# CVEs published 2024-03-22

81 CVEs were published on March 22, 2024: 10 critical, 27 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2024-29059](https://cve.now/CVE-2024-29059.md): .NET Framework Information Disclosure Vulnerability (CVSS 7.5, KEV, Microsoft .NET Framework)
- [CVE-2024-29190](https://cve.now/CVE-2024-29190.md): MobSF SSRF Vulnerability on assetlinks\_check(act\_name, well\_knowns) (CVSS 7.5, Mobile-Security-Framework-MobSF · mobsfscan +1)
- [CVE-2024-29057](https://cve.now/CVE-2024-29057.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 4.3, Microsoft Edge)
- [CVE-2024-26247](https://cve.now/CVE-2024-26247.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 4.7, Microsoft Edge)
- [CVE-2024-2828](https://cve.now/CVE-2024-2828.md): lakernote EasyAdmin IndexController.java thumbnail server-side request forgery (CVSS 6.3, lakernote EasyAdmin)
- [CVE-2024-2827](https://cve.now/CVE-2024-2827.md): lakernote EasyAdmin saveReportFile server-side request forgery (CVSS 6.3, lakernote EasyAdmin)
- [CVE-2024-2826](https://cve.now/CVE-2024-2826.md): lakernote EasyAdmin saveReportFile xml external entity reference (CVSS 6.3, lakernote EasyAdmin)
- [CVE-2024-2825](https://cve.now/CVE-2024-2825.md): lakernote EasyAdmin saveReportFile path traversal (CVSS 6.3, lakernote EasyAdmin)
- [CVE-2023-5685](https://cve.now/CVE-2023-5685.md): Xnio: stackoverflowexception when the chain of notifier states becomes problematically big (CVSS 7.5, Red Hat build of Apache Camel 4.4.0 for Spring Boot · R… +10)
- [CVE-2024-2824](https://cve.now/CVE-2024-2824.md): Matthias-Wandel jhead exif.c PrintFormatNumber heap-based overflow (CVSS 6.3, Matthias-Wandel jhead)
- [CVE-2023-4063](https://cve.now/CVE-2023-4063.md): Certain HP OfficeJet Pro printers are potentially vulnerable to a Denial of Service when using an improper eSCL URL GET request. (CVSS 5.3, Certain HP OfficeJet Pro Printers)
- [CVE-2024-29186](https://cve.now/CVE-2024-29186.md): Slow String Operations via MultiPart Requests in Event-Driven Functions (CVSS 5.3, brefphp bref · bref/bref)
- [CVE-2024-29185](https://cve.now/CVE-2024-29185.md): FreeScout OS Command Injection vulnerability (CVSS 9.1, freescout-helpdesk freescout)
- [CVE-2024-29184](https://cve.now/CVE-2024-29184.md): FreeScout Stored XSS to Privilege Escalation After CSP Bypass (CVSS 8.0, freescout-helpdesk freescout)
- [CVE-2024-2823](https://cve.now/CVE-2024-2823.md): DedeCMS mda\_main.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-2822](https://cve.now/CVE-2024-2822.md): DedeCMS vote\_edit.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-29042](https://cve.now/CVE-2024-29042.md): Translate Cache Poisoning Vulnerability (CVSS 5.3, franciscop translate · translate)
- [CVE-2024-28861](https://cve.now/CVE-2024-28861.md): Gadget chain in Symfony 1 due to uncontrolled unserialized input in sfNamespacedParameterHolder (CVSS 9.8, FriendsOfSymfony1 symfony1 · friendsofsymfony1/symfony1)
- [CVE-2023-23349](https://cve.now/CVE-2023-23349.md): Kaspersky has fixed a security issue in Kaspersky Password Manager (KPM) for Windows that allowed a local user to recover the auto-filled cr (CVSS 2.2, Kaspersky Password Manager for Windows)
- [CVE-2024-2821](https://cve.now/CVE-2024-2821.md): DedeCMS friendlink\_edit.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-2820](https://cve.now/CVE-2024-2820.md): DedeCMS baidunews.php cross-site request forgery (CVSS 4.3, DedeCMS)
- [CVE-2024-2228](https://cve.now/CVE-2024-2228.md): IdentityIQ Authorization of QuickLink Target Identities Vulnerability (CVSS 7.1, SailPoint IdentityIQ)
- [CVE-2024-2227](https://cve.now/CVE-2024-2227.md): IdentityIQ JavaServer Faces File Path Traversal Vulnerability (CVSS 10.0, SailPoint IdentityIQ)
- [CVE-2022-32754](https://cve.now/CVE-2022-32754.md): IBM Security Verify Directory cross-site scripting (CVSS 4.8, IBM Security Verify Directory)
- [CVE-2022-32751](https://cve.now/CVE-2022-32751.md): IBM Security Verify Directory information disclosure (CVSS 5.3, IBM Security Verify Directory)
- [CVE-2022-32756](https://cve.now/CVE-2022-32756.md): IBM Security Verify Directory information disclosure (CVSS 2.7, IBM Security Verify Directory)
- [CVE-2022-32753](https://cve.now/CVE-2022-32753.md): IBM Security Verify Directory information disclosure (CVSS 4.5, IBM Security Verify Directory)
- [CVE-2024-2728](https://cve.now/CVE-2024-2728.md): Information exposure vulnerability in the CIGESv2 system (CVSS 4.1, CIGESv2)
- [CVE-2024-2727](https://cve.now/CVE-2024-2727.md): Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 system (CVSS 6.1, CIGESv2)
- [CVE-2024-2726](https://cve.now/CVE-2024-2726.md): Stored Cross-Site Scripting (Stored-XSS) vulnerability in the CIGESv2 system (CVSS 6.1, CIGESv2)
- [CVE-2024-2449](https://cve.now/CVE-2024-2449.md): LoadMaster Cross-Site Request Forgery (CSRF) (CVSS 7.5, Progress Software LoadMaster)
- [CVE-2024-2725](https://cve.now/CVE-2024-2725.md): Exposure of Sensitive Information vulnerability in the CIGESv2 system (CVSS 7.5, CIGESv2)
- [CVE-2024-2724](https://cve.now/CVE-2024-2724.md): SQL injection vulnerability in the CIGESv2 system (CVSS 9.8, CIGESv2)
- [CVE-2024-2723](https://cve.now/CVE-2024-2723.md): SQL injection vulnerability in the CIGESv2 system (CVSS 9.8, CIGESv2)
- [CVE-2024-2722](https://cve.now/CVE-2024-2722.md): SQL injection vulnerability in the CIGESv2 system (CVSS 9.8, CIGESv2)
- [CVE-2024-2448](https://cve.now/CVE-2024-2448.md): LoadMaster Command Injection Vulnerability (CVSS 8.4, Progress Software LoadMaster)
- [CVE-2024-29944](https://cve.now/CVE-2024-29944.md): An attacker was able to inject an event handler into a privileged object that would allow arbitrary JavaScript execution in the parent proce (CVSS 8.4, Mozilla Firefox)
- [CVE-2024-29943](https://cve.now/CVE-2024-29943.md): An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. (CVSS 9.8, Mozilla Firefox)
- [CVE-2024-1848](https://cve.now/CVE-2024-1848.md): Multiple vulnerabilities exist in file reading procedure in SOLIDWORKS Desktop on Release SOLIDWORKS 2024 (CVSS 7.8, Dassault Systèmes SOLIDWORKS Desktop)
- [CVE-2024-28824](https://cve.now/CVE-2024-28824.md): Privilege escalation in mk\_informix plugin (CVSS 8.8, Checkmk)
- [CVE-2024-1742](https://cve.now/CVE-2024-1742.md): Information disclosure in mk\_oracle Checkmk agent plugin (CVSS 3.8, Checkmk)
- [CVE-2024-0638](https://cve.now/CVE-2024-0638.md): Privilege escalation in mk\_oracle plugins (CVSS 8.2, Checkmk)
- [CVE-2024-2817](https://cve.now/CVE-2024-2817.md): Tenda AC15 SysToolRestoreSet fromSysToolRestoreSet cross-site request forgery (CVSS 4.3, Tenda AC15)
- [CVE-2024-2816](https://cve.now/CVE-2024-2816.md): Tenda AC15 SysToolReboot fromSysToolReboot cross-site request forgery (CVSS 4.3, Tenda AC15)
- [CVE-2024-2815](https://cve.now/CVE-2024-2815.md): Tenda AC15 Cookie execCommand R7WebsSecurityHandler stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-2814](https://cve.now/CVE-2024-2814.md): Tenda AC15 DhcpListClient fromDhcpListClient stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-2813](https://cve.now/CVE-2024-2813.md): Tenda AC15 fast\_setting\_wifi\_set form\_fast\_setting\_wifi\_set stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-2812](https://cve.now/CVE-2024-2812.md): Tenda AC15 WriteFacMac formWriteFacMac os command injection (CVSS 6.3, Tenda AC15)
- [CVE-2024-2811](https://cve.now/CVE-2024-2811.md): Tenda AC15 WifiWpsStart formWifiWpsStart stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-2810](https://cve.now/CVE-2024-2810.md): Tenda AC15 WifiWpsOOB formWifiWpsOOB stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-2809](https://cve.now/CVE-2024-2809.md): Tenda AC15 SetFirewallCfg formSetFirewallCfg stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-2808](https://cve.now/CVE-2024-2808.md): Tenda AC15 QuickIndex formQuickIndex stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-2807](https://cve.now/CVE-2024-2807.md): Tenda AC15 expandDlnaFile formExpandDlnaFile stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-2806](https://cve.now/CVE-2024-2806.md): Tenda AC15 addWifiMacFilter stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-2805](https://cve.now/CVE-2024-2805.md): Tenda AC15 SetSpeedWan formSetSpeedWan stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-0957](https://cve.now/CVE-2024-0957.md): WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels \<= 4.4.1 - Unauthenticated Stored Cross-Site Scripting (CVSS 6.1, WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery…)
- [CVE-2024-2392](https://cve.now/CVE-2024-2392.md): Blocksy Companion \<= 2.0.31 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, creativethemeshq Blocksy Companion)
- [CVE-2024-2500](https://cve.now/CVE-2024-2500.md): ColorMag \<= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name (CVSS 6.4, themegrill ColorMag)
- [CVE-2024-2080](https://cve.now/CVE-2024-2080.md): LiquidPoll – Polls, Surveys, NPS and Feedback Reviews \<= 3.3.76 - Information Exposure (CVSS 4.3, LiquidPoll – Polls, Surveys, NPS and Feedback Reviews)
- [CVE-2024-2780](https://cve.now/CVE-2024-2780.md): Campcodes Online Marriage Registration System admin-profile.php cross site scripting (CVSS 3.5, Campcodes Online Marriage Registration System)
- [CVE-2024-2779](https://cve.now/CVE-2024-2779.md): Campcodes Online Marriage Registration System application-bwdates-reports-details.php cross site scripting (CVSS 3.5, Campcodes Online Marriage Registration System)
- [CVE-2024-2778](https://cve.now/CVE-2024-2778.md): Campcodes Online Marriage Registration System search.php cross site scripting (CVSS 3.5, Campcodes Online Marriage Registration System)
- [CVE-2024-2777](https://cve.now/CVE-2024-2777.md): Campcodes/PHPGurukul Online Marriage Registration System application-bwdates-reports-details.php sql injection (CVSS 5.3, Campcodes Online Marriage Registration System · PHPGurukul…)
- [CVE-2023-41099](https://cve.now/CVE-2023-41099.md): In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.(from a regular user to SYSTEM). (CVSS 7.8)
- [CVE-2024-25168](https://cve.now/CVE-2024-25168.md): SQL injection vulnerability in snow snow v.2.0.0 allows a remote attacker to execute arbitrary code via the dataScope parameter of the syste (CVSS 6.3)
- [CVE-2024-25807](https://cve.now/CVE-2024-25807.md): Cross Site Scripting (XSS) vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information (CVSS 6.1)
- [CVE-2024-25808](https://cve.now/CVE-2024-25808.md): Cross-site Request Forgery (CSRF) vulnerability in Lychee version 3.1.6, allows remote attackers to execute arbitrary code via the create ne (CVSS 8.3)
- [CVE-2024-26557](https://cve.now/CVE-2024-26557.md): Codiad v2.8.4 allows reflected XSS via the components/market/dialog.php type parameter. (CVSS 5.4)
- [CVE-2024-28441](https://cve.now/CVE-2024-28441.md): File Upload vulnerability in magicflue v.7.0 and before allows a remote attacker to execute arbitrary code via a crafted request to the mess (CVSS 9.8)
- [CVE-2024-28559](https://cve.now/CVE-2024-28559.md): SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the setPrice() function of the (CVSS 8.8)
- [CVE-2024-28560](https://cve.now/CVE-2024-28560.md): SQL injection vulnerability in Niushop B2B2C v.5.3.3 and before allows an attacker to escalate privileges via the deleteArea() function of t (CVSS 5.4)
- [CVE-2024-28593](https://cve.now/CVE-2024-28593.md): The Chat activity in Moodle 4.3.3 allows students to insert a potentially unwanted HTML A element or IMG element, or HTML content that leads (CVSS 5.4, moodle/moodle)
- [CVE-2024-29271](https://cve.now/CVE-2024-29271.md): Reflected Cross-Site Scripting (XSS) vulnerability in VvvebJs before version 1.7.7, allows remote attackers to execute arbitrary code and ob (CVSS 6.1, vvvebjs)
- [CVE-2024-29272](https://cve.now/CVE-2024-29272.md): Arbitrary File Upload vulnerability in VvvebJs before version 1.7.5, allows unauthenticated remote attackers to execute arbitrary code and o (CVSS 6.5, vvvebJs)
- [CVE-2024-29273](https://cve.now/CVE-2024-29273.md): There is Stored Cross-Site Scripting (XSS) in dzzoffice 2.02.1 SC UTF8 in uploadfile to index.php, with the XSS payload in an SVG document. (CVSS 6.1)
- [CVE-2024-29275](https://cve.now/CVE-2024-29275.md): SQL injection vulnerability in SeaCMS version 12.9, allows remote unauthenticated attackers to execute arbitrary code and obtain sensitive i (CVSS 9.8)
- [CVE-2024-29338](https://cve.now/CVE-2024-29338.md): Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/categories/delete/2. (CVSS 2.4, anchorcms/anchor-cms)
- [CVE-2024-29366](https://cve.now/CVE-2024-29366.md): A command injection vulnerability exists in the cgibin binary in DIR-845L router firmware \<= v1.01KRb03. (CVSS 8.8)
- [CVE-2024-29385](https://cve.now/CVE-2024-29385.md): DIR-845L router \<= v1.01KRb03 has an Unauthenticated remote code execution vulnerability in the cgibin binary via soapcgi\_main function. (CVSS 9.0)
- [CVE-2024-29499](https://cve.now/CVE-2024-29499.md): Anchor CMS v0.12.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via /anchor/admin/users/delete/2. (CVSS 7.4, anchorcms/anchor-cms)
- [CVE-2024-29865](https://cve.now/CVE-2024-29865.md): Logpoint before 7.1.0 allows Self-XSS on the LDAP authentication page via the username to the LDAP login form. (CVSS 5.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.