CVEs published February 24, 2023
50 CVEs were published on February 24, 2023: 7 critical, 12 high.
- Published
- 50
- Critical
- 7
- High
- 12
- Medium
- 26
- Low
- 2
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 17
Most affected products
- Apache Software Foundation Apache Airflow Google Provider ·…
- 2
- nextcloud security-advisories
- 2
- SHIRASAGI Project SHIRASAGI
- 2
- smub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…
- 2
- Twister Antivirus
- 2
- @braintree/sanitize-url
- 1
- ABB Pulsar Plus System Controller NE843_S · ABB Infinity DC…
- 1
- Apache Software Foundation Apache Airflow AWS Provider · ap…
- 1
- Apache Software Foundation Apache Airflow Hive Provider · a…
- 1
- Apache Software Foundation Apache Airflow Sqoop Provider… +1
- 1
Critical 7
- CVE-2023-25696Apache Airflow Hive Provider Beeline RCEApache Software Foundation Apache Airflow Hive Provider · a…
- CVE-2023-25693Sqoop Apache Airflow Provider Remote Code Execution VulnerabilityApache Software Foundation Apache Airflow Sqoop Provider… +1
- CVE-2023-25691Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command ExecutionApache Software Foundation Apache Airflow Google Provider ·…
- CVE-2021-4105Unauthenticated Remote Code Execution on COSLAT FirewallBG-TEK COSLAT Firewall
- CVE-2021-33387Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request.
- CVE-2021-35370An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function.
- CVE-2023-24189An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /u
High 12
- CVE-2023-26033Gentoo soko contains DoS attack based on SQL Injectiongentoo soko
- CVE-2022-23535LiteDB contains Deserialization of Untrusted Datambdavid LiteDB · LiteDB
- CVE-2021-3855Command Injection in Liman Central Management SystemLiman Central Management System
- CVE-2023-25956Apache Airflow AWS Provider: Arbitrary file read via AWS providerApache Software Foundation Apache Airflow AWS Provider · ap…
- CVE-2023-25692Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of ServiceApache Software Foundation Apache Airflow Google Provider ·…
- CVE-2023-0997SourceCodester Moosikay E-Commerce System POST Parameter order.php sql injectionSourceCodester Moosikay E-Commerce System
- CVE-2023-26102All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function rangy
- CVE-2023-0996 There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif.Struktur libheif
- CVE-2021-34167Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin.
- CVE-2021-34249SQL injection vulnerability in sourcecodester online-book-store 1.0 allows remote attackers to view sensitive information via the id paremet
- CVE-2022-44310In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived sharecdh
- CVE-2023-0994Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosisfrancoisjacquet/rosariosis
Medium, low and unrated 31
- CVE-2023-25821Nextcloud download permissions can be changed by resharernextcloud security-advisories
- CVE-2023-25816nextcloud vulnerable to Uncontrolled Resource Consumptionnextcloud security-advisories
- CVE-2023-1030SourceCodester/code-projects Online Boat Reservation System POST Parameter login.php cross site scriptingSourceCodester Online Boat Reservation System · code-projec…
- CVE-2023-1029WP Meta SEO <= 4.5.3 - Cross-Site Request Forgery via 'regenerateSitemaps'joomunited WP Meta SEO
- CVE-2022-4203X.509 Name Constraints Read Buffer OverflowOpenSSL · openssl-src
- CVE-2023-0586All in One SEO Pack <= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scriptingsmub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…
- CVE-2023-0585All in One SEO Pack <= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scriptingsmub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…
- CVE-2022-43923IBM Maximo Application Suite 8.8.0 and 8.9.0 stores potentially sensitive information that could be read by a local user.IBM Maximo Application Suite
- CVE-2023-1010vox2png vox2png.c heap-based overflowvox2png
- CVE-2023-1009DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub_1DF14 path traversalDrayTek Vigor
- CVE-2023-1008Twister Antivirus IoControlCode filmfd.sys 0x801120E4 denial of serviceTwister Antivirus
- CVE-2023-1007Twister Antivirus IoControlCode filmfd.sys 0x801120E4 access controlTwister Antivirus
- CVE-2023-1006SourceCodester Medical Certificate Generator App New Record cross site scriptingSourceCodester Medical Certificate Generator App
- CVE-2023-1005JP1016 Markdown-Electron code injectionJP1016 Markdown-Electron
- CVE-2023-1004MarkText WSH JScript code injectionMarkText
- CVE-2023-1003Typora WSH JScript code injectionTypora
- CVE-2023-1002MuYuCMS index.php path traversalMuYuCMS
- CVE-2023-0999SourceCodester Sales Tracker Management System cross-site request forgerySourceCodester Sales Tracker Management System
- CVE-2023-0998SourceCodester Alphaware Simple E-Commerce System Payment summary.php access controlSourceCodester Alphaware Simple E-Commerce System
- CVE-2022-1607Cross Site Scripting vulnerability in NE843 Pulsar Plus ControllerABB Pulsar Plus System Controller NE843_S · ABB Infinity DC…
- CVE-2021-33224File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and a
- CVE-2021-35290File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog
- CVE-2021-35369Arbitrary File Read vulnerability found in Peacexie ImCat v.5.2 fixed in v.5.4 allows attackers to obtain sensitive information via the filt
- CVE-2022-46440ttftool v0.9.2 was discovered to contain a segmentation violation via the readU16 function at ttf.c.
- CVE-2022-48345sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities.@braintree/sanitize-url
- CVE-2023-0481In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp fiQuarkus · io.quarkus.resteasy.reactive:resteasy-reactive-co…
- CVE-2023-0595A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious pSchneider Electric EcoStruxure Geo SCADA Expert · Schneider…
- CVE-2023-0995Cross-site Scripting (XSS) - Stored in unilogies/bumsysunilogies/bumsys
- CVE-2023-22425Stored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remote authenticated attacSHIRASAGI Project SHIRASAGI
- CVE-2023-22427Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a remote attacker witSHIRASAGI Project SHIRASAGI
- CVE-2023-23205An issue was discovered in lib60870 v2.3.2.