# CVEs published 2024-03-06

120 CVEs were published on March 6, 2024: 9 critical, 49 high. Days are UTC.

- [CVE-2024-2236](https://cve.now/CVE-2024-2236.md): Libgcrypt: vulnerable to marvin attack (CVSS 5.9, libgcrypt · Red Hat Enterprise Linux)
- [CVE-2024-28111](https://cve.now/CVE-2024-28111.md): CSV Injection in exported history CSV files (CVSS 6.5, thinkst canarytokens)
- [CVE-2024-28110](https://cve.now/CVE-2024-28110.md): Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials (CVSS 7.5, cloudevents sdk-go · github.com/cloudevents/sdk-go/v2)
- [CVE-2024-28102](https://cve.now/CVE-2024-28102.md): JWCrypto vulnerable to JWT bomb Attack in \`deserialize\` function (CVSS 6.8, latchset jwcrypto · jwcrypto)
- [CVE-2024-28101](https://cve.now/CVE-2024-28101.md): Apollo Router's Compressed Payloads do not respect HTTP Payload Limits (CVSS 7.5, apollographql router · apollo-router)
- [CVE-2024-27936](https://cve.now/CVE-2024-27936.md): Deno interactive permission prompt spoofing via improper ANSI stripping (CVSS 8.8, denoland deno · deno +1)
- [CVE-2024-27935](https://cve.now/CVE-2024-27935.md): Deno's Node.js Compatibility Runtime has Cross-Session Data Contamination (CVSS 7.2, denoland deno · deno)
- [CVE-2024-27934](https://cve.now/CVE-2024-27934.md): \*const c\_void / ExternalPointer unsoundness leading to use-after-free (CVSS 8.4, denoland deno · deno)
- [CVE-2024-27933](https://cve.now/CVE-2024-27933.md): Deno arbitrary file descriptor close via \`op\_node\_ipc\_pipe()\` leading to permission prompt bypass (CVSS 8.3, denoland deno · deno)
- [CVE-2024-27932](https://cve.now/CVE-2024-27932.md): Deno's improper suffix match testing for DENO\_AUTH\_TOKENS (CVSS 4.6, denoland deno · deno)
- [CVE-2024-27927](https://cve.now/CVE-2024-27927.md): RSSHub vulnerable to SSRF in /mastodon, /zjoi, and /m4 (CVSS 6.5, DIYgod RSSHub · rsshub)
- [CVE-2024-27926](https://cve.now/CVE-2024-27926.md): RSSHub Cross-site Scripting vulnerability caused by internal media proxy (CVSS 6.1, DIYgod RSSHub · rsshub)
- [CVE-2024-27922](https://cve.now/CVE-2024-27922.md): HTTP Handling Vulnerability in the Bare server (CVSS 9.8, tomphttp bare-server-node · @tomphttp/bare-server-node)
- [CVE-2024-27923](https://cve.now/CVE-2024-27923.md): Remote Code Execution by uploading a phar file using frontmatter (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2024-27918](https://cve.now/CVE-2024-27918.md): Coder's OIDC authentication allows email with partially matching domain to register (CVSS 8.2, coder · github.com/coder/coder/v2 +1)
- [CVE-2024-27916](https://cve.now/CVE-2024-27916.md): \`GetRepositoryByName\`, \`DeleteRepositoryByName\` and \`GetArtifactByName\` allow access of arbitrary repositories in Minder by any authenticated user (CVSS 7.1, stacklok minder · github.com/stacklok/minder)
- [CVE-2024-1142](https://cve.now/CVE-2024-1142.md): Sonatype IQ Server - Path Traversal (CVSS 5.4, Sonatype IQ Server)
- [CVE-2024-27917](https://cve.now/CVE-2024-27917.md): Shopware's session is persistent in Cache for 404 pages (CVSS 7.5, shopware · shopware/storefront +1)
- [CVE-2024-27915](https://cve.now/CVE-2024-27915.md): Sulu grants access to pages regardless of role permissions (CVSS 6.8, sulu · sulu/sulu)
- [CVE-2024-27308](https://cve.now/CVE-2024-27308.md): Mio's tokens for named pipes may be delivered after deregistration (CVSS 7.5, tokio-rs mio · mio)
- [CVE-2024-27307](https://cve.now/CVE-2024-27307.md): JSONata expression can pollute the "Object" prototype (CVSS 9.8, jsonata-js jsonata · jsonata)
- [CVE-2023-48703](https://cve.now/CVE-2023-48703.md): SAML authentication bypass vulnerability in RobotsAndPencils/go-saml (CVSS 7.5, RobotsAndPencils go-saml · github.com/RobotsAndPencils/go-s…)
- [CVE-2024-27304](https://cve.now/CVE-2024-27304.md): pgx SQL Injection via Protocol Message Size Overflow (CVSS 9.8, jackc pgx · github.com/jackc/pgproto3 +4)
- [CVE-2024-27303](https://cve.now/CVE-2024-27303.md): electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only) (CVSS 7.3, electron-userland electron-builder · app-builder-lib)
- [CVE-2024-2176](https://cve.now/CVE-2024-2176.md): Use after free in FedCM in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2024-2174](https://cve.now/CVE-2024-2174.md): Inappropriate implementation in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to potentially exploit heap corruption (CVSS 8.8, Google Chrome)
- [CVE-2024-2173](https://cve.now/CVE-2024-2173.md): Out of bounds memory access in V8 in Google Chrome prior to 122.0.6261.111 allowed a remote attacker to perform out of bounds memory access (CVSS 6.8, Google Chrome)
- [CVE-2024-27302](https://cve.now/CVE-2024-27302.md): Authorization Bypass Through User-Controlled Key in go-zero (CVSS 9.1, zeromicro go-zero · github.com/zeromicro/go-zero)
- [CVE-2024-27289](https://cve.now/CVE-2024-27289.md): pgx SQL Injection via Line Comment Creation (CVSS 8.1, jackc pgx · github.com/jackc/pgx +1)
- [CVE-2024-27288](https://cve.now/CVE-2024-27288.md): 1Panel open source panel project has an unauthorized vulnerability. (CVSS 6.3, 1Panel-dev 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2024-27287](https://cve.now/CVE-2024-27287.md): ESPHome vulnerable to stored Cross-site Scripting in edit configuration file API (CVSS 6.5, esphome)
- [CVE-2024-25111](https://cve.now/CVE-2024-25111.md): SQUID-2024:1 Denial of Service in HTTP Chunked Decoding (CVSS 8.6, squid-cache squid)
- [CVE-2024-24766](https://cve.now/CVE-2024-24766.md): CasaOS Username Enumeration (CVSS 6.2, IceWhaleTech CasaOS-UserService · github.com/IceWhaleTech/C…)
- [CVE-2024-24767](https://cve.now/CVE-2024-24767.md): CasaOS Improper Restriction of Excessive Authentication Attempts vulnerability (CVSS 9.1, IceWhaleTech CasaOS-UserService · github.com/IceWhaleTech/C…)
- [CVE-2024-24765](https://cve.now/CVE-2024-24765.md): CasaOS-UserService allows unauthorized access to any file (CVSS 7.5, IceWhaleTech CasaOS-UserService · github.com/IceWhaleTech/C…)
- [CVE-2024-24761](https://cve.now/CVE-2024-24761.md): Galette public pages accessibility restriction (CVSS 7.5, galette)
- [CVE-2023-50716](https://cve.now/CVE-2023-50716.md): Invalid DATA\_FRAG Submessage causes a bad-free error (CVSS 9.7, eProsima Fast-DDS)
- [CVE-2023-50167](https://cve.now/CVE-2023-50167.md): Pega Platform from 7.1.7 to 23.1.1 is affected by an XSS issue with editing/rendering user html content. (CVSS 5.4, Pegasystems Pega Platform)
- [CVE-2024-28162](https://cve.now/CVE-2024-28162.md): In Jenkins Delphix Plugin 3.0.1 through 3.1.0 (both inclusive) a global option for administrators to enable or disable SSL/TLS certificate v (CVSS 4.2, Jenkins Project Jenkins Delphix Plugin · org.jenkins-ci.plu…)
- [CVE-2024-28161](https://cve.now/CVE-2024-28161.md): In Jenkins Delphix Plugin 3.0.1, a global option for administrators to enable or disable SSL/TLS certificate validation for Data Control Tow (CVSS 5.3, Jenkins Project Jenkins Delphix Plugin · org.jenkins-ci.plu…)
- [CVE-2024-28160](https://cve.now/CVE-2024-28160.md): Jenkins iceScrum Plugin 1.1.6 and earlier does not sanitize iceScrum project URLs on build views, resulting in a stored cross-site scripting (CVSS 8.8, Jenkins Project Jenkins iceScrum Plugin · org.jenkins-ci.pl…)
- [CVE-2024-28159](https://cve.now/CVE-2024-28159.md): A missing permission check in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers with Item/Read permission (CVSS 4.3, Jenkins Project Jenkins Subversion Partial Release Manager…)
- [CVE-2024-28158](https://cve.now/CVE-2024-28158.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Partial Release Manager Plugin 1.0.1 and earlier allows attackers to (CVSS 4.3, Jenkins Project Jenkins Subversion Partial Release Manager…)
- [CVE-2024-28157](https://cve.now/CVE-2024-28157.md): Jenkins GitBucket Plugin 0.8 and earlier does not sanitize Gitbucket URLs on build views, resulting in a stored cross-site scripting (XSS) v (CVSS 8.0, Jenkins Project Jenkins GitBucket Plugin · org.jenkins-ci.p…)
- [CVE-2024-28156](https://cve.now/CVE-2024-28156.md): Jenkins Build Monitor View Plugin 1.14-860.vd06ef2568b\_3f and earlier does not escape Build Monitor View names, resulting in a stored cross- (CVSS 5.4, Jenkins Project Jenkins Build Monitor View Plugin · org.jen…)
- [CVE-2024-28155](https://cve.now/CVE-2024-28155.md): Jenkins AppSpider Plugin 1.0.16 and earlier does not perform permission checks in several HTTP endpoints, allowing attackers with Overall/Re (CVSS 4.3, Jenkins Project Jenkins AppSpider Plugin · com.rapid7:jenki…)
- [CVE-2024-28154](https://cve.now/CVE-2024-28154.md): Jenkins MQ Notifier Plugin 1.4.0 and earlier logs potentially sensitive build parameters as part of debug information in build logs by defau (CVSS 6.5, Jenkins Project Jenkins MQ Notifier Plugin · com.sonymobile…)
- [CVE-2024-28153](https://cve.now/CVE-2024-28153.md): Jenkins OWASP Dependency-Check Plugin 5.4.5 and earlier does not escape vulnerability metadata from Dependency-Check reports, resulting in a (CVSS 7.3, Jenkins Project Jenkins OWASP Dependency-Check Plugin · org…)
- [CVE-2024-28152](https://cve.now/CVE-2024-28152.md): In Jenkins Bitbucket Branch Source Plugin 866.vdea\_7dcd3008e and earlier, except 848.850.v6a\_a\_2a\_234a\_c81, when discovering pull requests f (CVSS 6.3, Jenkins Project Jenkins Bitbucket Branch Source Plugin · or…)
- [CVE-2024-28151](https://cve.now/CVE-2024-28151.md): Jenkins HTML Publisher Plugin 1.32 and earlier archives invalid symbolic links in report directories on agents and recreates them on the con (CVSS 4.3, Jenkins Project Jenkins HTML Publisher Plugin · org.jenkins…)
- [CVE-2024-28150](https://cve.now/CVE-2024-28150.md): Jenkins HTML Publisher Plugin 1.32 and earlier does not escape job names, report names, and index page titles shown as part of the report fr (CVSS 4.7, Jenkins Project Jenkins HTML Publisher Plugin · org.jenkins…)
- [CVE-2024-28149](https://cve.now/CVE-2024-28149.md): Jenkins HTML Publisher Plugin 1.16 through 1.32 (both inclusive) does not properly sanitize input, allowing attackers with Item/Configure pe (CVSS 6.5, Jenkins Project Jenkins HTML Publisher Plugin · org.jenkins…)
- [CVE-2024-2216](https://cve.now/CVE-2024-2216.md): A missing permission check in an HTTP endpoint in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers with Overall/Read permi (CVSS 8.8, Jenkins Project Jenkins docker-build-step Plugin · org.jenk…)
- [CVE-2024-2215](https://cve.now/CVE-2024-2215.md): A cross-site request forgery (CSRF) vulnerability in Jenkins docker-build-step Plugin 2.11 and earlier allows attackers to connect to an att (CVSS 6.1, Jenkins Project Jenkins docker-build-step Plugin · org.jenk…)
- [CVE-2024-28174](https://cve.now/CVE-2024-28174.md): In JetBrains TeamCity before 2023.11.4 presigned URL generation requests in S3 Artifact Storage plugin were authorized improperly (CVSS 5.8, JetBrains TeamCity)
- [CVE-2024-28173](https://cve.now/CVE-2024-28173.md): In JetBrains TeamCity between 2023.11 and 2023.11.4 custom build parameters of the "password" type could be disclosed (CVSS 4.3, JetBrains TeamCity)
- [CVE-2024-20345](https://cve.now/CVE-2024-20345.md): A vulnerability in the file upload functionality of Cisco AppDynamics Controller could allow an authenticated, remote attacker to conduct di (CVSS 6.5, Cisco AppDynamics)
- [CVE-2024-20346](https://cve.now/CVE-2024-20346.md): A vulnerability in the web-based management interface of Cisco AppDynamics Controller could allow an authenticated, remote attacker to perfo (CVSS 5.4, Cisco AppDynamics)
- [CVE-2024-20292](https://cve.now/CVE-2024-20292.md): A vulnerability in the logging component of Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, local attacker (CVSS 4.4, Cisco Duo)
- [CVE-2024-20336](https://cve.now/CVE-2024-20336.md): A vulnerability in the web-based user interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authenticated, (CVSS 6.5, Cisco Business Wireless Access Point Software)
- [CVE-2024-20335](https://cve.now/CVE-2024-20335.md): A vulnerability in the web-based management interface of Cisco Small Business 100, 300, and 500 Series Wireless APs could allow an authentic (CVSS 6.5, Cisco Business Wireless Access Point Software)
- [CVE-2024-20337](https://cve.now/CVE-2024-20337.md): A vulnerability in the SAML authentication process of Cisco Secure Client could allow an unauthenticated, remote attacker to conduct a carri (CVSS 8.2, Cisco Secure Client)
- [CVE-2024-20338](https://cve.now/CVE-2024-20338.md): A vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to ele (CVSS 7.3, Cisco Secure Client)
- [CVE-2024-20301](https://cve.now/CVE-2024-20301.md): A vulnerability in Cisco Duo Authentication for Windows Logon and RDP could allow an authenticated, physical attacker to bypass secondary au (CVSS 6.2, Cisco Duo)
- [CVE-2023-50740](https://cve.now/CVE-2023-50740.md): Apache Linkis DataSource: DataSource module Oracle SQL Database Password Logged (CVSS 5.3, Apache Software Foundation Apache Linkis DataSource · org.a…)
- [CVE-2024-26580](https://cve.now/CVE-2024-26580.md): Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability (CVSS 9.1, Apache Software Foundation Apache InLong · org.apache.inlon…)
- [CVE-2024-25103](https://cve.now/CVE-2024-25103.md): Dynamic Link Library (DLL) Hijacking Vulnerability in CDAC AppSamvid Software (CVSS 6.3, CDAC AppSamvid Software)
- [CVE-2024-25102](https://cve.now/CVE-2024-25102.md): Information Disclosure Vulnerability in CDAC AppSamvid Software (CVSS 7.8, CDAC AppSamvid Software)
- [CVE-2024-1224](https://cve.now/CVE-2024-1224.md): Information Disclosure Vulnerability in CDAC USB Pratirodh (CVSS 7.1, CDAC USB Pratirodh)
- [CVE-2024-2211](https://cve.now/CVE-2024-2211.md): Cross-Site Scripting vulnerability in Gophish Admin Panel (CVSS 4.6, Gophish Admin Panel)
- [CVE-2024-26627](https://cve.now/CVE-2024-26627.md): scsi: core: Move scsi\_host\_busy() out of host lock for waking up EH handler (CVSS 5.5, Linux)
- [CVE-2024-26626](https://cve.now/CVE-2024-26626.md): ipmr: fix kernel panic when forwarding mcast packets (CVSS 7.5, Linux)
- [CVE-2024-26625](https://cve.now/CVE-2024-26625.md): llc: call sock\_orphan() at release time (CVSS 7.8, Linux)
- [CVE-2024-26623](https://cve.now/CVE-2024-26623.md): pds\_core: Prevent race issues involving the adminq (CVSS 7.8, Linux)
- [CVE-2023-52607](https://cve.now/CVE-2023-52607.md): powerpc/mm: Fix null-pointer dereference in pgtable\_cache\_add (CVSS 5.5, Linux)
- [CVE-2023-52606](https://cve.now/CVE-2023-52606.md): powerpc/lib: Validate size for vector operations (CVSS 7.8, Linux)
- [CVE-2023-52604](https://cve.now/CVE-2023-52604.md): FS:JFS:UBSAN:array-index-out-of-bounds in dbAdjTree (CVSS 7.8, Linux)
- [CVE-2023-52603](https://cve.now/CVE-2023-52603.md): UBSAN: array-index-out-of-bounds in dtSplitRoot (CVSS 7.8, Linux)
- [CVE-2023-52602](https://cve.now/CVE-2023-52602.md): jfs: fix slab-out-of-bounds Read in dtSearch (CVSS 7.8, Linux)
- [CVE-2023-52601](https://cve.now/CVE-2023-52601.md): jfs: fix array-index-out-of-bounds in dbAdjTree (CVSS 7.8, Linux)
- [CVE-2023-52600](https://cve.now/CVE-2023-52600.md): jfs: fix uaf in jfs\_evict\_inode (CVSS 7.8, Linux)
- [CVE-2023-52599](https://cve.now/CVE-2023-52599.md): jfs: fix array-index-out-of-bounds in diNewExt (CVSS 7.8, Linux)
- [CVE-2023-52598](https://cve.now/CVE-2023-52598.md): s390/ptrace: handle setting of fpc register correctly (no CVSS, Linux)
- [CVE-2023-52597](https://cve.now/CVE-2023-52597.md): KVM: s390: fix setting of fpc register (CVSS 4.0, Linux)
- [CVE-2023-52596](https://cve.now/CVE-2023-52596.md): sysctl: Fix out of bounds access for empty sysctl registers (no CVSS, Linux)
- [CVE-2023-52595](https://cve.now/CVE-2023-52595.md): wifi: rt2x00: restart beacon queue when hardware reset (no CVSS, Linux)
- [CVE-2023-52594](https://cve.now/CVE-2023-52594.md): wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k\_htc\_txstatus() (no CVSS, Linux)
- [CVE-2023-52593](https://cve.now/CVE-2023-52593.md): wifi: wfx: fix possible NULL pointer dereference in wfx\_set\_mfp\_ap() (no CVSS, Linux)
- [CVE-2023-52591](https://cve.now/CVE-2023-52591.md): reiserfs: Avoid touching renamed directory if parent does not change (CVSS 7.8, Linux)
- [CVE-2023-52590](https://cve.now/CVE-2023-52590.md): ocfs2: Avoid touching renamed directory if parent does not change (CVSS 7.8, Linux)
- [CVE-2023-52589](https://cve.now/CVE-2023-52589.md): media: rkisp1: Fix IRQ disable race issue (no CVSS, Linux)
- [CVE-2023-52588](https://cve.now/CVE-2023-52588.md): f2fs: fix to tag gcing flag on page during block migration (CVSS 7.3, Linux)
- [CVE-2023-52587](https://cve.now/CVE-2023-52587.md): IB/ipoib: Fix mcast list locking (no CVSS, Linux)
- [CVE-2023-52586](https://cve.now/CVE-2023-52586.md): drm/msm/dpu: Add mutex lock in control vblank irq (CVSS 7.8, Linux)
- [CVE-2023-52585](https://cve.now/CVE-2023-52585.md): drm/amdgpu: Fix possible NULL dereference in amdgpu\_ras\_query\_error\_status\_helper() (CVSS 5.5, Linux)
- [CVE-2023-52584](https://cve.now/CVE-2023-52584.md): spmi: mediatek: Fix UAF on device remove (CVSS 3.8, Linux)
- [CVE-2023-52583](https://cve.now/CVE-2023-52583.md): ceph: fix deadlock or deadcode of misusing dget() (no CVSS, Linux)
- [CVE-2024-1989](https://cve.now/CVE-2024-1989.md): Social Sharing Plugin – Sassy Social Share \<= 3.3.58 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, heateor Social Sharing Plugin – Sassy Social Share)
- [CVE-2024-1771](https://cve.now/CVE-2024-1771.md): Total \<= 2.1.59 - Missing Authorization to Authenticated (Subscriber+) Sections Update (CVSS 4.3, hashthemes Total)
- [CVE-2024-1760](https://cve.now/CVE-2024-1760.md): Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin \<= 1.6.6.20 - Cross-Site Request Forgery to Plugin Data Reset (CVSS 4.3, croixhaug Appointment Booking Calendar — Simply Schedule Ap…)
- [CVE-2024-1220](https://cve.now/CVE-2024-1220.md): NPort W2150A/W2250A Series Web Server Stack-based Buffer Overflow Vulnerability (CVSS 8.2, Moxa NPort W2150A/W2250A Series)
- [CVE-2020-26942](https://cve.now/CVE-2020-26942.md): An issue discovered in Axigen Mail Server 10.3.x before 10.3.1.27 and 10.3.2.x before 10.3.3.1 allows unauthenticated attackers to submit a (CVSS 9.1)
- [CVE-2023-33677](https://cve.now/CVE-2023-33677.md): Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=\*". (CVSS 5.4)
- [CVE-2023-38825](https://cve.now/CVE-2023-38825.md): SQL injection vulnerability in Vanderbilt REDCap before v.13.8.0 allows a remote attacker to obtain sensitive information via the password r (CVSS 9.8)
- [CVE-2023-38945](https://cve.now/CVE-2023-38945.md): Multilaser RE160 v5.07.51\_pt\_MTL01 and v5.07.52\_pt\_MTL01, Multilaser RE160V v12.03.01.08\_pt and V12.03.01.09\_pt, and Multilaser RE163V v12.0 (CVSS 8.8)
- [CVE-2023-38946](https://cve.now/CVE-2023-38946.md): An issue in Multilaser RE160 firmware v5.07.51\_pt\_MTL01 and v5.07.52\_pt\_MTL01 allows attackers to bypass the access control and gain complet (CVSS 8.8)
- [CVE-2023-49971](https://cve.now/CVE-2023-49971.md): A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra (CVSS 4.7)
- [CVE-2023-49973](https://cve.now/CVE-2023-49973.md): A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra (CVSS 6.1)
- [CVE-2023-49974](https://cve.now/CVE-2023-49974.md): A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra (CVSS 6.1)
- [CVE-2023-49976](https://cve.now/CVE-2023-49976.md): A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra (CVSS 5.4)
- [CVE-2023-49977](https://cve.now/CVE-2023-49977.md): A cross-site scripting (XSS) vulnerability in Customer Support System v1 allows attackers to execute arbitrary web scripts or HTML via a cra (CVSS 5.4)
- [CVE-2023-49978](https://cve.now/CVE-2023-49978.md): Incorrect access control in Customer Support System v1 allows non-administrator users to access administrative pages and execute actions res (CVSS 7.2)
- [CVE-2023-49979](https://cve.now/CVE-2023-49979.md): A directory listing vulnerability in Customer Support System v1 allows attackers to list directories and sensitive files within the applicat (CVSS 7.5)
- [CVE-2023-49980](https://cve.now/CVE-2023-49980.md): A directory listing vulnerability in Best Student Result Management System v1.0 allows attackers to list directories and sensitive files wit (CVSS 7.5)
- [CVE-2023-49981](https://cve.now/CVE-2023-49981.md): A directory listing vulnerability in School Fees Management System v1.0 allows attackers to list directories and sensitive files within the (CVSS 7.5)
- [CVE-2023-49982](https://cve.now/CVE-2023-49982.md): Broken access control in the component /admin/management/users of School Fees Management System v1.0 allows attackers to escalate privileges (CVSS 8.8)
- [CVE-2023-49983](https://cve.now/CVE-2023-49983.md): A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to exec (CVSS 6.8)
- [CVE-2023-49984](https://cve.now/CVE-2023-49984.md): A cross-site scripting (XSS) vulnerability in the component /management/settings of School Fees Management System v1.0 allows attackers to e (CVSS 6.1)
- [CVE-2023-49985](https://cve.now/CVE-2023-49985.md): A cross-site scripting (XSS) vulnerability in the component /management/class of School Fees Management System v1.0 allows attackers to exec (CVSS 6.5)
- [CVE-2024-25359](https://cve.now/CVE-2024-25359.md): An issue in zuoxingdong lagom v.0.1.2 allows a local attacker to execute arbitrary code via the pickle\_load function of the serialize.py fil (CVSS 6.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.