# CVEs published 2024-04-03

231 CVEs were published on April 3, 2024: 20 critical, 69 high. Days are UTC.

- [CVE-2024-3270](https://cve.now/CVE-2024-3270.md): ThingsBoard AdvancedFeature access control (CVSS 3.8, ThingsBoard)
- [CVE-2024-30265](https://cve.now/CVE-2024-30265.md): Voilà Local file inclusion (CVSS 7.5, voila-dashboards voila · voila)
- [CVE-2024-28870](https://cve.now/CVE-2024-28870.md): Suricata uses excessive resource use in malformed ssh traffic parsing (CVSS 7.5, OISF suricata)
- [CVE-2024-2689](https://cve.now/CVE-2024-2689.md): Denial of Service if invalid UTF-8 sent (CVSS 4.4, Temporal Technologies Temporal Server · go.temporal.io/s… +1)
- [CVE-2024-3181](https://cve.now/CVE-2024-3181.md): Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. (CVSS 3.1, Concrete CMS · concrete5/concrete5)
- [CVE-2024-3180](https://cve.now/CVE-2024-3180.md): Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file (CVSS 3.1, Concrete CMS · concrete5/concrete5)
- [CVE-2024-0335](https://cve.now/CVE-2024-0335.md): Malformed Packet Handling (CVSS 7.5, ABB Symphony Plus S+ Operations · ABB Symphony Plus S+ E… +1)
- [CVE-2024-3179](https://cve.now/CVE-2024-3179.md): Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page (CVSS 3.1, Concrete CMS · concrete5/concrete5)
- [CVE-2024-3178](https://cve.now/CVE-2024-3178.md): Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search… (CVSS 3.1, Concrete CMS · concrete5/concrete5)
- [CVE-2024-2753](https://cve.now/CVE-2024-2753.md): Concrete CMS version 9 below 9.2.8 and below 8.5.16 is vulnerable to stored XSS on the calendar color settings screen (CVSS 2.0, Concrete CMS · concrete5/concrete5)
- [CVE-2024-2653](https://cve.now/CVE-2024-2653.md): CVE-2024-2653 (CVSS 8.2, amphp/http-client · amphp/http)
- [CVE-2024-2758](https://cve.now/CVE-2024-2758.md): CVE-2024-2758 (CVSS 6.3, Tempesta FW)
- [CVE-2024-26779](https://cve.now/CVE-2024-26779.md): wifi: mac80211: fix race condition on enabling fast-xmit (CVSS 8.8, Linux)
- [CVE-2024-26778](https://cve.now/CVE-2024-26778.md): fbdev: savage: Error out if pixclock equals zero (no CVSS, Linux)
- [CVE-2024-26777](https://cve.now/CVE-2024-26777.md): fbdev: sis: Error out if pixclock equals zero (no CVSS, Linux)
- [CVE-2024-26776](https://cve.now/CVE-2024-26776.md): spi: hisi-sfc-v3xx: Return IRQ\_NONE if no interrupts were detected (no CVSS, Linux)
- [CVE-2024-26775](https://cve.now/CVE-2024-26775.md): aoe: avoid potential deadlock at set\_capacity (no CVSS, Linux)
- [CVE-2024-26774](https://cve.now/CVE-2024-26774.md): ext4: avoid dividing by 0 in mb\_update\_avg\_fragment\_size() when block bitmap corrupt (no CVSS, Linux)
- [CVE-2024-26773](https://cve.now/CVE-2024-26773.md): ext4: avoid allocating blocks from corrupted group in ext4\_mb\_try\_best\_found() (CVSS 7.8, Linux)
- [CVE-2024-26772](https://cve.now/CVE-2024-26772.md): ext4: avoid allocating blocks from corrupted group in ext4\_mb\_find\_by\_goal() (CVSS 7.8, Linux)
- [CVE-2024-26771](https://cve.now/CVE-2024-26771.md): dmaengine: ti: edma: Add some null pointer checks to the edma\_probe (no CVSS, Linux)
- [CVE-2024-26770](https://cve.now/CVE-2024-26770.md): HID: nvidia-shield: Add missing null pointer checks to LED initialization (no CVSS, Linux)
- [CVE-2024-26769](https://cve.now/CVE-2024-26769.md): nvmet-fc: avoid deadlock on delete association path (CVSS 7.5, Linux)
- [CVE-2024-26768](https://cve.now/CVE-2024-26768.md): LoongArch: Change acpi\_core\_pic\[NR\_CPUS\] to acpi\_core\_pic\[MAX\_CORE\_PIC\] (CVSS 7.2, Linux)
- [CVE-2024-26767](https://cve.now/CVE-2024-26767.md): drm/amd/display: fixed integer types and null check locations (no CVSS, Linux)
- [CVE-2024-26766](https://cve.now/CVE-2024-26766.md): IB/hfi1: Fix sdma.h tx-\>num\_descs off-by-one error (CVSS 7.8, Linux)
- [CVE-2024-26765](https://cve.now/CVE-2024-26765.md): LoongArch: Disable IRQ before init\_fn() for nonboot CPUs (no CVSS, Linux)
- [CVE-2024-26764](https://cve.now/CVE-2024-26764.md): fs/aio: Restrict kiocb\_set\_cancel\_fn() to I/O submitted via libaio (no CVSS, Linux)
- [CVE-2024-26763](https://cve.now/CVE-2024-26763.md): dm-crypt: don't modify the data when using authenticated encryption (CVSS 7.1, Linux)
- [CVE-2024-26762](https://cve.now/CVE-2024-26762.md): cxl/pci: Skip to handle RAS errors if CXL.mem device is detached (CVSS 7.8, Linux)
- [CVE-2024-26761](https://cve.now/CVE-2024-26761.md): cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window (no CVSS, Linux)
- [CVE-2024-26760](https://cve.now/CVE-2024-26760.md): scsi: target: pscsi: Fix bio\_put() for error case (CVSS 9.8, Linux)
- [CVE-2024-26759](https://cve.now/CVE-2024-26759.md): mm/swap: fix race when skipping swapcache (CVSS 7.8, Linux)
- [CVE-2024-26758](https://cve.now/CVE-2024-26758.md): md: Don't ignore suspended array in md\_check\_recovery() (CVSS 5.5, Linux)
- [CVE-2024-26757](https://cve.now/CVE-2024-26757.md): md: Don't ignore read-only array in md\_check\_recovery() (CVSS 5.5, Linux)
- [CVE-2024-26756](https://cve.now/CVE-2024-26756.md): md: Don't register sync\_thread for reshape directly (no CVSS, Linux)
- [CVE-2024-26755](https://cve.now/CVE-2024-26755.md): md: Don't suspend the array for interrupted reshape (CVSS 5.3, Linux)
- [CVE-2024-26754](https://cve.now/CVE-2024-26754.md): gtp: fix use-after-free and null-ptr-deref in gtp\_genl\_dump\_pdp() (no CVSS, Linux)
- [CVE-2024-26753](https://cve.now/CVE-2024-26753.md): crypto: virtio/akcipher - Fix stack overflow on memcpy (no CVSS, Linux)
- [CVE-2024-26752](https://cve.now/CVE-2024-26752.md): l2tp: pass correct message length to ip6\_append\_data (no CVSS, Linux)
- [CVE-2024-26751](https://cve.now/CVE-2024-26751.md): ARM: ep93xx: Add terminator to gpiod\_lookup\_table (no CVSS, Linux)
- [CVE-2024-26749](https://cve.now/CVE-2024-26749.md): usb: cdns3: fixed memory use after free at cdns3\_gadget\_ep\_disable() (no CVSS, Linux)
- [CVE-2024-26748](https://cve.now/CVE-2024-26748.md): usb: cdns3: fix memory double free when handle zero packet (CVSS 7.8, Linux)
- [CVE-2024-26747](https://cve.now/CVE-2024-26747.md): usb: roles: fix NULL pointer issue when put module's reference (CVSS 4.4, Linux)
- [CVE-2024-26744](https://cve.now/CVE-2024-26744.md): RDMA/srpt: Support specifying the srpt\_service\_guid parameter (CVSS 5.5, Linux)
- [CVE-2024-26743](https://cve.now/CVE-2024-26743.md): RDMA/qedr: Fix qedr\_create\_user\_qp error flow (no CVSS, Linux)
- [CVE-2024-26742](https://cve.now/CVE-2024-26742.md): scsi: smartpqi: Fix disable\_managed\_interrupts (no CVSS, Linux)
- [CVE-2024-26741](https://cve.now/CVE-2024-26741.md): dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check\_estalblished(). (no CVSS, Linux)
- [CVE-2024-26740](https://cve.now/CVE-2024-26740.md): net/sched: act\_mirred: use the backlog for mirred ingress (no CVSS, Linux)
- [CVE-2024-26739](https://cve.now/CVE-2024-26739.md): net/sched: act\_mirred: don't override retval if we already lost the skb (CVSS 7.8, Linux)
- [CVE-2024-26738](https://cve.now/CVE-2024-26738.md): powerpc/pseries/iommu: DLPAR add doesn't completely initialize pci\_controller (no CVSS, Linux)
- [CVE-2024-26737](https://cve.now/CVE-2024-26737.md): bpf: Fix racing between bpf\_timer\_cancel\_and\_free and bpf\_timer\_cancel (CVSS 7.8, Linux)
- [CVE-2024-26736](https://cve.now/CVE-2024-26736.md): afs: Increase buffer size in afs\_update\_volume\_status() (CVSS 8.1, Linux)
- [CVE-2024-26735](https://cve.now/CVE-2024-26735.md): ipv6: sr: fix possible use-after-free and null-ptr-deref (no CVSS, Linux)
- [CVE-2024-26734](https://cve.now/CVE-2024-26734.md): devlink: fix possible use-after-free and memory leaks in devlink\_init() (CVSS 7.0, Linux)
- [CVE-2024-26733](https://cve.now/CVE-2024-26733.md): arp: Prevent overflow in arp\_req\_get(). (no CVSS, Linux)
- [CVE-2024-26732](https://cve.now/CVE-2024-26732.md): net: implement lockless setsockopt(SO\_PEEK\_OFF) (no CVSS, Linux)
- [CVE-2024-26731](https://cve.now/CVE-2024-26731.md): bpf, sockmap: Fix NULL pointer dereference in sk\_psock\_verdict\_data\_ready() (CVSS 5.3, Linux)
- [CVE-2024-26730](https://cve.now/CVE-2024-26730.md): hwmon: (nct6775) Fix access to temperature configuration registers (CVSS 7.3, Linux)
- [CVE-2024-26729](https://cve.now/CVE-2024-26729.md): drm/amd/display: Fix potential null pointer dereference in dc\_dmub\_srv (no CVSS, Linux)
- [CVE-2024-26728](https://cve.now/CVE-2024-26728.md): drm/amd/display: fix null-pointer dereference on edid reading (CVSS 7.8, Linux)
- [CVE-2023-52641](https://cve.now/CVE-2023-52641.md): fs/ntfs3: Add NULL ptr dereference checking at the end of attr\_allocate\_frame() (no CVSS, Linux)
- [CVE-2023-52640](https://cve.now/CVE-2023-52640.md): fs/ntfs3: Fix oob in ntfs\_listxattr (CVSS 7.1, Linux)
- [CVE-2024-23540](https://cve.now/CVE-2024-23540.md): HCL BigFix Inventory is vulnerable to path traversal (CVSS 5.3, HCL Software BigFix Inventory)
- [CVE-2024-1180](https://cve.now/CVE-2024-1180.md): TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability (CVSS 6.8, TP-Link Omada ER605)
- [CVE-2024-20352](https://cve.now/CVE-2024-20352.md): A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which… (CVSS 4.9, Cisco Emergency Responder)
- [CVE-2024-20347](https://cve.now/CVE-2024-20347.md): A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a CSRF attack, which could allow… (CVSS 4.3, Cisco Emergency Responder)
- [CVE-2024-20362](https://cve.now/CVE-2024-20362.md): A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could… (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20348](https://cve.now/CVE-2024-20348.md): A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an… (CVSS 7.5, Cisco Data Center Network Manager)
- [CVE-2024-20283](https://cve.now/CVE-2024-20283.md): A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an… (CVSS 4.3, Cisco Nexus Dashboard)
- [CVE-2024-20334](https://cve.now/CVE-2024-20334.md): A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote… (CVSS 5.5, Cisco TelePresence Management Suite)
- [CVE-2024-30366](https://cve.now/CVE-2024-30366.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30334](https://cve.now/CVE-2024-30334.md): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30333](https://cve.now/CVE-2024-30333.md): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30332](https://cve.now/CVE-2024-30332.md): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30331](https://cve.now/CVE-2024-30331.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-20368](https://cve.now/CVE-2024-20368.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote… (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2024-30330](https://cve.now/CVE-2024-30330.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30329](https://cve.now/CVE-2024-30329.md): Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2024-20367](https://cve.now/CVE-2024-20367.md): A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a… (CVSS 5.4, Cisco Enterprise Chat and Email)
- [CVE-2024-30328](https://cve.now/CVE-2024-30328.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30327](https://cve.now/CVE-2024-30327.md): Foxit PDF Reader template Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-20332](https://cve.now/CVE-2024-20332.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote… (CVSS 5.5, Cisco Identity Services Engine Software)
- [CVE-2024-30326](https://cve.now/CVE-2024-30326.md): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30325](https://cve.now/CVE-2024-30325.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-20302](https://cve.now/CVE-2024-20302.md): A vulnerability in the tenant security implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an authenticated, remote… (CVSS 5.4, Cisco Nexus Dashboard Orchestrator)
- [CVE-2024-30324](https://cve.now/CVE-2024-30324.md): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30323](https://cve.now/CVE-2024-30323.md): Foxit PDF Reader template Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30322](https://cve.now/CVE-2024-30322.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-20282](https://cve.now/CVE-2024-20282.md): A vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid rescue-user credentials to elevate… (CVSS 6.0, Cisco Nexus Dashboard)
- [CVE-2024-20281](https://cve.now/CVE-2024-20281.md): A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashboard hosted services could allow an… (CVSS 7.5, Cisco Data Center Network Manager · Cisco Nexus Dashboard)
- [CVE-2024-27346](https://cve.now/CVE-2024-27346.md): Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Kofax Power PDF)
- [CVE-2024-27345](https://cve.now/CVE-2024-27345.md): Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Kofax Power PDF)
- [CVE-2024-20310](https://cve.now/CVE-2024-20310.md): A vulnerability in the web-based interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an… (CVSS 6.1, Cisco IOS XE Software · Cisco Unified Communications Manage…)
- [CVE-2024-27344](https://cve.now/CVE-2024-27344.md): Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27343](https://cve.now/CVE-2024-27343.md): Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Kofax Power PDF)
- [CVE-2024-27342](https://cve.now/CVE-2024-27342.md): Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27341](https://cve.now/CVE-2024-27341.md): Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27340](https://cve.now/CVE-2024-27340.md): Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27339](https://cve.now/CVE-2024-27339.md): Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27338](https://cve.now/CVE-2024-27338.md): Kofax Power PDF app response Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27337](https://cve.now/CVE-2024-27337.md): Kofax Power PDF TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27336](https://cve.now/CVE-2024-27336.md): Kofax Power PDF PNG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Kofax Power PDF)
- [CVE-2024-27335](https://cve.now/CVE-2024-27335.md): Kofax Power PDF PNG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-31392](https://cve.now/CVE-2024-31392.md): If an insecure element was added to a page after a delay, Firefox would not replace the secure icon with a mixed content security status… (CVSS 7.5, Mozilla Firefox for iOS)
- [CVE-2024-31393](https://cve.now/CVE-2024-31393.md): Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This… (CVSS 4.3, Mozilla Firefox for iOS)
- [CVE-2024-26727](https://cve.now/CVE-2024-26727.md): btrfs: do not ASSERT() if the newly created subvolume already got read (no CVSS, Linux)
- [CVE-2024-26726](https://cve.now/CVE-2024-26726.md): btrfs: don't drop extent\_map for free space inode on write error (no CVSS, Linux)
- [CVE-2024-26725](https://cve.now/CVE-2024-26725.md): dpll: fix possible deadlock during netlink dump operation (no CVSS, Linux)
- [CVE-2024-26724](https://cve.now/CVE-2024-26724.md): net/mlx5: DPLL, Fix possible use after free after delayed work timer triggers (no CVSS, Linux)
- [CVE-2024-26723](https://cve.now/CVE-2024-26723.md): lan966x: Fix crash when adding interface under a lag (CVSS 7.8, Linux)
- [CVE-2024-26722](https://cve.now/CVE-2024-26722.md): ASoC: rt5645: Fix deadlock in rt5645\_jack\_detect\_work() (no CVSS, Linux)
- [CVE-2024-26721](https://cve.now/CVE-2024-26721.md): drm/i915/dsc: Fix the macro that calculates DSCC\_/DSCA\_ PPS reg address (no CVSS, Linux)
- [CVE-2024-26719](https://cve.now/CVE-2024-26719.md): nouveau: offload fence uevents work to workqueue (no CVSS, Linux)
- [CVE-2024-26718](https://cve.now/CVE-2024-26718.md): dm-crypt, dm-verity: disable tasklets (CVSS 7.8, Linux)
- [CVE-2024-26717](https://cve.now/CVE-2024-26717.md): HID: i2c-hid-of: fix NULL-deref on failed power up (no CVSS, Linux)
- [CVE-2024-26716](https://cve.now/CVE-2024-26716.md): usb: core: Prevent null pointer dereference in update\_port\_device\_state (no CVSS, Linux)
- [CVE-2024-26715](https://cve.now/CVE-2024-26715.md): usb: dwc3: gadget: Fix NULL pointer dereference in dwc3\_gadget\_suspend (no CVSS, Linux)
- [CVE-2024-26714](https://cve.now/CVE-2024-26714.md): interconnect: qcom: sc8180x: Mark CO0 BCM keepalive (no CVSS, Linux)
- [CVE-2024-26712](https://cve.now/CVE-2024-26712.md): powerpc/kasan: Fix addr error caused by page alignment (CVSS 7.8, Linux)
- [CVE-2024-26711](https://cve.now/CVE-2024-26711.md): iio: adc: ad4130: zero-initialize clock init data (no CVSS, Linux)
- [CVE-2024-26710](https://cve.now/CVE-2024-26710.md): powerpc/kasan: Limit KASAN thread size increase to 32KB (no CVSS, Linux)
- [CVE-2024-26709](https://cve.now/CVE-2024-26709.md): powerpc/iommu: Fix the missing iommu\_group\_put() during platform domain attach (no CVSS, Linux)
- [CVE-2024-26708](https://cve.now/CVE-2024-26708.md): mptcp: really cope with fastopen race (CVSS 5.5, Linux)
- [CVE-2024-26707](https://cve.now/CVE-2024-26707.md): net: hsr: remove WARN\_ONCE() in send\_hsr\_supervision\_frame() (no CVSS, Linux)
- [CVE-2024-26706](https://cve.now/CVE-2024-26706.md): parisc: Fix random data corruption from exception handler (CVSS 7.8, Linux)
- [CVE-2024-26705](https://cve.now/CVE-2024-26705.md): parisc: BTLB: Fix crash when setting up BTLB at CPU bringup (no CVSS, Linux)
- [CVE-2024-26704](https://cve.now/CVE-2024-26704.md): ext4: fix double-free of blocks due to wrong extents moved\_len (CVSS 7.8, Linux)
- [CVE-2024-26703](https://cve.now/CVE-2024-26703.md): tracing/timerlat: Move hrtimer\_init to timerlat\_fd open() (no CVSS, Linux)
- [CVE-2024-26702](https://cve.now/CVE-2024-26702.md): iio: magnetometer: rm3100: add boundary check for the value read from RM3100\_REG\_TMRC (CVSS 5.5, Linux)
- [CVE-2024-26700](https://cve.now/CVE-2024-26700.md): drm/amd/display: Fix MST Null Ptr for RV (no CVSS, Linux)
- [CVE-2024-26699](https://cve.now/CVE-2024-26699.md): drm/amd/display: Fix array-index-out-of-bounds in dcn35\_clkmgr (CVSS 7.8, Linux)
- [CVE-2024-26698](https://cve.now/CVE-2024-26698.md): hv\_netvsc: Fix race condition between netvsc\_probe and netvsc\_remove (no CVSS, Linux)
- [CVE-2024-26697](https://cve.now/CVE-2024-26697.md): nilfs2: fix data corruption in dsync block recovery for small block sizes (CVSS 7.8, Linux)
- [CVE-2024-26696](https://cve.now/CVE-2024-26696.md): nilfs2: fix hang in nilfs\_lookup\_dirty\_data\_buffers() (no CVSS, Linux)
- [CVE-2024-26695](https://cve.now/CVE-2024-26695.md): crypto: ccp - Fix null pointer dereference in \_\_sev\_platform\_shutdown\_locked (no CVSS, Linux)
- [CVE-2024-26694](https://cve.now/CVE-2024-26694.md): wifi: iwlwifi: fix double-free bug (no CVSS, Linux)
- [CVE-2024-26693](https://cve.now/CVE-2024-26693.md): wifi: iwlwifi: mvm: fix a crash when we run out of stations (no CVSS, Linux)
- [CVE-2024-26692](https://cve.now/CVE-2024-26692.md): smb: Fix regression in writes when non-standard maximum write size negotiated (CVSS 8.3, Linux)
- [CVE-2024-26691](https://cve.now/CVE-2024-26691.md): KVM: arm64: Fix circular locking dependency (no CVSS, Linux)
- [CVE-2024-26690](https://cve.now/CVE-2024-26690.md): net: stmmac: protect updates of 64-bit statistics counters (CVSS 7.5, Linux)
- [CVE-2024-26689](https://cve.now/CVE-2024-26689.md): ceph: prevent use-after-free in encode\_cap\_msg() (CVSS 8.8, Linux)
- [CVE-2024-26688](https://cve.now/CVE-2024-26688.md): fs,hugetlb: fix NULL pointer dereference in hugetlbs\_fill\_super (no CVSS, Linux)
- [CVE-2024-26687](https://cve.now/CVE-2024-26687.md): xen/events: close evtchn after mapping cleanup (no CVSS, Linux)
- [CVE-2024-26686](https://cve.now/CVE-2024-26686.md): fs/proc: do\_task\_stat: use sig-\>stats\_lock to gather the threads/children stats (no CVSS, Linux)
- [CVE-2024-26685](https://cve.now/CVE-2024-26685.md): nilfs2: fix potential bug in end\_buffer\_async\_write (CVSS 5.5, Linux)
- [CVE-2023-52639](https://cve.now/CVE-2023-52639.md): KVM: s390: vsie: fix race during shadow creation (no CVSS, Linux)
- [CVE-2023-52638](https://cve.now/CVE-2023-52638.md): can: j1939: prevent deadlock by changing j1939\_socks\_lock to rwlock (no CVSS, Linux)
- [CVE-2023-52637](https://cve.now/CVE-2023-52637.md): can: j1939: Fix UAF in j1939\_sk\_match\_filter during setsockopt(SO\_J1939\_FILTER) (CVSS 7.8, Linux)
- [CVE-2024-31420](https://cve.now/CVE-2024-31420.md): Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashes (CVSS 6.5, cnv · Red Hat OpenShift Virtualization +1)
- [CVE-2024-31419](https://cve.now/CVE-2024-31419.md): Cnv: information disclosure through the usage of vm-dump-metrics (CVSS 4.3, cnv · Red Hat OpenShift Virtualization)
- [CVE-2024-24976](https://cve.now/CVE-2024-24976.md): A denial of service vulnerability exists in the OAS Engine File Data Source Configuration functionality of Open Automation Software OAS… (CVSS 4.9, Open Automation Software OAS Platform)
- [CVE-2024-27201](https://cve.now/CVE-2024-27201.md): An improper input validation vulnerability exists in the OAS Engine User Configuration functionality of Open Automation Software OAS… (CVSS 4.9, Open Automation Software OAS Platform)
- [CVE-2024-21870](https://cve.now/CVE-2024-21870.md): A file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Platform V19.00.0057. (CVSS 4.9, Open Automation Software OAS Platform)
- [CVE-2024-22178](https://cve.now/CVE-2024-22178.md): A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform… (CVSS 4.9, Open Automation Software OAS Platform)
- [CVE-2024-0394](https://cve.now/CVE-2024-0394.md): Rapid7 Minerva Armor Privilege Escalation (CVSS 7.8, Rapid7 Minerva)
- [CVE-2024-3259](https://cve.now/CVE-2024-3259.md): SourceCodester Internship Portal Management System delete\_activity.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-3258](https://cve.now/CVE-2024-3258.md): SourceCodester Internship Portal Management System add\_activity.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-3257](https://cve.now/CVE-2024-3257.md): SourceCodester Internship Portal Management System edit\_activity\_query.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-22360](https://cve.now/CVE-2024-22360.md): IBM Db2 for Linux, UNIX and Windows denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-3256](https://cve.now/CVE-2024-3256.md): SourceCodester Internship Portal Management System edit\_activity.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2023-52296](https://cve.now/CVE-2023-52296.md): IBM Db2 for Linux, UNIX and Windows denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-38729](https://cve.now/CVE-2023-38729.md): IBM Db2 information disclosure (CVSS 6.8, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-27254](https://cve.now/CVE-2024-27254.md): IBM Db2 for Linux, UNIX and Windows denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-25699](https://cve.now/CVE-2023-25699.md): WordPress VideoWhisper Live Streaming Integration plugin \<= 5.5.15 - Remote Code Execution (RCE) (CVSS 9.0, VideoWhisper.com VideoWhisper Live Streaming Integration)
- [CVE-2024-24707](https://cve.now/CVE-2024-24707.md): WordPress Cwicly plugin \<= 1.4.0.2 - Auth. Remote Code Execution (RCE) vulnerability (CVSS 9.9, Cwicly Builder, SL. Cwicly)
- [CVE-2024-25096](https://cve.now/CVE-2024-25096.md): WordPress canto plugin \<= 3.0.7 - Unauth. Remote Code Execution (RCE) vulnerability (CVSS 10.0, Canto)
- [CVE-2024-25046](https://cve.now/CVE-2024-25046.md): IBM Db2 for Linux, UNIX and Windows denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-25030](https://cve.now/CVE-2024-25030.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 stores potentially sensitive information in log files that could be… (CVSS 6.2, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-25918](https://cve.now/CVE-2024-25918.md): WordPress InstaWP Connect plugin \<= 0.1.0.8 - Remote Code Execution vulnerability (CVSS 9.9, InstaWP Connect)
- [CVE-2024-27191](https://cve.now/CVE-2024-27191.md): WordPress Slivery Extender plugin \<= 1.0.2 - Remote Code Execution (RCE) vulnerability (CVSS 8.5, inpersttion Slivery Extender)
- [CVE-2024-28782](https://cve.now/CVE-2024-28782.md): IBM QRadar Suite Software information disclosure (CVSS 6.3, IBM QRadar Suite Software · IBM Cloud Pak for Security)
- [CVE-2024-3255](https://cve.now/CVE-2024-3255.md): SourceCodester Internship Portal Management System edit\_admin\_query.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-3254](https://cve.now/CVE-2024-3254.md): SourceCodester Internship Portal Management System edit\_admin.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-27951](https://cve.now/CVE-2024-27951.md): WordPress Multiple Page Generator Plugin \<= 3.4.0 - Auth. Remote Code Execution (RCE) vulnerability (CVSS 9.1, Themeisle Multiple Page Generator Plugin – MPG)
- [CVE-2024-27972](https://cve.now/CVE-2024-27972.md): WordPress WP Fusion Lite plugin \<= 3.41.24 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, Jack Arturo WP Fusion Lite)
- [CVE-2024-31380](https://cve.now/CVE-2024-31380.md): WordPress Oxygen plugin \<= 4.9 - Authenticated Remote Code Execution (RCE) vulnerability (CVSS 9.9, Soflyy Oxygen Builder)
- [CVE-2024-31390](https://cve.now/CVE-2024-31390.md): WordPress Breakdance plugin \<= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability (CVSS 9.9, Soflyy Breakdance)
- [CVE-2024-3253](https://cve.now/CVE-2024-3253.md): SourceCodester Internship Portal Management System add\_admin.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-3252](https://cve.now/CVE-2024-3252.md): SourceCodester Internship Portal Management System check\_admin.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-3251](https://cve.now/CVE-2024-3251.md): SourceCodester Computer Laboratory Management System sql injection (CVSS 6.3, SourceCodester Computer Laboratory Management System)
- [CVE-2024-0172](https://cve.now/CVE-2024-0172.md): Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. (CVSS 7.9, Dell PowerEdge Platform)
- [CVE-2024-29734](https://cve.now/CVE-2024-29734.md): Uncontrolled search path element issue exists in SonicDICOM Media Viewer 2.3.2 and earlier, which may lead to insecurely loading Dynamic… (CVSS 7.8, Fujidenolo Solutions Co. SonicDICOM Media Viewer)
- [CVE-2023-35764](https://cve.now/CVE-2023-35764.md): Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an… (CVSS 5.3, AYS Pro Plugins Survey Maker)
- [CVE-2023-34423](https://cve.now/CVE-2023-34423.md): Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. (CVSS 6.1, AYS Pro Plugins Survey Maker)
- [CVE-2024-2322](https://cve.now/CVE-2024-2322.md): WooCommerce Cart Abandonment Recovery \< 1.2.27 - Templates/Abandoned Orders Deletion via CSRF (CVSS 6.8, WooCommerce Cart Abandonment Recovery)
- [CVE-2024-2879](https://cve.now/CVE-2024-2879.md): The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls\_get\_popup\_markup action in versions 7.9.11 and 7.10.0 due… (CVSS 9.8, LayerSlider)
- [CVE-2024-3162](https://cve.now/CVE-2024-3162.md): Jeg Elementor Kit \<= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2024-1327](https://cve.now/CVE-2024-1327.md): Jeg Elementor Kit \<= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2024-3227](https://cve.now/CVE-2024-3227.md): Panwei eoffice OA Backend save\_image.php path traversal (CVSS 4.7, Panwei eoffice OA)
- [CVE-2024-3226](https://cve.now/CVE-2024-3226.md): Campcodes Online Patient Record Management System login.php sql injection (CVSS 7.3, Campcodes Online Patient Record Management System)
- [CVE-2024-3225](https://cve.now/CVE-2024-3225.md): SourceCodester PHP Task Management System edit-task.php sql injection (CVSS 6.3, SourceCodester PHP Task Management System)
- [CVE-2024-3224](https://cve.now/CVE-2024-3224.md): SourceCodester PHP Task Management System task-details.php sql injection (CVSS 6.3, SourceCodester PHP Task Management System)
- [CVE-2024-3223](https://cve.now/CVE-2024-3223.md): SourceCodester PHP Task Management System admin-manage-user.php sql injection (CVSS 6.3, SourceCodester PHP Task Management System)
- [CVE-2024-3222](https://cve.now/CVE-2024-3222.md): SourceCodester PHP Task Management System admin-password-change.php sql injection (CVSS 6.3, SourceCodester PHP Task Management System)
- [CVE-2024-3221](https://cve.now/CVE-2024-3221.md): SourceCodester PHP Task Management System attendance-info.php sql injection (CVSS 6.3, SourceCodester PHP Task Management System)
- [CVE-2021-27312](https://cve.now/CVE-2021-27312.md): Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code and obtain… (CVSS 9.4, gleez/cms)
- [CVE-2023-35812](https://cve.now/CVE-2023-35812.md): An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for… (CVSS 5.3)
- [CVE-2023-44038](https://cve.now/CVE-2023-44038.md): In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users… (CVSS 6.5)
- [CVE-2023-44039](https://cve.now/CVE-2023-44039.md): In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is… (CVSS 9.1)
- [CVE-2023-44040](https://cve.now/CVE-2023-44040.md): In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited… (CVSS 6.1)
- [CVE-2023-45552](https://cve.now/CVE-2023-45552.md): In VeridiumID before 3.5.0, a stored cross-site scripting (XSS) vulnerability has been discovered in the admin portal that allows an… (CVSS 6.5)
- [CVE-2023-52043](https://cve.now/CVE-2023-52043.md): An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point… (CVSS 8.1)
- [CVE-2024-24506](https://cve.now/CVE-2024-24506.md): Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute… (CVSS 6.1)
- [CVE-2024-24724](https://cve.now/CVE-2024-24724.md): Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code… (CVSS 9.8)
- [CVE-2024-25864](https://cve.now/CVE-2024-25864.md): Server Side Request Forgery (SSRF) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code… (CVSS 9.1)
- [CVE-2024-26495](https://cve.now/CVE-2024-26495.md): Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and… (CVSS 6.1)
- [CVE-2024-27674](https://cve.now/CVE-2024-27674.md): Macro Expert through 4.9.4 allows BUILTIN\\Users:(OI)(CI)(M) access to the "%PROGRAMFILES(X86)%\\GrassSoft\\Macro Expert" folder and thus an… (CVSS 7.8)
- [CVE-2024-27705](https://cve.now/CVE-2024-27705.md): Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the… (CVSS 7.6)
- [CVE-2024-27706](https://cve.now/CVE-2024-27706.md): Cross Site Scripting vulnerability in Huly Platform v.0.6.202 allows attackers to execute arbitrary code via upload of crafted SVG file to… (CVSS 6.1)
- [CVE-2024-28219](https://cve.now/CVE-2024-28219.md): In \_imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. (CVSS 6.7, pillow)
- [CVE-2024-28275](https://cve.now/CVE-2024-28275.md): Puwell Cloud Tech Co, Ltd 360Eyes Pro v3.9.5.16(3090516) was discovered to transmit sensitive information in cleartext. (CVSS 6.5)
- [CVE-2024-28515](https://cve.now/CVE-2024-28515.md): Buffer Overflow vulnerability in CSAPP\_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of… (CVSS 9.8)
- [CVE-2024-28589](https://cve.now/CVE-2024-28589.md): An issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute… (CVSS 6.7)
- [CVE-2024-28755](https://cve.now/CVE-2024-28755.md): An issue was discovered in Mbed TLS 3.5.x before 3.6.0. (CVSS 6.5)
- [CVE-2024-28836](https://cve.now/CVE-2024-28836.md): An issue was discovered in Mbed TLS 3.5.x before 3.6.0. (CVSS 5.4)
- [CVE-2024-29413](https://cve.now/CVE-2024-29413.md): Cross Site Scripting vulnerability in Webasyst v.2.9.9 allows a remote attacker to run arbitrary code via the Instant messenger field in… (CVSS 5.4)
- [CVE-2024-29477](https://cve.now/CVE-2024-29477.md): Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the… (CVSS 8.8, dolibarr/dolibarr)
- [CVE-2024-30166](https://cve.now/CVE-2024-30166.md): In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a… (CVSS 9.1)
- [CVE-2024-30568](https://cve.now/CVE-2024-30568.md): Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter. (CVSS 9.8)
- [CVE-2024-30569](https://cve.now/CVE-2024-30569.md): An information leak in currentsetting.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any… (CVSS 7.5)
- [CVE-2024-30570](https://cve.now/CVE-2024-30570.md): An information leak in debuginfo.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any… (CVSS 5.3)
- [CVE-2024-30571](https://cve.now/CVE-2024-30571.md): An information leak in the BRS\_top.html component of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any… (CVSS 7.5)
- [CVE-2024-30572](https://cve.now/CVE-2024-30572.md): Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntp\_server parameter. (CVSS 8.0)
- [CVE-2024-30998](https://cve.now/CVE-2024-30998.md): SQL Injection vulnerability in PHPGurukul Men Salon Management System v.2.0, allows remote attackers to execute arbitrary code and obtain… (CVSS 9.8)
- [CVE-2024-31008](https://cve.now/CVE-2024-31008.md): An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the… (CVSS 6.5)
- [CVE-2024-31009](https://cve.now/CVE-2024-31009.md): SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid parameter in Banner.php. (CVSS 6.5)
- [CVE-2024-31010](https://cve.now/CVE-2024-31010.md): SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php. (CVSS 7.5)
- [CVE-2024-31011](https://cve.now/CVE-2024-31011.md): Arbitrary file write vulnerability in beescms v.4.0, allows a remote attacker to execute arbitrary code via a file path that was not… (CVSS 9.8)
- [CVE-2024-31012](https://cve.now/CVE-2024-31012.md): An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive… (CVSS 9.8)
- [CVE-2024-31013](https://cve.now/CVE-2024-31013.md): Cross Site Scripting (XSS) vulnerability in emlog version Pro 2.3, allow remote attackers to execute arbitrary code via a crafted payload… (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2024-04-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.