# CVEs published 2024-03-26

158 CVEs were published on March 26, 2024: 15 critical, 68 high. Days are UTC.

- [CVE-2024-2209](https://cve.now/CVE-2024-2209.md): HP Printer Firmware Update Utility for Certain HP DeskJet Printers - Potential Execution of Arbitrary Code (CVSS 6.3, HP Printer Firmware Update Utility)
- [CVE-2024-2930](https://cve.now/CVE-2024-2930.md): SourceCodester Music Gallery Site unrestricted upload (CVSS 7.3, SourceCodester Music Gallery Site)
- [CVE-2024-25138](https://cve.now/CVE-2024-25138.md): AutomationDirect C-MORE EA9 HMI Plaintext Storage of a Password (CVSS 6.5, AutomationDirect C-MORE EA9 HMI EA9-T6CL · AutomationDir… +9)
- [CVE-2024-2927](https://cve.now/CVE-2024-2927.md): code-projects Mobile Shop Login Page Details.php sql injection (CVSS 7.3, code-projects Mobile Shop)
- [CVE-2024-2917](https://cve.now/CVE-2024-2917.md): Campcodes House Rental Management System index.php file inclusion (CVSS 5.4, Campcodes House Rental Management System)
- [CVE-2024-25137](https://cve.now/CVE-2024-25137.md): AutomationDirect C-MORE EA9 HMI Stack-based Buffer Overflow (CVSS 4.3, AutomationDirect C-MORE EA9 HMI EA9-T6CL · AutomationDir… +9)
- [CVE-2024-25136](https://cve.now/CVE-2024-25136.md): AutomationDirect C-MORE EA9 HMI Path Traversal (CVSS 7.5, AutomationDirect C-MORE EA9 HMI EA9-T6CL · AutomationDir… +9)
- [CVE-2024-2916](https://cve.now/CVE-2024-2916.md): Campcodes House Rental Management System ajax.php sql injection (CVSS 7.3, Campcodes House Rental Management System)
- [CVE-2024-2971](https://cve.now/CVE-2024-2971.md): Out-of-bounds array access due to negative object numbers in indirect references in Xpdf 4.05 (CVSS 2.9, Xpdf)
- [CVE-2024-2911](https://cve.now/CVE-2024-2911.md): Tianjin PubliCMS cross-site request forgery (CVSS 6.9, Tianjin PubliCMS)
- [CVE-2024-2910](https://cve.now/CVE-2024-2910.md): Ruijie RG-EG350 HTTP POST Request vpnAction os command injection (CVSS 6.3, Ruijie RG-EG350)
- [CVE-2024-2909](https://cve.now/CVE-2024-2909.md): Ruijie RG-EG350 HTTP POST Request setAction os command injection (CVSS 8.8, Ruijie RG-EG350)
- [CVE-2023-48777](https://cve.now/CVE-2023-48777.md): WordPress Elementor plugin 3.3.0-3.18.1 - Arbitrary File Upload vulnerability (CVSS 9.9, Elementor.com Elementor Website Builder)
- [CVE-2023-48275](https://cve.now/CVE-2023-48275.md): WordPress Widgets for Google Reviews plugin \<= 11.0.2 - Arbitrary File Upload vulnerability (CVSS 8.0, Trustindex.io Widgets for Google Reviews)
- [CVE-2023-39307](https://cve.now/CVE-2023-39307.md): WordPress Avada theme \<= 7.11.1 - Authenticated Arbitrary File Upload vulnerability (CVSS 8.5, ThemeFusion Avada)
- [CVE-2023-38388](https://cve.now/CVE-2023-38388.md): WordPress Jupiter X Core plugin \<= 3.3.5 - Unauth. Arbitrary File Upload vulnerability (CVSS 9.0, Artbees JupiterX Core)
- [CVE-2023-47873](https://cve.now/CVE-2023-47873.md): WordPress WP Child Theme Generator plugin \<= 1.0.9 - Arbitrary File Upload vulnerability (CVSS 9.1, WEN Solutions WP Child Theme Generator)
- [CVE-2023-47846](https://cve.now/CVE-2023-47846.md): WordPress WP Githuber MD plugin \<= 1.16.2 - Arbitrary File Upload vulnerability (CVSS 9.1, Terry Lin WP Githuber MD)
- [CVE-2024-2903](https://cve.now/CVE-2024-2903.md): Tenda AC7 GetParentControlInfo stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2023-47842](https://cve.now/CVE-2023-47842.md): WordPress CataBlog plugin \<= 1.7.0 - Arbitrary File Upload vulnerability (CVSS 9.1, Zachary Segal CataBlog)
- [CVE-2023-29386](https://cve.now/CVE-2023-29386.md): WordPress Manager for Icomoon plugin \<= 2.0 - Arbitrary File Upload vulnerability (CVSS 9.1, Julien Crego Manager for Icomoon)
- [CVE-2024-26303](https://cve.now/CVE-2024-26303.md): Authenticated Denial of Service Vulnerability in ArubaOS-Switch SSH Daemon (CVSS 4.9, Hewlett Packard Enterprise (HPE) ArubaOS-S Switch)
- [CVE-2023-28787](https://cve.now/CVE-2023-28787.md): WordPress Quiz And Survey Master plugin \<= 8.1.4 - Unauthenticated SQL Injection vulnerability (CVSS 9.3, ExpressTech Quiz And Survey Master)
- [CVE-2023-28687](https://cve.now/CVE-2023-28687.md): Reflected Cross-Site Scripting (XSS) vulnerability in multiple WordPress themes (CVSS 7.1, perfectwpthemes Glaze Blog Lite · themebeez Fascinate +2)
- [CVE-2024-2887](https://cve.now/CVE-2024-2887.md): Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML (CVSS 8.1, Google Chrome)
- [CVE-2024-2886](https://cve.now/CVE-2024-2886.md): Use after free in WebCodecs in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to perform arbitrary read/write via a crafted (CVSS 7.5, Google Chrome)
- [CVE-2024-2885](https://cve.now/CVE-2024-2885.md): Use after free in Dawn in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2024-2883](https://cve.now/CVE-2024-2883.md): Use after free in ANGLE in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to potentially exploit heap corruption via a craft (CVSS 7.5, Google Chrome)
- [CVE-2023-27630](https://cve.now/CVE-2023-27630.md): WordPress Community by PeepSo plugin \<= 6.0.9.0 - Server Information Disclosure (CVSS 5.3, Community by PeepSo)
- [CVE-2024-2955](https://cve.now/CVE-2024-2955.md): Mismatched Memory Management Routines in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2023-27459](https://cve.now/CVE-2023-27459.md): WordPress User Registration plugin \<= 2.3.2.1 - Authenticated PHP Object Injection vulnerability (CVSS 7.4, WPEverest User Registration)
- [CVE-2024-2902](https://cve.now/CVE-2024-2902.md): Tenda AC7 WifiGuestSet fromSetWifiGusetBasic stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2024-2901](https://cve.now/CVE-2024-2901.md): Tenda AC7 openSchedWifi setSchedWifi stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2023-27440](https://cve.now/CVE-2023-27440.md): WordPress Toolset Types plugin \<= 3.4.17 - Authenticated Arbitrary File Upload Vulnerability (CVSS 7.2, OnTheGoSystems Types)
- [CVE-2023-25965](https://cve.now/CVE-2023-25965.md): WordPress Upload Resume plugin \<= 1.2.0 - Sensitive Data Exposure vulnerability (CVSS 5.9, mbbhatti Upload Resume)
- [CVE-2023-23656](https://cve.now/CVE-2023-23656.md): WordPress MainWP File Uploader Extension Plugin \<= 4.1 - Unauthenticated Arbitrary File Upload Vulnerability (CVSS 10.0, MainWP File Uploader Extension)
- [CVE-2023-6091](https://cve.now/CVE-2023-6091.md): WordPress Theme Editor plugin \<= 2.7.1 - Arbitrary File Upload vulnerability (CVSS 7.2, mndpsingh287 Theme Editor)
- [CVE-2024-2900](https://cve.now/CVE-2024-2900.md): Tenda AC7 saveParentControlInfo stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2024-2899](https://cve.now/CVE-2024-2899.md): Tenda AC7 WifiExtraSet fromSetWirelessRepeat stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2024-22436](https://cve.now/CVE-2024-22436.md): A security vulnerability in HPE IceWall Agent products could be exploited remotely to cause a denial of service. (CVSS 6.5, Hewlett Packard Enterprise (HPE) IceWall Gen11, IceWall SSO…)
- [CVE-2024-2898](https://cve.now/CVE-2024-2898.md): Tenda AC7 SetStaticRouteCfg fromSetRouteStatic stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2024-2897](https://cve.now/CVE-2024-2897.md): Tenda AC7 WriteFacMac formWriteFacMac os command injection (CVSS 6.3, Tenda AC7)
- [CVE-2024-2951](https://cve.now/CVE-2024-2951.md): WordPress RegistrationMagic plugin \<= 5.3.0.0 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Metagauss RegistrationMagic)
- [CVE-2024-2896](https://cve.now/CVE-2024-2896.md): Tenda AC7 WifiWpsStart formWifiWpsStart stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2024-26649](https://cve.now/CVE-2024-26649.md): drm/amdgpu: Fix the null pointer when load rlc firmware (no CVSS, Linux)
- [CVE-2024-26648](https://cve.now/CVE-2024-26648.md): drm/amd/display: Fix variable deferencing before NULL check in edp\_setup\_replay() (CVSS 5.5, Linux)
- [CVE-2024-26647](https://cve.now/CVE-2024-26647.md): drm/amd/display: Fix late derefrence 'dsc' check in 'link\_set\_dsc\_pps\_packet()' (no CVSS, Linux)
- [CVE-2024-26646](https://cve.now/CVE-2024-26646.md): thermal: intel: hfi: Add syscore callbacks for system-wide PM (CVSS 7.8, Linux)
- [CVE-2023-52627](https://cve.now/CVE-2023-52627.md): iio: adc: ad7091r: Allow users to configure device events (CVSS 5.5, Linux)
- [CVE-2023-52626](https://cve.now/CVE-2023-52626.md): net/mlx5e: Fix operation precedence bug in port timestamping napi\_poll context (no CVSS, Linux)
- [CVE-2023-52625](https://cve.now/CVE-2023-52625.md): drm/amd/display: Refactor DMCUB enter/exit idle interface (no CVSS, Linux)
- [CVE-2023-52624](https://cve.now/CVE-2023-52624.md): drm/amd/display: Wake DMCUB before executing GPINT commands (no CVSS, Linux)
- [CVE-2024-2895](https://cve.now/CVE-2024-2895.md): Tenda AC7 WifiWpsOOB formWifiWpsOOB stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2024-1313](https://cve.now/CVE-2024-1313.md): Users outside an organization can delete a snapshot with its key (CVSS 6.5, Grafana · github.com/grafana/grafana)
- [CVE-2023-44989](https://cve.now/CVE-2023-44989.md): WordPress CF7 Google Sheets Connector plugin \<= 5.0.5 - Sensitive Data Exposure via Debug Log vulnerability (CVSS 7.5, GSheetConnector CF7 Google Sheets Connector)
- [CVE-2023-52623](https://cve.now/CVE-2023-52623.md): SUNRPC: Fix a suspicious RCU usage warning (CVSS 7.8, Linux)
- [CVE-2023-52622](https://cve.now/CVE-2023-52622.md): ext4: avoid online resizing failures due to oversized flex bg (no CVSS, Linux)
- [CVE-2023-52621](https://cve.now/CVE-2023-52621.md): bpf: Check rcu\_read\_lock\_trace\_held() before calling bpf map helpers (no CVSS, Linux)
- [CVE-2024-2894](https://cve.now/CVE-2024-2894.md): Tenda AC7 SetNetControlList formSetQosBand stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2024-29735](https://cve.now/CVE-2024-29735.md): Apache Airflow: Potentially harmful permission changing by log task handler (CVSS 5.3, Apache Software Foundation Apache Airflow · apache-airflow)
- [CVE-2024-2893](https://cve.now/CVE-2024-2893.md): Tenda AC7 SetOnlineDevName formSetDeviceName stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2024-2892](https://cve.now/CVE-2024-2892.md): Tenda AC7 setcfm formSetCfm stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2024-2212](https://cve.now/CVE-2024-2212.md): Integer wraparounds, under-allocations, and heap buffer overflows in Eclipse ThreadX xQueueCreate() and xQueueCreateSet() (CVSS 7.3, Eclipse Foundation ThreadX)
- [CVE-2024-2929](https://cve.now/CVE-2024-2929.md): Rockwell Automation Arena Simulation Vulnerable To Memory Corruption (CVSS 7.8, Rockwell Automation Arena Simulation)
- [CVE-2024-2921](https://cve.now/CVE-2024-2921.md): Improper access control in PAM vault permissions in Devolutions Server 2024.1.10.0 and earlier allows an authenticated user with access to t (CVSS 9.8, Devolutions Server)
- [CVE-2024-2915](https://cve.now/CVE-2024-2915.md): Improper access control in PAM JIT elevation in Devolutions Server 2024.1.6 and earlier allows an attacker with access to the PAM JIT elevat (CVSS 8.8, Devolutions Server)
- [CVE-2024-21920](https://cve.now/CVE-2024-21920.md): Rockwell Automation Arena Simulation Vulnerable To Buffer Overflow (CVSS 4.4, Rockwell Automation Arena Simulation)
- [CVE-2024-2214](https://cve.now/CVE-2024-2214.md): Missing array size check in \_Mtxinit() in the Xtensa port (CVSS 7.0, Eclipse Foundation ThreadX)
- [CVE-2024-21919](https://cve.now/CVE-2024-21919.md): Rockwell Automation Arena Simulation Vulnerable To Uninitialized Pointer (CVSS 7.8, Rockwell Automation Arena Simulation)
- [CVE-2024-21918](https://cve.now/CVE-2024-21918.md): Rockwell Automation Arena Simulation Vulnerable To Memory Corruption (CVSS 7.8, Rockwell Automation Arena Simulation)
- [CVE-2024-2452](https://cve.now/CVE-2024-2452.md): Integer wraparound, under-allocation, and heap buffer overflow in Eclipse ThreadX NetX Duo \_\_portable\_aligned\_alloc() (CVSS 7.0, Eclipse Foundation ThreadX)
- [CVE-2024-21913](https://cve.now/CVE-2024-21913.md): Rockwell Automation Arena Simulation Vulnerable To Memory Corruption (CVSS 7.8, Rockwell Automation Arena Simulation)
- [CVE-2024-21912](https://cve.now/CVE-2024-21912.md): Rockwell Automation Arena Simulation vulnerable to out of bounds write (CVSS 7.8, Rockwell Automation Arena Simulation)
- [CVE-2024-25956](https://cve.now/CVE-2024-25956.md): Dell Grab for Windows, versions 5.0.4 and below, contains an improper file permissions vulnerability. (CVSS 5.5, Dell Grab for Windows)
- [CVE-2024-29833](https://cve.now/CVE-2024-29833.md): WordPress Photo Gallery Plugin \<= 1.8.21 Stored Cross Site Scripting in UploadHandler (CVSS 5.4, 10Web PhotoGallery)
- [CVE-2024-29810](https://cve.now/CVE-2024-29810.md): WordPress Photo Gallery Plugin \<= 1.8.21 Reflected Cross Site Scripting in editimage\_bwg thumb\_url (CVSS 5.4, 10Web PhotoGallery)
- [CVE-2024-29809](https://cve.now/CVE-2024-29809.md): WordPress Photo Gallery Plugin \<= 1.8.21 Reflected Cross Site Scripting in editimage\_bwg image\_url (CVSS 5.4, 10Web PhotoGallery)
- [CVE-2024-29808](https://cve.now/CVE-2024-29808.md): WordPress Photo Gallery Plugin \<= 1.8.21 Reflected Cross Site Scripting in editimage\_bwg image\_id (CVSS 5.4, 10Web PhotoGallery)
- [CVE-2024-25957](https://cve.now/CVE-2024-25957.md): Dell Grab for Windows, versions 5.0.4 and below, contains a cleartext storage of sensitive information vulnerability in its appsync module. (CVSS 4.8, Dell Grab for Windows)
- [CVE-2024-29832](https://cve.now/CVE-2024-29832.md): WordPress Photo Gallery Plugin \<= 1.8.21 Unauthenticated Reflected Cross Site Scripting in GalleryBox current\_url (CVSS 6.1, 10Web PhotoGallery)
- [CVE-2024-25958](https://cve.now/CVE-2024-25958.md): Dell Grab for Windows, versions up to and including 5.0.4, contain Weak Application Folder Permissions vulnerability. (CVSS 6.7, Dell Grab for Windows)
- [CVE-2024-26645](https://cve.now/CVE-2024-26645.md): tracing: Ensure visibility when inserting an element into tracing\_map (no CVSS, Linux)
- [CVE-2024-26644](https://cve.now/CVE-2024-26644.md): btrfs: don't abort filesystem when attempting to snapshot deleted subvolume (no CVSS, Linux)
- [CVE-2024-29197](https://cve.now/CVE-2024-29197.md): Pimcore Preview Documents are not restricted to logged in users anymore (CVSS 6.5, pimcore)
- [CVE-2024-23482](https://cve.now/CVE-2024-23482.md): ZScalerService Local Privilege Escalation (CVSS 7.0, Zscaler Client Connector)
- [CVE-2023-41973](https://cve.now/CVE-2023-41973.md): Lack of input santization on Zscaler Client Connector enables arbitrary code execution (CVSS 7.3, Zscaler Client Connector)
- [CVE-2023-41972](https://cve.now/CVE-2023-41972.md): Revert password check incorrect type validation (CVSS 7.3, Zscaler Client Connector)
- [CVE-2023-41969](https://cve.now/CVE-2023-41969.md): ZSATrayManager Arbitrary File Deletion (CVSS 7.3, Zscaler Client Connector)
- [CVE-2024-22356](https://cve.now/CVE-2024-22356.md): IBM App Connect Enterprise and IBM Integration Bus for z/OS information disclosure (CVSS 4.9, IBM App Connect Enterprise · IBM Integration Bus)
- [CVE-2023-33855](https://cve.now/CVE-2023-33855.md): IBM Common Cryptographic Architecture information disclosure (CVSS 3.7, IBM Common Cryptographic Architecture)
- [CVE-2024-1455](https://cve.now/CVE-2024-1455.md): Billion Laughs Attack leading to DoS in langchain-ai/langchain (CVSS 5.9, langchain-ai/langchain · langchain-core)
- [CVE-2023-47150](https://cve.now/CVE-2023-47150.md): IBM Common Cryptographic Architecture denial of service (CVSS 7.5, IBM Common Cryptographic Architecture)
- [CVE-2024-2891](https://cve.now/CVE-2024-2891.md): Tenda AC7 QuickIndex formQuickIndex stack-based overflow (CVSS 8.8, Tenda AC7)
- [CVE-2024-29883](https://cve.now/CVE-2024-29883.md): CreateWiki's wiki request suppression ignores the suppression settings set by the suppressor (CVSS 4.9, miraheze CreateWiki)
- [CVE-2024-29881](https://cve.now/CVE-2024-29881.md): TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements (CVSS 4.3, tinymce · tinymce/tinymce)
- [CVE-2024-29203](https://cve.now/CVE-2024-29203.md): TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes (CVSS 4.3, tinymce · tinymce/tinymce)
- [CVE-2024-1933](https://cve.now/CVE-2024-1933.md): Improper symlink resolution in TeamViewer Remote client for macOS (CVSS 7.1, TeamViewer Remote Client)
- [CVE-2023-52214](https://cve.now/CVE-2023-52214.md): WordPress Void Contact Form 7 Widget For Elementor Page Builder plugin \<= 2.3 - Broken Access Control vulnerability (CVSS 4.3, voidCoders Void Contact Form 7 Widget For Elementor Page Bu…)
- [CVE-2024-22156](https://cve.now/CVE-2024-22156.md): WordPress SalesKing plugin \<= 1.6.15 - Unauthenticated Plugin Settings Change vulnerability (CVSS 6.5, SNP Digital SalesKing)
- [CVE-2024-2906](https://cve.now/CVE-2024-2906.md): WordPress Radio Player plugin \<= 2.0.73 - Unauthenticated Broken Access Control vulnerability (CVSS 6.5, SoftLab Radio Player)
- [CVE-2024-30235](https://cve.now/CVE-2024-30235.md): WordPress Multiple Page Generator Plugin – MPG plugin \<= 3.4.0 - Broken Access Control vulnerability (CVSS 4.3, Themeisle Multiple Page Generator Plugin – MPG)
- [CVE-2024-30234](https://cve.now/CVE-2024-30234.md): WordPress WholesaleX plugin \<= 1.3.1 - Broken Access Control vulnerability (CVSS 6.5, Wholesale Team WholesaleX)
- [CVE-2024-30233](https://cve.now/CVE-2024-30233.md): WordPress WholesaleX plugin \<= 1.3.1 - Sensitive Data Exposure on User Export vulnerability (CVSS 6.5, Wholesale Team WholesaleX)
- [CVE-2024-30232](https://cve.now/CVE-2024-30232.md): WordPress Exclusive Addons for Elementor plugin \<= 2.6.9 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Exclusive Addons Elementor)
- [CVE-2024-30231](https://cve.now/CVE-2024-30231.md): WordPress Product Import Export for WooCommerce plugin \<= 2.4.1 - Arbitrary File Upload vulnerability (CVSS 9.1, WebToffee Product Import Export for WooCommerce)
- [CVE-2024-23520](https://cve.now/CVE-2024-23520.md): WordPress PopupAlly plugin \<= 2.1.0 - Broken Access Control vulnerability (CVSS 4.3, AccessAlly PopupAlly)
- [CVE-2024-24711](https://cve.now/CVE-2024-24711.md): WordPress WooCommerce Conversion Tracking plugin \<= 2.0.11 - Broken Access Control vulnerability (CVSS 4.3, weDevs WooCommerce Conversion Tracking)
- [CVE-2024-24718](https://cve.now/CVE-2024-24718.md): WordPress PropertyHive plugin \<= 2.0.6 - Missing Authorization to Non-Arbitrary Plugin Installation vulnerability (CVSS 4.3, PropertyHive)
- [CVE-2024-24719](https://cve.now/CVE-2024-24719.md): WordPress Kikote plugin \<= 1.8.9 - Broken Access Control vulnerability (CVSS 4.3, Uriahs Victor Location Picker at Checkout for WooCommerce)
- [CVE-2024-24799](https://cve.now/CVE-2024-24799.md): WordPress WooCommerce Box Office plugin \<= 1.2.2 - Broken Access Control vulnerability (CVSS 6.5, WooCommerce Box Office)
- [CVE-2024-28126](https://cve.now/CVE-2024-28126.md): Cross-site scripting vulnerability exists in 0ch BBS Script ver.4.00. (CVSS 6.1, Zerochannel 0ch BBS Script)
- [CVE-2024-2904](https://cve.now/CVE-2024-2904.md): WordPress Calliope theme \<= 1.0.33 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Extend Themes Calliope)
- [CVE-2024-28048](https://cve.now/CVE-2024-28048.md): OS command injection vulnerability exists in ffBull ver.4.11, which may allow a remote unauthenticated attacker to execute an arbitrary OS c (CVSS 9.8, Fortunefield ffBull)
- [CVE-2024-28034](https://cve.now/CVE-2024-28034.md): Cross-site scripting vulnerability exists in Mini Thread Version 3.33βi. (CVSS 5.4, Flash CGI Mini Thread)
- [CVE-2024-28033](https://cve.now/CVE-2024-28033.md): OS command injection vulnerability exists in WebProxy 1.7.8 and 1.7.9, which may allow a remote unauthenticated attacker to execute an arbit (CVSS 7.3, LunarNight Laboratory WebProxy)
- [CVE-2024-26018](https://cve.now/CVE-2024-26018.md): Cross-site scripting vulnerability exists in TvRock 0.9t8a. (CVSS 6.1, TvRock)
- [CVE-2024-28131](https://cve.now/CVE-2024-28131.md): EasyRange Ver 1.41 contains an issue with the executable file search path when displaying an extracted file on Explorer, which may lead to l (CVSS 7.8, sira.jp EasyRange)
- [CVE-2024-24805](https://cve.now/CVE-2024-24805.md): WordPress WP Dummy Content Generator plugin \<= 3.1.2 - Broken Access Control vulnerability (CVSS 4.3, Deepak anand WP Dummy Content Generator)
- [CVE-2023-23991](https://cve.now/CVE-2023-23991.md): WordPress Booking Calendar plugin \<= 9.4.3 - SQL Injection (CVSS 7.6, WPdevelop / Oplugins Booking Calendar)
- [CVE-2023-32237](https://cve.now/CVE-2023-32237.md): Auth. Stored Cross-Site Scripting (XSS) vulnerability in TheGem theme by CodexThemes (CVSS 5.4, CodexThemes TheGem)
- [CVE-2023-33322](https://cve.now/CVE-2023-33322.md): WordPress Front End Users plugin \< 3.2.25 - Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Etoile Web Design Front End Users)
- [CVE-2023-7251](https://cve.now/CVE-2023-7251.md): WordPress User Submitted Posts plugin \<= 20230901 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Jeff Starr User Submitted Posts)
- [CVE-2023-45771](https://cve.now/CVE-2023-45771.md): WordPress Contact Form With Captcha plugin \<= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Contact Form With Captcha)
- [CVE-2023-49838](https://cve.now/CVE-2023-49838.md): Cross-Site Request Forgery (CSRF) vulnerability in multiple themes by KlbTheme (CVSS 4.3, KlbTheme Clotya theme · KlbTheme Cosmetsy theme +5)
- [CVE-2023-49839](https://cve.now/CVE-2023-49839.md): Reflected Cross-Site Scripting vulnerability in multiple WordPress components by KlbTheme (CVSS 7.1, KlbTheme Cosmetsy theme · KlbTheme Partdo theme +4)
- [CVE-2023-51416](https://cve.now/CVE-2023-51416.md): WordPress EnvíaloSimple plugin \<= 2.2 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5, EnvialoSimple EnvíaloSimple)
- [CVE-2023-6175](https://cve.now/CVE-2023-6175.md): Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in Wireshark (CVSS 7.8, Wireshark Foundation Wireshark)
- [CVE-2024-2889](https://cve.now/CVE-2024-2889.md): WordPress WP-Lister Lite for Amazon plugin \<= 2.6.11 - Cross Site Scripting (XSS) vulnerability (CVSS 5.9, WP Lab WP-Lister Lite for Amazon)
- [CVE-2024-2888](https://cve.now/CVE-2024-2888.md): WordPress Post and Page Builder by BoldGrid plugin \<= 1.26.2 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, Post and Page Builder by BoldGrid – Visual Drag and Drop Ed…)
- [CVE-2024-2303](https://cve.now/CVE-2024-2303.md): Easy Textillate \<= 2.01 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4, flector Easy Textillate)
- [CVE-2024-1745](https://cve.now/CVE-2024-1745.md): Testimonial Slider \< 2.3.7 - Author+ Settings Update (CVSS 4.3, Testimonial Slider)
- [CVE-2023-7232](https://cve.now/CVE-2023-7232.md): Backup and Restore WordPress \<= 1.45 - Unauthenticated Sensitive Data Exposure (CVSS 5.3, Backup and Restore WordPress)
- [CVE-2024-2170](https://cve.now/CVE-2024-2170.md): VK All in One Expansion Unit \<= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className (CVSS 6.4, kurudrive VK All in One Expansion Unit)
- [CVE-2024-29199](https://cve.now/CVE-2024-29199.md): Unauthenticated views may expose information to anonymous users (CVSS 3.7, nautobot)
- [CVE-2024-0866](https://cve.now/CVE-2024-0866.md): Check & Log Email \<= 1.0.9 - Unauthenticated Hook Injection (CVSS 8.1, checkemail Check & Log Email – Easy Email Testing & Mail lo…)
- [CVE-2024-29196](https://cve.now/CVE-2024-29196.md): phpMyFAQ Path Traversal in Attachments (CVSS 3.8, thorsten phpMyFAQ · phpmyfaq/phpmyfaq)
- [CVE-2024-29195](https://cve.now/CVE-2024-29195.md): Azure C SDK Integer Wraparound Vulnerability (CVSS 6.0, azure-c-shared-utility)
- [CVE-2024-29189](https://cve.now/CVE-2024-29189.md): ansys-geometry-core OS Command Injection vulnerability (CVSS 7.4, pyansys-geometry · ansys-geometry-core)
- [CVE-2024-2732](https://cve.now/CVE-2024-2732.md): Themify Shortcodes \<= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, themifyme Themify Shortcodes)
- [CVE-2017-20190](https://cve.now/CVE-2017-20190.md): Some Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side performance degradation during processing of multi (no CVSS)
- [CVE-2023-50702](https://cve.now/CVE-2023-50702.md): Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users (and low-privileged u (CVSS 8.8)
- [CVE-2023-50894](https://cve.now/CVE-2023-50894.md): In Janitza GridVis through 9.0.66, use of hard-coded credentials in the de.janitza.pasw.feature.impl.activators.PasswordEncryption password (CVSS 8.8)
- [CVE-2023-50895](https://cve.now/CVE-2023-50895.md): In Janitza GridVis through 9.0.66, exposed dangerous methods in the de.janitza.pasw.project.server.ServerDatabaseProject project load functi (CVSS 7.2)
- [CVE-2023-51146](https://cve.now/CVE-2023-51146.md): Buffer Overflow vulnerability in TRENDnet AC1200 TEW-821DAP with firmware version 3.00b06 allows an attacker to execute arbitrary code via t (CVSS 8.0)
- [CVE-2023-51147](https://cve.now/CVE-2023-51147.md): Buffer Overflow vulnerability in TRENDnet Trendnet AC1200 TEW-821DAP with firmware version 3.00b06 allows an attacker to execute arbitrary c (CVSS 8.0)
- [CVE-2023-51148](https://cve.now/CVE-2023-51148.md): An issue in TRENDnet Trendnet AC1200 Dual Band PoE Indoor Wireless Access Point TEW-821DAP v.3.00b06 allows an attacker to execute arbitrary (CVSS 8.0)
- [CVE-2024-23722](https://cve.now/CVE-2024-23722.md): In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the content type of x-www-form- (CVSS 7.5)
- [CVE-2024-25420](https://cve.now/CVE-2024-25420.md): An issue in Ignite Realtime Openfire before 4.8.1 allows a remote attacker to escalate privileges via the admin.authorizedJIDs system proper (CVSS 7.2, org.igniterealtime.openfire:xmppserver)
- [CVE-2024-25421](https://cve.now/CVE-2024-25421.md): An issue in Ignite Realtime Openfire v.4.9.0 and before allows a remote attacker to escalate privileges via the ROOM\_CACHE component. (CVSS 9.8, org.igniterealtime.openfire:xmppserver)
- [CVE-2024-26577](https://cve.now/CVE-2024-26577.md): VSeeFace through 1.13.38.c2 allows attackers to cause a denial of service (application hang) via a spoofed UDP packet containing at least 10 (CVSS 7.5)
- [CVE-2024-27521](https://cve.now/CVE-2024-27521.md): TOTOLINK A3300R V17.0.0cu.557\_B20221024 was discovered to contain an unauthenticated remote command execution (RCE) vulnerability via multip (CVSS 8.0)
- [CVE-2024-28093](https://cve.now/CVE-2024-28093.md): The TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has default credentials for a root-level account (CVSS 8.8)
- [CVE-2024-28442](https://cve.now/CVE-2024-28442.md): Directory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate attacker to obtain sensitive information via t (CVSS 7.5)
- [CVE-2024-28545](https://cve.now/CVE-2024-28545.md): Tenda AC18 V15.03.05.05 contains a command injection vulnerablility in the deviceName parameter of formsetUsbUnload function. (CVSS 9.8)
- [CVE-2024-28551](https://cve.now/CVE-2024-28551.md): Tenda AC18 V15.03.05.05 has a stack overflow vulnerability in the ssid parameter of form\_fast\_setting\_wifi\_set function. (CVSS 7.5)
- [CVE-2024-29401](https://cve.now/CVE-2024-29401.md): xzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the session of a deleted admin to do anything. (CVSS 9.8)
- [CVE-2024-29644](https://cve.now/CVE-2024-29644.md): Cross Site Scripting vulnerability in dcat-admin v.2.1.3 and before allows a remote attacker to execute arbitrary code via a crafted script (CVSS 6.1, dcat/laravel-admin)
- [CVE-2024-29684](https://cve.now/CVE-2024-29684.md): DedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src/dede/makehtml\_homepage.php allowing a remo (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.