# CVEs published 2024-04-03

231 CVEs were published on April 3, 2024: 20 critical, 69 high. Days are UTC.

- [CVE-2024-3270](https://cve.now/CVE-2024-3270.md): ThingsBoard AdvancedFeature access control (CVSS 3.8, ThingsBoard)
- [CVE-2024-30265](https://cve.now/CVE-2024-30265.md): Voilà Local file inclusion (CVSS 7.5, voila-dashboards voila · voila)
- [CVE-2024-28870](https://cve.now/CVE-2024-28870.md): Suricata uses excessive resource use in malformed ssh traffic parsing (CVSS 7.5, OISF suricata)
- [CVE-2024-2689](https://cve.now/CVE-2024-2689.md): Denial of Service if invalid UTF-8 sent (CVSS 4.4, Temporal Technologies Temporal Server · go.temporal.io/s… +1)
- [CVE-2024-3181](https://cve.now/CVE-2024-3181.md): Concrete CMS version 9 prior to 9.2.8 and previous versions prior to 8.5.16 are vulnerable to Stored XSS in the Search Field. (CVSS 3.1, Concrete CMS · concrete5/concrete5)
- [CVE-2024-3180](https://cve.now/CVE-2024-3180.md): Concrete CMS version 9 below 9.2.8 and previous versions below 8.5.16 is vulnerable to Stored XSS in blocks of type file (CVSS 3.1, Concrete CMS · concrete5/concrete5)
- [CVE-2024-0335](https://cve.now/CVE-2024-0335.md): Malformed Packet Handling (CVSS 7.5, ABB Symphony Plus S+ Operations · ABB Symphony Plus S+ E… +1)
- [CVE-2024-3179](https://cve.now/CVE-2024-3179.md): Concrete CMS version 9 before 9.2.8 and previous versions before 8.5.16 are vulnerable to Stored XSS in the Custom Class page (CVSS 3.1, Concrete CMS · concrete5/concrete5)
- [CVE-2024-3178](https://cve.now/CVE-2024-3178.md): Concrete CMS versions 9 below 9.2.8 and versions below 8.5.16 are vulnerable to Cross-site Scripting (XSS) in the Advanced File Search Filter (CVSS 3.1, Concrete CMS · concrete5/concrete5)
- [CVE-2024-2753](https://cve.now/CVE-2024-2753.md): Concrete CMS version 9 below 9.2.8 and below 8.5.16 is vulnerable to stored XSS on the calendar color settings screen (CVSS 2.0, Concrete CMS · concrete5/concrete5)
- [CVE-2024-2653](https://cve.now/CVE-2024-2653.md): CVE-2024-2653 (CVSS 8.2, amphp/http-client · amphp/http)
- [CVE-2024-2758](https://cve.now/CVE-2024-2758.md): CVE-2024-2758 (CVSS 6.3, Tempesta FW)
- [CVE-2024-26779](https://cve.now/CVE-2024-26779.md): wifi: mac80211: fix race condition on enabling fast-xmit (CVSS 8.8, Linux)
- [CVE-2024-26778](https://cve.now/CVE-2024-26778.md): fbdev: savage: Error out if pixclock equals zero (no CVSS, Linux)
- [CVE-2024-26777](https://cve.now/CVE-2024-26777.md): fbdev: sis: Error out if pixclock equals zero (no CVSS, Linux)
- [CVE-2024-26776](https://cve.now/CVE-2024-26776.md): spi: hisi-sfc-v3xx: Return IRQ\_NONE if no interrupts were detected (no CVSS, Linux)
- [CVE-2024-26775](https://cve.now/CVE-2024-26775.md): aoe: avoid potential deadlock at set\_capacity (no CVSS, Linux)
- [CVE-2024-26774](https://cve.now/CVE-2024-26774.md): ext4: avoid dividing by 0 in mb\_update\_avg\_fragment\_size() when block bitmap corrupt (no CVSS, Linux)
- [CVE-2024-26773](https://cve.now/CVE-2024-26773.md): ext4: avoid allocating blocks from corrupted group in ext4\_mb\_try\_best\_found() (CVSS 7.8, Linux)
- [CVE-2024-26772](https://cve.now/CVE-2024-26772.md): ext4: avoid allocating blocks from corrupted group in ext4\_mb\_find\_by\_goal() (CVSS 7.8, Linux)
- [CVE-2024-26771](https://cve.now/CVE-2024-26771.md): dmaengine: ti: edma: Add some null pointer checks to the edma\_probe (no CVSS, Linux)
- [CVE-2024-26770](https://cve.now/CVE-2024-26770.md): HID: nvidia-shield: Add missing null pointer checks to LED initialization (no CVSS, Linux)
- [CVE-2024-26769](https://cve.now/CVE-2024-26769.md): nvmet-fc: avoid deadlock on delete association path (CVSS 7.5, Linux)
- [CVE-2024-26768](https://cve.now/CVE-2024-26768.md): LoongArch: Change acpi\_core\_pic\[NR\_CPUS\] to acpi\_core\_pic\[MAX\_CORE\_PIC\] (CVSS 7.2, Linux)
- [CVE-2024-26767](https://cve.now/CVE-2024-26767.md): drm/amd/display: fixed integer types and null check locations (no CVSS, Linux)
- [CVE-2024-26766](https://cve.now/CVE-2024-26766.md): IB/hfi1: Fix sdma.h tx-\>num\_descs off-by-one error (CVSS 7.8, Linux)
- [CVE-2024-26765](https://cve.now/CVE-2024-26765.md): LoongArch: Disable IRQ before init\_fn() for nonboot CPUs (no CVSS, Linux)
- [CVE-2024-26764](https://cve.now/CVE-2024-26764.md): fs/aio: Restrict kiocb\_set\_cancel\_fn() to I/O submitted via libaio (no CVSS, Linux)
- [CVE-2024-26763](https://cve.now/CVE-2024-26763.md): dm-crypt: don't modify the data when using authenticated encryption (CVSS 7.1, Linux)
- [CVE-2024-26762](https://cve.now/CVE-2024-26762.md): cxl/pci: Skip to handle RAS errors if CXL.mem device is detached (CVSS 7.8, Linux)
- [CVE-2024-26761](https://cve.now/CVE-2024-26761.md): cxl/pci: Fix disabling memory if DVSEC CXL Range does not match a CFMWS window (no CVSS, Linux)
- [CVE-2024-26760](https://cve.now/CVE-2024-26760.md): scsi: target: pscsi: Fix bio\_put() for error case (CVSS 9.8, Linux)
- [CVE-2024-26759](https://cve.now/CVE-2024-26759.md): mm/swap: fix race when skipping swapcache (CVSS 7.8, Linux)
- [CVE-2024-26758](https://cve.now/CVE-2024-26758.md): md: Don't ignore suspended array in md\_check\_recovery() (CVSS 5.5, Linux)
- [CVE-2024-26757](https://cve.now/CVE-2024-26757.md): md: Don't ignore read-only array in md\_check\_recovery() (CVSS 5.5, Linux)
- [CVE-2024-26756](https://cve.now/CVE-2024-26756.md): md: Don't register sync\_thread for reshape directly (no CVSS, Linux)
- [CVE-2024-26755](https://cve.now/CVE-2024-26755.md): md: Don't suspend the array for interrupted reshape (CVSS 5.3, Linux)
- [CVE-2024-26754](https://cve.now/CVE-2024-26754.md): gtp: fix use-after-free and null-ptr-deref in gtp\_genl\_dump\_pdp() (no CVSS, Linux)
- [CVE-2024-26753](https://cve.now/CVE-2024-26753.md): crypto: virtio/akcipher - Fix stack overflow on memcpy (no CVSS, Linux)
- [CVE-2024-26752](https://cve.now/CVE-2024-26752.md): l2tp: pass correct message length to ip6\_append\_data (no CVSS, Linux)
- [CVE-2024-26751](https://cve.now/CVE-2024-26751.md): ARM: ep93xx: Add terminator to gpiod\_lookup\_table (no CVSS, Linux)
- [CVE-2024-26749](https://cve.now/CVE-2024-26749.md): usb: cdns3: fixed memory use after free at cdns3\_gadget\_ep\_disable() (no CVSS, Linux)
- [CVE-2024-26748](https://cve.now/CVE-2024-26748.md): usb: cdns3: fix memory double free when handle zero packet (CVSS 7.8, Linux)
- [CVE-2024-26747](https://cve.now/CVE-2024-26747.md): usb: roles: fix NULL pointer issue when put module's reference (CVSS 4.4, Linux)
- [CVE-2024-26744](https://cve.now/CVE-2024-26744.md): RDMA/srpt: Support specifying the srpt\_service\_guid parameter (CVSS 5.5, Linux)
- [CVE-2024-26743](https://cve.now/CVE-2024-26743.md): RDMA/qedr: Fix qedr\_create\_user\_qp error flow (no CVSS, Linux)
- [CVE-2024-26742](https://cve.now/CVE-2024-26742.md): scsi: smartpqi: Fix disable\_managed\_interrupts (no CVSS, Linux)
- [CVE-2024-26741](https://cve.now/CVE-2024-26741.md): dccp/tcp: Unhash sk from ehash for tb2 alloc failure after check\_estalblished(). (no CVSS, Linux)
- [CVE-2024-26740](https://cve.now/CVE-2024-26740.md): net/sched: act\_mirred: use the backlog for mirred ingress (no CVSS, Linux)
- [CVE-2024-26739](https://cve.now/CVE-2024-26739.md): net/sched: act\_mirred: don't override retval if we already lost the skb (CVSS 7.8, Linux)
- [CVE-2024-26738](https://cve.now/CVE-2024-26738.md): powerpc/pseries/iommu: DLPAR add doesn't completely initialize pci\_controller (no CVSS, Linux)
- [CVE-2024-26737](https://cve.now/CVE-2024-26737.md): bpf: Fix racing between bpf\_timer\_cancel\_and\_free and bpf\_timer\_cancel (CVSS 7.8, Linux)
- [CVE-2024-26736](https://cve.now/CVE-2024-26736.md): afs: Increase buffer size in afs\_update\_volume\_status() (CVSS 8.1, Linux)
- [CVE-2024-26735](https://cve.now/CVE-2024-26735.md): ipv6: sr: fix possible use-after-free and null-ptr-deref (no CVSS, Linux)
- [CVE-2024-26734](https://cve.now/CVE-2024-26734.md): devlink: fix possible use-after-free and memory leaks in devlink\_init() (CVSS 7.0, Linux)
- [CVE-2024-26733](https://cve.now/CVE-2024-26733.md): arp: Prevent overflow in arp\_req\_get(). (no CVSS, Linux)
- [CVE-2024-26732](https://cve.now/CVE-2024-26732.md): net: implement lockless setsockopt(SO\_PEEK\_OFF) (no CVSS, Linux)
- [CVE-2024-26731](https://cve.now/CVE-2024-26731.md): bpf, sockmap: Fix NULL pointer dereference in sk\_psock\_verdict\_data\_ready() (CVSS 5.3, Linux)
- [CVE-2024-26730](https://cve.now/CVE-2024-26730.md): hwmon: (nct6775) Fix access to temperature configuration registers (CVSS 7.3, Linux)
- [CVE-2024-26729](https://cve.now/CVE-2024-26729.md): drm/amd/display: Fix potential null pointer dereference in dc\_dmub\_srv (no CVSS, Linux)
- [CVE-2024-26728](https://cve.now/CVE-2024-26728.md): drm/amd/display: fix null-pointer dereference on edid reading (CVSS 7.8, Linux)
- [CVE-2023-52641](https://cve.now/CVE-2023-52641.md): fs/ntfs3: Add NULL ptr dereference checking at the end of attr\_allocate\_frame() (no CVSS, Linux)
- [CVE-2023-52640](https://cve.now/CVE-2023-52640.md): fs/ntfs3: Fix oob in ntfs\_listxattr (CVSS 7.1, Linux)
- [CVE-2024-23540](https://cve.now/CVE-2024-23540.md): HCL BigFix Inventory is vulnerable to path traversal (CVSS 5.3, HCL Software BigFix Inventory)
- [CVE-2024-1180](https://cve.now/CVE-2024-1180.md): TP-Link Omada ER605 Access Control Command Injection Remote Code Execution Vulnerability (CVSS 6.8, TP-Link Omada ER605)
- [CVE-2024-20352](https://cve.now/CVE-2024-20352.md): A vulnerability in Cisco Emergency Responder could allow an authenticated, remote attacker to conduct a directory traversal attack, which co (CVSS 4.9, Cisco Emergency Responder)
- [CVE-2024-20347](https://cve.now/CVE-2024-20347.md): A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to conduct a CSRF attack, which could allow the (CVSS 4.3, Cisco Emergency Responder)
- [CVE-2024-20362](https://cve.now/CVE-2024-20362.md): A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320, and RV325 Routers could al (CVSS 6.1, Cisco Small Business RV Series Router Firmware)
- [CVE-2024-20348](https://cve.now/CVE-2024-20348.md): A vulnerability in the Out-of-Band (OOB) Plug and Play (PnP) feature of Cisco Nexus Dashboard Fabric Controller (NDFC) could allow an unauth (CVSS 7.5, Cisco Data Center Network Manager)
- [CVE-2024-20283](https://cve.now/CVE-2024-20283.md): A vulnerability in Cisco Nexus Dashboard could allow an authenticated, remote attacker to learn cluster deployment information on an affecte (CVSS 4.3, Cisco Nexus Dashboard)
- [CVE-2024-20334](https://cve.now/CVE-2024-20334.md): A vulnerability in the web-based management interface of Cisco TelePresence Management Suite (TMS) could allow a low-privileged, remote atta (CVSS 5.5, Cisco TelePresence Management Suite)
- [CVE-2024-30366](https://cve.now/CVE-2024-30366.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30334](https://cve.now/CVE-2024-30334.md): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30333](https://cve.now/CVE-2024-30333.md): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30332](https://cve.now/CVE-2024-30332.md): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30331](https://cve.now/CVE-2024-30331.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-20368](https://cve.now/CVE-2024-20368.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an unauthenticated, remote attacke (CVSS 6.5, Cisco Identity Services Engine Software)
- [CVE-2024-30330](https://cve.now/CVE-2024-30330.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30329](https://cve.now/CVE-2024-30329.md): Foxit PDF Reader Annotation Use-After-Free Information Disclosure Vulnerability (CVSS 3.3, Foxit PDF Reader)
- [CVE-2024-20367](https://cve.now/CVE-2024-20367.md): A vulnerability in the web UI of Cisco Enterprise Chat and Email (ECE) could allow an authenticated, remote attacker to conduct a cross-site (CVSS 5.4, Cisco Enterprise Chat and Email)
- [CVE-2024-30328](https://cve.now/CVE-2024-30328.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30327](https://cve.now/CVE-2024-30327.md): Foxit PDF Reader template Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-20332](https://cve.now/CVE-2024-20332.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an authenticated, remote attacker (CVSS 5.5, Cisco Identity Services Engine Software)
- [CVE-2024-30326](https://cve.now/CVE-2024-30326.md): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30325](https://cve.now/CVE-2024-30325.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-20302](https://cve.now/CVE-2024-20302.md): A vulnerability in the tenant security implementation of Cisco Nexus Dashboard Orchestrator (NDO) could allow an authenticated, remote attac (CVSS 5.4, Cisco Nexus Dashboard Orchestrator)
- [CVE-2024-30324](https://cve.now/CVE-2024-30324.md): Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30323](https://cve.now/CVE-2024-30323.md): Foxit PDF Reader template Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-30322](https://cve.now/CVE-2024-30322.md): Foxit PDF Reader AcroForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Foxit PDF Reader)
- [CVE-2024-20282](https://cve.now/CVE-2024-20282.md): A vulnerability in Cisco Nexus Dashboard could allow an authenticated, local attacker with valid rescue-user credentials to elevate privileg (CVSS 6.0, Cisco Nexus Dashboard)
- [CVE-2024-20281](https://cve.now/CVE-2024-20281.md): A vulnerability in the web-based management interface of Cisco Nexus Dashboard and Cisco Nexus Dashboard hosted services could allow an unau (CVSS 7.5, Cisco Data Center Network Manager · Cisco Nexus Dashboard)
- [CVE-2024-27346](https://cve.now/CVE-2024-27346.md): Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Kofax Power PDF)
- [CVE-2024-27345](https://cve.now/CVE-2024-27345.md): Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Kofax Power PDF)
- [CVE-2024-20310](https://cve.now/CVE-2024-20310.md): A vulnerability in the web-based interface of Cisco Unified Communications Manager IM & Presence Service (Unified CM IM&P) could allow an un (CVSS 6.1, Cisco IOS XE Software · Cisco Unified Communications Manage…)
- [CVE-2024-27344](https://cve.now/CVE-2024-27344.md): Kofax Power PDF PDF File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27343](https://cve.now/CVE-2024-27343.md): Kofax Power PDF PDF File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Kofax Power PDF)
- [CVE-2024-27342](https://cve.now/CVE-2024-27342.md): Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27341](https://cve.now/CVE-2024-27341.md): Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27340](https://cve.now/CVE-2024-27340.md): Kofax Power PDF PDF File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27339](https://cve.now/CVE-2024-27339.md): Kofax Power PDF PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27338](https://cve.now/CVE-2024-27338.md): Kofax Power PDF app response Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27337](https://cve.now/CVE-2024-27337.md): Kofax Power PDF TIF File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-27336](https://cve.now/CVE-2024-27336.md): Kofax Power PDF PNG File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 3.3, Kofax Power PDF)
- [CVE-2024-27335](https://cve.now/CVE-2024-27335.md): Kofax Power PDF PNG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Kofax Power PDF)
- [CVE-2024-31392](https://cve.now/CVE-2024-31392.md): If an insecure element was added to a page after a delay, Firefox would not replace the secure icon with a mixed content security status Thi (CVSS 7.5, Mozilla Firefox for iOS)
- [CVE-2024-31393](https://cve.now/CVE-2024-31393.md): Dragging Javascript URLs to the address bar could cause them to be loaded, bypassing restrictions and security protections This vulnerabilit (CVSS 4.3, Mozilla Firefox for iOS)
- [CVE-2024-26727](https://cve.now/CVE-2024-26727.md): btrfs: do not ASSERT() if the newly created subvolume already got read (no CVSS, Linux)
- [CVE-2024-26726](https://cve.now/CVE-2024-26726.md): btrfs: don't drop extent\_map for free space inode on write error (no CVSS, Linux)
- [CVE-2024-26725](https://cve.now/CVE-2024-26725.md): dpll: fix possible deadlock during netlink dump operation (no CVSS, Linux)
- [CVE-2024-26724](https://cve.now/CVE-2024-26724.md): net/mlx5: DPLL, Fix possible use after free after delayed work timer triggers (no CVSS, Linux)
- [CVE-2024-26723](https://cve.now/CVE-2024-26723.md): lan966x: Fix crash when adding interface under a lag (CVSS 7.8, Linux)
- [CVE-2024-26722](https://cve.now/CVE-2024-26722.md): ASoC: rt5645: Fix deadlock in rt5645\_jack\_detect\_work() (no CVSS, Linux)
- [CVE-2024-26721](https://cve.now/CVE-2024-26721.md): drm/i915/dsc: Fix the macro that calculates DSCC\_/DSCA\_ PPS reg address (no CVSS, Linux)
- [CVE-2024-26719](https://cve.now/CVE-2024-26719.md): nouveau: offload fence uevents work to workqueue (no CVSS, Linux)
- [CVE-2024-26718](https://cve.now/CVE-2024-26718.md): dm-crypt, dm-verity: disable tasklets (CVSS 7.8, Linux)
- [CVE-2024-26717](https://cve.now/CVE-2024-26717.md): HID: i2c-hid-of: fix NULL-deref on failed power up (no CVSS, Linux)
- [CVE-2024-26716](https://cve.now/CVE-2024-26716.md): usb: core: Prevent null pointer dereference in update\_port\_device\_state (no CVSS, Linux)
- [CVE-2024-26715](https://cve.now/CVE-2024-26715.md): usb: dwc3: gadget: Fix NULL pointer dereference in dwc3\_gadget\_suspend (no CVSS, Linux)
- [CVE-2024-26714](https://cve.now/CVE-2024-26714.md): interconnect: qcom: sc8180x: Mark CO0 BCM keepalive (no CVSS, Linux)
- [CVE-2024-26712](https://cve.now/CVE-2024-26712.md): powerpc/kasan: Fix addr error caused by page alignment (CVSS 7.8, Linux)
- [CVE-2024-26711](https://cve.now/CVE-2024-26711.md): iio: adc: ad4130: zero-initialize clock init data (no CVSS, Linux)
- [CVE-2024-26710](https://cve.now/CVE-2024-26710.md): powerpc/kasan: Limit KASAN thread size increase to 32KB (no CVSS, Linux)
- [CVE-2024-26709](https://cve.now/CVE-2024-26709.md): powerpc/iommu: Fix the missing iommu\_group\_put() during platform domain attach (no CVSS, Linux)
- [CVE-2024-26708](https://cve.now/CVE-2024-26708.md): mptcp: really cope with fastopen race (CVSS 5.5, Linux)
- [CVE-2024-26707](https://cve.now/CVE-2024-26707.md): net: hsr: remove WARN\_ONCE() in send\_hsr\_supervision\_frame() (no CVSS, Linux)
- [CVE-2024-26706](https://cve.now/CVE-2024-26706.md): parisc: Fix random data corruption from exception handler (CVSS 7.8, Linux)
- [CVE-2024-26705](https://cve.now/CVE-2024-26705.md): parisc: BTLB: Fix crash when setting up BTLB at CPU bringup (no CVSS, Linux)
- [CVE-2024-26704](https://cve.now/CVE-2024-26704.md): ext4: fix double-free of blocks due to wrong extents moved\_len (CVSS 7.8, Linux)
- [CVE-2024-26703](https://cve.now/CVE-2024-26703.md): tracing/timerlat: Move hrtimer\_init to timerlat\_fd open() (no CVSS, Linux)
- [CVE-2024-26702](https://cve.now/CVE-2024-26702.md): iio: magnetometer: rm3100: add boundary check for the value read from RM3100\_REG\_TMRC (CVSS 5.5, Linux)
- [CVE-2024-26700](https://cve.now/CVE-2024-26700.md): drm/amd/display: Fix MST Null Ptr for RV (no CVSS, Linux)
- [CVE-2024-26699](https://cve.now/CVE-2024-26699.md): drm/amd/display: Fix array-index-out-of-bounds in dcn35\_clkmgr (CVSS 7.8, Linux)
- [CVE-2024-26698](https://cve.now/CVE-2024-26698.md): hv\_netvsc: Fix race condition between netvsc\_probe and netvsc\_remove (no CVSS, Linux)
- [CVE-2024-26697](https://cve.now/CVE-2024-26697.md): nilfs2: fix data corruption in dsync block recovery for small block sizes (CVSS 7.8, Linux)
- [CVE-2024-26696](https://cve.now/CVE-2024-26696.md): nilfs2: fix hang in nilfs\_lookup\_dirty\_data\_buffers() (no CVSS, Linux)
- [CVE-2024-26695](https://cve.now/CVE-2024-26695.md): crypto: ccp - Fix null pointer dereference in \_\_sev\_platform\_shutdown\_locked (no CVSS, Linux)
- [CVE-2024-26694](https://cve.now/CVE-2024-26694.md): wifi: iwlwifi: fix double-free bug (no CVSS, Linux)
- [CVE-2024-26693](https://cve.now/CVE-2024-26693.md): wifi: iwlwifi: mvm: fix a crash when we run out of stations (no CVSS, Linux)
- [CVE-2024-26692](https://cve.now/CVE-2024-26692.md): smb: Fix regression in writes when non-standard maximum write size negotiated (CVSS 8.3, Linux)
- [CVE-2024-26691](https://cve.now/CVE-2024-26691.md): KVM: arm64: Fix circular locking dependency (no CVSS, Linux)
- [CVE-2024-26690](https://cve.now/CVE-2024-26690.md): net: stmmac: protect updates of 64-bit statistics counters (CVSS 7.5, Linux)
- [CVE-2024-26689](https://cve.now/CVE-2024-26689.md): ceph: prevent use-after-free in encode\_cap\_msg() (CVSS 8.8, Linux)
- [CVE-2024-26688](https://cve.now/CVE-2024-26688.md): fs,hugetlb: fix NULL pointer dereference in hugetlbs\_fill\_super (no CVSS, Linux)
- [CVE-2024-26687](https://cve.now/CVE-2024-26687.md): xen/events: close evtchn after mapping cleanup (no CVSS, Linux)
- [CVE-2024-26686](https://cve.now/CVE-2024-26686.md): fs/proc: do\_task\_stat: use sig-\>stats\_lock to gather the threads/children stats (no CVSS, Linux)
- [CVE-2024-26685](https://cve.now/CVE-2024-26685.md): nilfs2: fix potential bug in end\_buffer\_async\_write (CVSS 5.5, Linux)
- [CVE-2023-52639](https://cve.now/CVE-2023-52639.md): KVM: s390: vsie: fix race during shadow creation (no CVSS, Linux)
- [CVE-2023-52638](https://cve.now/CVE-2023-52638.md): can: j1939: prevent deadlock by changing j1939\_socks\_lock to rwlock (no CVSS, Linux)
- [CVE-2023-52637](https://cve.now/CVE-2023-52637.md): can: j1939: Fix UAF in j1939\_sk\_match\_filter during setsockopt(SO\_J1939\_FILTER) (CVSS 7.8, Linux)
- [CVE-2024-31420](https://cve.now/CVE-2024-31420.md): Cnv: dos through repeatedly calling vm-dump-metrics until virt handler crashes (CVSS 6.5, cnv · Red Hat OpenShift Virtualization +1)
- [CVE-2024-31419](https://cve.now/CVE-2024-31419.md): Cnv: information disclosure through the usage of vm-dump-metrics (CVSS 4.3, cnv · Red Hat OpenShift Virtualization)
- [CVE-2024-24976](https://cve.now/CVE-2024-24976.md): A denial of service vulnerability exists in the OAS Engine File Data Source Configuration functionality of Open Automation Software OAS Plat (CVSS 4.9, Open Automation Software OAS Platform)
- [CVE-2024-27201](https://cve.now/CVE-2024-27201.md): An improper input validation vulnerability exists in the OAS Engine User Configuration functionality of Open Automation Software OAS Platfor (CVSS 4.9, Open Automation Software OAS Platform)
- [CVE-2024-21870](https://cve.now/CVE-2024-21870.md): A file write vulnerability exists in the OAS Engine Tags Configuration functionality of Open Automation Software OAS Platform V19.00.0057. (CVSS 4.9, Open Automation Software OAS Platform)
- [CVE-2024-22178](https://cve.now/CVE-2024-22178.md): A file write vulnerability exists in the OAS Engine Save Security Configuration functionality of Open Automation Software OAS Platform V19.0 (CVSS 4.9, Open Automation Software OAS Platform)
- [CVE-2024-0394](https://cve.now/CVE-2024-0394.md): Rapid7 Minerva Armor Privilege Escalation (CVSS 7.8, Rapid7 Minerva)
- [CVE-2024-3259](https://cve.now/CVE-2024-3259.md): SourceCodester Internship Portal Management System delete\_activity.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-3258](https://cve.now/CVE-2024-3258.md): SourceCodester Internship Portal Management System add\_activity.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-3257](https://cve.now/CVE-2024-3257.md): SourceCodester Internship Portal Management System edit\_activity\_query.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-22360](https://cve.now/CVE-2024-22360.md): IBM Db2 for Linux, UNIX and Windows denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-3256](https://cve.now/CVE-2024-3256.md): SourceCodester Internship Portal Management System edit\_activity.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2023-52296](https://cve.now/CVE-2023-52296.md): IBM Db2 for Linux, UNIX and Windows denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-38729](https://cve.now/CVE-2023-38729.md): IBM Db2 information disclosure (CVSS 6.8, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-27254](https://cve.now/CVE-2024-27254.md): IBM Db2 for Linux, UNIX and Windows denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2023-25699](https://cve.now/CVE-2023-25699.md): WordPress VideoWhisper Live Streaming Integration plugin \<= 5.5.15 - Remote Code Execution (RCE) (CVSS 9.0, VideoWhisper.com VideoWhisper Live Streaming Integration)
- [CVE-2024-24707](https://cve.now/CVE-2024-24707.md): WordPress Cwicly plugin \<= 1.4.0.2 - Auth. Remote Code Execution (RCE) vulnerability (CVSS 9.9, Cwicly Builder, SL. Cwicly)
- [CVE-2024-25096](https://cve.now/CVE-2024-25096.md): WordPress canto plugin \<= 3.0.7 - Unauth. Remote Code Execution (RCE) vulnerability (CVSS 10.0, Canto)
- [CVE-2024-25046](https://cve.now/CVE-2024-25046.md): IBM Db2 for Linux, UNIX and Windows denial of service (CVSS 5.3, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-25030](https://cve.now/CVE-2024-25030.md): IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 stores potentially sensitive information in log files that could be r (CVSS 6.2, IBM Db2 for Linux, UNIX and Windows)
- [CVE-2024-25918](https://cve.now/CVE-2024-25918.md): WordPress InstaWP Connect plugin \<= 0.1.0.8 - Remote Code Execution vulnerability (CVSS 9.9, InstaWP Connect)
- [CVE-2024-27191](https://cve.now/CVE-2024-27191.md): WordPress Slivery Extender plugin \<= 1.0.2 - Remote Code Execution (RCE) vulnerability (CVSS 8.5, inpersttion Slivery Extender)
- [CVE-2024-28782](https://cve.now/CVE-2024-28782.md): IBM QRadar Suite Software information disclosure (CVSS 6.3, IBM QRadar Suite Software · IBM Cloud Pak for Security)
- [CVE-2024-3255](https://cve.now/CVE-2024-3255.md): SourceCodester Internship Portal Management System edit\_admin\_query.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-3254](https://cve.now/CVE-2024-3254.md): SourceCodester Internship Portal Management System edit\_admin.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-27951](https://cve.now/CVE-2024-27951.md): WordPress Multiple Page Generator Plugin \<= 3.4.0 - Auth. Remote Code Execution (RCE) vulnerability (CVSS 9.1, Themeisle Multiple Page Generator Plugin – MPG)
- [CVE-2024-27972](https://cve.now/CVE-2024-27972.md): WordPress WP Fusion Lite plugin \<= 3.41.24 - Remote Code Execution (RCE) vulnerability (CVSS 9.9, Jack Arturo WP Fusion Lite)
- [CVE-2024-31380](https://cve.now/CVE-2024-31380.md): WordPress Oxygen plugin \<= 4.9 - Authenticated Remote Code Execution (RCE) vulnerability (CVSS 9.9, Soflyy Oxygen Builder)
- [CVE-2024-31390](https://cve.now/CVE-2024-31390.md): WordPress Breakdance plugin \<= 1.7.2 - Authenticated Remote Code Execution (RCE) vulnerability (CVSS 9.9, Soflyy Breakdance)
- [CVE-2024-3253](https://cve.now/CVE-2024-3253.md): SourceCodester Internship Portal Management System add\_admin.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-3252](https://cve.now/CVE-2024-3252.md): SourceCodester Internship Portal Management System check\_admin.php sql injection (CVSS 6.3, SourceCodester Internship Portal Management System)
- [CVE-2024-3251](https://cve.now/CVE-2024-3251.md): SourceCodester Computer Laboratory Management System sql injection (CVSS 6.3, SourceCodester Computer Laboratory Management System)
- [CVE-2024-0172](https://cve.now/CVE-2024-0172.md): Dell PowerEdge Server BIOS and Dell Precision Rack BIOS contain an improper privilege management security vulnerability. (CVSS 7.9, Dell PowerEdge Platform)
- [CVE-2024-29734](https://cve.now/CVE-2024-29734.md): Uncontrolled search path element issue exists in SonicDICOM Media Viewer 2.3.2 and earlier, which may lead to insecurely loading Dynamic Lin (CVSS 7.8, Fujidenolo Solutions Co. SonicDICOM Media Viewer)
- [CVE-2023-35764](https://cve.now/CVE-2023-35764.md): Insufficient verification of data authenticity issue in Survey Maker prior to 3.6.4 allows a remote unauthenticated attacker to spoof an IP (CVSS 5.3, AYS Pro Plugins Survey Maker)
- [CVE-2023-34423](https://cve.now/CVE-2023-34423.md): Survey Maker prior to 3.6.4 contains a stored cross-site scripting vulnerability. (CVSS 6.1, AYS Pro Plugins Survey Maker)
- [CVE-2024-2322](https://cve.now/CVE-2024-2322.md): WooCommerce Cart Abandonment Recovery \< 1.2.27 - Templates/Abandoned Orders Deletion via CSRF (CVSS 6.8, WooCommerce Cart Abandonment Recovery)
- [CVE-2024-2879](https://cve.now/CVE-2024-2879.md): The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls\_get\_popup\_markup action in versions 7.9.11 and 7.10.0 due to (CVSS 9.8, LayerSlider)
- [CVE-2024-3162](https://cve.now/CVE-2024-3162.md): Jeg Elementor Kit \<= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Testimonial (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2024-1327](https://cve.now/CVE-2024-1327.md): Jeg Elementor Kit \<= 2.6.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Image Box (CVSS 6.4, jegtheme Jeg Kit for Elementor – Powerful Addons for Elemen…)
- [CVE-2024-3227](https://cve.now/CVE-2024-3227.md): Panwei eoffice OA Backend save\_image.php path traversal (CVSS 4.7, Panwei eoffice OA)
- [CVE-2024-3226](https://cve.now/CVE-2024-3226.md): Campcodes Online Patient Record Management System login.php sql injection (CVSS 7.3, Campcodes Online Patient Record Management System)
- [CVE-2024-3225](https://cve.now/CVE-2024-3225.md): SourceCodester PHP Task Management System edit-task.php sql injection (CVSS 6.3, SourceCodester PHP Task Management System)
- [CVE-2024-3224](https://cve.now/CVE-2024-3224.md): SourceCodester PHP Task Management System task-details.php sql injection (CVSS 6.3, SourceCodester PHP Task Management System)
- [CVE-2024-3223](https://cve.now/CVE-2024-3223.md): SourceCodester PHP Task Management System admin-manage-user.php sql injection (CVSS 6.3, SourceCodester PHP Task Management System)
- [CVE-2024-3222](https://cve.now/CVE-2024-3222.md): SourceCodester PHP Task Management System admin-password-change.php sql injection (CVSS 6.3, SourceCodester PHP Task Management System)
- [CVE-2024-3221](https://cve.now/CVE-2024-3221.md): SourceCodester PHP Task Management System attendance-info.php sql injection (CVSS 6.3, SourceCodester PHP Task Management System)
- [CVE-2021-27312](https://cve.now/CVE-2021-27312.md): Server Side Request Forgery (SSRF) vulnerability in Gleez Cms 1.2.0, allows remote attackers to execute arbitrary code and obtain sensitive (CVSS 9.4, gleez/cms)
- [CVE-2023-35812](https://cve.now/CVE-2023-35812.md): An issue was discovered in the Amazon Linux packages of OpenSSH 7.4 for Amazon Linux 1 and 2, because of an incomplete fix for CVE-2019-6111 (CVSS 5.3)
- [CVE-2023-44038](https://cve.now/CVE-2023-44038.md): In VeridiumID before 3.5.0, the identity provider page allows an unauthenticated attacker to discover information about registered users via (CVSS 6.5)
- [CVE-2023-44039](https://cve.now/CVE-2023-44039.md): In VeridiumID before 3.5.0, the WebAuthn API allows an internal unauthenticated attacker (who can pass enrollment verifications and is allow (CVSS 9.1)
- [CVE-2023-44040](https://cve.now/CVE-2023-44040.md): In VeridiumID before 3.5.0, the identity provider page is susceptible to a cross-site scripting (XSS) vulnerability that can be exploited by (CVSS 6.1)
- [CVE-2023-45552](https://cve.now/CVE-2023-45552.md): In VeridiumID before 3.5.0, a stored cross-site scripting (XSS) vulnerability has been discovered in the admin portal that allows an authent (CVSS 6.5)
- [CVE-2023-52043](https://cve.now/CVE-2023-52043.md): An issue in D-Link COVR 1100, 1102, 1103 AC1200 Dual-Band Whole-Home Mesh Wi-Fi System (Hardware Rev B1) truncates Wireless Access Point Pas (CVSS 8.1)
- [CVE-2024-24506](https://cve.now/CVE-2024-24506.md): Cross Site Scripting (XSS) vulnerability in Lime Survey Community Edition Version v.5.3.32+220817, allows remote attackers to execute arbitr (CVSS 6.1)
- [CVE-2024-24724](https://cve.now/CVE-2024-24724.md): Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution (CVSS 9.8)
- [CVE-2024-25864](https://cve.now/CVE-2024-25864.md): Server Side Request Forgery (SSRF) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code a (CVSS 9.1)
- [CVE-2024-26495](https://cve.now/CVE-2024-26495.md): Cross Site Scripting (XSS) vulnerability in Friendica versions after v.2023.12, allows a remote attacker to execute arbitrary code and obtai (CVSS 6.1)
- [CVE-2024-27674](https://cve.now/CVE-2024-27674.md): Macro Expert through 4.9.4 allows BUILTIN\\Users:(OI)(CI)(M) access to the "%PROGRAMFILES(X86)%\\GrassSoft\\Macro Expert" folder and thus an un (CVSS 7.8)
- [CVE-2024-27705](https://cve.now/CVE-2024-27705.md): Cross Site Scripting vulnerability in Leantime v3.0.6 allows attackers to execute arbitrary code via upload of crafted PDF file to the files (CVSS 7.6)
- [CVE-2024-27706](https://cve.now/CVE-2024-27706.md): Cross Site Scripting vulnerability in Huly Platform v.0.6.202 allows attackers to execute arbitrary code via upload of crafted SVG file to i (CVSS 6.1)
- [CVE-2024-28219](https://cve.now/CVE-2024-28219.md): In \_imagingcms.c in Pillow before 10.3.0, a buffer overflow exists because strcpy is used instead of strncpy. (CVSS 6.7, pillow)
- [CVE-2024-28275](https://cve.now/CVE-2024-28275.md): Puwell Cloud Tech Co, Ltd 360Eyes Pro v3.9.5.16(3090516) was discovered to transmit sensitive information in cleartext. (CVSS 6.5)
- [CVE-2024-28515](https://cve.now/CVE-2024-28515.md): Buffer Overflow vulnerability in CSAPP\_Lab CSAPP Lab3 15-213 Fall 20xx allows a remote attacker to execute arbitrary code via the lab3 of cs (CVSS 9.8)
- [CVE-2024-28589](https://cve.now/CVE-2024-28589.md): An issue was discovered in Axigen Mail Server for Windows versions 10.5.18 and before, allows local low-privileged attackers to execute arbi (CVSS 6.7)
- [CVE-2024-28755](https://cve.now/CVE-2024-28755.md): An issue was discovered in Mbed TLS 3.5.x before 3.6.0. (CVSS 6.5)
- [CVE-2024-28836](https://cve.now/CVE-2024-28836.md): An issue was discovered in Mbed TLS 3.5.x before 3.6.0. (CVSS 5.4)
- [CVE-2024-29413](https://cve.now/CVE-2024-29413.md): Cross Site Scripting vulnerability in Webasyst v.2.9.9 allows a remote attacker to run arbitrary code via the Instant messenger field in the (CVSS 5.4)
- [CVE-2024-29477](https://cve.now/CVE-2024-29477.md): Lack of sanitization during Installation Process in Dolibarr ERP CRM up to version 19.0.0 allows an attacker with adjacent access to the net (CVSS 8.8, dolibarr/dolibarr)
- [CVE-2024-30166](https://cve.now/CVE-2024-30166.md): In Mbed TLS 3.3.0 through 3.5.2 before 3.6.0, a malicious client can cause information disclosure or a denial of service because of a stack (CVSS 9.1)
- [CVE-2024-30568](https://cve.now/CVE-2024-30568.md): Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter. (CVSS 9.8)
- [CVE-2024-30569](https://cve.now/CVE-2024-30569.md): An information leak in currentsetting.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentica (CVSS 7.5)
- [CVE-2024-30570](https://cve.now/CVE-2024-30570.md): An information leak in debuginfo.htm of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication (CVSS 5.3)
- [CVE-2024-30571](https://cve.now/CVE-2024-30571.md): An information leak in the BRS\_top.html component of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any au (CVSS 7.5)
- [CVE-2024-30572](https://cve.now/CVE-2024-30572.md): Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the ntp\_server parameter. (CVSS 8.0)
- [CVE-2024-30998](https://cve.now/CVE-2024-30998.md): SQL Injection vulnerability in PHPGurukul Men Salon Management System v.2.0, allows remote attackers to execute arbitrary code and obtain se (CVSS 9.8)
- [CVE-2024-31008](https://cve.now/CVE-2024-31008.md): An issue was discovered in WUZHICMS version 4.1.0, allows an attacker to execute arbitrary code and obtain sensitive information via the ind (CVSS 6.5)
- [CVE-2024-31009](https://cve.now/CVE-2024-31009.md): SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via lgid parameter in Banner.php. (CVSS 6.5)
- [CVE-2024-31010](https://cve.now/CVE-2024-31010.md): SQL injection vulnerability in SEMCMS v.4.8, allows a remote attacker to obtain sensitive information via the ID parameter in Banner.php. (CVSS 7.5)
- [CVE-2024-31011](https://cve.now/CVE-2024-31011.md): Arbitrary file write vulnerability in beescms v.4.0, allows a remote attacker to execute arbitrary code via a file path that was not isolate (CVSS 9.8)
- [CVE-2024-31012](https://cve.now/CVE-2024-31012.md): An issue was discovered in SEMCMS v.4.8, allows remote attackers to execute arbitrary code, escalate privileges, and obtain sensitive inform (CVSS 9.8)
- [CVE-2024-31013](https://cve.now/CVE-2024-31013.md): Cross Site Scripting (XSS) vulnerability in emlog version Pro 2.3, allow remote attackers to execute arbitrary code via a crafted payload to (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2024-04-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.