CVEs published March 4, 2024
116 CVEs were published on March 4, 2024: 11 critical, 46 high. 2 are now in CISA KEV.
- Published
- 116
- Critical
- 11
- High
- 46
- Medium
- 38
- Low
- 6
- Unrated
- 15
- Now in CISA KEV
- 2
- Fix available
- 22
Most affected products
- Linux
- 26
- Qualcomm Snapdragon
- 22
- MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…
- 6
- OpenHarmony
- 5
- SourceCodester Online Mobile Management Store
- 3
- Arm Midgard GPU Kernel Driver · Arm Bifrost GPU Kernel D… +2
- 2
- Dell Digital Delivery
- 2
- Dell PowerScale OneFS
- 2
- IBM CICS TX Advanced
- 2
- JetBrains TeamCity
- 2
Critical 11
- CVE-2021-47107NFSD: Fix READDIR buffer overflowLinux
- CVE-2021-47103inet: fully convert sk->sk_rx_dst to RCU rulesLinux
- CVE-2024-27198In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possibleJetBrains TeamCity
- CVE-2023-43553Use of Out-of-range Pointer Offset in WLAN HOSTQualcomm Snapdragon
- CVE-2023-43552Use After Free in WLAN Host CommunicationQualcomm Snapdragon
- CVE-2023-28582Buffer Copy Without Checking Size of Input in Data ModemQualcomm Snapdragon
- CVE-2023-28578Improper Input Validation in ServicesQualcomm Snapdragon
- CVE-2024-20018In wlan driver, there is a possible out of bounds write due to improper input validation.MediaTek MT7615
- CVE-2024-20017In wlan service, there is a possible out of bounds write due to improper input validation.MediaTek MT6890, MT7915, MT7916, MT7981, MT7986
- CVE-2023-49547Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer_support/ajax.php?
- CVE-2023-49970Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer_support/ajax.php?a
High 46
- CVE-2024-1936The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird'sMozilla Thunderbird
- CVE-2024-2048Vault Cert Auth Method Did Not Correctly Validate Non-CA CertificatesHashiCorp Vault · github.com/hashicorp/vault
- CVE-2024-27889Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW).Arista Networks Arista Edge Threat Management - Arista NG F…
- CVE-2023-32331IBM Connect:Express for UNIX denial of serviceIBM Sterling Connect:Express for UNIX
- CVE-2021-47106netfilter: nf_tables: fix use-after-free in nft_set_catchall_destroy()Linux
- CVE-2021-47102net: marvell: prestera: fix incorrect structure accessLinux
- CVE-2021-47099veth: ensure skb entering GRO are not cloned.Linux
- CVE-2021-47094KVM: x86/mmu: Don't advance iterator after restart due to yieldingLinux
- CVE-2021-47087tee: optee: Fix incorrect page free bugLinux
- CVE-2021-47083pinctrl: mediatek: fix global-out-of-bounds issueLinux
- CVE-2021-47082tun: avoid double free in tun_free_netdevLinux
- CVE-2024-27199In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possibleJetBrains TeamCity
- CVE-2024-22463Dell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability.Dell PowerScale OneFS
- CVE-2024-22452Dell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access control vulnerability.Dell Display and Peripheral Manager
- CVE-2024-0155Dell Digital Delivery, versions prior to 5.2.0.0, contain a Use After Free Vulnerability.Dell Digital Delivery
- CVE-2024-0156Dell Digital Delivery, versions prior to 5.2.0.0, contain a Buffer Overflow Vulnerability.Dell Digital Delivery
- CVE-2023-6241Mali GPU Kernel Driver allows improper GPU memory processing operationsArm Midgard GPU Kernel Driver · Arm Bifrost GPU Kernel D… +2
- CVE-2023-43550Integer Overflow or Wraparound in Core ServicesQualcomm Snapdragon
- CVE-2023-43549Stack-based Buffer Overflow in WLAN HALQualcomm Snapdragon
- CVE-2023-43548Buffer Copy Without Checking Size of Input in VideoQualcomm Snapdragon
- CVE-2023-43547Use After Free in Automotive MultimediaQualcomm Snapdragon
- CVE-2023-43546Use After Free in Automotive MultimediaQualcomm Snapdragon
- CVE-2023-43541NULL Pointer Dereference in Windows GraphicsQualcomm Snapdragon
- CVE-2023-43540Buffer Copy Without Checking Size of Input in Bluetooth HOSTQualcomm Snapdragon
- CVE-2023-43539Buffer Over-read in WLAN FirmwareQualcomm Snapdragon
- CVE-2023-33105Configuration Issue in WLAN Host and FirmwareQualcomm Snapdragon
- CVE-2023-33104Improper input Validation in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2023-33103Improper Input Validation in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2023-33096Reachable Assertion in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2023-33095Reachable Assertion in Multi-Mode Call ProcessorQualcomm Snapdragon
- CVE-2023-33086Improper Release of Memory Before Removing Last Reference in Data ModemQualcomm Snapdragon
- CVE-2023-33084Improper Release of Memory Before Removing Last Reference in Data ModemQualcomm Snapdragon
- CVE-2023-33066Use of Out-of-range Pointer Offset in AudioQualcomm Snapdragon
- CVE-2023-6143Mali GPU Kernel Driver allows improper GPU memory processing operationsArm Midgard GPU Kernel Driver · Arm Bifrost GPU Kernel D… +2
- CVE-2023-4479Stored XSS Vulnerability in M-Files WebM-Files Web
- CVE-2024-20034In battery, there is a possible escalation of privilege due to a missing bounds check.MediaTek MT6761, MT6765, MT6768, MT6855, MT6895, MT8167, MT…
- CVE-2024-20029In wlan firmware, there is a possible out of bounds write due to improper input validation.MediaTek MT6985, MT6989, MT8678, MT8796
- CVE-2024-20027In da, there is a possible out of bounds write due to improper input validation.MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…
- CVE-2024-20005In da, there is a possible permission bypass due to a missing permission check.MediaTek MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT…
- CVE-2023-49546Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer_support/ajax.php.
- CVE-2023-49548Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer_support/ajax.php?
- CVE-2023-49968Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/manage_departme
- CVE-2024-25164iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download fu
- CVE-2024-25731The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a
- CVE-2024-27694FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the /system/share/ztree_category_edit.
- CVE-2024-27718SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information
Medium, low and unrated 59
- CVE-2023-41829An improper export vulnerability was reported in the Motorola Carrier Services application that could allow a malicious, local application tMotorola Phones
- CVE-2023-41827An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to injMotorola Phones
- CVE-2024-2168SourceCodester Online Tours & Travels Management System HTTP POST Request expense_category.php sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2024-1316Event Tickets and Registration < 5.8.1 - Contributor+ Arbitrary Events AccessEvent Tickets and Registration · Events Tickets Plus
- CVE-2024-1319Event Tickets Plus < 5.9.1 - Contributor+ Attendees Lists DisclosureEvents Tickets Plus
- CVE-2023-6068On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in some packets that should be denied being permitted and someArista Networks MOS
- CVE-2021-47108drm/mediatek: hdmi: Perform NULL pointer check for mtk_hdmi_confLinux
- CVE-2021-47105ice: xsk: return xsk buffers back to pool when cleaning the ringLinux
- CVE-2021-47104IB/qib: Fix memory leak in qib_user_sdma_queue_pkts()Linux
- CVE-2021-47101asix: fix uninit-value in asix_mdio_read()Linux
- CVE-2021-47100ipmi: Fix UAF when uninstall ipmi_si and ipmi_msghandler moduleLinux
- CVE-2021-47098hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculationsLinux
- CVE-2021-47097Input: elantech - fix stack out of bound access in elantech_change_report_id()Linux
- CVE-2021-47096ALSA: rawmidi - fix the uninitalized user_pversionLinux
- CVE-2021-47095ipmi: ssif: initialize ssif_info->client earlyLinux
- CVE-2021-47093platform/x86: intel_pmc_core: fix memleak on registration failureLinux
- CVE-2021-47092KVM: VMX: Always clear vmx->fail on emulation_requiredLinux
- CVE-2021-47091mac80211: fix locking in ieee80211_start_ap error pathLinux
- CVE-2021-47090mm/hwpoison: clear MF_COUNT_INCREASED before retrying get_any_page()Linux
- CVE-2021-47089kfence: fix memory leak when cat kfence objectsLinux
- CVE-2021-47088mm/damon/dbgfs: protect targets destructions with kdamond_lockLinux
- CVE-2021-47086phonet/pep: refuse to enable an unbound pipeLinux
- CVE-2023-38360IBM CICS TX cross-site scriptingIBM CICS TX Advanced
- CVE-2023-38362IBM CICS TX information disclosureIBM CICS TX Advanced
- CVE-2023-5451Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client downForcepoint Next Generation Firewall Security Management Cen…
- CVE-2022-43890IBM Security Verify Privilege On-Premises information disclosureIBM Security Verify Privilege On-Premises
- CVE-2024-24901Dell PowerScale OneFS 8.2.x through 9.6.0.x contain an insufficient logging vulnerability.Dell PowerScale OneFS
- CVE-2023-33090Buffer Over-read in AudioQualcomm Snapdragon
- CVE-2023-33078Buffer Over-read in DSP ServicesQualcomm Snapdragon
- CVE-2024-26622tomoyo: fix UAF write bug in tomoyo_write_control()Linux
- CVE-2024-21826Huks has an insecure storage of sensitive information vulnerabilityOpenHarmony
- CVE-2024-21816Background task manager has an improper preservation of permissions vulnerabilityOpenHarmony
- CVE-2023-49602Arkui has a type confusion vulnerabilityOpenHarmony
- CVE-2023-46708Wlan has a use after free vulnerabilityOpenHarmony
- CVE-2023-25176Pasteboard has an out-of-bounds read vulnerabilityOpenHarmony
- CVE-2024-20038In pq, there is a possible out of bounds read due to an incorrect bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT…
- CVE-2024-20037In pq, there is a possible write-what-where condition due to an incorrect bounds check.MediaTek MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT…
- CVE-2024-20036In vdec, there is a possible permission bypass due to a permissions bypass.MediaTek MT6835, MT6855, MT6879, MT6886, MT6895, MT6983, MT…
- CVE-2024-20033In nvram, there is a possible information disclosure due to a missing bounds check.MediaTek MT2713, MT6739, MT6761, MT6765, MT6768, MT6771, MT…
- CVE-2024-20032In aee, there is a possible permission bypass due to a missing permission check.MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…
- CVE-2024-20031In da, there is a possible out of bounds write due to lack of valudation.MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…
- CVE-2024-20030In da, there is a possible information disclosure due to improper input validation.MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…
- CVE-2024-20028In da, there is a possible out of bounds write due to lack of valudation.MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…
- CVE-2024-20026In da, there is a possible information disclosure due to improper input validation.MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…
- CVE-2024-20025In da, there is a possible out of bounds write due to an integer overflow.MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…
- CVE-2024-20024In flashc, there is a possible out of bounds write due to lack of valudation.MediaTek MT6781, MT6789, MT6833, MT6835, MT6879, MT6886, MT…
- CVE-2024-20023In flashc, there is a possible out of bounds write due to lack of valudation.MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…
- CVE-2024-20022In lk, there is a possible escalation of privilege due to a missing bounds check.MediaTek MT2737, MT6789, MT6835, MT6855, MT6879, MT6880, MT…
- CVE-2024-20019In wlan driver, there is a possible memory leak due to improper input handling.MediaTek MT7925, MT7927
- CVE-2024-20020In OPTEE, there is a possible out of bounds write due to an incorrect bounds check.MediaTek MT2713, MT2715, MT8173, MT8188, MT8195, MT8390, MT…
- CVE-2024-2156SourceCodester Best POS Management System admin_class.php sql injectionSourceCodester Best POS Management System
- CVE-2024-2155SourceCodester Best POS Management System index.php file inclusionSourceCodester Best POS Management System
- CVE-2024-2154SourceCodester Online Mobile Management Store view_product.php sql injectionSourceCodester Online Mobile Management Store
- CVE-2024-2153SourceCodester Online Mobile Management Store view_order.php sql injectionSourceCodester Online Mobile Management Store
- CVE-2024-2152SourceCodester Online Mobile Management Store manage_product.php sql injectionSourceCodester Online Mobile Management Store
- CVE-2023-49969Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer_support/index.php?page=
- CVE-2024-27668Flusity-CMS v2.33 is affected by: Cross Site Scripting (XSS) in 'Custom Blocks.'
- CVE-2024-27680Flusity-CMS v2.33 is vulnerable to Cross Site Scripting (XSS) in the "Contact form."
- CVE-2024-27684A Cross-site scripting (XSS) vulnerability in dlapn.cgi, dldongle.cgi, dlcfg.cgi, fwup.cgi and seama.cgi in D-Link GORTAC750_A1_FW_v101b03 a