# CVEs published 2024-03-12

186 CVEs were published on March 12, 2024: 14 critical, 88 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2024-1326](https://cve.now/CVE-2024-1326.md): Jeg Elementor Kit \<= 2.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via HTML Tags (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2023-6500](https://cve.now/CVE-2023-6500.md): Shariff Wrapper \<= 4.6.9 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, 3uu Shariff Wrapper)
- [CVE-2024-1278](https://cve.now/CVE-2024-1278.md): Easy Social Feed – Social Photos Gallery – Post Feed – Like Box \<= 6.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, sjaved Easy Social Feed – Social Photos Gallery and Post Fe…)
- [CVE-2024-1214](https://cve.now/CVE-2024-1214.md): Easy Social Feed \<= 6.5.4 - Cross-Site Request Forgery (CVSS 4.3, sjaved Easy Social Feed – Social Photos Gallery and Post Fe…)
- [CVE-2024-0966](https://cve.now/CVE-2024-0966.md): Shariff Wrapper \<= 4.6.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, 3uu Shariff Wrapper)
- [CVE-2024-1502](https://cve.now/CVE-2024-1502.md): Tutor LMS – eLearning and online course solution \<= 2.6.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion (CVSS 5.4, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-1213](https://cve.now/CVE-2024-1213.md): Easy Social Feed \<= 6.5.4 - Cross-Site Request Forgery (CVSS 5.4, sjaved Easy Social Feed – Social Photos Gallery and Post Fe…)
- [CVE-2024-1503](https://cve.now/CVE-2024-1503.md): Tutor LMS – eLearning and online course solution \<= 2.6.1 - Cross-Site Request Forgery to Plugin Deactivation and Data Erase (CVSS 4.3, themeum Tutor LMS – eLearning and online course solution)
- [CVE-2024-1450](https://cve.now/CVE-2024-1450.md): Shariff Wrapper \<= 4.6.10 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, 3uu Shariff Wrapper)
- [CVE-2023-7072](https://cve.now/CVE-2023-7072.md): Post Grid Combo – 36+ Gutenberg Blocks \<= 2.2.68 - Information Exposure via get\_posts API Endpoint (CVSS 7.5, pickplugins Post Grid)
- [CVE-2024-1421](https://cve.now/CVE-2024-1421.md): HT Mega – Absolute Addons For Elementor \<= 2.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Carousel Widget (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-1397](https://cve.now/CVE-2024-1397.md): HT Mega \<= 2.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via titleTag (CVSS 6.4, devitemsllc HT Mega Addons for Elementor – Elementor Widget…)
- [CVE-2024-0386](https://cve.now/CVE-2024-0386.md): weForms \<= 1.6.21 - Unauthenticated Stored Cross-Site Scripting via Referer (CVSS 7.2, boldgrid weForms – Easy Drag & Drop Contact Form Builder Fo…)
- [CVE-2024-2107](https://cve.now/CVE-2024-2107.md): Blossom Spa \<= 1.3.3 - Sensitive Information Exposure (CVSS 5.8, blossomthemes Blossom Spa)
- [CVE-2024-2395](https://cve.now/CVE-2024-2395.md): Bulgarisation for WooCommerce \<= 3.0.14 - Cross-Site Request Forgery (CVSS 7.3, autopolisbg Bulgarisation for WooCommerce)
- [CVE-2024-28236](https://cve.now/CVE-2024-28236.md): Insecure Variable Substitution in Vela (CVSS 7.7, go-vela worker · github.com/go-vela/worker)
- [CVE-2024-23300](https://cve.now/CVE-2024-23300.md): A use-after-free issue was addressed with improved memory management. (CVSS 7.8, Apple GarageBand)
- [CVE-2024-2406](https://cve.now/CVE-2024-2406.md): Gacjie Server Upload.php index unrestricted upload (CVSS 5.4, Gacjie Server)
- [CVE-2024-27305](https://cve.now/CVE-2024-27305.md): SMTP smuggling in aiosmtpd (CVSS 5.3, aio-libs aiosmtpd · aiosmtpd)
- [CVE-2024-28238](https://cve.now/CVE-2024-28238.md): Session Token in URL in directus (CVSS 2.3, directus)
- [CVE-2024-28239](https://cve.now/CVE-2024-28239.md): URL Redirection to Untrusted Site in OAuth2/OpenID in directus (CVSS 5.4, directus)
- [CVE-2023-5410](https://cve.now/CVE-2023-5410.md): A potential security vulnerability has been reported in the system BIOS of certain HP PC products, which might allow memory tampering. (CVSS 8.2, HP PC BIOS)
- [CVE-2024-28114](https://cve.now/CVE-2024-28114.md): Remote Code Execution using Server Side Template Injection in Peering Manager (CVSS 8.1, peering-manager)
- [CVE-2024-28113](https://cve.now/CVE-2024-28113.md): Open redirection using the return\_url parameter in Peering Manager (CVSS 3.5, peering-manager)
- [CVE-2024-28112](https://cve.now/CVE-2024-28112.md): Cross site scripting on router page in Peering Manager (CVSS 6.1, peering-manager)
- [CVE-2024-28121](https://cve.now/CVE-2024-28121.md): Reflex arbitrary method call in stimulus\_reflex (CVSS 8.8, stimulusreflex stimulus\_reflex · stimulus\_reflex)
- [CVE-2023-30968](https://cve.now/CVE-2023-30968.md): Stored XSS in gaia (CVSS 6.8, com.palantir.acme.gaia:gaia)
- [CVE-2024-28186](https://cve.now/CVE-2024-28186.md): SMTP Mail Credentials Disclosed in Error Log in freescout (CVSS 7.1, freescout-helpdesk freescout)
- [CVE-2024-2130](https://cve.now/CVE-2024-2130.md): CWW Companion \<= 1.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, codeworkweb CWW Companion)
- [CVE-2024-2031](https://cve.now/CVE-2024-2031.md): Video Conferencing with Zoom \<= 4.4.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, j\_3rk Video Conferencing with Zoom)
- [CVE-2024-27894](https://cve.now/CVE-2024-27894.md): Apache Pulsar: Pulsar Functions Worker Allows Unauthorized File Access and Unauthorized HTTP/HTTPS Proxying (CVSS 8.5, Apache Software Foundation Apache Pulsar · org.apache.pulsa…)
- [CVE-2024-27317](https://cve.now/CVE-2024-27317.md): Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification (CVSS 8.4, Apache Software Foundation Apache Pulsar · org.apache.pulsa…)
- [CVE-2024-27135](https://cve.now/CVE-2024-27135.md): Apache Pulsar: Improper Input Validation in Pulsar Function Worker allows Remote Code Execution (CVSS 8.5, Apache Software Foundation Apache Pulsar · org.apache.pulsa…)
- [CVE-2022-34321](https://cve.now/CVE-2022-34321.md): Apache Pulsar: Improper Authentication for Pulsar Proxy Statistics Endpoint (CVSS 8.2, Apache Software Foundation Apache Pulsar · org.apache.pulsa…)
- [CVE-2024-28098](https://cve.now/CVE-2024-28098.md): Apache Pulsar: Improper Authorization For Topic-Level Policy Management (CVSS 6.4, Apache Software Foundation Apache Pulsar · org.apache.pulsa…)
- [CVE-2024-1410](https://cve.now/CVE-2024-1410.md): Unbounded storage of information related to connection ID retirement, in quiche (CVSS 3.7, Cloudflare quiche · quiche)
- [CVE-2024-1765](https://cve.now/CVE-2024-1765.md): Unlimited resource allocation by QUIC CRYPTO frames flooding in quiche (CVSS 5.9, Cloudflare quiche · quiche)
- [CVE-2024-1137](https://cve.now/CVE-2024-1137.md): TIBCO ActiveSpaces Information Leak Vulnerability (CVSS 4.3, TIBCO Software TIBCO ActiveSpaces - Enterprise Edition)
- [CVE-2024-1138](https://cve.now/CVE-2024-1138.md): TIBCO FTL Privilege Escalation (CVSS 8.8, TIBCO Software TIBCO FTL - Enterprise Edition)
- [CVE-2024-26165](https://cve.now/CVE-2024-26165.md): Visual Studio Code Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Visual Studio Code)
- [CVE-2024-26204](https://cve.now/CVE-2024-26204.md): Outlook for Android Information Disclosure Vulnerability (CVSS 7.5, Microsoft Outlook for Android)
- [CVE-2024-26185](https://cve.now/CVE-2024-26185.md): Windows Compressed Folder Tampering Vulnerability (CVSS 6.5, Microsoft Windows)
- [CVE-2024-26182](https://cve.now/CVE-2024-26182.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26181](https://cve.now/CVE-2024-26181.md): Windows Kernel Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-26178](https://cve.now/CVE-2024-26178.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26177](https://cve.now/CVE-2024-26177.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-26176](https://cve.now/CVE-2024-26176.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26174](https://cve.now/CVE-2024-26174.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-26173](https://cve.now/CVE-2024-26173.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-26170](https://cve.now/CVE-2024-26170.md): Windows Composite Image File System (CimFS) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-26169](https://cve.now/CVE-2024-26169.md): Windows Error Reporting Service Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows)
- [CVE-2024-26166](https://cve.now/CVE-2024-26166.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-26162](https://cve.now/CVE-2024-26162.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-26160](https://cve.now/CVE-2024-26160.md): Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-21448](https://cve.now/CVE-2024-21448.md): Microsoft Teams for Android Information Disclosure Vulnerability (CVSS 5.0, Microsoft Teams for Android)
- [CVE-2024-21440](https://cve.now/CVE-2024-21440.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21437](https://cve.now/CVE-2024-21437.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-21436](https://cve.now/CVE-2024-21436.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-21435](https://cve.now/CVE-2024-21435.md): Windows OLE Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21434](https://cve.now/CVE-2024-21434.md): Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-21433](https://cve.now/CVE-2024-21433.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-21432](https://cve.now/CVE-2024-21432.md): Windows Update Stack Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-21431](https://cve.now/CVE-2024-21431.md): Hypervisor-Protected Code Integrity (HVCI) Security Feature Bypass Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-21427](https://cve.now/CVE-2024-21427.md): Windows Kerberos Security Feature Bypass Vulnerability (CVSS 7.5, Microsoft Windows Server)
- [CVE-2024-21419](https://cve.now/CVE-2024-21419.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises))
- [CVE-2024-21408](https://cve.now/CVE-2024-21408.md): Windows Hyper-V Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2024-21407](https://cve.now/CVE-2024-21407.md): Windows Hyper-V Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2024-21400](https://cve.now/CVE-2024-21400.md): Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability (CVSS 9.0, Microsoft Azure Kubernetes Service)
- [CVE-2024-21390](https://cve.now/CVE-2024-21390.md): Microsoft Authenticator Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Authenticator)
- [CVE-2024-21334](https://cve.now/CVE-2024-21334.md): Open Management Infrastructure (OMI) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft System Center Operations Manager (SCOM) · Microso…)
- [CVE-2024-21330](https://cve.now/CVE-2024-21330.md): Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft System Center Operations Manager (SCOM) · Micr… +6)
- [CVE-2024-26164](https://cve.now/CVE-2024-26164.md): Microsoft Django Backend for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SQL Server backend for Django · mssql-django)
- [CVE-2024-26161](https://cve.now/CVE-2024-26161.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-26203](https://cve.now/CVE-2024-26203.md): Azure Data Studio Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Azure Data Studio)
- [CVE-2024-26201](https://cve.now/CVE-2024-26201.md): Microsoft Intune Linux Agent Elevation of Privilege Vulnerability (CVSS 6.6, Microsoft Intune Company Portal for Android)
- [CVE-2024-26199](https://cve.now/CVE-2024-26199.md): Microsoft Office Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft 365 Apps for Enterprise)
- [CVE-2024-26198](https://cve.now/CVE-2024-26198.md): Microsoft Exchange Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2024-26190](https://cve.now/CVE-2024-26190.md): Microsoft QUIC Denial of Service Vulnerability (CVSS 7.5, Microsoft Visual Studio · Microsoft Windows Server +3)
- [CVE-2024-26159](https://cve.now/CVE-2024-26159.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-26197](https://cve.now/CVE-2024-26197.md): Windows Standards-Based Storage Management Service Denial of Service Vulnerability (CVSS 6.5, Microsoft Windows Server)
- [CVE-2024-21451](https://cve.now/CVE-2024-21451.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21450](https://cve.now/CVE-2024-21450.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21446](https://cve.now/CVE-2024-21446.md): NTFS Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2024-21445](https://cve.now/CVE-2024-21445.md): Windows USB Print Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-21444](https://cve.now/CVE-2024-21444.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21443](https://cve.now/CVE-2024-21443.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.3, Microsoft Windows)
- [CVE-2024-21442](https://cve.now/CVE-2024-21442.md): Windows USB Print Driver Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2024-21441](https://cve.now/CVE-2024-21441.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2024-21439](https://cve.now/CVE-2024-21439.md): Windows Telephony Server Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2024-21438](https://cve.now/CVE-2024-21438.md): Microsoft AllJoyn API Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2024-21430](https://cve.now/CVE-2024-21430.md): Windows USB Attached SCSI (UAS) Protocol Remote Code Execution Vulnerability (CVSS 5.7, Microsoft Windows)
- [CVE-2024-21429](https://cve.now/CVE-2024-21429.md): Windows USB Hub Driver Remote Code Execution Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2024-21426](https://cve.now/CVE-2024-21426.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 7.8, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2024-21421](https://cve.now/CVE-2024-21421.md): Azure SDK Spoofing Vulnerability (CVSS 7.5, Microsoft Azure SDK)
- [CVE-2024-21418](https://cve.now/CVE-2024-21418.md): Software for Open Networking in the Cloud (SONiC) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Software for Open Networking in the Cloud)
- [CVE-2024-21411](https://cve.now/CVE-2024-21411.md): Skype for Consumer Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Skype for Consumer)
- [CVE-2024-21392](https://cve.now/CVE-2024-21392.md): .NET and Visual Studio Denial of Service Vulnerability (CVSS 7.5, Microsoft Visual Studio · Microsoft PowerShell +13)
- [CVE-2024-20671](https://cve.now/CVE-2024-20671.md): Microsoft Defender Security Feature Bypass Vulnerability (CVSS 5.5, Microsoft Windows Defender Antimalware Platform)
- [CVE-2024-2182](https://cve.now/CVE-2024-2182.md): Ovn: insufficient validation of bfd packets may lead to denial of service (CVSS 6.5, ovn · Fast Datapath for Red Hat Enterprise Linux +3)
- [CVE-2024-1304](https://cve.now/CVE-2024-1304.md): Multiple Vulnerabilities in Badger Meter's Monitool (CVSS 6.3, Badger Meter Monitool)
- [CVE-2024-1303](https://cve.now/CVE-2024-1303.md): Multiple Vulnerabilities in Badger Meter's Monitool (CVSS 6.5, Badger Meter Monitool)
- [CVE-2024-1302](https://cve.now/CVE-2024-1302.md): Multiple Vulnerabilities in Badger Meter's Monitool (CVSS 7.3, Badger Meter Monitool)
- [CVE-2024-1529](https://cve.now/CVE-2024-1529.md): Cross-site Scripting in CMS Made Simple (CVSS 7.4, CMS Made Simple)
- [CVE-2024-1301](https://cve.now/CVE-2024-1301.md): Multiple Vulnerabilities in Badger Meter's Monitool (CVSS 9.8, Badger Meter Monitool)
- [CVE-2024-1528](https://cve.now/CVE-2024-1528.md): Cross-site Scripting in CMS Made Simple (CVSS 7.4, CMS Made Simple)
- [CVE-2024-1527](https://cve.now/CVE-2024-1527.md): Unrestricted Upload of File with Dangerous Type in CMS Made Simple (CVSS 9.8, CMS Made Simple)
- [CVE-2024-1227](https://cve.now/CVE-2024-1227.md): Multiple vulnerabilities in Rejetto's Http File Server (CVSS 6.5, Rejetto Http File Server)
- [CVE-2023-47534](https://cve.now/CVE-2023-47534.md): A improper neutralization of formula elements in a csv file vulnerability in Fortinet FortiClientEMS 7.2.0 through 7.2.2, FortiClientEMS 7.0 (CVSS 8.7, Fortinet FortiClientEMS)
- [CVE-2023-46717](https://cve.now/CVE-2023-46717.md): An improper authentication vulnerability \[CWE-287\] in FortiOS versions 7.4.1 and below, versions 7.2.6 and below, and versions 7.0.12 and be (CVSS 6.7, Fortinet FortiOS)
- [CVE-2023-48788](https://cve.now/CVE-2023-48788.md): A improper neutralization of special elements used in an sql command ('sql injection') in Fortinet FortiClientEMS version 7.2.0 through 7.2. (CVSS 9.3, KEV, Fortinet FortiClientEMS)
- [CVE-2023-42789](https://cve.now/CVE-2023-42789.md): A out-of-bounds write vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0.12, Fort (CVSS 9.3, Fortinet FortiProxy · Fortinet FortiSASE +1)
- [CVE-2024-23112](https://cve.now/CVE-2024-23112.md): An authorization bypass through user-controlled key vulnerability \[CWE-639\] in FortiOS version 7.4.0 through 7.4.1, 7.2.0 through 7.2.6, 7.0 (CVSS 7.2, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2023-42790](https://cve.now/CVE-2023-42790.md): A stack-based buffer overflow vulnerability in Fortinet FortiOS 7.4.0 through 7.4.1, FortiOS 7.2.0 through 7.2.5, FortiOS 7.0.0 through 7.0. (CVSS 7.7, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2024-21761](https://cve.now/CVE-2024-21761.md): An improper authorization vulnerability \[CWE-285\] in FortiPortal version 7.2.0, and versions 7.0.6 and below reports may allow a user to dow (CVSS 3.9, Fortinet FortiPortal)
- [CVE-2023-41842](https://cve.now/CVE-2023-41842.md): A use of externally-controlled format string vulnerability \[CWE-134\] vulnerability in Fortinet allows a privileged attacker to execute unau (CVSS 6.3, Fortinet FortiPortal · Fortinet FortiAnalyzer-BigData +2)
- [CVE-2023-36554](https://cve.now/CVE-2023-36554.md): A improper access control in Fortinet FortiManager version 7.4.0, version 7.2.0 through 7.2.3, version 7.0.0 through 7.0.10, version 6.4.0 t (CVSS 7.7, Fortinet FortiManager)
- [CVE-2024-1226](https://cve.now/CVE-2024-1226.md): Multiple vulnerabilities in Rejetto's Http File Server (CVSS 7.5, Rejetto Http File Server)
- [CVE-2024-1618](https://cve.now/CVE-2024-1618.md): Unquoted item or search path vulnerability in Faronics Deep Freeze Server Standard (CVSS 7.8, Faronics Deep Freeze Server Standard)
- [CVE-2024-2394](https://cve.now/CVE-2024-2394.md): SourceCodester Employee Management System add-admin.php unrestricted upload (CVSS 4.7, SourceCodester Employee Management System)
- [CVE-2024-2393](https://cve.now/CVE-2024-2393.md): SourceCodester CRUD without Page Reload add\_user.php sql injection (CVSS 6.3, SourceCodester CRUD without Page Reload)
- [CVE-2024-2049](https://cve.now/CVE-2024-2049.md): Server-Side Request Forgery (SSRF) (CVSS 6.5, Citrix SD-WAN Standard/Premium Editions)
- [CVE-2022-32257](https://cve.now/CVE-2022-32257.md): A vulnerability has been identified in SINEMA Remote Connect Server (All versions \< V3.2). (CVSS 9.8, Siemens SINEMA Remote Connect Server)
- [CVE-2024-2391](https://cve.now/CVE-2024-2391.md): EVE-NG Lab cross site scripting (CVSS 2.4, EVE-NG)
- [CVE-2024-27907](https://cve.now/CVE-2024-27907.md): A vulnerability has been identified in Simcenter Femap (All versions \< V2306.0000). (CVSS 7.8, Siemens Simcenter Femap)
- [CVE-2024-22045](https://cve.now/CVE-2024-22045.md): A vulnerability has been identified in SINEMA Remote Connect Client (All versions \< V3.1 SP1). (CVSS 7.6, Siemens SINEMA Remote Connect Client)
- [CVE-2024-22044](https://cve.now/CVE-2024-22044.md): A vulnerability has been identified in SENTRON 3KC ATC6 Expansion Module Ethernet (3KC9000-8TL75) (All versions). (CVSS 7.5, Siemens SENTRON 3KC ATC6 Expansion Module Ethernet)
- [CVE-2024-22041](https://cve.now/CVE-2024-22041.md): A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions), (CVSS 7.5, Siemens Cerberus PRO EN Engineering Tool · Siemens Cerb… +21)
- [CVE-2024-22040](https://cve.now/CVE-2024-22040.md): A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions), Cerberus PRO EN Fire Panel FC72x IP6 (All versions), (CVSS 7.5, Siemens Cerberus PRO EN Engineering Tool · Siemens Cerb… +21)
- [CVE-2024-22039](https://cve.now/CVE-2024-22039.md): A vulnerability has been identified in Cerberus PRO EN Engineering Tool (All versions \< IP8), Cerberus PRO EN Fire Panel FC72x IP6 (All vers (CVSS 10.0, Siemens Cerberus PRO EN Engineering Tool · Siemens Cerb… +19)
- [CVE-2024-21483](https://cve.now/CVE-2024-21483.md): A vulnerability has been identified in SENTRON 7KM PAC3120 AC/DC (7KM3120-0BA01-1DA0) (All versions \>= V3.2.3 \< V3.2.4 only when manufacture (CVSS 4.6, Siemens SENTRON 7KM PAC3120 AC/DC · Siemens SENTRON 7KM… +2)
- [CVE-2023-45793](https://cve.now/CVE-2023-45793.md): A vulnerability has been identified in Siveillance Control (All versions \>= V2.8 \< V3.1.1). (CVSS 5.5, Siemens Siveillance Control)
- [CVE-2023-41313](https://cve.now/CVE-2023-41313.md): Apache Doris: Timing Attack weakness (CVSS 9.8, Apache Software Foundation Apache Doris)
- [CVE-2023-4629](https://cve.now/CVE-2023-4629.md): LadiApp \<= 4.4 - Cross-Site Request Forgery via save\_config() (CVSS 4.3, binhnguyenplus LadiApp: Landing Page, PopupX, Marketing Aut…)
- [CVE-2023-4729](https://cve.now/CVE-2023-4729.md): LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… \<= 4.4 - Cross-Site Request Forgery via publish\_lp() (CVSS 4.3, binhnguyenplus LadiApp: Landing Page, PopupX, Marketing Aut…)
- [CVE-2023-4627](https://cve.now/CVE-2023-4627.md): LadiApp \<= 4.4 - Missing Authorization via save\_config() (CVSS 4.3, binhnguyenplus LadiApp: Landing Page, PopupX, Marketing Aut…)
- [CVE-2023-4728](https://cve.now/CVE-2023-4728.md): LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… \<= 4.4 - Missing Authorization on publish\_lp() (CVSS 4.3, binhnguyenplus LadiApp: Landing Page, PopupX, Marketing Aut…)
- [CVE-2023-4626](https://cve.now/CVE-2023-4626.md): The LadiApp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ladiflow\_save\_h (CVSS 4.3, binhnguyenplus LadiApp: Landing Page, PopupX, Marketing Aut…)
- [CVE-2023-4731](https://cve.now/CVE-2023-4731.md): LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… \<= 4.4 - Cross-Site Request Forgery via init\_endpoint (CVSS 4.3, binhnguyenplus LadiApp: Landing Page, PopupX, Marketing Aut…)
- [CVE-2023-4628](https://cve.now/CVE-2023-4628.md): LadiApp \<= 4.4 - Cross-Site Request Forgery via ladiflow\_save\_hook() (CVSS 4.3, binhnguyenplus LadiApp: Landing Page, PopupX, Marketing Aut…)
- [CVE-2024-2371](https://cve.now/CVE-2024-2371.md): Information exposure vulnerability in Korenix JetI/O 6550 (CVSS 6.2, Korenix JetI/O)
- [CVE-2024-0906](https://cve.now/CVE-2024-0906.md): f(x) Private Site \<= 1.2.1 - Sensitive Information Exposure (CVSS 5.3, turtlepod f(x) Private Site)
- [CVE-2024-1328](https://cve.now/CVE-2024-1328.md): Newsletter2Go \<= 4.0.14 - Authenticated(Subscriber+) Stored Cross-Site Scripting via style (CVSS 6.4, Newsletter2Go)
- [CVE-2024-27279](https://cve.now/CVE-2024-27279.md): Directory traversal vulnerability exists in a-blog cms Ver.3.1.x series Ver.3.1.9 and earlier, Ver.3.0.x series Ver.3.0.30 and earlier, Ver. (CVSS 6.5, appleple a-blog cms Ver.3.1.x series · appleple a-blog c… +3)
- [CVE-2024-26288](https://cve.now/CVE-2024-26288.md): PHOENIX CONTACT: Lack of SSL support in CHARX Series (CVSS 8.7, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-26005](https://cve.now/CVE-2024-26005.md): PHOENIX CONTACT: Privilege gain through incomplete cleanup in CHARX Series (CVSS 4.8, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-26004](https://cve.now/CVE-2024-26004.md): PHOENIX CONTACT: DoS of a control agent due to access of a uninitialized pointer in CHARX Series (CVSS 7.5, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-26003](https://cve.now/CVE-2024-26003.md): PHOENIX CONTACT: DoS of the control agent in CHARX Series (CVSS 7.5, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-26002](https://cve.now/CVE-2024-26002.md): PHOENIX CONTACT: File ownership manipulation in CHARX Series (CVSS 7.8, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-26001](https://cve.now/CVE-2024-26001.md): PHOENIX CONTACT: Out of bounds write only memory access (CVSS 7.4, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-26000](https://cve.now/CVE-2024-26000.md): PHOENIX CONTACT: Out of bounds read only memory access (CVSS 5.9, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-25999](https://cve.now/CVE-2024-25999.md): PHOENIX CONTACT: Privilege escalation in the OCPP agent service (CVSS 8.4, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-25998](https://cve.now/CVE-2024-25998.md): PHOENIX CONTACT: Command injection in the OCPP Service (CVSS 7.3, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-25997](https://cve.now/CVE-2024-25997.md): PHOENIX CONTACT: Log injection in CHARX Series (CVSS 5.3, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-25996](https://cve.now/CVE-2024-25996.md): PHOENIX CONTACT: Remote code execution due to an origin validation error in CHARX Series (CVSS 5.3, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-25995](https://cve.now/CVE-2024-25995.md): PHOENIX CONTACT: Remote code execution in CHARX Series (CVSS 9.8, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-25994](https://cve.now/CVE-2024-25994.md): PHOENIX CONTACT: Unintended script file upload in CHARX Series (CVSS 5.3, PHOENIX CONTACT CHARX SEC-3000 · PHOENIX CONTACT CHARX S… +2)
- [CVE-2024-27121](https://cve.now/CVE-2024-27121.md): Path traversal vulnerability exists in Machine Automation Controller NJ Series and Machine Automation Controller NX Series. (CVSS 7.2, OMRON Machine Automation Controller NJ Series · OMRON Machi…)
- [CVE-2024-21584](https://cve.now/CVE-2024-21584.md): Pleasanter 1.3.49.0 and earlier contains a cross-site scripting vulnerability. (CVSS 6.1, Implem Pleasanter)
- [CVE-2024-24964](https://cve.now/CVE-2024-24964.md): Improper access control vulnerability exists in the resident process of SKYSEA Client View versions from Ver.11.220 prior to Ver.19.2. (CVSS 6.3, Sky Co. SKYSEA Client View)
- [CVE-2024-21805](https://cve.now/CVE-2024-21805.md): Improper access control vulnerability exists in the specific folder of SKYSEA Client View versions from Ver.16.100 prior to Ver.19.2. (CVSS 7.8, Sky Co. SKYSEA Client View)
- [CVE-2023-6814](https://cve.now/CVE-2023-6814.md): Information Exposure Vulnerability in Cosminexus Component Container (CVSS 5.6, Hitachi Cosminexus Component Container)
- [CVE-2024-25645](https://cve.now/CVE-2024-25645.md): Information Disclosure vulnerability in SAP NetWeaver (Enterprise Portal) (CVSS 5.3, SAP\_SE SAP NetWeaver)
- [CVE-2024-28163](https://cve.now/CVE-2024-28163.md): Information Disclosure vulnerability in SAP NetWeaver Process Integration (Support Web Pages) (CVSS 5.3, SAP\_SE SAP NetWeaver Process Integration)
- [CVE-2024-27902](https://cve.now/CVE-2024-27902.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS ABAP applications based on SAPGUI for HTML (WebGUI) (CVSS 5.4, SAP\_SE SAP NetWeaver AS ABAP applications based on SAPGUI f…)
- [CVE-2024-27900](https://cve.now/CVE-2024-27900.md): Missing Authorization check in SAP ABAP Platform (CVSS 4.3, SAP\_SE SAP ABAP Platform)
- [CVE-2024-25644](https://cve.now/CVE-2024-25644.md): Information Disclosure vulnerability in NetWeaver (WSRM) (CVSS 5.3, SAP\_SE NetWeaver)
- [CVE-2024-22133](https://cve.now/CVE-2024-22133.md): Improper Access Control in SAP Fiori Front End Server (CVSS 4.6, SAP\_SE SAP Fiori Front End Server)
- [CVE-2024-22127](https://cve.now/CVE-2024-22127.md): Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in) (CVSS 9.1, SAP\_SE SAP NetWeaver AS Java)
- [CVE-2023-42307](https://cve.now/CVE-2023-42307.md): Cross Site Scripting (XSS) vulnerability in Code-Projects Exam Form Submission 1.0 allows attackers to run arbitrary code via "Subject Name" (CVSS 6.1)
- [CVE-2023-42308](https://cve.now/CVE-2023-42308.md): Cross Site Scripting (XSS) vulnerability in Manage Fastrack Subjects in Code-Projects Exam Form Submission 1.0 allows attackers to run arbit (CVSS 6.1)
- [CVE-2023-43279](https://cve.now/CVE-2023-43279.md): Null Pointer Dereference in mask\_cidr6 component at cidr.c in Tcpreplay 4.4.4 allows attackers to crash the application via crafted tcprewri (CVSS 6.5)
- [CVE-2023-43292](https://cve.now/CVE-2023-43292.md): Cross Site Scripting vulnerability in My Food Recipe Using PHP with Source Code v.1.0 allows a local attacker to execute arbitrary code via (CVSS 6.1)
- [CVE-2023-49453](https://cve.now/CVE-2023-49453.md): Reflected cross-site scripting (XSS) vulnerability in Racktables v0.22.0 and before, allows local attackers to execute arbitrary code and ob (CVSS 6.1)
- [CVE-2024-24092](https://cve.now/CVE-2024-24092.md): SQL Injection vulnerability in Code-projects.org Scholars Tracking System 1.0 allows attackers to run arbitrary code via login.php. (CVSS 7.8)
- [CVE-2024-24093](https://cve.now/CVE-2024-24093.md): SQL Injection vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via Personal Information Up (CVSS 9.8)
- [CVE-2024-24097](https://cve.now/CVE-2024-24097.md): Cross Site Scripting (XSS) vulnerability in Code-projects Scholars Tracking System 1.0 allows attackers to run arbitrary code via the News F (CVSS 5.4)
- [CVE-2024-24101](https://cve.now/CVE-2024-24101.md): Code-projects Scholars Tracking System 1.0 is vulnerable to SQL Injection under Eligibility Information Update. (CVSS 5.1)
- [CVE-2024-25325](https://cve.now/CVE-2024-25325.md): SQL injection vulnerability in Employee Management System v.1.0 allows a local attacker to obtain sensitive information via a crafted payloa (CVSS 7.1)
- [CVE-2024-25331](https://cve.now/CVE-2024-25331.md): DIR-822 Rev. (CVSS 9.3)
- [CVE-2024-26521](https://cve.now/CVE-2024-26521.md): HTML Injection vulnerability in CE Phoenix v1.0.8.20 and before allows a remote attacker to execute arbitrary code, escalate privileges, and (CVSS 4.8)
- [CVE-2024-27758](https://cve.now/CVE-2024-27758.md): In RPyC before 6.0.0, when a server exposes a method that calls the attribute named \_\_array\_\_ for a client-provided netref (e.g., np.array(c (CVSS 8.4, rpyc)
- [CVE-2024-28338](https://cve.now/CVE-2024-28338.md): A login bypass in TOTOLINK A8000RU V7.1cu.643\_B20200521 allows attackers to login to Administrator accounts via providing a crafted session (CVSS 8.0)
- [CVE-2024-28339](https://cve.now/CVE-2024-28339.md): An information leak in the debuginfo.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows atta (CVSS 5.4)
- [CVE-2024-28340](https://cve.now/CVE-2024-28340.md): An information leak in the currentsetting.htm component of Netgear CBR40 2.5.0.28, Netgear CBK40 2.5.0.28, and Netgear CBK43 2.5.0.28 allows (CVSS 7.5)
- [CVE-2024-28535](https://cve.now/CVE-2024-28535.md): Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the mitInterface parameter of fromAddressNat function. (CVSS 8.0)
- [CVE-2024-28553](https://cve.now/CVE-2024-28553.md): Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the entrys parameter fromAddressNat function. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.