CVEs published March 7, 2024
95 CVEs were published on March 7, 2024: 15 critical, 29 high.
- Published
- 95
- Critical
- 15
- High
- 29
- Medium
- 48
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- keerti1924 Online-Book-Store-Website
- 6
- NAVER nGrinder
- 5
- IBM DS8900F
- 4
- paddlepaddle/paddle · paddlepaddle
- 4
- Schoolbox Pty Schoolbox
- 4
- JetBrains YouTrack
- 3
- JFrog Artifactory
- 3
- GitLab
- 2
- keerti1924 PHP-MYSQL-User-Login-System
- 2
- MSI Afterburner
- 2
Critical 15
- CVE-2024-2044Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4pgadmin.org pgAdmin · pgadmin4
- CVE-2024-0818Arbitrary File Overwrite Via Path Traversal in paddlepaddle/paddle before 2.6paddlepaddle/paddle · paddlepaddle
- CVE-2023-42662JFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access TokensJFrog Artifactory
- CVE-2024-0917remote code execution in paddlepaddle/paddle 2.6.0paddlepaddle/paddle · paddlepaddle
- CVE-2024-28213nGrinder before 3.5.9 allows to accept serialized Java objects from unauthenticated users, which could allow remote attacker to execute arbiNAVER nGrinder · org.ngrinder:ngrinder-core
- CVE-2024-28212nGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute arbitrary code via unsafe deserialization.NAVER nGrinder
- CVE-2024-28211nGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be the cause of executing arbitrary code via RMINAVER nGrinder
- CVE-2024-0815Command injection in paddle.utils.download._wget_download (bypass filter) in paddlepaddle/paddle 2.6.0paddlepaddle/paddle · paddlepaddle
- CVE-2024-0817Command injection in IrGraph.draw in paddlepaddle/paddle 2.6.0paddlepaddle/paddle · paddlepaddle
- CVE-2023-41014code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via the Username parameter for "Employer."
- CVE-2023-41503Student Enrollment In PHP v1.0 was discovered to contain a SQL injection vulnerability via the Login function.
- CVE-2023-49989Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at update.php.
- CVE-2023-51786An issue was discovered in Lustre versions 2.13.x, 2.14.x, and 2.15.x before 2.15.4, allows attackers to escalate privileges and obtain sens
- CVE-2024-22857Heap based buffer flow in zlog v1.1.0 to v1.2.17 in zlog_rule_new().The size of record_name is MAXLEN_PATH(1024) + 1 but file_path may have
- CVE-2024-28222In Veritas NetBackup before 8.1.2 and NetBackup Appliance before 3.1.2, the BPCD process inadequately validates the file path, allowing an u
High 29
- CVE-2024-2264keerti1924 PHP-MYSQL-User-Login-System login.php sql injectionkeerti1924 PHP-MYSQL-User-Login-System
- CVE-2024-28115Privilege Escalation in FreeRTOS Kernel ARMv7-M MPU ports and ARMv8-M ports with MPU support enabledFreeRTOS-Kernel
- CVE-2024-1986Elite Booster for WooCommerce <= 7.1.7 - Authenticated (Subscriber+) Arbitrary File Uploadpluggabl Booster Elite for WooCommerce
- CVE-2024-0203The Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.1.UnitedOver Digits: WordPress Mobile Number Signup and Login
- CVE-2024-1773PDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injectionacowebs PDF Invoices and Packing Slips For WooCommerce
- CVE-2024-1351MongoDB Server may allow successful untrusted connectionMongoDB Server
- CVE-2023-48725A stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule() functionality of Netgear RAX30 1.0.11.96 and 1.0.7Netgear RAX30
- CVE-2023-42661JFrog Artifactory Improper input validation leads to arbitrary file writeJFrog Artifactory
- CVE-2024-1169Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Uploadthemekraft Post Form – Registration Form – Profile Form for…
- CVE-2024-1170Post Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletionthemekraft Post Form – Registration Form – Profile Form for…
- CVE-2024-1931Denial of service when trimming EDE text on positive repliesNLnet Labs Unbound
- CVE-2024-1382Restaurant Reservations <= 1.9 - Directory Traversal to Authenticated (Contributor+) Local File Inclusionnicdark Restaurant Reservations
- CVE-2023-51395Z-Wave S0 Decryption Vulnerability in End DevicesSilicon Labs Z-Wave SDK
- CVE-2024-28215nGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of access control, which could be the cause oNAVER nGrinder
- CVE-2024-28097Stored Cross-site Scripting in Calendar functionality in SchoolboxSchoolbox Pty Schoolbox
- CVE-2024-28096Stored Cross-site Scripting in Class functionality in SchoolboxSchoolbox Pty Schoolbox
- CVE-2024-28095Stored Cross-site Scripting in News functionality in SchoolboxSchoolbox Pty Schoolbox
- CVE-2024-28094Blind SQL Injection in Chat functionality in SchoolboxSchoolbox Pty Schoolbox
- CVE-2024-0199Incorrect Authorization in GitLabGitLab
- CVE-2022-46497Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_doc_view_single_p
- CVE-2022-46499Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the pat_number parameter at his_admin_view_single
- CVE-2023-33676Sourcecodester Lost and Found Information System's Version 1.0 is vulnerable to unauthenticated SQL Injection at "?page=items/view&id=*" whi
- CVE-2023-47415Cypress Solutions CTM-200 v2.7.1.5600 and below was discovered to contain an OS command injection vulnerability via the cli_text parameter.
- CVE-2023-49988Hotel Booking Management v1.0 was discovered to contain a SQL injection vulnerability via the npss parameter at rooms.php.
- CVE-2024-22752Insecure permissions issue in EaseUS MobiMover 6.0.5 Build 21620 allows attackers to gain escalated privileges via use of crafted executable
- CVE-2024-24375SQL injection vulnerability in Jfinalcms v.5.0.0 allows a remote attacker to obtain sensitive information via /admin/admin name parameter.
- CVE-2024-25729Arris SBG6580 devices have predictable default WPA2 security passwords that could lead to unauthorized remote access.
- CVE-2024-26566An issue in Cute Http File Server v.3.1 allows a remote attacker to escalate privileges via the password verification component.
- CVE-2024-27733File Upload vulnerability in Byzro Network Smart s42 Management Platform v.S42 allows a local attacker to execute arbitrary code via the use
Medium, low and unrated 51
- CVE-2024-2272keerti1924 Online-Book-Store-Website HTTP POST Request home.php sql injectionkeerti1924 Online-Book-Store-Website
- CVE-2024-2271keerti1924 Online-Book-Store-Website HTTP POST Request shop.php sql injectionkeerti1924 Online-Book-Store-Website
- CVE-2024-2270keerti1924 Online-Book-Store-Website signup.php cross site scriptingkeerti1924 Online-Book-Store-Website
- CVE-2024-2269keerti1924 Online-Book-Store-Website search.php sql injectionkeerti1924 Online-Book-Store-Website
- CVE-2024-2268keerti1924 Online-Book-Store-Website unrestricted uploadkeerti1924 Online-Book-Store-Website
- CVE-2024-2267keerti1924 Online-Book-Store-Website shop.php logic errorkeerti1924 Online-Book-Store-Website
- CVE-2024-2266keerti1924 Secret-Coder-PHP-Project Login Page login.php cross site scriptingkeerti1924 Secret-Coder-PHP-Project
- CVE-2024-2265keerti1924 PHP-MYSQL-User-Login-System login.sql inclusion of sensitive information in source codekeerti1924 PHP-MYSQL-User-Login-System
- CVE-2023-46169IBM DS8900F file manipulationIBM DS8900F
- CVE-2023-46172IBM DS8900F security bypassIBM DS8900F
- CVE-2024-1802EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via Wistia Blockwpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2023-46170IBM DS8900F information disclosureIBM DS8900F
- CVE-2023-46171IBM DS8900F information disclosureIBM DS8900F
- CVE-2024-26167Microsoft Edge for Android Spoofing VulnerabilityMicrosoft Edge for Android
- CVE-2024-1725Kubevirt-csi: persistentvolume allows access to hcp's root nodekubevirt-csi-driver · Red Hat OpenShift Container Platfo… +1
- CVE-2024-2127Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributessoftaculous Page Builder: Pagelayer – Drag and Drop website…
- CVE-2024-2128EmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via EmbedPress PDF Widgetwpdevteam EmbedPress – PDF Embedder, Embed YouTube Videos,…
- CVE-2024-1442User with permissions to create a data source can CRUD all data sourcesGrafana · github.com/grafana/grafana
- CVE-2023-42509JFrog Artifactory Sensitive Data Leakage in Repository configuration processJFrog Artifactory
- CVE-2024-2241Improper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier allows an authenticated user to perform unintendDevolutions Workspace
- CVE-2024-2245Cross-Site Scripting vulnerability in moziloCMSmoziloCMS
- CVE-2024-28230In JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible without project admin permissionsJetBrains YouTrack
- CVE-2024-28229In JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore issues and articlesJetBrains YouTrack
- CVE-2024-28228In JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in HelpDesk was possibleJetBrains YouTrack
- CVE-2024-22256VMware Cloud Director contains a partial information disclosure vulnerability.VMware Cloud Director
- CVE-2024-1534Booster for WooCommerce <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocdepluggabl Booster for WooCommerce – PDF Invoices, Abandoned…
- CVE-2024-2136WPKoi Templates for Elementor <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widgetwpkoithemes WPKoi Templates for Elementor
- CVE-2024-1419The Plus Addons for Elementor <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content Widgetposimyththemes The Plus Addons for Elementor – Addons for E…
- CVE-2024-1506Prime Slider – Addons For Elementor <= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widgetbdthemes Prime Slider – Addons for Elementor
- CVE-2024-1377Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widgetthehappymonster Happy Addons for Elementor
- CVE-2024-1500Royal Elementor Addons and Templates <= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widgetwproyal Royal Addons for Elementor – Addons and Templates K…
- CVE-2024-1720User Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scriptingwpeverest User Registration & Membership – Free & Paid Memb…
- CVE-2024-1366Happy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widgetthehappymonster Happy Addons for Elementor
- CVE-2024-28216nGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of access control, which could be the cause oNAVER nGrinder
- CVE-2024-28214nGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial of Service by remote attacker.NAVER nGrinder
- CVE-2024-1761WP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributesninjateam WP Chat App
- CVE-2024-1460MSI Afterburner v4.6.5.16370 - Kernel Memory LeakMSI Afterburner
- CVE-2024-1443MSI Afterburner v4.6.5.16370 - Denial of ServiceMSI Afterburner
- CVE-2024-1299Privilege Chaining in GitLabGitLab
- CVE-2022-46089Cross Site Scripting (XSS) vulnerability in the add-airline form of Online Flight Booking Management System v1.0 allows attackers to execute
- CVE-2022-46091Cross Site Scripting (XSS) vulnerability in the feedback form of Online Flight Booking Management System v1.0 allows attackers to execute ar
- CVE-2022-46498Hospital Management System 1.0 was discovered to contain a SQL injection vulnerability via the doc_number parameter at his_admin_view_single
- CVE-2023-41015code-projects.org Online Job Portal 1.0 is vulnerable to SQL Injection via /Employer/DeleteJob.php?JobId=1.
- CVE-2023-49986A cross-site scripting (XSS) vulnerability in the component /admin/parent of School Fees Management System 1.0 allow attackers to execute ar
- CVE-2023-49987A cross-site scripting (XSS) vulnerability in the component /management/term of School Fees Management System v1.0 allows attackers to execu
- CVE-2023-51281Cross Site Scripting vulnerability in Customer Support System v.1.0 allows a remote attacker to escalate privileges via a crafted script fir
- CVE-2024-24035Cross Site Scripting (XSS) vulnerability in Setor Informatica SIL 3.1 allows attackers to run arbitrary code via the hmessage parameter.
- CVE-2024-24389A cross-site scripting (XSS) vulnerability in XunRuiCMS up to v4.6.2 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2024-25327Cross Site Scripting (XSS) vulnerability in Justice Systems FullCourt Enterprise v.8.2 allows a remote attacker to execute arbitrary code vi
- CVE-2024-26492An issue in Online Diagnostic Lab Management System 1.0 allows a remote attacker to gain control of a 'Staff' user account via a crafted POS
- CVE-2024-27707Server Side Request Forgery (SSRF) vulnerability in hcengineering Huly Platform v.0.6.202 allows attackers to run arbitrary code via upload