# CVEs published 2024-03-01

122 CVEs were published on March 1, 2024: 11 critical, 36 high. Days are UTC.

- [CVE-2024-1869](https://cve.now/CVE-2024-1869.md): Certain HP DesignJet print products are potentially vulnerable to information disclosure related to accessing memory out-of-bounds when usin (CVSS 7.5, HP DesignJet)
- [CVE-2021-47081](https://cve.now/CVE-2021-47081.md): habanalabs/gaudi: Fix a potential use after free in gaudi\_memset\_device\_memory (CVSS 7.8, Linux)
- [CVE-2021-47080](https://cve.now/CVE-2021-47080.md): RDMA/core: Prevent divide-by-zero error triggered by the user (no CVSS, Linux)
- [CVE-2021-47079](https://cve.now/CVE-2021-47079.md): platform/x86: ideapad-laptop: fix a NULL pointer dereference (no CVSS, Linux)
- [CVE-2021-47078](https://cve.now/CVE-2021-47078.md): RDMA/rxe: Clear all QP fields if creation failed (CVSS 7.8, Linux)
- [CVE-2021-47077](https://cve.now/CVE-2021-47077.md): scsi: qedf: Add pointer checks in qedf\_update\_link\_speed() (no CVSS, Linux)
- [CVE-2021-47076](https://cve.now/CVE-2021-47076.md): RDMA/rxe: Return CQE error if invalid lkey was supplied (no CVSS, Linux)
- [CVE-2021-47075](https://cve.now/CVE-2021-47075.md): nvmet: fix memory leak in nvmet\_alloc\_ctrl() (CVSS 5.3, Linux)
- [CVE-2021-47074](https://cve.now/CVE-2021-47074.md): nvme-loop: fix memory leak in nvme\_loop\_create\_ctrl() (no CVSS, Linux)
- [CVE-2021-47073](https://cve.now/CVE-2021-47073.md): platform/x86: dell-smbios-wmi: Fix oops on rmmod dell\_smbios (no CVSS, Linux)
- [CVE-2021-47072](https://cve.now/CVE-2021-47072.md): btrfs: fix removed dentries still existing after log is synced (no CVSS, Linux)
- [CVE-2021-47071](https://cve.now/CVE-2021-47071.md): uio\_hv\_generic: Fix a memory leak in error handling paths (no CVSS, Linux)
- [CVE-2021-47070](https://cve.now/CVE-2021-47070.md): uio\_hv\_generic: Fix another memory leak in error handling paths (CVSS 5.5, Linux)
- [CVE-2021-47069](https://cve.now/CVE-2021-47069.md): ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (CVSS 7.8, Linux)
- [CVE-2024-27101](https://cve.now/CVE-2024-27101.md): Integer overflow in chunking helper causes dispatching to miss elements or panic (CVSS 7.3, authzed spicedb · github.com/authzed/spicedb)
- [CVE-2024-23492](https://cve.now/CVE-2024-23492.md): Commend WS203VICM Weak Encoding for Password (CVSS 5.7, Commend WS203VICM)
- [CVE-2024-21767](https://cve.now/CVE-2024-21767.md): Commend WS203VICM Improper Access Control (CVSS 9.4, Commend WS203VICM)
- [CVE-2024-22182](https://cve.now/CVE-2024-22182.md): Commend WS203VICM Argument Injection (CVSS 8.6, Commend WS203VICM)
- [CVE-2024-20328](https://cve.now/CVE-2024-20328.md): ClamAV VirusEvent File Processing Command Injection Vulnerability (CVSS 5.3, Cisco ClamAV)
- [CVE-2023-7242](https://cve.now/CVE-2023-7242.md): Ethercat Zeek Plugin Out-of-bounds Read (CVSS 8.2, CISA Industrial Control Systems Network Protocol Parsers (I…)
- [CVE-2023-7243](https://cve.now/CVE-2023-7243.md): Ethercat Zeek Plugin Out-of-bounds Write (CVSS 9.8, CISA Industrial Control Systems Network Protocol Parsers (I…)
- [CVE-2023-7244](https://cve.now/CVE-2023-7244.md): Ethercat Zeek Plugin Out-of-bounds Write (CVSS 9.8, CISA Industrial Control Systems Network Protocol Parsers (I…)
- [CVE-2024-1174](https://cve.now/CVE-2024-1174.md): Previous versions of HP ThinPro (prior to HP ThinPro 8.0 SP 8) could potentially contain security vulnerabilities. (CVSS 8.2, HP ThinPro)
- [CVE-2024-1453](https://cve.now/CVE-2024-1453.md): Santesoft Sante DICOM Viewer Pro Out-of-Bounds Read (CVSS 7.8, Santesoft Sante DICOM Viewer Pro)
- [CVE-2024-2077](https://cve.now/CVE-2024-2077.md): SourceCodester Simple Online Bidding System index.php sql injection (CVSS 6.3, SourceCodester Simple Online Bidding System)
- [CVE-2024-2076](https://cve.now/CVE-2024-2076.md): CodeAstro House Rental Management System tenant.php missing authentication (CVSS 5.3, CodeAstro House Rental Management System)
- [CVE-2024-2075](https://cve.now/CVE-2024-2075.md): SourceCodester Daily Habit Tracker update-tracker.php cross site scripting (CVSS 3.5, SourceCodester Daily Habit Tracker)
- [CVE-2024-27298](https://cve.now/CVE-2024-27298.md): Parse Server literalizeRegexPart SQL Injection (CVSS 10.0, parse-community parse-server · parse-server)
- [CVE-2024-2074](https://cve.now/CVE-2024-2074.md): Mini-Tmall 1 sql injection (CVSS 6.3, Mini-Tmall)
- [CVE-2024-2073](https://cve.now/CVE-2024-2073.md): SourceCodester Block Inserter for Dynamic Content view\_post.php sql injection (CVSS 6.3, SourceCodester Block Inserter for Dynamic Content)
- [CVE-2024-2072](https://cve.now/CVE-2024-2072.md): SourceCodester Flashcard Quiz App update-flashcard.php cross site scripting (CVSS 3.5, SourceCodester Flashcard Quiz App)
- [CVE-2023-52558](https://cve.now/CVE-2023-52558.md): OpenBSD 7.4 and 7.3 m\_split() network buffer kernel crash (CVSS 7.5, OpenBSD)
- [CVE-2024-2071](https://cve.now/CVE-2024-2071.md): SourceCodester FAQ Management System Update FAQ cross site scripting (CVSS 3.5, SourceCodester FAQ Management System)
- [CVE-2023-52557](https://cve.now/CVE-2023-52557.md): OpenBSD 7.3 invalid l2tp message npppd crash (CVSS 7.5, OpenBSD)
- [CVE-2023-52556](https://cve.now/CVE-2023-52556.md): OpenBSD 7.4 pf state race condition kernel crash (CVSS 6.2, OpenBSD)
- [CVE-2024-2070](https://cve.now/CVE-2024-2070.md): SourceCodester FAQ Management System add-faq.php cross site scripting (CVSS 3.5, SourceCodester FAQ Management System)
- [CVE-2024-1624](https://cve.now/CVE-2024-1624.md): OS Command Injection vulnerability affecting documentation server on certain Releases of 3DEXPERIENCE, SIMULIA Abaqus, SIMULIA Isight and CATIA Composer (CVSS 9.4, Dassault Systèmes Documentation server)
- [CVE-2024-27296](https://cve.now/CVE-2024-27296.md): Directus version number disclosure (CVSS 5.3, directus)
- [CVE-2024-27138](https://cve.now/CVE-2024-27138.md): Apache Archiva: disabling user registration is not effective (CVSS 7.5, Apache Software Foundation Apache Archiva · org.apache.arch…)
- [CVE-2024-27139](https://cve.now/CVE-2024-27139.md): Apache Archiva: incorrect authentication potentially leading to account takeover (CVSS 7.5, Apache Software Foundation Apache Archiva · org.apache.arch…)
- [CVE-2024-27140](https://cve.now/CVE-2024-27140.md): Apache Archiva: reflected XSS (CVSS 5.4, Apache Software Foundation Apache Archiva · org.apache.arch…)
- [CVE-2024-27295](https://cve.now/CVE-2024-27295.md): Directus MySQL accent insensitive email matching (CVSS 8.2, directus)
- [CVE-2024-2069](https://cve.now/CVE-2024-2069.md): SourceCodester FAQ Management System delete-faq.php sql injection (CVSS 6.3, SourceCodester FAQ Management System)
- [CVE-2024-2068](https://cve.now/CVE-2024-2068.md): SourceCodester Computer Inventory System update-computer.php cross site scripting (CVSS 3.5, SourceCodester Computer Inventory System)
- [CVE-2024-2067](https://cve.now/CVE-2024-2067.md): SourceCodester Computer Inventory System delete-computer.php sql injection (CVSS 6.3, SourceCodester Computer Inventory System)
- [CVE-2023-50378](https://cve.now/CVE-2023-50378.md): Apache Ambari: Various XSS problems (CVSS 6.1, Apache Software Foundation Apache Ambari · org.apache.ambar…)
- [CVE-2024-2066](https://cve.now/CVE-2024-2066.md): SourceCodester Computer Inventory System add-computer.php cross site scripting (CVSS 2.4, SourceCodester Computer Inventory System)
- [CVE-2024-2065](https://cve.now/CVE-2024-2065.md): SourceCodester Barangay Population Monitoring System update-resident.php cross site scripting (CVSS 3.5, SourceCodester Barangay Population Monitoring System)
- [CVE-2024-0967](https://cve.now/CVE-2024-0967.md): OpenText / Micro Focus ArcSight Enterprise Security Manager Remote Vulnerability (CVSS 4.3, OpenText ArcSight Enterprise Security Manager)
- [CVE-2024-2064](https://cve.now/CVE-2024-2064.md): rahman SelectCours Template CacheController.java getCacheNames injection (CVSS 4.3, rahman SelectCours)
- [CVE-2024-24903](https://cve.now/CVE-2024-24903.md): Dell Secure Connect Gateway (SCG) Policy Manager, version 5.10+, contain a weak password recovery mechanism for forgotten passwords. (CVSS 8.0, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2024-24904](https://cve.now/CVE-2024-24904.md): Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. (CVSS 7.6, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2024-24905](https://cve.now/CVE-2024-24905.md): Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability. (CVSS 7.6, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2024-24907](https://cve.now/CVE-2024-24907.md): Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in the Filters page. (CVSS 7.6, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2024-24906](https://cve.now/CVE-2024-24906.md): Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain(s) a Stored Cross-Site Scripting Vulnerability in Policy page. (CVSS 7.6, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2024-2063](https://cve.now/CVE-2024-2063.md): SourceCodester Petrol Pump Management Software profile\_crud.php cross site scripting (CVSS 2.4, SourceCodester Petrol Pump Management Software)
- [CVE-2024-2062](https://cve.now/CVE-2024-2062.md): SourceCodester Petrol Pump Management Software edit\_categories.php sql injection (CVSS 4.7, SourceCodester Petrol Pump Management Software)
- [CVE-2024-24900](https://cve.now/CVE-2024-24900.md): Dell Secure Connect Gateway (SCG) Policy Manager, all versions, contain an improper authorization vulnerability. (CVSS 5.8, Dell Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2023-39254](https://cve.now/CVE-2023-39254.md): Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. (CVSS 6.7, Dell DUP Framework)
- [CVE-2023-48674](https://cve.now/CVE-2023-48674.md): Dell Platform BIOS contains an Improper Null Termination vulnerability. (CVSS 6.8, Dell CPG BIOS)
- [CVE-2024-2061](https://cve.now/CVE-2024-2061.md): SourceCodester Petrol Pump Management Software edit\_supplier.php sql injection (CVSS 4.7, SourceCodester Petrol Pump Management Software)
- [CVE-2024-2060](https://cve.now/CVE-2024-2060.md): SourceCodester Petrol Pump Management Software login\_crud.php sql injection (CVSS 4.7, SourceCodester Petrol Pump Management Software)
- [CVE-2024-2059](https://cve.now/CVE-2024-2059.md): SourceCodester Petrol Pump Management Software service\_crud.php unrestricted upload (CVSS 4.7, SourceCodester Petrol Pump Management Software)
- [CVE-2024-2057](https://cve.now/CVE-2024-2057.md): LangChain langchain\_community TFIDFRetriever tfidf.py load\_local server-side request forgery (CVSS 6.3, langchain\_community · langchain-community)
- [CVE-2024-2078](https://cve.now/CVE-2024-2078.md): Cross-Site Scripting vulnerability in HelpDeskZ (CVSS 4.6, HelpDeskZ)
- [CVE-2024-26280](https://cve.now/CVE-2024-26280.md): Apache Airflow: Overly broad default permissions for Viewer/Ops (audit logs) (CVSS 4.7, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-22457](https://cve.now/CVE-2024-22457.md): Dell Secure Connect Gateway 5.20 contains an improper authentication vulnerability during the SRS to SCG update path. (CVSS 7.1, Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS)
- [CVE-2024-22458](https://cve.now/CVE-2024-22458.md): Dell Secure Connect Gateway, 5.18, contains an Inadequate Encryption Strength Vulnerability. (CVSS 3.7, Dell Secure Connect Gateway (SCG) 5.0 Appliance - SRS)
- [CVE-2024-2058](https://cve.now/CVE-2024-2058.md): SourceCodester Petrol Pump Management Software product.php unrestricted upload (CVSS 4.7, SourceCodester Petrol Pump Management Software)
- [CVE-2024-1120](https://cve.now/CVE-2024-1120.md): NextMove Lite – Thank You Page for WooCommerce & Finale Lite – Sales Countdown Timer & Discount for WooCommerce \<= 2.17.0 - Missing Authorization to Unauthenticated System Information Disclosure (CVSS 5.3, djeet Finale Lite – Sales Countdown Timer & Discount for Wo…)
- [CVE-2024-25972](https://cve.now/CVE-2024-25972.md): Initialization of a resource with an insecure default vulnerability in OET-213H-BTS1 sold in Japan by Atsumi Electric Co., Ltd. (CVSS 8.3, Zhejiang Uniview Technologies Co.,Ltd and Atsumi Electric C…)
- [CVE-2024-25091](https://cve.now/CVE-2024-25091.md): Protection mechanism failure issue exists in RevoWorks SCVX prior to scvimage4.10.21\_1013 (when using 'VirusChecker' or 'ThreatChecker' feat (CVSS 9.1, J's Communications Co. RevoWorks SCVX · J's Communications…)
- [CVE-2024-0692](https://cve.now/CVE-2024-0692.md): SolarWinds Security Event Manager Deserialization of Untrusted Data Remote Code Execution Vulnerability (CVSS 8.8, SolarWinds Security Event Manager)
- [CVE-2024-25552](https://cve.now/CVE-2024-25552.md): Wiesemann & Theis: Multiple products prone to unquoted search path (CVSS 7.8, W&T Com Redirector PnP · W&T Com Redirector Legacy +1)
- [CVE-2024-27950](https://cve.now/CVE-2024-27950.md): WordPress Sirv plugin \<= 7.2.0 - Broken Access Control vulnerability (CVSS 5.4, Sirv CDN and Image Hosting Sirv)
- [CVE-2024-27949](https://cve.now/CVE-2024-27949.md): WordPress Sirv plugin \<= 7.2.0 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.4, Sirv CDN and Image Hosting Sirv)
- [CVE-2024-1859](https://cve.now/CVE-2024-1859.md): Slider Responsive Slideshow – Image slider, Gallery slideshow \<= 1.3.8 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, awordpresslife Responsive Slideshow)
- [CVE-2023-50312](https://cve.now/CVE-2023-50312.md): IBM WebSphere Application Server Liberty information disclosure (CVSS 5.3, IBM WebSphere Application Server Liberty)
- [CVE-2023-38366](https://cve.now/CVE-2023-38366.md): IBM FileNet Content Manager directory traversal (CVSS 5.3, IBM Filenet Content Manager)
- [CVE-2023-47716](https://cve.now/CVE-2023-47716.md): IBM FileNet Content Manager privilege escalation (CVSS 6.3, IBM Filenet Content Manager)
- [CVE-2023-50324](https://cve.now/CVE-2023-50324.md): IBM Cognos Command Center information disclosure (CVSS 5.3, IBM Cognos Command Center)
- [CVE-2023-28949](https://cve.now/CVE-2023-28949.md): IBM Engineering Requirements Management cross-site request forgery (CVSS 6.5, IBM Engineering Requirements Management)
- [CVE-2023-50305](https://cve.now/CVE-2023-50305.md): IBM Engineering Requirements Management information disclosure (CVSS 5.1, IBM Engineering Requirements Management)
- [CVE-2023-28525](https://cve.now/CVE-2023-28525.md): IBM Engineering Requirements Management cross-site scripting (CVSS 4.8, IBM Engineering Requirements Management)
- [CVE-2024-25578](https://cve.now/CVE-2024-25578.md): MicroDicom DICOM Viewer Out-of-Bounds Write (CVSS 7.8, MicroDicom DICOM Viewer)
- [CVE-2024-22100](https://cve.now/CVE-2024-22100.md): MicroDicom DICOM Heap-based Buffer Overflow (CVSS 7.8, MicroDicom DICOM Viewer)
- [CVE-2024-1941](https://cve.now/CVE-2024-1941.md): Delta Electronics CNCSoft-B Stack-based Buffer Overflow (CVSS 7.8, Delta Electronics CNCSoft-B)
- [CVE-2024-2022](https://cve.now/CVE-2024-2022.md): Netentsec NS-ASG Application Security Gateway list\_ipAddressPolicy.php sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2023-46950](https://cve.now/CVE-2023-46950.md): Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted URL (CVSS 6.1, sidekiq-unique-jobs)
- [CVE-2023-46951](https://cve.now/CVE-2023-46951.md): Cross Site Scripting vulnerability in Contribsys Sidekiq v.6.5.8 allows a remote attacker to obtain sensitive information via a crafted payl (CVSS 6.1, sidekiq-unique-jobs)
- [CVE-2023-49539](https://cve.now/CVE-2023-49539.md): Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms\_ci/index.php/category. (CVSS 6.1)
- [CVE-2023-49540](https://cve.now/CVE-2023-49540.md): Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms\_ci/index.php/history. (CVSS 6.1)
- [CVE-2023-49543](https://cve.now/CVE-2023-49543.md): Incorrect access control in Book Store Management System v1 allows attackers to access unauthorized pages and execute administrative functio (CVSS 9.8)
- [CVE-2023-49544](https://cve.now/CVE-2023-49544.md): A local file inclusion (LFI) in Customer Support System v1 allows attackers to include internal PHP files and gain unauthorized acces via ma (CVSS 4.9)
- [CVE-2023-49545](https://cve.now/CVE-2023-49545.md): A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the applicat (CVSS 7.5)
- [CVE-2023-52555](https://cve.now/CVE-2023-52555.md): In mongo-express 1.0.2, /admin allows CSRF, as demonstrated by deletion of a Collection. (CVSS 6.1, mongo-express)
- [CVE-2024-22891](https://cve.now/CVE-2024-22891.md): Nteract v.0.28.0 was discovered to contain a remote code execution (RCE) vulnerability via the Markdown link. (CVSS 9.8, nteract)
- [CVE-2024-24511](https://cve.now/CVE-2024-24511.md): Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the Input Title component. (CVSS 6.1)
- [CVE-2024-24512](https://cve.now/CVE-2024-24512.md): Cross Site Scripting vulnerability in Pkp OJS v.3.4 allows an attacker to execute arbitrary code via the input subtitle component. (CVSS 6.1)
- [CVE-2024-25293](https://cve.now/CVE-2024-25293.md): mjml-app versions 3.0.4 and 3.1.0-beta were discovered to contain a remote code execution (RCE) via the href attribute. (CVSS 9.3)
- [CVE-2024-25386](https://cve.now/CVE-2024-25386.md): Directory Traversal vulnerability in DICOM® Connectivity Framework by laurelbridge before v.2.7.6b allows a remote attacker to execute arbit (CVSS 8.8)
- [CVE-2024-25434](https://cve.now/CVE-2024-25434.md): A cross-site scripting (XSS) vulnerability in Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTML via a crafted payload i (CVSS 5.4)
- [CVE-2024-25436](https://cve.now/CVE-2024-25436.md): A cross-site scripting (XSS) vulnerability in the Production module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTM (CVSS 6.1)
- [CVE-2024-25438](https://cve.now/CVE-2024-25438.md): A cross-site scripting (XSS) vulnerability in the Submission module of Pkp Ojs v3.3 allows attackers to execute arbitrary web scripts or HTM (CVSS 6.1)
- [CVE-2024-27354](https://cve.now/CVE-2024-27354.md): An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. (CVSS 7.5, phpseclib/phpseclib)
- [CVE-2024-27355](https://cve.now/CVE-2024-27355.md): An issue was discovered in phpseclib 1.x before 1.0.23, 2.x before 2.0.47, and 3.x before 3.0.36. (CVSS 7.5, phpseclib/phpseclib)
- [CVE-2024-27497](https://cve.now/CVE-2024-27497.md): Linksys E2000 Ver.1.0.06 build 1 is vulnerable to authentication bypass via the position.js file. (CVSS 8.8)
- [CVE-2024-27499](https://cve.now/CVE-2024-27499.md): Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option. (CVSS 6.5, bagisto/bagisto)
- [CVE-2024-27558](https://cve.now/CVE-2024-27558.md): Stupid Simple CMS 1.2.4 is vulnerable to Cross Site Scripting (XSS) within the blog title of the settings. (CVSS 6.1)
- [CVE-2024-27559](https://cve.now/CVE-2024-27559.md): Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /save\_settings.php (CVSS 6.3)
- [CVE-2024-27567](https://cve.now/CVE-2024-27567.md): LBT T300- T390 v2.2.1.8 were discovered to contain a stack overflow via the vpn\_client\_ip parameter in the config\_vpn\_pptp function. (CVSS 6.5)
- [CVE-2024-27568](https://cve.now/CVE-2024-27568.md): LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the apn\_name\_3g parameter in the setupEC20Apn function. (CVSS 6.5)
- [CVE-2024-27569](https://cve.now/CVE-2024-27569.md): LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the init\_nvram function. (CVSS 6.5)
- [CVE-2024-27570](https://cve.now/CVE-2024-27570.md): LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the generate\_conf\_router function. (CVSS 7.5)
- [CVE-2024-27571](https://cve.now/CVE-2024-27571.md): LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the makeCurRemoteApList function. (CVSS 7.5)
- [CVE-2024-27572](https://cve.now/CVE-2024-27572.md): LBT T300-T390 v2.2.1.8 were discovered to contain a stack overflow via the ApCliSsid parameter in the updateCurAPlist function. (CVSS 7.5)
- [CVE-2024-27689](https://cve.now/CVE-2024-27689.md): Stupid Simple CMS v1.2.4 was discovered to contain a Cross-Site Request Forgery (CSRF) via /update-article.php. (CVSS 8.8)
- [CVE-2024-27734](https://cve.now/CVE-2024-27734.md): A Cross Site Scripting vulnerability in CSZ CMS v.1.3.0 allows an attacker to execute arbitrary code via a crafted script to the Site Name f (CVSS 6.1)
- [CVE-2024-27743](https://cve.now/CVE-2024-27743.md): Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payloa (CVSS 6.1)
- [CVE-2024-27744](https://cve.now/CVE-2024-27744.md): Cross Site Scripting vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payloa (CVSS 6.1)
- [CVE-2024-27746](https://cve.now/CVE-2024-27746.md): SQL Injection vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to th (CVSS 9.8)
- [CVE-2024-27747](https://cve.now/CVE-2024-27747.md): File Upload vulnerability in Petrol Pump Mangement Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.