# CVEs published 2023-02-28

113 CVEs were published on February 28, 2023: 10 critical, 48 high. Days are UTC.

- [CVE-2023-0847](https://cve.now/CVE-2023-0847.md): The Sub-IoT implementation of the DASH 7 Alliance protocol has a vulnerability that can lead to an out-of-bounds write prior to implementat (CVSS 5.3, Sub-IoT DASH 7 Alliance Protocol stack implementation)
- [CVE-2023-25575](https://cve.now/CVE-2023-25575.md): Secured properties in API Platform Core may be accessible within collections (CVSS 7.7, api-platform core · api-platform/core)
- [CVE-2023-1100](https://cve.now/CVE-2023-1100.md): SourceCodester Online Catering Reservation System POST Parameter add\_message.php sql injection (CVSS 6.3, SourceCodester Online Catering Reservation System)
- [CVE-2023-1099](https://cve.now/CVE-2023-1099.md): SourceCodester Online Student Management System edit-class-detail.php sql injection (CVSS 6.3, SourceCodester Online Student Management System)
- [CVE-2023-1065](https://cve.now/CVE-2023-1065.md): This vulnerability in the Snyk Kubernetes Monitor can result in irrelevant data being posted to a Snyk Organization, which could in turn obf (CVSS 6.5, Snyk Kubernetes Monitor)
- [CVE-2023-1017](https://cve.now/CVE-2023-1017.md): TPM2.0 vulnerable to out-of-bounds write (no CVSS, Trusted Computing Group TPM2.0)
- [CVE-2023-1018](https://cve.now/CVE-2023-1018.md): TPM2.0 vulnerable to out-of-bounds read (CVSS 5.5, Trusted Computing Group TPM2.0)
- [CVE-2022-41727](https://cve.now/CVE-2022-41727.md): Denial of service via crafted TIFF image in golang.org/x/image/tiff (no CVSS, golang.org/x/image/tiff · golang.org/x/image)
- [CVE-2022-41723](https://cve.now/CVE-2022-41723.md): Denial of service via crafted HTTP/2 stream in net/http and golang.org/x/net (CVSS 7.5, Go standard library net/http · golang.org/x/net/http2 +3)
- [CVE-2022-41724](https://cve.now/CVE-2022-41724.md): Panic on large handshake records in crypto/tls (no CVSS, Go standard library crypto/tls · stdlib)
- [CVE-2022-41725](https://cve.now/CVE-2022-41725.md): Excessive resource consumption in mime/multipart (no CVSS, Go standard library mime/multipart · stdlib)
- [CVE-2022-41722](https://cve.now/CVE-2022-41722.md): Path traversal on Windows in path/filepath (no CVSS, Go standard library path/filepath · stdlib)
- [CVE-2023-22778](https://cve.now/CVE-2023-22778.md): Authenticated Stored Cross-Site Scripting (CVSS 4.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22777](https://cve.now/CVE-2023-22777.md): Authenticated Information Disclosure in ArubaOS Web-based Management Interface (CVSS 4.9, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22776](https://cve.now/CVE-2023-22776.md): Authenticated Remote Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Read (CVSS 4.9, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22775](https://cve.now/CVE-2023-22775.md): Authenticated Sensitive Information Disclosure in ArubaOS Command Line Interface (CVSS 6.5, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22774](https://cve.now/CVE-2023-22774.md): Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion. (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22773](https://cve.now/CVE-2023-22773.md): Authenticated Path Traversal in ArubaOS Command Line Interface Allows for Arbitrary File Deletion. (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22772](https://cve.now/CVE-2023-22772.md): Authenticated Path Traversal in ArubaOS Web-based Management Interface Allows for Arbitrary File Deletion (CVSS 6.5, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22771](https://cve.now/CVE-2023-22771.md): Insufficient Session Expiration in ArubaOS Command Line Interface (CVSS 6.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22770](https://cve.now/CVE-2023-22770.md): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22769](https://cve.now/CVE-2023-22769.md): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22768](https://cve.now/CVE-2023-22768.md): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22767](https://cve.now/CVE-2023-22767.md): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22766](https://cve.now/CVE-2023-22766.md): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22765](https://cve.now/CVE-2023-22765.md): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22764](https://cve.now/CVE-2023-22764.md): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22763](https://cve.now/CVE-2023-22763.md): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22762](https://cve.now/CVE-2023-22762.md): Authenticated Remote Command Execution in the ArubaOS Command Line Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22761](https://cve.now/CVE-2023-22761.md): Authenticated Remote Command Execution in ArubaOS Web-based Management Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22760](https://cve.now/CVE-2023-22760.md): Authenticated Remote Command Execution in ArubaOS Web-based Management Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22759](https://cve.now/CVE-2023-22759.md): Authenticated Remote Command Execution in ArubaOS Web-based Management Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-23689](https://cve.now/CVE-2023-23689.md): Dell PowerScale nodes A200, A2000, H400, H500, H600, H5600, F800, F810 integrated hardware management software contains an uncontrolled res (CVSS 5.3, Dell PowerScale OneFS)
- [CVE-2023-22758](https://cve.now/CVE-2023-22758.md): Authenticated Remote Command Execution in ArubaOS Web-based Management Interface (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22757](https://cve.now/CVE-2023-22757.md): Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS Processes (CVSS 8.1, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22756](https://cve.now/CVE-2023-22756.md): Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS Processes (CVSS 8.1, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22755](https://cve.now/CVE-2023-22755.md): Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS Processes (CVSS 8.1, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22754](https://cve.now/CVE-2023-22754.md): Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS Processes (CVSS 8.1, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22753](https://cve.now/CVE-2023-22753.md): Unauthenticated Buffer Overflow Vulnerabilities in ArubaOS Processes (CVSS 8.1, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-25540](https://cve.now/CVE-2023-25540.md): Dell PowerScale OneFS 9.4.0.x contains an incorrect default permissions vulnerability. (CVSS 6.0, Dell PowerScale OneFS)
- [CVE-2023-22752](https://cve.now/CVE-2023-22752.md): Unauthenticated Stack-Based Buffer Overflow Vulnerabilities in the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22751](https://cve.now/CVE-2023-22751.md): Unauthenticated Stack-Based Buffer Overflow Vulnerabilities in the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-0511](https://cve.now/CVE-2023-0511.md): AM Java Policy Agent path traversal (CVSS 9.1, ForgeRock Access Management Java Policy Agent)
- [CVE-2023-0339](https://cve.now/CVE-2023-0339.md): AM Web Policy Agent path traversal (CVSS 9.1, ForgeRock Access Management Web Policy Agent)
- [CVE-2023-22750](https://cve.now/CVE-2023-22750.md): Multiple Unauthenticated Command Injections in the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22749](https://cve.now/CVE-2023-22749.md): Multiple Unauthenticated Command Injections in the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22748](https://cve.now/CVE-2023-22748.md): Multiple Unauthenticated Command Injections in the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-22747](https://cve.now/CVE-2023-22747.md): Multiple Unauthenticated Command Injections in the PAPI Protocol (CVSS 9.8, Hewlett Packard Enterprise (HPE) Aruba Mobility Conductor (…)
- [CVE-2023-25807](https://cve.now/CVE-2023-25807.md): DataEase dashboard has a stored XSS vulnerability (CVSS 7.2, dataease)
- [CVE-2022-47179](https://cve.now/CVE-2022-47179.md): WordPress OWM Weather Plugin \<= 5.6.11 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Uwe Jacobs OWM Weather)
- [CVE-2022-47612](https://cve.now/CVE-2022-47612.md): WordPress Participants Database Plugin \<= 2.4.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Roland Barker, xnau webdesign Participants Database)
- [CVE-2023-23865](https://cve.now/CVE-2023-23865.md): WordPress Stripe Payments For WooCommerce by Checkout Plugin \<= 1.4.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Stripe Payments For WooCommerce by Checkout Plugins)
- [CVE-2023-23983](https://cve.now/CVE-2023-23983.md): WordPress Responsive Vertical Icon Menu Plugin \<= 1.5.8 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, wpdevart Responsive Vertical Icon Menu)
- [CVE-2023-0461](https://cve.now/CVE-2023-0461.md): Use-after-free vulnerability in the Linux Kernel (CVSS 7.8, Linux Kernel)
- [CVE-2023-26281](https://cve.now/CVE-2023-26281.md): IBM HTTP Server denial of service (CVSS 5.9, IBM HTTP Server)
- [CVE-2023-23992](https://cve.now/CVE-2023-23992.md): WordPress AutomatorWP Plugin \<= 2.5.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, AutomatorWP)
- [CVE-2023-24419](https://cve.now/CVE-2023-24419.md): WordPress Formidable Forms Plugin \<= 5.5.6 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 7.1, Strategy11 Form Builder Team Formidable Forms)
- [CVE-2022-43459](https://cve.now/CVE-2022-43459.md): WordPress Forms by CaptainForm Plugin \<= 2.5.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Forms by CaptainForm – Form Builder for WordPress)
- [CVE-2023-1022](https://cve.now/CVE-2023-1022.md): WP Meta SEO \<= 4.5.3 - Missing Authorization in 'wpmsGGSaveInformation' (CVSS 5.4, joomunited WP Meta SEO)
- [CVE-2023-1023](https://cve.now/CVE-2023-1023.md): WP Meta SEO \<= 4.5.3 - Missing Authorization in 'saveSitemapSettings' (CVSS 5.4, joomunited WP Meta SEO)
- [CVE-2023-1024](https://cve.now/CVE-2023-1024.md): WP Meta SEO \<= 4.5.3 - Missing Authorization in 'regenerateSitemaps' (CVSS 4.3, joomunited WP Meta SEO)
- [CVE-2023-1026](https://cve.now/CVE-2023-1026.md): WP Meta SEO \<= 4.5.3 - Missing Authorization in 'listPostsCategory' (CVSS 4.3, joomunited WP Meta SEO)
- [CVE-2023-1027](https://cve.now/CVE-2023-1027.md): WP Meta SEO \<= 4.5.3 - Missing Authorization in 'checkAllCategoryInSitemap' (CVSS 4.3, joomunited WP Meta SEO)
- [CVE-2023-1028](https://cve.now/CVE-2023-1028.md): WP Meta SEO \<= 4.5.3 - Cross-Site Request Forgery via 'setIgnore' (CVSS 4.3, joomunited WP Meta SEO)
- [CVE-2023-1080](https://cve.now/CVE-2023-1080.md): GN Publisher \<= 1.5.5 - Reflected Cross-Site Scripting (CVSS 6.1, gnpublisher GN Publisher: Google News Compatible RSS Feeds)
- [CVE-2023-26105](https://cve.now/CVE-2023-26105.md): All versions of the package utilities are vulnerable to Prototype Pollution via the \_mix function. (CVSS 7.5, utilities)
- [CVE-2021-22283](https://cve.now/CVE-2021-22283.md): MMS File Transfer Vulnerability impact on Distribution Automation products (CVSS 6.2, ABB Relion protection relays - 611 series · ABB Relion p… +9)
- [CVE-2020-36652](https://cve.now/CVE-2020-36652.md): File and Directory Permissions Vulnerability in Hitachi Automation Director, Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center (CVSS 6.6, Hitachi Automation Director · Hitachi Infrastructure Ana… +3)
- [CVE-2022-4895](https://cve.now/CVE-2022-4895.md): Man-in-the-middle attack Vulnerability in Hitachi Infrastructure Analytics Advisor, Hitachi Ops Center Analyzer (CVSS 8.6, Hitachi Infrastructure Analytics Advisor · Hitachi Ops Cent…)
- [CVE-2022-3884](https://cve.now/CVE-2022-3884.md): Directory Permission Vulnerability in Hitachi Ops Center Analyzer (CVSS 7.3, Hitachi Ops Center Analyzer)
- [CVE-2015-10086](https://cve.now/CVE-2015-10086.md): OpenCycleCompass server-php login.php sql injection (CVSS 7.3, OpenCycleCompass server-php)
- [CVE-2022-20455](https://cve.now/CVE-2022-20455.md): In addAutomaticZenRule of ZenModeHelper.java, there is a possible persistent denial of service due to resource exhaustion. (CVSS 5.5, Android)
- [CVE-2022-20481](https://cve.now/CVE-2022-20481.md): In multiple files, there is a possible way to preserve WiFi settings due to residual data after a reset. (CVSS 5.5, Android)
- [CVE-2022-20551](https://cve.now/CVE-2022-20551.md): In createTrack of AudioFlinger.cpp, there is a possible way to record audio without a privacy indicator due to a logic error in the code. (CVSS 6.7, Android)
- [CVE-2022-23239](https://cve.now/CVE-2022-23239.md): Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which (no CVSS, Active IQ Unified Manager for VMware vSphere, Linux, and Mi…)
- [CVE-2022-23240](https://cve.now/CVE-2022-23240.md): Active IQ Unified Manager for VMware vSphere, Linux, and Microsoft Windows versions prior to 9.11P1 are susceptible to a vulnerability which (CVSS 6.5, Active IQ Unified Manager for VMware vSphere, Linux, and Mi…)
- [CVE-2022-38220](https://cve.now/CVE-2022-38220.md): An XSS vulnerability exists within Quest KACE Systems Management Appliance (SMA) through 12.1 that may allow remote injection of arbitrary w (CVSS 6.1)
- [CVE-2022-47075](https://cve.now/CVE-2022-47075.md): An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name paramet (CVSS 7.5)
- [CVE-2022-47076](https://cve.now/CVE-2022-47076.md): An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to view sensitive information via DisplayParallelLogData.aspx (CVSS 7.5)
- [CVE-2023-1081](https://cve.now/CVE-2023-1081.md): Cross-site Scripting (XSS) - Stored in microweber/microweber (CVSS 5.7, microweber/microweber)
- [CVE-2023-1095](https://cve.now/CVE-2023-1095.md): In nf\_tables\_updtable, if nf\_tables\_table\_enable returns an error, nft\_trans\_destroy is called to free the transaction object. (CVSS 5.5, Linux kernel netfilter subsystem.)
- [CVE-2023-20857](https://cve.now/CVE-2023-20857.md): VMware Workspace ONE Content contains a passcode bypass vulnerability. (CVSS 6.8, VMware Workspace ONE Content)
- [CVE-2023-20932](https://cve.now/CVE-2023-20932.md): In onCreatePreferences of EditInfoFragment.java, there is a possible way to read contacts belonging to other users due to improper input val (CVSS 3.3, Android)
- [CVE-2023-20933](https://cve.now/CVE-2023-20933.md): In several functions of MediaCodec.cpp, there is a possible way to corrupt memory due to a use after free. (CVSS 7.8, Android)
- [CVE-2023-20934](https://cve.now/CVE-2023-20934.md): In resolveAttributionSource of ServiceUtilities.cpp, there is a possible way to disable the microphone privacy indicator due to a permission (CVSS 7.8, Android)
- [CVE-2023-20937](https://cve.now/CVE-2023-20937.md): In several functions of the Android Linux kernel, there is a possible way to corrupt memory due to a use after free. (CVSS 7.8, Android)
- [CVE-2023-20938](https://cve.now/CVE-2023-20938.md): In binder\_transaction\_buffer\_release of binder.c, there is a possible use after free due to improper input validation. (CVSS 8.1, Android)
- [CVE-2023-20939](https://cve.now/CVE-2023-20939.md): In multiple functions of looper\_backed\_event\_loop.cpp, there is a possible way to corrupt memory due to improper locking. (CVSS 7.8, Android)
- [CVE-2023-20940](https://cve.now/CVE-2023-20940.md): In the Android operating system, there is a possible way to replace a boot partition due to improperly used crypto. (CVSS 7.8, Android)
- [CVE-2023-20943](https://cve.now/CVE-2023-20943.md): In clearApplicationUserData of ActivityManagerService.java, there is a possible way to remove system files due to a path traversal error. (CVSS 7.8, Android)
- [CVE-2023-20944](https://cve.now/CVE-2023-20944.md): In run of ChooseTypeAndAccountActivity.java, there is a possible escalation of privilege due to unsafe deserialization. (CVSS 7.8, Android)
- [CVE-2023-20945](https://cve.now/CVE-2023-20945.md): In phNciNfc\_MfCreateXchgDataHdr of phNxpExtns\_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, Android)
- [CVE-2023-20946](https://cve.now/CVE-2023-20946.md): In onStart of BluetoothSwitchPreferenceController.java, there is a possible permission bypass due to a confused deputy. (CVSS 9.8, Android)
- [CVE-2023-20948](https://cve.now/CVE-2023-20948.md): In dropFramesUntilIframe of AAVCAssembler.cpp, there is a possible out of bounds read due to a heap buffer overflow. (CVSS 7.5, Android)
- [CVE-2023-22995](https://cve.now/CVE-2023-22995.md): In the Linux kernel before 5.17, an error path in dwc3\_qcom\_acpi\_register\_core in drivers/usb/dwc3/dwc3-qcom.c lacks certain platform\_device (CVSS 7.8)
- [CVE-2023-22996](https://cve.now/CVE-2023-22996.md): In the Linux kernel before 5.17.2, drivers/soc/qcom/qcom\_aoss.c does not release an of\_find\_device\_by\_node reference after use, e.g., with p (CVSS 5.5)
- [CVE-2023-22997](https://cve.now/CVE-2023-22997.md): In the Linux kernel before 6.1.2, kernel/module/decompress.c misinterprets the module\_get\_next\_page return value (expects it to be NULL in t (CVSS 5.5)
- [CVE-2023-22998](https://cve.now/CVE-2023-22998.md): In the Linux kernel before 6.0.3, drivers/gpu/drm/virtio/virtgpu\_object.c misinterprets the drm\_gem\_shmem\_get\_sg\_table return value (expects (CVSS 5.5)
- [CVE-2023-22999](https://cve.now/CVE-2023-22999.md): In the Linux kernel before 5.16.3, drivers/usb/dwc3/dwc3-qcom.c misinterprets the dwc3\_qcom\_create\_urs\_usb\_platdev return value (expects it (CVSS 5.5)
- [CVE-2023-25264](https://cve.now/CVE-2023-25264.md): An issue was discovered in Docmosis Tornado prior to version 2.9.5. (CVSS 7.5)
- [CVE-2023-25265](https://cve.now/CVE-2023-25265.md): Docmosis Tornado \<= 2.9.4 is vulnerable to Directory Traversal leading to the disclosure of arbitrary content on the file system. (CVSS 7.5)
- [CVE-2023-25266](https://cve.now/CVE-2023-25266.md): An issue was discovered in Docmosis Tornado prior to version 2.9.5. (CVSS 8.8)
- [CVE-2023-25431](https://cve.now/CVE-2023-25431.md): An issue was discovered in Online Reviewer Management System v1.0. (CVSS 4.8)
- [CVE-2023-25432](https://cve.now/CVE-2023-25432.md): An issue was discovered in Online Reviewer Management System v1.0. (no CVSS)
- [CVE-2023-26255](https://cve.now/CVE-2023-26255.md): An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. (CVSS 7.5)
- [CVE-2023-26256](https://cve.now/CVE-2023-26256.md): An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. (CVSS 7.5)
- [CVE-2023-27292](https://cve.now/CVE-2023-27292.md): An open redirect vulnerability exposes OpenCATS to template injection due to improper validation of user-supplied GET parameters. (CVSS 5.4, OpenCATS)
- [CVE-2023-27293](https://cve.now/CVE-2023-27293.md): Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer (CVSS 6.1, OpenCATS)
- [CVE-2023-27294](https://cve.now/CVE-2023-27294.md): Improper neutralization of input during web page generation allows an authenticated attacker with access to a restricted account to submit m (CVSS 5.4, OpenCATS)
- [CVE-2023-27295](https://cve.now/CVE-2023-27295.md): Cross-site request forgery is facilitated by OpenCATS failure to require CSRF tokens in POST requests. (CVSS 5.4, OpenCATS)
- [CVE-2023-27320](https://cve.now/CVE-2023-27320.md): Sudo before 1.9.13p2 has a double free in the per-command chroot feature. (CVSS 7.2)
- [CVE-2023-27371](https://cve.now/CVE-2023-27371.md): GNU libmicrohttpd before 0.9.76 allows remote DoS (Denial of Service) due to improper parsing of a multipart/form-data boundary in the postp (CVSS 5.9)
- [CVE-2023-27372](https://cve.now/CVE-2023-27372.md): SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-02-28
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.