# CVEs published 2024-03-09

24 CVEs were published on March 9, 2024: 2 critical, 6 high. Days are UTC.

- [CVE-2024-2351](https://cve.now/CVE-2024-2351.md): CodeAstro Ecommerce Site Search action.php sql injection (CVSS 6.3, CodeAstro Ecommerce Site)
- [CVE-2024-2333](https://cve.now/CVE-2024-2333.md): CodeAstro Membership Management System add\_members.php sql injection (CVSS 6.3, CodeAstro Membership Management System)
- [CVE-2024-2332](https://cve.now/CVE-2024-2332.md): SourceCodester Online Mobile Management Store HTTP GET Request manage\_category.php sql injection (CVSS 6.3, SourceCodester Online Mobile Management Store)
- [CVE-2024-2331](https://cve.now/CVE-2024-2331.md): SourceCodester Tourist Reservation System System.cpp ad\_writedata buffer overflow (CVSS 6.3, SourceCodester Tourist Reservation System)
- [CVE-2024-1870](https://cve.now/CVE-2024-1870.md): Colibri Page Builder \<= 1.0.260 - Missing Authorization (CVSS 4.3, extendthemes Colibri Page Builder)
- [CVE-2024-2330](https://cve.now/CVE-2024-2330.md): Netentsec NS-ASG Application Security Gateway index.php sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-2329](https://cve.now/CVE-2024-2329.md): Netentsec NS-ASG Application Security Gateway sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-1767](https://cve.now/CVE-2024-1767.md): Blocksy \<= 2.0.26 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, creativethemeshq Blocksy)
- [CVE-2024-1125](https://cve.now/CVE-2024-1125.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (CVSS 5.4, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2024-1320](https://cve.now/CVE-2024-1320.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.5, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2024-1123](https://cve.now/CVE-2024-1123.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.2 - Missing Authorization to Arbitrary Post Overwrite (CVSS 6.5, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2024-1124](https://cve.now/CVE-2024-1124.md): EventPrime – Events Calendar, Bookings and Tickets \<= 3.4.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Email Sending (CVSS 4.3, metagauss EventPrime – Events Calendar, Bookings and Tickets)
- [CVE-2024-25951](https://cve.now/CVE-2024-25951.md): A command injection vulnerability exists in local RACADM. (CVSS 8.0, Integrated Dell Remote Access Controller)
- [CVE-2024-28180](https://cve.now/CVE-2024-28180.md): Go JOSE vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) (CVSS 4.3, go-jose · github.com/go-jose/go-jose/v4 +3)
- [CVE-2024-28184](https://cve.now/CVE-2024-28184.md): WeasyPrint allows the attachment of arbitrary files and URLs to a PDF (CVSS 7.4, Kozea WeasyPrint · weasyprint)
- [CVE-2024-28122](https://cve.now/CVE-2024-28122.md): JWX vulnerable to a denial of service attack using compressed JWE message (CVSS 6.8, lestrrat-go jwx · github.com/lestrrat-go/jwx/v2 +1)
- [CVE-2024-28176](https://cve.now/CVE-2024-28176.md): jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext (CVSS 4.9, panva jose · jose +2)
- [CVE-2023-46426](https://cve.now/CVE-2023-46426.md): Heap-based Buffer Overflow vulnerability in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code (CVSS 8.8)
- [CVE-2023-46427](https://cve.now/CVE-2023-46427.md): An issue was discovered in gpac version 2.3-DEV-rev588-g7edc40fee-master, allows remote attackers to execute arbitrary code, cause a denial (CVSS 9.8)
- [CVE-2023-49340](https://cve.now/CVE-2023-49340.md): An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II\_G\_V1.00.011, allows remote attackers to escalate privileg (CVSS 9.8)
- [CVE-2023-49341](https://cve.now/CVE-2023-49341.md): An issue was discovered in Newland Nquire 1000 Interactive Kiosk version NQ1000-II\_G\_V1.00.011, allows remote attackers to obtain sensitive (CVSS 7.5)
- [CVE-2023-50015](https://cve.now/CVE-2023-50015.md): An issue was discovered in Grandstream GXP14XX 1.0.8.9 and GXP16XX 1.0.7.13, allows remote attackers to escalate privileges via incorrect ac (CVSS 8.8)
- [CVE-2024-25501](https://cve.now/CVE-2024-25501.md): An issue WinMail v.7.1 and v.5.1 and before allows a remote attacker to execute arbitrary code via a crafted script to the email parameter. (CVSS 8.8)
- [CVE-2024-28089](https://cve.now/CVE-2024-28089.md): Hitron CODA-4582 2AHKM-CODA4589 7.2.4.5.1b8 devices allow a remote attacker within Wi-Fi proximity (who has access to the router admin panel (CVSS 5.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.