# CVEs published 2024-03-21

127 CVEs were published on March 21, 2024: 23 critical, 43 high. Days are UTC.

- [CVE-2024-2776](https://cve.now/CVE-2024-2776.md): Campcodes Online Marriage Registration System search.php sql injection (CVSS 6.3, Campcodes Online Marriage Registration System)
- [CVE-2024-2775](https://cve.now/CVE-2024-2775.md): Campcodes Online Marriage Registration System user-profile.php cross site scripting (CVSS 3.5, Campcodes Online Marriage Registration System)
- [CVE-2024-2774](https://cve.now/CVE-2024-2774.md): Campcodes Online Marriage Registration System search.php sql injection (CVSS 6.3, Campcodes Online Marriage Registration System)
- [CVE-2024-2453](https://cve.now/CVE-2024-2453.md): Advantech WebAccess/SCADA SQL Injection (CVSS 6.4, Advantech WebAccess/SCADA)
- [CVE-2024-2773](https://cve.now/CVE-2024-2773.md): Campcodes Online Marriage Registration System search.php cross site scripting (CVSS 3.5, Campcodes Online Marriage Registration System)
- [CVE-2024-2770](https://cve.now/CVE-2024-2770.md): Campcodes Complete Online Beauty Parlor Management System contact-us.php sql injection (CVSS 6.3, Campcodes Complete Online Beauty Parlor Management System)
- [CVE-2023-42954](https://cve.now/CVE-2023-42954.md): A privilege escalation issue existed in FileMaker Server, potentially exposing sensitive information to front-end websites when signed in to (CVSS 6.5, Claris FileMaker Server)
- [CVE-2024-28045](https://cve.now/CVE-2024-28045.md): Delta Electronics DIAEnergie Cross-site scripting (CVSS 4.6, Delta Electronics DIAEnergie)
- [CVE-2024-25567](https://cve.now/CVE-2024-25567.md): Delta Electronics DIAEnergie Path traversal (CVSS 8.1, Delta Electronics DIAEnergie)
- [CVE-2024-28171](https://cve.now/CVE-2024-28171.md): Delta Electronics DIAEnergie Path traversal (CVSS 8.1, Delta Electronics DIAEnergie)
- [CVE-2024-23494](https://cve.now/CVE-2024-23494.md): Delta Electronics DIAEnergie SQL injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2024-29031](https://cve.now/CVE-2024-29031.md): Meshery SQL Injection vulnerability (CVSS 7.5, meshery · github.com/layer5io/meshery)
- [CVE-2024-23975](https://cve.now/CVE-2024-23975.md): Delta Electronics DIAEnergie SQL injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2024-28040](https://cve.now/CVE-2024-28040.md): Delta Electronics DIAEnergie SQL injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2024-28863](https://cve.now/CVE-2024-28863.md): node-tar vulnerable to denial of service while parsing a tar file due to lack of folders count validation (CVSS 6.5, isaacs node-tar · node-tar +1)
- [CVE-2024-25937](https://cve.now/CVE-2024-25937.md): Delta Electronics DIAEnergie SQL injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2024-28891](https://cve.now/CVE-2024-28891.md): Delta Electronics DIAEnergie SQL injection (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2024-28029](https://cve.now/CVE-2024-28029.md): Client-Side Enforcement of Server-Side Security in Delta Electronics DIAEnergie (CVSS 8.8, Delta Electronics DIAEnergie)
- [CVE-2024-28119](https://cve.now/CVE-2024-28119.md): Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2024-2769](https://cve.now/CVE-2024-2769.md): Campcodes Complete Online Beauty Parlor Management System admin-profile.php sql injection (CVSS 5.3, Campcodes Complete Online Beauty Parlor Management System)
- [CVE-2024-28118](https://cve.now/CVE-2024-28118.md): Grav vulnerable to Server Side Template Injection (SSTI) (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2024-28117](https://cve.now/CVE-2024-28117.md): Grav vulnerable to Server Side Template Injection (SSTI) (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2024-28116](https://cve.now/CVE-2024-28116.md): Server-Side Template Injection (SSTI) with Grav CMS security sandbox bypass (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2024-27921](https://cve.now/CVE-2024-27921.md): Grav File Upload Path Traversal vulnerability (CVSS 8.8, getgrav grav · getgrav/grav)
- [CVE-2024-2768](https://cve.now/CVE-2024-2768.md): Campcodes Complete Online Beauty Parlor Management System edit-services.php sql injection (CVSS 6.3, Campcodes Complete Online Beauty Parlor Management System)
- [CVE-2024-2767](https://cve.now/CVE-2024-2767.md): Campcodes Complete Online Beauty Parlor Management System forgot-password.php sql injection (CVSS 6.3, Campcodes Complete Online Beauty Parlor Management System)
- [CVE-2024-2766](https://cve.now/CVE-2024-2766.md): Campcodes Complete Online Beauty Parlor Management System index.php sql injection (CVSS 6.3, Campcodes Complete Online Beauty Parlor Management System)
- [CVE-2024-2764](https://cve.now/CVE-2024-2764.md): Tenda AC10U SetPptpServerCfg formSetPPTPServer stack-based overflow (CVSS 8.8, Tenda AC10U)
- [CVE-2024-2763](https://cve.now/CVE-2024-2763.md): Tenda AC10U setcfm formSetCfm stack-based overflow (CVSS 8.8, Tenda AC10U)
- [CVE-2024-1727](https://cve.now/CVE-2024-1727.md): CSRF Vulnerability in gradio-app/gradio (CVSS 4.3, gradio-app/gradio · gradio)
- [CVE-2024-24883](https://cve.now/CVE-2024-24883.md): WordPress Prime Slider plugin \<= 3.11.10 - Broken Access Control on Duplicate Post vulnerability (CVSS 4.3, BdThemes Prime Slider – Addons For Elementor)
- [CVE-2024-25907](https://cve.now/CVE-2024-25907.md): WordPress WP Media folder plugin \<= 5.7.2 - Plugin Settings Change vulnerability (CVSS 5.4, JoomUnited WP Media folder)
- [CVE-2024-24850](https://cve.now/CVE-2024-24850.md): WordPress Quicksand Post Filter jQuery plugin \<= 3.1.1 - Broken Access Control vulnerability (CVSS 5.3, Mark Stockton Quicksand Post Filter jQuery Plugin)
- [CVE-2022-44633](https://cve.now/CVE-2022-44633.md): WordPress YITH WooCommerce Gift Cards Premium plugin \<= 3.23.1 - Unauth. Gift Card Creation Leading to Stored XSS vulnerability (CVSS 6.5, YITH WooCommerce Gift Cards Premium)
- [CVE-2022-47604](https://cve.now/CVE-2022-47604.md): WordPress AJAX Thumbnail Rebuild plugin \<= 1.13 - Broken Access Control vulnerability (CVSS 4.3, junkcoder, ristoniinemets AJAX Thumbnail Rebuild)
- [CVE-2024-25908](https://cve.now/CVE-2024-25908.md): WordPress WP Media folder plugin \<= 5.7.2 - Subscriber+ Arbitrary Post/Page Modification vulnerability (CVSS 4.3, JoomUnited WP Media folder)
- [CVE-2024-25912](https://cve.now/CVE-2024-25912.md): WordPress MoveTo plugin \<= 6.2 - Unauthenticated Arbitrary WordPress Settings Change vulnerability (CVSS 9.8, Skymoonlabs MoveTo)
- [CVE-2024-25922](https://cve.now/CVE-2024-25922.md): WordPress Peach Payments Gateway plugin \<= 3.1.9 - Broken Access Control vulnerability (CVSS 5.4, Peach Payments Gateway)
- [CVE-2024-25935](https://cve.now/CVE-2024-25935.md): WordPress RegistrationMagic plugin \<= 5.2.5.9 - Broken Access Control vulnerability (CVSS 4.3, Metagauss RegistrationMagic)
- [CVE-2023-51672](https://cve.now/CVE-2023-51672.md): WordPress FunnelKit Checkout plugin \<= 3.10.3 - Unauthenticated Arbitrary Post/Page Deletion vulnerability (CVSS 7.5, FunnelKit Checkout)
- [CVE-2023-27607](https://cve.now/CVE-2023-27607.md): WordPress Points and Rewards for WooCommerce plugin \<= 1.5.0 - Settings Change vulnerability (CVSS 5.4, WP Swings Points and Rewards for WooCommerce)
- [CVE-2022-44595](https://cve.now/CVE-2022-44595.md): WordPress WP2FA plugin \<= 2.2.0 - Broken Authentication vulnerability (CVSS 5.3, Melapress WP 2FA)
- [CVE-2024-27277](https://cve.now/CVE-2024-27277.md): IBM Storage Protect Plus Server information disclosure (CVSS 6.2, IBM Storage Protect Plus Server)
- [CVE-2023-49837](https://cve.now/CVE-2023-49837.md): WordPress embed-code plugin \<= 2.3.6 - Denial of Service Attack vulnerability (CVSS 6.5, David Artiss Code Embed)
- [CVE-2024-27190](https://cve.now/CVE-2024-27190.md): WordPress Download Media plugin \<= 1.4.2 - Broken Access Control vulnerability (CVSS 4.3, Jean-David Daviet Download Media)
- [CVE-2024-27956](https://cve.now/CVE-2024-27956.md): WordPress Automatic plugin \<= 3.92.0 - Unauthenticated Arbitrary SQL Execution vulnerability (CVSS 9.9, ValvePress Automatic)
- [CVE-2024-27968](https://cve.now/CVE-2024-27968.md): WordPress Super Page Cache for Cloudflare plugin \<= 4.7.5 - Cross Site Request Forgery (CSRF) to XSS vulnerability (CVSS 7.1, Optimole Super Page Cache for Cloudflare)
- [CVE-2024-2578](https://cve.now/CVE-2024-2578.md): WordPress WP Coder plugin \<= 3.5 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPCoder WP Coder)
- [CVE-2024-2579](https://cve.now/CVE-2024-2579.md): WordPress Tracking Code Manager plugin \<= 2.0.16 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Data443 Tracking Code Manager)
- [CVE-2024-2580](https://cve.now/CVE-2024-2580.md): WordPress Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit plugin \<= 2.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, FunnelKit Automation By Autonami)
- [CVE-2024-29180](https://cve.now/CVE-2024-29180.md): webpack-dev-middleware Path Traversal vulnerability (CVSS 7.4, webpack-dev-middleware)
- [CVE-2024-27962](https://cve.now/CVE-2024-27962.md): WordPress wp-mpdf plugin \<= 3.7.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Florian 'fkrauthan' Krauthan wp-mpdf)
- [CVE-2024-27963](https://cve.now/CVE-2024-27963.md): WordPress Crisp – Live Chat and Chatbot plugin \<= 0.44 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Crisp)
- [CVE-2024-27964](https://cve.now/CVE-2024-27964.md): WordPress Zippy plugin \<= 1.6.9 - Arbitrary File Upload vulnerability (CVSS 8.8, Gesundheit Bewegt Zippy)
- [CVE-2024-27965](https://cve.now/CVE-2024-27965.md): WordPress WPFunnels plugin \<= 3.0.6 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WPFunnels)
- [CVE-2024-29019](https://cve.now/CVE-2024-29019.md): ESPHome vulnerable to Authentication bypass via Cross site request forgery (CVSS 8.1, esphome)
- [CVE-2024-27966](https://cve.now/CVE-2024-27966.md): WordPress Quiz And Survey Master plugin \<= 8.2.2 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, ExpressTech Quiz And Survey Master)
- [CVE-2024-27967](https://cve.now/CVE-2024-27967.md): WordPress DSGVO All in one for WP plugin \<= 4.3 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Michael Leithold DSGVO All in one for WP)
- [CVE-2024-27969](https://cve.now/CVE-2024-27969.md): WordPress Free Downloads WooCommerce plugin \<= 3.5.8.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WP Enhanced Free Downloads WooCommerce)
- [CVE-2024-27970](https://cve.now/CVE-2024-27970.md): WordPress WP SendFox plugin \<= 1.3.0 - Broken Access Control vulnerability (CVSS 5.4, BogdanFix WP SendFox)
- [CVE-2024-27985](https://cve.now/CVE-2024-27985.md): WordPress PropertyHive plugin \<= 2.0.9 - PHP Object Injection vulnerability (CVSS 5.4, PropertyHive)
- [CVE-2024-27988](https://cve.now/CVE-2024-27988.md): WordPress WEN Responsive Columns plugin \<= 1.3.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WEN Themes WEN Responsive Columns)
- [CVE-2024-27989](https://cve.now/CVE-2024-27989.md): WordPress WP Responsive Tabs horizontal vertical and accordion Tabs plugin \<= 1.1.17 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, I Thirteen Web Solution WP Responsive Tabs horizontal verti…)
- [CVE-2024-27990](https://cve.now/CVE-2024-27990.md): WordPress The Moneytizer plugin \<= 9.5.20 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, The Moneytizer)
- [CVE-2024-27991](https://cve.now/CVE-2024-27991.md): WordPress SupportCandy plugin \<= 3.2.3 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, SupportCandy)
- [CVE-2024-27992](https://cve.now/CVE-2024-27992.md): WordPress Link Whisper Free plugin \<= 0.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Link Whisper Free)
- [CVE-2024-27993](https://cve.now/CVE-2024-27993.md): WordPress Calendarista Basic Edition plugin \<= 3.0.2 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, typps Calendarista Basic Edition)
- [CVE-2024-27994](https://cve.now/CVE-2024-27994.md): WordPress YITH WooCommerce Product Add-Ons plugin \<= 4.5.0 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, YITHEMES YITH WooCommerce Product Add-Ons)
- [CVE-2024-27995](https://cve.now/CVE-2024-27995.md): WordPress ARMember plugin \<= 4.0.23 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, Repute Infosystems ARMember – Membership Plugin, Content Re…)
- [CVE-2024-2465](https://cve.now/CVE-2024-2465.md): Open redirection in CDeX (CVSS 7.1, CDeX PSA CDeX)
- [CVE-2024-2464](https://cve.now/CVE-2024-2464.md): Application users enumeration in CDeX (CVSS 6.3, CDeX PSA CDeX)
- [CVE-2024-2463](https://cve.now/CVE-2024-2463.md): Weak password recovery mechanism in CDeX (CVSS 8.0, CDeX PSA CDeX)
- [CVE-2023-47715](https://cve.now/CVE-2023-47715.md): IBM Storage Protect Plus Server improper access control (CVSS 4.3, IBM Storage Protect Plus Server)
- [CVE-2024-29880](https://cve.now/CVE-2024-29880.md): In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user running the agent process (CVSS 4.2, JetBrains TeamCity)
- [CVE-2024-29879](https://cve.now/CVE-2024-29879.md): Cross-Site Scripting (XSS) vulnerability in Sentrifugo (CVSS 7.1, Sentrifugo)
- [CVE-2024-29878](https://cve.now/CVE-2024-29878.md): Cross-Site Scripting (XSS) vulnerability in Sentrifugo (CVSS 7.1, Sentrifugo)
- [CVE-2024-29877](https://cve.now/CVE-2024-29877.md): Cross-Site Scripting (XSS) vulnerability in Sentrifugo (CVSS 7.1, Sentrifugo)
- [CVE-2024-29876](https://cve.now/CVE-2024-29876.md): SQL injection vulnerability in Sentrifugo (CVSS 9.8, Sentrifugo)
- [CVE-2024-29875](https://cve.now/CVE-2024-29875.md): SQL injection vulnerability in Sentrifugo (CVSS 9.8, Sentrifugo)
- [CVE-2024-29874](https://cve.now/CVE-2024-29874.md): SQL injection vulnerability in Sentrifugo (CVSS 9.8, Sentrifugo)
- [CVE-2024-29873](https://cve.now/CVE-2024-29873.md): SQL injection vulnerability in Sentrifugo (CVSS 9.8, Sentrifugo)
- [CVE-2024-29872](https://cve.now/CVE-2024-29872.md): SQL injection vulnerability in Sentrifugo (CVSS 9.8, Sentrifugo)
- [CVE-2024-29871](https://cve.now/CVE-2024-29871.md): SQL injection vulnerability in Sentrifugo (CVSS 9.8, Sentrifugo)
- [CVE-2024-29870](https://cve.now/CVE-2024-29870.md): SQL injection vulnerability in Sentrifugo (CVSS 9.8, Sentrifugo)
- [CVE-2024-2494](https://cve.now/CVE-2024-2494.md): Libvirt: negative g\_new0 length can lead to unbounded memory allocation (CVSS 6.2, libvirt · Red Hat Enterprise Linux)
- [CVE-2024-28834](https://cve.now/CVE-2024-28834.md): Gnutls: vulnerable to minerva side-channel information leak (CVSS 5.3, gnutls · Red Hat Enterprise Linux)
- [CVE-2024-1394](https://cve.now/CVE-2024-1394.md): Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads (CVSS 7.5, Red Hat Ansible Automation Platform 2.4 for RHEL · Red… +23)
- [CVE-2024-2742](https://cve.now/CVE-2024-2742.md): OS Command Injection in Planet IGS-4215-16T2S (CVSS 6.4, Planet IGS-4215-16T2S)
- [CVE-2024-2741](https://cve.now/CVE-2024-2741.md): Cross-Site Request Forgery in Planet IGS-4215-16T2S (CVSS 7.1, Planet IGS-4215-16T2S)
- [CVE-2024-2740](https://cve.now/CVE-2024-2740.md): Exposure of Sensitive Information to an Unauthorized Actor in Planet IGS-4215-16T2S (CVSS 7.7, Planet IGS-4215-16T2S)
- [CVE-2024-26643](https://cve.now/CVE-2024-26643.md): netfilter: nf\_tables: mark set as dead when unbinding anonymous set with timeout (CVSS 7.8, Linux)
- [CVE-2024-26642](https://cve.now/CVE-2024-26642.md): netfilter: nf\_tables: disallow anonymous set with timeout flag (CVSS 7.8, Linux)
- [CVE-2023-52620](https://cve.now/CVE-2023-52620.md): netfilter: nf\_tables: disallow timeout for anonymous sets (CVSS 7.8, Linux)
- [CVE-2024-29732](https://cve.now/CVE-2024-29732.md): SQL Injection vulnerability on SCAN\_VISIO eDocument Suite Web Viewer from Abast (CVSS 9.8, Abast SCAN\_VISIO eDocument Suite Web Viewer)
- [CVE-2024-27438](https://cve.now/CVE-2024-27438.md): Apache Doris: Downloading arbitrary remote jar files resulting in remote command execution (CVSS 9.8, Apache Software Foundation Apache Doris)
- [CVE-2024-26307](https://cve.now/CVE-2024-26307.md): Apache Doris: Possible race condition (CVSS 5.3, Apache Software Foundation Apache Doris)
- [CVE-2024-29131](https://cve.now/CVE-2024-29131.md): Apache Commons Configuration: StackOverflowError adding property in AbstractListDelimiterHandler.flattenIterator() (CVSS 7.3, Apache Software Foundation Apache Commons Configuration · o…)
- [CVE-2024-29133](https://cve.now/CVE-2024-29133.md): Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree (CVSS 5.4, Apache Software Foundation Apache Commons Configuration · o…)
- [CVE-2024-1148](https://cve.now/CVE-2024-1148.md): Weak Access Control - Arbitrary file upload (CVSS 9.8, OpenText PVCS)
- [CVE-2024-1147](https://cve.now/CVE-2024-1147.md): Weak Access Control - Arbitrary file download (CVSS 9.8, OpenText PVCS)
- [CVE-2024-2754](https://cve.now/CVE-2024-2754.md): SourceCodester Complete E-Commerce Site users\_photo.php unrestricted upload (CVSS 4.7, SourceCodester Complete E-Commerce Site)
- [CVE-2024-28835](https://cve.now/CVE-2024-28835.md): Gnutls: potential crash during chain building/verification (CVSS 5.0, gnutls · Red Hat Enterprise Linux)
- [CVE-2024-2162](https://cve.now/CVE-2024-2162.md): Authenticated Remote Code Execution in Kiloview NDI N series products (CVSS 8.8, Kiloview NDI)
- [CVE-2024-2161](https://cve.now/CVE-2024-2161.md): Use of Hard-coded Credentials in Kiloview NDI N series products API middleware (CVSS 9.8, Kiloview NDI)
- [CVE-2024-1538](https://cve.now/CVE-2024-1538.md): File Manager \<= 7.2.4 - Cross-Site Request Forgery to Local JS File Inclusion (CVSS 8.8, mndpsingh287 File Manager)
- [CVE-2023-48901](https://cve.now/CVE-2023-48901.md): A SQL injection vulnerability in tramyardg Autoexpress version 1.3.0, allows remote unauthenticated attackers to execute arbitrary SQL comma (CVSS 9.8)
- [CVE-2023-48902](https://cve.now/CVE-2023-48902.md): An issue was discovered in tramyardg autoexpress version 1.3.0, allows unauthenticated remote attackers to escalate privileges, update car d (CVSS 9.8)
- [CVE-2023-48903](https://cve.now/CVE-2023-48903.md): Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers to inject arbitrary (CVSS 6.1)
- [CVE-2023-51141](https://cve.now/CVE-2023-51141.md): An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authentication & Authorizatio (CVSS 6.5)
- [CVE-2023-51142](https://cve.now/CVE-2023-51142.md): An issue in ZKTeco BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information. (CVSS 7.5)
- [CVE-2024-22724](https://cve.now/CVE-2024-22724.md): An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitrary code via administr (CVSS 6.6)
- [CVE-2024-24272](https://cve.now/CVE-2024-24272.md): An issue in iTop DualSafe Password Manager & Digital Vault before 1.4.24 allows a local attacker to obtain sensitive information via leaked (CVSS 7.1)
- [CVE-2024-27683](https://cve.now/CVE-2024-27683.md): D-Link Go-RT-AC750 GORTAC750\_A1\_FW\_v101b03 contains a stack-based buffer overflow via the function hnap\_main. (CVSS 9.8)
- [CVE-2024-28402](https://cve.now/CVE-2024-28402.md): TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in IP/Port Filtering under the Firew (CVSS 5.9)
- [CVE-2024-28521](https://cve.now/CVE-2024-28521.md): SQL Injection vulnerability in Netcome NS-ASG Application Security Gateway v.6.3.1 allows a local attacker to execute arbitrary code and obt (CVSS 7.8)
- [CVE-2024-28635](https://cve.now/CVE-2024-28635.md): Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obt (CVSS 6.1, survey-creator)
- [CVE-2024-28756](https://cve.now/CVE-2024-28756.md): The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Machine-in-the-middle (Mi (CVSS 5.9)
- [CVE-2024-29243](https://cve.now/CVE-2024-29243.md): Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the vpn\_client\_ip parameter at /ap (CVSS 9.8)
- [CVE-2024-29244](https://cve.now/CVE-2024-29244.md): Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the pin\_code\_3g parameter at /appl (CVSS 5.3)
- [CVE-2024-29374](https://cve.now/CVE-2024-29374.md): A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter. (CVSS 6.1, moodle/moodle)
- [CVE-2024-29858](https://cve.now/CVE-2024-29858.md): In MISP before 2.4.187, \_\_uploadLogo in app/Controller/OrganisationsController.php does not properly check for a valid logo upload. (CVSS 9.8)
- [CVE-2024-29859](https://cve.now/CVE-2024-29859.md): In MISP before 2.4.187, add\_misp\_export in app/Controller/EventsController.php does not properly check for a valid file upload. (CVSS 9.8)
- [CVE-2024-29862](https://cve.now/CVE-2024-29862.md): The Kerlink firewall in ChirpStack chirpstack-mqtt-forwarder before 4.2.1 and chirpstack-gateway-bridge before 4.0.11 wrongly accepts certai (CVSS 7.5)
- [CVE-2024-29864](https://cve.now/CVE-2024-29864.md): Distrobox before 1.7.0.1 allows attackers to execute arbitrary code via command injection into exported executables. (CVSS 9.8)
- [CVE-2024-29866](https://cve.now/CVE-2024-29866.md): Datalust Seq before 2023.4.11151 and 2024 before 2024.1.11146 has Incorrect Access Control because a Project Owner or Organization Owner can (CVSS 9.1)
- [CVE-2024-29916](https://cve.now/CVE-2024-29916.md): The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a property via forged k (CVSS 5.6)
- [CVE-2024-29937](https://cve.now/CVE-2024-29937.md): NFS in a BSD derived codebase, as used in OpenBSD through 7.4 and FreeBSD through 14.0-RELEASE, allows remote attackers to execute arbitrary (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.