# CVEs published 2024-03-08

103 CVEs were published on March 8, 2024: 6 critical, 29 high. Days are UTC.

- [CVE-2024-28123](https://cve.now/CVE-2024-28123.md): Wasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters (CVSS 7.3, wasmi-labs wasmi · wasmi)
- [CVE-2023-32264](https://cve.now/CVE-2023-32264.md): CWE-1385 vulnerability in OpenText Documentum D2 affecting versions16.5.1 to CE 23.2. (CVSS 5.8, OpenText Documentum D2)
- [CVE-2024-2339](https://cve.now/CVE-2024-2339.md): Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule (CVSS 8.0, DALIBO PostgreSQL Anonymizer)
- [CVE-2024-2338](https://cve.now/CVE-2024-2338.md): SQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule (CVSS 8.0, DALIBO PostgreSQL Anonymizer)
- [CVE-2022-43855](https://cve.now/CVE-2022-43855.md): IBM SPSS Statistics denial of service (CVSS 6.2, IBM SPSS Statistics)
- [CVE-2024-21901](https://cve.now/CVE-2024-21901.md): myQNAPcloud (CVSS 4.7, QNAP Systems myQNAPcloud · QNAP Systems QTS)
- [CVE-2024-21900](https://cve.now/CVE-2024-21900.md): QTS, QuTS hero, QuTScloud (CVSS 4.3, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2024-21899](https://cve.now/CVE-2024-21899.md): QTS, QuTS hero, QuTScloud (CVSS 9.8, QNAP Systems QTS · QNAP Systems QuTS hero +1)
- [CVE-2023-32969](https://cve.now/CVE-2023-32969.md): Network & Virtual Switch (CVSS 4.9, QNAP Systems QuTScloud · QNAP Systems QTS +1)
- [CVE-2023-34980](https://cve.now/CVE-2023-34980.md): QTS, QuTS hero (CVSS 5.9, QNAP Systems QTS · QNAP Systems QuTS hero)
- [CVE-2023-47221](https://cve.now/CVE-2023-47221.md): Photo Station (CVSS 5.5, QNAP Systems Photo Station)
- [CVE-2024-2319](https://cve.now/CVE-2024-2319.md): Cross-Site Scripting vulnerability in Django MarkdownX (CVSS 5.4, Django MarkdownX · django-markdownx)
- [CVE-2024-2318](https://cve.now/CVE-2024-2318.md): ZKTeco ZKBio Media Service Port 9999 download path traversal (CVSS 5.3, ZKTeco ZKBio Media)
- [CVE-2024-2317](https://cve.now/CVE-2024-2317.md): Bdtask Hospital AutoManager Prescription Page improper authorization (CVSS 3.8, Bdtask Hospital AutoManager)
- [CVE-2024-2316](https://cve.now/CVE-2024-2316.md): Bdtask Hospital AutoManager Update Bill Page cross-site request forgery (CVSS 4.3, Bdtask Hospital AutoManager)
- [CVE-2024-1851](https://cve.now/CVE-2024-1851.md): affiliate-toolkit – WordPress Affiliate Plugin \<= 3.5.4 - Missing Authorization via atkp\_create\_list (CVSS 6.3, cservit affiliate-toolkit – Multi-Network Affiliate & Amazo…)
- [CVE-2024-2298](https://cve.now/CVE-2024-2298.md): affiliate-toolkit – WordPress Affiliate Plugin \<= 3.5.4 - Missing Authorization via atkp\_import\_product (CVSS 4.3, cservit affiliate-toolkit – Multi-Network Affiliate & Amazo…)
- [CVE-2024-1987](https://cve.now/CVE-2024-1987.md): WP-Members Membership Plugin \<= 3.4.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, cbutlerjr WP-Members Membership Plugin)
- [CVE-2024-2285](https://cve.now/CVE-2024-2285.md): boyiddha Automated-Mess-Management-System member\_edit.php cross site scripting (CVSS 3.5, boyiddha Automated-Mess-Management-System)
- [CVE-2024-2284](https://cve.now/CVE-2024-2284.md): boyiddha Automated-Mess-Management-System Chat Book chat.php cross site scripting (CVSS 3.5, boyiddha Automated-Mess-Management-System)
- [CVE-2024-2283](https://cve.now/CVE-2024-2283.md): boyiddha Automated-Mess-Management-System view.php sql injection (CVSS 6.3, boyiddha Automated-Mess-Management-System)
- [CVE-2024-23259](https://cve.now/CVE-2024-23259.md): The issue was addressed with improved checks. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-23234](https://cve.now/CVE-2024-23234.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 7.8, Apple macOS)
- [CVE-2024-23263](https://cve.now/CVE-2024-23263.md): A logic issue was addressed with improved validation. (CVSS 8.1, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-23275](https://cve.now/CVE-2024-23275.md): A race condition was addressed with additional validation. (CVSS 4.7, Apple macOS)
- [CVE-2024-23255](https://cve.now/CVE-2024-23255.md): An authentication issue was addressed with improved state management. (CVSS 9.1, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-23238](https://cve.now/CVE-2024-23238.md): An access issue was addressed with improved access restrictions. (CVSS 7.1, Apple macOS)
- [CVE-2024-23280](https://cve.now/CVE-2024-23280.md): An injection issue was addressed with improved validation. (CVSS 7.5, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2024-23279](https://cve.now/CVE-2024-23279.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.3, Apple macOS)
- [CVE-2024-23297](https://cve.now/CVE-2024-23297.md): The issue was addressed with improved checks. (CVSS 5.5, Apple iOS and iPadOS · Apple tvOS +1)
- [CVE-2024-23278](https://cve.now/CVE-2024-23278.md): The issue was addressed with improved checks. (CVSS 7.7, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-0258](https://cve.now/CVE-2024-0258.md): The issue was addressed with improved memory handling. (CVSS 8.2, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23281](https://cve.now/CVE-2024-23281.md): This issue was addressed with improved state management. (CVSS 6.2, Apple macOS)
- [CVE-2024-23239](https://cve.now/CVE-2024-23239.md): A race condition was addressed with improved state handling. (CVSS 5.9, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23242](https://cve.now/CVE-2024-23242.md): A privacy issue was addressed by not logging contents of text fields. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-23254](https://cve.now/CVE-2024-23254.md): The issue was addressed with improved UI handling. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-23274](https://cve.now/CVE-2024-23274.md): An injection issue was addressed with improved input validation. (CVSS 8.4, Apple macOS)
- [CVE-2024-23262](https://cve.now/CVE-2024-23262.md): This issue was addressed with additional entitlement checks. (CVSS 4.3, Apple iOS and iPadOS · Apple visionOS)
- [CVE-2024-23235](https://cve.now/CVE-2024-23235.md): A race condition was addressed with additional validation. (CVSS 8.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-23258](https://cve.now/CVE-2024-23258.md): An out-of-bounds read was addressed with improved input validation. (CVSS 7.8, Apple macOS · Apple visionOS)
- [CVE-2024-23253](https://cve.now/CVE-2024-23253.md): A permissions issue was addressed with additional restrictions. (CVSS 7.5, Apple macOS)
- [CVE-2024-23245](https://cve.now/CVE-2024-23245.md): This issue was addressed by adding an additional prompt for user consent. (CVSS 5.4, Apple macOS)
- [CVE-2024-23286](https://cve.now/CVE-2024-23286.md): A buffer overflow issue was addressed with improved memory handling. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-23269](https://cve.now/CVE-2024-23269.md): A downgrade issue affecting Intel-based Mac computers was addressed with additional code-signing restrictions. (CVSS 6.2, Apple macOS)
- [CVE-2024-23290](https://cve.now/CVE-2024-23290.md): A logic issue was addressed with improved restrictions. (CVSS 5.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23249](https://cve.now/CVE-2024-23249.md): The issue was addressed with improved memory handling. (CVSS 6.2, Apple macOS)
- [CVE-2024-23232](https://cve.now/CVE-2024-23232.md): A privacy issue was addressed with improved handling of temporary files. (CVSS 3.3, Apple macOS)
- [CVE-2024-23265](https://cve.now/CVE-2024-23265.md): A memory corruption vulnerability was addressed with improved locking. (CVSS 9.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-23273](https://cve.now/CVE-2024-23273.md): This issue was addressed through improved state management. (CVSS 4.3, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2024-23272](https://cve.now/CVE-2024-23272.md): A logic issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-23264](https://cve.now/CVE-2024-23264.md): A validation issue was addressed with improved input sanitization. (CVSS 5.3, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23233](https://cve.now/CVE-2024-23233.md): This issue was addressed with improved checks. (CVSS 7.8, Apple macOS)
- [CVE-2024-23248](https://cve.now/CVE-2024-23248.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple macOS)
- [CVE-2024-23291](https://cve.now/CVE-2024-23291.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 7.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23287](https://cve.now/CVE-2024-23287.md): A privacy issue was addressed with improved handling of temporary files. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23268](https://cve.now/CVE-2024-23268.md): An injection issue was addressed with improved input validation. (CVSS 8.4, Apple macOS)
- [CVE-2024-23244](https://cve.now/CVE-2024-23244.md): A logic issue was addressed with improved restrictions. (CVSS 6.7, Apple macOS)
- [CVE-2024-23205](https://cve.now/CVE-2024-23205.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-23292](https://cve.now/CVE-2024-23292.md): This issue was addressed with improved data protection. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-23284](https://cve.now/CVE-2024-23284.md): A logic issue was addressed with improved state management. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +4)
- [CVE-2024-23247](https://cve.now/CVE-2024-23247.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple macOS)
- [CVE-2024-23226](https://cve.now/CVE-2024-23226.md): The issue was addressed with improved memory handling. (CVSS 8.8, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-23267](https://cve.now/CVE-2024-23267.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-23288](https://cve.now/CVE-2024-23288.md): This issue was addressed by removing the vulnerable code. (CVSS 8.4, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23230](https://cve.now/CVE-2024-23230.md): This issue was addressed with improved file handling. (CVSS 5.5, Apple macOS)
- [CVE-2024-23231](https://cve.now/CVE-2024-23231.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23266](https://cve.now/CVE-2024-23266.md): The issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2024-23289](https://cve.now/CVE-2024-23289.md): A lock screen issue was addressed with improved state management. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23270](https://cve.now/CVE-2024-23270.md): The issue was addressed with improved memory handling. (CVSS 7.8, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23227](https://cve.now/CVE-2024-23227.md): This issue was addressed with improved redaction of sensitive information. (CVSS 6.2, Apple macOS)
- [CVE-2024-23250](https://cve.now/CVE-2024-23250.md): An access issue was addressed with improved access restrictions. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23246](https://cve.now/CVE-2024-23246.md): This issue was addressed by removing the vulnerable code. (CVSS 8.1, Apple iOS and iPadOS · Apple macOS +3)
- [CVE-2024-23285](https://cve.now/CVE-2024-23285.md): This issue was addressed with improved handling of symlinks. (CVSS 7.8, Apple macOS)
- [CVE-2024-23293](https://cve.now/CVE-2024-23293.md): This issue was addressed through improved state management. (CVSS 4.6, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23220](https://cve.now/CVE-2024-23220.md): The issue was addressed with improved handling of caches. (CVSS 4.0, Apple iOS and iPadOS · Apple visionOS)
- [CVE-2023-28826](https://cve.now/CVE-2023-28826.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple macOS · Apple iOS and iPadOS)
- [CVE-2024-23277](https://cve.now/CVE-2024-23277.md): The issue was addressed with improved checks. (CVSS 5.9, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-23294](https://cve.now/CVE-2024-23294.md): This issue was addressed by removing the vulnerable code. (CVSS 7.8, Apple macOS)
- [CVE-2024-23241](https://cve.now/CVE-2024-23241.md): This issue was addressed through improved state management. (CVSS 6.5, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23216](https://cve.now/CVE-2024-23216.md): A path handling issue was addressed with improved validation. (CVSS 6.7, Apple macOS)
- [CVE-2024-23257](https://cve.now/CVE-2024-23257.md): The issue was addressed with improved memory handling. (CVSS 3.3, Apple iOS and iPadOS · Apple macOS +1)
- [CVE-2024-23201](https://cve.now/CVE-2024-23201.md): A permissions issue was addressed with additional restrictions. (CVSS 6.2, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2024-23240](https://cve.now/CVE-2024-23240.md): The issue was addressed with improved checks. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2024-23283](https://cve.now/CVE-2024-23283.md): A privacy issue was addressed with improved private data redaction for log entries. (CVSS 6.2, Apple iOS and iPadOS · Apple macOS)
- [CVE-2024-23295](https://cve.now/CVE-2024-23295.md): A permissions issue was addressed to help ensure Personas are always protected. (CVSS 6.2, Apple visionOS)
- [CVE-2024-23260](https://cve.now/CVE-2024-23260.md): This issue was addressed by removing additional entitlements. (CVSS 5.5, Apple macOS)
- [CVE-2024-23276](https://cve.now/CVE-2024-23276.md): A logic issue was addressed with improved checks. (CVSS 8.4, Apple macOS)
- [CVE-2024-2282](https://cve.now/CVE-2024-2282.md): boyiddha Automated-Mess-Management-System Login Page index.php sql injection (CVSS 7.3, boyiddha Automated-Mess-Management-System)
- [CVE-2024-2281](https://cve.now/CVE-2024-2281.md): boyiddha Automated-Mess-Management-System Setting index.php access control (CVSS 6.3, boyiddha Automated-Mess-Management-System)
- [CVE-2024-2277](https://cve.now/CVE-2024-2277.md): Bdtask G-Prescription Gynaecology & OBS Consultation Software Password Reset change\_password\_save cross-site request forgery (CVSS 4.3, Bdtask G-Prescription Gynaecology & OBS Consultation Softwa…)
- [CVE-2024-2276](https://cve.now/CVE-2024-2276.md): Bdtask G-Prescription Gynaecology & OBS Consultation Software Edit Venue Page cross site scripting (CVSS 2.4, Bdtask G-Prescription Gynaecology & OBS Consultation Softwa…)
- [CVE-2024-2275](https://cve.now/CVE-2024-2275.md): Bdtask G-Prescription Gynaecology & OBS Consultation Software OBS Patient/Gynee Prescription cross site scripting (CVSS 2.4, Bdtask G-Prescription Gynaecology & OBS Consultation Softwa…)
- [CVE-2024-2274](https://cve.now/CVE-2024-2274.md): Bdtask G-Prescription Gynaecology & OBS Consultation Software Prescription Dashboard Index cross site scripting (CVSS 2.4, Bdtask G-Prescription Gynaecology & OBS Consultation Softwa…)
- [CVE-2019-6268](https://cve.now/CVE-2019-6268.md): RAD SecFlow-2 devices with Hardware 0202, Firmware 4.1.01.63, and U-Boot 2010.12 allow URIs beginning with /.. (CVSS 7.5)
- [CVE-2024-25845](https://cve.now/CVE-2024-25845.md): In the module "CD Custom Fields 4 Orders" (cdcustomfields4orders) \<= 1.0.0 from Cleanpresta.com for PrestaShop, a guest can perform SQL inje (CVSS 9.8)
- [CVE-2024-25848](https://cve.now/CVE-2024-25848.md): In the module "Ever Ultimate SEO" (everpsseo) \<= 8.1.2 from Team Ever for PrestaShop, a guest can perform SQL injection in affected versions (CVSS 5.9)
- [CVE-2024-25849](https://cve.now/CVE-2024-25849.md): In the module "Make an offer" (makeanoffer) \<= 1.7.1 from PrestaToolKit for PrestaShop, a guest can perform SQL injection via MakeOffers::ch (CVSS 9.8)
- [CVE-2024-26309](https://cve.now/CVE-2024-26309.md): Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a sensitive information disclosure vulnerability. (CVSS 5.3)
- [CVE-2024-26313](https://cve.now/CVE-2024-26313.md): Archer Platform 6.x before 6.14 P2 HF2 (6.14.0.2.2) contains a stored cross-site scripting (XSS) vulnerability. (CVSS 7.3)
- [CVE-2024-27612](https://cve.now/CVE-2024-27612.md): Numbas editor before 7.3 mishandles editing of themes and extensions. (CVSS 6.2)
- [CVE-2024-27613](https://cve.now/CVE-2024-27613.md): Numbas editor before 7.3 mishandles reading of themes and extensions. (CVSS 7.3)
- [CVE-2024-28753](https://cve.now/CVE-2024-28753.md): RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to read the /etc/passwd file via a crafted request. (CVSS 6.5)
- [CVE-2024-28754](https://cve.now/CVE-2024-28754.md): RaspAP (aka raspap-webgui) through 3.0.9 allows remote attackers to cause a persistent denial of service (bricking) via a crafted request. (CVSS 7.5, billz/raspap-webgui)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-08
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.