# CVEs published 2024-03-15

126 CVEs were published on March 15, 2024: 9 critical, 42 high. Days are UTC.

- [CVE-2024-28862](https://cve.now/CVE-2024-28862.md): ROTP 6.2.2 and 6.2.1 has 0666 permissions for the .rb files. (CVSS 5.3, mdp rotp · rotp)
- [CVE-2024-28859](https://cve.now/CVE-2024-28859.md): Gadget chain in Symfony 1 due to vulnerable Swift Mailer dependency (CVSS 5.0, FriendsOfSymfony1 symfony1 · friendsofsymfony1/symfony1 +2)
- [CVE-2024-2514](https://cve.now/CVE-2024-2514.md): MAGESH-K21 Online-College-Event-Hall-Reservation-System login.php sql injection (CVSS 7.3, MAGESH-K21 Online-College-Event-Hall-Reservation-System)
- [CVE-2024-23298](https://cve.now/CVE-2024-23298.md): A logic issue was addressed with improved state management. (CVSS 4.3, Apple Xcode)
- [CVE-2021-47135](https://cve.now/CVE-2021-47135.md): mt76: mt7921: fix possible AOOB issue in mt7921\_mcu\_tx\_rate\_report (CVSS 7.8, Linux)
- [CVE-2021-47134](https://cve.now/CVE-2021-47134.md): efi/fdt: fix panic when no valid fdt found (no CVSS, Linux)
- [CVE-2021-47133](https://cve.now/CVE-2021-47133.md): HID: amd\_sfh: Fix memory leak in amd\_sfh\_work (no CVSS, Linux)
- [CVE-2021-47132](https://cve.now/CVE-2021-47132.md): mptcp: fix sk\_forward\_memory corruption on retransmission (CVSS 7.5, Linux)
- [CVE-2021-47131](https://cve.now/CVE-2021-47131.md): net/tls: Fix use-after-free after the TLS device goes down and up (CVSS 8.1, Linux)
- [CVE-2021-47130](https://cve.now/CVE-2021-47130.md): nvmet: fix freeing unallocated p2pmem (CVSS 7.5, Linux)
- [CVE-2021-47129](https://cve.now/CVE-2021-47129.md): netfilter: nft\_ct: skip expectations for confirmed conntrack (CVSS 7.8, Linux)
- [CVE-2021-47128](https://cve.now/CVE-2021-47128.md): bpf, lockdown, audit: Fix buggy SELinux lockdown permission checks (no CVSS, Linux)
- [CVE-2021-47127](https://cve.now/CVE-2021-47127.md): ice: track AF\_XDP ZC enabled queues in bitmap (no CVSS, Linux)
- [CVE-2021-47126](https://cve.now/CVE-2021-47126.md): ipv6: Fix KASAN: slab-out-of-bounds Read in fib6\_nh\_flush\_exceptions (CVSS 7.8, Linux)
- [CVE-2021-47125](https://cve.now/CVE-2021-47125.md): sch\_htb: fix refcount leak in htb\_parent\_to\_leaf\_offload (no CVSS, Linux)
- [CVE-2021-47124](https://cve.now/CVE-2021-47124.md): io\_uring: fix link timeout refs (CVSS 7.8, Linux)
- [CVE-2021-47123](https://cve.now/CVE-2021-47123.md): io\_uring: fix ltout double free on completion race (CVSS 7.8, Linux)
- [CVE-2021-47122](https://cve.now/CVE-2021-47122.md): net: caif: fix memory leak in caif\_device\_notify (no CVSS, Linux)
- [CVE-2021-47121](https://cve.now/CVE-2021-47121.md): net: caif: fix memory leak in cfusbl\_device\_notify (no CVSS, Linux)
- [CVE-2021-47120](https://cve.now/CVE-2021-47120.md): HID: magicmouse: fix NULL-deref on disconnect (no CVSS, Linux)
- [CVE-2021-47119](https://cve.now/CVE-2021-47119.md): ext4: fix memory leak in ext4\_fill\_super (no CVSS, Linux)
- [CVE-2021-47118](https://cve.now/CVE-2021-47118.md): pid: take a reference when initializing \`cad\_pid\` (no CVSS, Linux)
- [CVE-2021-47117](https://cve.now/CVE-2021-47117.md): ext4: fix bug on in ext4\_es\_cache\_extent as ext4\_split\_extent\_at failed (no CVSS, Linux)
- [CVE-2021-47116](https://cve.now/CVE-2021-47116.md): ext4: fix memory leak in ext4\_mb\_init\_backend on error path. (no CVSS, Linux)
- [CVE-2021-47114](https://cve.now/CVE-2021-47114.md): ocfs2: fix data corruption by fallocate (CVSS 5.5, Linux)
- [CVE-2021-47113](https://cve.now/CVE-2021-47113.md): btrfs: abort in rename\_exchange if we fail to insert the second ref (CVSS 7.1, Linux)
- [CVE-2021-47112](https://cve.now/CVE-2021-47112.md): x86/kvm: Teardown PV features on boot CPU as well (CVSS 7.8, Linux)
- [CVE-2021-47111](https://cve.now/CVE-2021-47111.md): xen-netback: take a reference to the RX task thread (CVSS 8.8, Linux)
- [CVE-2021-47110](https://cve.now/CVE-2021-47110.md): x86/kvm: Disable kvmclock on all CPUs on shutdown (no CVSS, Linux)
- [CVE-2021-47109](https://cve.now/CVE-2021-47109.md): neighbour: allow NUD\_NOARP entries to be forced GCed (CVSS 7.5, Linux)
- [CVE-2024-28848](https://cve.now/CVE-2024-28848.md): SpEL Injection in \`GET /api/v1/policies/validation/condition/\<expr\>\` in OpenMetadata (CVSS 8.8, open-metadata OpenMetadata · org.open-metadata:openmetadata…)
- [CVE-2024-28255](https://cve.now/CVE-2024-28255.md): Authentication Bypass in OpenMetadata (CVSS 9.8, open-metadata OpenMetadata)
- [CVE-2024-28847](https://cve.now/CVE-2024-28847.md): SpEL Injection in \`PUT /api/v1/events/subscriptions\` in OpenMetadata (CVSS 8.8, open-metadata OpenMetadata · org.open-metadata:openmetadata…)
- [CVE-2024-28254](https://cve.now/CVE-2024-28254.md): SpEL Injection in \`GET /api/v1/events/subscriptions/validation/condition/\<expr\>\` in OpenMetadata (CVSS 8.8, open-metadata OpenMetadata)
- [CVE-2024-28253](https://cve.now/CVE-2024-28253.md): SpEL Injection in \`PUT /api/v1/policies\` in OpenMetadata (CVSS 9.4, open-metadata OpenMetadata · org.open-metadata:openmetadata…)
- [CVE-2023-7248](https://cve.now/CVE-2023-7248.md): OpenText Vertica Management console might be prone to bypass via crafted requests (CVSS 5.0, Opentext Vertica Management Console)
- [CVE-2024-27920](https://cve.now/CVE-2024-27920.md): Unsigned code template execution through workflows in projectdiscovery/nuclei (CVSS 7.4, projectdiscovery nuclei · github.com/projectdiscovery/nu… +2)
- [CVE-2024-27085](https://cve.now/CVE-2024-27085.md): Denial of service through invites in Discourse (CVSS 6.5, discourse)
- [CVE-2024-27100](https://cve.now/CVE-2024-27100.md): Denial of service via Staff Actions in Discourse (CVSS 6.5, discourse)
- [CVE-2024-28242](https://cve.now/CVE-2024-28242.md): Disclosure of the existence of secret categories with custom backgrounds in Discourse (CVSS 5.3, discourse)
- [CVE-2024-24748](https://cve.now/CVE-2024-24748.md): Disclosure of the existence of secret subcategories in Discourse (CVSS 5.3, discourse)
- [CVE-2024-24827](https://cve.now/CVE-2024-24827.md): No rate limits on POST /uploads endpoint in Discourse (CVSS 5.3, discourse)
- [CVE-2023-51699](https://cve.now/CVE-2023-51699.md): OS Command Injection for Fluid Users with JuicefsRuntime (CVSS 4.0, fluid-cloudnative fluid · github.com/fluid-cloudnative/fluid)
- [CVE-2024-28252](https://cve.now/CVE-2024-28252.md): CoreWCF NetFraming based services can leave connections open when they should be closed (CVSS 7.5, CoreWCF · CoreWCF.NetFramingBase)
- [CVE-2024-28851](https://cve.now/CVE-2024-28851.md): Elevation of privilege in Snowflake Hive MetaStore Connector Helper script (CVSS 4.0, snowflakedb snowflake-hive-metastore-connector)
- [CVE-2024-28854](https://cve.now/CVE-2024-28854.md): Slow loris vulnerability with default configuration in tls-listener (CVSS 7.5, tmccombs tls-listener · tls-listener)
- [CVE-2023-7060](https://cve.now/CVE-2023-7060.md): Missing Security Control in Zephyr OS IP Packet Handling (CVSS 8.6, zephyrproject-rtos Zephyr)
- [CVE-2024-2193](https://cve.now/CVE-2024-2193.md): Speculative Race Condition impacts modern CPU architectures that support speculative execution, also known as GhostRace. (CVSS 5.7, AMD CPU · Xen)
- [CVE-2024-2537](https://cve.now/CVE-2024-2537.md): Electron Code Injection in Logi Tune macOS Application (CVSS 4.4, Logitech Logi Tune)
- [CVE-2023-6960](https://cve.now/CVE-2023-6960.md): CVE-2023-6960 (CVSS 7.5, Sciener TTLock App)
- [CVE-2023-7003](https://cve.now/CVE-2023-7003.md): CVE-2023-7003 (CVSS 6.8, Sciener Kontrol Lux)
- [CVE-2023-7007](https://cve.now/CVE-2023-7007.md): CVE-2023-7007 (CVSS 8.2, Sciener Gateway G2)
- [CVE-2023-7006](https://cve.now/CVE-2023-7006.md): CVE-2023-7006 (CVSS 9.1, Sciener Kontrol Lux)
- [CVE-2023-7004](https://cve.now/CVE-2023-7004.md): CVE-2023-7004 (CVSS 6.5, Sciener TTLock App)
- [CVE-2023-7009](https://cve.now/CVE-2023-7009.md): CVE-2023-7009 (CVSS 8.2, Sciener Kontrol Lux)
- [CVE-2023-7017](https://cve.now/CVE-2023-7017.md): CVE-2023-7017 (CVSS 9.8, Sciener Kontrol Lux)
- [CVE-2024-2497](https://cve.now/CVE-2024-2497.md): RaspAP raspap-webgui HTTP POST Request provider.php code injection (CVSS 4.7, raspap-webgui · billz/raspap-webgui)
- [CVE-2021-38938](https://cve.now/CVE-2021-38938.md): IBM Host Access Transformation Services information disclosure (CVSS 6.2, IBM Host Access Transformation Services)
- [CVE-2023-46181](https://cve.now/CVE-2023-46181.md): IBM Secure Proxy information disclosure (CVSS 4.0, IBM Secure Proxy)
- [CVE-2023-47699](https://cve.now/CVE-2023-47699.md): IBM Secure Proxy cross-site scripting (CVSS 6.1, IBM Secure Proxy)
- [CVE-2023-47147](https://cve.now/CVE-2023-47147.md): IBM Secure Proxy file manipulation (CVSS 5.9, IBM Secure Proxy)
- [CVE-2023-46179](https://cve.now/CVE-2023-46179.md): IBM Secure Proxy information disclosure (CVSS 4.3, IBM Secure Proxy)
- [CVE-2023-47162](https://cve.now/CVE-2023-47162.md): IBM Secure Proxy cross-site scripting (CVSS 6.1, IBM Secure Proxy)
- [CVE-2023-46182](https://cve.now/CVE-2023-46182.md): IBM Secure Proxy cross-site scripting (CVSS 5.4, IBM Secure Proxy)
- [CVE-2023-51522](https://cve.now/CVE-2023-51522.md): WordPress Paid Membership Subscriptions plugin \<= 2.10.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Cozmoslabs Paid Member Subscriptions)
- [CVE-2023-51369](https://cve.now/CVE-2023-51369.md): WordPress Customize My Account for WooCommerce plugin \<= 1.8.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, SysBasics Customize My Account for WooCommerce)
- [CVE-2023-50898](https://cve.now/CVE-2023-50898.md): WordPress Image Optimizer, Resizer and CDN – Sirv plugin \<= 7.1.2 - Broken Access Control vulnerability (CVSS 5.4, sirv.com Sirv)
- [CVE-2023-50886](https://cve.now/CVE-2023-50886.md): WordPress Legal Pages plugin \<= 1.3.7 - CSRF + Broken Access Control vulnerability (CVSS 4.3, wpWax Legal Pages)
- [CVE-2023-51525](https://cve.now/CVE-2023-51525.md): WordPress WP Simple Booking Calendar plugin \<= 2.0.8.4 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Veribo, Roland Murg WP Simple Booking Calendar)
- [CVE-2023-50861](https://cve.now/CVE-2023-50861.md): WordPress HUSKY plugin \<= 1.3.4.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, realmag777 HUSKY – Products Filter for WooCommerce)
- [CVE-2024-25597](https://cve.now/CVE-2024-25597.md): WordPress Ultimate Reviews plugin \<= 3.2.8 - Unauthenticated Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Etoile Web Design Ultimate Reviews)
- [CVE-2024-25596](https://cve.now/CVE-2024-25596.md): WordPress Doofinder for WooCommerce plugin \<= 2.1.8 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Doofinder for WooCommerce)
- [CVE-2024-25593](https://cve.now/CVE-2024-25593.md): WordPress NEX-Forms plugin \<= 8.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Basix NEX-Forms – Ultimate Form Builder)
- [CVE-2024-25592](https://cve.now/CVE-2024-25592.md): WordPress Broken Link Checker plugin \<= 2.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPMU DEV Broken Link Checker)
- [CVE-2024-25598](https://cve.now/CVE-2024-25598.md): WordPress Elementor Addons by Livemesh plugin \<= 8.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Livemesh Addons for Elementor)
- [CVE-2024-2495](https://cve.now/CVE-2024-2495.md): Cryptographic key in plain text vulnerability in FriendlyElec's FriendlyWrt (CVSS 5.2, FriendlyElec FriendlyWrt)
- [CVE-2024-25916](https://cve.now/CVE-2024-25916.md): WordPress My Calendar plugin \<= 3.4.23 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Joseph C Dolson My Calendar)
- [CVE-2024-25919](https://cve.now/CVE-2024-25919.md): WordPress Custom Field Template plugin \<= 2.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Hiroaki Miyashita Custom Field Template)
- [CVE-2024-25921](https://cve.now/CVE-2024-25921.md): WordPress Action Network plugin \<= 1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Concerted Action Action Network)
- [CVE-2024-25934](https://cve.now/CVE-2024-25934.md): WordPress FormFacade plugin \<= 1.0.0 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, FormFacade)
- [CVE-2024-25936](https://cve.now/CVE-2024-25936.md): WordPress SoundCloud Shortcode plugin \<= 4.0.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SoundCloud Inc., Lawrie Malen SoundCloud Shortcode)
- [CVE-2024-27189](https://cve.now/CVE-2024-27189.md): WordPress WP Social Widget plugin \<= 2.2.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, catchsquare WP Social Widget)
- [CVE-2024-27193](https://cve.now/CVE-2024-27193.md): WordPress PayU India plugin \<= 3.8.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, PayU India)
- [CVE-2024-27196](https://cve.now/CVE-2024-27196.md): WordPress postMash – custom post order plugin \<= 1.2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Joel Starnes postMash – custom post order)
- [CVE-2024-27192](https://cve.now/CVE-2024-27192.md): WordPress Configure SMTP Plugin \<= 3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Scott Reilly Configure SMTP)
- [CVE-2023-6725](https://cve.now/CVE-2023-6725.md): Tripleo-ansible: bind keys are world readable (CVSS 5.5, Red Hat OpenStack Platform 17.1 for RHEL · Red Hat OpenStac…)
- [CVE-2024-28752](https://cve.now/CVE-2024-28752.md): Apache CXF SSRF Vulnerability using the Aegis databinding (CVSS 9.3, Apache Software Foundation Apache CXF · org.apache.cxf:cxf-…)
- [CVE-2024-27987](https://cve.now/CVE-2024-27987.md): WordPress Give plugin \<= 3.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, StellarWP GiveWP)
- [CVE-2024-23944](https://cve.now/CVE-2024-23944.md): Apache ZooKeeper: Information disclosure in persistent watcher handling (CVSS 5.3, Apache Software Foundation Apache ZooKeeper · org.apache.zo…)
- [CVE-2024-2490](https://cve.now/CVE-2024-2490.md): Tenda AC18 openSchedWifi setSchedWifi stack-based overflow (CVSS 8.8, Tenda AC18)
- [CVE-2024-2445](https://cve.now/CVE-2024-2445.md): Reflected XSS in Mattermost Jira plugin (CVSS 6.1, Mattermost)
- [CVE-2024-2450](https://cve.now/CVE-2024-2450.md): Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to correctly verify account own (CVSS 8.8, Mattermost)
- [CVE-2024-2446](https://cve.now/CVE-2024-2446.md): Mattermost versions 8.1.x before 8.1.10, 9.2.x before 9.2.6, 9.3.x before 9.3.2, and 9.4.x before 9.4.3 fail to limit the number of @-mentio (CVSS 4.3, Mattermost)
- [CVE-2024-28053](https://cve.now/CVE-2024-28053.md): Resource Exhaustion via the Invitation Feature (CVSS 3.1, Mattermost · github.com/mattermost/mattermost/server/v8 +3)
- [CVE-2024-24975](https://cve.now/CVE-2024-24975.md): Denial of Service for mobile app users due to automatic code highlighting (CVSS 3.5, Mattermost Mobile)
- [CVE-2024-2489](https://cve.now/CVE-2024-2489.md): Tenda AC18 SetNetControlList formSetQosBand stack-based overflow (CVSS 8.8, Tenda AC18)
- [CVE-2024-2488](https://cve.now/CVE-2024-2488.md): Tenda AC18 SetPptpServerCfg formSetPPTPServer stack-based overflow (CVSS 8.8, Tenda AC18)
- [CVE-2024-2487](https://cve.now/CVE-2024-2487.md): Tenda AC18 SetOnlineDevName formSetDeviceName stack-based overflow (CVSS 8.8, Tenda AC18)
- [CVE-2024-2486](https://cve.now/CVE-2024-2486.md): Tenda AC18 QuickIndex formQuickIndex stack-based overflow (CVSS 8.8, Tenda AC18)
- [CVE-2024-2485](https://cve.now/CVE-2024-2485.md): Tenda AC18 SetSpeedWan formSetSpeedWan stack-based overflow (CVSS 8.8, Tenda AC18)
- [CVE-2024-2483](https://cve.now/CVE-2024-2483.md): Surya2Developer Hostel Management Service Password Change change-password.php cross-site request forgery (CVSS 4.3, Surya2Developer Hostel Management Service)
- [CVE-2024-1795](https://cve.now/CVE-2024-1795.md): HUSKY – Products Filter for WooCommerce Professional \<= 1.3.5.2 - Authenticated (Contributor+) SQL Injection (CVSS 8.8, realmag777 HUSKY – Products Filter Professional for WooComm…)
- [CVE-2024-2399](https://cve.now/CVE-2024-2399.md): Premium Addons for Elementor \<= 4.10.23 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, leap13 Premium Addons for Elementor – Powerful Elementor Te…)
- [CVE-2024-1796](https://cve.now/CVE-2024-1796.md): HUSKY – Products Filter for WooCommerce Professional \<= 1.3.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, realmag777 HUSKY – Products Filter Professional for WooComm…)
- [CVE-2024-2482](https://cve.now/CVE-2024-2482.md): Surya2Developer Hostel Management Service HTTP POST Request check\_availability.php observable response discrepancy (CVSS 3.7, Surya2Developer Hostel Management Service)
- [CVE-2024-2481](https://cve.now/CVE-2024-2481.md): Surya2Developer Hostel Management System manage-students.php access control (CVSS 6.5, Surya2Developer Hostel Management System)
- [CVE-2024-2480](https://cve.now/CVE-2024-2480.md): MHA Sistemas arMHAzena Executa Page sql injection (CVSS 6.3, MHA Sistemas arMHAzena)
- [CVE-2024-2479](https://cve.now/CVE-2024-2479.md): MHA Sistemas arMHAzena Cadastro Page cross site scripting (CVSS 3.5, MHA Sistemas arMHAzena)
- [CVE-2024-2478](https://cve.now/CVE-2024-2478.md): BradWenqiang HR Background Management register selectAll sql injection (CVSS 6.3, BradWenqiang HR)
- [CVE-2024-2204](https://cve.now/CVE-2024-2204.md): Zemana AntiLogger v2.74.204.664 - Denial of Service (DoS) (CVSS 5.5, Zemana AntiLogger)
- [CVE-2024-2180](https://cve.now/CVE-2024-2180.md): Zemana AntiLogger v2.74.204.664 - Kernel Memory Leak (CVSS 5.5, Zemana AntiLogger)
- [CVE-2024-1917](https://cve.now/CVE-2024-1917.md): Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a rem (CVSS 9.8, Mitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24)
- [CVE-2024-1916](https://cve.now/CVE-2024-1916.md): Integer Overflow or Wraparound vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a rem (CVSS 9.8, Mitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24)
- [CVE-2024-1915](https://cve.now/CVE-2024-1915.md): Incorrect Pointer Scaling vulnerability in Mitsubishi Electric Corporation MELSEC-Q Series and MELSEC-L Series CPU modules allows a remote u (CVSS 9.8, Mitsubishi Electric MELSEC-Q Series Q03UDECPU · Mitsubi… +24)
- [CVE-2024-25227](https://cve.now/CVE-2024-25227.md): SQL Injection vulnerability in ABO.CMS version 5.8, allows remote attackers to execute arbitrary code, cause a denial of service (DoS), esca (CVSS 6.5)
- [CVE-2024-26454](https://cve.now/CVE-2024-26454.md): A Cross Site Scripting vulnerability in Healthcare-Chatbot through 9b7058a can occur via a crafted payload to the email1 or pwd1 parameter i (CVSS 5.4)
- [CVE-2024-26540](https://cve.now/CVE-2024-26540.md): A heap-based buffer overflow in Clmg before 3.3.3 can occur via a crafted file to cimg\_library::CImg\<unsigned char\>::\_load\_analyze. (CVSS 7.8)
- [CVE-2024-27351](https://cve.now/CVE-2024-27351.md): In Django 3.2 before 3.2.25, 4.2 before 4.2.11, and 5.0 before 5.0.3, the django.utils.text.Truncator.words() method (with html=True) and th (CVSS 5.3, django)
- [CVE-2024-27756](https://cve.now/CVE-2024-27756.md): GLPI through 10.0.12 allows CSV injection by an attacker who is able to create an asset with a crafted title. (CVSS 8.8)
- [CVE-2024-28318](https://cve.now/CVE-2024-28318.md): gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain a out of boundary write vulnerability via swf\_get\_string at scene\_manager/sw (CVSS 7.1)
- [CVE-2024-28319](https://cve.now/CVE-2024-28319.md): gpac 2.3-DEV-rev921-g422b78ecf-master was discovered to contain an out of boundary read vulnerability via gf\_dash\_setup\_period media\_tools/d (CVSS 6.2)
- [CVE-2024-28353](https://cve.now/CVE-2024-28353.md): There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. (CVSS 8.8)
- [CVE-2024-28354](https://cve.now/CVE-2024-28354.md): There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. (CVSS 10.0)
- [CVE-2024-28401](https://cve.now/CVE-2024-28401.md): TOTOLINK X2000R before v1.0.0-B20231213.1013 contains a Store Cross-site scripting (XSS) vulnerability in Root Access Control under the Wire (CVSS 5.4)
- [CVE-2024-28403](https://cve.now/CVE-2024-28403.md): TOTOLINK X2000R before V1.0.0-B20231213.1013 is vulnerable to Cross Site Scripting (XSS) via the VPN Page. (CVSS 5.4)
- [CVE-2024-28404](https://cve.now/CVE-2024-28404.md): TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in MAC Filtering under the Firewall (CVSS 8.0)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.