CVEs published March 26, 2024
158 CVEs were published on March 26, 2024: 15 critical, 68 high.
- Published
- 158
- Critical
- 15
- High
- 68
- Medium
- 61
- Low
- 4
- Unrated
- 10
- Now in CISA KEV
- 0
- Fix available
- 36
Most affected products
- Linux
- 13
- Tenda AC7
- 13
- Rockwell Automation Arena Simulation
- 6
- 10Web PhotoGallery
- 5
- Google Chrome
- 4
- Zscaler Client Connector
- 4
- AutomationDirect C-MORE EA9 HMI EA9-T6CL · AutomationDir… +9
- 3
- Dell Grab for Windows
- 3
- Eclipse Foundation ThreadX
- 3
- Campcodes House Rental Management System
- 2
Critical 15
- CVE-2023-48777WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerabilityElementor.com Elementor Website Builder
- CVE-2023-38388WordPress Jupiter X Core plugin <= 3.3.5 - Unauth. Arbitrary File Upload vulnerabilityArtbees JupiterX Core
- CVE-2023-47873WordPress WP Child Theme Generator plugin <= 1.0.9 - Arbitrary File Upload vulnerabilityWEN Solutions WP Child Theme Generator
- CVE-2023-47846WordPress WP Githuber MD plugin <= 1.16.2 - Arbitrary File Upload vulnerabilityTerry Lin WP Githuber MD
- CVE-2023-47842WordPress CataBlog plugin <= 1.7.0 - Arbitrary File Upload vulnerabilityZachary Segal CataBlog
- CVE-2023-29386WordPress Manager for Icomoon plugin <= 2.0 - Arbitrary File Upload vulnerabilityJulien Crego Manager for Icomoon
- CVE-2023-28787WordPress Quiz And Survey Master plugin <= 8.1.4 - Unauthenticated SQL Injection vulnerabilityExpressTech Quiz And Survey Master
- CVE-2023-23656WordPress MainWP File Uploader Extension Plugin <= 4.1 - Unauthenticated Arbitrary File Upload VulnerabilityMainWP File Uploader Extension
- CVE-2024-2921Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to tDevolutions Server
- CVE-2024-30231WordPress Product Import Export for WooCommerce plugin <= 2.4.1 - Arbitrary File Upload vulnerabilityWebToffee Product Import Export for WooCommerce
- CVE-2024-28048OS command injection vulnerability exists in ffBull ver.4.11, which may allow a remote unauthenticated attacker to execute an arbitrary OS cFortunefield ffBull
- CVE-2024-25421An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM_CACHE component.org.igniterealtime.openfire:xmppserver
- CVE-2024-28545Tenda AC18 V15.03.05.05 contains a command injection vulnerablility in the deviceName parameter of formsetUsbUnload function.
- CVE-2024-29401xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything.
- CVE-2024-29684DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml_homepage.php allowing a remo
High 68
- CVE-2024-2930SourceCodester Music Gallery Site unrestricted uploadSourceCodester Music Gallery Site
- CVE-2024-2927code-projects Mobile Shop Login Page Details.php sql injectioncode-projects Mobile Shop
- CVE-2024-25136AutomationDirect C-MORE EA9 HMI Path TraversalAutomationDirect C-MORE EA9 HMI EA9-T6CL · AutomationDir… +9
- CVE-2024-2916Campcodes House Rental Management System ajax.php sql injectionCampcodes House Rental Management System
- CVE-2024-2909Ruijie RG-EG350 HTTP POST Request setAction os command injectionRuijie RG-EG350
- CVE-2023-48275WordPress Widgets for Google Reviews plugin <= 11.0.2 - Arbitrary File Upload vulnerabilityTrustindex.io Widgets for Google Reviews
- CVE-2023-39307WordPress Avada theme <= 7.11.1 - Authenticated Arbitrary File Upload vulnerabilityThemeFusion Avada
- CVE-2024-2903Tenda AC7 GetParentControlInfo stack-based overflowTenda AC7
- CVE-2023-28687Reflected Cross-Site Scripting (XSS) vulnerability in multiple WordPress themesperfectwpthemes Glaze Blog Lite · themebeez Fascinate +2
- CVE-2024-2887Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTMLGoogle Chrome
- CVE-2024-2886Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted Google Chrome
- CVE-2024-2885Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2024-2883Use after free in ANGLE in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a craftGoogle Chrome
- CVE-2024-2955Mismatched Memory Management Routines in WiresharkWireshark Foundation Wireshark
- CVE-2023-27459WordPress User Registration plugin <= 2.3.2.1 - Authenticated PHP Object Injection vulnerabilityWPEverest User Registration
- CVE-2024-2902Tenda AC7 WifiGuestSet fromSetWifiGusetBasic stack-based overflowTenda AC7
- CVE-2024-2901Tenda AC7 openSchedWifi setSchedWifi stack-based overflowTenda AC7
- CVE-2023-27440WordPress Toolset Types plugin <= 3.4.17 - Authenticated Arbitrary File Upload VulnerabilityOnTheGoSystems Types
- CVE-2023-6091WordPress Theme Editor plugin <= 2.7.1 - Arbitrary File Upload vulnerabilitymndpsingh287 Theme Editor
- CVE-2024-2900Tenda AC7 saveParentControlInfo stack-based overflowTenda AC7
- CVE-2024-2899Tenda AC7 WifiExtraSet fromSetWirelessRepeat stack-based overflowTenda AC7
- CVE-2024-2898Tenda AC7 SetStaticRouteCfg fromSetRouteStatic stack-based overflowTenda AC7
- CVE-2024-2896Tenda AC7 WifiWpsStart formWifiWpsStart stack-based overflowTenda AC7
- CVE-2024-26646thermal: intel: hfi: Add syscore callbacks for system-wide PMLinux
- CVE-2024-2895Tenda AC7 WifiWpsOOB formWifiWpsOOB stack-based overflowTenda AC7
- CVE-2023-44989WordPress CF7 Google Sheets Connector plugin <= 5.0.5 - Sensitive Data Exposure via Debug Log vulnerabilityGSheetConnector CF7 Google Sheets Connector
- CVE-2023-52623SUNRPC: Fix a suspicious RCU usage warningLinux
- CVE-2024-2894Tenda AC7 SetNetControlList formSetQosBand stack-based overflowTenda AC7
- CVE-2024-2893Tenda AC7 SetOnlineDevName formSetDeviceName stack-based overflowTenda AC7
- CVE-2024-2892Tenda AC7 setcfm formSetCfm stack-based overflowTenda AC7
- CVE-2024-2212Integer wraparounds, under-allocations, and heap buffer overflows in Eclipse ThreadX xQueueCreate() and xQueueCreateSet()Eclipse Foundation ThreadX
- CVE-2024-2929Rockwell Automation Arena Simulation Vulnerable To Memory CorruptionRockwell Automation Arena Simulation
- CVE-2024-2915Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevatDevolutions Server
- CVE-2024-2214Missing array size check in _Mtxinit() in the Xtensa portEclipse Foundation ThreadX
- CVE-2024-21919Rockwell Automation Arena Simulation Vulnerable To Uninitialized PointerRockwell Automation Arena Simulation
- CVE-2024-21918Rockwell Automation Arena Simulation Vulnerable To Memory CorruptionRockwell Automation Arena Simulation
- CVE-2024-2452Integer wraparound, under-allocation, and heap buffer overflow in Eclipse ThreadX NetX Duo __portable_aligned_alloc()Eclipse Foundation ThreadX
- CVE-2024-21913Rockwell Automation Arena Simulation Vulnerable To Memory CorruptionRockwell Automation Arena Simulation
- CVE-2024-21912Rockwell Automation Arena Simulation vulnerable to out of bounds writeRockwell Automation Arena Simulation
- CVE-2024-23482ZScalerService Local Privilege EscalationZscaler Client Connector
- CVE-2023-41973Lack of input santization on Zscaler Client Connector enables arbitrary code executionZscaler Client Connector
- CVE-2023-41972Revert password check incorrect type validationZscaler Client Connector
- CVE-2023-41969ZSATrayManager Arbitrary File DeletionZscaler Client Connector
- CVE-2023-47150IBM Common Cryptographic Architecture denial of serviceIBM Common Cryptographic Architecture
- CVE-2024-2891Tenda AC7 QuickIndex formQuickIndex stack-based overflowTenda AC7
- CVE-2024-1933Improper symlink resolution in TeamViewer Remote client for macOSTeamViewer Remote Client
- CVE-2024-28033OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbitLunarNight Laboratory WebProxy
- CVE-2024-28131EasyRange Ver 1.41 contains an issue with the executable file search path when displaying an extracted file on Explorer, which may lead to lsira.jp EasyRange
- CVE-2023-23991WordPress Booking Calendar plugin <= 9.4.3 - SQL InjectionWPdevelop / Oplugins Booking Calendar
- CVE-2023-33322WordPress Front End Users plugin < 3.2.25 - Cross Site Scripting (XSS) vulnerabilityEtoile Web Design Front End Users
- CVE-2023-45771WordPress Contact Form With Captcha plugin <= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerabilityContact Form With Captcha
- CVE-2023-49839Reflected Cross-Site Scripting vulnerability in multiple WordPress components by KlbThemeKlbTheme Cosmetsy theme · KlbTheme Partdo theme +4
- CVE-2023-6175Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in WiresharkWireshark Foundation Wireshark
- CVE-2024-0866Check & Log Email <= 1.0.9 - Unauthenticated Hook Injectioncheckemail Check & Log Email – Easy Email Testing & Mail lo…
- CVE-2024-29189ansys-geometry-core OS Command Injection vulnerabilitypyansys-geometry · ansys-geometry-core
- CVE-2023-50702Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users (and low-privileged u
- CVE-2023-50894In Janitza GridVis through 9.0.66, use of hard-coded credentials in the de.janitza.pasw.feature.impl.activators.PasswordEncryption password
- CVE-2023-50895In Janitza GridVis through 9.0.66, exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject project load functi
- CVE-2023-51146Buffer Overflow vulnerability in TRENDnet AC1200 TEW-821DAP with firmware version 3.00b06 allows an attacker to execute arbitrary code via t
- CVE-2023-51147Buffer Overflow vulnerability in TRENDnet Trendnet AC1200 TEW-821DAP with firmware version 3.00b06 allows an attacker to execute arbitrary c
- CVE-2023-51148An issue in TRENDnet Trendnet AC1200 Dual Band PoE Indoor Wireless Access Point TEW-821DAP v.3.00b06 allows an attacker to execute arbitrary
- CVE-2024-23722In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form-
- CVE-2024-25420An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system properorg.igniterealtime.openfire:xmppserver
- CVE-2024-26577VSeeFace through 1.13.38.c2 allows attackers to cause a denial of service (application hang) via a spoofed UDP packet containing at least 10
- CVE-2024-27521TOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multip
- CVE-2024-28093The TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has default credentials for a root-level account
- CVE-2024-28442Directory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate attacker to obtain sensitive information via t
- CVE-2024-28551Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the ssid parameter of form_fast_setting_wifi_set function.
Medium, low and unrated 75
- CVE-2024-2209HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary CodeHP Printer Firmware Update Utility
- CVE-2024-25138AutomationDirect C-MORE EA9 HMI Plaintext Storage of a PasswordAutomationDirect C-MORE EA9 HMI EA9-T6CL · AutomationDir… +9
- CVE-2024-2917Campcodes House Rental Management System index.php file inclusionCampcodes House Rental Management System
- CVE-2024-25137AutomationDirect C-MORE EA9 HMI Stack-based Buffer OverflowAutomationDirect C-MORE EA9 HMI EA9-T6CL · AutomationDir… +9
- CVE-2024-2971Out-of-bounds array access due to negative object numbers in indirect references in Xpdf 4.05Xpdf
- CVE-2024-2911Tianjin PubliCMS cross-site request forgeryTianjin PubliCMS
- CVE-2024-2910Ruijie RG-EG350 HTTP POST Request vpnAction os command injectionRuijie RG-EG350
- CVE-2024-26303Authenticated Denial of Service Vulnerability in ArubaOS-Switch SSH Daemon Hewlett Packard Enterprise (HPE) ArubaOS-S Switch
- CVE-2023-27630WordPress Community by PeepSo plugin <= 6.0.9.0 - Server Information DisclosureCommunity by PeepSo
- CVE-2023-25965WordPress Upload Resume plugin <= 1.2.0 - Sensitive Data Exposure vulnerabilitymbbhatti Upload Resume
- CVE-2024-22436A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a denial of service.Hewlett Packard Enterprise (HPE) IceWall Gen11, IceWall SSO…
- CVE-2024-2897Tenda AC7 WriteFacMac formWriteFacMac os command injectionTenda AC7
- CVE-2024-2951WordPress RegistrationMagic plugin <= 5.3.0.0 - Cross Site Request Forgery (CSRF) vulnerabilityMetagauss RegistrationMagic
- CVE-2024-26649drm/amdgpu: Fix the null pointer when load rlc firmwareLinux
- CVE-2024-26648drm/amd/display: Fix variable deferencing before NULL check in edp_setup_replay()Linux
- CVE-2024-26647drm/amd/display: Fix late derefrence 'dsc' check in 'link_set_dsc_pps_packet()'Linux
- CVE-2023-52627iio: adc: ad7091r: Allow users to configure device eventsLinux
- CVE-2023-52626net/mlx5e: Fix operation precedence bug in port timestamping napi_poll contextLinux
- CVE-2023-52625drm/amd/display: Refactor DMCUB enter/exit idle interfaceLinux
- CVE-2023-52624drm/amd/display: Wake DMCUB before executing GPINT commandsLinux
- CVE-2024-1313Users outside an organization can delete a snapshot with its keyGrafana · github.com/grafana/grafana
- CVE-2023-52622ext4: avoid online resizing failures due to oversized flex bgLinux
- CVE-2023-52621bpf: Check rcu_read_lock_trace_held() before calling bpf map helpersLinux
- CVE-2024-29735Apache Airflow: Potentially harmful permission changing by log task handlerApache Software Foundation Apache Airflow · apache-airflow
- CVE-2024-21920Rockwell Automation Arena Simulation Vulnerable To Buffer OverflowRockwell Automation Arena Simulation
- CVE-2024-25956Dell Grab for Windows, versions 5.0.4 and below, contains an improper file permissions vulnerability.Dell Grab for Windows
- CVE-2024-29833WordPress Photo Gallery Plugin <= 1.8.21 Stored Cross Site Scripting in UploadHandler10Web PhotoGallery
- CVE-2024-29810WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg thumb_url10Web PhotoGallery
- CVE-2024-29809WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_url10Web PhotoGallery
- CVE-2024-29808WordPress Photo Gallery Plugin <= 1.8.21 Reflected Cross Site Scripting in editimage_bwg image_id10Web PhotoGallery
- CVE-2024-25957Dell Grab for Windows, versions 5.0.4 and below, contains a cleartext storage of sensitive information vulnerability in its appsync module.Dell Grab for Windows
- CVE-2024-29832WordPress Photo Gallery Plugin <= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current_url10Web PhotoGallery
- CVE-2024-25958Dell Grab for Windows, versions up to and including 5.0.4, contain Weak Application Folder Permissions vulnerability.Dell Grab for Windows
- CVE-2024-26645tracing: Ensure visibility when inserting an element into tracing_mapLinux
- CVE-2024-26644btrfs: don't abort filesystem when attempting to snapshot deleted subvolumeLinux
- CVE-2024-29197Pimcore Preview Documents are not restricted to logged in users anymorepimcore
- CVE-2024-22356IBM App Connect Enterprise and IBM Integration Bus for z/OS information disclosureIBM App Connect Enterprise · IBM Integration Bus
- CVE-2023-33855IBM Common Cryptographic Architecture information disclosureIBM Common Cryptographic Architecture
- CVE-2024-1455Billion Laughs Attack leading to DoS in langchain-ai/langchainlangchain-ai/langchain · langchain-core
- CVE-2024-29883CreateWiki's wiki request suppression ignores the suppression settings set by the suppressormiraheze CreateWiki
- CVE-2024-29881TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elementstinymce · tinymce/tinymce
- CVE-2024-29203TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframestinymce · tinymce/tinymce
- CVE-2023-52214WordPress Void Contact Form 7 Widget For Elementor Page Builder plugin <= 2.3 - Broken Access Control vulnerabilityvoidCoders Void Contact Form 7 Widget For Elementor Page Bu…
- CVE-2024-22156WordPress SalesKing plugin <= 1.6.15 - Unauthenticated Plugin Settings Change vulnerabilitySNP Digital SalesKing
- CVE-2024-2906WordPress Radio Player plugin <= 2.0.73 - Unauthenticated Broken Access Control vulnerabilitySoftLab Radio Player
- CVE-2024-30235WordPress Multiple Page Generator Plugin – MPG plugin <= 3.4.0 - Broken Access Control vulnerabilityThemeisle Multiple Page Generator Plugin – MPG
- CVE-2024-30234WordPress WholesaleX plugin <= 1.3.1 - Broken Access Control vulnerabilityWholesale Team WholesaleX
- CVE-2024-30233WordPress WholesaleX plugin <= 1.3.1 - Sensitive Data Exposure on User Export vulnerabilityWholesale Team WholesaleX
- CVE-2024-30232WordPress Exclusive Addons for Elementor plugin <= 2.6.9 - Cross Site Scripting (XSS) vulnerabilityExclusive Addons Elementor
- CVE-2024-23520WordPress PopupAlly plugin <= 2.1.0 - Broken Access Control vulnerabilityAccessAlly PopupAlly
- CVE-2024-24711WordPress WooCommerce Conversion Tracking plugin <= 2.0.11 - Broken Access Control vulnerabilityweDevs WooCommerce Conversion Tracking
- CVE-2024-24718WordPress PropertyHive plugin <= 2.0.6 - Missing Authorization to Non-Arbitrary Plugin Installation vulnerabilityPropertyHive
- CVE-2024-24719WordPress Kikote plugin <= 1.8.9 - Broken Access Control vulnerabilityUriahs Victor Location Picker at Checkout for WooCommerce
- CVE-2024-24799WordPress WooCommerce Box Office plugin <= 1.2.2 - Broken Access Control vulnerabilityWooCommerce Box Office
- CVE-2024-28126Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00.Zerochannel 0ch BBS Script
- CVE-2024-2904WordPress Calliope theme <= 1.0.33 - Cross Site Request Forgery (CSRF) vulnerabilityExtend Themes Calliope
- CVE-2024-28034Cross-site scripting vulnerability exists in Mini Thread Version 3.33βi.Flash CGI Mini Thread
- CVE-2024-26018Cross-site scripting vulnerability exists in TvRock 0.9t8a.TvRock
- CVE-2024-24805WordPress WP Dummy Content Generator plugin <= 3.1.2 - Broken Access Control vulnerabilityDeepak anand WP Dummy Content Generator
- CVE-2023-32237Auth. Stored Cross-Site Scripting (XSS) vulnerability in TheGem theme by CodexThemesCodexThemes TheGem
- CVE-2023-7251WordPress User Submitted Posts plugin <= 20230901 - Cross Site Scripting (XSS) vulnerabilityJeff Starr User Submitted Posts
- CVE-2023-49838Cross-Site Request Forgery (CSRF) vulnerability in multiple themes by KlbThemeKlbTheme Clotya theme · KlbTheme Cosmetsy theme +5
- CVE-2023-51416WordPress EnvíaloSimple plugin <= 2.2 - Cross Site Request Forgery (CSRF) vulnerabilityEnvialoSimple EnvíaloSimple
- CVE-2024-2889WordPress WP-Lister Lite for Amazon plugin <= 2.6.11 - Cross Site Scripting (XSS) vulnerabilityWP Lab WP-Lister Lite for Amazon
- CVE-2024-2888WordPress Post and Page Builder by BoldGrid plugin <= 1.26.2 - Cross Site Scripting (XSS) vulnerabilityPost and Page Builder by BoldGrid – Visual Drag and Drop Ed…
- CVE-2024-2303Easy Textillate <= 2.01 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcodeflector Easy Textillate
- CVE-2024-1745Testimonial Slider < 2.3.7 - Author+ Settings UpdateTestimonial Slider
- CVE-2023-7232Backup and Restore WordPress <= 1.45 - Unauthenticated Sensitive Data ExposureBackup and Restore WordPress
- CVE-2024-2170VK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via classNamekurudrive VK All in One Expansion Unit
- CVE-2024-29199Unauthenticated views may expose information to anonymous usersnautobot
- CVE-2024-29196phpMyFAQ Path Traversal in Attachmentsthorsten phpMyFAQ · phpmyfaq/phpmyfaq
- CVE-2024-29195Azure C SDK Integer Wraparound Vulnerabilityazure-c-shared-utility
- CVE-2024-2732Themify Shortcodes <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingthemifyme Themify Shortcodes
- CVE-2017-20190Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multi
- CVE-2024-29644Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script dcat/laravel-admin