CVEs published March 6, 2024
120 CVEs were published on March 6, 2024: 9 critical, 49 high.
- Published
- 120
- Critical
- 9
- High
- 49
- Medium
- 53
- Low
- 1
- Unrated
- 8
- Now in CISA KEV
- 0
- Fix available
- 54
Most affected products
- Linux
- 27
- denoland deno · deno
- 4
- Google Chrome
- 3
- IceWhaleTech CasaOS-UserService · github.com/IceWhaleTech/C…
- 3
- Jenkins Project Jenkins HTML Publisher Plugin · org.jenkins…
- 3
- CDAC AppSamvid Software
- 2
- Cisco AppDynamics
- 2
- Cisco Business Wireless Access Point Software
- 2
- Cisco Duo
- 2
- Cisco Secure Client
- 2
Critical 9
- CVE-2024-27922HTTP Handling Vulnerability in the Bare servertomphttp bare-server-node · @tomphttp/bare-server-node
- CVE-2024-27307JSONata expression can pollute the "Object" prototypejsonata-js jsonata · jsonata
- CVE-2024-27304pgx SQL Injection via Protocol Message Size Overflowjackc pgx · github.com/jackc/pgproto3 +4
- CVE-2024-27302Authorization Bypass Through User-Controlled Key in go-zerozeromicro go-zero · github.com/zeromicro/go-zero
- CVE-2024-24767CasaOS Improper Restriction of Excessive Authentication Attempts vulnerabilityIceWhaleTech CasaOS-UserService · github.com/IceWhaleTech/C…
- CVE-2023-50716Invalid DATA_FRAG Submessage causes a bad-free erroreProsima Fast-DDS
- CVE-2024-26580Apache InLong: Logged-in user could exploit an arbitrary file read vulnerabilityApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2020-26942An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a
- CVE-2023-38825SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive information via the password r
High 49
- CVE-2024-28110Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentialscloudevents sdk-go · github.com/cloudevents/sdk-go/v2
- CVE-2024-28101Apollo Router's Compressed Payloads do not respect HTTP Payload Limitsapollographql router · apollo-router
- CVE-2024-27936Deno interactive permission prompt spoofing via improper ANSI strippingdenoland deno · deno +1
- CVE-2024-27935Deno's Node.js Compatibility Runtime has Cross-Session Data Contaminationdenoland deno · deno
- CVE-2024-27934*const c_void / ExternalPointer unsoundness leading to use-after-freedenoland deno · deno
- CVE-2024-27933Deno arbitrary file descriptor close via `op_node_ipc_pipe()` leading to permission prompt bypassdenoland deno · deno
- CVE-2024-27923Remote Code Execution by uploading a phar file using frontmattergetgrav grav · getgrav/grav
- CVE-2024-27918Coder's OIDC authentication allows email with partially matching domain to registercoder · github.com/coder/coder/v2 +1
- CVE-2024-27916`GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated userstacklok minder · github.com/stacklok/minder
- CVE-2024-27917Shopware's session is persistent in Cache for 404 pagesshopware · shopware/storefront +1
- CVE-2024-27308Mio's tokens for named pipes may be delivered after deregistrationtokio-rs mio · mio
- CVE-2023-48703SAML authentication bypass vulnerability in RobotsAndPencils/go-samlRobotsAndPencils go-saml · github.com/RobotsAndPencils/go-s…
- CVE-2024-27303electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)electron-userland electron-builder · app-builder-lib
- CVE-2024-2176Use after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2024-2174Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruptionGoogle Chrome
- CVE-2024-27289pgx SQL Injection via Line Comment Creationjackc pgx · github.com/jackc/pgx +1
- CVE-2024-25111SQUID-2024:1 Denial of Service in HTTP Chunked Decodingsquid-cache squid
- CVE-2024-24765CasaOS-UserService allows unauthorized access to any fileIceWhaleTech CasaOS-UserService · github.com/IceWhaleTech/C…
- CVE-2024-24761Galette public pages accessibility restrictiongalette
- CVE-2024-28160Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scriptingJenkins Project Jenkins iceScrum Plugin · org.jenkins-ci.pl…
- CVE-2024-28157Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) vJenkins Project Jenkins GitBucket Plugin · org.jenkins-ci.p…
- CVE-2024-28153Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in aJenkins Project Jenkins OWASP Dependency-Check Plugin · org…
- CVE-2024-2216A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permiJenkins Project Jenkins docker-build-step Plugin · org.jenk…
- CVE-2024-20337A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carriCisco Secure Client
- CVE-2024-20338A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to eleCisco Secure Client
- CVE-2024-25102Information Disclosure Vulnerability in CDAC AppSamvid SoftwareCDAC AppSamvid Software
- CVE-2024-1224Information Disclosure Vulnerability in CDAC USB PratirodhCDAC USB Pratirodh
- CVE-2024-26626ipmr: fix kernel panic when forwarding mcast packetsLinux
- CVE-2024-26625llc: call sock_orphan() at release timeLinux
- CVE-2024-26623pds_core: Prevent race issues involving the adminqLinux
- CVE-2023-52606powerpc/lib: Validate size for vector operationsLinux
- CVE-2023-52604FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTreeLinux
- CVE-2023-52603UBSAN: array-index-out-of-bounds in dtSplitRootLinux
- CVE-2023-52602jfs: fix slab-out-of-bounds Read in dtSearchLinux
- CVE-2023-52601jfs: fix array-index-out-of-bounds in dbAdjTreeLinux
- CVE-2023-52600jfs: fix uaf in jfs_evict_inodeLinux
- CVE-2023-52599jfs: fix array-index-out-of-bounds in diNewExtLinux
- CVE-2023-52591reiserfs: Avoid touching renamed directory if parent does not changeLinux
- CVE-2023-52590ocfs2: Avoid touching renamed directory if parent does not changeLinux
- CVE-2023-52588f2fs: fix to tag gcing flag on page during block migrationLinux
- CVE-2023-52586drm/msm/dpu: Add mutex lock in control vblank irqLinux
- CVE-2024-1220NPort W2150A/W2250A Series Web Server Stack-based Buffer Overflow VulnerabilityMoxa NPort W2150A/W2250A Series
- CVE-2023-38945Multilaser RE160 v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01, Multilaser RE160V v12.03.01.08_pt and V12.03.01.09_pt, and Multilaser RE163V v12.0
- CVE-2023-38946An issue in Multilaser RE160 firmware v5.07.51_pt_MTL01 and v5.07.52_pt_MTL01 allows attackers to bypass the access control and gain complet
- CVE-2023-49978Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions res
- CVE-2023-49979A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the applicat
- CVE-2023-49980A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files wit
- CVE-2023-49981A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the
- CVE-2023-49982Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges
Medium, low and unrated 62
- CVE-2024-2236Libgcrypt: vulnerable to marvin attacklibgcrypt · Red Hat Enterprise Linux
- CVE-2024-28111CSV Injection in exported history CSV filesthinkst canarytokens
- CVE-2024-28102JWCrypto vulnerable to JWT bomb Attack in `deserialize` functionlatchset jwcrypto · jwcrypto
- CVE-2024-27932Deno's improper suffix match testing for DENO_AUTH_TOKENSdenoland deno · deno
- CVE-2024-27927RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4DIYgod RSSHub · rsshub
- CVE-2024-27926RSSHub Cross-site Scripting vulnerability caused by internal media proxyDIYgod RSSHub · rsshub
- CVE-2024-1142Sonatype IQ Server - Path TraversalSonatype IQ Server
- CVE-2024-27915Sulu grants access to pages regardless of role permissionssulu · sulu/sulu
- CVE-2024-2173Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access Google Chrome
- CVE-2024-272881Panel open source panel project has an unauthorized vulnerability.1Panel-dev 1Panel · github.com/1Panel-dev/1Panel
- CVE-2024-27287ESPHome vulnerable to stored Cross-site Scripting in edit configuration file APIesphome
- CVE-2024-24766CasaOS Username EnumerationIceWhaleTech CasaOS-UserService · github.com/IceWhaleTech/C…
- CVE-2023-50167Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content.Pegasystems Pega Platform
- CVE-2024-28162In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate vJenkins Project Jenkins Delphix Plugin · org.jenkins-ci.plu…
- CVE-2024-28161In Jenkins Delphix Plugin 3.0.1, a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control TowJenkins Project Jenkins Delphix Plugin · org.jenkins-ci.plu…
- CVE-2024-28159A missing permission check in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers with Item/Read permissionJenkins Project Jenkins Subversion Partial Release Manager…
- CVE-2024-28158A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers toJenkins Project Jenkins Subversion Partial Release Manager…
- CVE-2024-28156Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b_3f and earlier does not escape Build Monitor View names, resulting in a stored cross-Jenkins Project Jenkins Build Monitor View Plugin · org.jen…
- CVE-2024-28155Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/ReJenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…
- CVE-2024-28154Jenkins MQ Notifier Plugin 1.4.0 and earlier logs potentially sensitive build parameters as part of debug information in build logs by defauJenkins Project Jenkins MQ Notifier Plugin · com.sonymobile…
- CVE-2024-28152In Jenkins Bitbucket Branch Source Plugin 866.vdea_7dcd3008e and earlier, except 848.850.v6a_a_2a_234a_c81, when discovering pull requests fJenkins Project Jenkins Bitbucket Branch Source Plugin · or…
- CVE-2024-28151Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the conJenkins Project Jenkins HTML Publisher Plugin · org.jenkins…
- CVE-2024-28150Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report frJenkins Project Jenkins HTML Publisher Plugin · org.jenkins…
- CVE-2024-28149Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure peJenkins Project Jenkins HTML Publisher Plugin · org.jenkins…
- CVE-2024-2215A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an attJenkins Project Jenkins docker-build-step Plugin · org.jenk…
- CVE-2024-28174In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperlyJetBrains TeamCity
- CVE-2024-28173In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosedJetBrains TeamCity
- CVE-2024-20345A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct diCisco AppDynamics
- CVE-2024-20346A vulnerability in the web-based management interface of Cisco AppDynamics Controller could allow an authenticated, remote attacker to perfoCisco AppDynamics
- CVE-2024-20292A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker Cisco Duo
- CVE-2024-20336A vulnerability in the web-based user interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated, Cisco Business Wireless Access Point Software
- CVE-2024-20335A vulnerability in the web-based management interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticCisco Business Wireless Access Point Software
- CVE-2024-20301A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary auCisco Duo
- CVE-2023-50740Apache Linkis DataSource: DataSource module Oracle SQL Database Password LoggedApache Software Foundation Apache Linkis DataSource · org.a…
- CVE-2024-25103Dynamic Link Library (DLL) Hijacking Vulnerability in CDAC AppSamvid SoftwareCDAC AppSamvid Software
- CVE-2024-2211Cross-Site Scripting vulnerability in Gophish Admin PanelGophish Admin Panel
- CVE-2024-26627scsi: core: Move scsi_host_busy() out of host lock for waking up EH handlerLinux
- CVE-2023-52607powerpc/mm: Fix null-pointer dereference in pgtable_cache_addLinux
- CVE-2023-52598s390/ptrace: handle setting of fpc register correctlyLinux
- CVE-2023-52597KVM: s390: fix setting of fpc registerLinux
- CVE-2023-52596sysctl: Fix out of bounds access for empty sysctl registersLinux
- CVE-2023-52595wifi: rt2x00: restart beacon queue when hardware resetLinux
- CVE-2023-52594wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus()Linux
- CVE-2023-52593wifi: wfx: fix possible NULL pointer dereference in wfx_set_mfp_ap()Linux
- CVE-2023-52589media: rkisp1: Fix IRQ disable race issueLinux
- CVE-2023-52587IB/ipoib: Fix mcast list lockingLinux
- CVE-2023-52585drm/amdgpu: Fix possible NULL dereference in amdgpu_ras_query_error_status_helper()Linux
- CVE-2023-52584spmi: mediatek: Fix UAF on device removeLinux
- CVE-2023-52583ceph: fix deadlock or deadcode of misusing dget()Linux
- CVE-2024-1989Social Sharing Plugin – Sassy Social Share <= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodeheateor Social Sharing Plugin – Sassy Social Share
- CVE-2024-1771Total <= 2.1.59 - Missing Authorization to Authenticated (Subscriber+) Sections Updatehashthemes Total
- CVE-2024-1760Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data Resetcroixhaug Appointment Booking Calendar — Simply Schedule Ap…
- CVE-2023-33677Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=*".
- CVE-2023-49971A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra
- CVE-2023-49973A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra
- CVE-2023-49974A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra
- CVE-2023-49976A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra
- CVE-2023-49977A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra
- CVE-2023-49983A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to exec
- CVE-2023-49984A cross-site scripting (XSS) vulnerability in the component /management/settings of School Fees Management System v1.0 allows attackers to e
- CVE-2023-49985A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to exec
- CVE-2024-25359An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle_load function of the serialize.py fil