# CVEs published 2024-03-10

10 CVEs were published on March 10, 2024: 0 critical, 2 high. Days are UTC.

- [CVE-2024-2365](https://cve.now/CVE-2024-2365.md): Musicshelf SHA-1 PinningTrustManager.java weak password hash (CVSS 1.6, Musicshelf)
- [CVE-2024-2364](https://cve.now/CVE-2024-2364.md): Musicshelf Backup androidmanifest.xml backup (CVSS 1.8, Musicshelf)
- [CVE-2024-2314](https://cve.now/CVE-2024-2314.md): If kernel headers need to be extracted, bcc will attempt to load them from a temporary directory. (CVSS 2.8, IOVisor BPF Compiler Collection)
- [CVE-2024-2313](https://cve.now/CVE-2024-2313.md): If kernel headers need to be extracted, bpftrace will attempt to load them from a temporary directory. (CVSS 2.8, bpftrace)
- [CVE-2024-2363](https://cve.now/CVE-2024-2363.md): AOL AIM Triton Invite denial of service (CVSS 5.3, AOL AIM Triton)
- [CVE-2024-2355](https://cve.now/CVE-2024-2355.md): keerti1924 Secret-Coder-PHP-Project secret\_coder.sql inclusion of sensitive information in source code (CVSS 3.7, keerti1924 Secret-Coder-PHP-Project)
- [CVE-2024-2354](https://cve.now/CVE-2024-2354.md): Dreamer CMS toEdit cross-site request forgery (CVSS 4.3, Dreamer CMS)
- [CVE-2024-2353](https://cve.now/CVE-2024-2353.md): Totolink X6000R shttpd cstecgi.cgi setDiagnosisCfg os command injection (CVSS 8.8, Totolink X6000R)
- [CVE-2024-2352](https://cve.now/CVE-2024-2352.md): 1Panel swap baseApi.UpdateDeviceSwap command injection (CVSS 6.3, 1Panel · github.com/1Panel-dev/1Panel)
- [CVE-2024-28757](https://cve.now/CVE-2024-28757.md): libexpat through 2.6.1 allows an XML Entity Expansion attack when there is isolated use of external parsers (created via XML\_ExternalEntityP (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.