# CVEs published 2024-03-20

163 CVEs were published on March 20, 2024: 12 critical, 46 high. Days are UTC.

- [CVE-2024-28916](https://cve.now/CVE-2024-28916.md): Xbox Gaming Services Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Xbox Gaming Services)
- [CVE-2024-2748](https://cve.now/CVE-2024-2748.md): CSRF vulnerability was identified in GitHub Enterprise Server that allowed performing actions on behalf of a user (CVSS 4.3, GitHub Enterprise Server)
- [CVE-2024-2443](https://cve.now/CVE-2024-2443.md): Improper input validation vulnerability was identified in GitHub Enterprise Server that allowed privilege escalation in the Management Console (CVSS 9.1, GitHub Enterprise Server)
- [CVE-2024-2469](https://cve.now/CVE-2024-2469.md): Remote Code Execution in GitHub Enterprise Server Allowed Administrators to gain SSH access to the appliance (CVSS 8.0, GitHub Enterprise Server)
- [CVE-2024-29026](https://cve.now/CVE-2024-29026.md): Owncast cross origin request (CVSS 8.2, owncast · github.com/owncast/owncast)
- [CVE-2024-2720](https://cve.now/CVE-2024-2720.md): Campcodes Complete Online DJ Booking System aboutus.php cross site scripting (CVSS 3.5, Campcodes Complete Online DJ Booking System)
- [CVE-2024-2719](https://cve.now/CVE-2024-2719.md): Campcodes Complete Online DJ Booking System admin-profile.php cross site scripting (CVSS 3.5, Campcodes Complete Online DJ Booking System)
- [CVE-2024-29037](https://cve.now/CVE-2024-29037.md): Default secret use for initial deployment (CVSS 9.1, acryldata datahub-helm)
- [CVE-2024-29036](https://cve.now/CVE-2024-29036.md): Saleor Storefront session leak in cache (CVSS 4.3, saleor storefront)
- [CVE-2024-29033](https://cve.now/CVE-2024-29033.md): GoogleOAuthenticator.hosted\_domain incorrectly verifies membership of an Google organization/workspace (CVSS 7.5, jupyterhub oauthenticator · oauthenticator)
- [CVE-2024-2718](https://cve.now/CVE-2024-2718.md): Campcodes Complete Online DJ Booking System booking-bwdates-reports-details.php cross site scripting (CVSS 3.5, Campcodes Complete Online DJ Booking System)
- [CVE-2024-2717](https://cve.now/CVE-2024-2717.md): Campcodes Complete Online DJ Booking System booking-search.php cross site scripting (CVSS 3.5, Campcodes Complete Online DJ Booking System)
- [CVE-2024-29032](https://cve.now/CVE-2024-29032.md): \`qiskit\_ibm\_runtime.RuntimeDecoder\` can execute arbitrary code (CVSS 5.3, qiskit-ibm-runtime)
- [CVE-2024-29018](https://cve.now/CVE-2024-29018.md): External DNS requests from 'internal' networks could lead to data exfiltration (CVSS 5.9, moby · github.com/docker/docker)
- [CVE-2024-28868](https://cve.now/CVE-2024-28868.md): Umbraco possible user enumeration vulnerability (CVSS 3.7, Umbraco-CMS · UmbracoCMS)
- [CVE-2024-28231](https://cve.now/CVE-2024-28231.md): Manipulated DATA Submessage causes a heap-buffer-overflow error (CVSS 9.7, eProsima Fast-DDS)
- [CVE-2024-2716](https://cve.now/CVE-2024-2716.md): Campcodes Complete Online DJ Booking System contactus.php cross site scripting (CVSS 3.5, Campcodes Complete Online DJ Booking System)
- [CVE-2024-2715](https://cve.now/CVE-2024-2715.md): Campcodes Complete Online DJ Booking System user-search.php cross site scripting (CVSS 3.5, Campcodes Complete Online DJ Booking System)
- [CVE-2024-28179](https://cve.now/CVE-2024-28179.md): Jupyter Server Proxy's Websocket Proxying does not require authentication (CVSS 9.1, jupyterhub jupyter-server-proxy · jupyter-server-proxy)
- [CVE-2024-27286](https://cve.now/CVE-2024-27286.md): Moving single messages from public to private streams leaves them accessible (CVSS 6.5, zulip)
- [CVE-2024-2714](https://cve.now/CVE-2024-2714.md): Campcodes Complete Online DJ Booking System booking-bwdates-reports-details.php sql injection (CVSS 6.3, Campcodes Complete Online DJ Booking System)
- [CVE-2024-2713](https://cve.now/CVE-2024-2713.md): Campcodes Complete Online DJ Booking System booking-search.php sql injection (CVSS 6.3, Campcodes Complete Online DJ Booking System)
- [CVE-2024-2712](https://cve.now/CVE-2024-2712.md): Campcodes Complete Online DJ Booking System user-search.php sql injection (CVSS 6.3, Campcodes Complete Online DJ Booking System)
- [CVE-2022-4963](https://cve.now/CVE-2022-4963.md): Folio Spring Module Core Schema Name HibernateSchemaService.java dropSchema sql injection (CVSS 5.5, Folio Spring Module Core · org.folio:spring-module-core)
- [CVE-2024-27105](https://cve.now/CVE-2024-27105.md): Frappe File Permissions can by bypassed using certain endpoints (CVSS 8.1, frappe)
- [CVE-2024-24813](https://cve.now/CVE-2024-24813.md): Frappe SQL Injection from reporting logic (CVSS 7.5, frappe)
- [CVE-2024-23821](https://cve.now/CVE-2024-23821.md): GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS) (CVSS 4.8, geoserver · org.geoserver:gs-gwc)
- [CVE-2024-23819](https://cve.now/CVE-2024-23819.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in MapML HTML Page (CVSS 4.8, geoserver · org.geoserver.extension:gs-mapml)
- [CVE-2024-2711](https://cve.now/CVE-2024-2711.md): Tenda AC10U addWifiMacFilter stack-based overflow (CVSS 8.8, Tenda AC10U)
- [CVE-2024-2710](https://cve.now/CVE-2024-2710.md): Tenda AC10U openSchedWifi setSchedWifi stack-based overflow (CVSS 8.8, Tenda AC10U)
- [CVE-2024-23818](https://cve.now/CVE-2024-23818.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in WMS OpenLayers Format (CVSS 4.8, geoserver · org.geoserver:gs-wms)
- [CVE-2024-23643](https://cve.now/CVE-2024-23643.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in GWC Seed Form (CVSS 4.8, geoserver · org.geoserver:gs-gwc-rest)
- [CVE-2024-23642](https://cve.now/CVE-2024-23642.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Simple SVG Renderer (CVSS 4.8, geoserver · org.geoserver:gs-wms)
- [CVE-2024-2709](https://cve.now/CVE-2024-2709.md): Tenda AC10U SetStaticRouteCfg fromSetRouteStatic stack-based overflow (CVSS 8.8, Tenda AC10U)
- [CVE-2024-2708](https://cve.now/CVE-2024-2708.md): Tenda AC10U execCommand formexeCommand stack-based overflow (CVSS 8.8, Tenda AC10U)
- [CVE-2023-45177](https://cve.now/CVE-2023-45177.md): IBM MQ denial of service (CVSS 5.3, IBM MQ)
- [CVE-2024-2631](https://cve.now/CVE-2024-2631.md): Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted H (CVSS 4.3, Google Chrome)
- [CVE-2024-2630](https://cve.now/CVE-2024-2630.md): Inappropriate implementation in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to leak cross-origin data via a crafte (CVSS 6.5, Google Chrome)
- [CVE-2024-2629](https://cve.now/CVE-2024-2629.md): Incorrect security UI in iOS in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a crafted HTML pag (CVSS 4.3, Google Chrome)
- [CVE-2024-2628](https://cve.now/CVE-2024-2628.md): Inappropriate implementation in Downloads in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform UI spoofing via a cra (CVSS 4.3, Google Chrome)
- [CVE-2024-2627](https://cve.now/CVE-2024-2627.md): Use after free in Canvas in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2024-2626](https://cve.now/CVE-2024-2626.md): Out of bounds read in Swiftshader in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to perform out of bounds memory access v (CVSS 6.5, Google Chrome)
- [CVE-2024-2625](https://cve.now/CVE-2024-2625.md): Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via (CVSS 8.8, Google Chrome)
- [CVE-2024-2707](https://cve.now/CVE-2024-2707.md): Tenda AC10U WriteFacMac formWriteFacMac os command injection (CVSS 6.3, Tenda AC10U)
- [CVE-2024-2706](https://cve.now/CVE-2024-2706.md): Tenda AC10U WifiWpsStart formWifiWpsStart stack-based overflow (CVSS 8.8, Tenda AC10U)
- [CVE-2024-2705](https://cve.now/CVE-2024-2705.md): Tenda AC10U SetNetControlList formSetQosBand stack-based overflow (CVSS 8.8, Tenda AC10U)
- [CVE-2024-2704](https://cve.now/CVE-2024-2704.md): Tenda AC10U SetFirewallCfg formSetFirewallCfg stack-based overflow (CVSS 8.8, Tenda AC10U)
- [CVE-2024-2703](https://cve.now/CVE-2024-2703.md): Tenda AC10U SetOnlineDevName formSetDeviceName stack-based overflow (CVSS 8.8, Tenda AC10U)
- [CVE-2024-23640](https://cve.now/CVE-2024-23640.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in Style Publisher (CVSS 4.8, geoserver · org.geoserver:gs-main +1)
- [CVE-2024-23634](https://cve.now/CVE-2024-23634.md): GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API (CVSS 6.0, geoserver · org.geoserver:gs-restconfig)
- [CVE-2023-51445](https://cve.now/CVE-2023-51445.md): GeoServer Stored Cross-Site Scripting (XSS) vulnerability in REST Resources API (CVSS 4.8, geoserver · org.geoserver:gs-restconfig)
- [CVE-2023-51444](https://cve.now/CVE-2023-51444.md): GeoServer arbitrary file upload vulnerability in REST Coverage Store API (CVSS 7.2, geoserver · org.geoserver:gs-platform +1)
- [CVE-2024-2291](https://cve.now/CVE-2024-2291.md): MOVEit Transfer Logging Bypass Vulnerability (CVSS 4.3, Progress Software MOVEit Transfer)
- [CVE-2023-41877](https://cve.now/CVE-2023-41877.md): GeoServer log file path traversal vulnerability (CVSS 7.2, geoserver · org.geoserver:gs-main)
- [CVE-2023-41038](https://cve.now/CVE-2023-41038.md): Server crash when using specific form of SET BIND statement (CVSS 7.5, FirebirdSQL firebird)
- [CVE-2023-35888](https://cve.now/CVE-2023-35888.md): IBM Security Verify Governance information disclosure (CVSS 5.9, IBM Security Verify Governance)
- [CVE-2024-1856](https://cve.now/CVE-2024-1856.md): Progress Telerik Reporting Remote Deserialization Vulnerability (CVSS 8.5, Progress Software Telerik Reporting)
- [CVE-2024-1801](https://cve.now/CVE-2024-1801.md): Progress Telerik Reporting Local Deserialization Vulnerability (CVSS 7.7, Progress Software Telerik Reporting)
- [CVE-2024-1800](https://cve.now/CVE-2024-1800.md): Progress Telerik Report Server Deserialization (CVSS 9.9, Progress Software Telerik Report Server)
- [CVE-2024-1811](https://cve.now/CVE-2024-1811.md): OpenText ArcSight Platform Remote Vulnerability (CVSS 9.8, OpenText ArcSight Platform)
- [CVE-2024-2721](https://cve.now/CVE-2024-2721.md): WordPress Social Media Share Buttons plugin \<= 2.1.0 - PHP Object Injection vulnerability (CVSS 8.2, Social Media Share Buttons By Sygnoos Social Media Share Bu…)
- [CVE-2023-52229](https://cve.now/CVE-2023-52229.md): WordPress Word Replacer Pro plugin \<= 1.0 - Broken Access Control vulnerability (CVSS 6.5, Save as PDF plugin by Pdfcrowd Word Replacer Pro)
- [CVE-2023-46841](https://cve.now/CVE-2023-46841.md): x86: shadow stack vs exceptions from emulation stubs (CVSS 6.5, Xen)
- [CVE-2023-46840](https://cve.now/CVE-2023-46840.md): VT-d: Failure to quarantine devices in !HVM builds (CVSS 4.1, Xen)
- [CVE-2023-46839](https://cve.now/CVE-2023-46839.md): pci: phantom functions assigned to incorrect contexts (CVSS 5.3, Xen)
- [CVE-2024-2690](https://cve.now/CVE-2024-2690.md): SourceCodester Online Discussion Forum Site uupdate.php unrestricted upload (CVSS 6.3, SourceCodester Online Discussion Forum Site)
- [CVE-2024-2702](https://cve.now/CVE-2024-2702.md): WordPress Olive One Click Demo Import plugin \<= 1.1.1 - Broken Access Control vulnerability (CVSS 8.2, Olive Themes Olive One Click Demo Import)
- [CVE-2024-2687](https://cve.now/CVE-2024-2687.md): Campcodes Online Job Finder System index.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-2686](https://cve.now/CVE-2024-2686.md): Campcodes Online Job Finder System controller.php cross site scripting (CVSS 3.5, Campcodes Online Job Finder System)
- [CVE-2024-2685](https://cve.now/CVE-2024-2685.md): Campcodes Online Job Finder System index.php cross site scripting (CVSS 3.5, Campcodes Online Job Finder System)
- [CVE-2024-2684](https://cve.now/CVE-2024-2684.md): Campcodes Online Job Finder System index.php cross site scripting (CVSS 3.5, Campcodes Online Job Finder System)
- [CVE-2024-2683](https://cve.now/CVE-2024-2683.md): Campcodes Online Job Finder System index.php cross site scripting (CVSS 3.5, Campcodes Online Job Finder System)
- [CVE-2024-2682](https://cve.now/CVE-2024-2682.md): Campcodes Online Job Finder System controller.php cross site scripting (CVSS 3.5, Campcodes Online Job Finder System)
- [CVE-2024-2681](https://cve.now/CVE-2024-2681.md): Campcodes Online Job Finder System index.php cross site scripting (CVSS 3.5, Campcodes Online Job Finder System)
- [CVE-2024-2680](https://cve.now/CVE-2024-2680.md): Campcodes Online Job Finder System index.php cross site scripting (CVSS 3.5, Campcodes Online Job Finder System)
- [CVE-2024-2679](https://cve.now/CVE-2024-2679.md): Campcodes Online Job Finder System index.php cross site scripting (CVSS 3.5, Campcodes Online Job Finder System)
- [CVE-2024-2678](https://cve.now/CVE-2024-2678.md): Campcodes Online Job Finder System controller.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-1711](https://cve.now/CVE-2024-1711.md): Create by Mediavine \<= 1.9.4 - Unauthenticated SQL Injection via 'id' (CVSS 9.8, mischiefmarmot Create)
- [CVE-2024-1325](https://cve.now/CVE-2024-1325.md): Live Sales Notification for Woocommerce – Woomotiv \<= 3.4.3 - Cross-Site Request Forgery via ajax\_cancel\_review (CVSS 4.3, delabon Live Sales Notification for Woocommerce – Woomotiv)
- [CVE-2024-1379](https://cve.now/CVE-2024-1379.md): Website Article Monetization By MageNet \<= 1.0.11 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1, Website Article Monetization By MageNet)
- [CVE-2024-1205](https://cve.now/CVE-2024-1205.md): Management App for WooCommerce – Order notifications, Order management, Lead management, Uptime Monitoring \<= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Upload (CVSS 8.8, israelb1 Management App for WooCommerce – Order notificatio…)
- [CVE-2024-1119](https://cve.now/CVE-2024-1119.md): Order Tip for WooCommerce \<= 1.3.1 - Missing Authorization to Unauthenticated Data Export (CVSS 5.3, railmedia Order Tip for WooCommerce)
- [CVE-2024-2304](https://cve.now/CVE-2024-2304.md): Animated Headline \<= 4.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, anshuln90 Animated Headline)
- [CVE-2024-1181](https://cve.now/CVE-2024-1181.md): Coming Soon, Under Construction & Maintenance Mode By Dazzler \<= 2.1.2 - Maintenance Mode Bypass (CVSS 5.3, dazzlersoft Coming Soon, Under Construction & Maintenance M…)
- [CVE-2024-1844](https://cve.now/CVE-2024-1844.md): RevivePress – Keep your Old Content Evergreen \<= 1.5.6 - Missing Authorization (CVSS 4.3, infosatech RevivePress – Keep your Old Content Evergreen)
- [CVE-2024-1473](https://cve.now/CVE-2024-1473.md): Coming Soon & Maintenance Mode by Colorlib \<= 1.0.99 - Information Exposure (CVSS 5.3, colorlibplugins Coming Soon & Maintenance Mode by Colorlib)
- [CVE-2024-2459](https://cve.now/CVE-2024-2459.md): UX Flat \<= 4.4 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 7.4, wpvncom UX Flat)
- [CVE-2024-1477](https://cve.now/CVE-2024-1477.md): Easy Maintenance Mode \<= 1.4.2 - Information Exposure (CVSS 5.3, aankit Easy Maintenance Mode)
- [CVE-2024-2129](https://cve.now/CVE-2024-2129.md): WPBITS Addons For Elementor Page Builder \<= 1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, WPBITS Addons For Elementor Page Builder)
- [CVE-2024-2677](https://cve.now/CVE-2024-2677.md): Campcodes Online Job Finder System controller.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-2676](https://cve.now/CVE-2024-2676.md): Campcodes Online Job Finder System controller.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-2675](https://cve.now/CVE-2024-2675.md): Campcodes Online Job Finder System index.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-2538](https://cve.now/CVE-2024-2538.md): Permalink Manager \<= 2.4.3.1 - Missing Authorization to Authenticated(Author+) Arbitrary Post Slug Modification (CVSS 5.4, mbis Permalink Manager Lite)
- [CVE-2024-2674](https://cve.now/CVE-2024-2674.md): Campcodes Online Job Finder System index.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-2673](https://cve.now/CVE-2024-2673.md): Campcodes Online Job Finder System login.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-1983](https://cve.now/CVE-2024-1983.md): Simple Ajax Chat \< 20240223 - Unauthenticated Stored XSS (CVSS 7.1, Simple Ajax Chat)
- [CVE-2024-0856](https://cve.now/CVE-2024-0856.md): Booking Calendar \< 1.3.83 - CSRF appointment scheduling (CVSS 8.8, Appointment Booking Calendar)
- [CVE-2024-0337](https://cve.now/CVE-2024-0337.md): Travelpayouts \<= 1.1.15 - Open Redirect (CVSS 6.1, Travelpayouts: All Travel Brands in One Place)
- [CVE-2023-7246](https://cve.now/CVE-2023-7246.md): System Dashboard \< 2.8.10 - XSS via Header Injection (CVSS 5.4, System Dashboard)
- [CVE-2024-2124](https://cve.now/CVE-2024-2124.md): Translate WordPress and go Multilingual – Weglot \<= 4.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes (CVSS 6.4, remyb92 Translate WordPress with Weglot – Multilingual AI T…)
- [CVE-2024-2474](https://cve.now/CVE-2024-2474.md): Standout Color Boxes and Buttons \<= 0.7.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, jp2112 Standout Color Boxes and Buttons)
- [CVE-2024-2672](https://cve.now/CVE-2024-2672.md): Campcodes Online Job Finder System controller.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-2671](https://cve.now/CVE-2024-2671.md): Campcodes Online Job Finder System index.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-2670](https://cve.now/CVE-2024-2670.md): Campcodes Online Job Finder System index.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-22258](https://cve.now/CVE-2024-22258.md): CVE-2024-22258: PKCE Downgrade in Spring Authorization Server (CVSS 6.1, Spring · org.springframework.security:spring-security-oauth…)
- [CVE-2024-2255](https://cve.now/CVE-2024-2255.md): Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates \<= 4.5.3 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, wpdevteam Gutenberg Essential Blocks – Page Builder for Gut…)
- [CVE-2024-1799](https://cve.now/CVE-2024-1799.md): GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress \<= 6.8.6 - Authenticated (Contributor+) SQL Injection via Shortcode (CVSS 8.8, rubengc GamiPress – Gamification plugin to reward points, a…)
- [CVE-2024-2384](https://cve.now/CVE-2024-2384.md): WooCommerce POS \<= 1.4.11 - Insufficient Verification of Data Authenticity to Authenticated (Customer+) Information Disclosure (CVSS 4.3, kilbot WCPOS – Point of Sale (POS) plugin for WooCommerce)
- [CVE-2024-2460](https://cve.now/CVE-2024-2460.md): GamiPress – Button \<= 1.0.7 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, rubengc GamiPress – Button)
- [CVE-2024-2669](https://cve.now/CVE-2024-2669.md): Campcodes Online Job Finder System GET Parameter controller.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-2668](https://cve.now/CVE-2024-2668.md): Campcodes Online Job Finder System controller.php sql injection (CVSS 6.3, Campcodes Online Job Finder System)
- [CVE-2024-1995](https://cve.now/CVE-2024-1995.md): Smart Custom Fields \<= 4.2.2 - Missing Authorization to Authenticated (Subscriber+) Post Content Disclosure (CVSS 4.3, inc2734 Smart Custom Fields)
- [CVE-2024-1787](https://cve.now/CVE-2024-1787.md): Contests by Rewards Fuel \<= 2.0.64 - Authenticated (Contributor+) Stored Cross-Site Scripting via update\_rewards\_fuel\_api\_key (CVSS 6.4, rewardsfuel Contests by Rewards Fuel)
- [CVE-2024-1785](https://cve.now/CVE-2024-1785.md): Contests by Rewards Fuel \<= 2.0.62 - Cross-Site Request Forgery to Stored Cross-Site Scripting (CVSS 5.4, rewardsfuel Contests by Rewards Fuel)
- [CVE-2024-2387](https://cve.now/CVE-2024-2387.md): Advanced Form Integration – Connect WooCommerce and Contact Form 7 to Google Sheets and other platforms \<= 1.82.0 - SQL Injection to Reflected Cross-Site Scripting via integration\_id (CVSS 6.1, nasirahmed AFI – The Easiest Integration Plugin)
- [CVE-2023-50967](https://cve.now/CVE-2023-50967.md): latchset jose through version 11 allows attackers to cause a denial of service (CPU consumption) via a large p2c (aka PBES2 Count) value. (CVSS 7.5)
- [CVE-2024-22077](https://cve.now/CVE-2024-22077.md): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. (CVSS 5.3)
- [CVE-2024-22078](https://cve.now/CVE-2024-22078.md): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. (CVSS 8.8)
- [CVE-2024-22079](https://cve.now/CVE-2024-22079.md): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. (CVSS 7.5)
- [CVE-2024-22080](https://cve.now/CVE-2024-22080.md): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. (CVSS 9.8)
- [CVE-2024-22081](https://cve.now/CVE-2024-22081.md): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. (CVSS 9.8)
- [CVE-2024-22082](https://cve.now/CVE-2024-22082.md): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. (CVSS 7.5)
- [CVE-2024-22083](https://cve.now/CVE-2024-22083.md): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. (CVSS 6.5)
- [CVE-2024-22084](https://cve.now/CVE-2024-22084.md): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. (CVSS 7.5)
- [CVE-2024-22085](https://cve.now/CVE-2024-22085.md): An issue was discovered in Elspec G5 digital fault recorder versions 1.1.4.15 and before. (CVSS 6.2)
- [CVE-2024-23721](https://cve.now/CVE-2024-23721.md): A Directory Traversal issue was discovered in process\_post on Draytek Vigor3910 4.3.2.5 devices. (CVSS 7.5)
- [CVE-2024-24050](https://cve.now/CVE-2024-24050.md): Cross Site Scripting (XSS) vulnerability in Sourcecodester Workout Journal App 1.0 allows attackers to run arbitrary code via parameters fir (CVSS 4.7)
- [CVE-2024-25294](https://cve.now/CVE-2024-25294.md): An SSRF issue in REBUILD v.3.5 allows a remote attacker to obtain sensitive information and execute arbitrary code via the FileDownloader.ja (CVSS 9.1)
- [CVE-2024-28286](https://cve.now/CVE-2024-28286.md): In mz-automation libiec61850 v1.4.0, a NULL Pointer Dereference was detected in the mmsServer\_handleFileCloseRequest.c function of src/mms/i (CVSS 7.5)
- [CVE-2024-28392](https://cve.now/CVE-2024-28392.md): SQL injection vulnerability in pscartabandonmentpro v.2.0.11 and before allows a remote attacker to escalate privileges via the pscartabando (CVSS 9.8)
- [CVE-2024-28395](https://cve.now/CVE-2024-28395.md): SQL injection vulnerability in Best-Kit bestkit\_popup v.1.7.2 and before allows a remote attacker to escalate privileges via the bestkit\_pop (CVSS 9.8)
- [CVE-2024-28396](https://cve.now/CVE-2024-28396.md): An issue in MyPrestaModules ordersexport v.6.0.2 and before allows a remote attacker to execute arbitrary code via the download.php componen (CVSS 7.5)
- [CVE-2024-28562](https://cve.now/CVE-2024-28562.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to execute arbitrary code via the Imf\_2\_2::c (CVSS 6.8)
- [CVE-2024-28563](https://cve.now/CVE-2024-28563.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the I (CVSS 5.9)
- [CVE-2024-28564](https://cve.now/CVE-2024-28564.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the I (CVSS 6.2)
- [CVE-2024-28565](https://cve.now/CVE-2024-28565.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the p (CVSS 5.5)
- [CVE-2024-28566](https://cve.now/CVE-2024-28566.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to execute arbitrary code via the AssignPixe (CVSS 8.4)
- [CVE-2024-28567](https://cve.now/CVE-2024-28567.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the F (CVSS 6.2)
- [CVE-2024-28568](https://cve.now/CVE-2024-28568.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the r (CVSS 8.4)
- [CVE-2024-28569](https://cve.now/CVE-2024-28569.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to execute arbitrary code via the Imf\_2\_2::X (CVSS 7.8)
- [CVE-2024-28570](https://cve.now/CVE-2024-28570.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the p (CVSS 5.5)
- [CVE-2024-28571](https://cve.now/CVE-2024-28571.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the f (CVSS 5.5)
- [CVE-2024-28572](https://cve.now/CVE-2024-28572.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the F (CVSS 6.2)
- [CVE-2024-28573](https://cve.now/CVE-2024-28573.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the j (CVSS 6.2)
- [CVE-2024-28574](https://cve.now/CVE-2024-28574.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the o (CVSS 6.2)
- [CVE-2024-28575](https://cve.now/CVE-2024-28575.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the o (CVSS 8.4)
- [CVE-2024-28576](https://cve.now/CVE-2024-28576.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the o (CVSS 5.5)
- [CVE-2024-28577](https://cve.now/CVE-2024-28577.md): Null Pointer Dereference vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) (CVSS 5.5)
- [CVE-2024-28578](https://cve.now/CVE-2024-28578.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to execute arbitrary code via the Load() fun (CVSS 8.4)
- [CVE-2024-28579](https://cve.now/CVE-2024-28579.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) via the F (CVSS 6.2)
- [CVE-2024-28580](https://cve.now/CVE-2024-28580.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to execute arbitrary code via the ReadData() (CVSS 8.4)
- [CVE-2024-28581](https://cve.now/CVE-2024-28581.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to execute arbitrary code via the \_assignPix (CVSS 8.4)
- [CVE-2024-28582](https://cve.now/CVE-2024-28582.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to execute arbitrary code via the rgbe\_RGBET (CVSS 8.4)
- [CVE-2024-28583](https://cve.now/CVE-2024-28583.md): Buffer Overflow vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to execute arbitrary code via the readLine() (CVSS 7.8)
- [CVE-2024-28584](https://cve.now/CVE-2024-28584.md): Null Pointer Dereference vulnerability in open source FreeImage v.3.19.0 \[r1909\] allows a local attacker to cause a denial of service (DoS) (CVSS 3.3)
- [CVE-2024-28735](https://cve.now/CVE-2024-28735.md): Unit4 Financials by Coda versions prior to 2023Q4 suffer from an incorrect access control authorization bypass vulnerability which allows an (CVSS 8.1)
- [CVE-2024-29419](https://cve.now/CVE-2024-29419.md): There is a Cross-site scripting (XSS) vulnerability in the Wireless settings under the Easy Setup Page of TOTOLINK X2000R before v1.0.0-B202 (CVSS 5.4)
- [CVE-2024-29469](https://cve.now/CVE-2024-29469.md): A stored cross-site scripting (XSS) vulnerability in OneBlog v2.3.4 allows attackers to execute arbitrary web scripts or HTML via a crafted (CVSS 6.1)
- [CVE-2024-29470](https://cve.now/CVE-2024-29470.md): OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the component {{rootpath}}/links. (CVSS 6.1)
- [CVE-2024-29471](https://cve.now/CVE-2024-29471.md): OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Notice Manage module. (CVSS 5.4)
- [CVE-2024-29472](https://cve.now/CVE-2024-29472.md): OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Privilege Management module. (CVSS 5.4)
- [CVE-2024-29473](https://cve.now/CVE-2024-29473.md): OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Role Management module. (CVSS 6.1)
- [CVE-2024-29474](https://cve.now/CVE-2024-29474.md): OneBlog v2.3.4 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Management module. (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.