CVEs published March 28, 2024
180 CVEs were published on March 28, 2024: 28 critical, 64 high.
- Published
- 180
- Critical
- 28
- High
- 64
- Medium
- 85
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 50
Most affected products
- Synology Surveillance Station
- 15
- NEC WG1800HP4 · NEC WG1200HS3 +56
- 12
- Dell PowerScale OneFS
- 7
- JetBrains TeamCity
- 7
- Apple macOS
- 5
- Apple iOS and iPadOS · Apple macOS +2
- 3
- HCL Software BigFix Platform
- 3
- Pz-LinkCard
- 3
- SourceCodester Simple Subscription Website
- 3
- Apple iOS and iPadOS · Apple macOS
- 2
Critical 28
- CVE-2023-6437Authenticated RCETP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD…
- CVE-2024-29241Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows remSynology Surveillance Station
- CVE-2024-2890WordPress Tumult Hype Animations plugin <= 1.9.12 - Arbitrary File Upload vulnerabilityTumult Hype Animations
- CVE-2024-29100WordPress AI Engine plugin <= 2.1.4 - Arbitrary File Upload vulnerabilityJordy Meow AI Engine: ChatGPT Chatbot
- CVE-2024-30223WordPress ARMember plugin <= 4.0.26 - Unauthenticated PHP Object Injection vulnerabilityRepute Infosystems ARMember
- CVE-2024-30224WordPress WholesaleX plugin <= 1.3.2 - Unauthenticated PHP Object Injection vulnerabilityWholesale Team WholesaleX
- CVE-2024-30225WordPress WP Migrate plugin <= 2.6.10 - Unauthenticated PHP Object Injection vulnerabilityWPENGINE WP Migrate
- CVE-2024-30226WordPress BetterDocs plugin <= 3.3.3 - Unauthenticated PHP Object Injection vulnerabilityWPDeveloper BetterDocs
- CVE-2024-30227WordPress Geo Controller plugin <= 8.6.4 - PHP Object Injection vulnerabilityINFINITUM FORM Geo Controller
- CVE-2024-30228WordPress Hercules Core plugin <= 6.4 - Auth. PHP Object Injection vulnerabilityHercules Design Hercules Core
- CVE-2024-28014Stack-based Buffer Overflow vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HNEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2024-28015Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WGNEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2024-28012Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WNEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2024-28011Hidden Functionality vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG12NEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2024-28010Use of Hard-coded Password in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, WNEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2024-28009Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WNEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2024-28008Active Debug Code in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MNEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2024-28007Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WNEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2023-50969Thales Imperva SecureSphere WAF 14.7.0.40 allows remote attackers to bypass WAF rules via a crafted POST request, a different vulnerability
- CVE-2024-28456Cross Site Scripting vulnerability in Campcodes Online Marriage Registration System v.1.0 allows a remote attacker to execute arbitrary code
- CVE-2024-28713An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature.
- CVE-2024-30584Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function.
- CVE-2024-30587Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function.
- CVE-2024-30589Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability in the entrys parameter of the fromAddressNat function.
- CVE-2024-30593Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability located in the deviceName parameter of the formSetDeviceName function.
- CVE-2024-30595Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the addWifiMacFilter function.
- CVE-2024-30596Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the formSetDeviceName function.
- CVE-2024-30602Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function.
High 64
- CVE-2024-25955Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability.Dell Virtual Appliance (vApp) Manager
- CVE-2024-25946Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability.Dell Virtual Appliance (vApp) Manager
- CVE-2024-3019Pcp: exposure of the redis server backend allows remote command execution via pmproxypcp · Red Hat Enterprise Linux
- CVE-2024-2947Cockpit: command injection when deleting a sosreport with a crafted namecockpit · Red Hat Enterprise Linux
- CVE-2024-25960Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability.Dell PowerScale OneFS
- CVE-2024-25959Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an insertion of sensitive information into log file vulnerability.Dell PowerScale OneFS
- CVE-2023-42931The issue was addressed with improved checks.Apple macOS
- CVE-2023-42950A use after free issue was addressed with improved memory management.Apple Safari · Apple iOS and iPadOS +3
- CVE-2023-42947A path handling issue was addressed with improved validation.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-42913This issue was addressed through improved state management.Apple macOS
- CVE-2023-42974A race condition was addressed with improved state handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-42962This issue was addressed with improved checks This issue is fixed in iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3.Apple iOS and iPadOS
- CVE-2023-42892A use-after-free issue was addressed with improved memory management.Apple macOS
- CVE-2024-31136In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameterJetBrains TeamCity
- CVE-2024-0259Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04Fortra Robot Schedule Enterprise Agent
- CVE-2024-29882SRS DOM - XSS on JSONP callbackossrs srs
- CVE-2024-28109Potential XSLT injection vulnerability when using policy filesveraPDF-library · org.verapdf:core +8
- CVE-2024-29896Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injectionsKindSpells astro-shield · @kindspells/astro-shield
- CVE-2024-27775SysAid - CWE-918: Server-Side Request Forgery (SSRF)SysAid
- CVE-2023-52628netfilter: nftables: exthdr: fix 4-byte stack OOB writeLinux
- CVE-2023-6371Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLabGitLab
- CVE-2024-25599WordPress Seriously Simple Podcasting plugin <= 3.0.2 - Reflected Cross Site Scripting (XSS) vulnerabilityCraig Hewitt Seriously Simple Podcasting
- CVE-2024-27999WordPress Preview E-mails for WooCommerce plugin <= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerabilityDigamber Pradhan Preview E-mails for WooCommerce
- CVE-2024-28001WordPress Favicon Rotator plugin <= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerabilityArchetyped Favicon Rotator
- CVE-2024-28002WordPress Cornerstone plugin <= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerabilityArchetyped Cornerstone
- CVE-2023-39309WordPress Avada Builder plugin <= 3.11.1 - Auth. SQL Injection vulnerabilityThemeFusion Fusion Builder
- CVE-2024-25924WordPress WP Testimonials plugin <= 1.4.3 - Auth. SQL Injection vulnerabilityTrustindex.io WP Testimonials
- CVE-2024-29229Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 aSynology Surveillance Station
- CVE-2024-29228Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allSynology Surveillance Station
- CVE-2023-23649WordPress MainWP Links Manager Extension Plugin <= 2.1 - Unauthenticated PHP Object Injection VulnerabilityMainWP Links Manager Extension
- CVE-2023-34370Server Side Request Forgery (SSRF) vulnerability in Starter Templates pluginsBrainstorm Force Starter Templates — Elementor, WordPress &…
- CVE-2023-36679WordPress Spectra plugin <= 2.6.6 - Server Side Request Forgery (SSRF) vulnerabilityBrainstorm Force Spectra
- CVE-2023-39313WordPress Avada theme <= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerabilityThemeFusion Avada
- CVE-2024-23500WordPress Kadence Blocks plugin <= 3.2.19 - Server Side Request Forgery (SSRF) vulnerabilityStellarWP Gutenberg Blocks by Kadence Blocks
- CVE-2024-30200WordPress BEAR plugin <= 1.1.4.2 - Reflected Cross Site Scripting (XSS) vulnerabilityrealmag777 BEAR
- CVE-2024-30222WordPress ARMember plugin <= 4.0.26 - PHP Object Injection vulnerabilityRepute Infosystems ARMember
- CVE-2024-0672Pz-LinkCard <= 2.5.1 - Reflected XSSPz-LinkCard
- CVE-2024-30229WordPress Give plugin <= 3.4.2 - PHP Object Injection vulnerabilityStellarWP GiveWP
- CVE-2024-30230WordPress PDF Invoices and Packing Slips For WooCommerce plugin <= 1.3.7 - PHP Object Injection vulnerabilityAcowebs PDF Invoices and Packing Slips For WooCommerce
- CVE-2024-30236WordPress Contest Gallery plugin <= 21.3.4 - SQL Injection vulnerabilityWasiliy Strecker / ContestGallery developer Contest Gallery
- CVE-2024-30237WordPress Slider by Supsystic plugin <= 1.8.10 - SQL Injection vulnerabilitySlider by Supsystic
- CVE-2024-30239WordPress Zoho Campaigns plugin <= 2.0.6 - SQL Injection vulnerabilityZoho Campaigns
- CVE-2024-30240WordPress Calendarista plugin <= 15.5.7 - SQL Injection vulnerabilityTypps Calendarista
- CVE-2024-30241WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin <= 5.7.1 - Contributor+ SQL Injection vulnerabilityMetagauss ProfileGrid
- CVE-2024-30242WordPress Contact Form to Any API plugin <= 1.1.8 - Auth. SQL Injection vulnerabilityIT Path Solutions Contact Form to Any API
- CVE-2024-30243WordPress Tooltips plugin < 9.4.5 - Auth. SQL Injection vulnerabilityTomas WordPress Tooltips
- CVE-2024-30244WordPress Church Admin plugin <= 4.0.27 - SQL Injection via shortcode vulnerabilityandy_moyle Church Admin
- CVE-2024-30245WordPress DecaLog plugin <= 3.9.0 - SQL Injection vulnerabilityPierre Lannoy DecaLog
- CVE-2024-1770Meta Tag Manager <= 3.0.2 - Authenticated (Subscriber+) PHP Object Injectionnetweblogic Meta Tag Manager
- CVE-2024-3012Tenda FH1205 GetParentControlInfo stack-based overflowTenda FH1205
- CVE-2024-3011Tenda FH1205 QuickIndex formQuickIndex stack-based overflowTenda FH1205
- CVE-2021-31156Allied Telesis AT-S115 1.2.0 devices before 1.00.024 with Boot Loader 1.00.006 allow Directory Traversal to achieve partial access to data.
- CVE-2024-23727The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0_20231219 for Android allows a remote attacker to execute arbitrary
- CVE-2024-28714SQL Injection vulnerability in CRMEB_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter.
- CVE-2024-30583Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the mitInterface parameter of the fromAddressNat function.
- CVE-2024-30591Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function.
- CVE-2024-30592Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the page parameter of the fromAddressNat function.
- CVE-2024-30599Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function.
- CVE-2024-30600Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function.
- CVE-2024-30601Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function.
- CVE-2024-30604Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the list1 parameter of the fromDhcpListClient function.
- CVE-2024-30606Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the page parameter of the fromDhcpListClient function.
- CVE-2024-30607Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function.
- CVE-2024-30612Tenda AC10U v15.03.06.48 has a stack overflow vulnerability in the deviceId, limitSpeed, limitSpeedUp parameter from formSetClientState func
Medium, low and unrated 88
- CVE-2024-25971Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability.Dell PowerProtect Data Manager
- CVE-2024-25954Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability.Dell PowerScale OneFS
- CVE-2024-25963Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerability.Dell PowerScale OneFS
- CVE-2024-25953Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability.Dell PowerScale OneFS
- CVE-2024-25952Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability.Dell PowerScale OneFS
- CVE-2024-25961Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an improper privilege management vulnerability.Dell PowerScale OneFS
- CVE-2023-42956The issue was addressed with improved memory handling.Apple Safari · Apple iOS and iPadOS +1
- CVE-2023-42936This issue was addressed with improved redaction of sensitive information.Apple iOS and iPadOS · Apple macOS +2
- CVE-2023-42896An issue was addressed with improved handling of temporary files.Apple iOS and iPadOS · Apple macOS
- CVE-2023-42930This issue was addressed with improved checks.Apple macOS
- CVE-2023-40390A privacy issue was addressed by moving sensitive data to a protected location.Apple macOS
- CVE-2023-42893A permissions issue was addressed by removing vulnerable code and adding additional checks.Apple iOS and iPadOS · Apple macOS +2
- CVE-2024-31140In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing toolsJetBrains TeamCity
- CVE-2024-31139In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detectorJetBrains TeamCity
- CVE-2024-31138In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settingsJetBrains TeamCity
- CVE-2024-31137In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configurationJetBrains TeamCity
- CVE-2024-31135In JetBrains TeamCity before 2024.03 open redirect was possible on the login pageJetBrains TeamCity
- CVE-2024-31134In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registratioJetBrains TeamCity
- CVE-2024-3042SourceCodester Simple Subscription Website manage_user.php sql injectionSourceCodester Simple Subscription Website
- CVE-2024-3041Netentsec NS-ASG Application Security Gateway listloginfo.php sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-3040Netentsec NS-ASG Application Security Gateway list_crl_conf sql injectionNetentsec NS-ASG Application Security Gateway
- CVE-2024-3039Shanghai Brad Technology BladeX API export-user sql injectionShanghai Brad Technology BladeX
- CVE-2023-45715HCL BigFix Platform is susceptible to a Denial of Service attackHCL Software BigFix Platform
- CVE-2023-45706HCL BigFix Platform is susceptible to Cross Site Scripting (XSS) and/or Man in the Middle (MITM) attackHCL Software BigFix Platform
- CVE-2023-45705HCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF)HCL Software BigFix Platform
- CVE-2024-29898Oversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikismiraheze CreateWiki
- CVE-2024-29897CreateWiki Leak of suppressed wiki requests outside of `CreateWikiGlobalWiki`miraheze CreateWiki
- CVE-2024-29200API returns timesheet entries a user should not be authorized to viewkimai · kimai/kimai
- CVE-2024-30422WordPress Elementor Addon Elements plugin <= 1.13.1 - Cross Site Scripting (XSS) vulnerabilityWPVibes Elementor Addon Elements
- CVE-2024-30421WordPress Events Manager plugin <= 6.4.7.1 - Cross Site Request Forgery (CSRF) vulnerabilityPixelite Events Manager
- CVE-2024-2818Allocation of Resources Without Limits or Throttling in GitLabGitLab
- CVE-2022-45850WordPress Image Map Pro premium plugin < 5.6.9 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)Nickys Image Map Pro
- CVE-2023-52231WordPress Booster Plus for WooCommerce plugin < 7.1.2 - Auth. Sensitive Data Exposure vulnerabilityBooster Plus for WooCommerce
- CVE-2023-52234WordPress Booster Elite for WooCommerce plugin < 7.1.2 - Auth. Sensitive Data Exposure vulnerabilityBooster Elite for WooCommerce
- CVE-2023-50374WordPress CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin <= 4.1.10 - Server Side Request Forgery (SSRF) vulnerabilityNiteoThemes CMP – Coming Soon & Maintenance
- CVE-2024-22138WordPress Seraphinite Accelerator plugin <= 2.20.47 - Sensitive Data Exposure via Log File vulnerabilitySeraphinite Solutions Seraphinite Accelerator
- CVE-2024-29240Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allowsSynology Surveillance Station
- CVE-2024-29239Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi compoSynology Surveillance Station
- CVE-2024-29238Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component iSynology Surveillance Station
- CVE-2024-29237Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in Synology Surveillance Station
- CVE-2024-29236Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delete webapi component iSynology Surveillance Station
- CVE-2024-29235Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog webapi component in SSynology Surveillance Station
- CVE-2024-29234Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi component in SynologSynology Surveillance Station
- CVE-2024-29233Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi component in SynoloSynology Surveillance Station
- CVE-2024-29232Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi component in SynologSynology Surveillance Station
- CVE-2024-29231Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 aSynology Surveillance Station
- CVE-2024-29230Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByCategory webapi componSynology Surveillance Station
- CVE-2024-25923WordPress Community by PeepSo plugin <= 6.2.7.0 - Sensitive Data Exposure via Log File vulnerabilityCommunity by PeepSo
- CVE-2024-29227Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in Synology Surveillance Station
- CVE-2024-28003WordPress Max Mega Menu plugin <= 3.3 - Broken Access Control vulnerabilityMegamenu Max Mega Menu
- CVE-2024-28004WordPress Colibri Page Builder plugin <= 1.0.248 - Broken Access Control vulnerabilityExtendThemes Colibri Page Builder
- CVE-2024-29090WordPress AI Engine plugin <= 2.1.4 - Server Side Request Forgery (SSRF) vulnerabilityJordy Meow AI Engine: ChatGPT Chatbot
- CVE-2024-30221WordPress Sunshine Photo Cart plugin <= 3.1.1 - PHP Object Injection vulnerabilitysunshinephotocart Sunshine Photo Cart
- CVE-2024-0677Pz-LinkCard <= 2.5.1 - Contributor+ SSRFPz-LinkCard
- CVE-2024-0673Pz-LinkCard <= 2.5.1 - Admin+ Stored XSSPz-LinkCard
- CVE-2024-2091Elementor Addon Elements <= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scriptingwpvibes Addon Elements for Elementor
- CVE-2024-2110Events Manager <= 6.4.7.1 - Cross-Site Request Forgerynetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2024-2111Events Manager <= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingnetweblogic Events Manager – Calendar, Bookings, Tickets, a…
- CVE-2024-3024appneta tcpreplay get.c get_layer4_v6 heap-based overflowappneta tcpreplay
- CVE-2024-3015SourceCodester Simple Subscription Website manage_plan.php sql injectionSourceCodester Simple Subscription Website
- CVE-2024-3014SourceCodester Simple Subscription Website Actions.php sql injectionSourceCodester Simple Subscription Website
- CVE-2024-28013Use of Insufficiently Random Values vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2,NEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2024-28016Improper Access Controlvulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WGNEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2024-28006Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WNEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2024-28005Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W30NEC WG1800HP4 · NEC WG1200HS3 +56
- CVE-2024-3013Teledyne FLIR AX8 User Registration test_login.php improper authorizationTeledyne FLIR AX8
- CVE-2023-25341A Directory Traversal vulnerability in ladle dev server 2.5.1 and earlier allows an attacker on the same network to read files accessible to
- CVE-2023-33528halo v1.6.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2024-24407SQL Injection vulnerability in Best Courier management system v.1.0 allows a remote attacker to obtain sensitive information via print_pdets
- CVE-2024-25506Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control
- CVE-2024-27719A cross site scripting (XSS) vulnerability in rems FAQ Management System v.1.0 allows a remote attacker to obtain sensitive information via
- CVE-2024-28090Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stor
- CVE-2024-28091Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stor
- CVE-2024-29316NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group vnodebb
- CVE-2024-29489Jerryscript 2.4.0 has SEGV at ./jerry-core/ecma/base/ecma-helpers.c:238:58 in ecma_get_object_type.
- CVE-2024-30585Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function.
- CVE-2024-30586Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.
- CVE-2024-30588Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function.
- CVE-2024-30590Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function.
- CVE-2024-30594Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function.
- CVE-2024-30597Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function.
- CVE-2024-30598Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security_5g parameter of the formWifiBasicSet function.
- CVE-2024-30603Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function.
- CVE-2024-31061Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via t
- CVE-2024-31062Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via t
- CVE-2024-31063Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via t
- CVE-2024-31064Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via t
- CVE-2024-31065Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via t