# CVEs published 2024-03-28

180 CVEs were published on March 28, 2024: 28 critical, 64 high. Days are UTC.

- [CVE-2024-25955](https://cve.now/CVE-2024-25955.md): Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. (CVSS 7.2, Dell Virtual Appliance (vApp) Manager)
- [CVE-2024-25946](https://cve.now/CVE-2024-25946.md): Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. (CVSS 7.2, Dell Virtual Appliance (vApp) Manager)
- [CVE-2024-25971](https://cve.now/CVE-2024-25971.md): Dell PowerProtect Data Manager, version 19.15, contains an XML External Entity Injection vulnerability. (CVSS 5.5, Dell PowerProtect Data Manager)
- [CVE-2024-25954](https://cve.now/CVE-2024-25954.md): Dell PowerScale OneFS, versions 9.5.0.x through 9.7.0.x, contain an insufficient session expiration vulnerability. (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2024-25963](https://cve.now/CVE-2024-25963.md): Dell PowerScale OneFS, versions 8.2.2.x through 9.5.0.x contains a use of a broken cryptographic algorithm vulnerability. (CVSS 5.9, Dell PowerScale OneFS)
- [CVE-2024-3019](https://cve.now/CVE-2024-3019.md): Pcp: exposure of the redis server backend allows remote command execution via pmproxy (CVSS 8.8, pcp · Red Hat Enterprise Linux)
- [CVE-2024-2947](https://cve.now/CVE-2024-2947.md): Cockpit: command injection when deleting a sosreport with a crafted name (CVSS 7.3, cockpit · Red Hat Enterprise Linux)
- [CVE-2024-25953](https://cve.now/CVE-2024-25953.md): Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. (CVSS 6.0, Dell PowerScale OneFS)
- [CVE-2024-25952](https://cve.now/CVE-2024-25952.md): Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an UNIX symbolic link (symlink) following vulnerability. (CVSS 6.0, Dell PowerScale OneFS)
- [CVE-2024-25960](https://cve.now/CVE-2024-25960.md): Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains a cleartext transmission of sensitive information vulnerability. (CVSS 7.3, Dell PowerScale OneFS)
- [CVE-2024-25961](https://cve.now/CVE-2024-25961.md): Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.x contains an improper privilege management vulnerability. (CVSS 6.0, Dell PowerScale OneFS)
- [CVE-2024-25959](https://cve.now/CVE-2024-25959.md): Dell PowerScale OneFS versions 9.4.0.x through 9.7.0.x contains an insertion of sensitive information into log file vulnerability. (CVSS 7.9, Dell PowerScale OneFS)
- [CVE-2023-42956](https://cve.now/CVE-2023-42956.md): The issue was addressed with improved memory handling. (CVSS 6.5, Apple Safari · Apple iOS and iPadOS +1)
- [CVE-2023-42936](https://cve.now/CVE-2023-42936.md): This issue was addressed with improved redaction of sensitive information. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-42931](https://cve.now/CVE-2023-42931.md): The issue was addressed with improved checks. (CVSS 8.3, Apple macOS)
- [CVE-2023-42950](https://cve.now/CVE-2023-42950.md): A use after free issue was addressed with improved memory management. (CVSS 8.8, Apple Safari · Apple iOS and iPadOS +3)
- [CVE-2023-42947](https://cve.now/CVE-2023-42947.md): A path handling issue was addressed with improved validation. (CVSS 8.6, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-42896](https://cve.now/CVE-2023-42896.md): An issue was addressed with improved handling of temporary files. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42930](https://cve.now/CVE-2023-42930.md): This issue was addressed with improved checks. (CVSS 5.5, Apple macOS)
- [CVE-2023-42913](https://cve.now/CVE-2023-42913.md): This issue was addressed through improved state management. (CVSS 8.8, Apple macOS)
- [CVE-2023-40390](https://cve.now/CVE-2023-40390.md): A privacy issue was addressed by moving sensitive data to a protected location. (CVSS 5.5, Apple macOS)
- [CVE-2023-42893](https://cve.now/CVE-2023-42893.md): A permissions issue was addressed by removing vulnerable code and adding additional checks. (CVSS 5.5, Apple iOS and iPadOS · Apple macOS +2)
- [CVE-2023-42974](https://cve.now/CVE-2023-42974.md): A race condition was addressed with improved state handling. (CVSS 7.0, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-42962](https://cve.now/CVE-2023-42962.md): This issue was addressed with improved checks This issue is fixed in iOS 17.2 and iPadOS 17.2, iOS 16.7.3 and iPadOS 16.7.3. (CVSS 7.5, Apple iOS and iPadOS)
- [CVE-2023-42892](https://cve.now/CVE-2023-42892.md): A use-after-free issue was addressed with improved memory management. (CVSS 7.8, Apple macOS)
- [CVE-2024-31140](https://cve.now/CVE-2024-31140.md): In JetBrains TeamCity before 2024.03 server administrators could remove arbitrary files from the server by installing tools (CVSS 4.1, JetBrains TeamCity)
- [CVE-2024-31139](https://cve.now/CVE-2024-31139.md): In JetBrains TeamCity before 2024.03 xXE was possible in the Maven build steps detector (CVSS 5.9, JetBrains TeamCity)
- [CVE-2024-31138](https://cve.now/CVE-2024-31138.md): In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings (CVSS 4.6, JetBrains TeamCity)
- [CVE-2024-31137](https://cve.now/CVE-2024-31137.md): In JetBrains TeamCity before 2024.03 reflected XSS was possible via Space connection configuration (CVSS 6.8, JetBrains TeamCity)
- [CVE-2024-31136](https://cve.now/CVE-2024-31136.md): In JetBrains TeamCity before 2024.03 2FA could be bypassed by providing a special URL parameter (CVSS 7.4, JetBrains TeamCity)
- [CVE-2024-31135](https://cve.now/CVE-2024-31135.md): In JetBrains TeamCity before 2024.03 open redirect was possible on the login page (CVSS 6.1, JetBrains TeamCity)
- [CVE-2024-31134](https://cve.now/CVE-2024-31134.md): In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registratio (CVSS 6.5, JetBrains TeamCity)
- [CVE-2024-3042](https://cve.now/CVE-2024-3042.md): SourceCodester Simple Subscription Website manage\_user.php sql injection (CVSS 6.3, SourceCodester Simple Subscription Website)
- [CVE-2024-3041](https://cve.now/CVE-2024-3041.md): Netentsec NS-ASG Application Security Gateway listloginfo.php sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-0259](https://cve.now/CVE-2024-0259.md): Privilege Escalation in Robot Schedule Enterprise Agent for Windows prior to version 3.04 (CVSS 7.3, Fortra Robot Schedule Enterprise Agent)
- [CVE-2024-3040](https://cve.now/CVE-2024-3040.md): Netentsec NS-ASG Application Security Gateway list\_crl\_conf sql injection (CVSS 6.3, Netentsec NS-ASG Application Security Gateway)
- [CVE-2024-3039](https://cve.now/CVE-2024-3039.md): Shanghai Brad Technology BladeX API export-user sql injection (CVSS 6.3, Shanghai Brad Technology BladeX)
- [CVE-2023-45715](https://cve.now/CVE-2023-45715.md): HCL BigFix Platform is susceptible to a Denial of Service attack (CVSS 3.5, HCL Software BigFix Platform)
- [CVE-2023-45706](https://cve.now/CVE-2023-45706.md): HCL BigFix Platform is susceptible to Cross Site Scripting (XSS) and/or Man in the Middle (MITM) attack (CVSS 2.0, HCL Software BigFix Platform)
- [CVE-2023-45705](https://cve.now/CVE-2023-45705.md): HCL BigFix Platform is susceptible to Server Side Request Forgery (SSRF) (CVSS 3.5, HCL Software BigFix Platform)
- [CVE-2024-29898](https://cve.now/CVE-2024-29898.md): Oversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikis (CVSS 4.9, miraheze CreateWiki)
- [CVE-2024-29897](https://cve.now/CVE-2024-29897.md): CreateWiki Leak of suppressed wiki requests outside of \`CreateWikiGlobalWiki\` (CVSS 4.9, miraheze CreateWiki)
- [CVE-2024-29882](https://cve.now/CVE-2024-29882.md): SRS DOM - XSS on JSONP callback (CVSS 7.2, ossrs srs)
- [CVE-2024-29200](https://cve.now/CVE-2024-29200.md): API returns timesheet entries a user should not be authorized to view (CVSS 6.8, kimai · kimai/kimai)
- [CVE-2024-28109](https://cve.now/CVE-2024-28109.md): Potential XSLT injection vulnerability when using policy files (CVSS 8.1, veraPDF-library · org.verapdf:core +8)
- [CVE-2023-6437](https://cve.now/CVE-2023-6437.md): Authenticated RCE (CVSS 9.8, TP-Link EX20v AX1800, Tp-Link Archer C5v AC1200, Tp-Link TD…)
- [CVE-2024-29896](https://cve.now/CVE-2024-29896.md): Astro-Shield's Content-Security-Policy header generation in middleware could be compromised by malicious injections (CVSS 7.5, KindSpells astro-shield · @kindspells/astro-shield)
- [CVE-2024-27775](https://cve.now/CVE-2024-27775.md): SysAid - CWE-918: Server-Side Request Forgery (SSRF) (CVSS 7.2, SysAid)
- [CVE-2024-30422](https://cve.now/CVE-2024-30422.md): WordPress Elementor Addon Elements plugin \<= 1.13.1 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5, WPVibes Elementor Addon Elements)
- [CVE-2024-30421](https://cve.now/CVE-2024-30421.md): WordPress Events Manager plugin \<= 6.4.7.1 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 4.3, Pixelite Events Manager)
- [CVE-2023-52628](https://cve.now/CVE-2023-52628.md): netfilter: nftables: exthdr: fix 4-byte stack OOB write (CVSS 7.8, Linux)
- [CVE-2023-6371](https://cve.now/CVE-2023-6371.md): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in GitLab (CVSS 8.7, GitLab)
- [CVE-2024-2818](https://cve.now/CVE-2024-2818.md): Allocation of Resources Without Limits or Throttling in GitLab (CVSS 4.3, GitLab)
- [CVE-2022-45850](https://cve.now/CVE-2022-45850.md): WordPress Image Map Pro premium plugin \< 5.6.9 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS) (CVSS 6.1, Nickys Image Map Pro)
- [CVE-2024-25599](https://cve.now/CVE-2024-25599.md): WordPress Seriously Simple Podcasting plugin \<= 3.0.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Craig Hewitt Seriously Simple Podcasting)
- [CVE-2024-27999](https://cve.now/CVE-2024-27999.md): WordPress Preview E-mails for WooCommerce plugin \<= 2.2.1 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Digamber Pradhan Preview E-mails for WooCommerce)
- [CVE-2024-28001](https://cve.now/CVE-2024-28001.md): WordPress Favicon Rotator plugin \<= 1.2.10 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Archetyped Favicon Rotator)
- [CVE-2024-28002](https://cve.now/CVE-2024-28002.md): WordPress Cornerstone plugin \<= 0.8.0 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, Archetyped Cornerstone)
- [CVE-2023-39309](https://cve.now/CVE-2023-39309.md): WordPress Avada Builder plugin \<= 3.11.1 - Auth. SQL Injection vulnerability (CVSS 8.5, ThemeFusion Fusion Builder)
- [CVE-2024-25924](https://cve.now/CVE-2024-25924.md): WordPress WP Testimonials plugin \<= 1.4.3 - Auth. SQL Injection vulnerability (CVSS 7.6, Trustindex.io WP Testimonials)
- [CVE-2023-52231](https://cve.now/CVE-2023-52231.md): WordPress Booster Plus for WooCommerce plugin \< 7.1.2 - Auth. Sensitive Data Exposure vulnerability (CVSS 6.5, Booster Plus for WooCommerce)
- [CVE-2023-52234](https://cve.now/CVE-2023-52234.md): WordPress Booster Elite for WooCommerce plugin \< 7.1.2 - Auth. Sensitive Data Exposure vulnerability (CVSS 6.5, Booster Elite for WooCommerce)
- [CVE-2023-50374](https://cve.now/CVE-2023-50374.md): WordPress CMP – Coming Soon & Maintenance Plugin by NiteoThemes plugin \<= 4.1.10 - Server Side Request Forgery (SSRF) vulnerability (CVSS 5.5, NiteoThemes CMP – Coming Soon & Maintenance)
- [CVE-2024-22138](https://cve.now/CVE-2024-22138.md): WordPress Seraphinite Accelerator plugin \<= 2.20.47 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, Seraphinite Solutions Seraphinite Accelerator)
- [CVE-2024-29241](https://cve.now/CVE-2024-29241.md): Missing authorization vulnerability in System webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 allows rem (CVSS 9.9, Synology Surveillance Station)
- [CVE-2024-29240](https://cve.now/CVE-2024-29240.md): Missing authorization vulnerability in LayoutSave webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows (CVSS 4.3, Synology Surveillance Station)
- [CVE-2024-29239](https://cve.now/CVE-2024-29239.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Recording.CountByCategory webapi compo (CVSS 5.4, Synology Surveillance Station)
- [CVE-2024-29238](https://cve.now/CVE-2024-29238.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Log.CountByCategory webapi component i (CVSS 5.4, Synology Surveillance Station)
- [CVE-2024-29237](https://cve.now/CVE-2024-29237.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in ActionRule.Delete webapi component in (CVSS 5.4, Synology Surveillance Station)
- [CVE-2024-29236](https://cve.now/CVE-2024-29236.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in AudioPattern.Delete webapi component i (CVSS 5.4, Synology Surveillance Station)
- [CVE-2024-29235](https://cve.now/CVE-2024-29235.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in IOModule.EnumLog webapi component in S (CVSS 5.4, Synology Surveillance Station)
- [CVE-2024-29234](https://cve.now/CVE-2024-29234.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Group.Save webapi component in Synolog (CVSS 5.4, Synology Surveillance Station)
- [CVE-2024-29233](https://cve.now/CVE-2024-29233.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Emap.Delete webapi component in Synolo (CVSS 5.4, Synology Surveillance Station)
- [CVE-2024-29232](https://cve.now/CVE-2024-29232.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Alert.Enum webapi component in Synolog (CVSS 5.4, Synology Surveillance Station)
- [CVE-2024-29231](https://cve.now/CVE-2024-29231.md): Improper validation of array index vulnerability in UserPrivilege.Enum webapi component in Synology Surveillance Station before 9.2.0-9289 a (CVSS 5.4, Synology Surveillance Station)
- [CVE-2024-29230](https://cve.now/CVE-2024-29230.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in SnapShot.CountByCategory webapi compon (CVSS 5.4, Synology Surveillance Station)
- [CVE-2024-29229](https://cve.now/CVE-2024-29229.md): Missing authorization vulnerability in GetLiveViewPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 a (CVSS 7.7, Synology Surveillance Station)
- [CVE-2024-25923](https://cve.now/CVE-2024-25923.md): WordPress Community by PeepSo plugin \<= 6.2.7.0 - Sensitive Data Exposure via Log File vulnerability (CVSS 5.3, Community by PeepSo)
- [CVE-2024-2890](https://cve.now/CVE-2024-2890.md): WordPress Tumult Hype Animations plugin \<= 1.9.12 - Arbitrary File Upload vulnerability (CVSS 9.1, Tumult Hype Animations)
- [CVE-2024-29228](https://cve.now/CVE-2024-29228.md): Missing authorization vulnerability in GetStmUrlPath webapi component in Synology Surveillance Station before 9.2.0-9289 and 9.2.0-11289 all (CVSS 7.7, Synology Surveillance Station)
- [CVE-2023-23649](https://cve.now/CVE-2023-23649.md): WordPress MainWP Links Manager Extension Plugin \<= 2.1 - Unauthenticated PHP Object Injection Vulnerability (CVSS 8.1, MainWP Links Manager Extension)
- [CVE-2024-29227](https://cve.now/CVE-2024-29227.md): Improper neutralization of special elements used in an SQL command ('SQL Injection') vulnerability in Layout.LayoutSave webapi component in (CVSS 5.4, Synology Surveillance Station)
- [CVE-2023-34370](https://cve.now/CVE-2023-34370.md): Server Side Request Forgery (SSRF) vulnerability in Starter Templates plugins (CVSS 7.1, Brainstorm Force Starter Templates — Elementor, WordPress &…)
- [CVE-2023-36679](https://cve.now/CVE-2023-36679.md): WordPress Spectra plugin \<= 2.6.6 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.1, Brainstorm Force Spectra)
- [CVE-2023-39313](https://cve.now/CVE-2023-39313.md): WordPress Avada theme \<= 7.11.1 - Authenticated Server Side Request Forgery (SSRF) vulnerability (CVSS 7.7, ThemeFusion Avada)
- [CVE-2024-23500](https://cve.now/CVE-2024-23500.md): WordPress Kadence Blocks plugin \<= 3.2.19 - Server Side Request Forgery (SSRF) vulnerability (CVSS 7.7, StellarWP Gutenberg Blocks by Kadence Blocks)
- [CVE-2024-28003](https://cve.now/CVE-2024-28003.md): WordPress Max Mega Menu plugin \<= 3.3 - Broken Access Control vulnerability (CVSS 5.4, Megamenu Max Mega Menu)
- [CVE-2024-28004](https://cve.now/CVE-2024-28004.md): WordPress Colibri Page Builder plugin \<= 1.0.248 - Broken Access Control vulnerability (CVSS 5.4, ExtendThemes Colibri Page Builder)
- [CVE-2024-29090](https://cve.now/CVE-2024-29090.md): WordPress AI Engine plugin \<= 2.1.4 - Server Side Request Forgery (SSRF) vulnerability (CVSS 6.8, Jordy Meow AI Engine: ChatGPT Chatbot)
- [CVE-2024-29100](https://cve.now/CVE-2024-29100.md): WordPress AI Engine plugin \<= 2.1.4 - Arbitrary File Upload vulnerability (CVSS 9.1, Jordy Meow AI Engine: ChatGPT Chatbot)
- [CVE-2024-30200](https://cve.now/CVE-2024-30200.md): WordPress BEAR plugin \<= 1.1.4.2 - Reflected Cross Site Scripting (XSS) vulnerability (CVSS 7.1, realmag777 BEAR)
- [CVE-2024-30221](https://cve.now/CVE-2024-30221.md): WordPress Sunshine Photo Cart plugin \<= 3.1.1 - PHP Object Injection vulnerability (CVSS 5.4, sunshinephotocart Sunshine Photo Cart)
- [CVE-2024-30222](https://cve.now/CVE-2024-30222.md): WordPress ARMember plugin \<= 4.0.26 - PHP Object Injection vulnerability (CVSS 8.5, Repute Infosystems ARMember)
- [CVE-2024-30223](https://cve.now/CVE-2024-30223.md): WordPress ARMember plugin \<= 4.0.26 - Unauthenticated PHP Object Injection vulnerability (CVSS 9.0, Repute Infosystems ARMember)
- [CVE-2024-30224](https://cve.now/CVE-2024-30224.md): WordPress WholesaleX plugin \<= 1.3.2 - Unauthenticated PHP Object Injection vulnerability (CVSS 10.0, Wholesale Team WholesaleX)
- [CVE-2024-30225](https://cve.now/CVE-2024-30225.md): WordPress WP Migrate plugin \<= 2.6.10 - Unauthenticated PHP Object Injection vulnerability (CVSS 10.0, WPENGINE WP Migrate)
- [CVE-2024-0677](https://cve.now/CVE-2024-0677.md): Pz-LinkCard \<= 2.5.1 - Contributor+ SSRF (CVSS 5.1, Pz-LinkCard)
- [CVE-2024-0673](https://cve.now/CVE-2024-0673.md): Pz-LinkCard \<= 2.5.1 - Admin+ Stored XSS (CVSS 6.1, Pz-LinkCard)
- [CVE-2024-0672](https://cve.now/CVE-2024-0672.md): Pz-LinkCard \<= 2.5.1 - Reflected XSS (CVSS 7.1, Pz-LinkCard)
- [CVE-2024-30226](https://cve.now/CVE-2024-30226.md): WordPress BetterDocs plugin \<= 3.3.3 - Unauthenticated PHP Object Injection vulnerability (CVSS 9.0, WPDeveloper BetterDocs)
- [CVE-2024-30227](https://cve.now/CVE-2024-30227.md): WordPress Geo Controller plugin \<= 8.6.4 - PHP Object Injection vulnerability (CVSS 9.0, INFINITUM FORM Geo Controller)
- [CVE-2024-30228](https://cve.now/CVE-2024-30228.md): WordPress Hercules Core plugin \<= 6.4 - Auth. PHP Object Injection vulnerability (CVSS 9.9, Hercules Design Hercules Core)
- [CVE-2024-30229](https://cve.now/CVE-2024-30229.md): WordPress Give plugin \<= 3.4.2 - PHP Object Injection vulnerability (CVSS 8.0, StellarWP GiveWP)
- [CVE-2024-30230](https://cve.now/CVE-2024-30230.md): WordPress PDF Invoices and Packing Slips For WooCommerce plugin \<= 1.3.7 - PHP Object Injection vulnerability (CVSS 8.2, Acowebs PDF Invoices and Packing Slips For WooCommerce)
- [CVE-2024-30236](https://cve.now/CVE-2024-30236.md): WordPress Contest Gallery plugin \<= 21.3.4 - SQL Injection vulnerability (CVSS 8.5, Wasiliy Strecker / ContestGallery developer Contest Gallery)
- [CVE-2024-30237](https://cve.now/CVE-2024-30237.md): WordPress Slider by Supsystic plugin \<= 1.8.10 - SQL Injection vulnerability (CVSS 7.6, Slider by Supsystic)
- [CVE-2024-30239](https://cve.now/CVE-2024-30239.md): WordPress Zoho Campaigns plugin \<= 2.0.6 - SQL Injection vulnerability (CVSS 8.5, Zoho Campaigns)
- [CVE-2024-30240](https://cve.now/CVE-2024-30240.md): WordPress Calendarista plugin \<= 15.5.7 - SQL Injection vulnerability (CVSS 8.5, Typps Calendarista)
- [CVE-2024-30241](https://cve.now/CVE-2024-30241.md): WordPress ProfileGrid – User Profiles, Memberships, Groups and Communities plugin \<= 5.7.1 - Contributor+ SQL Injection vulnerability (CVSS 8.5, Metagauss ProfileGrid)
- [CVE-2024-30242](https://cve.now/CVE-2024-30242.md): WordPress Contact Form to Any API plugin \<= 1.1.8 - Auth. SQL Injection vulnerability (CVSS 8.5, IT Path Solutions Contact Form to Any API)
- [CVE-2024-30243](https://cve.now/CVE-2024-30243.md): WordPress Tooltips plugin \< 9.4.5 - Auth. SQL Injection vulnerability (CVSS 8.5, Tomas WordPress Tooltips)
- [CVE-2024-30244](https://cve.now/CVE-2024-30244.md): WordPress Church Admin plugin \<= 4.0.27 - SQL Injection via shortcode vulnerability (CVSS 8.5, andy\_moyle Church Admin)
- [CVE-2024-30245](https://cve.now/CVE-2024-30245.md): WordPress DecaLog plugin \<= 3.9.0 - SQL Injection vulnerability (CVSS 7.6, Pierre Lannoy DecaLog)
- [CVE-2024-2091](https://cve.now/CVE-2024-2091.md): Elementor Addon Elements \<= 1.13.2 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 5.4, wpvibes Addon Elements for Elementor)
- [CVE-2024-2110](https://cve.now/CVE-2024-2110.md): Events Manager \<= 6.4.7.1 - Cross-Site Request Forgery (CVSS 4.3, netweblogic Events Manager – Calendar, Bookings, Tickets, a…)
- [CVE-2024-1770](https://cve.now/CVE-2024-1770.md): Meta Tag Manager \<= 3.0.2 - Authenticated (Subscriber+) PHP Object Injection (CVSS 8.8, netweblogic Meta Tag Manager)
- [CVE-2024-2111](https://cve.now/CVE-2024-2111.md): Events Manager \<= 6.4.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, netweblogic Events Manager – Calendar, Bookings, Tickets, a…)
- [CVE-2024-3024](https://cve.now/CVE-2024-3024.md): appneta tcpreplay get.c get\_layer4\_v6 heap-based overflow (CVSS 5.3, appneta tcpreplay)
- [CVE-2024-3015](https://cve.now/CVE-2024-3015.md): SourceCodester Simple Subscription Website manage\_plan.php sql injection (CVSS 6.3, SourceCodester Simple Subscription Website)
- [CVE-2024-3014](https://cve.now/CVE-2024-3014.md): SourceCodester Simple Subscription Website Actions.php sql injection (CVSS 6.3, SourceCodester Simple Subscription Website)
- [CVE-2024-28013](https://cve.now/CVE-2024-28013.md): Use of Insufficiently Random Values vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, (CVSS 5.3, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-28014](https://cve.now/CVE-2024-28014.md): Stack-based Buffer Overflow vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900H (CVSS 9.8, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-28015](https://cve.now/CVE-2024-28015.md): Improper Neutralization of Special Elements used in an OS Command vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG (CVSS 9.8, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-28016](https://cve.now/CVE-2024-28016.md): Improper Access Controlvulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG (CVSS 6.0, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-28012](https://cve.now/CVE-2024-28012.md): Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, W (CVSS 9.8, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-28011](https://cve.now/CVE-2024-28011.md): Hidden Functionality vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG12 (CVSS 9.8, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-28010](https://cve.now/CVE-2024-28010.md): Use of Hard-coded Password in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W (CVSS 9.8, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-28009](https://cve.now/CVE-2024-28009.md): Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, W (CVSS 9.8, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-28008](https://cve.now/CVE-2024-28008.md): Active Debug Code in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-M (CVSS 9.8, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-28007](https://cve.now/CVE-2024-28007.md): Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, W (CVSS 9.8, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-28006](https://cve.now/CVE-2024-28006.md): Improper authentication vulnerability in NEC Corporation Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, W (CVSS 5.3, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-28005](https://cve.now/CVE-2024-28005.md): Aterm WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP3, WG1800HP3, WG1200HS2, WG1900HP, WG1200HP2, W1200EX(-MS), WG1200HS, WG1200HP, WF300HP2, W30 (CVSS 4.7, NEC WG1800HP4 · NEC WG1200HS3 +56)
- [CVE-2024-3013](https://cve.now/CVE-2024-3013.md): Teledyne FLIR AX8 User Registration test\_login.php improper authorization (CVSS 5.3, Teledyne FLIR AX8)
- [CVE-2024-3012](https://cve.now/CVE-2024-3012.md): Tenda FH1205 GetParentControlInfo stack-based overflow (CVSS 8.8, Tenda FH1205)
- [CVE-2024-3011](https://cve.now/CVE-2024-3011.md): Tenda FH1205 QuickIndex formQuickIndex stack-based overflow (CVSS 8.8, Tenda FH1205)
- [CVE-2021-31156](https://cve.now/CVE-2021-31156.md): Allied Telesis AT-S115 1.2.0 devices before 1.00.024 with Boot Loader 1.00.006 allow Directory Traversal to achieve partial access to data. (CVSS 7.5)
- [CVE-2023-25341](https://cve.now/CVE-2023-25341.md): A Directory Traversal vulnerability in ladle dev server 2.5.1 and earlier allows an attacker on the same network to read files accessible to (CVSS 6.5)
- [CVE-2023-33528](https://cve.now/CVE-2023-33528.md): halo v1.6.0 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2023-50969](https://cve.now/CVE-2023-50969.md): Thales Imperva SecureSphere WAF 14.7.0.40 allows remote attackers to bypass WAF rules via a crafted POST request, a different vulnerability (CVSS 9.8)
- [CVE-2024-23727](https://cve.now/CVE-2024-23727.md): The YI Smart Kami Vision com.kamivision.yismart application through 1.0.0\_20231219 for Android allows a remote attacker to execute arbitrary (CVSS 8.4)
- [CVE-2024-24407](https://cve.now/CVE-2024-24407.md): SQL Injection vulnerability in Best Courier management system v.1.0 allows a remote attacker to obtain sensitive information via print\_pdets (CVSS 5.3)
- [CVE-2024-25506](https://cve.now/CVE-2024-25506.md): Cross Site Scripting vulnerability in Process Maker, Inc ProcessMaker before 4.0 allows a remote attacker to run arbitrary code via control (CVSS 6.5)
- [CVE-2024-27719](https://cve.now/CVE-2024-27719.md): A cross site scripting (XSS) vulnerability in rems FAQ Management System v.1.0 allows a remote attacker to obtain sensitive information via (CVSS 6.1)
- [CVE-2024-28090](https://cve.now/CVE-2024-28090.md): Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stor (CVSS 5.4)
- [CVE-2024-28091](https://cve.now/CVE-2024-28091.md): Technicolor TC8715D TC8715D-01.EF.04.38.00-180405-S-FF9-D RSE-TC8717T devices allow a remote attacker within Wi-Fi proximity to conduct stor (CVSS 6.1)
- [CVE-2024-28456](https://cve.now/CVE-2024-28456.md): Cross Site Scripting vulnerability in Campcodes Online Marriage Registration System v.1.0 allows a remote attacker to execute arbitrary code (CVSS 9.0)
- [CVE-2024-28713](https://cve.now/CVE-2024-28713.md): An issue in Mblog Blog system v.3.5.0 allows an attacker to execute arbitrary code via a crafted file to the theme management feature. (CVSS 9.8)
- [CVE-2024-28714](https://cve.now/CVE-2024-28714.md): SQL Injection vulnerability in CRMEB\_Java e-commerce system v.1.3.4 allows an attacker to execute arbitrary code via the groupid parameter. (CVSS 8.1)
- [CVE-2024-29316](https://cve.now/CVE-2024-29316.md): NodeBB 3.6.7 is vulnerable to Incorrect Access Control, e.g., a low-privileged attacker can access the restricted tabs for the Admin group v (CVSS 6.3, nodebb)
- [CVE-2024-29489](https://cve.now/CVE-2024-29489.md): Jerryscript 2.4.0 has SEGV at ./jerry-core/ecma/base/ecma-helpers.c:238:58 in ecma\_get\_object\_type. (CVSS 5.5)
- [CVE-2024-30583](https://cve.now/CVE-2024-30583.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the mitInterface parameter of the fromAddressNat function. (CVSS 8.0)
- [CVE-2024-30584](https://cve.now/CVE-2024-30584.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function. (CVSS 9.8)
- [CVE-2024-30585](https://cve.now/CVE-2024-30585.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function. (CVSS 6.5)
- [CVE-2024-30586](https://cve.now/CVE-2024-30586.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the security\_5g parameter of the formWifiBasicSet function. (CVSS 6.5)
- [CVE-2024-30587](https://cve.now/CVE-2024-30587.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function. (CVSS 9.8)
- [CVE-2024-30588](https://cve.now/CVE-2024-30588.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function. (CVSS 4.3)
- [CVE-2024-30589](https://cve.now/CVE-2024-30589.md): Tenda FH1202 v1.2.0.14(408) firmware has a stack overflow vulnerability in the entrys parameter of the fromAddressNat function. (CVSS 9.8)
- [CVE-2024-30590](https://cve.now/CVE-2024-30590.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function. (CVSS 6.5)
- [CVE-2024-30591](https://cve.now/CVE-2024-30591.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function. (CVSS 8.8)
- [CVE-2024-30592](https://cve.now/CVE-2024-30592.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the page parameter of the fromAddressNat function. (CVSS 8.0)
- [CVE-2024-30593](https://cve.now/CVE-2024-30593.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability located in the deviceName parameter of the formSetDeviceName function. (CVSS 9.8)
- [CVE-2024-30594](https://cve.now/CVE-2024-30594.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function. (CVSS 6.5)
- [CVE-2024-30595](https://cve.now/CVE-2024-30595.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the addWifiMacFilter function. (CVSS 9.8)
- [CVE-2024-30596](https://cve.now/CVE-2024-30596.md): Tenda FH1202 v1.2.0.14(408) has a stack overflow vulnerability in the deviceId parameter of the formSetDeviceName function. (CVSS 9.8)
- [CVE-2024-30597](https://cve.now/CVE-2024-30597.md): Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security parameter of the formWifiBasicSet function. (CVSS 6.5)
- [CVE-2024-30598](https://cve.now/CVE-2024-30598.md): Tenda FH1203 v2.0.1.6 firmware has a stack overflow vulnerability in the security\_5g parameter of the formWifiBasicSet function. (CVSS 6.5)
- [CVE-2024-30599](https://cve.now/CVE-2024-30599.md): Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceMac parameter of the addWifiMacFilter function. (CVSS 8.8)
- [CVE-2024-30600](https://cve.now/CVE-2024-30600.md): Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedEndTime parameter of the setSchedWifi function. (CVSS 8.0)
- [CVE-2024-30601](https://cve.now/CVE-2024-30601.md): Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the time parameter of the saveParentControlInfo function. (CVSS 8.0)
- [CVE-2024-30602](https://cve.now/CVE-2024-30602.md): Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the schedStartTime parameter of the setSchedWifi function. (CVSS 9.8)
- [CVE-2024-30603](https://cve.now/CVE-2024-30603.md): Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the urls parameter of the saveParentControlInfo function. (CVSS 6.5)
- [CVE-2024-30604](https://cve.now/CVE-2024-30604.md): Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the list1 parameter of the fromDhcpListClient function. (CVSS 7.5)
- [CVE-2024-30606](https://cve.now/CVE-2024-30606.md): Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the page parameter of the fromDhcpListClient function. (CVSS 8.0)
- [CVE-2024-30607](https://cve.now/CVE-2024-30607.md): Tenda FH1203 v2.0.1.6 has a stack overflow vulnerability in the deviceId parameter of the saveParentControlInfo function. (CVSS 8.0)
- [CVE-2024-30612](https://cve.now/CVE-2024-30612.md): Tenda AC10U v15.03.06.48 has a stack overflow vulnerability in the deviceId, limitSpeed, limitSpeedUp parameter from formSetClientState func (CVSS 8.1)
- [CVE-2024-31061](https://cve.now/CVE-2024-31061.md): Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via t (CVSS 6.1)
- [CVE-2024-31062](https://cve.now/CVE-2024-31062.md): Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via t (CVSS 6.3)
- [CVE-2024-31063](https://cve.now/CVE-2024-31063.md): Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via t (CVSS 6.4)
- [CVE-2024-31064](https://cve.now/CVE-2024-31064.md): Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via t (CVSS 6.1)
- [CVE-2024-31065](https://cve.now/CVE-2024-31065.md): Cross Site Scripting vulnerability in Insurance Mangement System v.1.0.0 and before allows a remote attacker to execute arbitrary code via t (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-03-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.