# CVEs published 2024-03-04

116 CVEs were published on March 4, 2024: 11 critical, 46 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-41829](https://cve.now/CVE-2023-41829.md): An improper export vulnerability was reported in the Motorola Carrier Services application that could allow a malicious, local application t (CVSS 5.0, Motorola Phones)
- [CVE-2023-41827](https://cve.now/CVE-2023-41827.md): An improper export vulnerability was reported in the Motorola OTA update application, that could allow a malicious, local application to inj (CVSS 5.1, Motorola Phones)
- [CVE-2024-1936](https://cve.now/CVE-2024-1936.md): The encrypted subject of an email message could be incorrectly and permanently assigned to an arbitrary other email message in Thunderbird's (CVSS 7.5, Mozilla Thunderbird)
- [CVE-2024-2168](https://cve.now/CVE-2024-2168.md): SourceCodester Online Tours & Travels Management System HTTP POST Request expense\_category.php sql injection (CVSS 4.7, SourceCodester Online Tours & Travels Management System)
- [CVE-2024-1316](https://cve.now/CVE-2024-1316.md): Event Tickets and Registration \< 5.8.1 - Contributor+ Arbitrary Events Access (CVSS 6.5, Event Tickets and Registration · Events Tickets Plus)
- [CVE-2024-1319](https://cve.now/CVE-2024-1319.md): Event Tickets Plus \< 5.9.1 - Contributor+ Attendees Lists Disclosure (CVSS 4.3, Events Tickets Plus)
- [CVE-2024-2048](https://cve.now/CVE-2024-2048.md): Vault Cert Auth Method Did Not Correctly Validate Non-CA Certificates (CVSS 8.1, HashiCorp Vault · github.com/hashicorp/vault)
- [CVE-2023-6068](https://cve.now/CVE-2023-6068.md): On affected 7130 Series FPGA platforms running MOS and recent versions of the MultiAccess FPGA, application of ACL’s may result in incorrect operation of the configured ACL for a port resulting in some packets that should be denied being permitted and some (CVSS 3.1, Arista Networks MOS)
- [CVE-2024-27889](https://cve.now/CVE-2024-27889.md): Multiple SQL Injection vulnerabilities exist in the reporting application of the Arista Edge Threat Management - Arista NG Firewall (NGFW). (CVSS 8.8, Arista Networks Arista Edge Threat Management - Arista NG F…)
- [CVE-2023-32331](https://cve.now/CVE-2023-32331.md): IBM Connect:Express for UNIX denial of service (CVSS 7.5, IBM Sterling Connect:Express for UNIX)
- [CVE-2021-47108](https://cve.now/CVE-2021-47108.md): drm/mediatek: hdmi: Perform NULL pointer check for mtk\_hdmi\_conf (no CVSS, Linux)
- [CVE-2021-47107](https://cve.now/CVE-2021-47107.md): NFSD: Fix READDIR buffer overflow (CVSS 9.8, Linux)
- [CVE-2021-47106](https://cve.now/CVE-2021-47106.md): netfilter: nf\_tables: fix use-after-free in nft\_set\_catchall\_destroy() (CVSS 7.8, Linux)
- [CVE-2021-47105](https://cve.now/CVE-2021-47105.md): ice: xsk: return xsk buffers back to pool when cleaning the ring (no CVSS, Linux)
- [CVE-2021-47104](https://cve.now/CVE-2021-47104.md): IB/qib: Fix memory leak in qib\_user\_sdma\_queue\_pkts() (no CVSS, Linux)
- [CVE-2021-47103](https://cve.now/CVE-2021-47103.md): inet: fully convert sk-\>sk\_rx\_dst to RCU rules (CVSS 9.8, Linux)
- [CVE-2021-47102](https://cve.now/CVE-2021-47102.md): net: marvell: prestera: fix incorrect structure access (CVSS 7.1, Linux)
- [CVE-2021-47101](https://cve.now/CVE-2021-47101.md): asix: fix uninit-value in asix\_mdio\_read() (no CVSS, Linux)
- [CVE-2021-47100](https://cve.now/CVE-2021-47100.md): ipmi: Fix UAF when uninstall ipmi\_si and ipmi\_msghandler module (no CVSS, Linux)
- [CVE-2021-47099](https://cve.now/CVE-2021-47099.md): veth: ensure skb entering GRO are not cloned. (CVSS 7.8, Linux)
- [CVE-2021-47098](https://cve.now/CVE-2021-47098.md): hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations (no CVSS, Linux)
- [CVE-2021-47097](https://cve.now/CVE-2021-47097.md): Input: elantech - fix stack out of bound access in elantech\_change\_report\_id() (no CVSS, Linux)
- [CVE-2021-47096](https://cve.now/CVE-2021-47096.md): ALSA: rawmidi - fix the uninitalized user\_pversion (CVSS 4.0, Linux)
- [CVE-2021-47095](https://cve.now/CVE-2021-47095.md): ipmi: ssif: initialize ssif\_info-\>client early (no CVSS, Linux)
- [CVE-2021-47094](https://cve.now/CVE-2021-47094.md): KVM: x86/mmu: Don't advance iterator after restart due to yielding (CVSS 7.8, Linux)
- [CVE-2021-47093](https://cve.now/CVE-2021-47093.md): platform/x86: intel\_pmc\_core: fix memleak on registration failure (no CVSS, Linux)
- [CVE-2021-47092](https://cve.now/CVE-2021-47092.md): KVM: VMX: Always clear vmx-\>fail on emulation\_required (no CVSS, Linux)
- [CVE-2021-47091](https://cve.now/CVE-2021-47091.md): mac80211: fix locking in ieee80211\_start\_ap error path (no CVSS, Linux)
- [CVE-2021-47090](https://cve.now/CVE-2021-47090.md): mm/hwpoison: clear MF\_COUNT\_INCREASED before retrying get\_any\_page() (no CVSS, Linux)
- [CVE-2021-47089](https://cve.now/CVE-2021-47089.md): kfence: fix memory leak when cat kfence objects (CVSS 3.3, Linux)
- [CVE-2021-47088](https://cve.now/CVE-2021-47088.md): mm/damon/dbgfs: protect targets destructions with kdamond\_lock (no CVSS, Linux)
- [CVE-2021-47087](https://cve.now/CVE-2021-47087.md): tee: optee: Fix incorrect page free bug (CVSS 7.8, Linux)
- [CVE-2021-47083](https://cve.now/CVE-2021-47083.md): pinctrl: mediatek: fix global-out-of-bounds issue (CVSS 7.1, Linux)
- [CVE-2021-47082](https://cve.now/CVE-2021-47082.md): tun: avoid double free in tun\_free\_netdev (CVSS 7.8, Linux)
- [CVE-2021-47086](https://cve.now/CVE-2021-47086.md): phonet/pep: refuse to enable an unbound pipe (no CVSS, Linux)
- [CVE-2023-38360](https://cve.now/CVE-2023-38360.md): IBM CICS TX cross-site scripting (CVSS 6.1, IBM CICS TX Advanced)
- [CVE-2024-27199](https://cve.now/CVE-2024-27199.md): In JetBrains TeamCity before 2023.11.4 path traversal allowing to perform limited admin actions was possible (CVSS 7.3, KEV, JetBrains TeamCity)
- [CVE-2024-27198](https://cve.now/CVE-2024-27198.md): In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible (CVSS 9.8, KEV, JetBrains TeamCity)
- [CVE-2023-38362](https://cve.now/CVE-2023-38362.md): IBM CICS TX information disclosure (CVSS 5.3, IBM CICS TX Advanced)
- [CVE-2023-5451](https://cve.now/CVE-2023-5451.md): Forcepoint NGFW Security Management Center Management Server has SMC Downloads optional feature to offer standalone Management Client down (CVSS 6.1, Forcepoint Next Generation Firewall Security Management Cen…)
- [CVE-2022-43890](https://cve.now/CVE-2022-43890.md): IBM Security Verify Privilege On-Premises information disclosure (CVSS 5.3, IBM Security Verify Privilege On-Premises)
- [CVE-2024-24901](https://cve.now/CVE-2024-24901.md): Dell PowerScale OneFS 8.2.x through 9.6.0.x contain an insufficient logging vulnerability. (CVSS 3.0, Dell PowerScale OneFS)
- [CVE-2024-22463](https://cve.now/CVE-2024-22463.md): Dell PowerScale OneFS 8.2.x through 9.6.0.x contains a use of a broken or risky cryptographic algorithm vulnerability. (CVSS 7.4, Dell PowerScale OneFS)
- [CVE-2024-22452](https://cve.now/CVE-2024-22452.md): Dell Display and Peripheral Manager for macOS prior to 1.3 contains an improper access control vulnerability. (CVSS 7.3, Dell Display and Peripheral Manager)
- [CVE-2024-0155](https://cve.now/CVE-2024-0155.md): Dell Digital Delivery, versions prior to 5.2.0.0, contain a Use After Free Vulnerability. (CVSS 7.0, Dell Digital Delivery)
- [CVE-2024-0156](https://cve.now/CVE-2024-0156.md): Dell Digital Delivery, versions prior to 5.2.0.0, contain a Buffer Overflow Vulnerability. (CVSS 7.0, Dell Digital Delivery)
- [CVE-2023-6241](https://cve.now/CVE-2023-6241.md): Mali GPU Kernel Driver allows improper GPU memory processing operations (CVSS 7.8, Arm Midgard GPU Kernel Driver · Arm Bifrost GPU Kernel D… +2)
- [CVE-2023-43553](https://cve.now/CVE-2023-43553.md): Use of Out-of-range Pointer Offset in WLAN HOST (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2023-43552](https://cve.now/CVE-2023-43552.md): Use After Free in WLAN Host Communication (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2023-43550](https://cve.now/CVE-2023-43550.md): Integer Overflow or Wraparound in Core Services (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2023-43549](https://cve.now/CVE-2023-43549.md): Stack-based Buffer Overflow in WLAN HAL (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-43548](https://cve.now/CVE-2023-43548.md): Buffer Copy Without Checking Size of Input in Video (CVSS 7.3, Qualcomm Snapdragon)
- [CVE-2023-43547](https://cve.now/CVE-2023-43547.md): Use After Free in Automotive Multimedia (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-43546](https://cve.now/CVE-2023-43546.md): Use After Free in Automotive Multimedia (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-43541](https://cve.now/CVE-2023-43541.md): NULL Pointer Dereference in Windows Graphics (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-43540](https://cve.now/CVE-2023-43540.md): Buffer Copy Without Checking Size of Input in Bluetooth HOST (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-43539](https://cve.now/CVE-2023-43539.md): Buffer Over-read in WLAN Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33105](https://cve.now/CVE-2023-33105.md): Configuration Issue in WLAN Host and Firmware (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33104](https://cve.now/CVE-2023-33104.md): Improper input Validation in Multi-Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33103](https://cve.now/CVE-2023-33103.md): Improper Input Validation in Multi-Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33096](https://cve.now/CVE-2023-33096.md): Reachable Assertion in Multi-Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33095](https://cve.now/CVE-2023-33095.md): Reachable Assertion in Multi-Mode Call Processor (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33090](https://cve.now/CVE-2023-33090.md): Buffer Over-read in Audio (CVSS 5.5, Qualcomm Snapdragon)
- [CVE-2023-33086](https://cve.now/CVE-2023-33086.md): Improper Release of Memory Before Removing Last Reference in Data Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33084](https://cve.now/CVE-2023-33084.md): Improper Release of Memory Before Removing Last Reference in Data Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2023-33078](https://cve.now/CVE-2023-33078.md): Buffer Over-read in DSP Services (CVSS 5.1, Qualcomm Snapdragon)
- [CVE-2023-33066](https://cve.now/CVE-2023-33066.md): Use of Out-of-range Pointer Offset in Audio (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2023-28582](https://cve.now/CVE-2023-28582.md): Buffer Copy Without Checking Size of Input in Data Modem (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2023-28578](https://cve.now/CVE-2023-28578.md): Improper Input Validation in Services (CVSS 9.3, Qualcomm Snapdragon)
- [CVE-2023-6143](https://cve.now/CVE-2023-6143.md): Mali GPU Kernel Driver allows improper GPU memory processing operations (CVSS 8.4, Arm Midgard GPU Kernel Driver · Arm Bifrost GPU Kernel D… +2)
- [CVE-2023-4479](https://cve.now/CVE-2023-4479.md): Stored XSS Vulnerability in M-Files Web (CVSS 7.3, M-Files Web)
- [CVE-2024-26622](https://cve.now/CVE-2024-26622.md): tomoyo: fix UAF write bug in tomoyo\_write\_control() (no CVSS, Linux)
- [CVE-2024-21826](https://cve.now/CVE-2024-21826.md): Huks has an insecure storage of sensitive information vulnerability (CVSS 4.3, OpenHarmony)
- [CVE-2024-21816](https://cve.now/CVE-2024-21816.md): Background task manager has an improper preservation of permissions vulnerability (CVSS 4.0, OpenHarmony)
- [CVE-2023-49602](https://cve.now/CVE-2023-49602.md): Arkui has a type confusion vulnerability (CVSS 2.9, OpenHarmony)
- [CVE-2023-46708](https://cve.now/CVE-2023-46708.md): Wlan has a use after free vulnerability (CVSS 4.3, OpenHarmony)
- [CVE-2023-25176](https://cve.now/CVE-2023-25176.md): Pasteboard has an out-of-bounds read vulnerability (CVSS 2.9, OpenHarmony)
- [CVE-2024-20038](https://cve.now/CVE-2024-20038.md): In pq, there is a possible out of bounds read due to an incorrect bounds check. (CVSS 3.4, MediaTek MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT…)
- [CVE-2024-20037](https://cve.now/CVE-2024-20037.md): In pq, there is a possible write-what-where condition due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6739, MT6761, MT6765, MT6768, MT6779, MT6781, MT…)
- [CVE-2024-20036](https://cve.now/CVE-2024-20036.md): In vdec, there is a possible permission bypass due to a permissions bypass. (CVSS 4.4, MediaTek MT6835, MT6855, MT6879, MT6886, MT6895, MT6983, MT…)
- [CVE-2024-20034](https://cve.now/CVE-2024-20034.md): In battery, there is a possible escalation of privilege due to a missing bounds check. (CVSS 7.2, MediaTek MT6761, MT6765, MT6768, MT6855, MT6895, MT8167, MT…)
- [CVE-2024-20033](https://cve.now/CVE-2024-20033.md): In nvram, there is a possible information disclosure due to a missing bounds check. (CVSS 4.4, MediaTek MT2713, MT6739, MT6761, MT6765, MT6768, MT6771, MT…)
- [CVE-2024-20032](https://cve.now/CVE-2024-20032.md): In aee, there is a possible permission bypass due to a missing permission check. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2024-20029](https://cve.now/CVE-2024-20029.md): In wlan firmware, there is a possible out of bounds write due to improper input validation. (CVSS 8.4, MediaTek MT6985, MT6989, MT8678, MT8796)
- [CVE-2024-20031](https://cve.now/CVE-2024-20031.md): In da, there is a possible out of bounds write due to lack of valudation. (CVSS 6.7, MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…)
- [CVE-2024-20030](https://cve.now/CVE-2024-20030.md): In da, there is a possible information disclosure due to improper input validation. (CVSS 4.4, MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…)
- [CVE-2024-20028](https://cve.now/CVE-2024-20028.md): In da, there is a possible out of bounds write due to lack of valudation. (CVSS 6.6, MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…)
- [CVE-2024-20027](https://cve.now/CVE-2024-20027.md): In da, there is a possible out of bounds write due to improper input validation. (CVSS 7.9, MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…)
- [CVE-2024-20026](https://cve.now/CVE-2024-20026.md): In da, there is a possible information disclosure due to improper input validation. (CVSS 4.2, MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…)
- [CVE-2024-20025](https://cve.now/CVE-2024-20025.md): In da, there is a possible out of bounds write due to an integer overflow. (CVSS 6.7, MediaTek MT6739, MT6757, MT6761, MT6763, MT6765, MT6768, MT…)
- [CVE-2024-20024](https://cve.now/CVE-2024-20024.md): In flashc, there is a possible out of bounds write due to lack of valudation. (CVSS 6.0, MediaTek MT6781, MT6789, MT6833, MT6835, MT6879, MT6886, MT…)
- [CVE-2024-20023](https://cve.now/CVE-2024-20023.md): In flashc, there is a possible out of bounds write due to lack of valudation. (CVSS 6.7, MediaTek MT2713, MT2737, MT6781, MT6789, MT6835, MT6855, MT…)
- [CVE-2024-20022](https://cve.now/CVE-2024-20022.md): In lk, there is a possible escalation of privilege due to a missing bounds check. (CVSS 6.7, MediaTek MT2737, MT6789, MT6835, MT6855, MT6879, MT6880, MT…)
- [CVE-2024-20005](https://cve.now/CVE-2024-20005.md): In da, there is a possible permission bypass due to a missing permission check. (CVSS 8.2, MediaTek MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT…)
- [CVE-2024-20019](https://cve.now/CVE-2024-20019.md): In wlan driver, there is a possible memory leak due to improper input handling. (CVSS 5.9, MediaTek MT7925, MT7927)
- [CVE-2024-20018](https://cve.now/CVE-2024-20018.md): In wlan driver, there is a possible out of bounds write due to improper input validation. (CVSS 9.8, MediaTek MT7615)
- [CVE-2024-20020](https://cve.now/CVE-2024-20020.md): In OPTEE, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 4.4, MediaTek MT2713, MT2715, MT8173, MT8188, MT8195, MT8390, MT…)
- [CVE-2024-20017](https://cve.now/CVE-2024-20017.md): In wlan service, there is a possible out of bounds write due to improper input validation. (CVSS 9.8, MediaTek MT6890, MT7915, MT7916, MT7981, MT7986)
- [CVE-2024-2156](https://cve.now/CVE-2024-2156.md): SourceCodester Best POS Management System admin\_class.php sql injection (CVSS 6.3, SourceCodester Best POS Management System)
- [CVE-2024-2155](https://cve.now/CVE-2024-2155.md): SourceCodester Best POS Management System index.php file inclusion (CVSS 4.3, SourceCodester Best POS Management System)
- [CVE-2024-2154](https://cve.now/CVE-2024-2154.md): SourceCodester Online Mobile Management Store view\_product.php sql injection (CVSS 6.3, SourceCodester Online Mobile Management Store)
- [CVE-2024-2153](https://cve.now/CVE-2024-2153.md): SourceCodester Online Mobile Management Store view\_order.php sql injection (CVSS 6.3, SourceCodester Online Mobile Management Store)
- [CVE-2024-2152](https://cve.now/CVE-2024-2152.md): SourceCodester Online Mobile Management Store manage\_product.php sql injection (CVSS 4.7, SourceCodester Online Mobile Management Store)
- [CVE-2023-49546](https://cve.now/CVE-2023-49546.md): Customer Support System v1 was discovered to contain a SQL injection vulnerability via the email parameter at /customer\_support/ajax.php. (CVSS 8.8)
- [CVE-2023-49547](https://cve.now/CVE-2023-49547.md): Customer Support System v1 was discovered to contain a SQL injection vulnerability via the username parameter at /customer\_support/ajax.php? (CVSS 9.8)
- [CVE-2023-49548](https://cve.now/CVE-2023-49548.md): Customer Support System v1 was discovered to contain a SQL injection vulnerability via the lastname parameter at /customer\_support/ajax.php? (CVSS 8.8)
- [CVE-2023-49968](https://cve.now/CVE-2023-49968.md): Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer\_support/manage\_departme (CVSS 7.3)
- [CVE-2023-49969](https://cve.now/CVE-2023-49969.md): Customer Support System v1 was discovered to contain a SQL injection vulnerability via the id parameter at /customer\_support/index.php?page= (CVSS 4.3)
- [CVE-2023-49970](https://cve.now/CVE-2023-49970.md): Customer Support System v1 was discovered to contain a SQL injection vulnerability via the subject parameter at /customer\_support/ajax.php?a (CVSS 9.8)
- [CVE-2024-25164](https://cve.now/CVE-2024-25164.md): iA Path Traversal vulnerability exists in iDURAR v2.0.0, that allows unauthenticated attackers to expose sensitive files via the download fu (CVSS 7.5)
- [CVE-2024-25731](https://cve.now/CVE-2024-25731.md): The Elink Smart eSmartCam (com.cn.dq.ipc) application 2.1.5 for Android contains hardcoded AES encryption keys that can be extracted from a (CVSS 7.5)
- [CVE-2024-27668](https://cve.now/CVE-2024-27668.md): Flusity-CMS v2.33 is affected by: Cross Site Scripting (XSS) in 'Custom Blocks.' (CVSS 6.1)
- [CVE-2024-27680](https://cve.now/CVE-2024-27680.md): Flusity-CMS v2.33 is vulnerable to Cross Site Scripting (XSS) in the "Contact form." (CVSS 6.1)
- [CVE-2024-27684](https://cve.now/CVE-2024-27684.md): A Cross-site scripting (XSS) vulnerability in dlapn.cgi, dldongle.cgi, dlcfg.cgi, fwup.cgi and seama.cgi in D-Link GORTAC750\_A1\_FW\_v101b03 a (CVSS 6.1)
- [CVE-2024-27694](https://cve.now/CVE-2024-27694.md): FlyCms v1.0 was discovered to contain a Cross-Site Request Forgery (CSRF) vulnerability via the /system/share/ztree\_category\_edit. (CVSS 7.4)
- [CVE-2024-27718](https://cve.now/CVE-2024-27718.md): SQL Injection vulnerability in Baizhuo Network Smart s200 Management Platform v.S200 allows a local attacker to obtain sensitive information (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.