CVEs published February 27, 2023
145 CVEs were published on February 27, 2023: 10 critical, 36 high. 1 is now in CISA KEV.
- Published
- 145
- Critical
- 10
- High
- 36
- Medium
- 42
- Low
- 4
- Unrated
- 53
- Now in CISA KEV
- 1
- Fix available
- 79
Most affected products
- Apple macOS
- 23
- Apple iOS and iPadOS · Apple tvOS +2
- 9
- SourceCodester Doctors Appointment System
- 7
- BiSheng-WNM
- 5
- Apple Music for Android
- 4
- Mattermost
- 4
- WAGO Compact Controller CC100 · WAGO Edge Controller +5
- 4
- Apple iOS and iPadOS · Apple macOS
- 3
- Apple iOS and iPadOS · Apple tvOS +3
- 3
- Apple iOS and iPadOS
- 2
Critical 10
- CVE-2022-45140WAGO: Missing Authentication for Critical Function WAGO Compact Controller CC100 · WAGO Edge Controller +5
- CVE-2022-45138WAGO: Missing Authentication for Critical FunctionWAGO Compact Controller CC100 · WAGO Edge Controller +5
- CVE-2022-48255There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325.BiSheng-WNM
- CVE-2022-48259There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325.BiSheng-WNM
- CVE-2022-48283A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability.HarmonyOS AILife Solution
- CVE-2022-48284A piece of Huawei whole-home intelligence software has an Incorrect Privilege Assignment vulnerability.HarmonyOS AILife Solution
- CVE-2023-23513A buffer overflow issue was addressed with improved memory handling.Apple macOS
- CVE-2023-25231Tenda Router W30E V1.0.1.25(633) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface.
- CVE-2023-25233Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromRouteStatic via parameters entrys and mitInterface.
- CVE-2023-25234Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInterface.
High 36
- CVE-2023-0331Correos Oficial <= 1.2.0.2 - Unauthenticated Arbitrary File DownloadCorreos Oficial
- CVE-2023-0278GeoDirectory < 2.2.24 - Admin+ SQLiGeoDirectory
- CVE-2023-0487My Sticky Elements < 2.0.9 - Admin+ SQLiAll-in-one Floating Contact Form, Call, Chat, and 50+ Socia…
- CVE-2023-0279Media Library Assistant < 3.06 - Admin+ SQLiMedia Library Assistant
- CVE-2022-4550User Activity <= 1.0.1 - IP SpoofingUser Activity
- CVE-2023-0381GigPress <= 2.3.28 - Subscriber+ SQLiGigPress
- CVE-2023-27264IDOR: Updating a playbook via the Playbooks APIMattermost
- CVE-2023-1058SourceCodester Doctors Appointment System create-account.php sql injectionSourceCodester Doctors Appointment System
- CVE-2022-32846A logic issue was addressed with improved state management.Apple Music for Android
- CVE-2022-32900A logic issue was addressed with improved state management.Apple macOS
- CVE-2022-32949This issue was addressed with improved checks.Apple iOS and iPadOS · Apple tvOS
- CVE-2022-34908An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android.
- CVE-2022-34909An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android.
- CVE-2022-48230There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325.BiSheng-WNM
- CVE-2022-48260There is a buffer overflow vulnerability in BiSheng-WNM FW 3.0.0.325.BiSheng-WNM
- CVE-2022-48261There is a misinterpretation of input vulnerability in BiSheng-WNM FW 3.0.0.325.BiSheng-WNM
- CVE-2023-1070External Control of File Name or Path in nilsteampassnet/teampassnilsteampassnet/teampass
- CVE-2023-23504The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-23507The issue was addressed with improved bounds checks.Apple macOS
- CVE-2023-23514A use after free issue was addressed with improved memory management.Apple macOS · Apple iOS and iPadOS
- CVE-2023-23517The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +3
- CVE-2023-23518The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +3
- CVE-2023-23519A memory corruption issue was addressed with improved state management.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-23524A denial-of-service issue was addressed with improved input validation.Apple iOS and iPadOS · Apple watchOS +2
- CVE-2023-23529A type confusion issue was addressed with improved checks.Apple iOS and iPadOS · Apple Safari +1
- CVE-2023-23530The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-23531The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple macOS
- CVE-2023-24364Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter under
- CVE-2023-24652Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the Description parameter un
- CVE-2023-24653Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the oldpass parameter under
- CVE-2023-24654Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the
- CVE-2023-24656Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the subject parameter under
- CVE-2023-25235Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function formOneSsidCfgSet via parameter ssid.
- CVE-2023-26257An issue was discovered in the Connected Vehicle Systems Alliance (COVESA; formerly GENIVI) dlt-daemon through 2.18.8.
- CVE-2023-26609ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap
- CVE-2023-26758Sme.UP TOKYO V6R1M220406 was discovered to contain an arbitrary file download vulnerabilty via the component /ResourceService.
Medium, low and unrated 99
- CVE-2023-26043XML External Entity (XXE) injection in GeoServer style upload functionalitygeonode
- CVE-2023-26041Nextcloud Talk messages can still be seen on conversation after expiring when cron is misconfigurednextcloud security-advisories
- CVE-2023-0043Custom Add User <= 2.0.2 - Reflected Cross-Site ScriptingCustom Add User
- CVE-2023-0535Donation Block For PayPal < 2.1.0 - Contributor+ Stored XSSDonation Block For PayPal
- CVE-2022-4679Wufoo Shortcode < 1.52 - Contributor+ Stored XSS via ShortcodeWufoo Shortcode
- CVE-2023-0539GS Insever Portfolio < 1.4.5 - Contributor+ Stored XSSGS Insever Portfolio
- CVE-2022-4788Embed PDF <= 1.0.6 - Contributor+ Stored XSS via ShortcodeEmbed PDF
- CVE-2023-0543Arigato Autoresponder and Newsletter < 2.1.7.2 - Admin+ Stored XSSArigato Autoresponder and Newsletter
- CVE-2023-0168Olevmedia Shortcodes <= 1.1.9 - Contributor+ Stored XSSOlevmedia Shortcodes
- CVE-2023-0552Pie Register < 3.8.2.3 - Open RedirectRegistration Forms
- CVE-2022-4757List Pages Shortcode < 1.7.6 - Contributor+ Stored XSS via ShortcodeList Pages Shortcode
- CVE-2022-4829Show-Hide / Collapse-Expand < 1.3.0 - Contributor+ Stored XSS via ShortcodeShow-Hide / Collapse-Expand
- CVE-2023-0548Namaste! LMS < 2.5.9.4 - Admin+ Stored XSSNamaste! LMS
- CVE-2022-4795Galleries by Angie Makes <= 1.67 - Contributor+ Stored XSS via ShortcodeGalleries by Angie Makes
- CVE-2023-0230VK All in One Expansion Unit < 9.86.0.0 - Contributor+ Stored XSSVK All in One Expansion Unit
- CVE-2023-0334ShortPixel Adaptive Images < 3.6.3 - Reflected XSSShortPixel Adaptive Images
- CVE-2023-27266Disclosure of team owner email address when when accessing the teams APIMattermost
- CVE-2023-27265Disclosure of team owner email address when regenerating Invite IDMattermost
- CVE-2023-27263IDOR: Accessing playbook runs via the Playbooks Runs APIMattermost
- CVE-2023-26042HTML/XSS injection possibilities in Part-DB Part-DB-server
- CVE-2022-45139WAGO: Origin validation error through CORS misconfigurationWAGO Compact Controller CC100 · WAGO Edge Controller +5
- CVE-2022-45137WAGO: Reflective Cross-Site ScriptingWAGO Compact Controller CC100 · WAGO Edge Controller +5
- CVE-2023-22860IBM Cloud Pak for Business Automation cross-site scriptingIBM Cloud Pak for Business Automation
- CVE-2022-40237IBM MQ for HPE NonStop denial of serviceIBM MQ for HPE NonStop
- CVE-2023-1068Download Read More Excerpt Link <= 1.6.0 - Cross-Site Request Forgery to Settings Updateteckel Read More Excerpt Link
- CVE-2023-1063SourceCodester Doctors Appointment System Parameter patient.php sql injectionSourceCodester Doctors Appointment System
- CVE-2023-1062SourceCodester Doctors Appointment System Parameter add-new.php sql injectionSourceCodester Doctors Appointment System
- CVE-2023-1061SourceCodester Doctors Appointment System edit-doc.php sql injectionSourceCodester Doctors Appointment System
- CVE-2023-1059SourceCodester Doctors Appointment System Parameter doctors.php sql injectionSourceCodester Doctors Appointment System
- CVE-2023-1057SourceCodester Doctors Appointment System login.php edoc sql injectionSourceCodester Doctors Appointment System
- CVE-2023-1056SourceCodester Doctors Appointment System patient.php sql injectionSourceCodester Doctors Appointment System
- CVE-2023-1054SourceCodester Music Gallery Site sql injectionSourceCodester Music Gallery Site
- CVE-2023-1053SourceCodester Music Gallery Site view_category.php sql injectionSourceCodester Music Gallery Site
- CVE-2023-22636An unauthorized configuration download vulnerability in FortiWeb 6.3.6 through 6.3.21, 6.4.0 through 6.4.2 and 7.0.0 through 7.0.4 may allowFortinet FortiWeb
- CVE-2020-9846A logic issue was addressed with improved state management.Apple macOS
- CVE-2021-32302Cross Site Scripting vulnerability in IRZ Electronics RUH2 GSM router allows attacker to obtain sensitive information via the Upload File pa
- CVE-2021-46841This issue was addressed by using HTTPS when sending information over the network.Apple Music for Android
- CVE-2022-22582A validation issue existed in the handling of symlinks.Apple macOS
- CVE-2022-22668A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2022-26760A memory corruption issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2022-31405MV iDigital Clinic Enterprise (iDCE) 1.0 stores passwords in cleartext.
- CVE-2022-32784The issue was addressed with improved UI handling.Apple Safari · Apple iOS and iPadOS
- CVE-2022-32824The issue was addressed with improved memory handling.Apple tvOS · Apple watchOS
- CVE-2022-32830An out-of-bounds read issue was addressed with improved bounds checking.Apple tvOS
- CVE-2022-32836This issue was addressed with improved state management.Apple Music for Android
- CVE-2022-32844A race condition was addressed with improved state handling.Apple tvOS · Apple watchOS
- CVE-2022-32855A logic issue was addressed with improved state management.Apple iOS and iPadOS
- CVE-2022-32891The issue was addressed with improved UI handling.Apple iOS · Apple Safari +1
- CVE-2022-32896This issue was addressed by enabling hardened runtime.Apple macOS
- CVE-2022-32902A logic issue was addressed with improved state management.Apple macOS
- CVE-2022-32906This issue was addressed with using HTTPS when sending information over the network.Apple Music for Android
- CVE-2022-34910An issue was discovered in the A4N (Aremis 4 Nomad) application 1.5.0 for Android.
- CVE-2022-42797An injection issue was addressed with improved input validation.Apple Xcode
- CVE-2022-42826A use after free issue was addressed with improved memory management.Apple macOS
- CVE-2022-42833An out-of-bounds read was addressed with improved input validation.Apple macOS
- CVE-2022-42838An issue with app access to camera data was addressed with improved logic.Apple macOS
- CVE-2022-45697Arbitrary File Delete vulnerability in Razer Central before v7.8.0.381 when handling files in the Accounts directory.
- CVE-2022-46704A logic issue was addressed with improved state management.Apple macOS
- CVE-2022-46705A spoofing issue existed in the handling of URLs.Apple macOS
- CVE-2022-46712A use after free issue was addressed with improved memory management.Apple macOS
- CVE-2022-46713A race condition was addressed with additional validation.Apple macOS
- CVE-2022-46723This issue was addressed with improved checks.Apple macOS
- CVE-2022-48254There is a data processing error vulnerability in Leia-B29 2.0.0.49(M03).Leia-B29
- CVE-2022-48305There is an identity authentication bypass vulnerability in Huawei Children Smart Watch (Simba-AL00) 1.1.1.274.Simba-AL00
- CVE-2023-1055A flaw was found in RHDS 11 and RHDS 12.Red Hat Directory Server
- CVE-2023-1067Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-23080Certain Tenda products are vulnerable to command injection.
- CVE-2023-23108In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a NULL pointer dereference in t
- CVE-2023-23109In crasm 1.8-3, invalid input validation, specific files passed to the command line application, can lead to a divide by zero fault in the f
- CVE-2023-23155Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the username parameter in the A
- CVE-2023-23156Art Gallery Management System Project in PHP 1.0 was discovered to contain a SQL injection vulnerability via the pid parameter in the single
- CVE-2023-23157A stored cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web sc
- CVE-2023-23158A stored cross-site scripting (XSS) vulnerability in Art Gallery Management System Project v1.0 allows attackers to execute arbitrary web sc
- CVE-2023-23493A logic issue was addressed with improved state management.Apple macOS
- CVE-2023-23496The issue was addressed with improved checks.Apple iOS and iPadOS · Apple tvOS +3
- CVE-2023-23497A logic issue was addressed with improved state management.Apple macOS
- CVE-2023-23498A logic issue was addressed with improved state management.Apple iOS and iPadOS · Apple macOS
- CVE-2023-23499This issue was addressed by enabling hardened runtime.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-23500The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-23501The issue was addressed with improved memory handling This issue is fixed in macOS Ventura 13.2.Apple macOS
- CVE-2023-23502An information disclosure issue was addressed by removing the vulnerable code.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-23503A logic issue was addressed with improved state management.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-23505A privacy issue was addressed with improved private data redaction for log entries.Apple iOS and iPadOS · Apple macOS +1
- CVE-2023-23506A permissions issue was addressed with improved validation.Apple macOS
- CVE-2023-23508The issue was addressed with improved memory handling.Apple macOS
- CVE-2023-23510A permissions issue was addressed with improved validation.Apple macOS
- CVE-2023-23511The issue was addressed with improved memory handling.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-23512The issue was addressed with improved handling of caches.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-23520A race condition was addressed with additional validation.Apple iOS and iPadOS · Apple tvOS +2
- CVE-2023-23522A privacy issue was addressed with improved handling of temporary files.Apple macOS
- CVE-2023-24206Davinci v0.3.0-rc was discovered to contain a SQL injection vulnerability via the copyDisplay function.
- CVE-2023-24249An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file.encore/laravel-admin
- CVE-2023-24251WangEditor v5 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /dist/index.js.
- CVE-2023-24253Domotica Labs srl Ikon Server before v2.8.6 was discovered to contain a SQL injection vulnerability.
- CVE-2023-24258SPIP v4.1.5 and earlier was discovered to contain a SQL injection vulnerability via the _oups parameter.
- CVE-2023-24651Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter on the re
- CVE-2023-26759Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an OS command injection vulnerability via calls made to the XMService component.
- CVE-2023-26760Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an information disclosure vulnerability via the /debug endpoint.
- CVE-2023-26762Sme.UP ERP TOKYO V6R1M220406 was discovered to contain an arbitrary file upload vulnerability.