CVEs published March 25, 2024
120 CVEs were published on March 25, 2024: 13 critical, 39 high.
- Published
- 120
- Critical
- 13
- High
- 39
- Medium
- 45
- Low
- 2
- Unrated
- 21
- Now in CISA KEV
- 0
- Fix available
- 34
Most affected products
- Linux
- 40
- thorsten phpMyFAQ · phpmyfaq/phpmyfaq
- 7
- KaTeX
- 4
- Muffingroup Betheme
- 4
- CM Download Manager
- 3
- KDDI HGW BL1500HM
- 3
- Rockwell Automation PowerFlex®
- 3
- InspiryThemes RealHomes
- 2
- LG Electronics LG LED Assistant
- 2
- @thi.ng/paths
- 1
Critical 13
- CVE-2024-2873User authentication bypass in wolfSSH serverwolfSSL wolfSSH
- CVE-2024-2865SQLi in Mergen Soft Quality Management SystemMergen Software Quality Management System
- CVE-2021-47168NFS: fix an incorrect limit in filelayout_decode_layout()Linux
- CVE-2021-47162tipc: skb_linearize the head skb when reassembling msgsLinux
- CVE-2021-47137net: lantiq: fix memory corruption in RX ringLinux
- CVE-2024-2862Password reset vulnerability without authorization on LG LED AssistantLG Electronics LG LED Assistant
- CVE-2022-36407Information Exposure Vulnerability in Hitachi Disk Array SystemsHitachi Virtual Storage Platform · Hitachi Unified Storage…
- CVE-2024-28386An issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute arbitrary code via the getPhpBin() component.
- CVE-2024-28393SQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate privileges via the ScalapayReturnModuleFron
- CVE-2024-28421SQL Injection vulnerability in Razor 0.8.0 allows a remote attacker to escalate privileges via the ChannelModel::updateapk method of the cha
- CVE-2024-29303The delete admin users function of SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection
- CVE-2024-29650An issue in @thi.ng/paths v.5.1.62 and before allows a remote attacker to execute arbitrary code via the mutIn and mutInManyUnsafe component@thi.ng/paths
- CVE-2024-29666Insecure Permissions vulnerability in Vehicle Monitoring platform system CMSV6 v.7.31.0.2 through v.7.32.0.3 allows a remote attacker to esc
High 39
- CVE-2024-0901SEGV and out of bounds memory read from malicious packetwolfSSL
- CVE-2024-1973Elevation of privileges vulnerabilityOpenText Secure Content Manager
- CVE-2024-2427Rockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 527Rockwell Automation PowerFlex®
- CVE-2024-2426Rockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 527Rockwell Automation PowerFlex®
- CVE-2024-2425Rockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 527Rockwell Automation PowerFlex®
- CVE-2024-28850WP Crontrol possible RCE when combined with a pre-conditionjohnbillion wp-crontrol · johnbillion/wp-crontrol
- CVE-2024-28107phpMyFAQ SQL injections at insertentry & saveentrythorsten phpMyFAQ · phpmyfaq/phpmyfaq
- CVE-2024-28105phpMyFAQ's File Upload Bypass at Category Image Leads to RCEthorsten phpMyFAQ · phpmyfaq/phpmyfaq
- CVE-2024-27299phpMyFAQ SQL Injection at "Save News"thorsten phpMyFAQ · phpmyfaq/phpmyfaq
- CVE-2024-25002Command Injection in the diagnostics interface of the Bosch Network Synchronizer allows unauthorized users full access to the device.Bosch Network Synchronizer Enterprise · Bosch Network Synch…
- CVE-2024-2864WordPress Youzify - Buddypress Moderation plugin <= 1.2.5 - Unauthenticated Cross Site Scripting (XSS) vulnerabilityKaineLabs Youzify - Buddypress Moderation
- CVE-2021-47179NFSv4: Fix a NULL pointer dereference in pnfs_mark_matching_lsegs_return()Linux
- CVE-2021-47178scsi: target: core: Avoid smp_processor_id() in preemptible codeLinux
- CVE-2021-47175net/sched: fq_pie: fix OOB access in the traffic pathLinux
- CVE-2021-47163tipc: wait and exit until all work queues are doneLinux
- CVE-2021-47160net: dsa: mt7530: fix VLAN traffic leaksLinux
- CVE-2021-47159net: dsa: fix a crash if ->get_sset_count() failsLinux
- CVE-2021-47158net: dsa: sja1105: add error handling in sja1105_setup()Linux
- CVE-2021-47153i2c: i801: Don't generate an interrupt on bus resetLinux
- CVE-2021-47152mptcp: fix data stream corruptionLinux
- CVE-2021-47148octeontx2-pf: fix a buffer overflow in otx2_set_rxfh_context()Linux
- CVE-2021-47142drm/amdgpu: Fix a use-after-freeLinux
- CVE-2021-47136net: zero-initialize tc skb extension on allocationLinux
- CVE-2024-24892Unauthorized RCE in migration-toolsopenEuler migration-tools
- CVE-2024-24899Command injection in aops-zeusopenEuler aops-zeus
- CVE-2024-24897Remote command execution in A-Tune-CollectoropenEuler A-Tune-Collector
- CVE-2024-24890Command injection in ioprobe of gala-gopheropenEuler gala-gopher
- CVE-2021-33632TOCTOU Race Condition problem in iSuladopenEuler iSulad
- CVE-2024-1962CM Download and File Manager < 2.9.1 - Download Edit via CSRFCM Download Manager
- CVE-2024-21505Versions of the package web3-utils before 4.2.1 are vulnerable to Prototype Pollution via the utility functions format and mergeDeep, due toweb3-utils
- CVE-2024-29071HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue.KDDI HGW BL1500HM
- CVE-2024-28041HGW BL1500HM Ver 002.001.013 and earlier allows a network-adjacent unauthenticated attacker to execute an arbitrary command.KDDI HGW BL1500HM
- CVE-2024-28387An issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information via the log.txt component.
- CVE-2024-28434The CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0.3.0.
- CVE-2024-29301SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-admin.php?admin_id=
- CVE-2024-29302SourceCodester PHP Task Management System 1.0 is vulnerable to SQL Injection via update-employee.php.
- CVE-2024-29515File Upload vulnerability in lepton v.7.1.0 allows a remote authenticated attackers to execute arbitrary code via uploading a crafted PHP fi
- CVE-2024-30202In Emacs before 29.3, arbitrary Lisp code is evaluated as part of turning on Org mode.
- CVE-2024-30205In Emacs before 29.3, Org mode considers contents of remote files to be trusted.
Medium, low and unrated 68
- CVE-2024-21914Rockwell Automation - FactoryTalk® View ME on PanelView™ Plus 7 Boot Terminal lack Security ProtectionsRockwell Automation FactoryTalk® View ME
- CVE-2024-29179phpMyFAQ Stored Cross-site Scripting at File Attachmentsthorsten phpMyFAQ · phpmyfaq/phpmyfaq
- CVE-2024-29041Express.js Open Redirect in malformed URLsexpressjs express · express
- CVE-2024-29025Netty HttpPostRequestDecoder can OOMnetty · io.netty:netty-codec-http
- CVE-2024-28246KaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocolsKaTeX
- CVE-2024-28245KaTeX's \includegraphics does not escape filenameKaTeX
- CVE-2024-28244KaTeX's maxExpand bypassed by Unicode sub/superscriptsKaTeX
- CVE-2024-28243KaTeX's maxExpand bypassed by \edefKaTeX
- CVE-2024-28108phpMyFAQ Stored HTML Injection at contentLinkthorsten phpMyFAQ · phpmyfaq/phpmyfaq
- CVE-2024-28106phpMyFAQ Stored XSS at FAQ News Contentthorsten phpMyFAQ · phpmyfaq/phpmyfaq
- CVE-2024-27300phpMyFAQ Stored XSS at user emailthorsten phpMyFAQ · phpmyfaq/phpmyfaq
- CVE-2023-48296OroPlatform's storefront user can access history and most viewed data from matching back-office user with the same IDoroinc orocommerce · oro/customer-portal
- CVE-2023-45824OroPlatform's pinned entity creation form shows pages of other usersoroinc platform · oro/platform
- CVE-2024-28183Anti Rollback bypass with physical access and TOCTOU attackespressif esp-idf
- CVE-2023-25039WordPress Google Maps CP plugin <= 1.0.43 - Missing Authorization Leading To Feedback Submission VulnerabilityCodePeople Google Maps CP
- CVE-2022-38057WordPress TH Advance Product Search plugin <= 1.2.1 - Unauthenticated Plugin Settings Reset vulnerabilityThemeHunk Advance WordPress Search Plugin
- CVE-2023-22699WordPress MainWP Wordfence Extension Plugin <= 4.0.7 - Subscriber+ Arbitrary Plugin Activation VulnerabilityMainWP Wordfence Extension
- CVE-2022-45851WordPress ShareThis Dashboard for Google Analytics plugin <= 3.1.4 - Broken Access Control vulnerabilityShareThis Dashboard for Google Analytics
- CVE-2022-45356WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerabilityMuffingroup Betheme
- CVE-2022-45352WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerabilityMuffingroup Betheme
- CVE-2022-45351WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerabilityMuffingroup Betheme
- CVE-2022-45349WordPress Betheme premium theme <= 26.6.1 - Broken Access Control vulnerabilityMuffingroup Betheme
- CVE-2022-44626WordPress Squirrly SEO (Peaks) plugin <= 12.1.20 - Broken Access Control vulnerabilitySEO Plugin by Squirrly SEO
- CVE-2023-27608WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Broken Access Control vulnerabilityWP Swings Points and Rewards for WooCommerce
- CVE-2021-47180NFC: nci: fix memory leak in nci_allocate_deviceLinux
- CVE-2021-47177iommu/vt-d: Fix sysfs leak in alloc_iommu()Linux
- CVE-2021-47176s390/dasd: add missing discipline functionLinux
- CVE-2021-47174netfilter: nft_set_pipapo_avx2: Add irq_fpu_usable() check, fallback to non-AVX2 versionLinux
- CVE-2021-47173misc/uss720: fix memory leak in uss720_probeLinux
- CVE-2021-47172iio: adc: ad7124: Fix potential overflow due to non sequential channel numbersLinux
- CVE-2021-47171net: usb: fix memory leak in smsc75xx_bindLinux
- CVE-2021-47170USB: usbfs: Don't WARN about excessively large memory allocationsLinux
- CVE-2021-47169serial: rp2: use 'request_firmware' instead of 'request_firmware_nowait'Linux
- CVE-2021-47167NFS: Fix an Oopsable condition in __nfs_pageio_add_request()Linux
- CVE-2021-47166NFS: Don't corrupt the value of pg_bytes_written in nfs_do_recoalesce()Linux
- CVE-2021-47165drm/meson: fix shutdown crash when component not probedLinux
- CVE-2021-47164net/mlx5e: Fix null deref accessing lag devLinux
- CVE-2021-47161spi: spi-fsl-dspi: Fix a resource leak in an error handling pathLinux
- CVE-2021-47151interconnect: qcom: bcm-voter: add a missing of_node_put()Linux
- CVE-2021-47150net: fec: fix the potential memory leak in fec_enet_init()Linux
- CVE-2021-47149net: fujitsu: fix potential null-ptr-derefLinux
- CVE-2021-47147ptp: ocp: Fix a resource leak in an error handling pathLinux
- CVE-2021-47146mld: fix panic in mld_newpack()Linux
- CVE-2021-47145btrfs: do not BUG_ON in link_to_fixup_dirLinux
- CVE-2021-47143net/smc: remove device from smcd_dev_list after failed device_add()Linux
- CVE-2021-47141gve: Add NULL pointer checks when freeing irqs.Linux
- CVE-2021-47140iommu/amd: Clear DMA ops when switching domainLinux
- CVE-2021-47139net: hns3: put off calling register_netdev() until client initialize completeLinux
- CVE-2021-47138cxgb4: avoid accessing registers when clearing filtersLinux
- CVE-2024-25964Dell PowerScale OneFS 9.5.0.x through 9.7.0.x contain a covert timing channel vulnerability.Dell PowerScale OneFS
- CVE-2020-36826AwesomestCode LiveBot parseMessage.js parseSend cross site scriptingAwesomestCode LiveBot
- CVE-2024-2863Path traversal via file upload on LG LED AssistantLG Electronics LG LED Assistant
- CVE-2024-29216Exposed IOCTL with insufficient access control issue exists in cg6kwin2k.sys prior to 2.1.7.0.Sangoma Technologies cg6kwin2k.sys
- CVE-2024-1564Schema Pro < 2.7.16 - Contributor+ Custom Field Accesswp-schema-pro
- CVE-2024-1232CM Download Manager < 2.9.0 - Download Deletion via CSRFCM Download Manager
- CVE-2024-1231CM Download and File Manager < 2.9.0 - Download Unpublish via CSRFCM Download Manager
- CVE-2023-30480WordPress Educenter theme <= 1.5.5 - Broken Access ControlSparkle WP Educenter
- CVE-2023-33923Broken Access Control leading to Arbitrary Plugin Activation in multiple HashThemes themesHashThemes Viral News · HashThemes Viral +1
- CVE-2023-37885WordPress RealHomes theme <= 4.0.2 - Broken Access Control vulnerabilityInspiryThemes RealHomes
- CVE-2023-37886WordPress RealHomes theme <= 4.0.2 - Broken Access Control vulnerabilityInspiryThemes RealHomes
- CVE-2024-29009Cross-site request forgery (CSRF) vulnerability in easy-popup-show all versions allows a remote unauthenticated attacker to hijack the autheAri Susanto easy-popup-show
- CVE-2024-21865HGW BL1500HM Ver 002.001.013 and earlier contains a use of week credentials issue.KDDI HGW BL1500HM
- CVE-2023-47430Stack-buffer-overflow vulnerability in ReadyMedia (MiniDLNA) v1.3.3 allows attackers to cause a denial of service via via the SendContainer(
- CVE-2024-25175An issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP response splitting attack.
- CVE-2024-28435The CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.
- CVE-2024-30187Anope before 2.0.15 does not prevent resetting the password of a suspended account.
- CVE-2024-30203In Emacs before 29.3, Gnus treats inline MIME contents as trusted.
- CVE-2024-30204In Emacs before 29.3, LaTeX preview is enabled by default for e-mail attachments.