CVEs published in February 2024

CVE-2024-26302Medium

vulnerability in the web-based management interface of ClearPass Policy Manager could

CVE-2024-26301Medium

vulnerability in the web-based management interface of ClearPass Policy Manager could

CVE-2024-26300Medium

vulnerability in the guest interface of ClearPass Policy Manager could

CVE-2024-26299Medium

vulnerability in the web-based management interface of ClearPass Policy Manager could

CVE-2024-26298High

Vulnerabilities in the ClearPass Policy Manager web-based management interface

CVE-2024-26297High

Vulnerabilities in the ClearPass Policy Manager web-based management interface

CVE-2024-26296High

Vulnerabilities in the ClearPass Policy Manager web-based management interface

CVE-2024-26295High

Vulnerabilities in the ClearPass Policy Manager web-based management interface

CVE-2024-26294High

Vulnerabilities in the ClearPass Policy Manager web-based management interface

CVE-2023-29180High

null pointer dereference vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2.0 through 6.2.14, FortiOS 6.0.0 through 6.0.16, FortiProxy 7.2.0 through 7.2.3, FortiProxy 7.0.0 through 7.0.10, FortiProxy 2.0.0 through 2.0.12, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to denial of service via specially crafted HTTP requests

CVE-2023-29181High

use of externally-controlled format string vulnerability in Fortinet FortiOS 7.2.0 through 7.2.4, FortiOS 7.0.0 through 7.0.11, FortiOS 6.4.0 through 6.4.12, FortiOS 6.2.0 through 6.2.14, FortiOS 6.0.0 through 6.0.16, FortiOS 5.6 all versions, FortiOS 5.4 all versions, FortiOS 5.2 all versions, FortiOS 5.0 all versions, FortiOS 4.3 all versions, FortiOS 4.2 all versions, FortiOS 4.1 all versions, FortiOS 4.0 all versions, FortiPAM 1.0 all versions, FortiProxy 7.2.0 through 7.2.4, FortiProxy 7.0.0 through 7.0.10, FortiProxy 2.0.0 through 2.0.12, FortiProxy 01.02 all versions, FortiProxy 1.2 all versions, FortiProxy 01.01 all versions, FortiProxy 1.1 all versions, FortiProxy 01.00 all versions allows attacker to execute unauthorized code or commands via specially crafted command

CVE-2024-0410High

Improper Enforcement of Behavioral Workflow in GitLab

CVE-2024-1525Medium

Authentication Bypass Using an Alternate Path or Channel in GitLab

CVE-2023-3509Low

Incorrect Authorization in GitLab

CVE-2024-21682High

Confluence: This High severity Injection vulnerability was introduced in Assets Discovery 1.0 - 6.2.0 (all versions).

CVE-2024-21678High

Confluence Data Center: This High severity Stored XSS vulnerability was introduced in version 2.7.0 of Confluence Data Center.

CVE-2023-45581High

improper privilege management vulnerability [CWE-269] vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0.6 through 7.0.10, FortiClientEMS 7.0.0 through 7.0.4, FortiClientEMS 6.4 all versions, FortiClientEMS 06.02 all versions, FortiClientEMS 6.2 all versions allows an Site administrator with Super Admin privileges to perform global administrative operations affecting other sites via crafted HTTP or HTTPS requests

CVE-2024-24990High

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests

CVE-2024-24989High

When NGINX Plus or NGINX OSS are configured to use the HTTP/3 QUIC module, undisclosed requests

CVE-2024-24966Medium

When LDAP remote authentication is configured on F5OS, a remote user without an assigned role will be incorrectly authorized

CVE-2024-24775High

When a virtual server is enabled with VLAN group and SNAT listener is configured, undisclosed traffic

CVE-2024-23982High

When a BIG-IP PEM classification profile is configured on a UDP virtual server, undisclosed requests

CVE-2024-23979High

When SSL Client Certificate LDAP or Certificate Revocation List Distribution Point (CRLDP) authentication profile is configured…

CVE-2024-23976Medium

BIG-IP: When running in Appliance mode, an authenticated attacker assigned the Administrator role

CVE-2024-23805High

BIG-IP: Undisclosed requests can cause the Traffic Management Microkernel (TMM) to terminate.

CVE-2024-23607Medium

directory traversal vulnerability exists in the F5OS QKView utility

CVE-2024-23603Low

BIG-IP: An SQL injection vulnerability exists in an undisclosed page of the BIG-IP Configuration utility.

CVE-2024-23314High

When HTTP/2 is configured on BIG-IP or BIG-IP Next SPK systems, undisclosed responses

CVE-2024-23308High

When a BIG-IP Advanced WAF or BIG-IP ASM policy with a Request Body Handling option is attached to a virtual server, undisclosed…

CVE-2024-23306High

BIG-IP Next: vulnerability exists in BIG-IP Next CNF and SPK systems that may allow access to undisclosed sensitive files.

CVE-2024-22389High

When BIG-IP is deployed in high availability (HA) and an iControl REST API token is updated, the change does not sync to the…

CVE-2024-22093High

When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST…

CVE-2024-21849High

When an Advanced WAF/ASM security policy and a Websockets profile are configured on a virtual server, undisclosed traffic

CVE-2024-21789High

When a BIG-IP ASM/Advanced WAF security policy is configured on a virtual server, undisclosed requests

CVE-2024-21782Medium

CVE-2020-5873Medium

CVE-2024-21771High

For unspecified traffic patterns, BIG-IP AFM IPS engine

CVE-2024-21763High

When BIG-IP AFM Device DoS or DoS profile is configured with NXDOMAIN attack vector and bad actor detection, undisclosed queries

CVE-2024-21412HighCISA KEV

Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability

CVE-2024-21410CriticalCISA KEV

Microsoft Exchange Server Privilege Escalation Vulnerability

CVE-2024-21406High

Windows Printing Service Spoofing Vulnerability

CVE-2024-21405High

Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability

CVE-2024-21391High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21377Medium

Windows DNS Information Disclosure Vulnerability

CVE-2024-21370High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21368High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21367High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21365High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21363High

Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

CVE-2024-21362Medium

Windows Kernel Security Feature Bypass Vulnerability

CVE-2024-21359High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21356Medium

Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability

CVE-2024-21355High

Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability

CVE-2024-21353High

Microsoft WDAC ODBC Driver Remote Code Execution Vulnerability

CVE-2024-21348High

Internet Connection Sharing (ICS) Denial of Service Vulnerability

CVE-2024-21347High

Microsoft ODBC Driver Remote Code Execution Vulnerability

CVE-2024-21346High

Win32k Elevation of Privilege Vulnerability

CVE-2024-21345High

Windows Kernel Elevation of Privilege Vulnerability

CVE-2024-21344Medium

Windows Network Address Translation (NAT) Denial of Service Vulnerability

CVE-2024-21343Medium

Windows Network Address Translation (NAT) Denial of Service Vulnerability

CVE-2024-21342High

Windows DNS Client Denial of Service Vulnerability

CVE-2024-21341Medium

Windows Kernel Remote Code Execution Vulnerability

CVE-2024-21339Medium

Windows USB Generic Parent Driver Remote Code Execution Vulnerability

CVE-2024-20684Medium

Windows Hyper-V Denial of Service Vulnerability

CVE-2024-21304Medium

Trusted Compute Base Elevation of Privilege Vulnerability

CVE-2024-21420High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21375High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21372High

Windows OLE Remote Code Execution Vulnerability

CVE-2024-21371High

Windows Kernel Elevation of Privilege Vulnerability

CVE-2024-21369High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21366High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21361High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21360High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21358High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21357High

Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability

CVE-2024-21354High

Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability

CVE-2024-21352High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21351HighCISA KEV

Microsoft Windows SmartScreen Security Feature Bypass Vulnerability

CVE-2024-21350High

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

CVE-2024-21349High

Microsoft ActiveX Data Objects Remote Code Execution Vulnerability

CVE-2024-21340Medium

Windows Kernel Information Disclosure Vulnerability

CVE-2024-21338HighCISA KEV

Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability

CVE-2023-50358Medium

QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVE-2023-47218Medium

QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVE-2024-0057Critical

.NET Vulnerability in NetApp Products

CVE-2023-6535High

Kernel: null pointer dereference in nvmet_tcp_execute_request

CVE-2023-50359Low

QTS: unchecked return value vulnerability has been reported to affect several QNAP operating system versions.

CVE-2023-47568High

QTS: SQL injection vulnerability has been reported to affect several QNAP operating system versions.

CVE-2023-47567Medium

QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVE-2023-47566Medium

QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.

CVE-2023-47564High

Qsync: incorrect permission assignment for critical resource vulnerability has been reported to affect Qsync Central.

CVE-2023-47562High

Photo Station: OS command injection vulnerability has been reported to affect Photo Station.

CVE-2023-47561Medium

Photo Station: cross-site scripting (XSS) vulnerability has been reported to affect Photo Station.

CVE-2023-45037Low

QTS: buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions

CVE-2023-45036Low

QTS: buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions

CVE-2023-45035Low

QTS: buffer copy without checking size of input vulnerability has been reported to affect several QNAP operating system versions

CVE-2023-45028Medium

QTS: uncontrolled resource consumption vulnerability has been reported to affect several QNAP operating system versions.

CVE-2023-45027Medium

QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.

CVE-2023-45026Medium

QTS: path traversal vulnerability has been reported to affect several QNAP operating system versions.

CVE-2023-45025Critical

QTS: OS command injection vulnerability has been reported to affect several QNAP operating system versions.