CVEs published March 22, 2024
81 CVEs were published on March 22, 2024: 10 critical, 27 high. 1 is now in CISA KEV.
- Published
- 81
- Critical
- 10
- High
- 27
- Medium
- 37
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 23
Most affected products
- Tenda AC15
- 13
- CIGESv2
- 7
- DedeCMS
- 4
- IBM Security Verify Directory
- 4
- lakernote EasyAdmin
- 4
- Campcodes Online Marriage Registration System
- 3
- Checkmk
- 3
- anchorcms/anchor-cms
- 2
- freescout-helpdesk freescout
- 2
- Microsoft Edge
- 2
Critical 10
- CVE-2024-29185FreeScout OS Command Injection vulnerabilityfreescout-helpdesk freescout
- CVE-2024-28861Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolderFriendsOfSymfony1 symfony1 · friendsofsymfony1/symfony1
- CVE-2024-2227IdentityIQ JavaServer Faces File Path Traversal VulnerabilitySailPoint IdentityIQ
- CVE-2024-2724SQL injection vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-2723SQL injection vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-2722SQL injection vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-29943An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination.Mozilla Firefox
- CVE-2024-28441File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the…
- CVE-2024-29275SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive…
- CVE-2024-29385DIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function.
High 27
- CVE-2024-29059.NET Framework Information Disclosure VulnerabilityMicrosoft .NET Framework
- CVE-2024-29190MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)Mobile-Security-Framework-MobSF · mobsfscan +1
- CVE-2023-5685Xnio: stackoverflowexception when the chain of notifier states becomes problematically bigRed Hat build of Apache Camel 4.4.0 for Spring Boot · R… +10
- CVE-2024-29184FreeScout Stored XSS to Privilege Escalation After CSP Bypassfreescout-helpdesk freescout
- CVE-2024-2228IdentityIQ Authorization of QuickLink Target Identities VulnerabilitySailPoint IdentityIQ
- CVE-2024-2449LoadMaster Cross-Site Request Forgery (CSRF)Progress Software LoadMaster
- CVE-2024-2725Exposure of Sensitive Information vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-2448LoadMaster Command Injection VulnerabilityProgress Software LoadMaster
- CVE-2024-29944An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent…Mozilla Firefox
- CVE-2024-1848Multiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024Dassault Systèmes SOLIDWORKS Desktop
- CVE-2024-28824Privilege escalation in mk_informix pluginCheckmk
- CVE-2024-0638Privilege escalation in mk_oracle pluginsCheckmk
- CVE-2024-2815Tenda AC15 Cookie execCommand R7WebsSecurityHandler stack-based overflowTenda AC15
- CVE-2024-2814Tenda AC15 DhcpListClient fromDhcpListClient stack-based overflowTenda AC15
- CVE-2024-2813Tenda AC15 fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflowTenda AC15
- CVE-2024-2811Tenda AC15 WifiWpsStart formWifiWpsStart stack-based overflowTenda AC15
- CVE-2024-2810Tenda AC15 WifiWpsOOB formWifiWpsOOB stack-based overflowTenda AC15
- CVE-2024-2809Tenda AC15 SetFirewallCfg formSetFirewallCfg stack-based overflowTenda AC15
- CVE-2024-2808Tenda AC15 QuickIndex formQuickIndex stack-based overflowTenda AC15
- CVE-2024-2807Tenda AC15 expandDlnaFile formExpandDlnaFile stack-based overflowTenda AC15
- CVE-2024-2806Tenda AC15 addWifiMacFilter stack-based overflowTenda AC15
- CVE-2024-2805Tenda AC15 SetSpeedWan formSetSpeedWan stack-based overflowTenda AC15
- CVE-2023-41099In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM).
- CVE-2024-25808Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create…
- CVE-2024-28559SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the setPrice() function of…
Show all 27 entriesShow fewer entries
Medium, low and unrated 44
- CVE-2024-29057Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-26247Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2024-2828lakernote EasyAdmin IndexController.java thumbnail server-side request forgerylakernote EasyAdmin
- CVE-2024-2827lakernote EasyAdmin saveReportFile server-side request forgerylakernote EasyAdmin
- CVE-2024-2826lakernote EasyAdmin saveReportFile xml external entity referencelakernote EasyAdmin
- CVE-2024-2825lakernote EasyAdmin saveReportFile path traversallakernote EasyAdmin
- CVE-2024-2824Matthias-Wandel jhead exif.c PrintFormatNumber heap-based overflowMatthias-Wandel jhead
- CVE-2023-4063Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request.Certain HP OfficeJet Pro Printers
- CVE-2024-29186Slow String Operations via MultiPart Requests in Event-Driven Functionsbrefphp bref · bref/bref
- CVE-2024-2823DedeCMS mda_main.php cross-site request forgeryDedeCMS
- CVE-2024-2822DedeCMS vote_edit.php cross-site request forgeryDedeCMS
- CVE-2024-29042Translate Cache Poisoning Vulnerabilityfranciscop translate · translate
- CVE-2023-23349Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled…Kaspersky Password Manager for Windows
- CVE-2024-2821DedeCMS friendlink_edit.php cross-site request forgeryDedeCMS
- CVE-2024-2820DedeCMS baidunews.php cross-site request forgeryDedeCMS
- CVE-2022-32754IBM Security Verify Directory cross-site scriptingIBM Security Verify Directory
- CVE-2022-32751IBM Security Verify Directory information disclosureIBM Security Verify Directory
- CVE-2022-32756IBM Security Verify Directory information disclosureIBM Security Verify Directory
- CVE-2022-32753IBM Security Verify Directory information disclosureIBM Security Verify Directory
- CVE-2024-2728Information exposure vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-2727Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-2726Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-1742Information disclosure in mk_oracle Checkmk agent pluginCheckmk
- CVE-2024-2817Tenda AC15 SysToolRestoreSet fromSysToolRestoreSet cross-site request forgeryTenda AC15
- CVE-2024-2816Tenda AC15 SysToolReboot fromSysToolReboot cross-site request forgeryTenda AC15
Show all 44 entriesShow fewer entries
- CVE-2024-2812Tenda AC15 WriteFacMac formWriteFacMac os command injectionTenda AC15
- CVE-2024-0957WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site ScriptingWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…
- CVE-2024-2392Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy Companion
- CVE-2024-2500ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Namethemegrill ColorMag
- CVE-2024-2080LiquidPoll – Polls, Surveys, NPS and Feedback Reviews <= 3.3.76 - Information ExposureLiquidPoll – Polls, Surveys, NPS and Feedback Reviews
- CVE-2024-2780Campcodes Online Marriage Registration System admin-profile.php cross site scriptingCampcodes Online Marriage Registration System
- CVE-2024-2779Campcodes Online Marriage Registration System application-bwdates-reports-details.php cross site scriptingCampcodes Online Marriage Registration System
- CVE-2024-2778Campcodes Online Marriage Registration System search.php cross site scriptingCampcodes Online Marriage Registration System
- CVE-2024-2777Campcodes/PHPGurukul Online Marriage Registration System application-bwdates-reports-details.php sql injectionCampcodes Online Marriage Registration System · PHPGurukul…
- CVE-2024-25168SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the…
- CVE-2024-25807Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive…
- CVE-2024-26557Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter.
- CVE-2024-28560SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea() function of…
- CVE-2024-28593The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that…moodle/moodle
- CVE-2024-29271Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and…vvvebjs
- CVE-2024-29272Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and…vvvebJs
- CVE-2024-29273There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.
- CVE-2024-29338Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2.anchorcms/anchor-cms
- CVE-2024-29865Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form.