CVEs published in March 2024
3,385 vulnerabilities, 290 critical, 8 exploited.
- microsoft edge, edge for android +1 moreMicrosoft Edge for Android Spoofing Vulnerability4.3 Medium
- red hat openshift container platform 4.13, openshift container platform 4.14, openshift container platform 4.15 +5 more +7 moreKubevirt-csi: persistentvolume allows access to hcp's root node6.5 Medium
nssTuxCare,nss-develTuxCare,nss-pkcs11-develTuxCare +2 more +4 moreUpdate of nssNo score- pagelayer, softaculous page builder: pagelayer – drag and drop website builder +1 morePage Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes6.4 Medium
- wpdeveloper embedpress, wpdevteam embedpress – pdf embedder, embed youtube videos, 3d flipbook, social feeds, docs & more +1 moreEmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.10 - Authenticated (Contributor+) Stored Cross-Site Scripti…6.4 Medium
- unitedover digits, digits: wordpress mobile number signup and login +1 moreThe Digits plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to,...8.8 High
linux-firmwareTuxCare,iwl1000-firmwareTuxCare,iwl100-firmwareTuxCare +21 more +23 moreUpdate of linux-firmwareNo score- acowebs pdf invoices and packing slips for woocommerce, pdf invoices and packing slips +1 morePDF Invoices and Packing Slips For WooCommerce <= 1.3.7 - Authenticated (Subscriber+) PHP Object Injection8.8 High
- grafanaUser with permissions to create a data source can CRUD all data sources6.0 Medium
- appsup-dart jose, fedoraproject fedora +1 morejose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext4.9 Medium
- wasmi-labs wasmiWasmi Out-of-bounds Write for host to Wasm calls with more than 128 Parameters7.3 High
- mongodb, mongodb inc server, mongodb, inc. mongodb server +2 more +4 moreMongoDB Server may allow successful untrusted connection8.8 High
- netgear rax30, rax30 firmware +1 moreA stack-based buffer overflow vulnerability exists in the JSON Parsing getblockschedule()...7.2 High
- jfrog artifactoryJFrog Artifactory Sensitive Data Leakage in Repository configuration process6.6 Medium
- jfrog artifactoryJFrog Artifactory Improper input validation leads to arbitrary file write7.2 High
- citrix workspaceImproper access control in the user interface in Devolutions Workspace 2024.1.0 and earlier...6.3 Medium
- mozilo mozilocmsCross-Site Scripting vulnerability in moziloCMS5.4 Medium
- paddlepaddle, paddlepaddle paddlepaddle/paddle +1 morePaddlePaddle Path Traversal vulnerability9.1 Critical
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 attaching/detaching workflow to a project was possible...6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 user without appropriate permissions could restore...6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2024.1.25893 creation comments on behalf of an arbitrary user in...5.3 Medium
- svenl7 post form, svenl77 post form – registration form – profile form for user profiles – frontend content forms for user submissions (ugc) +1 morePost Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Upload7.5 High
- svenl77 post form – registration form – profile form for user profiles – frontend content forms for user submissions (ugc), themekraft post form +1 morePost Form – Registration Form – Profile Form for User Profiles – Frontend Content Forms for User Submissions (UGC) <= 2.8.7 - Missing Authorization to Unauthenticated Media Deletion8.2 High
- vmware cloud directorVMware Cloud Director contains a partial information disclosure vulnerability. A malicious actor...4.3 Medium
- booster for woocommerce, pluggabl booster for woocommerce – pdf invoices, abandoned cart, variation swatches & 100+ tools +1 moreBooster for WooCommerce <= 7.1.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortocde6.4 Medium
- nlnet labs unbound, fedoraproject fedora +1 moreDenial of service when trimming EDE text on positive replies7.5 High
- wpkoi templates for elementor, wpkoithemes wpkoi templates for elementor +1 moreWPKoi Templates for Elementor <= 2.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Advanced Heading Widget6.4 Medium
- nicdark restaurant reservationsRestaurant Reservations <= 1.9 - Directory Traversal to Authenticated (Contributor+) Local File Inclusion8.8 High
- jfrog artifactoryJFrog Artifactory Improper SSO Mechanism may lead to Exposure of Access Tokens9.3 Critical
- paddlepaddle paddle, paddlepaddle, paddlepaddle paddlepaddle/paddle +2 morePaddlePaddle vulnerable to remote code execution9.4 Critical
- posimyth the plus addons for elementor, posimyththemes the plus addons for elementor – addons for elementor, page templates, widgets, mega menu, woocommerce +1 moreThe Plus Addons for Elementor <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Header Meta Content Widget6.4 Medium
- bdthemes prime slider – addons for elementor, prime slider +1 morePrime Slider – Addons For Elementor <= 3.13.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Fiestar Widget6.4 Medium
- leevio happy addons for elementorHappy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Author Meta Widget6.4 Medium
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builder, user registration \& membership +1 moreUser Registration – Custom Registration Form, Login Form, and User Profile WordPress Plugin <= 3.1.4 - Unauthenticated Stored Self-Based Cross-Site Scripting4.7 Medium
- royal-elementor-addons royal elementor addons, wproyal royal addons for elementor – addons and templates kit for elementor +1 moreRoyal Elementor Addons and Templates <= 1.3.91 - Authenticated (Contributor+) Stored Cross-Site Scripting via Logo Widget5.4 Medium
- leevio happy addons for elementorHappy Addons for Elementor <= 3.10.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Archive Title Widget6.4 Medium
- silabs z-wave software development kit, silicon labs z-wave sdk +1 moreZ-Wave S0 Decryption Vulnerability in End Devices8.8 High
- naver ngrindernGrinder before 3.5.9 allows an attacker to obtain the results of webhook requests due to lack of...5.4 Medium
- naver ngrindernGrinder before 3.5.9 allows an attacker to create or update webhook configuration due to lack of...7.5 High
- naver ngrindernGrinder before 3.5.9 allows to set delay without limitation, which could be the cause of Denial...2.7 Low
- naver ngrindernGrinder vulnerable to unsafe Java objects deserialization9.8 Critical
- naver ngrindernGrinder before 3.5.9 uses old version of SnakeYAML, which could allow remote attacker to execute...9.8 Critical
- naver ngrindernGrinder before 3.5.9 allows connection to malicious JMX/RMI server by default, which could be...9.8 Critical
- ninjateam wp chat appWP Chat App <= 3.6.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Block Attributes6.4 Medium
- schoolboxStored Cross-site Scripting in Calendar functionality in Schoolbox7.3 High
- schoolboxStored Cross-site Scripting in Class functionality in Schoolbox7.3 High
- schoolboxStored Cross-site Scripting in News functionality in Schoolbox7.3 High
- schoolboxBlind SQL Injection in Chat functionality in Schoolbox8.8 High
- paddlepaddle paddle, paddlepaddle, paddlepaddle paddlepaddle/paddle +2 morePaddlePaddle command injection in paddle.utils.download._wget_download9.3 Critical
- msi afterburnerMSI Afterburner v4.6.5.16370 - Kernel Memory Leak5.6 Medium
- Show moreLoading…