# CVEs published 2023-02-24

50 CVEs were published on February 24, 2023: 7 critical, 12 high. Days are UTC.

- [CVE-2023-25821](https://cve.now/CVE-2023-25821.md): Nextcloud download permissions can be changed by resharer (CVSS 5.7, nextcloud security-advisories)
- [CVE-2023-26033](https://cve.now/CVE-2023-26033.md): Gentoo soko contains DoS attack based on SQL Injection (CVSS 7.5, gentoo soko)
- [CVE-2023-25816](https://cve.now/CVE-2023-25816.md): nextcloud vulnerable to Uncontrolled Resource Consumption (CVSS 4.3, nextcloud security-advisories)
- [CVE-2022-23535](https://cve.now/CVE-2022-23535.md): LiteDB contains Deserialization of Untrusted Data (CVSS 7.3, mbdavid LiteDB · LiteDB)
- [CVE-2023-1030](https://cve.now/CVE-2023-1030.md): SourceCodester/code-projects Online Boat Reservation System POST Parameter login.php cross site scripting (CVSS 5.1, SourceCodester Online Boat Reservation System · code-projec…)
- [CVE-2023-1029](https://cve.now/CVE-2023-1029.md): WP Meta SEO \<= 4.5.3 - Cross-Site Request Forgery via 'regenerateSitemaps' (CVSS 4.3, joomunited WP Meta SEO)
- [CVE-2022-4203](https://cve.now/CVE-2022-4203.md): X.509 Name Constraints Read Buffer Overflow (CVSS 4.9, OpenSSL · openssl-src)
- [CVE-2023-0586](https://cve.now/CVE-2023-0586.md): All in One SEO Pack \<= 4.2.9 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, smub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…)
- [CVE-2023-0585](https://cve.now/CVE-2023-0585.md): All in One SEO Pack \<= 4.2.9 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, smub All in One SEO – Powerful SEO Plugin to Boost SEO Rank…)
- [CVE-2022-43923](https://cve.now/CVE-2022-43923.md): IBM Maximo Application Suite 8.8.0 and 8.9.0 stores potentially sensitive information that could be read by a local user. (CVSS 6.2, IBM Maximo Application Suite)
- [CVE-2021-3855](https://cve.now/CVE-2021-3855.md): Command Injection in Liman Central Management System (CVSS 8.8, Liman Central Management System)
- [CVE-2023-25956](https://cve.now/CVE-2023-25956.md): Apache Airflow AWS Provider: Arbitrary file read via AWS provider (CVSS 7.5, Apache Software Foundation Apache Airflow AWS Provider · ap…)
- [CVE-2023-25696](https://cve.now/CVE-2023-25696.md): Apache Airflow Hive Provider Beeline RCE (CVSS 9.8, Apache Software Foundation Apache Airflow Hive Provider · a…)
- [CVE-2023-25693](https://cve.now/CVE-2023-25693.md): Sqoop Apache Airflow Provider Remote Code Execution Vulnerability (CVSS 9.8, Apache Software Foundation Apache Airflow Sqoop Provider… +1)
- [CVE-2023-25692](https://cve.now/CVE-2023-25692.md): Apache Airflow Google Provider: Google Cloud Sql Provider Denial Of Service (CVSS 7.5, Apache Software Foundation Apache Airflow Google Provider ·…)
- [CVE-2023-25691](https://cve.now/CVE-2023-25691.md): Apache Airflow Google Provider: Google Cloud Sql Provider Remote Command Execution (CVSS 9.8, Apache Software Foundation Apache Airflow Google Provider ·…)
- [CVE-2021-4105](https://cve.now/CVE-2021-4105.md): Unauthenticated Remote Code Execution on COSLAT Firewall (CVSS 9.8, BG-TEK COSLAT Firewall)
- [CVE-2023-1010](https://cve.now/CVE-2023-1010.md): vox2png vox2png.c heap-based overflow (CVSS 5.3, vox2png)
- [CVE-2023-1009](https://cve.now/CVE-2023-1009.md): DrayTek Vigor 2960 Web Management Interface mainfunction.cgi sub\_1DF14 path traversal (CVSS 6.5, DrayTek Vigor)
- [CVE-2023-1008](https://cve.now/CVE-2023-1008.md): Twister Antivirus IoControlCode filmfd.sys 0x801120E4 denial of service (CVSS 5.5, Twister Antivirus)
- [CVE-2023-1007](https://cve.now/CVE-2023-1007.md): Twister Antivirus IoControlCode filmfd.sys 0x801120E4 access control (CVSS 5.3, Twister Antivirus)
- [CVE-2023-1006](https://cve.now/CVE-2023-1006.md): SourceCodester Medical Certificate Generator App New Record cross site scripting (CVSS 3.5, SourceCodester Medical Certificate Generator App)
- [CVE-2023-1005](https://cve.now/CVE-2023-1005.md): JP1016 Markdown-Electron code injection (CVSS 5.3, JP1016 Markdown-Electron)
- [CVE-2023-1004](https://cve.now/CVE-2023-1004.md): MarkText WSH JScript code injection (CVSS 5.3, MarkText)
- [CVE-2023-1003](https://cve.now/CVE-2023-1003.md): Typora WSH JScript code injection (CVSS 5.3, Typora)
- [CVE-2023-1002](https://cve.now/CVE-2023-1002.md): MuYuCMS index.php path traversal (CVSS 4.3, MuYuCMS)
- [CVE-2023-0999](https://cve.now/CVE-2023-0999.md): SourceCodester Sales Tracker Management System cross-site request forgery (CVSS 4.3, SourceCodester Sales Tracker Management System)
- [CVE-2023-0998](https://cve.now/CVE-2023-0998.md): SourceCodester Alphaware Simple E-Commerce System Payment summary.php access control (CVSS 6.5, SourceCodester Alphaware Simple E-Commerce System)
- [CVE-2023-0997](https://cve.now/CVE-2023-0997.md): SourceCodester Moosikay E-Commerce System POST Parameter order.php sql injection (CVSS 7.3, SourceCodester Moosikay E-Commerce System)
- [CVE-2023-26102](https://cve.now/CVE-2023-26102.md): All versions of the package rangy are vulnerable to Prototype Pollution when using the extend() function in file rangy-core.js.The function (CVSS 7.5, rangy)
- [CVE-2022-1607](https://cve.now/CVE-2022-1607.md): Cross Site Scripting vulnerability in NE843 Pulsar Plus Controller (CVSS 4.6, ABB Pulsar Plus System Controller NE843\_S · ABB Infinity DC…)
- [CVE-2023-0996](https://cve.now/CVE-2023-0996.md): There is a vulnerability in the strided image data parsing code in the emscripten wrapper for libheif. (CVSS 7.8, Struktur libheif)
- [CVE-2021-33224](https://cve.now/CVE-2021-33224.md): File upload vulnerability in Umbraco Forms v.8.7.0 allows unauthenticated attackers to execute arbitrary code via a crafted web.config and a (no CVSS)
- [CVE-2021-33387](https://cve.now/CVE-2021-33387.md): Cross Site Scripting Vulnerability in MiniCMS v.1.10 allows attacker to execute arbitrary code via a crafted get request. (CVSS 9.6)
- [CVE-2021-34167](https://cve.now/CVE-2021-34167.md): Cross Site Request Forgery (CSRF) vulnerability in taoCMS 3.0.2 allows remote attackers to gain escalated privileges via taocms/admin/admin. (CVSS 8.8)
- [CVE-2021-34249](https://cve.now/CVE-2021-34249.md): SQL injection vulnerability in sourcecodester online-book-store 1.0 allows remote attackers to view sensitive information via the id paremet (CVSS 7.5)
- [CVE-2021-35290](https://cve.now/CVE-2021-35290.md): File Upload vulnerability in balerocms-src 0.8.3 allows remote attackers to run arbitrary code via rich text editor on /admin/main/mod-blog (no CVSS)
- [CVE-2021-35369](https://cve.now/CVE-2021-35369.md): Arbitrary File Read vulnerability found in Peacexie ImCat v.5.2 fixed in v.5.4 allows attackers to obtain sensitive information via the filt (no CVSS)
- [CVE-2021-35370](https://cve.now/CVE-2021-35370.md): An issue found in Peacexie Imcat v5.4 allows attackers to execute arbitrary code via the incomplete filtering function. (CVSS 9.8)
- [CVE-2022-44310](https://cve.now/CVE-2022-44310.md): In Development IL ecdh before 0.2.0, an attacker can send an invalid point (not on the curve) as the public key, and obtain the derived shar (CVSS 7.5, ecdh)
- [CVE-2022-46440](https://cve.now/CVE-2022-46440.md): ttftool v0.9.2 was discovered to contain a segmentation violation via the readU16 function at ttf.c. (CVSS 5.5)
- [CVE-2022-48345](https://cve.now/CVE-2022-48345.md): sanitize-url (aka @braintree/sanitize-url) before 6.0.2 allows XSS via HTML entities. (CVSS 6.1, @braintree/sanitize-url)
- [CVE-2023-0481](https://cve.now/CVE-2023-0481.md): In RestEasy Reactive implementation of Quarkus the insecure File.createTempFile() is used in the FileBodyHandler class which creates temp fi (CVSS 3.3, Quarkus · io.quarkus.resteasy.reactive:resteasy-reactive-co…)
- [CVE-2023-0595](https://cve.now/CVE-2023-0595.md): A CWE-117: Improper Output Neutralization for Logs vulnerability exists that could cause the misinterpretation of log files when malicious p (CVSS 5.3, Schneider Electric EcoStruxure Geo SCADA Expert · Schneider…)
- [CVE-2023-0994](https://cve.now/CVE-2023-0994.md): Exposure of Sensitive Information to an Unauthorized Actor in francoisjacquet/rosariosis (CVSS 8.1, francoisjacquet/rosariosis)
- [CVE-2023-0995](https://cve.now/CVE-2023-0995.md): Cross-site Scripting (XSS) - Stored in unilogies/bumsys (CVSS 5.4, unilogies/bumsys)
- [CVE-2023-22425](https://cve.now/CVE-2023-22425.md): Stored cross-site scripting vulnerability in Schedule function of SHIRASAGI v1.16.2 and earlier versions allows a remote authenticated attac (CVSS 5.4, SHIRASAGI Project SHIRASAGI)
- [CVE-2023-22427](https://cve.now/CVE-2023-22427.md): Stored cross-site scripting vulnerability in Theme switching function of SHIRASAGI v1.16.2 and earlier versions allows a remote attacker wit (CVSS 4.8, SHIRASAGI Project SHIRASAGI)
- [CVE-2023-23205](https://cve.now/CVE-2023-23205.md): An issue was discovered in lib60870 v2.3.2. (CVSS 5.5)
- [CVE-2023-24189](https://cve.now/CVE-2023-24189.md): An XML External Entity (XXE) vulnerability in urule v2.1.7 allows attackers to execute arbitrary code via uploading a crafted XML file to /u (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.