CVEs published in March 2024
3,385 vulnerabilities, 290 critical, 8 exploited.
- twentyThe CRM platform Twenty version 0.3.0 is vulnerable to SSRF via file upload.5.4 Medium
- crm platform twenty, twenty +1 moreThe CRM platform Twenty is vulnerable to stored cross site scripting via file upload in version 0...7.6 High
- cobub razorSQL Injection vulnerability in Razor 0.8.0 allows a remote attacker to escalate privileges via...9.8 Critical
- prestashop scalapaySQL injection vulnerability in scalapay v.1.2.41 and before allows a remote attacker to escalate...9.8 Critical
- axonautAn issue in axonaut v.3.1.23 and before allows a remote attacker to obtain sensitive information...7.5 High
- home-made io fastmagsync, home-made fastmag sync +1 moreAn issue in Home-Made.io fastmagsync v.1.7.51 and before allows a remote attacker to execute...9.8 Critical
- kickdler, kickidler employee monitoring +1 moreAn issue in Kickdler before v1.107.0 allows attackers to provide an XSS payload via a HTTP...6.1 Medium
- red hat enterprise linux 7, enterprise linux 8, enterprise linux 9 +2 moreFreeipa: specially crafted http requests potentially lead to denial of service5.3 Medium
- readymedia project readymediaStack-buffer-overflow vulnerability in ReadyMedia (MiniDLNA) v1.3.3 allows attackers to cause a...7.5 High
- haxtheweb issuesMalicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files7.8 High
- wixtoolset project burn, haxtheweb issues +1 moreWiX based installers are vulnerable to binary hijack when run as SYSTEM7.3 High
- carrierwave project carrierwaveCarrierWave's Content-Type allowlist bypass vulnerability which possibly leads to XSS remained6.8 Medium
- hackerbay oneuptimeOneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation8.3 High
- cyberaz0r webratcyberaz0r WebRAT api.php download_file unrestricted upload5.3 Medium
- tenda ac10, ac10 firmware +1 moreTenda AC10 SetSysTimeCfg fromSetSysTime stack-based overflow8.8 High
- tenda ac15, ac15 firmware +1 moreTenda AC15 SetSysTimeCfg fromSetSysTime stack-based overflow8.8 High
- tenda ac18, ac18 firmware +1 moreTenda AC18 setsambacfg formSetSambaConf os command injection6.3 Medium
- tenda ac10u, ac10u firmware +1 moreTenda AC10U setsambacfg formSetSambaConf os command injection6.3 Medium
- tenda ac15, ac15 firmware +1 moreTenda AC15 saveParentControlInfo stack-based overflow8.8 High
- tenda ac15, ac15 firmware +1 moreTenda AC15 setsambacfg formSetSambaConf os command injection6.3 Medium
- tenda ac15, ac15 firmware +1 moreTenda AC15 saveParentControlInfo stack-based overflow8.8 High
javaparserOSS-FuzzSecurity exception in com.github.javaparser.ast.validator.TreeVisitorValidator.acceptNo scorelibxml2OSS-FuzzHeap-use-after-free in xmlDOMWrapNSNormAcquireNormalizedNsNo scorelibxml2OSS-FuzzUse-of-uninitialized-value in api.cNo score- qtIn Qt before 6.5.6 and 6.6.x before 6.6.3, the wasm component may access QNetworkReply header...6.5 Medium
varnishAlmaLinux,rh-varnish6-varnishRed Hat,rh-varnish6-varnish-develRed Hat +10 more +12 moreVarnish Cache before 7.3.2 and 7.4.x before 7.4.3 (and before 6.0.13 LTS), and Varnish Enterprise...7.5 High- No product listedThe XAO::Web module before 1.84 for Perl mishandles < and > characters in JSON output during use...5.4 Medium
- mojoliciousThe Mojolicious module before 7.66 for Perl may leak cookies in certain situations related to...5.3 Medium
- paddlepaddle paddle, paddlepaddle, paddlepaddle paddlepaddle/paddle +2 moreconfirmed8.2 High
- sourcecodester simple file manager, ganeshrkt simple file manager web app +1 moreSourceCodester Simple File Manager unrestricted upload6.3 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 3.3.9 - Broken Access Control vulnerability8.2 High
- realmag777 bear, pluginus bear - woocommerce bulk editor and products manager professional +1 moreWordPress BEAR plugin <= 1.1.4 - Broken Access Control vulnerability4.3 Medium
- bdthemes element pack elementor addons, element pack +1 moreWordPress Element Pack Elementor Addons plugin <= 5.4.11 - Broken Access Control on Duplicate Post vulnerability4.3 Medium
- campcodes online shopping systemCampcodes Online Shopping System offersmail.php cross site scripting3.5 Low
- caseproof prettylinks, supercleanse prettylinks – affiliate links, link branding, link tracking, marketing and stripe payments plugin +1 morePretty Links – Affiliate Links, Link Branding, Link Tracking & Marketing Plugin <= 3.6.3 - Cross-Site Request Forgery to Plugin Settings Update4.3 Medium
- godaddy coblocks, page builder gutenberg blocks – coblocks +1 morePage Builder Gutenberg Blocks – CoBlocks <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpdeveloper embedpress, wpdevteam embedpress – pdf embedder, embed youtube videos, 3d flipbook, social feeds, docs & more +1 moreEmbedPress <= 3.9.12 - Authenticated(Contributor+) Stored Cross-Site Scripting via Widget Attribute6.4 Medium
- wpdeveloper embedpress, wpdevteam embedpress – pdf embedder, embed youtube videos, 3d flipbook, social feeds, docs & more +1 moreEmbedPress – Embed PDF, Google Docs, Vimeo, Wistia, Embed YouTube Videos, Audios, Maps & Embed Any Documents in Gutenberg & Elementor <= 3.9.12 - Authenticated (Contributor+) Stored Cross-site Scripti…5.4 Medium
- gpriday page builder by siteorigin, siteorigin page builder +1 morePage Builder by SiteOrigin <= 2.29.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Legacy Image Widget6.4 Medium
- moveaddons move addons for elementorMove Addons for Elementor <= 1.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- svenl77 buddypress woocommerce my account integration. create woocommerce member pages, themekraft buddypress woocommerce my account integration +1 moreBuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.20 - Authenticated (Subscriber+) PHP Object Injection in get_simple_request8.8 High
- themelocation custom woocommerce checkout fields editorCustom WooCommerce Checkout Fields Editor <= 1.3.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
htslibOSS-FuzzNegative-size-param in vcf_parse_formatNo scorepcre2OSS-FuzzHeap-buffer-overflow in pcre2_fuzzsupport.cNo score- gibbonedu gibbonGibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks...8.8 High
- clickup, clickup desktop +1 moreClickUp Desktop before 3.3.77 on macOS and Windows allows code injection because of specific...8.8 High
- microsoft .net framework, .net framework 2.0 service pack 2, .net framework 3.0 service pack 2 +9 more +11 more.NET Framework Information Disclosure Vulnerability7.5 High
- mobsf mobile security framework, mobile-security-framework-mobsf +1 moreMobSF SSRF Vulnerability on assetlinks_check(act_name, well_knowns)7.5 High
- microsoft edge, edge (chromium-based) +1 moreMicrosoft Edge (Chromium-based) Spoofing Vulnerability4.3 Medium
- microsoft edge, edge (chromium-based) +1 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability4.7 Medium
- Show moreLoading…