# CVEs published 2024-03-18

194 CVEs were published on March 18, 2024: 13 critical, 72 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-28865](https://cve.now/CVE-2024-28865.md): django-wiki denial of service via regular expression (CVSS 7.5, django-wiki · wiki)
- [CVE-2024-28864](https://cve.now/CVE-2024-28864.md): \[TagAwareCipher\] - Decryption Failure (Regex Match) (CVSS 2.6, IlicMiljan Secure-Props · ilicmiljan/secure-props)
- [CVE-2024-28855](https://cve.now/CVE-2024-28855.md): ZITADEL vulnerable to improper HTML sanitization (CVSS 8.1, zitadel · github.com/zitadel/zitadel)
- [CVE-2024-28250](https://cve.now/CVE-2024-28250.md): Cilium has possible unencrypted traffic between nodes when using WireGuard and L7 policies (CVSS 6.1, cilium · github.com/cilium/cilium)
- [CVE-2024-28249](https://cve.now/CVE-2024-28249.md): Cilium has possible unencrypted traffic between nodes when using IPsec and L7 policies (CVSS 6.1, cilium · github.com/cilium/cilium)
- [CVE-2024-28248](https://cve.now/CVE-2024-28248.md): Cilium intermittent HTTP policy bypass (CVSS 7.2, cilium · github.com/cilium/cilium)
- [CVE-2024-28237](https://cve.now/CVE-2024-28237.md): OctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settings (CVSS 4.0, OctoPrint)
- [CVE-2024-24578](https://cve.now/CVE-2024-24578.md): RaspberryMatic Unauthenticated Remote Code Execution vulnerability through HMServer File Upload (CVSS 10.0, jens-maus RaspberryMatic)
- [CVE-2024-23333](https://cve.now/CVE-2024-23333.md): LAM vulnerable to Authenticated Remote Code Execution (CVSS 7.9, LDAPAccountManager lam)
- [CVE-2024-2604](https://cve.now/CVE-2024-2604.md): SourceCodester File Manager App update-file.php unrestricted upload (CVSS 6.3, SourceCodester File Manager App)
- [CVE-2024-22412](https://cve.now/CVE-2024-22412.md): ClickHouse's Role-based Access Control is bypassed when query caching is enabled. (CVSS 2.4, ClickHouse)
- [CVE-2023-7236](https://cve.now/CVE-2023-7236.md): Backup Bolt \<= 1.3.0 - Sensitive Data Exposure (CVSS 4.7, Backup Bolt)
- [CVE-2024-0951](https://cve.now/CVE-2024-0951.md): Advanced Social Feeds Widget & Shortcode \<= 1.7 - Admin+ Stored XSS (CVSS 4.8, Advanced Social Feeds Widget & Shortcode)
- [CVE-2024-0711](https://cve.now/CVE-2024-0711.md): Buttons Shortcode and Widget \<= 1.16 - Stored XSS via shortcode (CVSS 6.1, Buttons Shortcode and Widget)
- [CVE-2023-7085](https://cve.now/CVE-2023-7085.md): Scalable Vector Graphics (SVG) \<= 3.4 - Author+ Stored XSS via SVG (CVSS 5.4, Scalable Vector Graphics)
- [CVE-2023-6821](https://cve.now/CVE-2023-6821.md): Error Log Viewer \< 1.1.3 - Directory Listing to Sensitive Data Exposure (CVSS 6.5, Error Log Viewer by BestWebSoft)
- [CVE-2024-0858](https://cve.now/CVE-2024-0858.md): Innovs HR \< 1.0.3.7.1 - Employee Creation via CSRF (CVSS 8.8, Innovs HR)
- [CVE-2024-0973](https://cve.now/CVE-2024-0973.md): Widget for Social Page Feeds \< 6.4 - Admin+ Stored XSS (CVSS 6.1, Widget for Social Page Feeds)
- [CVE-2024-0820](https://cve.now/CVE-2024-0820.md): Jobs for WordPress \< 2.7.4 - Contributor+ Stored XSS (CVSS 5.4, Jobs for WordPress)
- [CVE-2024-0719](https://cve.now/CVE-2024-0719.md): Tabs Shortcode and Widget \<= 1.17 - Contributor+ Stored Cross-Site Scripting (CVSS 5.4, Tabs Shortcode and Widget)
- [CVE-2024-0365](https://cve.now/CVE-2024-0365.md): Fancy Product Designer \< 6.1.5 - Admin+ SQL Injection (CVSS 6.5, Fancy Product Designer)
- [CVE-2024-0779](https://cve.now/CVE-2024-0779.md): Enjoy Social Feed \<= 6.2.2 - Unauthenticated Arbitrary Instagram Account Unlinking (CVSS 8.8, Enjoy Social Feed plugin for WordPress website)
- [CVE-2024-0780](https://cve.now/CVE-2024-0780.md): Enjoy Social Feed \<= 6.2.2 - Subscriber+ Plugin Database Reset (CVSS 8.8, Enjoy Social Feed plugin for WordPress website)
- [CVE-2023-41334](https://cve.now/CVE-2023-41334.md): astropy vulnerable to RCE in TranformGraph().to\_dot\_graph function (CVSS 8.4, astropy)
- [CVE-2024-21662](https://cve.now/CVE-2024-21662.md): Argo CD vulnerable to Bypassing of Rate Limit and Brute Force Protection Using Cache Overflow (CVSS 7.5, argoproj argo-cd · github.com/argoproj/argo-cd/v2)
- [CVE-2024-21661](https://cve.now/CVE-2024-21661.md): Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment (CVSS 7.5, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2024-26065](https://cve.now/CVE-2024-26065.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26106](https://cve.now/CVE-2024-26106.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26063](https://cve.now/CVE-2024-26063.md): Adobe Experience Manager | Information Exposure (CWE-200) (CVSS 5.3, Adobe Experience Manager)
- [CVE-2024-26080](https://cve.now/CVE-2024-26080.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26062](https://cve.now/CVE-2024-26062.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26035](https://cve.now/CVE-2024-26035.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26033](https://cve.now/CVE-2024-26033.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-20760](https://cve.now/CVE-2024-20760.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26064](https://cve.now/CVE-2024-26064.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26120](https://cve.now/CVE-2024-26120.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26069](https://cve.now/CVE-2024-26069.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26061](https://cve.now/CVE-2024-26061.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26104](https://cve.now/CVE-2024-26104.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26103](https://cve.now/CVE-2024-26103.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26051](https://cve.now/CVE-2024-26051.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26101](https://cve.now/CVE-2024-26101.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26096](https://cve.now/CVE-2024-26096.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26056](https://cve.now/CVE-2024-26056.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26034](https://cve.now/CVE-2024-26034.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26124](https://cve.now/CVE-2024-26124.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26119](https://cve.now/CVE-2024-26119.md): Adobe Experience Manager | Information Exposure (CWE-200) (CVSS 5.3, Adobe Experience Manager)
- [CVE-2024-26031](https://cve.now/CVE-2024-26031.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26059](https://cve.now/CVE-2024-26059.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26073](https://cve.now/CVE-2024-26073.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26030](https://cve.now/CVE-2024-26030.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26102](https://cve.now/CVE-2024-26102.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26044](https://cve.now/CVE-2024-26044.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26038](https://cve.now/CVE-2024-26038.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26050](https://cve.now/CVE-2024-26050.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 4.8, Adobe Experience Manager)
- [CVE-2024-26067](https://cve.now/CVE-2024-26067.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26040](https://cve.now/CVE-2024-26040.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26094](https://cve.now/CVE-2024-26094.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26042](https://cve.now/CVE-2024-26042.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26028](https://cve.now/CVE-2024-26028.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26118](https://cve.now/CVE-2024-26118.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26032](https://cve.now/CVE-2024-26032.md): Adobe Experience Manager | Cross-site Scripting (DOM-based XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26105](https://cve.now/CVE-2024-26105.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26052](https://cve.now/CVE-2024-26052.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26107](https://cve.now/CVE-2024-26107.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26045](https://cve.now/CVE-2024-26045.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-20768](https://cve.now/CVE-2024-20768.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26125](https://cve.now/CVE-2024-26125.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26041](https://cve.now/CVE-2024-26041.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-26043](https://cve.now/CVE-2024-26043.md): Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2024-20762](https://cve.now/CVE-2024-20762.md): Adobe Animate MP3 File parsing unitialized heap memory corruption (CVSS 5.5, Adobe Animate)
- [CVE-2024-20764](https://cve.now/CVE-2024-20764.md): Adobe Animate 2024 SWF File parsing memory corruption (CVSS 5.5, Adobe Animate)
- [CVE-2024-20763](https://cve.now/CVE-2024-20763.md): Adobe Animate 2024 GIF file parsing memory corruption (CVSS 5.5, Adobe Animate)
- [CVE-2024-20761](https://cve.now/CVE-2024-20761.md): Adobe Animate 2024 BMP File Parsing Out-Of-Bound Write Remote Code execution Vulnerability (CVSS 7.8, Adobe Animate)
- [CVE-2024-21652](https://cve.now/CVE-2024-21652.md): Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss (CVSS 9.8, argoproj argo-cd · github.com/argoproj/argo-cd/v2)
- [CVE-2024-20754](https://cve.now/CVE-2024-20754.md): Lightroom Desktop | Untrusted Search Path (CWE-426) (CVSS 7.8, Adobe Lightroom Desktop)
- [CVE-2024-27914](https://cve.now/CVE-2024-27914.md): Reflected Cross-Site Scripting (XSS) in search engine when debug mode is enabled in GLPI (CVSS 5.3, glpi-project glpi)
- [CVE-2024-27104](https://cve.now/CVE-2024-27104.md): Stored XSS in dashboards in GLPI (CVSS 4.5, glpi-project glpi)
- [CVE-2024-27098](https://cve.now/CVE-2024-27098.md): Blind Server-Side Request Forgery (SSRF) using Arbitrary Object Instantiation in GLPI (CVSS 6.4, glpi-project glpi)
- [CVE-2024-27096](https://cve.now/CVE-2024-27096.md): SQL Injection in through the search engine (CVSS 7.7, glpi-project glpi)
- [CVE-2024-2229](https://cve.now/CVE-2024-2229.md): CWE-502: Deserialization of Untrusted Data vulnerability exists that could cause remote code execution when a malicious project file is loa (CVSS 7.8, Schneider Electric EcoStruxure Power Design - Ecodial)
- [CVE-2024-2052](https://cve.now/CVE-2024-2052.md): CWE-552: Files or Directories Accessible to External Parties vulnerability exists that could allow unauthenticated files and logs exfiltrat (CVSS 7.5, Schneider Electric Easergy T200 (Modbus) Models: T200I,… +1)
- [CVE-2024-2050](https://cve.now/CVE-2024-2050.md): CWE-79: Improper Neutralization of Input During Web Page Generation (‘Cross-site Scripting’) vulnerability exists when an attacker injects (CVSS 8.2, Schneider Electric Easergy T200 (Modbus) Models: T200I,… +1)
- [CVE-2024-2051](https://cve.now/CVE-2024-2051.md): CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover and unauthorized (CVSS 9.8, Schneider Electric Easergy T200 (Modbus) Models: T200I,… +1)
- [CVE-2024-20757](https://cve.now/CVE-2024-20757.md): Bridge 2024 TIF File Parsing Out-Of-Bound Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Bridge)
- [CVE-2024-20755](https://cve.now/CVE-2024-20755.md): Adobe Bridge PDF Parsing Heap Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2024-20752](https://cve.now/CVE-2024-20752.md): ZDI-CAN-22653: Adobe Bridge PS File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2024-20756](https://cve.now/CVE-2024-20756.md): Adobe Bridge 2024 Out of Bound Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Bridge)
- [CVE-2024-2390](https://cve.now/CVE-2024-2390.md): Local Privilege Escalation (CVSS 7.8, Tenable Nessus Agent · Tenable Nessus)
- [CVE-2024-27930](https://cve.now/CVE-2024-27930.md): Sensitive fields access through dropdowns in GLPI (CVSS 6.5, glpi-project glpi)
- [CVE-2024-27937](https://cve.now/CVE-2024-27937.md): glpi Users emails enumeration (CVSS 6.5, glpi-project glpi)
- [CVE-2024-1658](https://cve.now/CVE-2024-1658.md): Grid Shortcodes \< 1.1.1 - Contributor+ Stored XSS (CVSS 5.4, Grid Shortcodes)
- [CVE-2024-1333](https://cve.now/CVE-2024-1333.md): Responsive Pricing Table \< 5.1.11 - Author+ Stored XSS (CVSS 5.4, Responsive Pricing Table)
- [CVE-2024-1331](https://cve.now/CVE-2024-1331.md): Team Members \< 5.3.2 - Author+ Stored XSS (CVSS 6.1, Team Members)
- [CVE-2024-20746](https://cve.now/CVE-2024-20746.md): Adobe Premiere Pro Out-of-bounds Write Arbitrary code execution (CVSS 7.8, Adobe Premiere Pro)
- [CVE-2024-20745](https://cve.now/CVE-2024-20745.md): ZDI-CAN-22671: Adobe Premiere Pro AVI File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Premiere Pro)
- [CVE-2024-1753](https://cve.now/CVE-2024-1753.md): Buildah: buildah: container escape via improper bind mount validation (CVSS 8.6, buildah · Red Hat Enterprise Linux +4)
- [CVE-2024-22257](https://cve.now/CVE-2024-22257.md): In Spring Security, versions 5.7.x prior to 5.7.12, 5.8.x prior to 5.8.11, versions 6.0.x prior to 6.0.9, versions 6.1.x prior to 6.1.8, v (CVSS 8.2, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2024-2599](https://cve.now/CVE-2024-2599.md): Unrestricted Upload of File with Dangerous Type vulnerability in AMSS++ (CVSS 9.9, Amssplus AMSS++)
- [CVE-2024-2598](https://cve.now/CVE-2024-2598.md): Cross-Site Scripting (XSS) in AMSS++ (CVSS 7.1, Amssplus AMSS++)
- [CVE-2024-2597](https://cve.now/CVE-2024-2597.md): Cross-Site Scripting (XSS) in AMSS++ (CVSS 7.1, Amssplus AMSS++)
- [CVE-2024-2596](https://cve.now/CVE-2024-2596.md): Cross-Site Scripting (XSS) in AMSS++ (CVSS 7.1, Amssplus AMSS++)
- [CVE-2024-2595](https://cve.now/CVE-2024-2595.md): Cross-Site Scripting (XSS) in AMSS++ (CVSS 7.1, Amssplus AMSS++)
- [CVE-2024-2594](https://cve.now/CVE-2024-2594.md): Cross-Site Scripting (XSS) in AMSS++ (CVSS 7.1, Amssplus AMSS++)
- [CVE-2024-2593](https://cve.now/CVE-2024-2593.md): Cross-Site Scripting (XSS) in AMSS++ (CVSS 7.1, Amssplus AMSS++)
- [CVE-2024-2592](https://cve.now/CVE-2024-2592.md): SQL injection vulnerability in AMSS++ (CVSS 8.2, Amssplus AMSS++)
- [CVE-2024-2591](https://cve.now/CVE-2024-2591.md): SQL injection vulnerability in AMSS++ (CVSS 8.2, Amssplus AMSS++)
- [CVE-2024-2590](https://cve.now/CVE-2024-2590.md): SQL injection vulnerability in AMSS++ (CVSS 8.2, Amssplus AMSS++)
- [CVE-2024-2589](https://cve.now/CVE-2024-2589.md): SQL injection vulnerability in AMSS++ (CVSS 8.2, Amssplus AMSS++)
- [CVE-2024-2588](https://cve.now/CVE-2024-2588.md): SQL injection vulnerability in AMSS++ (CVSS 8.2, Amssplus AMSS++)
- [CVE-2024-2587](https://cve.now/CVE-2024-2587.md): SQL injection vulnerability in AMSS++ (CVSS 8.2, Amssplus AMSS++)
- [CVE-2024-2586](https://cve.now/CVE-2024-2586.md): SQL injection vulnerability in AMSS++ (CVSS 8.2, Amssplus AMSS++)
- [CVE-2024-2585](https://cve.now/CVE-2024-2585.md): SQL injection vulnerability in AMSS++ (CVSS 8.2, Amssplus AMSS++)
- [CVE-2024-2584](https://cve.now/CVE-2024-2584.md): SQL injection vulnerability in AMSS++ (CVSS 8.2, Amssplus AMSS++)
- [CVE-2024-27774](https://cve.now/CVE-2024-27774.md): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-259: Use of Hard-coded Password (CVSS 7.5, Unitronics Unistream Unilogic)
- [CVE-2024-27773](https://cve.now/CVE-2024-27773.md): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-348: Use of Less Trusted Source (CVSS 8.8, Unitronics Unistream Unilogic)
- [CVE-2024-27772](https://cve.now/CVE-2024-27772.md): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-78: 'OS Command Injection' (CVSS 8.8, Unitronics Unistream Unilogic)
- [CVE-2024-27771](https://cve.now/CVE-2024-27771.md): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-22: 'Path Traversal' (CVSS 8.8, Unitronics Unistream Unilogic)
- [CVE-2024-27770](https://cve.now/CVE-2024-27770.md): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-23: Relative Path Traversal (CVSS 8.8, Unitronics Unistream Unilogic)
- [CVE-2024-27769](https://cve.now/CVE-2024-27769.md): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (CVSS 8.8, Unitronics Unistream Unilogic)
- [CVE-2024-27768](https://cve.now/CVE-2024-27768.md): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-22: 'Path Traversal' (CVSS 9.8, Unitronics Unistream Unilogic)
- [CVE-2024-27767](https://cve.now/CVE-2024-27767.md): Unitronics Unistream Unilogic – Versions prior to 1.35.227 CWE-287: Improper Authentication (CVSS 10.0, Unitronics Unistream Unilogic)
- [CVE-2024-2496](https://cve.now/CVE-2024-2496.md): Libvirt: null pointer dereference in udevconnectlistallinterfaces() (CVSS 5.0, libvirt · Red Hat Enterprise Linux)
- [CVE-2024-2002](https://cve.now/CVE-2024-2002.md): Libdwarf: crashes randomly on fuzzed object (CVSS 7.5, libdwarf · Red Hat Enterprise Linux)
- [CVE-2023-7250](https://cve.now/CVE-2023-7250.md): Iperf3: possible denial of service (CVSS 5.3, Red Hat Enterprise Linux)
- [CVE-2024-20767](https://cve.now/CVE-2024-20767.md): ColdFusion | Improper Access Control (CWE-284) (CVSS 7.4, KEV, Adobe ColdFusion)
- [CVE-2024-1013](https://cve.now/CVE-2024-1013.md): Unixodbc: out of bounds stack write due to pointer-to-integer types conversion (CVSS 7.8, Red Hat Enterprise Linux)
- [CVE-2024-26641](https://cve.now/CVE-2024-26641.md): ip6\_tunnel: make sure to pull inner header in \_\_ip6\_tnl\_rcv() (CVSS 8.6, Linux)
- [CVE-2024-26640](https://cve.now/CVE-2024-26640.md): tcp: add sanity checks to rx zerocopy (CVSS 7.8, Linux)
- [CVE-2023-52619](https://cve.now/CVE-2023-52619.md): pstore/ram: Fix crash when setting number of cpus to an odd number (no CVSS, Linux)
- [CVE-2023-52618](https://cve.now/CVE-2023-52618.md): block/rnbd-srv: Check for unlikely string overflow (CVSS 5.3, Linux)
- [CVE-2023-52617](https://cve.now/CVE-2023-52617.md): PCI: switchtec: Fix stdev\_release() crash after surprise hot remove (CVSS 4.4, Linux)
- [CVE-2024-26638](https://cve.now/CVE-2024-26638.md): nbd: always initialize struct msghdr completely (CVSS 4.4, Linux)
- [CVE-2024-26637](https://cve.now/CVE-2024-26637.md): wifi: ath11k: rely on mac80211 debugfs handling for vif (CVSS 7.8, Linux)
- [CVE-2024-26636](https://cve.now/CVE-2024-26636.md): llc: make llc\_ui\_sendmsg() more robust against bonding changes (no CVSS, Linux)
- [CVE-2024-26635](https://cve.now/CVE-2024-26635.md): llc: Drop support for ETH\_P\_TR\_802\_2. (no CVSS, Linux)
- [CVE-2024-26634](https://cve.now/CVE-2024-26634.md): net: fix removing a namespace with conflicting altnames (no CVSS, Linux)
- [CVE-2023-52616](https://cve.now/CVE-2023-52616.md): crypto: lib/mpi - Fix unexpected pointer access in mpi\_ec\_init (CVSS 7.8, Linux)
- [CVE-2023-52615](https://cve.now/CVE-2023-52615.md): hwrng: core - Fix page fault dead lock on mmap-ed hwrng (no CVSS, Linux)
- [CVE-2023-52614](https://cve.now/CVE-2023-52614.md): PM / devfreq: Fix buffer overflow in trans\_stat\_show (CVSS 7.8, Linux)
- [CVE-2024-26633](https://cve.now/CVE-2024-26633.md): ip6\_tunnel: fix NEXTHDR\_FRAGMENT handling in ip6\_tnl\_parse\_tlv\_enc\_lim() (CVSS 5.5, Linux)
- [CVE-2024-26632](https://cve.now/CVE-2024-26632.md): block: Fix iterating over an empty bio with bio\_for\_each\_folio\_all (CVSS 7.8, Linux)
- [CVE-2024-26631](https://cve.now/CVE-2024-26631.md): ipv6: mcast: fix data-race in ipv6\_mc\_down / mld\_ifc\_work (CVSS 7.8, Linux)
- [CVE-2023-52613](https://cve.now/CVE-2023-52613.md): drivers/thermal/loongson2\_thermal: Fix incorrect PTR\_ERR() judgment (CVSS 5.5, Linux)
- [CVE-2023-52612](https://cve.now/CVE-2023-52612.md): crypto: scomp - fix req-\>dst buffer overflow (CVSS 7.8, Linux)
- [CVE-2023-52611](https://cve.now/CVE-2023-52611.md): wifi: rtw88: sdio: Honor the host max\_req\_size in the RX path (no CVSS, Linux)
- [CVE-2023-52610](https://cve.now/CVE-2023-52610.md): net/sched: act\_ct: fix skb leak and crash on ooo frags (CVSS 7.5, Linux)
- [CVE-2023-52609](https://cve.now/CVE-2023-52609.md): binder: fix race between mmput() and do\_exit() (no CVSS, Linux)
- [CVE-2024-1606](https://cve.now/CVE-2024-1606.md): HTML injection in BMC Control-M (CVSS 4.6, BMC Control-M)
- [CVE-2024-1605](https://cve.now/CVE-2024-1605.md): DLL side-loading in BMC Control-M (CVSS 6.6, BMC Control-M)
- [CVE-2024-1604](https://cve.now/CVE-2024-1604.md): Incorrect authorization in BMC Control-M (CVSS 6.4, BMC Control-M)
- [CVE-2024-28039](https://cve.now/CVE-2024-28039.md): Improper restriction of XML external entity references vulnerability exists in FitNesse all releases, which allows a remote unauthenticated (CVSS 5.8, unclebob FitNesse)
- [CVE-2024-22475](https://cve.now/CVE-2024-22475.md): Cross-site request forgery vulnerability in multiple printers and scanners which implement Web Based Management provided by BROTHER INDUSTRI (CVSS 6.1, BROTHER INDUSTRIES Multiple printers and scanners · FUJI… +2)
- [CVE-2024-21824](https://cve.now/CVE-2024-21824.md): Improper authentication vulnerability in exists in multiple printers and scanners which implement Web Based Management provided by BROTHER I (CVSS 5.3, BROTHER INDUSTRIES Multiple printers and scanners · FUJI… +2)
- [CVE-2024-27974](https://cve.now/CVE-2024-27974.md): Cross-site request forgery vulnerability in FUJIFILM printers which implement CentreWare Internet Services or Internet Services allows a rem (CVSS 6.3, FUJIFILM Business Inovation DocuPrint P450 d · FUJIFILM… +22)
- [CVE-2024-28128](https://cve.now/CVE-2024-28128.md): Cross-site scripting vulnerability exists in FitNesse releases prior to 20220319, which may allow a remote unauthenticated attacker to execu (CVSS 6.1, unclebob FitNesse · org.fitnesse:fitnesse)
- [CVE-2024-28125](https://cve.now/CVE-2024-28125.md): FitNesse all releases allows a remote authenticated attacker to execute arbitrary OS commands. (CVSS 9.8, unclebob FitNesse · org.fitnesse:fitnesse)
- [CVE-2024-23604](https://cve.now/CVE-2024-23604.md): Cross-site scripting vulnerability exists in FitNesse all releases, which may allow a remote unauthenticated attacker to execute an arbitrar (CVSS 5.4, unclebob FitNesse)
- [CVE-2024-28745](https://cve.now/CVE-2024-28745.md): Improper export of Android application components issue exists in 'ABEMA' App for Android prior to 10.65.0 allowing another app installed on (CVSS 3.3, AbemaTV 'ABEMA' App for Android)
- [CVE-2024-2581](https://cve.now/CVE-2024-2581.md): Tenda AC10 SetStaticRouteCfg fromSetRouteStatic stack-based overflow (CVSS 8.8, Tenda AC10)
- [CVE-2024-2577](https://cve.now/CVE-2024-2577.md): SourceCodester Employee Task Management System update-employee.php authorization (CVSS 7.3, SourceCodester Employee Task Management System)
- [CVE-2024-2576](https://cve.now/CVE-2024-2576.md): SourceCodester Employee Task Management System update-admin.php authorization (CVSS 7.3, SourceCodester Employee Task Management System)
- [CVE-2024-2575](https://cve.now/CVE-2024-2575.md): SourceCodester Employee Task Management System task-details.php authorization (CVSS 7.3, SourceCodester Employee Task Management System)
- [CVE-2024-2574](https://cve.now/CVE-2024-2574.md): SourceCodester Employee Task Management System edit-task.php authorization (CVSS 7.3, SourceCodester Employee Task Management System)
- [CVE-2024-2573](https://cve.now/CVE-2024-2573.md): SourceCodester Employee Task Management System task-info.php redirect (CVSS 7.3, SourceCodester Employee Task Management System)
- [CVE-2024-2572](https://cve.now/CVE-2024-2572.md): SourceCodester Employee Task Management System task-details.php redirect (CVSS 7.3, SourceCodester Employee Task Management System)
- [CVE-2023-40747](https://cve.now/CVE-2023-40747.md): Directory traversal vulnerability exists in A.K.I Software's PMailServer/PMailServer2 products' CGIs included in Internal Simple Webserver. (CVSS 7.5, A.K.I Software pmman.exe)
- [CVE-2023-40160](https://cve.now/CVE-2023-40160.md): Directory traversal vulnerability exists in Mailing List Search CGI (pmmls.exe) included in A.K.I Software's PMailServer/PMailServer2 produc (CVSS 3.7, A.K.I Software pmmls.exe)
- [CVE-2023-39933](https://cve.now/CVE-2023-39933.md): Insufficient verification vulnerability exists in Broadcast Mail CGI (pmc.exe) included in A.K.I Software's PMailServer/PMailServer2 product (CVSS 4.3, A.K.I Software pmc.exe)
- [CVE-2023-39223](https://cve.now/CVE-2023-39223.md): Stored cross-site scripting vulnerability exists in CGIs included in A.K.I Software's PMailServer/PMailServer2 products. (CVSS 5.4, A.K.I Software pmc.exe · A.K.I Software pmam.exe +1)
- [CVE-2024-2571](https://cve.now/CVE-2024-2571.md): SourceCodester Employee Task Management System manage-admin.php redirect (CVSS 7.3, SourceCodester Employee Task Management System)
- [CVE-2024-2570](https://cve.now/CVE-2024-2570.md): SourceCodester Employee Task Management System edit-task.php redirect (CVSS 7.3, SourceCodester Employee Task Management System)
- [CVE-2018-25099](https://cve.now/CVE-2018-25099.md): In the CryptX module before 0.062 for Perl, gcm\_decrypt\_verify() and chacha20poly1305\_decrypt\_verify() do not verify the tag. (CVSS 9.8)
- [CVE-2021-47154](https://cve.now/CVE-2021-47154.md): The Net::CIDR::Lite module before 0.22 for Perl does not properly consider extraneous zero characters at the beginning of an IP address stri (CVSS 6.3)
- [CVE-2021-47155](https://cve.now/CVE-2021-47155.md): The Net::IPV4Addr module 0.10 for Perl does not properly consider extraneous zero characters in an IP address string, which (in some situati (CVSS 9.1)
- [CVE-2021-47156](https://cve.now/CVE-2021-47156.md): The Net::IPAddress::Util module before 5.000 for Perl does not properly consider extraneous zero characters in an IP address string, which ( (CVSS 6.5)
- [CVE-2021-47157](https://cve.now/CVE-2021-47157.md): The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling. (CVSS 9.8)
- [CVE-2022-47036](https://cve.now/CVE-2022-47036.md): Siklu TG Terragraph devices before approximately 2.1.1 have a hardcoded root password that has been revealed via a brute force attack on an (CVSS 9.8)
- [CVE-2022-47037](https://cve.now/CVE-2022-47037.md): Siklu TG Terragraph devices before 2.1.1 allow attackers to discover valid, randomly generated credentials via GetCredentials. (CVSS 7.5)
- [CVE-2023-52159](https://cve.now/CVE-2023-52159.md): A stack-based buffer overflow vulnerability in gross 0.9.3 through 1.x before 1.0.4 allows remote attackers to trigger a denial of service ( (CVSS 7.5)
- [CVE-2024-24230](https://cve.now/CVE-2024-24230.md): Komm.One CMS 10.4.2.14 has a Server-Side Template Injection (SSTI) vulnerability via the Velocity template engine. (CVSS 7.5)
- [CVE-2024-24539](https://cve.now/CVE-2024-24539.md): FusionPBX before 5.2.0 does not validate a session. (CVSS 5.3)
- [CVE-2024-25654](https://cve.now/CVE-2024-25654.md): Insecure permissions for log files of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow members (with local access to the U (CVSS 5.5)
- [CVE-2024-25655](https://cve.now/CVE-2024-25655.md): Insecure storage of LDAP passwords in the authentication functionality of AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS allow (CVSS 6.5)
- [CVE-2024-25656](https://cve.now/CVE-2024-25656.md): Improper input validation in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS can result in unauthenticated CPE (Customer Premis (CVSS 5.9)
- [CVE-2024-25657](https://cve.now/CVE-2024-25657.md): An open redirect in the Login/Logout functionality of web management in AVSystem Unified Management Platform (UMP) 23.07.0.16567~LTS could a (CVSS 5.4)
- [CVE-2024-27757](https://cve.now/CVE-2024-27757.md): flusity CMS through 2.45 allows tools/addons\_model.php Gallery Name XSS. (CVSS 6.1)
- [CVE-2024-28054](https://cve.now/CVE-2024-28054.md): Amavis before 2.12.3 and 2.13.x before 2.13.1, in part because of its use of MIME-tools, has an Interpretation Conflict (relative to some ma (CVSS 7.4)
- [CVE-2024-28537](https://cve.now/CVE-2024-28537.md): Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the page parameter of fromNatStaticSetting function. (CVSS 9.8)
- [CVE-2024-28547](https://cve.now/CVE-2024-28547.md): Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the firewallEn parameter of formSetFirewallCfg function. (CVSS 6.5)
- [CVE-2024-28550](https://cve.now/CVE-2024-28550.md): Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the filePath parameter of formExpandDlnaFile function. (CVSS 4.3)
- [CVE-2024-29151](https://cve.now/CVE-2024-29151.md): Rocket.Chat.Audit through 5ad78e8 depends on filecachetools, which does not exist in PyPI. (CVSS 9.1)
- [CVE-2024-29154](https://cve.now/CVE-2024-29154.md): danielmiessler fabric through 1.3.0 allows installer/client/gui/static/js/index.js XSS because of innerHTML mishandling, such as in htmlToPl (CVSS 7.4)
- [CVE-2024-29156](https://cve.now/CVE-2024-29156.md): In OpenStack Murano through 16.0.0, when YAQL before 3.0.0 is used, the Murano service's MuranoPL extension to the YAQL language fails to sa (CVSS 6.5, yaql)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.