CVEs published March 1, 2023
82 CVEs were published on March 1, 2023: 3 critical, 8 high.
- Published
- 82
- Critical
- 3
- High
- 8
- Medium
- 53
- Low
- 3
- Unrated
- 15
- Now in CISA KEV
- 0
- Fix available
- 24
Most affected products
- IBM Financial Transaction Manager
- 3
- pimcore/pimcore
- 3
- Sophos Connect Client
- 3
- Dell NetWorker, NVE
- 2
- flatpressblog/flatpress
- 2
- Grafana · github.com/grafana/grafana
- 2
- SourceCodester Computer Parts Sales and Inventory System
- 2
- vantage6
- 2
- a3rev Software Contact Us Page – Contact People
- 1
- Baicells EG7035-M11
- 1
Critical 3
High 8
- CVE-2023-0594Grafana is an open-source platform for monitoring and observability.Grafana · github.com/grafana/grafana
- CVE-2023-0507Grafana is an open-source platform for monitoring and observability.Grafana · github.com/grafana/grafana
- CVE-2023-25544 Dell NetWorker versions 19.5 and earlier contain 'Apache Tomcat' version disclosure vulnerability.Dell NetWorker, NVE
- CVE-2023-24567 Dell NetWorker versions 19.5 and earlier contain 'RabbitMQ' version disclosure vulnerability.Dell NetWorker, NVE
- CVE-2023-1104Cross-site Scripting (XSS) - Stored in flatpressblog/flatpressflatpressblog/flatpress
- CVE-2023-1105External Control of File Name or Path in flatpressblog/flatpressflatpressblog/flatpress
- CVE-2023-1115Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-1127Divide By Zero in vim/vimvim/vim
Medium, low and unrated 71
- CVE-2020-5026IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensitIBM Financial Transaction Manager
- CVE-2020-5002IBM Financial Transaction Manager security bypassIBM Financial Transaction Manager
- CVE-2020-5001IBM Financial Transaction Manager path traversalIBM Financial Transaction Manager
- CVE-2022-43902IBM MQ denial of serviceIBM MQ
- CVE-2023-22738Improper Preservation of Permissions in vantage6vantage6
- CVE-2023-1131SourceCodester Computer Parts Sales and Inventory System customer.php cross site scriptingSourceCodester Computer Parts Sales and Inventory System
- CVE-2023-1130SourceCodester Computer Parts Sales and Inventory System processlogin sql injectionSourceCodester Computer Parts Sales and Inventory System
- CVE-2023-25931Medtronic Micro Clinician & InterStim X Clinician App Password Reset IssueMedtronic InsterStim Applications
- CVE-2023-0460Remote code execution in YouTube Android Player API SDKGoogle YouTube Android Player API SDK
- CVE-2022-39228Observable Response Discrepancy in vantage6vantage6
- CVE-2022-36021Redis string pattern matching can be abused to achieve Denial of Serviceredis
- CVE-2022-47148WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.2.5 is vulnerable to Cross Site Request Forgery (CSRF)WP Overnight PDF Invoices & Packing Slips for WooCommerce
- CVE-2022-46806WordPress Cart All In One For WooCommerce Plugin <= 1.1.10 is vulnerable to Cross Site Request Forgery (CSRF)VillaTheme Cart All In One For WooCommerce
- CVE-2022-46805WordPress Conditional Payments for WooCommerce Plugin <= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF)Lauri Karisola / WP Trio Conditional Shipping for WooCommer…
- CVE-2022-46798WordPress WooLentor Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)HasThemes ShopLentor
- CVE-2022-46797WordPress Conversios.io Plugin <= 5.2.3 is vulnerable to Cross Site Request Forgery (CSRF)Conversios All-in-one Google Analytics, Pixels and Product…
- CVE-2022-45068WordPress Mercado Pago payments for WooCommerce Plugin <= 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF)Mercado Pago payments for WooCommerce
- CVE-2022-45804WordPress Robo Gallery Plugin <= 3.2.9 is vulnerable to Cross Site Request Forgery (CSRF)RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery
- CVE-2022-40198WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)StandaloneTech TeraWallet – For WooCommerce
- CVE-2022-38468WordPress NextGEN Gallery Plugin <= 3.28 is vulnerable to Cross Site Request Forgery (CSRF)Imagely WordPress Gallery Plugin – NextGEN Gallery
- CVE-2023-23973WordPress Contact Us page - Contact people LITE Plugin <= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF)a3rev Software Contact Us Page – Contact People
- CVE-2023-23974WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Request Forgery (CSRF)Fullworks Quick Event Manager
- CVE-2023-23984WordPress Bubble Menu – circle floating menu Plugin <= 3.0.1 is vulnerable to Cross Site Request Forgery (CSRF)Wow-Company Bubble Menu – circle floating menu
- CVE-2021-4327SerenityOS TypedArray.cpp initialize_typed_array_from_array_buffer integer overflowSerenityOS
- CVE-2023-1113SourceCodester Simple Payroll System POST Parameter cross site scriptingSourceCodester Simple Payroll System
- CVE-2023-1112Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversalDrag and Drop Multiple File Upload Contact Form
- CVE-2022-3162Unauthorized read of Custom ResourcesKubernetes · k8s.io/kubernetes +1
- CVE-2022-3294Node address isn't always verified when proxyingKubernetes · github.com/kubernetes/kubernetes +1
- CVE-2022-45608An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers (CUSTOMER_USER) to gain escalated privileges (vertically) and
- CVE-2022-48309A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90.Sophos Connect Client
- CVE-2022-48310An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect versionSophos Connect Client
- CVE-2022-4901Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a maliciouSophos Connect Client
- CVE-2023-1116Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-1117Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-23000In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra_xusb_find_port_node return value.
- CVE-2023-23001In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator_get return value (expects it to be NULL in th
- CVE-2023-23002In the Linux kernel before 5.16.3, drivers/bluetooth/hci_qca.c misinterprets the devm_gpiod_get_index_optional return value (expects it to b
- CVE-2023-23003In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap__new return value.
- CVE-2023-23004In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp_planes.c misinterprets the get_sg_table return value (expects it to be NULL in t
- CVE-2023-23005In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc_memory_type return value (expects it to be NULL in the error case,
- CVE-2023-23006In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c misinterprets the mlx5_get_uars_page return
- CVE-2023-23315The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5.
- CVE-2023-24045In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target usern
- CVE-2023-24117Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepauth_5g parameter at /goform/WifiBa
- CVE-2023-24118Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the security parameter at /goform/WifiBasi
- CVE-2023-24119Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet
- CVE-2023-24120Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn_5g parameter at /goform/WifiBasi
- CVE-2023-24121Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the security_5g parameter at /goform/WifiB
- CVE-2023-24122Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid_5g parameter at /goform/WifiBasic
- CVE-2023-24123Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasic
- CVE-2023-24124Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSe
- CVE-2023-24125Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey2_5g parameter at /goform/WifiBa
- CVE-2023-24126Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey4_5g parameter at /goform/WifiBa
- CVE-2023-24127Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasic
- CVE-2023-24128Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasic
- CVE-2023-24129Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey4 parameter at /goform/WifiBasic
- CVE-2023-24130Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey parameter at /goform/WifiBasicS
- CVE-2023-24131Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey1_5g parameter at /goform/WifiBa
- CVE-2023-24132Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey3_5g parameter at /goform/WifiBa
- CVE-2023-24133Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey_5g parameter at /goform/WifiBas
- CVE-2023-24134Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey3 parameter at /goform/WifiBasic
- CVE-2023-24751libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the mc_chroma function at motion.cc.
- CVE-2023-24752libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_hevc_epel_pixels_8_sse function at sse-motion.cc.
- CVE-2023-24754libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc.
- CVE-2023-24755libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_weighted_pred_8_fallback function at fallback-motion.cc.
- CVE-2023-24756libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_unweighted_pred_8_sse function at sse-motion.cc.
- CVE-2023-24757libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_unweighted_pred_16_fallback function at fallback-motion.cc.
- CVE-2023-24758libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse function at sse-motion.cc.
- CVE-2023-25221Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derive_spatial_luma_vector_prediction function in mot
- CVE-2023-25222A heap-based buffer overflow vulnerability exits in GNU LibreDWG v0.12.5 via the bit_read_RC function at bits.c.
- CVE-2023-26608SOLDR (System of Orchestration, Lifecycle control, Detection and Response) 1.1.0 allows stored XSS via the module editor.