CVEs published March 14, 2024
69 CVEs were published on March 14, 2024: 10 critical, 21 high.
- Published
- 69
- Critical
- 10
- High
- 21
- Medium
- 35
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- PaperCut NG, PaperCut MF
- 7
- Intel(R) Processors
- 3
- Skyhigh Client Proxy
- 3
- Intel(R) CSME installer software
- 2
- Mitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24
- 2
- SonicWall SonicOS
- 2
- 3rd and 4th Generation Intel(R) Xeon(R) Processors when usi…
- 1
- 4th Generation Intel(R) Xeon(R) Processors when using Intel…
- 1
- airflow-diagrams
- 1
- Apache Software Foundation Apache Airflow · apache-airflow
- 1
Critical 10
- CVE-2024-0803Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remMitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24
- CVE-2024-0802Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote uMitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24
- CVE-2023-42286There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system co
- CVE-2024-25139In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffe
- CVE-2024-26503Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code v
- CVE-2024-28383Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub_431CF0 function.
- CVE-2024-28388SQL injection vulnerability in SunnyToo stproductcomments module for PrestaShop v.1.0.5 and before, allows a remote attacker to escalate pri
- CVE-2024-28390An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and ob
- CVE-2024-28391SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate
- CVE-2024-28423Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe_load function at cli.py.airflow-diagrams
High 21
- CVE-2024-0860Cleartext Transmission of Sensitive Information in Softing edgeConnector and edgeAggregatorSofting edgeConnector · Softing edgeAggregator
- CVE-2024-1713Plv8 Deferred Trigger Privilege EscalationPlv8
- CVE-2024-22346IBM i privilege escalationIBM i
- CVE-2024-27301Privilege Escalation Abusing installer in SupportApproot3nl SupportApp
- CVE-2024-27266IBM Maximo Application Suite XML external entity injectionIBM Maximo Asset Management
- CVE-2023-42938A logic issue was addressed with improved checks.Apple iTunes for Windows
- CVE-2024-28181Arbitrary method invocation turbo_boost-commands hopsoft turbo_boost-commands · turbo_boost-commands +1
- CVE-2023-32282Race condition in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via lIntel(R) Processors
- CVE-2023-32666On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or 4th Generation Intel(R) Xeon(R) Processors when using Intel…
- CVE-2023-50168Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation.Pegasystems Pega Platform
- CVE-2024-1623Insufficient session timeout vulnerability in Sagemcom routerSagemcom FAST3686 V2 Vodafone
- CVE-2024-28746Apache Airflow: Ignored Airflow PermissionsApache Software Foundation Apache Airflow · apache-airflow
- CVE-2024-22397Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authenticaSonicWall SonicOS
- CVE-2024-1882Server-side resource injection in PaperCut NG/MFPaperCut NG, PaperCut MF
- CVE-2024-1654Unauthorized write operations in PaperCut NG/MFPaperCut NG, PaperCut MF
- CVE-2024-1222Incorrect authorization controls in PaperCut NG/MF APIsPaperCut NG, PaperCut MF
- CVE-2023-50677An issue in NETGEAR-DGND4000 v.1.1.00.15_1.00.15 allows a remote attacker to escalate privileges via the next_file parameter to the /setup.c
- CVE-2024-25228Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function i
- CVE-2024-25652In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functionaDelinea Secret Server
- CVE-2024-28424zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle_materializ
- CVE-2024-28425greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load_obj function at /templates/pickle_utils.py.greykite
Medium, low and unrated 38
- CVE-2024-1853Zemana AntiLogger v2.74.204.664 - Arbitrary Process TerminationZemena AntiLogger
- CVE-2024-26246Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge for Android
- CVE-2024-26163Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2024-2249LA-Studio Element Kit for Elementor <= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scriptingchoijun LA-Studio Element Kit for Elementor
- CVE-2024-2256oik <= 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodebobbingwide oik
- CVE-2024-24562Security headers not set in vantage6-UIvantage6-UI
- CVE-2024-23823CORS settings overly permissive in vantage6vantage6 · vantage6-server
- CVE-2024-24770Username timing attack on recover password/MFA token in vantage6vantage6
- CVE-2024-27265IBM Integration Bus for z/OS cross-site request forgeryIBM Integration Bus for z/OS
- CVE-2024-28849Proxy-Authorization header kept across hosts in follow-redirectsfollow-redirects
- CVE-2023-28746Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) ProcessorIntel(R) Atom(R) Processors
- CVE-2023-27502Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2316.5.1.2 may allow Intel(R) Local Manageability Service software
- CVE-2023-32633Improper input validation in the Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially eIntel(R) CSME installer software
- CVE-2023-28389Incorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentiaIntel(R) CSME installer software
- CVE-2023-35191Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially enable denial of servicIntel(R) SPS firmware versions
- CVE-2023-22655Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a 3rd and 4th Generation Intel(R) Xeon(R) Processors when usi…
- CVE-2023-39368Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable deniIntel(R) Processors
- CVE-2023-38575Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentiallyIntel(R) Processors
- CVE-2023-43490Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to Intel(R) Xeon(R) D Processors with Intel(R) SGX
- CVE-2024-25156Path traversal in GoAnywhere MFT 7.4.1 and EarlierFortra GoAnywhere MFT
- CVE-2024-0313A malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization.Skyhigh Client Proxy
- CVE-2024-0312A malicious insider can uninstall Skyhigh Client Proxy without a valid uninstall password.Skyhigh Client Proxy
- CVE-2024-0311A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code.Skyhigh Client Proxy
- CVE-2024-27986WordPress Livemesh Addons for Elementor Plugin <= 8.3.5 is vulnerable to Cross Site Scripting (XSS)Elementor Addons by Livemesh
- CVE-2024-22398An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could alSonicWall Email Security
- CVE-2024-22396An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of SSonicWall SonicOS
- CVE-2024-1884Server Side Request Forgery in PaperCut NG/MFPaperCut NG, PaperCut MF
- CVE-2024-1883Reflected XSS in PaperCut NG/MFPaperCut NG, PaperCut MF
- CVE-2024-1223Improper authorization controls in PaperCut NG/MFPaperCut NG, PaperCut MF
- CVE-2024-1221Improper access controls on APIs on Linux and macOS in PaperCut NG/MFPaperCut NG, PaperCut MF
- CVE-2024-25649In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the follo
- CVE-2024-25650Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symme
- CVE-2024-25651User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4.
- CVE-2024-25653Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is
- CVE-2024-26475An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of service via the grub
- CVE-2024-28323The bwdates-report-result.php file in Phpgurukul User Registration & Login and User Management System 3.1 contains a potential security vuln
- CVE-2024-28417Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we_cmd.php.
- CVE-2024-28418Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we_cmd.php