# CVEs published 2024-03-24

16 CVEs were published on March 24, 2024: 0 critical, 8 high. Days are UTC.

- [CVE-2024-29188](https://cve.now/CVE-2024-29188.md): Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files (CVSS 7.8, wixtoolset issues · wix +1)
- [CVE-2024-29187](https://cve.now/CVE-2024-29187.md): WiX based installers are vulnerable to binary hijack when run as SYSTEM (CVSS 7.3, wixtoolset issues · wix +1)
- [CVE-2024-29034](https://cve.now/CVE-2024-29034.md): CarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained (CVSS 6.8, carrierwaveuploader carrierwave · carrierwave)
- [CVE-2024-29194](https://cve.now/CVE-2024-29194.md): OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation (CVSS 8.3, oneuptime · @oneuptime/model +1)
- [CVE-2020-36825](https://cve.now/CVE-2020-36825.md): cyberaz0r WebRAT api.php download\_file unrestricted upload (CVSS 5.3, cyberaz0r WebRAT)
- [CVE-2024-2856](https://cve.now/CVE-2024-2856.md): Tenda AC10 SetSysTimeCfg fromSetSysTime stack-based overflow (CVSS 8.8, Tenda AC10)
- [CVE-2024-2855](https://cve.now/CVE-2024-2855.md): Tenda AC15 SetSysTimeCfg fromSetSysTime stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-2854](https://cve.now/CVE-2024-2854.md): Tenda AC18 setsambacfg formSetSambaConf os command injection (CVSS 6.3, Tenda AC18)
- [CVE-2024-2853](https://cve.now/CVE-2024-2853.md): Tenda AC10U setsambacfg formSetSambaConf os command injection (CVSS 6.3, Tenda AC10U)
- [CVE-2024-2852](https://cve.now/CVE-2024-2852.md): Tenda AC15 saveParentControlInfo stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2024-2851](https://cve.now/CVE-2024-2851.md): Tenda AC15 setsambacfg formSetSambaConf os command injection (CVSS 6.3, Tenda AC15)
- [CVE-2024-2850](https://cve.now/CVE-2024-2850.md): Tenda AC15 saveParentControlInfo stack-based overflow (CVSS 8.8, Tenda AC15)
- [CVE-2018-25100](https://cve.now/CVE-2018-25100.md): The Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to multiple similar cookies for the same domain. (CVSS 5.3)
- [CVE-2020-36827](https://cve.now/CVE-2020-36827.md): The XAO::Web module before 1.84 for Perl mishandles \< and \> characters in JSON output during use of json-embed in Web::Action. (CVSS 5.4)
- [CVE-2024-30156](https://cve.now/CVE-2024-30156.md): Varnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise 6 before 6.0.12r6, allows credits exhausti (CVSS 7.5)
- [CVE-2024-30161](https://cve.now/CVE-2024-30161.md): In Qt 6.5.4, 6.5.5, and 6.6.2, QNetworkReply header data might be accessed via a dangling pointer in Qt for WebAssembly (wasm). (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.