CVEs published March 22, 2024
81 CVEs were published on March 22, 2024: 10 critical, 27 high. 1 is now in CISA KEV.
- Published
- 81
- Critical
- 10
- High
- 27
- Medium
- 37
- Low
- 7
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 23
Most affected products
- Tenda AC15
- 13
- CIGESv2
- 7
- DedeCMS
- 4
- IBM Security Verify Directory
- 4
- lakernote EasyAdmin
- 4
- Campcodes Online Marriage Registration System
- 3
- Checkmk
- 3
- anchorcms/anchor-cms
- 2
- freescout-helpdesk freescout
- 2
- Microsoft Edge
- 2
Critical 10
- CVE-2024-29185FreeScout OS Command Injection vulnerabilityfreescout-helpdesk freescout
- CVE-2024-28861Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolderFriendsOfSymfony1 symfony1 · friendsofsymfony1/symfony1
- CVE-2024-2227IdentityIQ JavaServer Faces File Path Traversal VulnerabilitySailPoint IdentityIQ
- CVE-2024-2724SQL injection vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-2723SQL injection vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-2722SQL injection vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-29943An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination.Mozilla Firefox
- CVE-2024-28441File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the mess
- CVE-2024-29275SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive i
- CVE-2024-29385DIR-845L router <= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi_main function.
High 27
- CVE-2024-29059.NET Framework Information Disclosure VulnerabilityMicrosoft .NET Framework
- CVE-2024-29190MobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)Mobile-Security-Framework-MobSF · mobsfscan +1
- CVE-2023-5685Xnio: stackoverflowexception when the chain of notifier states becomes problematically bigRed Hat build of Apache Camel 4.4.0 for Spring Boot · R… +10
- CVE-2024-29184FreeScout Stored XSS to Privilege Escalation After CSP Bypassfreescout-helpdesk freescout
- CVE-2024-2228IdentityIQ Authorization of QuickLink Target Identities VulnerabilitySailPoint IdentityIQ
- CVE-2024-2449LoadMaster Cross-Site Request Forgery (CSRF)Progress Software LoadMaster
- CVE-2024-2725Exposure of Sensitive Information vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-2448LoadMaster Command Injection VulnerabilityProgress Software LoadMaster
- CVE-2024-29944An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent proceMozilla Firefox
- CVE-2024-1848Multiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024Dassault Systèmes SOLIDWORKS Desktop
- CVE-2024-28824Privilege escalation in mk_informix pluginCheckmk
- CVE-2024-0638Privilege escalation in mk_oracle pluginsCheckmk
- CVE-2024-2815Tenda AC15 Cookie execCommand R7WebsSecurityHandler stack-based overflowTenda AC15
- CVE-2024-2814Tenda AC15 DhcpListClient fromDhcpListClient stack-based overflowTenda AC15
- CVE-2024-2813Tenda AC15 fast_setting_wifi_set form_fast_setting_wifi_set stack-based overflowTenda AC15
- CVE-2024-2811Tenda AC15 WifiWpsStart formWifiWpsStart stack-based overflowTenda AC15
- CVE-2024-2810Tenda AC15 WifiWpsOOB formWifiWpsOOB stack-based overflowTenda AC15
- CVE-2024-2809Tenda AC15 SetFirewallCfg formSetFirewallCfg stack-based overflowTenda AC15
- CVE-2024-2808Tenda AC15 QuickIndex formQuickIndex stack-based overflowTenda AC15
- CVE-2024-2807Tenda AC15 expandDlnaFile formExpandDlnaFile stack-based overflowTenda AC15
- CVE-2024-2806Tenda AC15 addWifiMacFilter stack-based overflowTenda AC15
- CVE-2024-2805Tenda AC15 SetSpeedWan formSetSpeedWan stack-based overflowTenda AC15
- CVE-2023-41099In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM).
- CVE-2024-25808Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create ne
- CVE-2024-28559SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the setPrice() function of the
- CVE-2024-29366A command injection vulnerability exists in the cgibin binary in DIR-845L router firmware <= v1.01KRb03.
- CVE-2024-29499Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2.anchorcms/anchor-cms
Medium, low and unrated 44
- CVE-2024-29057Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2024-26247Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2024-2828lakernote EasyAdmin IndexController.java thumbnail server-side request forgerylakernote EasyAdmin
- CVE-2024-2827lakernote EasyAdmin saveReportFile server-side request forgerylakernote EasyAdmin
- CVE-2024-2826lakernote EasyAdmin saveReportFile xml external entity referencelakernote EasyAdmin
- CVE-2024-2825lakernote EasyAdmin saveReportFile path traversallakernote EasyAdmin
- CVE-2024-2824Matthias-Wandel jhead exif.c PrintFormatNumber heap-based overflowMatthias-Wandel jhead
- CVE-2023-4063Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request.Certain HP OfficeJet Pro Printers
- CVE-2024-29186Slow String Operations via MultiPart Requests in Event-Driven Functionsbrefphp bref · bref/bref
- CVE-2024-2823DedeCMS mda_main.php cross-site request forgeryDedeCMS
- CVE-2024-2822DedeCMS vote_edit.php cross-site request forgeryDedeCMS
- CVE-2024-29042Translate Cache Poisoning Vulnerabilityfranciscop translate · translate
- CVE-2023-23349Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled crKaspersky Password Manager for Windows
- CVE-2024-2821DedeCMS friendlink_edit.php cross-site request forgeryDedeCMS
- CVE-2024-2820DedeCMS baidunews.php cross-site request forgeryDedeCMS
- CVE-2022-32754IBM Security Verify Directory cross-site scriptingIBM Security Verify Directory
- CVE-2022-32751IBM Security Verify Directory information disclosureIBM Security Verify Directory
- CVE-2022-32756IBM Security Verify Directory information disclosureIBM Security Verify Directory
- CVE-2022-32753IBM Security Verify Directory information disclosureIBM Security Verify Directory
- CVE-2024-2728Information exposure vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-2727Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-2726Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 systemCIGESv2
- CVE-2024-1742Information disclosure in mk_oracle Checkmk agent pluginCheckmk
- CVE-2024-2817Tenda AC15 SysToolRestoreSet fromSysToolRestoreSet cross-site request forgeryTenda AC15
- CVE-2024-2816Tenda AC15 SysToolReboot fromSysToolReboot cross-site request forgeryTenda AC15
- CVE-2024-2812Tenda AC15 WriteFacMac formWriteFacMac os command injectionTenda AC15
- CVE-2024-0957WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels <= 4.4.1 - Unauthenticated Stored Cross-Site ScriptingWebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…
- CVE-2024-2392Blocksy Companion <= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scriptingcreativethemeshq Blocksy Companion
- CVE-2024-2500ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Namethemegrill ColorMag
- CVE-2024-2080LiquidPoll – Polls, Surveys, NPS and Feedback Reviews <= 3.3.76 - Information ExposureLiquidPoll – Polls, Surveys, NPS and Feedback Reviews
- CVE-2024-2780Campcodes Online Marriage Registration System admin-profile.php cross site scriptingCampcodes Online Marriage Registration System
- CVE-2024-2779Campcodes Online Marriage Registration System application-bwdates-reports-details.php cross site scriptingCampcodes Online Marriage Registration System
- CVE-2024-2778Campcodes Online Marriage Registration System search.php cross site scriptingCampcodes Online Marriage Registration System
- CVE-2024-2777Campcodes/PHPGurukul Online Marriage Registration System application-bwdates-reports-details.php sql injectionCampcodes Online Marriage Registration System · PHPGurukul…
- CVE-2024-25168SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the syste
- CVE-2024-25807Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information
- CVE-2024-26557Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter.
- CVE-2024-28560SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea() function of t
- CVE-2024-28593The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leadsmoodle/moodle
- CVE-2024-29271Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and obvvvebjs
- CVE-2024-29272Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and ovvvebJs
- CVE-2024-29273There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document.
- CVE-2024-29338Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2.anchorcms/anchor-cms
- CVE-2024-29865Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form.