CVEs published March 24, 2024
16 CVEs were published on March 24, 2024: 0 critical, 8 high.
- Published
- 16
- Critical
- 0
- High
- 8
- Medium
- 8
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 5
Most affected products
- Tenda AC15
- 4
- wixtoolset issues · wix +1
- 2
- carrierwaveuploader carrierwave · carrierwave
- 1
- cyberaz0r WebRAT
- 1
- oneuptime · @oneuptime/model +1
- 1
- Tenda AC10
- 1
- Tenda AC10U
- 1
- Tenda AC18
- 1
High 8
- CVE-2024-29188Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated fileswixtoolset issues · wix +1
- CVE-2024-29187WiX based installers are vulnerable to binary hijack when run as SYSTEMwixtoolset issues · wix +1
- CVE-2024-29194OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulationoneuptime · @oneuptime/model +1
- CVE-2024-2856Tenda AC10 SetSysTimeCfg fromSetSysTime stack-based overflowTenda AC10
- CVE-2024-2855Tenda AC15 SetSysTimeCfg fromSetSysTime stack-based overflowTenda AC15
- CVE-2024-2852Tenda AC15 saveParentControlInfo stack-based overflowTenda AC15
- CVE-2024-2850Tenda AC15 saveParentControlInfo stack-based overflowTenda AC15
- CVE-2024-30156Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhausti
Medium, low and unrated 8
- CVE-2024-29034CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remainedcarrierwaveuploader carrierwave · carrierwave
- CVE-2020-36825cyberaz0r WebRAT api.php download_file unrestricted uploadcyberaz0r WebRAT
- CVE-2024-2854Tenda AC18 setsambacfg formSetSambaConf os command injectionTenda AC18
- CVE-2024-2853Tenda AC10U setsambacfg formSetSambaConf os command injectionTenda AC10U
- CVE-2024-2851Tenda AC15 setsambacfg formSetSambaConf os command injectionTenda AC15
- CVE-2018-25100The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain.
- CVE-2020-36827The XAO::Web module before 1.84 for Perl mishandles < and > characters in JSON output during use of json-embed in Web::Action.
- CVE-2024-30161In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm).