CVEs published March 1, 2024
122 CVEs were published on March 1, 2024: 11 critical, 36 high.
- Published
- 122
- Critical
- 11
- High
- 36
- Medium
- 58
- Low
- 9
- Unrated
- 8
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Linux
- 13
- Dell Secure Connect Gateway (SCG) Policy Manager
- 6
- SourceCodester Petrol Pump Management Software
- 6
- Apache Software Foundation Apache Archiva · org.apache.arch…
- 3
- CISA Industrial Control Systems Network Protocol Parsers (I…
- 3
- Commend WS203VICM
- 3
- IBM Engineering Requirements Management
- 3
- OpenBSD
- 3
- SourceCodester Computer Inventory System
- 3
- SourceCodester FAQ Management System
- 3
Critical 11
- CVE-2024-21767Commend WS203VICM Improper Access ControlCommend WS203VICM
- CVE-2023-7243Ethercat Zeek Plugin Out-of-bounds WriteCISA Industrial Control Systems Network Protocol Parsers (I…
- CVE-2023-7244Ethercat Zeek Plugin Out-of-bounds WriteCISA Industrial Control Systems Network Protocol Parsers (I…
- CVE-2024-27298Parse Server literalizeRegexPart SQL Injectionparse-community parse-server · parse-server
- CVE-2024-1624OS Command Injection vulnerability affecting documentation server on certain Releases of 3DEXPERIENCE, SIMULIA Abaqus, SIMULIA Isight and CATIA ComposerDassault Systèmes Documentation server
- CVE-2024-25091Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21_1013 (when using 'VirusChecker' or 'ThreatChecker' featJ's Communications Co. RevoWorks SCVX · J's Communications…
- CVE-2023-49543Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functio
- CVE-2024-22891Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link.nteract
- CVE-2024-25293mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute.
- CVE-2024-27746SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to th
- CVE-2024-27747File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the
High 36
- CVE-2024-1869Certain HP DesignJet print products are potentially vulnerable to information disclosure related to accessing memory out-of-bounds when usinHP DesignJet
- CVE-2021-47081habanalabs/gaudi: Fix a potential use after free in gaudi_memset_device_memoryLinux
- CVE-2021-47078RDMA/rxe: Clear all QP fields if creation failedLinux
- CVE-2021-47069ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiryLinux
- CVE-2024-27101Integer overflow in chunking helper causes dispatching to miss elements or panicauthzed spicedb · github.com/authzed/spicedb
- CVE-2024-22182Commend WS203VICM Argument InjectionCommend WS203VICM
- CVE-2023-7242Ethercat Zeek Plugin Out-of-bounds ReadCISA Industrial Control Systems Network Protocol Parsers (I…
- CVE-2024-1174Previous versions of HP ThinPro (prior to HP ThinPro 8.0 SP 8) could potentially contain security vulnerabilities.HP ThinPro
- CVE-2024-1453Santesoft Sante DICOM Viewer Pro Out-of-Bounds ReadSantesoft Sante DICOM Viewer Pro
- CVE-2023-52558OpenBSD 7.4 and 7.3 m_split() network buffer kernel crashOpenBSD
- CVE-2023-52557OpenBSD 7.3 invalid l2tp message npppd crashOpenBSD
- CVE-2024-27138Apache Archiva: disabling user registration is not effectiveApache Software Foundation Apache Archiva · org.apache.arch…
- CVE-2024-27139Apache Archiva: incorrect authentication potentially leading to account takeoverApache Software Foundation Apache Archiva · org.apache.arch…
- CVE-2024-27295Directus MySQL accent insensitive email matchingdirectus
- CVE-2024-24903Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords.Dell Secure Connect Gateway (SCG) Policy Manager
- CVE-2024-24904Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability.Dell Secure Connect Gateway (SCG) Policy Manager
- CVE-2024-24905Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability.Dell Secure Connect Gateway (SCG) Policy Manager
- CVE-2024-24907Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page.Dell Secure Connect Gateway (SCG) Policy Manager
- CVE-2024-24906Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page.Dell Secure Connect Gateway (SCG) Policy Manager
- CVE-2024-22457Dell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path.Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS
- CVE-2024-25972Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd.Zhejiang Uniview Technologies Co.,Ltd and Atsumi Electric C…
- CVE-2024-0692SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution VulnerabilitySolarWinds Security Event Manager
- CVE-2024-25552Wiesemann & Theis: Multiple products prone to unquoted search pathW&T Com Redirector PnP · W&T Com Redirector Legacy +1
- CVE-2024-1859Slider Responsive Slideshow – Image slider, Gallery slideshow <= 1.3.8 - Authenticated (Contributor+) PHP Object Injectionawordpresslife Responsive Slideshow
- CVE-2024-25578MicroDicom DICOM Viewer Out-of-Bounds WriteMicroDicom DICOM Viewer
- CVE-2024-22100MicroDicom DICOM Heap-based Buffer OverflowMicroDicom DICOM Viewer
- CVE-2024-1941Delta Electronics CNCSoft-B Stack-based Buffer OverflowDelta Electronics CNCSoft-B
- CVE-2023-49545A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the applicat
- CVE-2024-25386Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbit
- CVE-2024-27354An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36.phpseclib/phpseclib
- CVE-2024-27355An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36.phpseclib/phpseclib
- CVE-2024-27497Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file.
- CVE-2024-27570LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the generate_conf_router function.
- CVE-2024-27571LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the makeCurRemoteApList function.
- CVE-2024-27572LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the updateCurAPlist function.
- CVE-2024-27689Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via /update-article.php.
Medium, low and unrated 75
- CVE-2021-47080RDMA/core: Prevent divide-by-zero error triggered by the userLinux
- CVE-2021-47079platform/x86: ideapad-laptop: fix a NULL pointer dereferenceLinux
- CVE-2021-47077scsi: qedf: Add pointer checks in qedf_update_link_speed()Linux
- CVE-2021-47076RDMA/rxe: Return CQE error if invalid lkey was suppliedLinux
- CVE-2021-47075nvmet: fix memory leak in nvmet_alloc_ctrl()Linux
- CVE-2021-47074nvme-loop: fix memory leak in nvme_loop_create_ctrl()Linux
- CVE-2021-47073platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbiosLinux
- CVE-2021-47072btrfs: fix removed dentries still existing after log is syncedLinux
- CVE-2021-47071uio_hv_generic: Fix a memory leak in error handling pathsLinux
- CVE-2021-47070uio_hv_generic: Fix another memory leak in error handling pathsLinux
- CVE-2024-23492Commend WS203VICM Weak Encoding for PasswordCommend WS203VICM
- CVE-2024-20328ClamAV VirusEvent File Processing Command Injection VulnerabilityCisco ClamAV
- CVE-2024-2077SourceCodester Simple Online Bidding System index.php sql injectionSourceCodester Simple Online Bidding System
- CVE-2024-2076CodeAstro House Rental Management System tenant.php missing authenticationCodeAstro House Rental Management System
- CVE-2024-2075SourceCodester Daily Habit Tracker update-tracker.php cross site scriptingSourceCodester Daily Habit Tracker
- CVE-2024-2074Mini-Tmall 1 sql injectionMini-Tmall
- CVE-2024-2073SourceCodester Block Inserter for Dynamic Content view_post.php sql injectionSourceCodester Block Inserter for Dynamic Content
- CVE-2024-2072SourceCodester Flashcard Quiz App update-flashcard.php cross site scriptingSourceCodester Flashcard Quiz App
- CVE-2024-2071SourceCodester FAQ Management System Update FAQ cross site scriptingSourceCodester FAQ Management System
- CVE-2023-52556OpenBSD 7.4 pf state race condition kernel crashOpenBSD
- CVE-2024-2070SourceCodester FAQ Management System add-faq.php cross site scriptingSourceCodester FAQ Management System
- CVE-2024-27296Directus version number disclosuredirectus
- CVE-2024-27140Apache Archiva: reflected XSSApache Software Foundation Apache Archiva · org.apache.arch…
- CVE-2024-2069SourceCodester FAQ Management System delete-faq.php sql injectionSourceCodester FAQ Management System
- CVE-2024-2068SourceCodester Computer Inventory System update-computer.php cross site scriptingSourceCodester Computer Inventory System
- CVE-2024-2067SourceCodester Computer Inventory System delete-computer.php sql injectionSourceCodester Computer Inventory System
- CVE-2023-50378Apache Ambari: Various XSS problemsApache Software Foundation Apache Ambari · org.apache.ambar…
- CVE-2024-2066SourceCodester Computer Inventory System add-computer.php cross site scriptingSourceCodester Computer Inventory System
- CVE-2024-2065SourceCodester Barangay Population Monitoring System update-resident.php cross site scriptingSourceCodester Barangay Population Monitoring System
- CVE-2024-0967OpenText / Micro Focus ArcSight Enterprise Security Manager Remote VulnerabilityOpenText ArcSight Enterprise Security Manager
- CVE-2024-2064rahman SelectCours Template CacheController.java getCacheNames injectionrahman SelectCours
- CVE-2024-2063SourceCodester Petrol Pump Management Software profile_crud.php cross site scriptingSourceCodester Petrol Pump Management Software
- CVE-2024-2062SourceCodester Petrol Pump Management Software edit_categories.php sql injectionSourceCodester Petrol Pump Management Software
- CVE-2024-24900Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability.Dell Secure Connect Gateway (SCG) Policy Manager
- CVE-2023-39254Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability.Dell DUP Framework
- CVE-2023-48674Dell Platform BIOS contains an Improper Null Termination vulnerability.Dell CPG BIOS
- CVE-2024-2061SourceCodester Petrol Pump Management Software edit_supplier.php sql injectionSourceCodester Petrol Pump Management Software
- CVE-2024-2060SourceCodester Petrol Pump Management Software login_crud.php sql injectionSourceCodester Petrol Pump Management Software
- CVE-2024-2059SourceCodester Petrol Pump Management Software service_crud.php unrestricted uploadSourceCodester Petrol Pump Management Software
- CVE-2024-2057LangChain langchain_community TFIDFRetriever tfidf.py load_local server-side request forgerylangchain_community · langchain-community
- CVE-2024-2078Cross-Site Scripting vulnerability in HelpDeskZHelpDeskZ
- CVE-2024-26280Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs)Apache Software Foundation Apache Airflow · apache-airflow
- CVE-2024-22458Dell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability.Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS
- CVE-2024-2058SourceCodester Petrol Pump Management Software product.php unrestricted uploadSourceCodester Petrol Pump Management Software
- CVE-2024-1120NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce <= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosuredjeet Finale Lite – Sales Countdown Timer & Discount for Wo…
- CVE-2024-27950WordPress Sirv plugin <= 7.2.0 - Broken Access Control vulnerabilitySirv CDN and Image Hosting Sirv
- CVE-2024-27949WordPress Sirv plugin <= 7.2.0 - Server Side Request Forgery (SSRF) vulnerabilitySirv CDN and Image Hosting Sirv
- CVE-2023-50312IBM WebSphere Application Server Liberty information disclosureIBM WebSphere Application Server Liberty
- CVE-2023-38366IBM FileNet Content Manager directory traversalIBM Filenet Content Manager
- CVE-2023-47716IBM FileNet Content Manager privilege escalationIBM Filenet Content Manager
- CVE-2023-50324IBM Cognos Command Center information disclosureIBM Cognos Command Center
- CVE-2023-28949IBM Engineering Requirements Management cross-site request forgeryIBM Engineering Requirements Management
- CVE-2023-50305IBM Engineering Requirements Management information disclosureIBM Engineering Requirements Management
- CVE-2023-28525IBM Engineering Requirements Management cross-site scriptingIBM Engineering Requirements Management
- CVE-2024-2022Netentsec NS-ASG Application Security Gateway list_ipAddressPolicy.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2023-46950Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL sidekiq-unique-jobs
- CVE-2023-46951Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted paylsidekiq-unique-jobs
- CVE-2023-49539Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/category.
- CVE-2023-49540Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/history.
- CVE-2023-49544A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via ma
- CVE-2023-52555In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection.mongo-express
- CVE-2024-24511Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component.
- CVE-2024-24512Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component.
- CVE-2024-25434A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload i
- CVE-2024-25436A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTM
- CVE-2024-25438A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTM
- CVE-2024-27499Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option.bagisto/bagisto
- CVE-2024-27558Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings.
- CVE-2024-27559Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /save_settings.php
- CVE-2024-27567LBT T300- T390 v2.2.1.8 were discovered to contain a stack overflow via the vpn_client_ip parameter in the config_vpn_pptp function.
- CVE-2024-27568LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the apn_name_3g parameter in the setupEC20Apn function.
- CVE-2024-27569LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the init_nvram function.
- CVE-2024-27734A Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name f
- CVE-2024-27743Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payloa
- CVE-2024-27744Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payloa