# CVEs published 2024-03-05

115 CVEs were published on March 5, 2024: 17 critical, 27 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-27278](https://cve.now/CVE-2024-27278.md): OpenPNE Plugin "opTimelinePlugin" 1.2.11 and earlier contains a cross-site scripting vulnerability. (CVSS 5.4, OpenPNE Project OpenPNE Plugin "opTimelinePlugin")
- [CVE-2024-24786](https://cve.now/CVE-2024-24786.md): Infinite loop in JSON unmarshaling in google.golang.org/protobuf (CVSS 7.5, google.golang.org/protobuf/encoding/protojson · google.g… +1)
- [CVE-2024-24785](https://cve.now/CVE-2024-24785.md): Errors returned from JSON marshaling may break template escaping in html/template (CVSS 5.4, Go standard library html/template · stdlib)
- [CVE-2024-24784](https://cve.now/CVE-2024-24784.md): Comments in display names are incorrectly handled in net/mail (CVSS 7.5, Go standard library net/mail · stdlib)
- [CVE-2023-45289](https://cve.now/CVE-2023-45289.md): Incorrect forwarding of sensitive headers and cookies on HTTP redirect in net/http (CVSS 4.3, Go standard library net/http · Go standard library net/h… +1)
- [CVE-2023-45290](https://cve.now/CVE-2023-45290.md): Memory exhaustion in multipart form parsing in net/textproto and net/http (CVSS 6.5, Go standard library net/textproto · stdlib)
- [CVE-2024-24783](https://cve.now/CVE-2024-24783.md): Verify panics on certificates with an unknown public key algorithm in crypto/x509 (CVSS 5.9, Go standard library crypto/x509 · stdlib)
- [CVE-2024-1764](https://cve.now/CVE-2024-1764.md): Improper privilege management in Just-in-time (JIT) elevation module in Devolutions Server 2023.3.14.0 and earlier allows a user to continue (CVSS 7.6, Devolutions Server)
- [CVE-2024-1898](https://cve.now/CVE-2024-1898.md): Improper access control in the notification feature in Devolutions Server 2023.3.14.0 and earlier allows a low privileged user to change not (CVSS 3.9, Devolutions Server)
- [CVE-2024-1900](https://cve.now/CVE-2024-1900.md): Improper session management in the identity provider authentication flow in Devolutions Server 2023.3.14.0 and earlier allows an authenticat (CVSS 5.5, Devolutions Server)
- [CVE-2024-1901](https://cve.now/CVE-2024-1901.md): Denial of service in PAM password rotation during the check-in process in Devolutions Server 2023.3.14.0 allows an authenticated user with s (CVSS 4.3, Devolutions Server)
- [CVE-2024-2179](https://cve.now/CVE-2024-2179.md): Concrete CMS version 9 before 9.2.7 is vulnerable to Stored XSS via the Name field of a Group type (CVSS 2.2, Concrete CMS · concrete5/concrete5)
- [CVE-2024-25616](https://cve.now/CVE-2024-25616.md): Aruba has identified certain configurations of ArubaOS that can lead to partial disclosure of sensitive information in the IKE\_AUTH negotiat (CVSS 3.7, Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…)
- [CVE-2024-25615](https://cve.now/CVE-2024-25615.md): An unauthenticated Denial-of-Service (DoS) vulnerability exists in the Spectrum service accessed via the PAPI protocol in ArubaOS 8.x. (CVSS 5.3, Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…)
- [CVE-2024-25614](https://cve.now/CVE-2024-25614.md): There is an arbitrary file deletion vulnerability in the CLI used by ArubaOS. (CVSS 5.5, Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…)
- [CVE-2024-25613](https://cve.now/CVE-2024-25613.md): Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. (CVSS 7.2, Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…)
- [CVE-2024-25612](https://cve.now/CVE-2024-25612.md): Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. (CVSS 7.2, Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…)
- [CVE-2024-25611](https://cve.now/CVE-2024-25611.md): Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. (CVSS 7.2, Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…)
- [CVE-2024-1356](https://cve.now/CVE-2024-1356.md): Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. (CVSS 7.2, Hewlett Packard Enterprise (HPE) ArubaOS Wi-Fi Controllers…)
- [CVE-2022-22399](https://cve.now/CVE-2022-22399.md): IBM Aspera Faspex HTTP header injection (CVSS 5.4, IBM Aspera Faspex)
- [CVE-2023-25681](https://cve.now/CVE-2023-25681.md): IBM Spectrum Virtualize security bypass (CVSS 5.3, IBM Spectrum Virtualize)
- [CVE-2023-26282](https://cve.now/CVE-2023-26282.md): IBM Watson CP4D Data Stores file modificiation (CVSS 4.2, IBM Watson CP4D Data Stores)
- [CVE-2024-23243](https://cve.now/CVE-2024-23243.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 4.3, Apple iOS and iPadOS)
- [CVE-2024-23296](https://cve.now/CVE-2024-23296.md): A memory corruption issue was addressed with improved validation. (CVSS 7.8, KEV, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-23225](https://cve.now/CVE-2024-23225.md): A memory corruption issue was addressed with improved validation. (CVSS 7.8, KEV, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-23256](https://cve.now/CVE-2024-23256.md): A logic issue was addressed with improved state management. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2024-2056](https://cve.now/CVE-2024-2056.md): Artica Proxy Loopback Services Remotely Accessible Unauthenticated (CVSS 9.8, Artica Tech Artica Proxy · github.com/gvalkov/tailon)
- [CVE-2024-2055](https://cve.now/CVE-2024-2055.md): Artica Proxy Unauthenticated File Manager Vulnerability (CVSS 9.8, Artica Tech Artica Proxy)
- [CVE-2024-2054](https://cve.now/CVE-2024-2054.md): Artica Proxy Unauthenticated PHP Deserialization Vulnerability (CVSS 9.8, Artica Tech Artica Proxy)
- [CVE-2024-2053](https://cve.now/CVE-2024-2053.md): Artica Proxy Unauthenticated LFI Protection Bypass Vulnerability (CVSS 7.5, Artica Tech Artica Proxy)
- [CVE-2023-35899](https://cve.now/CVE-2023-35899.md): IBM Cloud Pak for Automation CSV injection (CVSS 7.0, IBM Cloud Pak for Automation)
- [CVE-2024-2005](https://cve.now/CVE-2024-2005.md): SAML implementation allows privilege escalation (CVSS 9.0, Blue Planet Inventory · Blue Planet Orchestration +2)
- [CVE-2024-22352](https://cve.now/CVE-2024-22352.md): IBM InfoSphere Information Server information disclosure (CVSS 6.5, IBM InfoSphere Information Server)
- [CVE-2024-22255](https://cve.now/CVE-2024-22255.md): Information disclosure vulnerability (CVSS 7.1, VMware ESXi · VMware Workstation +2)
- [CVE-2024-22254](https://cve.now/CVE-2024-22254.md): Out-of-bounds write vulnerability (CVSS 7.9, VMware ESXi · VMware Cloud Foundation)
- [CVE-2024-22253](https://cve.now/CVE-2024-22253.md): Use-after-free vulnerability (CVSS 9.3, VMware ESXi · VMware Workstation +2)
- [CVE-2024-22252](https://cve.now/CVE-2024-22252.md): Use-after-free vulnerability (CVSS 9.3, VMware ESXi · VMware Workstation +2)
- [CVE-2024-27931](https://cve.now/CVE-2024-27931.md): Insufficient permission checking in \`Deno.makeTemp\*\` APIs (CVSS 5.8, denoland deno · deno)
- [CVE-2024-27929](https://cve.now/CVE-2024-27929.md): Use After Free in SixLabors.ImageSharp (CVSS 7.1, SixLabors ImageSharp · SixLabors.ImageSharp)
- [CVE-2024-1202](https://cve.now/CVE-2024-1202.md): Authentication Bypass in XPodas' Octopod (CVSS 9.8, XPodas Octopod)
- [CVE-2023-7103](https://cve.now/CVE-2023-7103.md): Authentication Bypass in ZKSoftware's UFace 5 (CVSS 9.8, ZKSoftware Biometric Security Solutions UFace)
- [CVE-2024-2188](https://cve.now/CVE-2024-2188.md): Cross-Site Scripting vulnerability in TP-Link Archer AX50 (CVSS 6.1, TP-Link Archer AX50)
- [CVE-2023-45600](https://cve.now/CVE-2023-45600.md): A CWE-613 “Insufficient Session Expiration” vulnerability in the web application, due to the session cookie “sessionid” lasting two weeks, f (CVSS 5.6, AiLux imx6 bundle)
- [CVE-2023-45599](https://cve.now/CVE-2023-45599.md): A CWE-646 “Reliance on File Name or Extension of Externally-Supplied File” vulnerability in the “iec61850” functionality of the web applicat (CVSS 5.5, AiLux imx6 bundle)
- [CVE-2023-45598](https://cve.now/CVE-2023-45598.md): A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “measure” functionality of the web application allows a remote unauthent (CVSS 5.3, AiLux imx6 bundle)
- [CVE-2023-45597](https://cve.now/CVE-2023-45597.md): A CWE-1236 “Improper Neutralization of Formula Elements in a CSV File” vulnerability in the “file\_configuration” functionality of the web ap (CVSS 5.9, AiLux imx6 bundle)
- [CVE-2023-45596](https://cve.now/CVE-2023-45596.md): A CWE-425 “Direct Request ('Forced Browsing')” vulnerability in the “file\_configuration” functionality of the web application allows a remot (CVSS 5.3, AiLux imx6 bundle)
- [CVE-2023-45595](https://cve.now/CVE-2023-45595.md): A CWE-434 “Unrestricted Upload of File with Dangerous Type” vulnerability in the “file\_configuration” functionality of the web application a (CVSS 5.9, AiLux imx6 bundle)
- [CVE-2023-45594](https://cve.now/CVE-2023-45594.md): A CWE-552 “Files or Directories Accessible to External Parties” vulnerability in the embedded Chromium browser allows a physical attacker to (CVSS 6.8, AiLux imx6 bundle)
- [CVE-2023-45593](https://cve.now/CVE-2023-45593.md): A CWE-184 “Incomplete List of Disallowed Inputs” vulnerability in the embedded Chromium browser (concerning the handling of alternative URLs (CVSS 6.8, AiLux imx6 bundle)
- [CVE-2023-45592](https://cve.now/CVE-2023-45592.md): A CWE-250 “Execution with Unnecessary Privileges” vulnerability in the embedded Chromium browser (due to the binary being executed with the (CVSS 6.8, AiLux imx6 bundle)
- [CVE-2023-45591](https://cve.now/CVE-2023-45591.md): A CWE-122 “Heap-based Buffer Overflow” vulnerability in the “logger\_generic” function of the “Ax\_rtu” binary allows a remote authenticated a (CVSS 7.5, AiLux imx6 bundle)
- [CVE-2022-48630](https://cve.now/CVE-2022-48630.md): crypto: qcom-rng - fix infinite loop on requests not multiple of WORD\_SZ (no CVSS, Linux)
- [CVE-2022-48629](https://cve.now/CVE-2022-48629.md): crypto: qcom-rng - ensure buffer for generate is completely filled (CVSS 8.1, Linux)
- [CVE-2023-5457](https://cve.now/CVE-2023-5457.md): A CWE-1269 “Product Released in Non-Release Configuration” vulnerability in the Django web framework used by the web application (due to the (CVSS 7.5, AiLux imx6 bundle)
- [CVE-2023-5456](https://cve.now/CVE-2023-5456.md): A CWE-798 “Use of Hard-coded Credentials” vulnerability in the MariaDB database of the web application allows a remote unauthenticated attac (CVSS 8.1, AiLux imx6 bundle)
- [CVE-2024-20833](https://cve.now/CVE-2024-20833.md): Use after free vulnerability in pub\_crypto\_recv\_msg prior to SMR Mar-2024 Release 1 due to race condition allows local attackers with system (CVSS 4.1, Samsung Mobile Devices)
- [CVE-2023-42419](https://cve.now/CVE-2023-42419.md): Improper Management of Cryptographic Keys in the Maintenance Server in QCOW Air-Gapped Distribution (China Edition) (CVSS 3.8, Cybellum Maintenance Server)
- [CVE-2024-20841](https://cve.now/CVE-2024-20841.md): Improper Handling of Insufficient Privileges in Samsung Account prior to version 14.8.00.3 allows local attackers to access data. (CVSS 5.1, Samsung Mobile Samnsung Account)
- [CVE-2024-20840](https://cve.now/CVE-2024-20840.md): Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02 in Android 14 allows (CVSS 5.7, Samsung Mobile Samsung Voice Recorder)
- [CVE-2024-20839](https://cve.now/CVE-2024-20839.md): Improper access control in Samsung Voice Recorder prior to versions 21.5.16.01 in Android 12 and Android 13, 21.4.51.02 in Android 14 allows (CVSS 4.6, Samsung Mobile Samsung Voice Recorder)
- [CVE-2024-20838](https://cve.now/CVE-2024-20838.md): Improper validation vulnerability in Samsung Internet prior to version 24.0.3.2 allows local attackers to execute arbitrary code. (CVSS 6.8, Samsung Mobile Samsung Internet)
- [CVE-2024-20837](https://cve.now/CVE-2024-20837.md): Improper handling of granting permission for Trusted Web Activities in Samsung Internet prior to version 24.0.0.41 allows local attackers to (CVSS 5.3, Samsung Mobile Samsung Internet)
- [CVE-2024-20836](https://cve.now/CVE-2024-20836.md): Out of bounds Read vulnerability in ssmis\_get\_frm in libsubextractor.so prior to SMR Mar-2024 Release 1 allows local attackers to read out o (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2024-20835](https://cve.now/CVE-2024-20835.md): Improper access control vulnerability in CustomFrequencyManagerService prior to SMR Mar-2024 Release 1 allows local attackers to execute pri (CVSS 4.0, Samsung Mobile Devices)
- [CVE-2024-20834](https://cve.now/CVE-2024-20834.md): The sensitive information exposure vulnerability in WlanTest prior to SMR Mar-2024 Release 1 allows local attackers to access MAC address wi (CVSS 3.3, Samsung Mobile Devices)
- [CVE-2024-20832](https://cve.now/CVE-2024-20832.md): Heap overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows local privileged attackers to execute arbitrary code. (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2024-20831](https://cve.now/CVE-2024-20831.md): Stack overflow in Little Kernel in bootloader prior to SMR Mar-2024 Release 1 allows local privileged attackers to execute arbitrary code. (CVSS 6.4, Samsung Mobile Devices)
- [CVE-2024-20830](https://cve.now/CVE-2024-20830.md): Incorrect default permission in AppLock prior to SMR MAr-2024 Release 1 allows local attackers to configure AppLock settings. (CVSS 5.3, Samsung Mobile Devices)
- [CVE-2024-20829](https://cve.now/CVE-2024-20829.md): Missing proper interaction for opening deeplink in Samsung Internet prior to version v24.0.0.0 allows remote attackers to open an applicatio (CVSS 5.4, Samsung Mobile Samsung Internet)
- [CVE-2023-52432](https://cve.now/CVE-2023-52432.md): Improper input validation in IpcTxSndSetLoopbackCtrl in libsec-ril prior to SMR Sep-2023 Release 1 allows local attackers to write out-of-bo (CVSS 5.9, Samsung Mobile Devices)
- [CVE-2024-22383](https://cve.now/CVE-2024-22383.md): Missing release of resource after effective lifetime (CWE-772) in the Controller 7000 resulted in HBUS connected T-Series readers to not au (CVSS 6.2, Gallagher Controller)
- [CVE-2024-21838](https://cve.now/CVE-2024-21838.md): Improper neutralization of special elements in output (CWE-74) used by the email generation feature of the Command Centre Server could lead (CVSS 6.8, Gallagher Command Centre Server)
- [CVE-2024-21815](https://cve.now/CVE-2024-21815.md): Insufficiently protected credentials (CWE-522) for third party DVR integrations to the Command Centre Server are accessible to authenticate (CVSS 9.1, Gallagher Command Centre Server)
- [CVE-2024-1093](https://cve.now/CVE-2024-1093.md): Change Memory Limit \<= 1.0 - Missing Authorization via admin\_logic() (CVSS 5.3, simon99 Change Memory Limit)
- [CVE-2024-1769](https://cve.now/CVE-2024-1769.md): JM Twitter Cards \<= 14 - Information Exposure via Meta Description (CVSS 5.3, jmlapam JM Twitter Cards)
- [CVE-2024-1381](https://cve.now/CVE-2024-1381.md): Page Builder Sandwich – Front End WordPress Page Builder Plugin \<= 5.1.0 - Sensitive Information Exposure (CVSS 6.5, pagebuildersandwich Page Builder Sandwich – Front End WordP…)
- [CVE-2024-0825](https://cve.now/CVE-2024-0825.md): Vimeography: Vimeo Video Gallery WordPress Plugin \<= 2.3.2 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, videogallery Vimeography: Vimeo Video Gallery WordPress Plu…)
- [CVE-2024-1088](https://cve.now/CVE-2024-1088.md): Password Protected Store for WooCommerce \<= 2.2 - Information Exposure via REST API (CVSS 5.3, rajkakadiya Password Protected Store for WooCommerce)
- [CVE-2024-1285](https://cve.now/CVE-2024-1285.md): Page Builder Sandwich \<= 5.1.0 - Missing Authorization to Authenticated(Subscriber+) Arbitrary Post Editing (CVSS 6.5, pagebuildersandwich Page Builder Sandwich – Front End WordP…)
- [CVE-2024-1731](https://cve.now/CVE-2024-1731.md): Auto Refresh Single Page \<= 1.1 - Authenticated (Contributor+) PHP Object Injection (CVSS 8.8, jkohlbach Auto Refresh Single Page)
- [CVE-2024-0698](https://cve.now/CVE-2024-0698.md): Easy!Appointments \<= 1.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, alextselegidis Easy!Appointments)
- [CVE-2024-1095](https://cve.now/CVE-2024-1095.md): Build & Control Block Patterns – Boost up Gutenberg Editor \<= 1.3.5.4 - Missing Authorization (CVSS 5.3, razib\_ Build & Control Block Patterns – Boost up Gutenberg…)
- [CVE-2024-1478](https://cve.now/CVE-2024-1478.md): Maintenance Mode \<= 3.0.1 - Information Exposure (CVSS 5.3, helderk Maintenance Mode)
- [CVE-2024-1782](https://cve.now/CVE-2024-1782.md): Blue Triad EZAnalytics \<= 1.0 - Reflected Cross-Site Scripting via 'bt\_webid' (CVSS 6.1, jbahlquist Blue Triad EZAnalytics)
- [CVE-2024-1178](https://cve.now/CVE-2024-1178.md): SportsPress – Sports Club & League Manager \<= 2.7.17 - Missing Authorization to Unauthenticated Event Permalink Update (CVSS 5.3, themeboy SportsPress – Sports Club & League Manager)
- [CVE-2022-46088](https://cve.now/CVE-2022-46088.md): Online Flight Booking Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the feedback form. (CVSS 6.1)
- [CVE-2023-38944](https://cve.now/CVE-2023-38944.md): An issue in Multilaser RE160V firmware v12.03.01.09\_pt and Multilaser RE163V firmware v12.03.01.10\_pt allows attackers to bypass the access (CVSS 9.8)
- [CVE-2023-43318](https://cve.now/CVE-2023-43318.md): TP-Link JetStream Smart Switch TL-SG2210P 5.0 Build 20211201 allows attackers to escalate privileges via modification of the 'tid' and 'usrl (CVSS 8.8)
- [CVE-2023-48644](https://cve.now/CVE-2023-48644.md): An issue was discovered in the Archibus app 4.0.3 for iOS. (CVSS 6.1)
- [CVE-2024-22188](https://cve.now/CVE-2024-22188.md): TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the pri (CVSS 7.2, typo3/cms-core)
- [CVE-2024-22889](https://cve.now/CVE-2024-22889.md): Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a cr (CVSS 5.5, plone)
- [CVE-2024-24098](https://cve.now/CVE-2024-24098.md): Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection via the News Feed. (CVSS 9.8)
- [CVE-2024-24275](https://cve.now/CVE-2024-24275.md): Cross Site Scripting vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive i (CVSS 9.6)
- [CVE-2024-24276](https://cve.now/CVE-2024-24276.md): Cross Site Scripting (XSS) vulnerability in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensi (CVSS 9.6)
- [CVE-2024-24278](https://cve.now/CVE-2024-24278.md): An issue in Teamwire Windows desktop client v.2.0.1 through v.2.4.0 allows a remote attacker to obtain sensitive information via a crafted p (CVSS 7.5)
- [CVE-2024-25269](https://cve.now/CVE-2024-25269.md): libheif \<= 1.17.6 contains a memory leak in the function JpegEncoder::Encode. (CVSS 7.5)
- [CVE-2024-25817](https://cve.now/CVE-2024-25817.md): Buffer Overflow vulnerability in eza before version 0.18.2, allows local attackers to execute arbitrary code via the .git/HEAD, .git/refs, a (CVSS 8.4, eza)
- [CVE-2024-25858](https://cve.now/CVE-2024-25858.md): In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScript could occur because of an unoptimized prompt m (CVSS 8.4)
- [CVE-2024-26333](https://cve.now/CVE-2024-26333.md): swftools v0.9.2 was discovered to contain a segmentation violation via the function free\_lines at swftools/lib/modules/swfshape.c. (CVSS 5.5)
- [CVE-2024-26334](https://cve.now/CVE-2024-26334.md): swftools v0.9.2 was discovered to contain a segmentation violation via the function compileSWFActionCode at swftools/lib/action/actioncompil (CVSS 6.2)
- [CVE-2024-26335](https://cve.now/CVE-2024-26335.md): swftools v0.9.2 was discovered to contain a segmentation violation via the function state\_free at swftools/src/swfc-history.c. (CVSS 5.5)
- [CVE-2024-26337](https://cve.now/CVE-2024-26337.md): swftools v0.9.2 was discovered to contain a segmentation violation via the function s\_font at swftools/src/swfc.c. (CVSS 4.3)
- [CVE-2024-26339](https://cve.now/CVE-2024-26339.md): swftools v0.9.2 was discovered to contain a strcpy parameter overlap via /home/swftools/src/swfc+0x48318a. (CVSS 9.1)
- [CVE-2024-27561](https://cve.now/CVE-2024-27561.md): A Server-Side Request Forgery (SSRF) in the installUpdateThemePluginAction function of WonderCMS v3.1.3 allows attackers to force the applic (CVSS 9.1)
- [CVE-2024-27563](https://cve.now/CVE-2024-27563.md): A Server-Side Request Forgery (SSRF) in the getFileFromRepo function of WonderCMS v3.1.3 allows attackers to force the application to make a (CVSS 6.5)
- [CVE-2024-27564](https://cve.now/CVE-2024-27564.md): pictureproxy.php in the dirk1983 mm1.ltd source code f9f4bbc allows SSRF via the url parameter. (CVSS 5.8, dirk1983 mm1.ltd source code)
- [CVE-2024-27565](https://cve.now/CVE-2024-27565.md): A Server-Side Request Forgery (SSRF) in weixin.php of ChatGPT-wechat-personal commit a0857f6 allows attackers to force the application to ma (CVSS 9.8)
- [CVE-2024-27622](https://cve.now/CVE-2024-27622.md): A remote code execution vulnerability has been identified in the User Defined Tags module of CMS Made Simple version 2.2.19 / 2.2.21. (CVSS 7.2)
- [CVE-2024-27623](https://cve.now/CVE-2024-27623.md): CMS Made Simple version 2.2.19 is vulnerable to Server-Side Template Injection (SSTI). (CVSS 5.9)
- [CVE-2024-27625](https://cve.now/CVE-2024-27625.md): CMS Made Simple Version 2.2.19 is vulnerable to Cross Site Scripting (XSS). (CVSS 4.8)
- [CVE-2024-27626](https://cve.now/CVE-2024-27626.md): A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in Dotclear version 2.29. (CVSS 6.1)
- [CVE-2024-27627](https://cve.now/CVE-2024-27627.md): A reflected cross-site scripting (XSS) vulnerability exists in SuperCali version 1.1.0, allowing remote attackers to execute arbitrary JavaS (CVSS 6.1)
- [CVE-2024-27764](https://cve.now/CVE-2024-27764.md): An issue in Jeewms v.3.7 and before allows a remote attacker to escalate privileges via the AuthInterceptor component. (CVSS 9.8)
- [CVE-2024-27765](https://cve.now/CVE-2024-27765.md): Directory Traversal vulnerability in Jeewms v.3.7 and before allows a remote attacker to obtain sensitive information via the cgformTemplate (CVSS 5.3)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.