# CVEs published 2024-03-14

69 CVEs were published on March 14, 2024: 10 critical, 21 high. Days are UTC.

- [CVE-2024-0803](https://cve.now/CVE-2024-0803.md): Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a rem (CVSS 9.8, Mitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24)
- [CVE-2024-0802](https://cve.now/CVE-2024-0802.md): Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote u (CVSS 9.8, Mitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24)
- [CVE-2024-1853](https://cve.now/CVE-2024-1853.md): Zemana AntiLogger v2.74.204.664 - Arbitrary Process Termination (CVSS 5.5, Zemena AntiLogger)
- [CVE-2024-26246](https://cve.now/CVE-2024-26246.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 3.9, Microsoft Edge for Android)
- [CVE-2024-26163](https://cve.now/CVE-2024-26163.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 4.7, Microsoft Edge)
- [CVE-2024-2249](https://cve.now/CVE-2024-2249.md): LA-Studio Element Kit for Elementor \<= 1.3.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, choijun LA-Studio Element Kit for Elementor)
- [CVE-2024-0860](https://cve.now/CVE-2024-0860.md): Cleartext Transmission of Sensitive Information in Softing edgeConnector and edgeAggregator (CVSS 8.0, Softing edgeConnector · Softing edgeAggregator)
- [CVE-2024-2256](https://cve.now/CVE-2024-2256.md): oik \<= 4.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, bobbingwide oik)
- [CVE-2024-1713](https://cve.now/CVE-2024-1713.md): Plv8 Deferred Trigger Privilege Escalation (CVSS 7.2, Plv8)
- [CVE-2024-24562](https://cve.now/CVE-2024-24562.md): Security headers not set in vantage6-UI (CVSS 5.4, vantage6-UI)
- [CVE-2024-23823](https://cve.now/CVE-2024-23823.md): CORS settings overly permissive in vantage6 (CVSS 4.2, vantage6 · vantage6-server)
- [CVE-2024-24770](https://cve.now/CVE-2024-24770.md): Username timing attack on recover password/MFA token in vantage6 (CVSS 5.3, vantage6)
- [CVE-2024-22346](https://cve.now/CVE-2024-22346.md): IBM i privilege escalation (CVSS 8.4, IBM i)
- [CVE-2024-27265](https://cve.now/CVE-2024-27265.md): IBM Integration Bus for z/OS cross-site request forgery (CVSS 4.5, IBM Integration Bus for z/OS)
- [CVE-2024-27301](https://cve.now/CVE-2024-27301.md): Privilege Escalation Abusing installer in SupportApp (CVSS 7.3, root3nl SupportApp)
- [CVE-2024-27266](https://cve.now/CVE-2024-27266.md): IBM Maximo Application Suite XML external entity injection (CVSS 8.2, IBM Maximo Asset Management)
- [CVE-2023-42938](https://cve.now/CVE-2023-42938.md): A logic issue was addressed with improved checks. (CVSS 7.8, Apple iTunes for Windows)
- [CVE-2024-28181](https://cve.now/CVE-2024-28181.md): Arbitrary method invocation turbo\_boost-commands (CVSS 8.1, hopsoft turbo\_boost-commands · turbo\_boost-commands +1)
- [CVE-2024-28849](https://cve.now/CVE-2024-28849.md): Proxy-Authorization header kept across hosts in follow-redirects (CVSS 6.5, follow-redirects)
- [CVE-2023-28746](https://cve.now/CVE-2023-28746.md): Information exposure through microarchitectural state after transient execution from some register files for some Intel(R) Atom(R) Processor (CVSS 6.5, Intel(R) Atom(R) Processors)
- [CVE-2023-27502](https://cve.now/CVE-2023-27502.md): Insertion of sensitive information into log file for some Intel(R) Local Manageability Service software before version 2316.5.1.2 may allow (CVSS 3.3, Intel(R) Local Manageability Service software)
- [CVE-2023-32633](https://cve.now/CVE-2023-32633.md): Improper input validation in the Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentially e (CVSS 6.7, Intel(R) CSME installer software)
- [CVE-2023-28389](https://cve.now/CVE-2023-28389.md): Incorrect default permissions in some Intel(R) CSME installer software before version 2328.5.5.0 may allow an authenticated user to potentia (CVSS 6.7, Intel(R) CSME installer software)
- [CVE-2023-35191](https://cve.now/CVE-2023-35191.md): Uncontrolled resource consumption for some Intel(R) SPS firmware versions may allow a privileged user to potentially enable denial of servic (CVSS 6.8, Intel(R) SPS firmware versions)
- [CVE-2023-32282](https://cve.now/CVE-2023-32282.md): Race condition in BIOS firmware for some Intel(R) Processors may allow a privileged user to potentially enable escalation of privilege via l (CVSS 7.2, Intel(R) Processors)
- [CVE-2023-22655](https://cve.now/CVE-2023-22655.md): Protection mechanism failure in some 3rd and 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or Intel(R) TDX may allow a (CVSS 6.1, 3rd and 4th Generation Intel(R) Xeon(R) Processors when usi…)
- [CVE-2023-39368](https://cve.now/CVE-2023-39368.md): Protection mechanism failure of bus lock regulator for some Intel(R) Processors may allow an unauthenticated user to potentially enable deni (CVSS 6.5, Intel(R) Processors)
- [CVE-2023-38575](https://cve.now/CVE-2023-38575.md): Non-transparent sharing of return predictor targets between contexts in some Intel(R) Processors may allow an authorized user to potentially (CVSS 5.5, Intel(R) Processors)
- [CVE-2023-32666](https://cve.now/CVE-2023-32666.md): On-chip debug and test interface with improper access control in some 4th Generation Intel(R) Xeon(R) Processors when using Intel(R) SGX or (CVSS 7.2, 4th Generation Intel(R) Xeon(R) Processors when using Intel…)
- [CVE-2023-43490](https://cve.now/CVE-2023-43490.md): Incorrect calculation in microcode keying mechanism for some Intel(R) Xeon(R) D Processors with Intel(R) SGX may allow a privileged user to (CVSS 5.3, Intel(R) Xeon(R) D Processors with Intel(R) SGX)
- [CVE-2023-50168](https://cve.now/CVE-2023-50168.md): Pega Platform from 6.x to 8.8.4 is affected by an XXE issue with PDF Generation. (CVSS 7.7, Pegasystems Pega Platform)
- [CVE-2024-25156](https://cve.now/CVE-2024-25156.md): Path traversal in GoAnywhere MFT 7.4.1 and Earlier (CVSS 6.5, Fortra GoAnywhere MFT)
- [CVE-2024-1623](https://cve.now/CVE-2024-1623.md): Insufficient session timeout vulnerability in Sagemcom router (CVSS 7.7, Sagemcom FAST3686 V2 Vodafone)
- [CVE-2024-0313](https://cve.now/CVE-2024-0313.md): A malicious insider exploiting this vulnerability can circumvent existing security controls put in place by the organization. (CVSS 5.5, Skyhigh Client Proxy)
- [CVE-2024-0312](https://cve.now/CVE-2024-0312.md): A malicious insider can uninstall Skyhigh Client Proxy without a valid uninstall password. (CVSS 5.5, Skyhigh Client Proxy)
- [CVE-2024-0311](https://cve.now/CVE-2024-0311.md): A malicious insider can bypass the existing policy of Skyhigh Client Proxy without a valid release code. (CVSS 5.5, Skyhigh Client Proxy)
- [CVE-2024-28746](https://cve.now/CVE-2024-28746.md): Apache Airflow: Ignored Airflow Permissions (CVSS 8.1, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-27986](https://cve.now/CVE-2024-27986.md): WordPress Livemesh Addons for Elementor Plugin \<= 8.3.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Elementor Addons by Livemesh)
- [CVE-2024-22398](https://cve.now/CVE-2024-22398.md): An improper Limitation of a Pathname to a Restricted Directory (Path Traversal) vulnerability in SonicWall Email Security Appliance could al (CVSS 4.9, SonicWall Email Security)
- [CVE-2024-22397](https://cve.now/CVE-2024-22397.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the SonicOS SSLVPN portal allows a remote authentica (CVSS 8.3, SonicWall SonicOS)
- [CVE-2024-22396](https://cve.now/CVE-2024-22396.md): An Integer-based buffer overflow vulnerability in the SonicOS via IPSec allows a remote attacker in specific conditions to cause Denial of S (CVSS 5.3, SonicWall SonicOS)
- [CVE-2024-1884](https://cve.now/CVE-2024-1884.md): Server Side Request Forgery in PaperCut NG/MF (CVSS 6.5, PaperCut NG, PaperCut MF)
- [CVE-2024-1883](https://cve.now/CVE-2024-1883.md): Reflected XSS in PaperCut NG/MF (CVSS 6.3, PaperCut NG, PaperCut MF)
- [CVE-2024-1882](https://cve.now/CVE-2024-1882.md): Server-side resource injection in PaperCut NG/MF (CVSS 7.2, PaperCut NG, PaperCut MF)
- [CVE-2024-1654](https://cve.now/CVE-2024-1654.md): Unauthorized write operations in PaperCut NG/MF (CVSS 7.2, PaperCut NG, PaperCut MF)
- [CVE-2024-1223](https://cve.now/CVE-2024-1223.md): Improper authorization controls in PaperCut NG/MF (CVSS 4.8, PaperCut NG, PaperCut MF)
- [CVE-2024-1222](https://cve.now/CVE-2024-1222.md): Incorrect authorization controls in PaperCut NG/MF APIs (CVSS 8.6, PaperCut NG, PaperCut MF)
- [CVE-2024-1221](https://cve.now/CVE-2024-1221.md): Improper access controls on APIs on Linux and macOS in PaperCut NG/MF (CVSS 3.1, PaperCut NG, PaperCut MF)
- [CVE-2023-42286](https://cve.now/CVE-2023-42286.md): There is a PHP file inclusion vulnerability in the template configuration of eyoucms v1.6.4, allowing attackers to execute code or system co (CVSS 9.8)
- [CVE-2023-50677](https://cve.now/CVE-2023-50677.md): An issue in NETGEAR-DGND4000 v.1.1.00.15\_1.00.15 allows a remote attacker to escalate privileges via the next\_file parameter to the /setup.c (CVSS 8.8)
- [CVE-2024-25139](https://cve.now/CVE-2024-25139.md): In TP-Link Omada er605 1.0.1 through (v2.6) 2.2.3, a cloud-brd binary is susceptible to an integer overflow that leads to a heap-based buffe (CVSS 10.0)
- [CVE-2024-25228](https://cve.now/CVE-2024-25228.md): Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function i (CVSS 8.8)
- [CVE-2024-25649](https://cve.now/CVE-2024-25649.md): In Delinea PAM Secret Server 11.4, it is possible for an attacker (with Administrator access to the Secret Server machine) to read the follo (CVSS 6.7)
- [CVE-2024-25650](https://cve.now/CVE-2024-25650.md): Insecure key exchange between Delinea PAM Secret Server 11.4 and the Distributed Engine 8.4.3 allows a PAM administrator to obtain the Symme (CVSS 5.9)
- [CVE-2024-25651](https://cve.now/CVE-2024-25651.md): User enumeration can occur in the Authentication REST API in Delinea PAM Secret Server 11.4. (CVSS 5.3)
- [CVE-2024-25652](https://cve.now/CVE-2024-25652.md): In Delinea PAM Secret Server 11.4, it is possible for a user assigned "Administer Reports" permission and/or with access to Report functiona (CVSS 7.6, Delinea Secret Server)
- [CVE-2024-25653](https://cve.now/CVE-2024-25653.md): Broken Access Control in the Report functionality of Delinea PAM Secret Server 11.4 allows unprivileged users, when Unlimited Admin Mode is (CVSS 4.3)
- [CVE-2024-26475](https://cve.now/CVE-2024-26475.md): An issue in radareorg radare2 v.0.9.7 through v.5.8.6 and fixed in v.5.8.8 allows a local attacker to cause a denial of service via the grub (CVSS 5.5)
- [CVE-2024-26503](https://cve.now/CVE-2024-26503.md): Unrestricted File Upload vulnerability in Greek Universities Network Open eClass v.3.15 and earlier allows attackers to run arbitrary code v (CVSS 9.1)
- [CVE-2024-28323](https://cve.now/CVE-2024-28323.md): The bwdates-report-result.php file in Phpgurukul User Registration & Login and User Management System 3.1 contains a potential security vuln (CVSS 6.5)
- [CVE-2024-28383](https://cve.now/CVE-2024-28383.md): Tenda AX12 v1.0 v22.03.01.16 was discovered to contain a stack overflow via the ssid parameter in the sub\_431CF0 function. (CVSS 9.8)
- [CVE-2024-28388](https://cve.now/CVE-2024-28388.md): SQL injection vulnerability in SunnyToo stproductcomments module for PrestaShop v.1.0.5 and before, allows a remote attacker to escalate pri (CVSS 9.8)
- [CVE-2024-28390](https://cve.now/CVE-2024-28390.md): An issue in Advanced Plugins ultimateimagetool module for PrestaShop before v.2.2.01, allows a remote attacker to escalate privileges and ob (CVSS 9.8)
- [CVE-2024-28391](https://cve.now/CVE-2024-28391.md): SQL injection vulnerability in FME Modules quickproducttable module for PrestaShop v.1.2.1 and before, allows a remote attacker to escalate (CVSS 9.8)
- [CVE-2024-28417](https://cve.now/CVE-2024-28417.md): Webedition CMS 9.2.2.0 has a Stored XSS vulnerability via /webEdition/we\_cmd.php. (CVSS 6.3)
- [CVE-2024-28418](https://cve.now/CVE-2024-28418.md): Webedition CMS 9.2.2.0 has a File upload vulnerability via /webEdition/we\_cmd.php (CVSS 6.5)
- [CVE-2024-28423](https://cve.now/CVE-2024-28423.md): Airflow-Diagrams v2.1.0 was discovered to contain an arbitrary file upload vulnerability in the unsafe\_load function at cli.py. (CVSS 9.8, airflow-diagrams)
- [CVE-2024-28424](https://cve.now/CVE-2024-28424.md): zenml v0.55.4 was discovered to contain an arbitrary file upload vulnerability in the load function at /materializers/cloudpickle\_materializ (CVSS 8.8)
- [CVE-2024-28425](https://cve.now/CVE-2024-28425.md): greykite v1.0.0 was discovered to contain an arbitrary file upload vulnerability in the load\_obj function at /templates/pickle\_utils.py. (CVSS 7.5, greykite)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.