# CVEs published 2024-03-19

132 CVEs were published on March 19, 2024: 10 critical, 50 high. Days are UTC.

- [CVE-2024-2197](https://cve.now/CVE-2024-2197.md): Chirp Systems Chirp Access Use of Hard-coded Password (CVSS 4.3, Chirp Systems Chirp Access)
- [CVE-2024-2649](https://cve.now/CVE-2024-2649.md): Netentsec NS-ASG Application Security Gateway deleteonlineuser.php sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-2648](https://cve.now/CVE-2024-2648.md): Netentsec NS-ASG Application Security Gateway naccheck.php xpath injection (CVSS 4.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-2647](https://cve.now/CVE-2024-2647.md): Netentsec NS-ASG Application Security Gateway singlelogin.php sql injection (CVSS 7.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-2646](https://cve.now/CVE-2024-2646.md): Netentsec NS-ASG Application Security Gateway sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-2645](https://cve.now/CVE-2024-2645.md): Netentsec NS-ASG Application Security Gateway resetpwd.php xpath injection (CVSS 4.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-2644](https://cve.now/CVE-2024-2644.md): Netentsec NS-ASG Application Security Gateway addfirewall.php sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-2642](https://cve.now/CVE-2024-2642.md): Ruijie RG-NBS2009G-P EXCU\_SHELL command injection (CVSS 7.3, Ruijie RG-NBS2009G-P)
- [CVE-2024-2641](https://cve.now/CVE-2024-2641.md): Ruijie RG-NBS2009G-P Password passwdManage.htm improper authorization (CVSS 5.3, Ruijie RG-NBS2009G-P)
- [CVE-2024-2169](https://cve.now/CVE-2024-2169.md): Implementations of UDP application protocols are susceptible to network loops and denial of service (CVSS 7.5, MikroTik RouterOS-TFTP · Microsoft WDS +1)
- [CVE-2024-29027](https://cve.now/CVE-2024-29027.md): Parse Server crash and RCE via invalid Cloud Function or Cloud Job name (CVSS 9.1, parse-community parse-server · parse-server)
- [CVE-2024-21677](https://cve.now/CVE-2024-21677.md): This High severity Path Traversal vulnerability was introduced in version 6.13.0 of Confluence Data Center. (CVSS 8.3, Atlassian Confluence Data Center)
- [CVE-2024-27996](https://cve.now/CVE-2024-27996.md): WordPress Survey Maker plugin \<= 4.0.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Survey Maker team Survey Maker)
- [CVE-2024-27997](https://cve.now/CVE-2024-27997.md): WordPress Visual Composer plugin \<= 45.6.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Visual Composer Website Builder)
- [CVE-2023-42920](https://cve.now/CVE-2023-42920.md): Claris International has fixed a dylib hijacking vulnerability in the FileMaker Pro.app and Claris Pro.app versions on macOS. (CVSS 7.8, Claris FileMaker Pro)
- [CVE-2024-27998](https://cve.now/CVE-2024-27998.md): WordPress Barcode Scanner and Inventory manager plugin \<= 1.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inve…)
- [CVE-2024-29089](https://cve.now/CVE-2024-29089.md): WordPress Restaurant Menu and Food Ordering plugin \<= 2.4.14 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Five Star Plugins Five Star Restaurant Menu)
- [CVE-2024-29091](https://cve.now/CVE-2024-29091.md): WordPress WP Armour plugin \<= 2.1.13 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Dnesscarkey WP Armour – Honeypot Anti Spam)
- [CVE-2024-29092](https://cve.now/CVE-2024-29092.md): WordPress Permalink Manager Lite plugin \<= 2.4.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Maciej Bis Permalink Manager Lite)
- [CVE-2024-29093](https://cve.now/CVE-2024-29093.md): WordPress Builder for WooCommerce reviews shortcodes – ReviewShort plugin \<= 1.01.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Saleswonder Team: Tobias Builder for WooCommerce reviews sh…)
- [CVE-2024-29094](https://cve.now/CVE-2024-29094.md): WordPress HT Easy GA4 plugin \<= 1.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, HasThemes HT Easy GA4)
- [CVE-2023-41793](https://cve.now/CVE-2023-41793.md): Path Traversal and Untrusted Upload File (CVSS 6.7, Pandora FMS)
- [CVE-2023-44092](https://cve.now/CVE-2023-44092.md): OS Command Injection (CVSS 7.6, Pandora FMS)
- [CVE-2023-44091](https://cve.now/CVE-2023-44091.md): Unauth Time-Based SQL Injection (CVSS 7.5, Pandora FMS)
- [CVE-2024-2442](https://cve.now/CVE-2024-2442.md): Path Traversal vulnerability in Franklin Fueling System EVO 550/5000 (CVSS 7.5, Franklin Fueling System EVO)
- [CVE-2023-44090](https://cve.now/CVE-2023-44090.md): UnautH SQL Injection (CVSS 6.8, Pandora FMS)
- [CVE-2024-2307](https://cve.now/CVE-2024-2307.md): Osbuild-composer: race condition may disable gpg verification for package repositories (CVSS 6.1, osbuild-composer · Red Hat Enterprise Linux)
- [CVE-2024-29095](https://cve.now/CVE-2024-29095.md): WordPress Site Reviews plugin \<= 6.11.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Gemini Labs Site Reviews)
- [CVE-2024-29096](https://cve.now/CVE-2024-29096.md): WordPress MJM Clinic plugin \<= 1.1.22 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Matt Manning MJM Clinic)
- [CVE-2024-29097](https://cve.now/CVE-2024-29097.md): WordPress User profile plugin \<= 2.0.20 - Subscriber+ Stored Cross Site Scripting (XSS) vulnerability (CVSS 6.3, PickPlugins User profile)
- [CVE-2024-29098](https://cve.now/CVE-2024-29098.md): WordPress WP Calameo plugin \<= 2.1.7 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Calameo)
- [CVE-2024-29099](https://cve.now/CVE-2024-29099.md): WordPress Evergreen Content Poster plugin \<= 1.4.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Evergreen Content Poster)
- [CVE-2023-32260](https://cve.now/CVE-2023-32260.md): A potential Misinterpretation of Input vulnerability has been identified in SMAX, AMX, and HCMX products. (CVSS 6.5, OpenText™ Service Management Automation X · OpenText™ As… +1)
- [CVE-2023-32259](https://cve.now/CVE-2023-32259.md): Potential Insufficient Access Control vulnerability has been identified in OpenText™ SMAX/AMX products. (CVSS 6.5, OpenText™ Service Management Automation X · OpenText™ Asset…)
- [CVE-2024-29101](https://cve.now/CVE-2024-29101.md): WordPress Jeg Elementor Kit plugin \<= 2.6.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jegtheme Jeg Elementor Kit)
- [CVE-2024-29102](https://cve.now/CVE-2024-29102.md): WordPress Extensions For CF7 plugin \<= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability (CVSS 7.1, HasThemes Extensions For CF7)
- [CVE-2023-6597](https://cve.now/CVE-2023-6597.md): An issue was found in the CPython \`tempfile.TemporaryDirectory\` class affecting versions 3.12.1, 3.11.7, 3.10.13, 3.9.18, and 3.8.18 and pri (CVSS 7.8, Python Software Foundation CPython)
- [CVE-2024-29103](https://cve.now/CVE-2024-29103.md): WordPress Database for Contact Form 7 plugin \<= 3.0.6 - Unauthenticated Cross Site Scripting (XSS) vulnerability (CVSS 7.1, NinjaTeam Database for Contact Form)
- [CVE-2024-29104](https://cve.now/CVE-2024-29104.md): WordPress Ticket Tailor plugin \<= 1.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Zimma Ticket Tailor)
- [CVE-2024-29105](https://cve.now/CVE-2024-29105.md): WordPress WP Popups – WordPress Popup builder plugin \<= 2.1.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Timersys WP Popups)
- [CVE-2024-29106](https://cve.now/CVE-2024-29106.md): WordPress Premium Addons for Elementor plugin \<= 4.10.16 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Leap13 Premium Addons for Elementor)
- [CVE-2024-29107](https://cve.now/CVE-2024-29107.md): WordPress Elementor Addon Elements plugin \<= 1.12.10 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPVibes Elementor Addon Elements)
- [CVE-2024-29108](https://cve.now/CVE-2024-29108.md): WordPress Happy Addons for Elementor plugin \<= 3.10.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Leevio Happy Addons for Elementor)
- [CVE-2024-0450](https://cve.now/CVE-2024-0450.md): Quoted zip-bomb protection for zipfile (CVSS 6.2, Python Software Foundation CPython)
- [CVE-2024-29109](https://cve.now/CVE-2024-29109.md): WordPress Shariff Wrapper plugin \<= 4.6.10 - Contributor+ Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jan-Peter Lambeck & 3UU Shariff Wrapper)
- [CVE-2024-29110](https://cve.now/CVE-2024-29110.md): WordPress Tablesome plugin \<= 1.0.27 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Pauple Table & Contact Form 7 Database – Tablesome)
- [CVE-2024-29111](https://cve.now/CVE-2024-29111.md): WordPress Sitekit plugin \<= 1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Webvitaly Sitekit)
- [CVE-2024-29112](https://cve.now/CVE-2024-29112.md): WordPress WooCommerce Google Feed Manager plugin \<= 2.2.0 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP Marketing Robot WooCommerce Google Feed Manager)
- [CVE-2024-29113](https://cve.now/CVE-2024-29113.md): WordPress RegistrationMagic plugin \<= 5.2.5.9 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Metagauss RegistrationMagic)
- [CVE-2024-2639](https://cve.now/CVE-2024-2639.md): Bdtask Wholesale Inventory Management System session fixiation (CVSS 4.3, Bdtask Wholesale Inventory Management System)
- [CVE-2024-29114](https://cve.now/CVE-2024-29114.md): WordPress Download Manager plugin \<= 3.2.84 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, W3 Eden Download Manager)
- [CVE-2024-29115](https://cve.now/CVE-2024-29115.md): WordPress Smart Online Order for Clover plugin \<= 1.5.5 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Zaytech Smart Online Order for Clover)
- [CVE-2024-29116](https://cve.now/CVE-2024-29116.md): WordPress WooThumbs for WooCommerce by Iconic plugin \<= 5.5.3 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, IconicWP WooThumbs for WooCommerce by Iconic)
- [CVE-2024-29117](https://cve.now/CVE-2024-29117.md): WordPress Contact Forms by Cimatti plugin \<= 1.7.0 - Unauthenticated Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Cimatti Consulting Contact Forms by Cimatti)
- [CVE-2024-29118](https://cve.now/CVE-2024-29118.md): WordPress Scrollsequence plugin \<= 1.5.4 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Scrollsequence)
- [CVE-2024-29121](https://cve.now/CVE-2024-29121.md): WordPress WooCommerce License Manager plugin \<= 5.3.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Firassaidi WooCommerce License Manager)
- [CVE-2024-29122](https://cve.now/CVE-2024-29122.md): WordPress FV Player plugin \<= 7.5.41.7212 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Foliovision: Making the web work for you FV Flowplayer Vide…)
- [CVE-2024-29123](https://cve.now/CVE-2024-29123.md): WordPress Link Library plugin \<= 7.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Yannick Lefebvre Link Library)
- [CVE-2024-1401](https://cve.now/CVE-2024-1401.md): Profile Box Shortcode And Widget \< 1.2.1 Admin+ Stored XSS (CVSS 4.8, Profile Box Shortcode And Widget)
- [CVE-2024-29124](https://cve.now/CVE-2024-29124.md): WordPress Advanced Access Manager plugin \<= 6.9.20 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, AAM Advanced Access Manager)
- [CVE-2024-29125](https://cve.now/CVE-2024-29125.md): WordPress Coupon Affiliates plugin \<= 5.12.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Elliot Sowersby / RelyWP Coupon Affiliates)
- [CVE-2024-29126](https://cve.now/CVE-2024-29126.md): WordPress Specific Content For Mobile plugin \<= 0.1.9.5 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Jose Mortellaro Specific Content For Mobile – Customize the…)
- [CVE-2024-29127](https://cve.now/CVE-2024-29127.md): WordPress Advanced Access Manager plugin \<= 6.9.20 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, AAM Advanced Access Manager)
- [CVE-2024-29128](https://cve.now/CVE-2024-29128.md): WordPress POST SMTP Mailer plugin \<= 2.8.6 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, POST SMTP)
- [CVE-2024-29129](https://cve.now/CVE-2024-29129.md): WordPress OxyExtras plugin \<= 1.4.3 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WPLIT Pty OxyExtras)
- [CVE-2024-29130](https://cve.now/CVE-2024-29130.md): WordPress Contact Form 7 – PayPal & Stripe Add-on plugin \<= 2.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Scott Paterson Contact Form 7 – PayPal & Stripe Add-on)
- [CVE-2024-29134](https://cve.now/CVE-2024-29134.md): WordPress Tourfic plugin \<= 2.11.8 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Themefic Tourfic)
- [CVE-2024-29135](https://cve.now/CVE-2024-29135.md): WordPress Tourfic plugin \<= 2.11.15 - Arbitrary File Upload vulnerability (CVSS 9.9, Themefic Tourfic)
- [CVE-2024-29136](https://cve.now/CVE-2024-29136.md): WordPress Tourfic plugin \<= 2.11.17 - PHP Object Injection vulnerability (CVSS 8.5, Themefic Tourfic)
- [CVE-2024-29137](https://cve.now/CVE-2024-29137.md): WordPress Tourfic plugin \<= 2.11.7 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Themefic Tourfic)
- [CVE-2024-29138](https://cve.now/CVE-2024-29138.md): WordPress Restrict User Access plugin \<= 2.5 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Joachim Jensen Restrict User Access – Membership Plugin wit…)
- [CVE-2024-29139](https://cve.now/CVE-2024-29139.md): WordPress MyCurator Content Curation plugin \<= 3.76 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Mark Tilly MyCurator Content Curation)
- [CVE-2024-29140](https://cve.now/CVE-2024-29140.md): WordPress MJM Clinic plugin \<= 1.1.22 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Matt Manning MJM Clinic)
- [CVE-2024-29141](https://cve.now/CVE-2024-29141.md): WordPress PDF Embedder plugin \<= 4.6.4 - Cross Site Scripting (XSS) vulnerability (CVSS 5.5, PDF Embedder)
- [CVE-2024-29142](https://cve.now/CVE-2024-29142.md): WordPress Better Search plugin \<= 3.3.0 - Stored Cross Site Scripting (XSS) vulnerability (CVSS 7.1, WebberZone Better Search – Relevant search results for Word…)
- [CVE-2024-29143](https://cve.now/CVE-2024-29143.md): WordPress Passwordless Login plugin \<= 1.1.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Cozmoslabs, sareiodata Passwordless Login)
- [CVE-2024-2636](https://cve.now/CVE-2024-2636.md): Multiple vulnerabilities on Meta4 HR from Cegid (CVSS 9.0, Cegid Meta4 HR)
- [CVE-2024-2635](https://cve.now/CVE-2024-2635.md): Multiple vulnerabilities on Meta4 HR from Cegid (CVSS 7.3, Cegid Meta4 HR)
- [CVE-2024-2634](https://cve.now/CVE-2024-2634.md): Multiple vulnerabilities on Meta4 HR from Cegid (CVSS 6.1, Cegid Meta4 HR)
- [CVE-2024-2633](https://cve.now/CVE-2024-2633.md): Multiple vulnerabilities on Meta4 HR from Cegid (CVSS 6.1, Cegid Meta4 HR)
- [CVE-2024-2616](https://cve.now/CVE-2024-2616.md): To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. (CVSS 2.7, Mozilla Firefox ESR · Mozilla Thunderbird)
- [CVE-2024-2615](https://cve.now/CVE-2024-2615.md): Memory safety bugs present in Firefox 123. (CVSS 9.8, Mozilla Firefox)
- [CVE-2024-2614](https://cve.now/CVE-2024-2614.md): Memory safety bugs present in Firefox 123, Firefox ESR 115.8, and Thunderbird 115.8. (CVSS 8.8, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-2613](https://cve.now/CVE-2024-2613.md): Data was not properly sanitized when decoding a QUIC ACK frame; this could have led to unrestricted memory consumption and a crash. (CVSS 7.5, Mozilla Firefox)
- [CVE-2024-2612](https://cve.now/CVE-2024-2612.md): If an attacker could find a way to trigger a particular code path in \`SafeRefPtr\`, it could have triggered a crash or potentially be leverag (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-2611](https://cve.now/CVE-2024-2611.md): A missing delay on when pointer lock was used could have allowed a malicious page to trick a user into granting permissions. (CVSS 5.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-2610](https://cve.now/CVE-2024-2610.md): Using a markup injection an attacker could have stolen nonce values. (CVSS 6.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-2609](https://cve.now/CVE-2024-2609.md): The permission prompt input delay could expire while the window is not in focus. (CVSS 6.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2023-5388](https://cve.now/CVE-2023-5388.md): NSS was susceptible to a timing side-channel attack when performing RSA decryption. (CVSS 6.5, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-2608](https://cve.now/CVE-2024-2608.md): \`AppendEncodedAttributeValue(), ExtraSpaceNeededForAttrEncoding()\` and \`AppendEncodedCharacters()\` could have experienced integer overflows, (CVSS 8.4, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-2607](https://cve.now/CVE-2024-2607.md): Return registers were overwritten which could have allowed an attacker to execute arbitrary code. (CVSS 8.1, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-2606](https://cve.now/CVE-2024-2606.md): Passing invalid data could have led to invalid wasm values being created, such as arbitrary integers turning into pointer values. (CVSS 3.7, Mozilla Firefox)
- [CVE-2024-2605](https://cve.now/CVE-2024-2605.md): An attacker could have leveraged the Windows Error Reporter to run arbitrary code on the system escaping the sandbox. (CVSS 5.9, Mozilla Firefox · Mozilla Thunderbird)
- [CVE-2024-2632](https://cve.now/CVE-2024-2632.md): Information Exposure Vulnerability on Meta4 HR (CVSS 7.5, Cegid Meta4 HR)
- [CVE-2024-1146](https://cve.now/CVE-2024-1146.md): Cross-site Scripting at Alma Devklan Blog (CVSS 5.8, Devklan Alma Blog)
- [CVE-2024-1145](https://cve.now/CVE-2024-1145.md): Observable Response Discrepancy at Alma Devklan Blog (CVSS 5.3, Devklan Alma Blog)
- [CVE-2024-1144](https://cve.now/CVE-2024-1144.md): Improper Access Control at Alma Devklan Blog (CVSS 6.5, Devklan Alma Blog)
- [CVE-2024-27439](https://cve.now/CVE-2024-27439.md): Apache Wicket: Possible bypass of CSRF protection (CVSS 6.5, Apache Software Foundation Apache Wicket · org.apache.wicke…)
- [CVE-2024-24683](https://cve.now/CVE-2024-24683.md): Apache Hop Engine: ID isn't escaped when generating HTML (CVSS 6.5, Apache Software Foundation Apache Hop Engine · org.apache.h…)
- [CVE-2024-25942](https://cve.now/CVE-2024-25942.md): Dell PowerEdge Server BIOS contains an Improper SMM communication buffer verification vulnerability. (CVSS 4.4, Dell PowerEdge Platform)
- [CVE-2024-22453](https://cve.now/CVE-2024-22453.md): Dell PowerEdge Server BIOS contains a heap-based buffer overflow vulnerability. (CVSS 7.2, Dell PowerEdge Platform)
- [CVE-2024-0055](https://cve.now/CVE-2024-0055.md): Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs mediaclip.cgi and playclip.cgi was vulnerable for file (CVSS 6.5, Axis Communications AB AXIS OS)
- [CVE-2024-0054](https://cve.now/CVE-2024-0054.md): Sandro Poppi, member of the AXIS OS Bug Bounty Program, has found that the VAPIX APIs local\_list.cgi, create\_overlay.cgi and irissetup.cgi w (CVSS 6.5, Axis Communications AB AXIS OS)
- [CVE-2024-21503](https://cve.now/CVE-2024-21503.md): Versions of the package black before 24.3.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the lines\_with\_leading\_tabs\_e (CVSS 5.3, black)
- [CVE-2024-21504](https://cve.now/CVE-2024-21504.md): Versions of the package livewire/livewire from 3.3.5 and before 3.4.9 are vulnerable to Cross-site Scripting (XSS) when a page uses \[Url\] fo (CVSS 6.1, livewire/livewire)
- [CVE-2024-22025](https://cve.now/CVE-2024-22025.md): A vulnerability in Node.js has been identified, allowing for a Denial of Service (DoS) attack through resource exhaustion when using the fet (CVSS 6.5, NodeJS Node)
- [CVE-2024-22017](https://cve.now/CVE-2024-22017.md): setuid() does not affect libuv's internal io\_uring operations if initialized before the call to setuid(). (CVSS 7.3, NodeJS Node)
- [CVE-2024-2622](https://cve.now/CVE-2024-2622.md): Fujian Kelixin Communication Command and Dispatch Platform editemedia.php sql injection (CVSS 6.3, Fujian Kelixin Communication Command and Dispatch Platform)
- [CVE-2024-2621](https://cve.now/CVE-2024-2621.md): Fujian Kelixin Communication Command and Dispatch Platform pwd\_update.php sql injection (CVSS 6.3, Fujian Kelixin Communication Command and Dispatch Platform)
- [CVE-2024-2620](https://cve.now/CVE-2024-2620.md): Fujian Kelixin Communication Command and Dispatch Platform down\_file.php sql injection (CVSS 6.3, Fujian Kelixin Communication Command and Dispatch Platform)
- [CVE-2023-40275](https://cve.now/CVE-2023-40275.md): An issue was discovered in OpenClinic GA 5.247.01. (CVSS 9.1)
- [CVE-2023-40276](https://cve.now/CVE-2023-40276.md): An issue was discovered in OpenClinic GA 5.247.01. (CVSS 9.1)
- [CVE-2023-40277](https://cve.now/CVE-2023-40277.md): An issue was discovered in OpenClinic GA 5.247.01. (CVSS 6.1)
- [CVE-2023-40278](https://cve.now/CVE-2023-40278.md): An issue was discovered in OpenClinic GA 5.247.01. (CVSS 7.5)
- [CVE-2023-40279](https://cve.now/CVE-2023-40279.md): An issue was discovered in OpenClinic GA 5.247.01. (CVSS 7.5)
- [CVE-2023-40280](https://cve.now/CVE-2023-40280.md): An issue was discovered in OpenClinic GA 5.247.01. (CVSS 7.5)
- [CVE-2023-50811](https://cve.now/CVE-2023-50811.md): An issue discovered in SELESTA Visual Access Manager 4.38.6 allows attackers to modify the “computer” POST parameter related to the ID of a (CVSS 6.5)
- [CVE-2023-50966](https://cve.now/CVE-2023-50966.md): erlang-jose (aka JOSE for Erlang and Elixir) through 1.11.6 allow attackers to cause a denial of service (CPU consumption) via a large p2c ( (CVSS 5.3)
- [CVE-2024-24042](https://cve.now/CVE-2024-24042.md): Directory Traversal vulnerability in Devan-Kerman ARRP v.0.8.1 and before allows a remote attacker to execute arbitrary code via the dumpDir (CVSS 8.8, net.devtech:arrp)
- [CVE-2024-24043](https://cve.now/CVE-2024-24043.md): Directory Traversal vulnerability in Speedy11CZ MCRPX v.1.4.0 and before allows a local attacker to execute arbitrary code via a crafted fil (CVSS 5.5)
- [CVE-2024-24336](https://cve.now/CVE-2024-24336.md): A multiple Cross-site scripting (XSS) vulnerability in the '/members/moremember.pl', and ‘/members/members-home.pl’ endpoints within Koha Li (CVSS 8.1)
- [CVE-2024-26369](https://cve.now/CVE-2024-26369.md): An issue in the HistoryQosPolicy component of FastDDS v2.12.x, v2.11.x, v2.10.x, and v2.6.x leads to a SIGABRT (signal abort) upon receiving (CVSS 7.5)
- [CVE-2024-28092](https://cve.now/CVE-2024-28092.md): UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks vi (CVSS 7.2)
- [CVE-2024-28283](https://cve.now/CVE-2024-28283.md): There is stack-based buffer overflow vulnerability in pc\_change\_act function in Linksys E1000 router firmware version v.2.1.03 and before, l (CVSS 6.7)
- [CVE-2024-28303](https://cve.now/CVE-2024-28303.md): Open Source Medicine Ordering System v1.0 was discovered to contain a SQL injection vulnerability via the date parameter at /admin/reports/i (CVSS 9.8)
- [CVE-2024-28389](https://cve.now/CVE-2024-28389.md): SQL injection vulnerability in KnowBand spinwheel v.3.0.3 and before allows a remote attacker to gain escalated privileges and obtain sensit (CVSS 9.8)
- [CVE-2024-28394](https://cve.now/CVE-2024-28394.md): An issue in Advanced Plugins reportsstatistics v1.3.20 and before allows a remote attacker to execute arbitrary code via the Sales Reports, (CVSS 9.8)
- [CVE-2024-28446](https://cve.now/CVE-2024-28446.md): Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 v1.2.9 was discovered to contain a buffer overflow via lan\_netmask parameter at /apply.c (CVSS 5.7)
- [CVE-2024-28447](https://cve.now/CVE-2024-28447.md): Shenzhen Libituo Technology Co., Ltd LBT-T300-mini1 v1.2.9 was discovered to contain a buffer overflow via lan\_ipaddr parameters at /apply.c (CVSS 6.5)
- [CVE-2024-28595](https://cve.now/CVE-2024-28595.md): SQL Injection vulnerability in Employee Management System v1.0 allows attackers to run arbitrary SQL commands via the admin\_id parameter in (CVSS 9.8)
- [CVE-2024-28715](https://cve.now/CVE-2024-28715.md): Cross Site Scripting vulnerability in DOraCMS v.2.18 and before allows a remote attacker to execute arbitrary code via the markdown0 functio (CVSS 8.8)
- [CVE-2024-28734](https://cve.now/CVE-2024-28734.md): Cross Site Scripting vulnerability in Unit4 Financials by Coda prior to 2023Q4 allows a remote attacker to run arbitrary code via a crafted (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.