Skip to content
OpenAdvisories

Archive

21 March 2024

Vulnerabilities first published on this day (UTC), newest first.

← February 2024 2024 / March /21 April 2024 →
  1. 1124
  2. 269
  3. 330
  4. 4116
  5. 5116
  6. 6120
  7. 795
  8. 8103
  9. 924
  10. 1010
  11. 1191
  12. 12187
  13. 13222
  14. 1469
  15. 15131
  16. 1650
  17. 1731
  18. 18194
  19. 19132
  20. 20167
  21. 21127
  22. 2281
  23. 2317
  24. 2416
  25. 25123
  26. 26158
  27. 27285
  28. 28180
  29. 29156
  30. 3026
  31. 3167
All Critical High Medium Low Exploited only Public exploit

59 results · Clear filters · Feed

  • Medium 6.3
    CVE-2024-2464

    Application users enumeration in CDeX

    This issue occurs during password recovery, where a difference in messages could allow an attacker to determine if the user is valid or not, enabling a brute force attack with valid users.This issue affects CDeX application versions through 5.7.1.

    CDeX PSA CDeX
  • Medium 4.3
    CVE-2023-47715

    IBM Storage Protect Plus Server improper access control

    IBM Storage Protect Plus Server 10.1.0 through 10.1.16 could allow an authenticated user with read-only permissions to add or delete entries from an existing HyperVisor configuration. IBM X-Force ID: 271538.

    IBM Storage Protect Plus Server
  • Medium 4.2
    CVE-2024-29880

    In JetBrains TeamCity before 2023.11 users with access to the agent machine might obtain permissions of the user runnin…

    JetBrains TeamCity
  • Medium 6.2
    CVE-2024-2494

    Libvirt: negative g_new0 length can lead to unbounded memory allocation

    A flaw was found in the RPC library APIs of libvirt. The RPC server deserialization code allocates memory for arrays before the non-negative length check is performed by the C API entry points. Passing a negative length to the g_new0 function results in a cra…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux
  • Medium 5.3
    CVE-2024-28834

    Gnutls: vulnerable to minerva side-channel information leak

    A flaw was found in GnuTLS. The Minerva attack is a cryptographic vulnerability that exploits deterministic behavior in systems like GnuTLS, leading to side-channel leaks. In specific scenarios, such as when using the GNUTLS_PRIVKEY_FLAG_REPRODUCIBLE flag, it…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Medium 6.4
    CVE-2024-2742

    OS Command Injection in Planet IGS-4215-16T2S

    Operating system command injection vulnerability in Planet IGS-4215-16T2S, affecting firmware version 1.305b210528. An authenticated attacker could execute arbitrary code on the remote host by exploiting IP address functionality.

    PLANET Technology IGS-4215-16T2S
  • Medium 5.3
    CVE-2024-26307

    Apache Doris: Possible race condition

    Possible race condition vulnerability in Apache Doris. Some of code using `chmod()` method. This method run the risk of someone renaming the file out from under user and chmodding the wrong file. This could theoretically happen, but the impact would be minima…

    Apache Software Foundation Apache Doris
  • Medium 5.4
    CVE-2024-29133

    Apache Commons Configuration: StackOverflowError calling ListDelimiterHandler.flatten(Object, int) with a cyclical object tree

    Out-of-bounds Write vulnerability in Apache Commons Configuration.This issue affects Apache Commons Configuration: from 2.0 before 2.10.1. Users are recommended to upgrade to version 2.10.1, which fixes the issue.

    Apache Software Foundation Apache Commons Configuration druid trino Debian Ubuntu Wolfi Maven
  • Medium 4.7
    CVE-2024-2754

    SourceCodester Complete E-Commerce Site users_photo.php unrestricted upload

    A vulnerability classified as critical has been found in SourceCodester Complete E-Commerce Site 1.0. Affected is an unknown function of the file /admin/users_photo.php. The manipulation of the argument photo leads to unrestricted upload. It is possible to la…

    SourceCodester Complete E-Commerce Site
  • Medium 5.0
    CVE-2024-28835

    Gnutls: potential crash during chain building/verification

    A flaw has been discovered in GnuTLS where an application crash can be induced when attempting to verify a specially crafted .pem bundle using the "certtool --verify-chain" command.

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine
  • Medium 6.1
    CVE-2023-48903

    Stored Cross-Site Scripting (XSS) vulnerability in tramyardg autoexpress 1.3.0, allows remote unauthenticated attackers…

  • Medium 6.5
    CVE-2023-51141

    An issue in ZKTeko BioTime v.8.5.4 and before allows a remote attacker to obtain sensitive information via the Authenti…

  • Medium 5.9
    CVE-2024-28756

    The SolarEdge mySolarEdge application before 2.20.1 for Android has a certificate verification issue that allows a Mach…

  • Medium 6.1
    CVE-2024-28635

    Cross-site scripting in Survey Creator

    Cross Site Scripting (XSS) vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form.

    survey-creator npm
  • Medium 5.9
    CVE-2024-28402

    TOTOLINK X2000R before V1.0.0-B20231213.1013 contains a Stored Cross-site scripting (XSS) vulnerability in IP/Port Filt…

  • Medium 5.3
    CVE-2024-29244

    Shenzhen Libituo Technology Co., Ltd LBT-T300-mini v1.2.9 was discovered to contain a buffer overflow via the pin_code_…

  • Medium 5.6
    CVE-2024-29916

    The dormakaba Saflok system before the November 2023 software update allows an attacker to unlock arbitrary doors at a …

  • Medium 6.1
    CVE-2024-29374

    Cross site scripting in moodle

    A Cross-Site Scripting (XSS) vulnerability exists in the way MOODLE 3.10.9 handles user input within the "GET /?lang=" URL parameter.

    moodle/moodle moodle Ubuntu Packagist
  • Medium 6.6
    CVE-2024-22724

    An issue was discovered in osCommerce v4, allows local attackers to bypass file upload restrictions and execute arbitra…