CVEs published March 19, 2024
132 CVEs were published on March 19, 2024: 10 critical, 50 high.
- Published
- 132
- Critical
- 10
- High
- 50
- Medium
- 70
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- Mozilla Firefox · Mozilla Thunderbird
- 9
- Netentsec NS-ASG Application Security Gateway
- 6
- Cegid Meta4 HR
- 5
- Pandora FMS
- 4
- Themefic Tourfic
- 4
- Devklan Alma Blog
- 3
- Fujian Kelixin Communication Command and Dispatch Platform
- 3
- Mozilla Firefox
- 3
- AAM Advanced Access Manager
- 2
- Axis Communications AB AXIS OS
- 2
Critical 10
- CVE-2024-29027Parse Server crash and RCE via invalid Cloud Function or Cloud Job nameparse-community parse-server · parse-server
- CVE-2024-29135WordPress Tourfic plugin <= 2.11.15 - Arbitrary File Upload vulnerabilityThemefic Tourfic
- CVE-2024-2636Multiple vulnerabilities on Meta4 HR from CegidCegid Meta4 HR
- CVE-2024-2615Memory safety bugs present in Firefox 123.Mozilla Firefox
- CVE-2023-40275An issue was discovered in OpenClinic GA 5.247.01.
- CVE-2023-40276An issue was discovered in OpenClinic GA 5.247.01.
- CVE-2024-28303Open Source Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the date parameter at /admin/reports/i
- CVE-2024-28389SQL injection vulnerability in KnowBand spinwheel v.3.0.3 and before allows a remote attacker to gain escalated privileges and obtain sensit
- CVE-2024-28394An issue in Advanced Plugins reportsstatistics v1.3.20 and before allows a remote attacker to execute arbitrary code via the Sales Reports,
- CVE-2024-28595SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin_id parameter in
High 50
- CVE-2024-2647Netentsec NS-ASG Application Security Gateway singlelogin.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-2642Ruijie RG-NBS2009G-P EXCU_SHELL command injectionRuijie RG-NBS2009G-P
- CVE-2024-2169Implementations of UDP application protocols are susceptible to network loops and denial of serviceMikroTik RouterOS-TFTP · Microsoft WDS +1
- CVE-2024-21677This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center.Atlassian Confluence Data Center
- CVE-2023-42920Claris International has fixed a dylib hijacking vulnerability in the FileMaker Pro.app and Claris Pro.app versions on macOS.Claris FileMaker Pro
- CVE-2024-27998WordPress Barcode Scanner and Inventory manager plugin <= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityDmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…
- CVE-2024-29091WordPress WP Armour plugin <= 2.1.13 - Reflected Cross Site Scripting (XSS) vulnerabilityDnesscarkey WP Armour – Honeypot Anti Spam
- CVE-2024-29092WordPress Permalink Manager Lite plugin <= 2.4.3 - Reflected Cross Site Scripting (XSS) vulnerabilityMaciej Bis Permalink Manager Lite
- CVE-2024-29094WordPress HT Easy GA4 plugin <= 1.1.7 - Cross Site Scripting (XSS) vulnerabilityHasThemes HT Easy GA4
- CVE-2023-44092OS Command InjectionPandora FMS
- CVE-2023-44091Unauth Time-Based SQL InjectionPandora FMS
- CVE-2024-2442Path Traversal vulnerability in Franklin Fueling System EVO 550/5000Franklin Fueling System EVO
- CVE-2024-29099WordPress Evergreen Content Poster plugin <= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerabilityEvergreen Content Poster
- CVE-2024-29102WordPress Extensions For CF7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityHasThemes Extensions For CF7
- CVE-2023-6597An issue was found in the CPython `tempfile.TemporaryDirectory` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and priPython Software Foundation CPython
- CVE-2024-29103WordPress Database for Contact Form 7 plugin <= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityNinjaTeam Database for Contact Form
- CVE-2024-29110WordPress Tablesome plugin <= 1.0.27 - Cross Site Scripting (XSS) vulnerabilityPauple Table & Contact Form 7 Database – Tablesome
- CVE-2024-29113WordPress RegistrationMagic plugin <= 5.2.5.9 - Reflected Cross Site Scripting (XSS) vulnerabilityMetagauss RegistrationMagic
- CVE-2024-29116WordPress WooThumbs for WooCommerce by Iconic plugin <= 5.5.3 - Reflected Cross Site Scripting (XSS) vulnerabilityIconicWP WooThumbs for WooCommerce by Iconic
- CVE-2024-29117WordPress Contact Forms by Cimatti plugin <= 1.7.0 - Unauthenticated Stored Cross Site Scripting (XSS) vulnerabilityCimatti Consulting Contact Forms by Cimatti
- CVE-2024-29121WordPress WooCommerce License Manager plugin <= 5.3.1 - Reflected Cross Site Scripting (XSS) vulnerabilityFirassaidi WooCommerce License Manager
- CVE-2024-29123WordPress Link Library plugin <= 7.6 - Reflected Cross Site Scripting (XSS) vulnerabilityYannick Lefebvre Link Library
- CVE-2024-29125WordPress Coupon Affiliates plugin <= 5.12.7 - Reflected Cross Site Scripting (XSS) vulnerabilityElliot Sowersby / RelyWP Coupon Affiliates
- CVE-2024-29126WordPress Specific Content For Mobile plugin <= 0.1.9.5 - Cross Site Scripting (XSS) vulnerabilityJose Mortellaro Specific Content For Mobile – Customize the…
- CVE-2024-29127WordPress Advanced Access Manager plugin <= 6.9.20 - Reflected Cross Site Scripting (XSS) vulnerabilityAAM Advanced Access Manager
- CVE-2024-29128WordPress POST SMTP Mailer plugin <= 2.8.6 - Reflected Cross Site Scripting (XSS) vulnerabilityPOST SMTP
- CVE-2024-29129WordPress OxyExtras plugin <= 1.4.3 - Cross Site Scripting (XSS) vulnerabilityWPLIT Pty OxyExtras
- CVE-2024-29130WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.0 - Reflected Cross Site Scripting (XSS) vulnerabilityScott Paterson Contact Form 7 – PayPal & Stripe Add-on
- CVE-2024-29136WordPress Tourfic plugin <= 2.11.17 - PHP Object Injection vulnerabilityThemefic Tourfic
- CVE-2024-29137WordPress Tourfic plugin <= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerabilityThemefic Tourfic
- CVE-2024-29138WordPress Restrict User Access plugin <= 2.5 - Reflected Cross Site Scripting (XSS) vulnerabilityJoachim Jensen Restrict User Access – Membership Plugin wit…
- CVE-2024-29139WordPress MyCurator Content Curation plugin <= 3.76 - Cross Site Scripting (XSS) vulnerabilityMark Tilly MyCurator Content Curation
- CVE-2024-29142WordPress Better Search plugin <= 3.3.0 - Stored Cross Site Scripting (XSS) vulnerabilityWebberZone Better Search – Relevant search results for Word…
- CVE-2024-2635Multiple vulnerabilities on Meta4 HR from CegidCegid Meta4 HR
- CVE-2024-2614Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-2613Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash.Mozilla Firefox
- CVE-2024-2612If an attacker could find a way to trigger a particular code path in `SafeRefPtr`, it could have triggered a crash or potentially be leveragMozilla Firefox · Mozilla Thunderbird
- CVE-2024-2608`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()` and `AppendEncodedCharacters()` could have experienced integer overflows,Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-2607Return registers were overwritten which could have allowed an attacker to execute arbitrary code.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-2632Information Exposure Vulnerability on Meta4 HRCegid Meta4 HR
- CVE-2024-22453Dell PowerEdge Server BIOS contains a heap-based buffer overflow vulnerability.Dell PowerEdge Platform
- CVE-2024-22017setuid() does not affect libuv's internal io_uring operations if initialized before the call to setuid().NodeJS Node
- CVE-2023-40278An issue was discovered in OpenClinic GA 5.247.01.
- CVE-2023-40279An issue was discovered in OpenClinic GA 5.247.01.
- CVE-2023-40280An issue was discovered in OpenClinic GA 5.247.01.
- CVE-2024-24042Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDirnet.devtech:arrp
- CVE-2024-24336A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Li
- CVE-2024-26369An issue in the HistoryQosPolicy component of FastDDS v2.12.x, v2.11.x, v2.10.x, and v2.6.x leads to a SIGABRT (signal abort) upon receiving
- CVE-2024-28092UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks vi
- CVE-2024-28715Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 functio
Medium, low and unrated 72
- CVE-2024-2197Chirp Systems Chirp Access Use of Hard-coded PasswordChirp Systems Chirp Access
- CVE-2024-2649Netentsec NS-ASG Application Security Gateway deleteonlineuser.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-2648Netentsec NS-ASG Application Security Gateway naccheck.php xpath injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-2646Netentsec NS-ASG Application Security Gateway sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-2645Netentsec NS-ASG Application Security Gateway resetpwd.php xpath injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-2644Netentsec NS-ASG Application Security Gateway addfirewall.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-2641Ruijie RG-NBS2009G-P Password passwdManage.htm improper authorizationRuijie RG-NBS2009G-P
- CVE-2024-27996WordPress Survey Maker plugin <= 4.0.5 - Cross Site Scripting (XSS) vulnerabilitySurvey Maker team Survey Maker
- CVE-2024-27997WordPress Visual Composer plugin <= 45.6.0 - Cross Site Scripting (XSS) vulnerabilityVisual Composer Website Builder
- CVE-2024-29089WordPress Restaurant Menu and Food Ordering plugin <= 2.4.14 - Cross Site Scripting (XSS) vulnerabilityFive Star Plugins Five Star Restaurant Menu
- CVE-2024-29093WordPress Builder for WooCommerce reviews shortcodes – ReviewShort plugin <= 1.01.3 - Cross Site Request Forgery (CSRF) vulnerabilitySaleswonder Team: Tobias Builder for WooCommerce reviews sh…
- CVE-2023-41793Path Traversal and Untrusted Upload FilePandora FMS
- CVE-2023-44090UnautH SQL InjectionPandora FMS
- CVE-2024-2307Osbuild-composer: race condition may disable gpg verification for package repositoriesosbuild-composer · Red Hat Enterprise Linux
- CVE-2024-29095WordPress Site Reviews plugin <= 6.11.6 - Cross Site Scripting (XSS) vulnerabilityGemini Labs Site Reviews
- CVE-2024-29096WordPress MJM Clinic plugin <= 1.1.22 - Cross Site Scripting (XSS) vulnerabilityMatt Manning MJM Clinic
- CVE-2024-29097WordPress User profile plugin <= 2.0.20 - Subscriber+ Stored Cross Site Scripting (XSS) vulnerabilityPickPlugins User profile
- CVE-2024-29098WordPress WP Calameo plugin <= 2.1.7 - Cross Site Scripting (XSS) vulnerabilityWP Calameo
- CVE-2023-32260A potential Misinterpretation of Input vulnerability has been identified in SMAX, AMX, and HCMX products.OpenText™ Service Management Automation X · OpenText™ As… +1
- CVE-2023-32259Potential Insufficient Access Control vulnerability has been identified in OpenText™ SMAX/AMX products.OpenText™ Service Management Automation X · OpenText™ Asset…
- CVE-2024-29101WordPress Jeg Elementor Kit plugin <= 2.6.2 - Cross Site Scripting (XSS) vulnerabilityJegtheme Jeg Elementor Kit
- CVE-2024-29104WordPress Ticket Tailor plugin <= 1.10 - Cross Site Scripting (XSS) vulnerabilityZimma Ticket Tailor
- CVE-2024-29105WordPress WP Popups – WordPress Popup builder plugin <= 2.1.5.5 - Cross Site Scripting (XSS) vulnerabilityTimersys WP Popups
- CVE-2024-29106WordPress Premium Addons for Elementor plugin <= 4.10.16 - Cross Site Scripting (XSS) vulnerabilityLeap13 Premium Addons for Elementor
- CVE-2024-29107WordPress Elementor Addon Elements plugin <= 1.12.10 - Cross Site Scripting (XSS) vulnerabilityWPVibes Elementor Addon Elements
- CVE-2024-29108WordPress Happy Addons for Elementor plugin <= 3.10.1 - Cross Site Scripting (XSS) vulnerabilityLeevio Happy Addons for Elementor
- CVE-2024-0450Quoted zip-bomb protection for zipfilePython Software Foundation CPython
- CVE-2024-29109WordPress Shariff Wrapper plugin <= 4.6.10 - Contributor+ Cross Site Scripting (XSS) vulnerabilityJan-Peter Lambeck & 3UU Shariff Wrapper
- CVE-2024-29111WordPress Sitekit plugin <= 1.6 - Cross Site Scripting (XSS) vulnerabilityWebvitaly Sitekit
- CVE-2024-29112WordPress WooCommerce Google Feed Manager plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerabilityWP Marketing Robot WooCommerce Google Feed Manager
- CVE-2024-2639Bdtask Wholesale Inventory Management System session fixiationBdtask Wholesale Inventory Management System
- CVE-2024-29114WordPress Download Manager plugin <= 3.2.84 - Cross Site Scripting (XSS) vulnerabilityW3 Eden Download Manager
- CVE-2024-29115WordPress Smart Online Order for Clover plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerabilityZaytech Smart Online Order for Clover
- CVE-2024-29118WordPress Scrollsequence plugin <= 1.5.4 - Cross Site Scripting (XSS) vulnerabilityScrollsequence
- CVE-2024-29122WordPress FV Player plugin <= 7.5.41.7212 - Cross Site Scripting (XSS) vulnerabilityFoliovision: Making the web work for you FV Flowplayer Vide…
- CVE-2024-1401Profile Box Shortcode And Widget < 1.2.1 Admin+ Stored XSSProfile Box Shortcode And Widget
- CVE-2024-29124WordPress Advanced Access Manager plugin <= 6.9.20 - Cross Site Scripting (XSS) vulnerabilityAAM Advanced Access Manager
- CVE-2024-29134WordPress Tourfic plugin <= 2.11.8 - Cross Site Scripting (XSS) vulnerabilityThemefic Tourfic
- CVE-2024-29140WordPress MJM Clinic plugin <= 1.1.22 - Cross Site Scripting (XSS) vulnerabilityMatt Manning MJM Clinic
- CVE-2024-29141WordPress PDF Embedder plugin <= 4.6.4 - Cross Site Scripting (XSS) vulnerabilityPDF Embedder
- CVE-2024-29143WordPress Passwordless Login plugin <= 1.1.2 - Cross Site Scripting (XSS) vulnerabilityCozmoslabs, sareiodata Passwordless Login
- CVE-2024-2634Multiple vulnerabilities on Meta4 HR from CegidCegid Meta4 HR
- CVE-2024-2633Multiple vulnerabilities on Meta4 HR from CegidCegid Meta4 HR
- CVE-2024-2616To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue.Mozilla Firefox ESR · Mozilla Thunderbird
- CVE-2024-2611A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-2610Using a markup injection an attacker could have stolen nonce values.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-2609The permission prompt input delay could expire while the window is not in focus.Mozilla Firefox · Mozilla Thunderbird
- CVE-2023-5388NSS was susceptible to a timing side-channel attack when performing RSA decryption.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-2606Passing invalid data could have led to invalid wasm values being created, such as arbitrary integers turning into pointer values.Mozilla Firefox
- CVE-2024-2605An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox.Mozilla Firefox · Mozilla Thunderbird
- CVE-2024-1146Cross-site Scripting at Alma Devklan BlogDevklan Alma Blog
- CVE-2024-1145Observable Response Discrepancy at Alma Devklan BlogDevklan Alma Blog
- CVE-2024-1144Improper Access Control at Alma Devklan BlogDevklan Alma Blog
- CVE-2024-27439Apache Wicket: Possible bypass of CSRF protectionApache Software Foundation Apache Wicket · org.apache.wicke…
- CVE-2024-24683Apache Hop Engine: ID isn't escaped when generating HTMLApache Software Foundation Apache Hop Engine · org.apache.h…
- CVE-2024-25942Dell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2024-0055Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for fileAxis Communications AB AXIS OS
- CVE-2024-0054Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs local_list.cgi, create_overlay.cgi and irissetup.cgi wAxis Communications AB AXIS OS
- CVE-2024-21503Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines_with_leading_tabs_eblack
- CVE-2024-21504Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses [Url] folivewire/livewire
- CVE-2024-22025A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fetNodeJS Node
- CVE-2024-2622Fujian Kelixin Communication Command and Dispatch Platform editemedia.php sql injectionFujian Kelixin Communication Command and Dispatch Platform
- CVE-2024-2621Fujian Kelixin Communication Command and Dispatch Platform pwd_update.php sql injectionFujian Kelixin Communication Command and Dispatch Platform
- CVE-2024-2620Fujian Kelixin Communication Command and Dispatch Platform down_file.php sql injectionFujian Kelixin Communication Command and Dispatch Platform
- CVE-2023-40277An issue was discovered in OpenClinic GA 5.247.01.
- CVE-2023-50811An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a
- CVE-2023-50966erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c (
- CVE-2024-24043Directory Traversal vulnerability in Speedy11CZ MCRPX v.1.4.0 and before allows a local attacker to execute arbitrary code via a crafted fil
- CVE-2024-28283There is stack-based buffer overflow vulnerability in pc_change_act function in Linksys E1000 router firmware version v.2.1.03 and before, l
- CVE-2024-28446Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 v1.2.9 was discovered to contain a buffer overflow via lan_netmask parameter at /apply.c
- CVE-2024-28447Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 v1.2.9 was discovered to contain a buffer overflow via lan_ipaddr parameters at /apply.c
- CVE-2024-28734Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted