CVEs published March 2, 2023
57 CVEs were published on March 2, 2023: 7 critical, 10 high.
- Published
- 57
- Critical
- 7
- High
- 10
- Medium
- 30
- Low
- 4
- Unrated
- 6
- Now in CISA KEV
- 0
- Fix available
- 30
Most affected products
- flatpressblog/flatpress
- 5
- xwiki-platform · org.xwiki.platform:xwiki-platform-renderin…
- 3
- Yordam Information Technologies Library Automation System
- 3
- NVIDIA CUDA Toolkit
- 2
- roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- 2
- saleor
- 2
- SonicWall SonicOS
- 2
- ABB Symphony Plus S+ Operations
- 1
- btcpayserver/btcpayserver
- 1
- Dell PowerScale OneFS
- 1
Critical 7
- CVE-2023-26055XWiki Commons may allow privilege escalation to programming rights via user's first namexwiki-commons · org.xwiki.commons:xwiki-commons-xml
- CVE-2023-26471XWiki Platform users may execute anything with superadmin right through comments and async macroxwiki-platform · org.xwiki.platform:xwiki-platform-renderin…
- CVE-2023-26472XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profilexwiki-platform · org.xwiki.platform:xwiki-platform-icon-ui
- CVE-2023-26474XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong authorxwiki-platform · org.xwiki.platform:xwiki-platform-oldco… +1
- CVE-2023-26475XWiki Platform vulnerable to Remote Code Execution in Annotationsxwiki-platform · org.xwiki.platform:xwiki-platform-annotati…
- CVE-2023-26477org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…
- CVE-2021-3854SQLi in Glox Technology's Useroam HotspotGlox Technology Useroam Hotspot
High 10
- CVE-2023-0084Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scriptingroxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-26476Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actorxwiki-platform · org.xwiki.platform:xwiki-platform-livet… +1
- CVE-2023-26480XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Dataxwiki-platform · org.xwiki.platform:xwiki-platform-livedata…
- CVE-2023-0228Improper authentication vulnerability in S+ OperationsABB Symphony Plus S+ Operations
- CVE-2023-0053SAUTER Controls Nova 200–220 Series Cleartext Transmission of Sensitive InformationSAUTER Controls Nova 220 (EYK220F001) DDC with BACnet co… +2
- CVE-2023-1101SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes.SonicWall SonicOS
- CVE-2023-1118A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device.Kernel
- CVE-2023-25358A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
- CVE-2023-25360A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
- CVE-2023-25361A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely.
Medium, low and unrated 40
- CVE-2022-40633Rittal CMC III Improper Access ControlRittal CMC III
- CVE-2023-22381Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub ActionsGitHub Enterprise Server
- CVE-2023-24975IBM Spectrum Symphony HOST header injectionIBM Spectrum Symphony
- CVE-2022-35645IBM Maximo Asset Management cross-site scriptingIBM Maximo Asset Management · IBM Maximo Application Suite
- CVE-2023-26052Saleor is vulnerable to unauthenticated information disclosure via Python exceptionssaleor
- CVE-2023-26056XWiki Platform allows macro execution as any user without programming rights through the context macroxwiki-platform · org.xwiki.platform:xwiki-platform-renderin…
- CVE-2023-26470In XWiki Platform, saving a document with a large object number leads to persistent OOM errorsxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-26051Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptionssaleor
- CVE-2021-4328狮子鱼CMS ApiController.class.php goods_detail sql injection狮子鱼CMS
- CVE-2023-26473XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vmxwiki-platform · org.xwiki.platform:xwiki-platform-web
- CVE-2023-1157finixbit elf-parser elf_parser.cpp get_segments denial of servicefinixbit elf-parser
- CVE-2023-1156SourceCodester Health Center Patient Record Management System fecalysis_form.php cross site scriptingSourceCodester Health Center Patient Record Management Syst…
- CVE-2023-26478org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Functionxwiki-platform · org.xwiki.platform:xwiki-platform-store-fi…
- CVE-2023-26479org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditionsxwiki-platform · org.xwiki.platform:xwiki-platform-renderin…
- CVE-2023-1155Cost Calculator <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scriptingnicdark Cost Calculator
- CVE-2023-0085Metform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypassroxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…
- CVE-2023-25536 Dell PowerScale OneFS 9.4.0.x contains exposure of sensitive information to an unauthorized actor.Dell PowerScale OneFS
- CVE-2021-45479XSS in Yordam Library Automation SystemYordam Information Technologies Library Automation System
- CVE-2021-45478IDOR in Yordam Library Automation SystemYordam Information Technologies Library Automation System
- CVE-2021-45477IDOR in Yordam Library Automation SystemYordam Information Technologies Library Automation System
- CVE-2023-1151SourceCodester Electronic Medical Records System Cookie administrator.php sql injectionSourceCodester Electronic Medical Records System
- CVE-2023-26053Gradle usage of long IDs for PGP keys opens potential for collision attacksgradle
- CVE-2023-25806Time discrepancy in authentication responses in OpenSearchopensearch-project security · org.opensearch.plugin:opensea…
- CVE-2023-25155Integer Overflow in several Redis commands can lead to denial of service.redis
- CVE-2023-0196 NVIDIA CUDA Toolkit SDK contains a bug in cuobjdump, where a local user running the tool against an ill-formed binary may cause a null- poiNVIDIA CUDA Toolkit
- CVE-2023-0193 NVIDIA CUDA Toolkit SDK contains a vulnerability in cuobjdump, where a local user running the tool against a malicious binary may cause an NVIDIA CUDA Toolkit
- CVE-2023-26046teler-waf subject to bypass of common web attack threat rule with HTML entities payloadkitabisa teler-waf · github.com/kitabisa/teler-waf
- CVE-2023-22462Stored XSS in Grafana Text plugingrafana · github.com/grafana/grafana
- CVE-2022-38734StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability.Denial of Service Vulnerability in StorageGRID
- CVE-2022-46501Accruent LLC Maintenance Connection 2021 (all) & 2022.2 was discovered to contain a SQL injection vulnerability via the E-Mail to Work Order
- CVE-2023-0656A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which SonicWall SonicOS
- CVE-2023-1106Cross-site Scripting (XSS) - Reflected in flatpressblog/flatpressflatpressblog/flatpress
- CVE-2023-1107Cross-site Scripting (XSS) - Stored in flatpressblog/flatpressflatpressblog/flatpress
- CVE-2023-1146Cross-site Scripting (XSS) - Generic in flatpressblog/flatpressflatpressblog/flatpress
- CVE-2023-1147Cross-site Scripting (XSS) - Stored in flatpressblog/flatpressflatpressblog/flatpress
- CVE-2023-1148Cross-site Scripting (XSS) - Stored in flatpressblog/flatpressflatpressblog/flatpress
- CVE-2023-1149Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserverbtcpayserver/btcpayserver
- CVE-2023-25362A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute cod
- CVE-2023-25363A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execut
- CVE-2023-26780CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection.