CVEs published March 21, 2024
127 CVEs were published on March 21, 2024: 23 critical, 43 high.
- Published
- 127
- Critical
- 23
- High
- 43
- Medium
- 59
- Low
- 2
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- Sentrifugo
- 10
- Delta Electronics DIAEnergie
- 9
- Campcodes Complete Online Beauty Parlor Management System
- 5
- getgrav grav · getgrav/grav
- 5
- Campcodes Online Marriage Registration System
- 4
- CDeX PSA CDeX
- 3
- Linux
- 3
- Planet IGS-4215-16T2S
- 3
- Apache Software Foundation Apache Commons Configuration · o…
- 2
- Apache Software Foundation Apache Doris
- 2
Critical 23
- CVE-2024-25912WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary WordPress Settings Change vulnerabilitySkymoonlabs MoveTo
- CVE-2024-27956WordPress Automatic plugin <= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerabilityValvePress Automatic
- CVE-2024-29876SQL injection vulnerability in SentrifugoSentrifugo
- CVE-2024-29875SQL injection vulnerability in SentrifugoSentrifugo
- CVE-2024-29874SQL injection vulnerability in SentrifugoSentrifugo
- CVE-2024-29873SQL injection vulnerability in SentrifugoSentrifugo
- CVE-2024-29872SQL injection vulnerability in SentrifugoSentrifugo
- CVE-2024-29871SQL injection vulnerability in SentrifugoSentrifugo
- CVE-2024-29870SQL injection vulnerability in SentrifugoSentrifugo
- CVE-2024-29732SQL Injection vulnerability on SCAN_VISIO eDocument Suite Web Viewer from AbastAbast SCAN_VISIO eDocument Suite Web Viewer
- CVE-2024-27438Apache Doris: Downloading arbitrary remote jar files resulting in remote command executionApache Software Foundation Apache Doris
- CVE-2024-1148Weak Access Control - Arbitrary file uploadOpenText PVCS
- CVE-2024-1147Weak Access Control - Arbitrary file downloadOpenText PVCS
- CVE-2024-2161Use of Hard-coded Credentials in Kiloview NDI N series products API middlewareKiloview NDI
- CVE-2023-48901A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL comma
- CVE-2023-48902An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car d
- CVE-2024-27683D-Link Go-RT-AC750 GORTAC750_A1_FW_v101b03 contains a stack-based buffer overflow via the function hnap_main.
- CVE-2024-29243Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the vpn_client_ip parameter at /ap
- CVE-2024-29858In MISP before 2.4.187, __uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload.
- CVE-2024-29859In MISP before 2.4.187, add_misp_export in app/Controller/EventsController.php does not properly check for a valid file upload.
- CVE-2024-29864Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables.
- CVE-2024-29866Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can
- CVE-2024-29937NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary
High 43
- CVE-2024-25567Delta Electronics DIAEnergie Path traversalDelta Electronics DIAEnergie
- CVE-2024-28171Delta Electronics DIAEnergie Path traversalDelta Electronics DIAEnergie
- CVE-2024-23494Delta Electronics DIAEnergie SQL injectionDelta Electronics DIAEnergie
- CVE-2024-29031Meshery SQL Injection vulnerabilitymeshery · github.com/layer5io/meshery
- CVE-2024-23975Delta Electronics DIAEnergie SQL injectionDelta Electronics DIAEnergie
- CVE-2024-28040Delta Electronics DIAEnergie SQL injectionDelta Electronics DIAEnergie
- CVE-2024-25937Delta Electronics DIAEnergie SQL injectionDelta Electronics DIAEnergie
- CVE-2024-28891Delta Electronics DIAEnergie SQL injectionDelta Electronics DIAEnergie
- CVE-2024-28029Client-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergieDelta Electronics DIAEnergie
- CVE-2024-28119Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handlergetgrav grav · getgrav/grav
- CVE-2024-28118Grav vulnerable to Server Side Template Injection (SSTI)getgrav grav · getgrav/grav
- CVE-2024-28117Grav vulnerable to Server Side Template Injection (SSTI)getgrav grav · getgrav/grav
- CVE-2024-28116Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypassgetgrav grav · getgrav/grav
- CVE-2024-27921Grav File Upload Path Traversal vulnerabilitygetgrav grav · getgrav/grav
- CVE-2024-2764Tenda AC10U SetPptpServerCfg formSetPPTPServer stack-based overflowTenda AC10U
- CVE-2024-2763Tenda AC10U setcfm formSetCfm stack-based overflowTenda AC10U
- CVE-2023-51672WordPress FunnelKit Checkout plugin <= 3.10.3 - Unauthenticated Arbitrary Post/Page Deletion vulnerabilityFunnelKit Checkout
- CVE-2024-27968WordPress Super Page Cache for Cloudflare plugin <= 4.7.5 - Cross Site Request Forgery (CSRF) to XSS vulnerabilityOptimole Super Page Cache for Cloudflare
- CVE-2024-29180webpack-dev-middleware Path Traversal vulnerabilitywebpack-dev-middleware
- CVE-2024-27962WordPress wp-mpdf plugin <= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerabilityFlorian 'fkrauthan' Krauthan wp-mpdf
- CVE-2024-27964WordPress Zippy plugin <= 1.6.9 - Arbitrary File Upload vulnerabilityGesundheit Bewegt Zippy
- CVE-2024-29019ESPHome vulnerable to Authentication bypass via Cross site request forgeryesphome
- CVE-2024-27992WordPress Link Whisper Free plugin <= 0.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityLink Whisper Free
- CVE-2024-27993WordPress Calendarista Basic Edition plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerabilitytypps Calendarista Basic Edition
- CVE-2024-27994WordPress YITH WooCommerce Product Add-Ons plugin <= 4.5.0 - Cross Site Scripting (XSS) vulnerabilityYITHEMES YITH WooCommerce Product Add-Ons
- CVE-2024-2465Open redirection in CDeXCDeX PSA CDeX
- CVE-2024-2463Weak password recovery mechanism in CDeXCDeX PSA CDeX
- CVE-2024-29879Cross-Site Scripting (XSS) vulnerability in SentrifugoSentrifugo
- CVE-2024-29878Cross-Site Scripting (XSS) vulnerability in SentrifugoSentrifugo
- CVE-2024-29877Cross-Site Scripting (XSS) vulnerability in SentrifugoSentrifugo
- CVE-2024-1394Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloadsRed Hat Ansible Automation Platform 2.4 for RHEL · Red… +23
- CVE-2024-2741Cross-Site Request Forgery in Planet IGS-4215-16T2SPlanet IGS-4215-16T2S
- CVE-2024-2740Exposure of Sensitive Information to an Unauthorized Actor in Planet IGS-4215-16T2SPlanet IGS-4215-16T2S
- CVE-2024-26643netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeoutLinux
- CVE-2024-26642netfilter: nf_tables: disallow anonymous set with timeout flagLinux
- CVE-2023-52620netfilter: nf_tables: disallow timeout for anonymous setsLinux
- CVE-2024-29131Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator()Apache Software Foundation Apache Commons Configuration · o…
- CVE-2024-2162Authenticated Remote Code Execution in Kiloview NDI N series productsKiloview NDI
- CVE-2024-1538File Manager <= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusionmndpsingh287 File Manager
- CVE-2023-51142An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information.
- CVE-2024-24272An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked
- CVE-2024-28521SQL Injection vulnerability in Netcome NS-ASG Application Security Gateway v.6.3.1 allows a local attacker to execute arbitrary code and obt
- CVE-2024-29862The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certai
Medium, low and unrated 61
- CVE-2024-2776Campcodes Online Marriage Registration System search.php sql injectionCampcodes Online Marriage Registration System
- CVE-2024-2775Campcodes Online Marriage Registration System user-profile.php cross site scriptingCampcodes Online Marriage Registration System
- CVE-2024-2774Campcodes Online Marriage Registration System search.php sql injectionCampcodes Online Marriage Registration System
- CVE-2024-2453Advantech WebAccess/SCADA SQL InjectionAdvantech WebAccess/SCADA
- CVE-2024-2773Campcodes Online Marriage Registration System search.php cross site scriptingCampcodes Online Marriage Registration System
- CVE-2024-2770Campcodes Complete Online Beauty Parlor Management System contact-us.php sql injectionCampcodes Complete Online Beauty Parlor Management System
- CVE-2023-42954A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in toClaris FileMaker Server
- CVE-2024-28045Delta Electronics DIAEnergie Cross-site scriptingDelta Electronics DIAEnergie
- CVE-2024-28863node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validationisaacs node-tar · node-tar +1
- CVE-2024-2769Campcodes Complete Online Beauty Parlor Management System admin-profile.php sql injectionCampcodes Complete Online Beauty Parlor Management System
- CVE-2024-2768Campcodes Complete Online Beauty Parlor Management System edit-services.php sql injectionCampcodes Complete Online Beauty Parlor Management System
- CVE-2024-2767Campcodes Complete Online Beauty Parlor Management System forgot-password.php sql injectionCampcodes Complete Online Beauty Parlor Management System
- CVE-2024-2766Campcodes Complete Online Beauty Parlor Management System index.php sql injectionCampcodes Complete Online Beauty Parlor Management System
- CVE-2024-1727CSRF Vulnerability in gradio-app/gradiogradio-app/gradio · gradio
- CVE-2024-24883WordPress Prime Slider plugin <= 3.11.10 - Broken Access Control on Duplicate Post vulnerabilityBdThemes Prime Slider – Addons For Elementor
- CVE-2024-25907WordPress WP Media folder plugin <= 5.7.2 - Plugin Settings Change vulnerabilityJoomUnited WP Media folder
- CVE-2024-24850WordPress Quicksand Post Filter jQuery plugin <= 3.1.1 - Broken Access Control vulnerabilityMark Stockton Quicksand Post Filter jQuery Plugin
- CVE-2022-44633WordPress YITH WooCommerce Gift Cards Premium plugin <= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerabilityYITH WooCommerce Gift Cards Premium
- CVE-2022-47604WordPress AJAX Thumbnail Rebuild plugin <= 1.13 - Broken Access Control vulnerabilityjunkcoder, ristoniinemets AJAX Thumbnail Rebuild
- CVE-2024-25908WordPress WP Media folder plugin <= 5.7.2 - Subscriber+ Arbitrary Post/Page Modification vulnerabilityJoomUnited WP Media folder
- CVE-2024-25922WordPress Peach Payments Gateway plugin <= 3.1.9 - Broken Access Control vulnerabilityPeach Payments Gateway
- CVE-2024-25935WordPress RegistrationMagic plugin <= 5.2.5.9 - Broken Access Control vulnerabilityMetagauss RegistrationMagic
- CVE-2023-27607WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Settings Change vulnerabilityWP Swings Points and Rewards for WooCommerce
- CVE-2022-44595WordPress WP2FA plugin <= 2.2.0 - Broken Authentication vulnerabilityMelapress WP 2FA
- CVE-2024-27277IBM Storage Protect Plus Server information disclosureIBM Storage Protect Plus Server
- CVE-2023-49837WordPress embed-code plugin <= 2.3.6 - Denial of Service Attack vulnerabilityDavid Artiss Code Embed
- CVE-2024-27190WordPress Download Media plugin <= 1.4.2 - Broken Access Control vulnerabilityJean-David Daviet Download Media
- CVE-2024-2578WordPress WP Coder plugin <= 3.5 - Cross Site Scripting (XSS) vulnerabilityWPCoder WP Coder
- CVE-2024-2579WordPress Tracking Code Manager plugin <= 2.0.16 - Cross Site Scripting (XSS) vulnerabilityData443 Tracking Code Manager
- CVE-2024-2580WordPress Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin <= 2.8.2 - Cross Site Scripting (XSS) vulnerabilityFunnelKit Automation By Autonami
- CVE-2024-27963WordPress Crisp – Live Chat and Chatbot plugin <= 0.44 - Cross Site Scripting (XSS) vulnerabilityCrisp
- CVE-2024-27965WordPress WPFunnels plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerabilityWPFunnels
- CVE-2024-27966WordPress Quiz And Survey Master plugin <= 8.2.2 - Cross Site Scripting (XSS) vulnerabilityExpressTech Quiz And Survey Master
- CVE-2024-27967WordPress DSGVO All in one for WP plugin <= 4.3 - Cross Site Request Forgery (CSRF) vulnerabilityMichael Leithold DSGVO All in one for WP
- CVE-2024-27969WordPress Free Downloads WooCommerce plugin <= 3.5.8.2 - Cross Site Scripting (XSS) vulnerabilityWP Enhanced Free Downloads WooCommerce
- CVE-2024-27970WordPress WP SendFox plugin <= 1.3.0 - Broken Access Control vulnerabilityBogdanFix WP SendFox
- CVE-2024-27985WordPress PropertyHive plugin <= 2.0.9 - PHP Object Injection vulnerabilityPropertyHive
- CVE-2024-27988WordPress WEN Responsive Columns plugin <= 1.3.2 - Cross Site Scripting (XSS) vulnerabilityWEN Themes WEN Responsive Columns
- CVE-2024-27989WordPress WP Responsive Tabs horizontal vertical and accordion Tabs plugin <= 1.1.17 - Cross Site Scripting (XSS) vulnerabilityI Thirteen Web Solution WP Responsive Tabs horizontal verti…
- CVE-2024-27990WordPress The Moneytizer plugin <= 9.5.20 - Cross Site Scripting (XSS) vulnerabilityThe Moneytizer
- CVE-2024-27991WordPress SupportCandy plugin <= 3.2.3 - Cross Site Scripting (XSS) vulnerabilitySupportCandy
- CVE-2024-27995WordPress ARMember plugin <= 4.0.23 - Cross Site Scripting (XSS) vulnerabilityRepute Infosystems ARMember – Membership Plugin, Content Re…
- CVE-2024-2464Application users enumeration in CDeXCDeX PSA CDeX
- CVE-2023-47715IBM Storage Protect Plus Server improper access controlIBM Storage Protect Plus Server
- CVE-2024-29880In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent processJetBrains TeamCity
- CVE-2024-2494Libvirt: negative g_new0 length can lead to unbounded memory allocationlibvirt · Red Hat Enterprise Linux
- CVE-2024-28834Gnutls: vulnerable to minerva side-channel information leakgnutls · Red Hat Enterprise Linux
- CVE-2024-2742OS Command Injection in Planet IGS-4215-16T2SPlanet IGS-4215-16T2S
- CVE-2024-26307Apache Doris: Possible race conditionApache Software Foundation Apache Doris
- CVE-2024-29133Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object treeApache Software Foundation Apache Commons Configuration · o…
- CVE-2024-2754SourceCodester Complete E-Commerce Site users_photo.php unrestricted uploadSourceCodester Complete E-Commerce Site
- CVE-2024-28835Gnutls: potential crash during chain building/verificationgnutls · Red Hat Enterprise Linux
- CVE-2023-48903Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary
- CVE-2023-51141An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorizatio
- CVE-2024-22724An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administr
- CVE-2024-28402TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firew
- CVE-2024-28635Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtsurvey-creator
- CVE-2024-28756The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (Mi
- CVE-2024-29244Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the pin_code_3g parameter at /appl
- CVE-2024-29374A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.moodle/moodle
- CVE-2024-29916The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged k