CVEs published March 9, 2024
24 CVEs were published on March 9, 2024: 2 critical, 6 high.
- Published
- 24
- Critical
- 2
- High
- 6
- Medium
- 16
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- metagauss EventPrime – Events Calendar, Bookings and Tickets
- 4
- Netentsec NS-ASG Application Security Gateway
- 2
- CodeAstro Ecommerce Site
- 1
- CodeAstro Membership Management System
- 1
- creativethemeshq Blocksy
- 1
- extendthemes Colibri Page Builder
- 1
- go-jose · github.com/go-jose/go-jose/v4 +3
- 1
- Integrated Dell Remote Access Controller
- 1
- Kozea WeasyPrint · weasyprint
- 1
- lestrrat-go jwx · github.com/lestrrat-go/jwx/v2 +1
- 1
Critical 2
- CVE-2023-46427An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial
- CVE-2023-49340An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to escalate privileg
High 6
- CVE-2024-25951A command injection vulnerability exists in local RACADM.Integrated Dell Remote Access Controller
- CVE-2024-28184WeasyPrint allows the attachment of arbitrary files and URLs to a PDFKozea WeasyPrint · weasyprint
- CVE-2023-46426Heap-based Buffer Overflow vulnerability in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code
- CVE-2023-49341An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II_G_V1.00.011, allows remote attackers to obtain sensitive
- CVE-2023-50015An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect ac
- CVE-2024-25501An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter.
Medium, low and unrated 16
- CVE-2024-2351CodeAstro Ecommerce Site Search action.php sql injectionCodeAstro Ecommerce Site
- CVE-2024-2333CodeAstro Membership Management System add_members.php sql injectionCodeAstro Membership Management System
- CVE-2024-2332SourceCodester Online Mobile Management Store HTTP GET Request manage_category.php sql injectionSourceCodester Online Mobile Management Store
- CVE-2024-2331SourceCodester Tourist Reservation System System.cpp ad_writedata buffer overflowSourceCodester Tourist Reservation System
- CVE-2024-1870Colibri Page Builder <= 1.0.260 - Missing Authorizationextendthemes Colibri Page Builder
- CVE-2024-2330Netentsec NS-ASG Application Security Gateway index.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-2329Netentsec NS-ASG Application Security Gateway sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-1767Blocksy <= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy
- CVE-2024-1125EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletionmetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-1320EventPrime – Events Calendar, Bookings and Tickets <= 3.4.3 - Unauthenticated Stored Cross-Site Scriptingmetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-1123EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Arbitrary Post Overwritemetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-1124EventPrime – Events Calendar, Bookings and Tickets <= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sendingmetagauss EventPrime – Events Calendar, Bookings and Tickets
- CVE-2024-28180Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification)go-jose · github.com/go-jose/go-jose/v4 +3
- CVE-2024-28122 JWX vulnerable to a denial of service attack using compressed JWE messagelestrrat-go jwx · github.com/lestrrat-go/jwx/v2 +1
- CVE-2024-28176jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintextpanva jose · jose +2
- CVE-2024-28089Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity (who has access to the router admin panel