers to bypass access controls via manipulating the Host header.

    CriticalCVSS 9.1Proof of conceptEPSS 0%

    jupo · mezzanineFeb 28, 2024

  • CVE-2024-25202
    24Monitor

    Cross Site Scripting vulnerability in Phpgurukul User Registration & Login and User Management System 1.0 allows attackers to run arbitrary

    MediumCVSS 6.1Proof of conceptEPSS 0%

    phpgurukul · user registration \& login and user management systemFeb 28, 2024

  • CVE-2024-22983
    32Monitor

    SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the

    HighCVSS 8.1Proof of conceptEPSS 0%

    projectworlds · visitor management systemFeb 28, 2024

  • CVE-2024-25869
    41Plan

    An Unrestricted File Upload vulnerability in CodeAstro Membership Management System in PHP v.1.0 allows a remote attacker to execute arbitra

    HighCVSS 8.8No exploitEPSS 18%

    codeastro · membership management systemFeb 28, 2024

  • CVE-2024-22532
    26Monitor

    Buffer Overflow vulnerability in XNSoft NConvert 7.163 (for Windows x86) allows attackers to cause a denial of service via crafted xwd file.

    MediumCVSS 6.5Proof of conceptEPSS 1%

    xnview · nconvertFeb 28, 2024

  • CVE-2024-25422
    39Monitor

    SQL Injection vulnerability in SEMCMS v.4.8 allows a remote attacker to execute arbitrary code and obtain sensitive information via the SEMC

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    sem-cms · semcmsFeb 28, 2024

  • CVE-2024-25126
    41Plan

    Rack ReDos in content type parsing (2nd degree polynomial)

    HighCVSS 7.5No exploitEPSS 35%

    rack · rackFeb 28, 2024

  • CVE-2024-0379
    17Monitor

    Custom Twitter Feeds – A Tweets Widget or X Feed Widget <= 2.2.1 - Cross-Site Request Forgery to Plugin Options Update

    MediumCVSS 4.3Proof of conceptEPSS 0%

    smashballoon · custom twitter feedsFeb 28, 2024

  • CVE-2024-0590
    24Monitor

    Microsoft Clarity <= 0.9.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 1%

    microsoft · clarityFeb 28, 2024

  • CVE-2024-1939
    36Monitor

    Type Confusion in V8 in Google Chrome prior to 122.0.6261.94 allowed a remote attacker to potentially exploit heap corruption via a crafted

    HighCVSS 8.8Proof of conceptEPSS 2%

    google · chromeFeb 28, 2024

  • CVE-2024-21725
    32Monitor

    [20240204] - Core - XSS in mail address outputs

    MediumCVSS 6.1No exploitEPSS 26%

    joomla · joomla\!Feb 28, 2024

  • CVE-2024-21726
    41Plan

    [20240205] - Core - Inadequate content filtering within the filter code

    MediumCVSS 6.5No exploitEPSS 48%

    joomla · joomla\!Feb 28, 2024

  • CVE-2024-22939
    35Monitor

    Cross Site Request Forgery vulnerability in FlyCms v.1.0 allows a remote attacker to execute arbitrary code via the system/article/category_

    HighCVSS 8.8Proof of conceptEPSS 0%

    sunkaifei · flycmsFeb 28, 2024

  • CVE-2024-25065
    50Plan

    Apache OFBiz: Path traversal allowing authentication bypass.

    CriticalCVSS 9.1No exploitEPSS 47%

    apache · ofbizFeb 28, 2024

  • CVE-2024-25830
    46Plan

    F-logic DataCube3 v1.0 is vulnerable to Incorrect Access Control due to an improper directory access restriction.

    CriticalCVSS 9.8Proof of conceptEPSS 24%

    f-logic · datacube3 firmwareFeb 28, 2024

  • CVE-2024-25832
    39Monitor

    F-logic DataCube3 v1.0 is vulnerable to unrestricted file upload, which could allow an authenticated malicious actor to upload a file of dan

    HighCVSS 8.8Proof of conceptEPSS 12%

    f-logic · datacube3Feb 28, 2024

  • CVE-2023-51800
    21Monitor

    Cross Site Scripting (XSS) vulnerability in School Fees Management System v.1.0 allows a remote attacker to execute arbitrary code via a cra

    MediumCVSS 5.4Proof of conceptEPSS 0%

    school fees management system project · school fees management system1.0Feb 28, 2024

  • CVE-2023-51801
    39Monitor

    SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code via a crafted p

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    oretnom23 · simple student attendance systemFeb 28, 2024

  • CVE-2023-51802
    24Monitor

    Cross Site Scripting (XSS) vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary code vi

    MediumCVSS 6.1Proof of conceptEPSS 0%

    oretnom23 · simple student attendance systemFeb 28, 2024

  • CVE-2024-25291
    39Monitor

    Deskfiler v1.2.3 allows attackers to execute arbitrary code via uploading a crafted plugin.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    deskfiler · deskfilerFeb 29, 2024

  • CVE-2024-25292
    38Monitor

    Cross-site scripting (XSS) vulnerability in RenderTune v1.1.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa

    CriticalCVSS 9.6Proof of conceptEPSS 1%

    martinbarker · rendertuneFeb 29, 2024

  • CVE-2024-25180
    39Monitor

    An issue discovered in pdfmake 0.2.9 allows remote attackers to run arbitrary code via crafted POST request to the /pdf endpoint.

    CriticalCVSS 9.8Proof of conceptEPSS 1%

    pdfmake project · pdfmakeFeb 29, 2024