# CVEs published 2023-03-01

82 CVEs were published on March 1, 2023: 3 critical, 8 high. Days are UTC.

- [CVE-2020-5026](https://cve.now/CVE-2020-5026.md): IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote attacker to obtain sensit (CVSS 4.3, IBM Financial Transaction Manager)
- [CVE-2020-5002](https://cve.now/CVE-2020-5002.md): IBM Financial Transaction Manager security bypass (CVSS 4.3, IBM Financial Transaction Manager)
- [CVE-2020-5001](https://cve.now/CVE-2020-5001.md): IBM Financial Transaction Manager path traversal (CVSS 4.3, IBM Financial Transaction Manager)
- [CVE-2022-43902](https://cve.now/CVE-2022-43902.md): IBM MQ denial of service (CVSS 6.5, IBM MQ)
- [CVE-2023-22738](https://cve.now/CVE-2023-22738.md): Improper Preservation of Permissions in vantage6 (CVSS 6.3, vantage6)
- [CVE-2023-1131](https://cve.now/CVE-2023-1131.md): SourceCodester Computer Parts Sales and Inventory System customer.php cross site scripting (CVSS 3.5, SourceCodester Computer Parts Sales and Inventory System)
- [CVE-2023-1130](https://cve.now/CVE-2023-1130.md): SourceCodester Computer Parts Sales and Inventory System processlogin sql injection (CVSS 6.3, SourceCodester Computer Parts Sales and Inventory System)
- [CVE-2023-1097](https://cve.now/CVE-2023-1097.md): Unauthenticated Command Injection EG7035-M11 Series (CVSS 9.3, Baicells EG7035-M11)
- [CVE-2023-25931](https://cve.now/CVE-2023-25931.md): Medtronic Micro Clinician & InterStim X Clinician App Password Reset Issue (CVSS 6.4, Medtronic InsterStim Applications)
- [CVE-2023-0460](https://cve.now/CVE-2023-0460.md): Remote code execution in YouTube Android Player API SDK (CVSS 5.1, Google YouTube Android Player API SDK)
- [CVE-2022-39228](https://cve.now/CVE-2022-39228.md): Observable Response Discrepancy in vantage6 (CVSS 5.3, vantage6)
- [CVE-2022-36021](https://cve.now/CVE-2022-36021.md): Redis string pattern matching can be abused to achieve Denial of Service (CVSS 5.5, redis)
- [CVE-2023-0594](https://cve.now/CVE-2023-0594.md): Grafana is an open-source platform for monitoring and observability. (CVSS 7.3, Grafana · github.com/grafana/grafana)
- [CVE-2023-0507](https://cve.now/CVE-2023-0507.md): Grafana is an open-source platform for monitoring and observability. (CVSS 7.3, Grafana · github.com/grafana/grafana)
- [CVE-2023-25544](https://cve.now/CVE-2023-25544.md): Dell NetWorker versions 19.5 and earlier contain 'Apache Tomcat' version disclosure vulnerability. (CVSS 7.5, Dell NetWorker, NVE)
- [CVE-2022-47148](https://cve.now/CVE-2022-47148.md): WordPress WooCommerce PDF Invoices & Packing Slips Plugin \<= 3.2.5 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, WP Overnight PDF Invoices & Packing Slips for WooCommerce)
- [CVE-2023-24567](https://cve.now/CVE-2023-24567.md): Dell NetWorker versions 19.5 and earlier contain 'RabbitMQ' version disclosure vulnerability. (CVSS 7.5, Dell NetWorker, NVE)
- [CVE-2022-46806](https://cve.now/CVE-2022-46806.md): WordPress Cart All In One For WooCommerce Plugin \<= 1.1.10 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, VillaTheme Cart All In One For WooCommerce)
- [CVE-2022-46805](https://cve.now/CVE-2022-46805.md): WordPress Conditional Payments for WooCommerce Plugin \<= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Lauri Karisola / WP Trio Conditional Shipping for WooCommer…)
- [CVE-2022-46798](https://cve.now/CVE-2022-46798.md): WordPress WooLentor Plugin \<= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, HasThemes ShopLentor)
- [CVE-2022-46797](https://cve.now/CVE-2022-46797.md): WordPress Conversios.io Plugin \<= 5.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Conversios All-in-one Google Analytics, Pixels and Product…)
- [CVE-2022-45068](https://cve.now/CVE-2022-45068.md): WordPress Mercado Pago payments for WooCommerce Plugin \<= 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Mercado Pago payments for WooCommerce)
- [CVE-2022-45804](https://cve.now/CVE-2022-45804.md): WordPress Robo Gallery Plugin \<= 3.2.9 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery)
- [CVE-2022-40198](https://cve.now/CVE-2022-40198.md): WordPress TeraWallet – For WooCommerce Plugin \<= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, StandaloneTech TeraWallet – For WooCommerce)
- [CVE-2022-38468](https://cve.now/CVE-2022-38468.md): WordPress NextGEN Gallery Plugin \<= 3.28 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Imagely WordPress Gallery Plugin – NextGEN Gallery)
- [CVE-2023-1064](https://cve.now/CVE-2023-1064.md): SQLi in Uzay Baskul's Weighbridge Automation Software (CVSS 9.8, Uzay Baskul Weighbridge Automation Software)
- [CVE-2023-23973](https://cve.now/CVE-2023-23973.md): WordPress Contact Us page - Contact people LITE Plugin \<= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, a3rev Software Contact Us Page – Contact People)
- [CVE-2023-23974](https://cve.now/CVE-2023-23974.md): WordPress Quick Event Manager Plugin \<= 9.7.4 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Fullworks Quick Event Manager)
- [CVE-2023-23984](https://cve.now/CVE-2023-23984.md): WordPress Bubble Menu – circle floating menu Plugin \<= 3.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Wow-Company Bubble Menu – circle floating menu)
- [CVE-2023-1114](https://cve.now/CVE-2023-1114.md): Improper Input Validation on e-Belediye (CVSS 9.8, Eskom e-Belediye)
- [CVE-2021-4327](https://cve.now/CVE-2021-4327.md): SerenityOS TypedArray.cpp initialize\_typed\_array\_from\_array\_buffer integer overflow (CVSS 5.5, SerenityOS)
- [CVE-2023-1113](https://cve.now/CVE-2023-1113.md): SourceCodester Simple Payroll System POST Parameter cross site scripting (CVSS 2.4, SourceCodester Simple Payroll System)
- [CVE-2023-1112](https://cve.now/CVE-2023-1112.md): Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal (CVSS 4.7, Drag and Drop Multiple File Upload Contact Form)
- [CVE-2022-3162](https://cve.now/CVE-2022-3162.md): Unauthorized read of Custom Resources (CVSS 6.5, Kubernetes · k8s.io/kubernetes +1)
- [CVE-2022-3294](https://cve.now/CVE-2022-3294.md): Node address isn't always verified when proxying (CVSS 6.6, Kubernetes · github.com/kubernetes/kubernetes +1)
- [CVE-2022-45608](https://cve.now/CVE-2022-45608.md): An issue was discovered in ThingsBoard 3.4.1, allows low privileged attackers (CUSTOMER\_USER) to gain escalated privileges (vertically) and (no CVSS)
- [CVE-2022-48309](https://cve.now/CVE-2022-48309.md): A CSRF vulnerability allows malicious websites to retrieve logs and technical support archives in Sophos Connect versions older than 2.2.90. (CVSS 4.3, Sophos Connect Client)
- [CVE-2022-48310](https://cve.now/CVE-2022-48310.md): An information disclosure vulnerability allows sensitive key material to be included in technical support archives in Sophos Connect version (CVSS 5.5, Sophos Connect Client)
- [CVE-2022-4901](https://cve.now/CVE-2022-4901.md): Multiple stored XSS vulnerabilities in Sophos Connect versions older than 2.2.90 allow Javascript code to run in the local UI via a maliciou (CVSS 3.3, Sophos Connect Client)
- [CVE-2023-1104](https://cve.now/CVE-2023-1104.md): Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress (CVSS 8.1, flatpressblog/flatpress)
- [CVE-2023-1105](https://cve.now/CVE-2023-1105.md): External Control of File Name or Path in flatpressblog/flatpress (CVSS 7.5, flatpressblog/flatpress)
- [CVE-2023-1115](https://cve.now/CVE-2023-1115.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 7.6, pimcore/pimcore)
- [CVE-2023-1116](https://cve.now/CVE-2023-1116.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.4, pimcore/pimcore)
- [CVE-2023-1117](https://cve.now/CVE-2023-1117.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.8, pimcore/pimcore)
- [CVE-2023-1127](https://cve.now/CVE-2023-1127.md): Divide By Zero in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2023-23000](https://cve.now/CVE-2023-23000.md): In the Linux kernel before 5.17, drivers/phy/tegra/xusb.c mishandles the tegra\_xusb\_find\_port\_node return value. (CVSS 5.5)
- [CVE-2023-23001](https://cve.now/CVE-2023-23001.md): In the Linux kernel before 5.16.3, drivers/scsi/ufs/ufs-mediatek.c misinterprets the regulator\_get return value (expects it to be NULL in th (CVSS 5.5)
- [CVE-2023-23002](https://cve.now/CVE-2023-23002.md): In the Linux kernel before 5.16.3, drivers/bluetooth/hci\_qca.c misinterprets the devm\_gpiod\_get\_index\_optional return value (expects it to b (CVSS 5.5)
- [CVE-2023-23003](https://cve.now/CVE-2023-23003.md): In the Linux kernel before 5.16, tools/perf/util/expr.c lacks a check for the hashmap\_\_new return value. (CVSS 4.0)
- [CVE-2023-23004](https://cve.now/CVE-2023-23004.md): In the Linux kernel before 5.19, drivers/gpu/drm/arm/malidp\_planes.c misinterprets the get\_sg\_table return value (expects it to be NULL in t (CVSS 5.5)
- [CVE-2023-23005](https://cve.now/CVE-2023-23005.md): In the Linux kernel before 6.2, mm/memory-tiers.c misinterprets the alloc\_memory\_type return value (expects it to be NULL in the error case, (CVSS 5.5)
- [CVE-2023-23006](https://cve.now/CVE-2023-23006.md): In the Linux kernel before 5.15.13, drivers/net/ethernet/mellanox/mlx5/core/steering/dr\_domain.c misinterprets the mlx5\_get\_uars\_page return (CVSS 5.5)
- [CVE-2023-23315](https://cve.now/CVE-2023-23315.md): The PrestaShop e-commerce platform module stripejs contains a Blind SQL injection vulnerability up to version 4.5.5. (no CVSS)
- [CVE-2023-24045](https://cve.now/CVE-2023-24045.md): In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specifying the target usern (CVSS 6.5)
- [CVE-2023-24117](https://cve.now/CVE-2023-24117.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepauth\_5g parameter at /goform/WifiBa (CVSS 6.5)
- [CVE-2023-24118](https://cve.now/CVE-2023-24118.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the security parameter at /goform/WifiBasi (CVSS 6.5)
- [CVE-2023-24119](https://cve.now/CVE-2023-24119.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the ssid parameter at /goform/WifiBasicSet (CVSS 6.5)
- [CVE-2023-24120](https://cve.now/CVE-2023-24120.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wrlEn\_5g parameter at /goform/WifiBasi (CVSS 6.5)
- [CVE-2023-24121](https://cve.now/CVE-2023-24121.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the security\_5g parameter at /goform/WifiB (CVSS 6.5)
- [CVE-2023-24122](https://cve.now/CVE-2023-24122.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the ssid\_5g parameter at /goform/WifiBasic (CVSS 6.5)
- [CVE-2023-24123](https://cve.now/CVE-2023-24123.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepauth parameter at /goform/WifiBasic (CVSS 6.5)
- [CVE-2023-24124](https://cve.now/CVE-2023-24124.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wrlEn parameter at /goform/WifiBasicSe (CVSS 6.5)
- [CVE-2023-24125](https://cve.now/CVE-2023-24125.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepkey2\_5g parameter at /goform/WifiBa (CVSS 6.5)
- [CVE-2023-24126](https://cve.now/CVE-2023-24126.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepkey4\_5g parameter at /goform/WifiBa (CVSS 6.5)
- [CVE-2023-24127](https://cve.now/CVE-2023-24127.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepkey1 parameter at /goform/WifiBasic (no CVSS)
- [CVE-2023-24128](https://cve.now/CVE-2023-24128.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepkey2 parameter at /goform/WifiBasic (no CVSS)
- [CVE-2023-24129](https://cve.now/CVE-2023-24129.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepkey4 parameter at /goform/WifiBasic (no CVSS)
- [CVE-2023-24130](https://cve.now/CVE-2023-24130.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepkey parameter at /goform/WifiBasicS (no CVSS)
- [CVE-2023-24131](https://cve.now/CVE-2023-24131.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepkey1\_5g parameter at /goform/WifiBa (no CVSS)
- [CVE-2023-24132](https://cve.now/CVE-2023-24132.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepkey3\_5g parameter at /goform/WifiBa (no CVSS)
- [CVE-2023-24133](https://cve.now/CVE-2023-24133.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepkey\_5g parameter at /goform/WifiBas (no CVSS)
- [CVE-2023-24134](https://cve.now/CVE-2023-24134.md): Jensen of Scandinavia Eagle 1200AC V15.03.06.33\_en was discovered to contain a stack overflow via the wepkey3 parameter at /goform/WifiBasic (no CVSS)
- [CVE-2023-24751](https://cve.now/CVE-2023-24751.md): libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the mc\_chroma function at motion.cc. (no CVSS)
- [CVE-2023-24752](https://cve.now/CVE-2023-24752.md): libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff\_hevc\_put\_hevc\_epel\_pixels\_8\_sse function at sse-motion.cc. (no CVSS)
- [CVE-2023-24754](https://cve.now/CVE-2023-24754.md): libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff\_hevc\_put\_weighted\_pred\_avg\_8\_sse function at sse-motion.cc. (CVSS 5.5)
- [CVE-2023-24755](https://cve.now/CVE-2023-24755.md): libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put\_weighted\_pred\_8\_fallback function at fallback-motion.cc. (CVSS 5.5)
- [CVE-2023-24756](https://cve.now/CVE-2023-24756.md): libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff\_hevc\_put\_unweighted\_pred\_8\_sse function at sse-motion.cc. (CVSS 5.5)
- [CVE-2023-24757](https://cve.now/CVE-2023-24757.md): libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put\_unweighted\_pred\_16\_fallback function at fallback-motion.cc. (CVSS 5.5)
- [CVE-2023-24758](https://cve.now/CVE-2023-24758.md): libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff\_hevc\_put\_weighted\_pred\_avg\_8\_sse function at sse-motion.cc. (CVSS 5.5)
- [CVE-2023-25221](https://cve.now/CVE-2023-25221.md): Libde265 v1.0.10 was discovered to contain a heap-buffer-overflow vulnerability in the derive\_spatial\_luma\_vector\_prediction function in mot (no CVSS)
- [CVE-2023-25222](https://cve.now/CVE-2023-25222.md): A heap-based buffer overflow vulnerability exits in GNU LibreDWG v0.12.5 via the bit\_read\_RC function at bits.c. (no CVSS)
- [CVE-2023-26608](https://cve.now/CVE-2023-26608.md): SOLDR (System of Orchestration, Lifecycle control, Detection and Response) 1.1.0 allows stored XSS via the module editor. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.