# CVEs published 2024-03-02

69 CVEs were published on March 2, 2024: 1 critical, 15 high. Days are UTC.

- [CVE-2024-2133](https://cve.now/CVE-2024-2133.md): Bdtask Isshue Multi Store eCommerce Shopping Cart Solution Manage Sale Page manage\_invoice cross site scripting (CVSS 2.4, Bdtask Isshue Multi Store eCommerce Shopping Cart Solution)
- [CVE-2023-52582](https://cve.now/CVE-2023-52582.md): netfs: Only call folio\_start\_fscache() one time for each folio (no CVSS, Linux)
- [CVE-2023-52581](https://cve.now/CVE-2023-52581.md): netfilter: nf\_tables: fix memleak when more than 255 elements expired (CVSS 6.3, Linux)
- [CVE-2023-52580](https://cve.now/CVE-2023-52580.md): net/core: Fix ETH\_P\_1588 flow dissector (no CVSS, Linux)
- [CVE-2023-52578](https://cve.now/CVE-2023-52578.md): net: bridge: use DEV\_STATS\_INC() (no CVSS, Linux)
- [CVE-2023-52577](https://cve.now/CVE-2023-52577.md): dccp: fix dccp\_v4\_err()/dccp\_v6\_err() again (no CVSS, Linux)
- [CVE-2023-52576](https://cve.now/CVE-2023-52576.md): x86/mm, kexec, ima: Use memblock\_free\_late() from ima\_free\_kexec\_buffer() (CVSS 5.5, Linux)
- [CVE-2023-52574](https://cve.now/CVE-2023-52574.md): team: fix null-ptr-deref when team device type is changed (CVSS 7.8, Linux)
- [CVE-2023-52573](https://cve.now/CVE-2023-52573.md): net: rds: Fix possible NULL-pointer dereference (no CVSS, Linux)
- [CVE-2023-52572](https://cve.now/CVE-2023-52572.md): cifs: Fix UAF in cifs\_demultiplex\_thread() (CVSS 7.8, Linux)
- [CVE-2023-52571](https://cve.now/CVE-2023-52571.md): power: supply: rk817: Fix node refcount leak (CVSS 7.1, Linux)
- [CVE-2023-52570](https://cve.now/CVE-2023-52570.md): vfio/mdev: Fix a null-ptr-deref bug for mdev\_unregister\_parent() (no CVSS, Linux)
- [CVE-2023-52569](https://cve.now/CVE-2023-52569.md): btrfs: remove BUG() after failure to insert delayed dir index item (no CVSS, Linux)
- [CVE-2023-52568](https://cve.now/CVE-2023-52568.md): x86/sgx: Resolves SECS reclaim vs. page fault for EAUG race (no CVSS, Linux)
- [CVE-2023-52567](https://cve.now/CVE-2023-52567.md): serial: 8250\_port: Check IRQ data before use (no CVSS, Linux)
- [CVE-2023-52566](https://cve.now/CVE-2023-52566.md): nilfs2: fix potential use after free in nilfs\_gccache\_submit\_read\_data() (CVSS 5.5, Linux)
- [CVE-2023-52565](https://cve.now/CVE-2023-52565.md): media: uvcvideo: Fix OOB read (CVSS 7.1, Linux)
- [CVE-2023-52564](https://cve.now/CVE-2023-52564.md): Revert "tty: n\_gsm: fix UAF in gsm\_cleanup\_mux" (no CVSS, Linux)
- [CVE-2023-52563](https://cve.now/CVE-2023-52563.md): drm/meson: fix memory leak on -\>hpd\_notify callback (no CVSS, Linux)
- [CVE-2023-52562](https://cve.now/CVE-2023-52562.md): mm/slab\_common: fix slab\_caches list corruption after kmem\_cache\_destroy() (no CVSS, Linux)
- [CVE-2023-52561](https://cve.now/CVE-2023-52561.md): arm64: dts: qcom: sdm845-db845c: Mark cont splash memory region as reserved (CVSS 5.5, Linux)
- [CVE-2023-52560](https://cve.now/CVE-2023-52560.md): mm/damon/vaddr-test: fix memory leak in damon\_do\_test\_apply\_three\_regions() (no CVSS, Linux)
- [CVE-2023-52559](https://cve.now/CVE-2023-52559.md): iommu/vt-d: Avoid memory allocation in iommu\_suspend() (no CVSS, Linux)
- [CVE-2023-52518](https://cve.now/CVE-2023-52518.md): Bluetooth: hci\_codec: Fix leaking content of local\_codecs (CVSS 5.5, Linux)
- [CVE-2023-52532](https://cve.now/CVE-2023-52532.md): net: mana: Fix TX CQE error handling (no CVSS, Linux)
- [CVE-2023-52531](https://cve.now/CVE-2023-52531.md): wifi: iwlwifi: mvm: Fix a memory corruption issue (no CVSS, Linux)
- [CVE-2023-52530](https://cve.now/CVE-2023-52530.md): wifi: mac80211: fix potential key use-after-free (CVSS 8.8, Linux)
- [CVE-2023-52529](https://cve.now/CVE-2023-52529.md): HID: sony: Fix a potential memory leak in sony\_probe() (CVSS 6.0, Linux)
- [CVE-2023-52528](https://cve.now/CVE-2023-52528.md): net: usb: smsc75xx: Fix uninit-value access in \_\_smsc75xx\_read\_reg (no CVSS, Linux)
- [CVE-2023-52527](https://cve.now/CVE-2023-52527.md): ipv4, ipv6: Fix handling of transhdrlen in \_\_ip{,6}\_append\_data() (no CVSS, Linux)
- [CVE-2023-52526](https://cve.now/CVE-2023-52526.md): erofs: fix memory leak of LZMA global compressed deduplication (no CVSS, Linux)
- [CVE-2023-52525](https://cve.now/CVE-2023-52525.md): wifi: mwifiex: Fix oob check condition in mwifiex\_process\_rx\_packet (no CVSS, Linux)
- [CVE-2023-52524](https://cve.now/CVE-2023-52524.md): net: nfc: llcp: Add lock when modifying device list (no CVSS, Linux)
- [CVE-2023-52523](https://cve.now/CVE-2023-52523.md): bpf, sockmap: Reject sk\_msg egress redirects to non-TCP sockets (CVSS 7.8, Linux)
- [CVE-2023-52522](https://cve.now/CVE-2023-52522.md): net: fix possible store tearing in neigh\_periodic\_work() (CVSS 8.8, Linux)
- [CVE-2023-52520](https://cve.now/CVE-2023-52520.md): platform/x86: think-lmi: Fix reference leak (no CVSS, Linux)
- [CVE-2023-52519](https://cve.now/CVE-2023-52519.md): HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit (no CVSS, Linux)
- [CVE-2023-52517](https://cve.now/CVE-2023-52517.md): spi: sun6i: fix race between DMA RX transfer completion and RX FIFO drain (CVSS 7.8, Linux)
- [CVE-2023-52516](https://cve.now/CVE-2023-52516.md): dma-debug: don't call \_\_dma\_entry\_alloc\_check\_leak() under free\_entries\_lock (no CVSS, Linux)
- [CVE-2023-52515](https://cve.now/CVE-2023-52515.md): RDMA/srp: Do not call scsi\_done() from srp\_abort() (CVSS 9.8, Linux)
- [CVE-2023-52513](https://cve.now/CVE-2023-52513.md): RDMA/siw: Fix connection failure handling (CVSS 7.5, Linux)
- [CVE-2023-52512](https://cve.now/CVE-2023-52512.md): pinctrl: nuvoton: wpcm450: fix out of bounds write (CVSS 5.5, Linux)
- [CVE-2023-52511](https://cve.now/CVE-2023-52511.md): spi: sun6i: reduce DMA RX transfer width to single byte (CVSS 5.3, Linux)
- [CVE-2023-52510](https://cve.now/CVE-2023-52510.md): ieee802154: ca8210: Fix a potential UAF in ca8210\_probe (no CVSS, Linux)
- [CVE-2023-52509](https://cve.now/CVE-2023-52509.md): ravb: Fix use-after-free issue in ravb\_tx\_timeout\_work() (CVSS 7.8, Linux)
- [CVE-2023-52508](https://cve.now/CVE-2023-52508.md): nvme-fc: Prevent null pointer dereference in nvme\_fc\_io\_getuuid() (CVSS 5.5, Linux)
- [CVE-2023-52507](https://cve.now/CVE-2023-52507.md): nfc: nci: assert requested protocol is valid (no CVSS, Linux)
- [CVE-2023-52506](https://cve.now/CVE-2023-52506.md): LoongArch: Set all reserved memblocks on Node#0 at initialization (no CVSS, Linux)
- [CVE-2023-52505](https://cve.now/CVE-2023-52505.md): phy: lynx-28g: serialize concurrent phy\_set\_mode\_ext() calls to shared registers (no CVSS, Linux)
- [CVE-2023-52504](https://cve.now/CVE-2023-52504.md): x86/alternatives: Disable KASAN in apply\_alternatives() (no CVSS, Linux)
- [CVE-2023-52503](https://cve.now/CVE-2023-52503.md): tee: amdtee: fix use-after-free vulnerability in amdtee\_close\_session (CVSS 7.8, Linux)
- [CVE-2023-52502](https://cve.now/CVE-2023-52502.md): net: nfc: fix races in nfc\_llcp\_sock\_get() and nfc\_llcp\_sock\_get\_sn() (CVSS 8.8, Linux)
- [CVE-2023-52501](https://cve.now/CVE-2023-52501.md): ring-buffer: Do not attempt to read past "commit" (no CVSS, Linux)
- [CVE-2023-52500](https://cve.now/CVE-2023-52500.md): scsi: pm80xx: Avoid leaking tags when processing OPC\_INB\_SET\_CONTROLLER\_CONFIG command (no CVSS, Linux)
- [CVE-2023-52499](https://cve.now/CVE-2023-52499.md): powerpc/47x: Fix 47x syscall return crash (no CVSS, Linux)
- [CVE-2022-48628](https://cve.now/CVE-2022-48628.md): ceph: drop messages from MDS when unmounting (no CVSS, Linux)
- [CVE-2024-26621](https://cve.now/CVE-2024-26621.md): mm: huge\_memory: don't force huge page alignment on 32 bit (CVSS 8.2, Linux)
- [CVE-2022-48627](https://cve.now/CVE-2022-48627.md): vt: fix memory overlapping when deleting chars in the buffer (CVSS 5.5, Linux)
- [CVE-2024-0795](https://cve.now/CVE-2024-0795.md): Create user API role not enforced (CVSS 7.2, mintplex-labs/anything-llm)
- [CVE-2024-1398](https://cve.now/CVE-2024-1398.md): Ultimate Bootstrap Elements for Elementor \<= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, g5theme Ultimate Bootstrap Elements for Elementor)
- [CVE-2024-1449](https://cve.now/CVE-2024-1449.md): Master Slider – Responsive Touch Slider \<= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, averta Master Slider – Responsive Touch Slider)
- [CVE-2024-0611](https://cve.now/CVE-2024-0611.md): Master Slider – Responsive Touch Slider \<= 3.9.9 - Authenticated(Editor+) Stored Cross-Site Scripting via slider callback (CVSS 4.4, averta Master Slider – Responsive Touch Slider)
- [CVE-2023-6326](https://cve.now/CVE-2023-6326.md): Master Slider - Responsive Touch Slider \<= 3.9.10 - Cross-Site Request Forgery via process\_bulk\_action (CVSS 5.4, averta Master Slider – Responsive Touch Slider)
- [CVE-2024-0378](https://cve.now/CVE-2024-0378.md): AI Engine \<= 2.2.0 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.5, tigroumeow AI Engine – The Chatbot, AI Framework & MCP for…)
- [CVE-2024-1775](https://cve.now/CVE-2024-1775.md): Nextend Social Login and Register \<= 3.1.12 - Reflected Self-Based Cross-Site Scripting via error\_description (CVSS 5.4, nextendweb Nextend Social Login and Register)
- [CVE-2024-1592](https://cve.now/CVE-2024-1592.md): Complianz – GDPR/CCPA Cookie Consent \<= 6.5.6 - Cross-Site Request Forgery to Data Request Deletion (CVSS 4.3, Complianz – GDPR/CCPA Cookie Consent)
- [CVE-2024-25064](https://cve.now/CVE-2024-25064.md): Due to insufficient server-side validation, an attacker with login privileges could access certain resources that the attacker should not ha (CVSS 4.3, Hikvision HikCentral Professional)
- [CVE-2024-25063](https://cve.now/CVE-2024-25063.md): Due to insufficient server-side validation, a successful exploit of this vulnerability could allow an attacker to gain access to certain URL (CVSS 7.5, Hikvision HikCentral Professional)
- [CVE-2024-25865](https://cve.now/CVE-2024-25865.md): Cross Site Scripting (XSS) vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia se (CVSS 6.1, hexo-theme-anzhiyu)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.