CVEs published March 5, 2024
115 CVEs were published on March 5, 2024: 17 critical, 27 high. 2 are now in CISA KEV.
- Published
- 115
- Critical
- 17
- High
- 27
- Medium
- 63
- Low
- 7
- Unrated
- 1
- Now in CISA KEV
- 2
- Fix available
- 36
Most affected products
- AiLux imx6 bundle
- 12
- Samsung Mobile Devices
- 8
- Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…
- 7
- Devolutions Server
- 4
- Artica Tech Artica Proxy
- 3
- Samsung Mobile Samsung Internet
- 3
- VMware ESXi · VMware Workstation +2
- 3
- Apple iOS and iPadOS
- 2
- Apple iOS and iPadOS · Apple macOS +3
- 2
- Gallagher Command Centre Server
- 2
Critical 17
- CVE-2024-2056Artica Proxy Loopback Services Remotely Accessible UnauthenticatedArtica Tech Artica Proxy · github.com/gvalkov/tailon
- CVE-2024-2055Artica Proxy Unauthenticated File Manager VulnerabilityArtica Tech Artica Proxy
- CVE-2024-2054Artica Proxy Unauthenticated PHP Deserialization VulnerabilityArtica Tech Artica Proxy
- CVE-2024-2005SAML implementation allows privilege escalationBlue Planet Inventory · Blue Planet Orchestration +2
- CVE-2024-22253Use-after-free vulnerabilityVMware ESXi · VMware Workstation +2
- CVE-2024-22252Use-after-free vulnerabilityVMware ESXi · VMware Workstation +2
- CVE-2024-1202Authentication Bypass in XPodas' OctopodXPodas Octopod
- CVE-2023-7103Authentication Bypass in ZKSoftware's UFace 5ZKSoftware Biometric Security Solutions UFace
- CVE-2024-21815 Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticateGallagher Command Centre Server
- CVE-2023-38944An issue in Multilaser RE160V firmware v12.03.01.09_pt and Multilaser RE163V firmware v12.03.01.10_pt allows attackers to bypass the access
- CVE-2024-24098Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection via the News Feed.
- CVE-2024-24275Cross Site Scripting vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive i
- CVE-2024-24276Cross Site Scripting (XSS) vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensi
- CVE-2024-26339swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a.
- CVE-2024-27561A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the applic
- CVE-2024-27565A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to ma
- CVE-2024-27764An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component.
High 27
- CVE-2024-24786Infinite loop in JSON unmarshaling in google.golang.org/protobufgoogle.golang.org/protobuf/encoding/protojson · google.g… +1
- CVE-2024-24784Comments in display names are incorrectly handled in net/mailGo standard library net/mail · stdlib
- CVE-2024-1764Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continueDevolutions Server
- CVE-2024-25613Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…
- CVE-2024-25612Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…
- CVE-2024-25611Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…
- CVE-2024-1356Authenticated command injection vulnerabilities exist in the ArubaOS command line interface.Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…
- CVE-2024-23296A memory corruption issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-23225A memory corruption issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +3
- CVE-2024-2053Artica Proxy Unauthenticated LFI Protection Bypass VulnerabilityArtica Tech Artica Proxy
- CVE-2023-35899IBM Cloud Pak for Automation CSV injectionIBM Cloud Pak for Automation
- CVE-2024-22255Information disclosure vulnerabilityVMware ESXi · VMware Workstation +2
- CVE-2024-22254Out-of-bounds write vulnerabilityVMware ESXi · VMware Cloud Foundation
- CVE-2024-27929Use After Free in SixLabors.ImageSharpSixLabors ImageSharp · SixLabors.ImageSharp
- CVE-2023-45591A CWE-122 “Heap-based Buffer Overflow” vulnerability in the “logger_generic” function of the “Ax_rtu” binary allows a remote authenticated aAiLux imx6 bundle
- CVE-2022-48629crypto: qcom-rng - ensure buffer for generate is completely filledLinux
- CVE-2023-5457A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the web application (due to theAiLux imx6 bundle
- CVE-2023-5456A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attacAiLux imx6 bundle
- CVE-2024-0825Vimeography: Vimeo Video Gallery WordPress Plugin <= 2.3.2 - Authenticated (Contributor+) PHP Object Injectionvideogallery Vimeography: Vimeo Video Gallery WordPress Plu…
- CVE-2024-1731Auto Refresh Single Page <= 1.1 - Authenticated (Contributor+) PHP Object Injectionjkohlbach Auto Refresh Single Page
- CVE-2023-43318TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrl
- CVE-2024-22188TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the pritypo3/cms-core
- CVE-2024-24278An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted p
- CVE-2024-25269libheif <= 1.17.6 contains a memory leak in the function JpegEncoder::Encode.
- CVE-2024-25817Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, aeza
- CVE-2024-25858In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScript could occur because of an unoptimized prompt m
- CVE-2024-27622A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21.
Medium, low and unrated 71
- CVE-2024-27278OpenPNE Plugin "opTimelinePlugin" 1.2.11 and earlier contains a cross-site scripting vulnerability.OpenPNE Project OpenPNE Plugin "opTimelinePlugin"
- CVE-2024-24785Errors returned from JSON marshaling may break template escaping in html/templateGo standard library html/template · stdlib
- CVE-2023-45289Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/httpGo standard library net/http · Go standard library net/h… +1
- CVE-2023-45290Memory exhaustion in multipart form parsing in net/textproto and net/httpGo standard library net/textproto · stdlib
- CVE-2024-24783Verify panics on certificates with an unknown public key algorithm in crypto/x509Go standard library crypto/x509 · stdlib
- CVE-2024-1898Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change notDevolutions Server
- CVE-2024-1900Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticatDevolutions Server
- CVE-2024-1901Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with sDevolutions Server
- CVE-2024-2179Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group typeConcrete CMS · concrete5/concrete5
- CVE-2024-25616Aruba has identified certain configurations of ArubaOS that can lead to partial disclosure of sensitive information in the IKE_AUTH negotiatHewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…
- CVE-2024-25615 An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Spectrum service accessed via the PAPI protocol in ArubaOS 8.x.Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…
- CVE-2024-25614There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS.Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…
- CVE-2022-22399IBM Aspera Faspex HTTP header injectionIBM Aspera Faspex
- CVE-2023-25681IBM Spectrum Virtualize security bypassIBM Spectrum Virtualize
- CVE-2023-26282IBM Watson CP4D Data Stores file modificiationIBM Watson CP4D Data Stores
- CVE-2024-23243A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS
- CVE-2024-23256A logic issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2024-22352IBM InfoSphere Information Server information disclosureIBM InfoSphere Information Server
- CVE-2024-27931Insufficient permission checking in `Deno.makeTemp*` APIsdenoland deno · deno
- CVE-2024-2188Cross-Site Scripting vulnerability in TP-Link Archer AX50TP-Link Archer AX50
- CVE-2023-45600A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, fAiLux imx6 bundle
- CVE-2023-45599A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web applicatAiLux imx6 bundle
- CVE-2023-45598A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “measure” functionality of the web application allows a remote unauthentAiLux imx6 bundle
- CVE-2023-45597A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file_configuration” functionality of the web apAiLux imx6 bundle
- CVE-2023-45596A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “file_configuration” functionality of the web application allows a remotAiLux imx6 bundle
- CVE-2023-45595A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file_configuration” functionality of the web application aAiLux imx6 bundle
- CVE-2023-45594A CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a physical attacker toAiLux imx6 bundle
- CVE-2023-45593A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLsAiLux imx6 bundle
- CVE-2023-45592A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser (due to the binary being executed with the AiLux imx6 bundle
- CVE-2022-48630crypto: qcom-rng - fix infinite loop on requests not multiple of WORD_SZLinux
- CVE-2024-20833Use after free vulnerability in pub_crypto_recv_msg prior to SMR Mar-2024 Release 1 due to race condition allows local attackers with systemSamsung Mobile Devices
- CVE-2023-42419Improper Management of Cryptographic Keys in the Maintenance Server in QCOW Air-Gapped Distribution (China Edition)Cybellum Maintenance Server
- CVE-2024-20841Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to access data.Samsung Mobile Samnsung Account
- CVE-2024-20840Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02 in Android 14 allowsSamsung Mobile Samsung Voice Recorder
- CVE-2024-20839Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02 in Android 14 allowsSamsung Mobile Samsung Voice Recorder
- CVE-2024-20838Improper validation vulnerability in Samsung Internet prior to version 24.0.3.2 allows local attackers to execute arbitrary code.Samsung Mobile Samsung Internet
- CVE-2024-20837Improper handling of granting permission for Trusted Web Activities in Samsung Internet prior to version 24.0.0.41 allows local attackers toSamsung Mobile Samsung Internet
- CVE-2024-20836Out of bounds Read vulnerability in ssmis_get_frm in libsubextractor.so prior to SMR Mar-2024 Release 1 allows local attackers to read out oSamsung Mobile Devices
- CVE-2024-20835Improper access control vulnerability in CustomFrequencyManagerService prior to SMR Mar-2024 Release 1 allows local attackers to execute priSamsung Mobile Devices
- CVE-2024-20834The sensitive information exposure vulnerability in WlanTest prior to SMR Mar-2024 Release 1 allows local attackers to access MAC address wiSamsung Mobile Devices
- CVE-2024-20832Heap overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows local privileged attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2024-20831Stack overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows local privileged attackers to execute arbitrary code.Samsung Mobile Devices
- CVE-2024-20830Incorrect default permission in AppLock prior to SMR MAr-2024 Release 1 allows local attackers to configure AppLock settings.Samsung Mobile Devices
- CVE-2024-20829Missing proper interaction for opening deeplink in Samsung Internet prior to version v24.0.0.0 allows remote attackers to open an applicatioSamsung Mobile Samsung Internet
- CVE-2023-52432Improper input validation in IpcTxSndSetLoopbackCtrl in libsec-ril prior to SMR Sep-2023 Release 1 allows local attackers to write out-of-boSamsung Mobile Devices
- CVE-2024-22383 Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not auGallagher Controller
- CVE-2024-21838 Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could leadGallagher Command Centre Server
- CVE-2024-1093Change Memory Limit <= 1.0 - Missing Authorization via admin_logic()simon99 Change Memory Limit
- CVE-2024-1769JM Twitter Cards <= 14 - Information Exposure via Meta Descriptionjmlapam JM Twitter Cards
- CVE-2024-1381Page Builder Sandwich – Front End WordPress Page Builder Plugin <= 5.1.0 - Sensitive Information Exposurepagebuildersandwich Page Builder Sandwich – Front End WordP…
- CVE-2024-1088Password Protected Store for WooCommerce <= 2.2 - Information Exposure via REST APIrajkakadiya Password Protected Store for WooCommerce
- CVE-2024-1285Page Builder Sandwich <= 5.1.0 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Post Editingpagebuildersandwich Page Builder Sandwich – Front End WordP…
- CVE-2024-0698Easy!Appointments <= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingalextselegidis Easy!Appointments
- CVE-2024-1095Build & Control Block Patterns – Boost up Gutenberg Editor <= 1.3.5.4 - Missing Authorizationrazib_ Build & Control Block Patterns – Boost up Gutenberg…
- CVE-2024-1478Maintenance Mode <= 3.0.1 - Information Exposurehelderk Maintenance Mode
- CVE-2024-1782Blue Triad EZAnalytics <= 1.0 - Reflected Cross-Site Scripting via 'bt_webid'jbahlquist Blue Triad EZAnalytics
- CVE-2024-1178SportsPress – Sports Club & League Manager <= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Updatethemeboy SportsPress – Sports Club & League Manager
- CVE-2022-46088Online Flight Booking Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the feedback form.
- CVE-2023-48644An issue was discovered in the Archibus app 4.0.3 for iOS.
- CVE-2024-22889Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crplone
- CVE-2024-26333swftools v0.9.2 was discovered to contain a segmentation violation via the function free_lines at swftools/lib/modules/swfshape.c.
- CVE-2024-26334swftools v0.9.2 was discovered to contain a segmentation violation via the function compileSWFActionCode at swftools/lib/action/actioncompil
- CVE-2024-26335swftools v0.9.2 was discovered to contain a segmentation violation via the function state_free at swftools/src/swfc-history.c.
- CVE-2024-26337swftools v0.9.2 was discovered to contain a segmentation violation via the function s_font at swftools/src/swfc.c.
- CVE-2024-27563A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make a
- CVE-2024-27564pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter.dirk1983 mm1.ltd source code
- CVE-2024-27623CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI).
- CVE-2024-27625CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-27626A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29.
- CVE-2024-27627A reflected cross-site scripting (XSS) vulnerability exists in SuperCali version 1.1.0, allowing remote attackers to execute arbitrary JavaS
- CVE-2024-27765Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplate