CVEs published March 20, 2024
163 CVEs were published on March 20, 2024: 12 critical, 46 high.
- Published
- 163
- Critical
- 12
- High
- 46
- Medium
- 89
- Low
- 16
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 40
Most affected products
- Campcodes Online Job Finder System
- 20
- Campcodes Complete Online DJ Booking System
- 9
- Tenda AC10U
- 9
- Google Chrome
- 7
- GitHub Enterprise Server
- 3
- Xen
- 3
- frappe
- 2
- geoserver · org.geoserver:gs-restconfig
- 2
- geoserver · org.geoserver:gs-wms
- 2
- Progress Software Telerik Reporting
- 2
Critical 12
- CVE-2024-2443Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management ConsoleGitHub Enterprise Server
- CVE-2024-29037Default secret use for initial deploymentacryldata datahub-helm
- CVE-2024-28231Manipulated DATA Submessage causes a heap-buffer-overflow erroreProsima Fast-DDS
- CVE-2024-28179Jupyter Server Proxy's Websocket Proxying does not require authenticationjupyterhub jupyter-server-proxy · jupyter-server-proxy
- CVE-2024-1800Progress Telerik Report Server DeserializationProgress Software Telerik Report Server
- CVE-2024-1811OpenText ArcSight Platform Remote VulnerabilityOpenText ArcSight Platform
- CVE-2024-1711Create by Mediavine <= 1.9.4 - Unauthenticated SQL Injection via 'id'mischiefmarmot Create
- CVE-2024-22080An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.
- CVE-2024-22081An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.
- CVE-2024-25294An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.ja
- CVE-2024-28392SQL injection vulnerability in pscartabandonmentpro v.2.0.11 and before allows a remote attacker to escalate privileges via the pscartabando
- CVE-2024-28395SQL injection vulnerability in Best-Kit bestkit_popup v.1.7.2 and before allows a remote attacker to escalate privileges via the bestkit_pop
High 46
- CVE-2024-28916Xbox Gaming Services Elevation of Privilege VulnerabilityMicrosoft Xbox Gaming Services
- CVE-2024-2469Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the applianceGitHub Enterprise Server
- CVE-2024-29026Owncast cross origin requestowncast · github.com/owncast/owncast
- CVE-2024-29033GoogleOAuthenticator.hosted_domain incorrectly verifies membership of an Google organization/workspacejupyterhub oauthenticator · oauthenticator
- CVE-2024-27105Frappe File Permissions can by bypassed using certain endpointsfrappe
- CVE-2024-24813Frappe SQL Injection from reporting logicfrappe
- CVE-2024-2711Tenda AC10U addWifiMacFilter stack-based overflowTenda AC10U
- CVE-2024-2710Tenda AC10U openSchedWifi setSchedWifi stack-based overflowTenda AC10U
- CVE-2024-2709Tenda AC10U SetStaticRouteCfg fromSetRouteStatic stack-based overflowTenda AC10U
- CVE-2024-2708Tenda AC10U execCommand formexeCommand stack-based overflowTenda AC10U
- CVE-2024-2627Use after free in Canvas in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2024-2625Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via Google Chrome
- CVE-2024-2706Tenda AC10U WifiWpsStart formWifiWpsStart stack-based overflowTenda AC10U
- CVE-2024-2705Tenda AC10U SetNetControlList formSetQosBand stack-based overflowTenda AC10U
- CVE-2024-2704Tenda AC10U SetFirewallCfg formSetFirewallCfg stack-based overflowTenda AC10U
- CVE-2024-2703Tenda AC10U SetOnlineDevName formSetDeviceName stack-based overflowTenda AC10U
- CVE-2023-51444GeoServer arbitrary file upload vulnerability in REST Coverage Store APIgeoserver · org.geoserver:gs-platform +1
- CVE-2023-41877GeoServer log file path traversal vulnerabilitygeoserver · org.geoserver:gs-main
- CVE-2023-41038Server crash when using specific form of SET BIND statementFirebirdSQL firebird
- CVE-2024-1856Progress Telerik Reporting Remote Deserialization VulnerabilityProgress Software Telerik Reporting
- CVE-2024-1801Progress Telerik Reporting Local Deserialization VulnerabilityProgress Software Telerik Reporting
- CVE-2024-2721WordPress Social Media Share Buttons plugin <= 2.1.0 - PHP Object Injection vulnerabilitySocial Media Share Buttons By Sygnoos Social Media Share Bu…
- CVE-2024-2702WordPress Olive One Click Demo Import plugin <= 1.1.1 - Broken Access Control vulnerabilityOlive Themes Olive One Click Demo Import
- CVE-2024-1205Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Uploadisraelb1 Management App for WooCommerce – Order notificatio…
- CVE-2024-2459UX Flat <= 4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcodewpvncom UX Flat
- CVE-2024-1983Simple Ajax Chat < 20240223 - Unauthenticated Stored XSSSimple Ajax Chat
- CVE-2024-0856Booking Calendar < 1.3.83 - CSRF appointment schedulingAppointment Booking Calendar
- CVE-2024-1799GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress <= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcoderubengc GamiPress – Gamification plugin to reward points, a…
- CVE-2023-50967latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value.
- CVE-2024-22078An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.
- CVE-2024-22079An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.
- CVE-2024-22082An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.
- CVE-2024-22084An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.
- CVE-2024-23721A Directory Traversal issue was discovered in process_post on Draytek Vigor3910 4.3.2.5 devices.
- CVE-2024-28286In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer_handleFileCloseRequest.c function of src/mms/i
- CVE-2024-28396An issue in MyPrestaModules ordersexport v.6.0.2 and before allows a remote attacker to execute arbitrary code via the download.php componen
- CVE-2024-28566Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the AssignPixe
- CVE-2024-28568Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the r
- CVE-2024-28569Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Imf_2_2::X
- CVE-2024-28575Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the o
- CVE-2024-28578Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Load() fun
- CVE-2024-28580Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the ReadData()
- CVE-2024-28581Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the _assignPix
- CVE-2024-28582Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the rgbe_RGBET
- CVE-2024-28583Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the readLine()
- CVE-2024-28735Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an
Medium, low and unrated 105
- CVE-2024-2748CSRF vulnerability was identified in GitHub Enterprise Server that allowed performing actions on behalf of a userGitHub Enterprise Server
- CVE-2024-2720Campcodes Complete Online DJ Booking System aboutus.php cross site scriptingCampcodes Complete Online DJ Booking System
- CVE-2024-2719Campcodes Complete Online DJ Booking System admin-profile.php cross site scriptingCampcodes Complete Online DJ Booking System
- CVE-2024-29036Saleor Storefront session leak in cachesaleor storefront
- CVE-2024-2718Campcodes Complete Online DJ Booking System booking-bwdates-reports-details.php cross site scriptingCampcodes Complete Online DJ Booking System
- CVE-2024-2717Campcodes Complete Online DJ Booking System booking-search.php cross site scriptingCampcodes Complete Online DJ Booking System
- CVE-2024-29032`qiskit_ibm_runtime.RuntimeDecoder` can execute arbitrary codeqiskit-ibm-runtime
- CVE-2024-29018External DNS requests from 'internal' networks could lead to data exfiltrationmoby · github.com/docker/docker
- CVE-2024-28868Umbraco possible user enumeration vulnerabilityUmbraco-CMS · UmbracoCMS
- CVE-2024-2716Campcodes Complete Online DJ Booking System contactus.php cross site scriptingCampcodes Complete Online DJ Booking System
- CVE-2024-2715Campcodes Complete Online DJ Booking System user-search.php cross site scriptingCampcodes Complete Online DJ Booking System
- CVE-2024-27286Moving single messages from public to private streams leaves them accessiblezulip
- CVE-2024-2714Campcodes Complete Online DJ Booking System booking-bwdates-reports-details.php sql injectionCampcodes Complete Online DJ Booking System
- CVE-2024-2713Campcodes Complete Online DJ Booking System booking-search.php sql injectionCampcodes Complete Online DJ Booking System
- CVE-2024-2712Campcodes Complete Online DJ Booking System user-search.php sql injectionCampcodes Complete Online DJ Booking System
- CVE-2022-4963Folio Spring Module Core Schema Name HibernateSchemaService.java dropSchema sql injectionFolio Spring Module Core · org.folio:spring-module-core
- CVE-2024-23821GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)geoserver · org.geoserver:gs-gwc
- CVE-2024-23819GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Pagegeoserver · org.geoserver.extension:gs-mapml
- CVE-2024-23818GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Formatgeoserver · org.geoserver:gs-wms
- CVE-2024-23643GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Formgeoserver · org.geoserver:gs-gwc-rest
- CVE-2024-23642GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderergeoserver · org.geoserver:gs-wms
- CVE-2023-45177IBM MQ denial of serviceIBM MQ
- CVE-2024-2631Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HGoogle Chrome
- CVE-2024-2630Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafteGoogle Chrome
- CVE-2024-2629Incorrect security UI in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML pagGoogle Chrome
- CVE-2024-2628Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a craGoogle Chrome
- CVE-2024-2626Out of bounds read in Swiftshader in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access vGoogle Chrome
- CVE-2024-2707Tenda AC10U WriteFacMac formWriteFacMac os command injectionTenda AC10U
- CVE-2024-23640GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publishergeoserver · org.geoserver:gs-main +1
- CVE-2024-23634GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store APIgeoserver · org.geoserver:gs-restconfig
- CVE-2023-51445GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources APIgeoserver · org.geoserver:gs-restconfig
- CVE-2024-2291MOVEit Transfer Logging Bypass VulnerabilityProgress Software MOVEit Transfer
- CVE-2023-35888IBM Security Verify Governance information disclosureIBM Security Verify Governance
- CVE-2023-52229WordPress Word Replacer Pro plugin <= 1.0 - Broken Access Control vulnerabilitySave as PDF plugin by Pdfcrowd Word Replacer Pro
- CVE-2023-46841x86: shadow stack vs exceptions from emulation stubsXen
- CVE-2023-46840VT-d: Failure to quarantine devices in !HVM buildsXen
- CVE-2023-46839pci: phantom functions assigned to incorrect contextsXen
- CVE-2024-2690SourceCodester Online Discussion Forum Site uupdate.php unrestricted uploadSourceCodester Online Discussion Forum Site
- CVE-2024-2687Campcodes Online Job Finder System index.php sql injectionCampcodes Online Job Finder System
- CVE-2024-2686Campcodes Online Job Finder System controller.php cross site scriptingCampcodes Online Job Finder System
- CVE-2024-2685Campcodes Online Job Finder System index.php cross site scriptingCampcodes Online Job Finder System
- CVE-2024-2684Campcodes Online Job Finder System index.php cross site scriptingCampcodes Online Job Finder System
- CVE-2024-2683Campcodes Online Job Finder System index.php cross site scriptingCampcodes Online Job Finder System
- CVE-2024-2682Campcodes Online Job Finder System controller.php cross site scriptingCampcodes Online Job Finder System
- CVE-2024-2681Campcodes Online Job Finder System index.php cross site scriptingCampcodes Online Job Finder System
- CVE-2024-2680Campcodes Online Job Finder System index.php cross site scriptingCampcodes Online Job Finder System
- CVE-2024-2679Campcodes Online Job Finder System index.php cross site scriptingCampcodes Online Job Finder System
- CVE-2024-2678Campcodes Online Job Finder System controller.php sql injectionCampcodes Online Job Finder System
- CVE-2024-1325Live Sales Notification for Woocommerce – Woomotiv <= 3.4.3 - Cross-Site Request Forgery via ajax_cancel_reviewdelabon Live Sales Notification for Woocommerce – Woomotiv
- CVE-2024-1379Website Article Monetization By MageNet <= 1.0.11 - Unauthenticated Stored Cross-Site ScriptingWebsite Article Monetization By MageNet
- CVE-2024-1119Order Tip for WooCommerce <= 1.3.1 - Missing Authorization to Unauthenticated Data Exportrailmedia Order Tip for WooCommerce
- CVE-2024-2304Animated Headline <= 4.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcodeanshuln90 Animated Headline
- CVE-2024-1181Coming Soon, Under Construction & Maintenance Mode By Dazzler <= 2.1.2 - Maintenance Mode Bypassdazzlersoft Coming Soon, Under Construction & Maintenance M…
- CVE-2024-1844RevivePress – Keep your Old Content Evergreen <= 1.5.6 - Missing Authorizationinfosatech RevivePress – Keep your Old Content Evergreen
- CVE-2024-1473Coming Soon & Maintenance Mode by Colorlib <= 1.0.99 - Information Exposurecolorlibplugins Coming Soon & Maintenance Mode by Colorlib
- CVE-2024-1477Easy Maintenance Mode <= 1.4.2 - Information Exposureaankit Easy Maintenance Mode
- CVE-2024-2129WPBITS Addons For Elementor Page Builder <= 1.4 - Authenticated (Contributor+) Stored Cross-Site ScriptingWPBITS Addons For Elementor Page Builder
- CVE-2024-2677Campcodes Online Job Finder System controller.php sql injectionCampcodes Online Job Finder System
- CVE-2024-2676Campcodes Online Job Finder System controller.php sql injectionCampcodes Online Job Finder System
- CVE-2024-2675Campcodes Online Job Finder System index.php sql injectionCampcodes Online Job Finder System
- CVE-2024-2538Permalink Manager <= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modificationmbis Permalink Manager Lite
- CVE-2024-2674Campcodes Online Job Finder System index.php sql injectionCampcodes Online Job Finder System
- CVE-2024-2673Campcodes Online Job Finder System login.php sql injectionCampcodes Online Job Finder System
- CVE-2024-0337Travelpayouts <= 1.1.15 - Open RedirectTravelpayouts: All Travel Brands in One Place
- CVE-2023-7246System Dashboard < 2.8.10 - XSS via Header InjectionSystem Dashboard
- CVE-2024-2124Translate WordPress and go Multilingual – Weglot <= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributesremyb92 Translate WordPress with Weglot – Multilingual AI T…
- CVE-2024-2474Standout Color Boxes and Buttons <= 0.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcodejp2112 Standout Color Boxes and Buttons
- CVE-2024-2672Campcodes Online Job Finder System controller.php sql injectionCampcodes Online Job Finder System
- CVE-2024-2671Campcodes Online Job Finder System index.php sql injectionCampcodes Online Job Finder System
- CVE-2024-2670Campcodes Online Job Finder System index.php sql injectionCampcodes Online Job Finder System
- CVE-2024-22258CVE-2024-22258: PKCE Downgrade in Spring Authorization ServerSpring · org.springframework.security:spring-security-oauth…
- CVE-2024-2255Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates <= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpdevteam Gutenberg Essential Blocks – Page Builder for Gut…
- CVE-2024-2384WooCommerce POS <= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosurekilbot WCPOS – Point of Sale (POS) plugin for WooCommerce
- CVE-2024-2460GamiPress – Button <= 1.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcoderubengc GamiPress – Button
- CVE-2024-2669Campcodes Online Job Finder System GET Parameter controller.php sql injectionCampcodes Online Job Finder System
- CVE-2024-2668Campcodes Online Job Finder System controller.php sql injectionCampcodes Online Job Finder System
- CVE-2024-1995Smart Custom Fields <= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosureinc2734 Smart Custom Fields
- CVE-2024-1787Contests by Rewards Fuel <= 2.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting via update_rewards_fuel_api_keyrewardsfuel Contests by Rewards Fuel
- CVE-2024-1785Contests by Rewards Fuel <= 2.0.62 - Cross-Site Request Forgery to Stored Cross-Site Scriptingrewardsfuel Contests by Rewards Fuel
- CVE-2024-2387Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms <= 1.82.0 - SQL Injection to Reflected Cross-Site Scripting via integration_idnasirahmed AFI – The Easiest Integration Plugin
- CVE-2024-22077An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.
- CVE-2024-22083An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.
- CVE-2024-22085An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before.
- CVE-2024-24050Cross Site Scripting (XSS) vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary code via parameters fir
- CVE-2024-28562Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to execute arbitrary code via the Imf_2_2::c
- CVE-2024-28563Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the I
- CVE-2024-28564Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the I
- CVE-2024-28565Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the p
- CVE-2024-28567Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the F
- CVE-2024-28570Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the p
- CVE-2024-28571Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the f
- CVE-2024-28572Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the F
- CVE-2024-28573Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the j
- CVE-2024-28574Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the o
- CVE-2024-28576Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the o
- CVE-2024-28577Null Pointer Dereference vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS)
- CVE-2024-28579Buffer Overflow vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS) via the F
- CVE-2024-28584Null Pointer Dereference vulnerability in open source FreeImage v.3.19.0 [r1909] allows a local attacker to cause a denial of service (DoS)
- CVE-2024-29419There is a Cross-site scripting (XSS) vulnerability in the Wireless settings under the Easy Setup Page of TOTOLINK X2000R before v1.0.0-B202
- CVE-2024-29469A stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2024-29470OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component {{rootpath}}/links.
- CVE-2024-29471OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notice Manage module.
- CVE-2024-29472OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Privilege Management module.
- CVE-2024-29473OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Role Management module.
- CVE-2024-29474OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Management module.