CVEs published March 15, 2024
126 CVEs were published on March 15, 2024: 9 critical, 42 high.
- Published
- 126
- Critical
- 9
- High
- 42
- Medium
- 58
- Low
- 4
- Unrated
- 13
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- Linux
- 26
- IBM Secure Proxy
- 6
- Tenda AC18
- 6
- discourse
- 5
- Sciener Kontrol Lux
- 4
- Mattermost
- 3
- Mitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24
- 3
- open-metadata OpenMetadata · org.open-metadata:openmetadata…
- 3
- MHA Sistemas arMHAzena
- 2
- open-metadata OpenMetadata
- 2
Critical 9
- CVE-2024-28255Authentication Bypass in OpenMetadataopen-metadata OpenMetadata
- CVE-2024-28253SpEL Injection in `PUT /api/v1/policies` in OpenMetadataopen-metadata OpenMetadata · org.open-metadata:openmetadata…
- CVE-2023-7006CVE-2023-7006Sciener Kontrol Lux
- CVE-2023-7017CVE-2023-7017Sciener Kontrol Lux
- CVE-2024-28752Apache CXF SSRF Vulnerability using the Aegis databindingApache Software Foundation Apache CXF · org.apache.cxf:cxf-…
- CVE-2024-1917Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remMitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24
- CVE-2024-1916Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remMitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24
- CVE-2024-1915Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote uMitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24
- CVE-2024-28354There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01.
High 42
- CVE-2024-2514MAGESH-K21 Online-College-Event-Hall-Reservation-System login.php sql injectionMAGESH-K21 Online-College-Event-Hall-Reservation-System
- CVE-2021-47135mt76: mt7921: fix possible AOOB issue in mt7921_mcu_tx_rate_reportLinux
- CVE-2021-47132mptcp: fix sk_forward_memory corruption on retransmissionLinux
- CVE-2021-47131net/tls: Fix use-after-free after the TLS device goes down and upLinux
- CVE-2021-47130nvmet: fix freeing unallocated p2pmemLinux
- CVE-2021-47129netfilter: nft_ct: skip expectations for confirmed conntrackLinux
- CVE-2021-47126ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptionsLinux
- CVE-2021-47124io_uring: fix link timeout refsLinux
- CVE-2021-47123io_uring: fix ltout double free on completion raceLinux
- CVE-2021-47113btrfs: abort in rename_exchange if we fail to insert the second refLinux
- CVE-2021-47112x86/kvm: Teardown PV features on boot CPU as wellLinux
- CVE-2021-47111xen-netback: take a reference to the RX task threadLinux
- CVE-2021-47109neighbour: allow NUD_NOARP entries to be forced GCedLinux
- CVE-2024-28848SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadataopen-metadata OpenMetadata · org.open-metadata:openmetadata…
- CVE-2024-28847SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadataopen-metadata OpenMetadata · org.open-metadata:openmetadata…
- CVE-2024-28254SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadataopen-metadata OpenMetadata
- CVE-2024-27920Unsigned code template execution through workflows in projectdiscovery/nucleiprojectdiscovery nuclei · github.com/projectdiscovery/nu… +2
- CVE-2024-28252CoreWCF NetFraming based services can leave connections open when they should be closedCoreWCF · CoreWCF.NetFramingBase
- CVE-2024-28854Slow loris vulnerability with default configuration in tls-listenertmccombs tls-listener · tls-listener
- CVE-2023-7060Missing Security Control in Zephyr OS IP Packet Handlingzephyrproject-rtos Zephyr
- CVE-2023-6960CVE-2023-6960Sciener TTLock App
- CVE-2023-7007CVE-2023-7007Sciener Gateway G2
- CVE-2023-7009CVE-2023-7009Sciener Kontrol Lux
- CVE-2024-25597WordPress Ultimate Reviews plugin <= 3.2.8 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityEtoile Web Design Ultimate Reviews
- CVE-2024-25921WordPress Action Network plugin <= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityConcerted Action Action Network
- CVE-2024-27193WordPress PayU India plugin <= 3.8.8 - Reflected Cross Site Scripting (XSS) vulnerabilityPayU India
- CVE-2024-27196WordPress postMash – custom post order plugin <= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityJoel Starnes postMash – custom post order
- CVE-2024-27192WordPress Configure SMTP Plugin <= 3.1 is vulnerable to Cross Site Scripting (XSS)Scott Reilly Configure SMTP
- CVE-2024-27987WordPress Give plugin <= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityStellarWP GiveWP
- CVE-2024-2490Tenda AC18 openSchedWifi setSchedWifi stack-based overflowTenda AC18
- CVE-2024-2450Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account ownMattermost
- CVE-2024-2489Tenda AC18 SetNetControlList formSetQosBand stack-based overflowTenda AC18
- CVE-2024-2488Tenda AC18 SetPptpServerCfg formSetPPTPServer stack-based overflowTenda AC18
- CVE-2024-2487Tenda AC18 SetOnlineDevName formSetDeviceName stack-based overflowTenda AC18
- CVE-2024-2486Tenda AC18 QuickIndex formQuickIndex stack-based overflowTenda AC18
- CVE-2024-2485Tenda AC18 SetSpeedWan formSetSpeedWan stack-based overflowTenda AC18
- CVE-2024-1795HUSKY – Products Filter for WooCommerce Professional <= 1.3.5.2 - Authenticated (Contributor+) SQL Injectionrealmag777 HUSKY – Products Filter Professional for WooComm…
- CVE-2024-26540A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimg_library::CImg<unsigned char>::_load_analyze.
- CVE-2024-27756GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title.
- CVE-2024-28318gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf_get_string at scene_manager/sw
- CVE-2024-28353There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01.
- CVE-2024-28404TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall
Medium, low and unrated 75
- CVE-2024-28862ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files.mdp rotp · rotp
- CVE-2024-28859Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependencyFriendsOfSymfony1 symfony1 · friendsofsymfony1/symfony1 +2
- CVE-2024-23298A logic issue was addressed with improved state management.Apple Xcode
- CVE-2021-47134efi/fdt: fix panic when no valid fdt foundLinux
- CVE-2021-47133HID: amd_sfh: Fix memory leak in amd_sfh_workLinux
- CVE-2021-47128bpf, lockdown, audit: Fix buggy SELinux lockdown permission checksLinux
- CVE-2021-47127ice: track AF_XDP ZC enabled queues in bitmapLinux
- CVE-2021-47125sch_htb: fix refcount leak in htb_parent_to_leaf_offloadLinux
- CVE-2021-47122net: caif: fix memory leak in caif_device_notifyLinux
- CVE-2021-47121net: caif: fix memory leak in cfusbl_device_notifyLinux
- CVE-2021-47120HID: magicmouse: fix NULL-deref on disconnectLinux
- CVE-2021-47119ext4: fix memory leak in ext4_fill_superLinux
- CVE-2021-47118pid: take a reference when initializing `cad_pid`Linux
- CVE-2021-47117ext4: fix bug on in ext4_es_cache_extent as ext4_split_extent_at failedLinux
- CVE-2021-47116ext4: fix memory leak in ext4_mb_init_backend on error path.Linux
- CVE-2021-47114ocfs2: fix data corruption by fallocateLinux
- CVE-2021-47110x86/kvm: Disable kvmclock on all CPUs on shutdownLinux
- CVE-2023-7248OpenText Vertica Management console might be prone to bypass via crafted requestsOpentext Vertica Management Console
- CVE-2024-27085Denial of service through invites in Discoursediscourse
- CVE-2024-27100Denial of service via Staff Actions in Discoursediscourse
- CVE-2024-28242Disclosure of the existence of secret categories with custom backgrounds in Discoursediscourse
- CVE-2024-24748Disclosure of the existence of secret subcategories in Discoursediscourse
- CVE-2024-24827No rate limits on POST /uploads endpoint in Discoursediscourse
- CVE-2023-51699OS Command Injection for Fluid Users with JuicefsRuntimefluid-cloudnative fluid · github.com/fluid-cloudnative/fluid
- CVE-2024-28851Elevation of privilege in Snowflake Hive MetaStore Connector Helper scriptsnowflakedb snowflake-hive-metastore-connector
- CVE-2024-2193Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace.AMD CPU · Xen
- CVE-2024-2537Electron Code Injection in Logi Tune macOS ApplicationLogitech Logi Tune
- CVE-2023-7003CVE-2023-7003Sciener Kontrol Lux
- CVE-2023-7004CVE-2023-7004Sciener TTLock App
- CVE-2024-2497RaspAP raspap-webgui HTTP POST Request provider.php code injectionraspap-webgui · billz/raspap-webgui
- CVE-2021-38938IBM Host Access Transformation Services information disclosureIBM Host Access Transformation Services
- CVE-2023-46181IBM Secure Proxy information disclosureIBM Secure Proxy
- CVE-2023-47699IBM Secure Proxy cross-site scriptingIBM Secure Proxy
- CVE-2023-47147IBM Secure Proxy file manipulationIBM Secure Proxy
- CVE-2023-46179IBM Secure Proxy information disclosureIBM Secure Proxy
- CVE-2023-47162IBM Secure Proxy cross-site scriptingIBM Secure Proxy
- CVE-2023-46182IBM Secure Proxy cross-site scriptingIBM Secure Proxy
- CVE-2023-51522WordPress Paid Membership Subscriptions plugin <= 2.10.4 - Cross Site Request Forgery (CSRF) vulnerabilityCozmoslabs Paid Member Subscriptions
- CVE-2023-51369WordPress Customize My Account for WooCommerce plugin <= 1.8.3 - Cross Site Request Forgery (CSRF) vulnerabilitySysBasics Customize My Account for WooCommerce
- CVE-2023-50898WordPress Image Optimizer, Resizer and CDN – Sirv plugin <= 7.1.2 - Broken Access Control vulnerabilitysirv.com Sirv
- CVE-2023-50886WordPress Legal Pages plugin <= 1.3.7 - CSRF + Broken Access Control vulnerabilitywpWax Legal Pages
- CVE-2023-51525WordPress WP Simple Booking Calendar plugin <= 2.0.8.4 - Cross Site Request Forgery (CSRF) vulnerabilityVeribo, Roland Murg WP Simple Booking Calendar
- CVE-2023-50861WordPress HUSKY plugin <= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerabilityrealmag777 HUSKY – Products Filter for WooCommerce
- CVE-2024-25596WordPress Doofinder for WooCommerce plugin <= 2.1.8 - Cross Site Scripting (XSS) vulnerabilityDoofinder for WooCommerce
- CVE-2024-25593WordPress NEX-Forms plugin <= 8.5.5 - Cross Site Scripting (XSS) vulnerabilityBasix NEX-Forms – Ultimate Form Builder
- CVE-2024-25592WordPress Broken Link Checker plugin <= 2.2.3 - Cross Site Scripting (XSS) vulnerabilityWPMU DEV Broken Link Checker
- CVE-2024-25598WordPress Elementor Addons by Livemesh plugin <= 8.3 - Cross Site Scripting (XSS) vulnerabilityLivemesh Addons for Elementor
- CVE-2024-2495Cryptographic key in plain text vulnerability in FriendlyElec's FriendlyWrtFriendlyElec FriendlyWrt
- CVE-2024-25916WordPress My Calendar plugin <= 3.4.23 - Cross Site Scripting (XSS) vulnerabilityJoseph C Dolson My Calendar
- CVE-2024-25919WordPress Custom Field Template plugin <= 2.6 - Cross Site Scripting (XSS) vulnerabilityHiroaki Miyashita Custom Field Template
- CVE-2024-25934WordPress FormFacade plugin <= 1.0.0 - Cross Site Scripting (XSS) vulnerabilityFormFacade
- CVE-2024-25936WordPress SoundCloud Shortcode plugin <= 4.0.1 - Cross Site Scripting (XSS) vulnerabilitySoundCloud Inc., Lawrie Malen SoundCloud Shortcode
- CVE-2024-27189WordPress WP Social Widget plugin <= 2.2.5 - Cross Site Scripting (XSS) vulnerabilitycatchsquare WP Social Widget
- CVE-2023-6725Tripleo-ansible: bind keys are world readableRed Hat OpenStack Platform 17.1 for RHEL · Red Hat OpenStac…
- CVE-2024-23944Apache ZooKeeper: Information disclosure in persistent watcher handlingApache Software Foundation Apache ZooKeeper · org.apache.zo…
- CVE-2024-2445Reflected XSS in Mattermost Jira pluginMattermost
- CVE-2024-2446Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentioMattermost
- CVE-2024-28053Resource Exhaustion via the Invitation FeatureMattermost · github.com/mattermost/mattermost/server/v8 +3
- CVE-2024-24975 Denial of Service for mobile app users due to automatic code highlightingMattermost Mobile
- CVE-2024-2483Surya2Developer Hostel Management Service Password Change change-password.php cross-site request forgerySurya2Developer Hostel Management Service
- CVE-2024-2399Premium Addons for Elementor <= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site Scriptingleap13 Premium Addons for Elementor – Powerful Elementor Te…
- CVE-2024-1796HUSKY – Products Filter for WooCommerce Professional <= 1.3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcoderealmag777 HUSKY – Products Filter Professional for WooComm…
- CVE-2024-2482Surya2Developer Hostel Management Service HTTP POST Request check_availability.php observable response discrepancySurya2Developer Hostel Management Service
- CVE-2024-2481Surya2Developer Hostel Management System manage-students.php access controlSurya2Developer Hostel Management System
- CVE-2024-2480MHA Sistemas arMHAzena Executa Page sql injectionMHA Sistemas arMHAzena
- CVE-2024-2479MHA Sistemas arMHAzena Cadastro Page cross site scriptingMHA Sistemas arMHAzena
- CVE-2024-2478BradWenqiang HR Background Management register selectAll sql injectionBradWenqiang HR
- CVE-2024-2204Zemana AntiLogger v2.74.204.664 - Denial of Service (DoS)Zemana AntiLogger
- CVE-2024-2180Zemana AntiLogger v2.74.204.664 - Kernel Memory LeakZemana AntiLogger
- CVE-2024-25227SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), esca
- CVE-2024-26454A Cross Site Scripting vulnerability in Healthcare-Chatbot through 9b7058a can occur via a crafted payload to the email1 or pwd1 parameter i
- CVE-2024-27351In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and thdjango
- CVE-2024-28319gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf_dash_setup_period media_tools/d
- CVE-2024-28401TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wire
- CVE-2024-28403TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page.