CVEs published in March 2024
3,385 vulnerabilities, 290 critical, 8 exploited.
- etoile web design front end usersWordPress Front End Users plugin < 3.2.25 - Cross Site Scripting (XSS) vulnerability7.1 High
- jeff starr user submitted postsWordPress User Submitted Posts plugin <= 20230901 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- bestwebsoft captcha, contact form with captcha form with captcha +1 moreWordPress Contact Form With Captcha plugin <= 1.6.8 - Reflected Cross Site Scripting (XSS) vulnerability7.1 High
- klbtheme bacola theme, clotya theme, cosmetsy theme +4 more +6 moreCross-Site Request Forgery (CSRF) vulnerability in multiple themes by KlbTheme4.3 Medium
- klbtheme bacola theme (core plugin), clotya theme (core plugin), cosmetsy theme (core plugin) +3 more +5 moreReflected Cross-Site Scripting vulnerability in multiple WordPress components by KlbTheme7.1 High
- envialosimple envíalosimpleWordPress EnvíaloSimple plugin <= 2.2 - Cross Site Request Forgery (CSRF) vulnerability6.5 Medium
- unknown wp-lister lite for amazonWordPress WP-Lister Lite for Amazon plugin <= 2.6.11 - Cross Site Scripting (XSS) vulnerability5.9 Medium
- boldgrid post and page builder by boldgrid – visual drag and drop editor, post and page builder +1 moreWordPress Post and Page Builder by BoldGrid plugin <= 1.26.2 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- flector easy textillateEasy Textillate <= 2.01 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode6.4 Medium
- pickplugins testimonial slider, radiustheme testimonial slider and showcase +1 moreTestimonial Slider < 2.3.7 - Author+ Settings Update4.3 Medium
- unknown backup and restore wordpress, wpbackitup wp backitup +1 moreBackup and Restore WordPress <= 1.45 - Unauthenticated Sensitive Data Exposure5.3 Medium
- hidekazu ishikawa vk all in one expansion unitVK All in One Expansion Unit <= 9.96.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className6.4 Medium
- checkemail check & log email – easy email testing & mail logging, checkmail check and log email +1 moreCheck & Log Email <= 1.0.9 - Unauthenticated Hook Injection8.1 High
- azure azure-c-shared-utility, microsoft azure c shared utility +1 moreAzure C SDK Integer Wraparound Vulnerability6.0 Medium
- themify shortcodes, themifyme themify shortcodes +1 moreThemify Shortcodes <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting5.4 Medium
- nautobotUnauthenticated views may expose information to anonymous users3.7 Low
- dedecmsDedeCMS v5.7 was discovered to contain a Cross-Site Request Forgery (CSRF) via the component /src...9.8 Critical
- dcatadmin dcat admindcat-admin Cross Site Scripting vulnerability6.1 Medium
- mindskip xzs-mysqlxzs-mysql 3.8 is vulnerable to Insufficient Session Expiration, which allows attackers to use the...9.8 Critical
- tenda ac18 firmwareTenda AC18 V15.03.05.05 has a stack overflow vulnerability in the ssid parameter of...7.5 High
- tenda ac18 firmwareTenda AC18 V15.03.05.05 contains a command injection vulnerablility in the deviceName parameter...9.8 Critical
- yealink vp59 firmwareDirectory Traversal vulnerability in Yealink VP59 v.91.15.0.118 allows a physically proximate...7.5 High
- adtran netvanta 3120 firmwareThe TELNET service of AdTran NetVanta 3120 18.01.01.00.E devices is enabled by default, and has...8.8 High
- totolink a3300r firmwareTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain an unauthenticated remote...8.0 High
- emilianavt vseefaceVSeeFace through 1.13.38.c2 allows attackers to cause a denial of service (application hang) via...7.5 High
- ignite realtime openfireIgnite Realtime Openfire privilege escalation vulnerability9.8 Critical
- igniterealtime openfireIgnite Realtime Openfire privilege escalation vulnerability7.2 High
- fluent bit, treasuredata fluent bit +1 moreIn Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP...7.5 High
- trendnet tew-821dap firmware, tew-821dap v2.0r firmware, tew-821dap v2.5r firmware +2 moreAn issue in TRENDnet Trendnet AC1200 Dual Band PoE Indoor Wireless Access Point TEW-821DAP v.3...8.0 High
- trendnet tew-821dap firmware, tew-821dap v2.0r firmware, tew-821dap v2.5r firmware +2 moreBuffer Overflow vulnerability in TRENDnet Trendnet AC1200 TEW-821DAP with firmware version 3...8.0 High
- trendnet tew-821dap firmware, tew-821dap v2.0r firmware, tew-821dap v2.5r firmware +2 moreBuffer Overflow vulnerability in TRENDnet AC1200 TEW-821DAP with firmware version 3.00b06 allows...8.0 High
- janitza gridvisIn Janitza GridVis through 9.0.66, exposed dangerous methods in the de.janitza.pasw.project...7.2 High
- janitza gridvisIn Janitza GridVis through 9.0.66, use of hard-coded credentials in the de.janitza.pasw.feature...8.8 High
- sikkasoft platform utilitySikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by...8.8 High
- microsoft windowsSome Microsoft technologies as used in Windows 8 through 11 allow a temporary client-side...No score
- wolfsslSEGV and out of bounds memory read from malicious packet7.5 High
- wolfsshUser authentication bypass in wolfSSH server9.1 Critical
- opentext secure content managerElevation of privileges vulnerability8.5 High
- rockwell automation factorytalk® view me, rockwellautomation factorytalk view, factorytalk view me +2 moreRockwell Automation - FactoryTalk® View ME on PanelView™ Plus 7 Boot Terminal lack Security Protections5.3 Medium
- rockwell automation powerflex® 527, rockwellautomation powerflex 527 ac drives firmware +1 moreRockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 5277.5 High
- rockwell automation powerflex® 527, rockwellautomation powerflex 527 ac drives firmware +1 moreRockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 5277.5 High
- rockwell automation powerflex® 527, rockwellautomation powerflex 527 ac drives firmware +1 moreRockwell Automation - Denial-of-service and Input Validation Vulnerabilities in PowerFlex® 5277.5 High
- phpmyfaqphpMyFAQ Stored Cross-site Scripting at File Attachments4.3 Medium
- @clerk expressExpress.js Open Redirect in malformed URLs6.1 Medium
- katexKaTeX is missing normalization of the protocol in URLs allows bypassing forbidden protocols5.5 Medium
- katexKaTeX's \includegraphics does not escape filename6.3 Medium
- katexKaTeX's maxExpand bypassed by Unicode sub/superscripts6.5 Medium
- katexKaTeX's maxExpand bypassed by \edef6.5 Medium
- ansys pyansys geometry, pyansys-geometry +1 moreansys-geometry-core OS Command Injection vulnerability7.4 High
- ruby rdocRDoc RCE vulnerability with .rdoc_options4.5 Medium
- Show moreLoading…