# CVEs published 2023-03-02

57 CVEs were published on March 2, 2023: 7 critical, 10 high. Days are UTC.

- [CVE-2022-40633](https://cve.now/CVE-2022-40633.md): Rittal CMC III Improper Access Control (CVSS 4.6, Rittal CMC III)
- [CVE-2023-22381](https://cve.now/CVE-2023-22381.md): Code injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions (CVSS 4.1, GitHub Enterprise Server)
- [CVE-2023-24975](https://cve.now/CVE-2023-24975.md): IBM Spectrum Symphony HOST header injection (CVSS 5.4, IBM Spectrum Symphony)
- [CVE-2022-35645](https://cve.now/CVE-2022-35645.md): IBM Maximo Asset Management cross-site scripting (CVSS 6.4, IBM Maximo Asset Management · IBM Maximo Application Suite)
- [CVE-2023-26052](https://cve.now/CVE-2023-26052.md): Saleor is vulnerable to unauthenticated information disclosure via Python exceptions (CVSS 3.7, saleor)
- [CVE-2023-26055](https://cve.now/CVE-2023-26055.md): XWiki Commons may allow privilege escalation to programming rights via user's first name (CVSS 10.0, xwiki-commons · org.xwiki.commons:xwiki-commons-xml)
- [CVE-2023-26056](https://cve.now/CVE-2023-26056.md): XWiki Platform allows macro execution as any user without programming rights through the context macro (CVSS 5.4, xwiki-platform · org.xwiki.platform:xwiki-platform-renderin…)
- [CVE-2023-26470](https://cve.now/CVE-2023-26470.md): In XWiki Platform, saving a document with a large object number leads to persistent OOM errors (CVSS 5.7, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-0084](https://cve.now/CVE-2023-0084.md): Metform Elementor Contact Form Builder \<= 3.1.2 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-26051](https://cve.now/CVE-2023-26051.md): Saleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions (CVSS 6.5, saleor)
- [CVE-2023-26471](https://cve.now/CVE-2023-26471.md): XWiki Platform users may execute anything with superadmin right through comments and async macro (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-renderin…)
- [CVE-2021-4328](https://cve.now/CVE-2021-4328.md): 狮子鱼CMS ApiController.class.php goods\_detail sql injection (CVSS 6.3, 狮子鱼CMS)
- [CVE-2023-26472](https://cve.now/CVE-2023-26472.md): XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-icon-ui)
- [CVE-2023-26473](https://cve.now/CVE-2023-26473.md): XWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm (CVSS 6.5, xwiki-platform · org.xwiki.platform:xwiki-platform-web)
- [CVE-2023-1157](https://cve.now/CVE-2023-1157.md): finixbit elf-parser elf\_parser.cpp get\_segments denial of service (CVSS 2.8, finixbit elf-parser)
- [CVE-2023-26474](https://cve.now/CVE-2023-26474.md): XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-oldco… +1)
- [CVE-2023-1156](https://cve.now/CVE-2023-1156.md): SourceCodester Health Center Patient Record Management System fecalysis\_form.php cross site scripting (CVSS 3.5, SourceCodester Health Center Patient Record Management Syst…)
- [CVE-2023-26475](https://cve.now/CVE-2023-26475.md): XWiki Platform vulnerable to Remote Code Execution in Annotations (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-annotati…)
- [CVE-2023-26476](https://cve.now/CVE-2023-26476.md): Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor (CVSS 7.5, xwiki-platform · org.xwiki.platform:xwiki-platform-livet… +1)
- [CVE-2023-26477](https://cve.now/CVE-2023-26477.md): org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…)
- [CVE-2023-26478](https://cve.now/CVE-2023-26478.md): org.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function (CVSS 6.6, xwiki-platform · org.xwiki.platform:xwiki-platform-store-fi…)
- [CVE-2023-26479](https://cve.now/CVE-2023-26479.md): org.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditions (CVSS 6.5, xwiki-platform · org.xwiki.platform:xwiki-platform-renderin…)
- [CVE-2023-26480](https://cve.now/CVE-2023-26480.md): XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data (CVSS 8.9, xwiki-platform · org.xwiki.platform:xwiki-platform-livedata…)
- [CVE-2023-1155](https://cve.now/CVE-2023-1155.md): Cost Calculator \<= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4, nicdark Cost Calculator)
- [CVE-2023-0085](https://cve.now/CVE-2023-0085.md): Metform Elementor Contact Form Builder \<= 3.2.1 - reCaptcha Protection Bypass (CVSS 5.3, roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form…)
- [CVE-2023-25536](https://cve.now/CVE-2023-25536.md): Dell PowerScale OneFS 9.4.0.x contains exposure of sensitive information to an unauthorized actor. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2021-3854](https://cve.now/CVE-2021-3854.md): SQLi in Glox Technology's Useroam Hotspot (CVSS 9.8, Glox Technology Useroam Hotspot)
- [CVE-2021-45479](https://cve.now/CVE-2021-45479.md): XSS in Yordam Library Automation System (CVSS 5.4, Yordam Information Technologies Library Automation System)
- [CVE-2021-45478](https://cve.now/CVE-2021-45478.md): IDOR in Yordam Library Automation System (CVSS 6.5, Yordam Information Technologies Library Automation System)
- [CVE-2021-45477](https://cve.now/CVE-2021-45477.md): IDOR in Yordam Library Automation System (CVSS 6.5, Yordam Information Technologies Library Automation System)
- [CVE-2023-1151](https://cve.now/CVE-2023-1151.md): SourceCodester Electronic Medical Records System Cookie administrator.php sql injection (CVSS 6.3, SourceCodester Electronic Medical Records System)
- [CVE-2023-26053](https://cve.now/CVE-2023-26053.md): Gradle usage of long IDs for PGP keys opens potential for collision attacks (CVSS 6.6, gradle)
- [CVE-2023-25806](https://cve.now/CVE-2023-25806.md): Time discrepancy in authentication responses in OpenSearch (CVSS 5.3, opensearch-project security · org.opensearch.plugin:opensea…)
- [CVE-2023-25155](https://cve.now/CVE-2023-25155.md): Integer Overflow in several Redis commands can lead to denial of service. (CVSS 5.5, redis)
- [CVE-2023-0228](https://cve.now/CVE-2023-0228.md): Improper authentication vulnerability in S+ Operations (CVSS 8.8, ABB Symphony Plus S+ Operations)
- [CVE-2023-0196](https://cve.now/CVE-2023-0196.md): NVIDIA CUDA Toolkit SDK contains a bug in cuobjdump, where a local user running the tool against an ill-formed binary may cause a null- poi (CVSS 3.3, NVIDIA CUDA Toolkit)
- [CVE-2023-0193](https://cve.now/CVE-2023-0193.md): NVIDIA CUDA Toolkit SDK contains a vulnerability in cuobjdump, where a local user running the tool against a malicious binary may cause an (CVSS 4.4, NVIDIA CUDA Toolkit)
- [CVE-2023-0053](https://cve.now/CVE-2023-0053.md): SAUTER Controls Nova 200–220 Series Cleartext Transmission of Sensitive Information (CVSS 7.5, SAUTER Controls Nova 220 (EYK220F001) DDC with BACnet co… +2)
- [CVE-2023-26046](https://cve.now/CVE-2023-26046.md): teler-waf subject to bypass of common web attack threat rule with HTML entities payload (CVSS 6.5, kitabisa teler-waf · github.com/kitabisa/teler-waf)
- [CVE-2023-22462](https://cve.now/CVE-2023-22462.md): Stored XSS in Grafana Text plugin (CVSS 6.4, grafana · github.com/grafana/grafana)
- [CVE-2022-38734](https://cve.now/CVE-2022-38734.md): StorageGRID (formerly StorageGRID Webscale) versions prior to 11.6.0.8 are susceptible to a Denial of Service (DoS) vulnerability. (no CVSS, Denial of Service Vulnerability in StorageGRID)
- [CVE-2022-46501](https://cve.now/CVE-2022-46501.md): Accruent LLC Maintenance Connection 2021 (all) & 2022.2 was discovered to contain a SQL injection vulnerability via the E-Mail to Work Order (no CVSS)
- [CVE-2023-0656](https://cve.now/CVE-2023-0656.md): A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which (no CVSS, SonicWall SonicOS)
- [CVE-2023-1101](https://cve.now/CVE-2023-1101.md): SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use excessive MFA codes. (CVSS 8.8, SonicWall SonicOS)
- [CVE-2023-1106](https://cve.now/CVE-2023-1106.md): Cross-site Scripting (XSS) - Reflected in flatpressblog/flatpress (CVSS 5.3, flatpressblog/flatpress)
- [CVE-2023-1107](https://cve.now/CVE-2023-1107.md): Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress (CVSS 6.5, flatpressblog/flatpress)
- [CVE-2023-1118](https://cve.now/CVE-2023-1118.md): A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user detaching rc device. (CVSS 7.8, Kernel)
- [CVE-2023-1146](https://cve.now/CVE-2023-1146.md): Cross-site Scripting (XSS) - Generic in flatpressblog/flatpress (CVSS 5.4, flatpressblog/flatpress)
- [CVE-2023-1147](https://cve.now/CVE-2023-1147.md): Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress (CVSS 6.5, flatpressblog/flatpress)
- [CVE-2023-1148](https://cve.now/CVE-2023-1148.md): Cross-site Scripting (XSS) - Stored in flatpressblog/flatpress (CVSS 6.5, flatpressblog/flatpress)
- [CVE-2023-1149](https://cve.now/CVE-2023-1149.md): Improper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver (CVSS 5.7, btcpayserver/btcpayserver)
- [CVE-2023-25358](https://cve.now/CVE-2023-25358.md): A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute code remotely. (CVSS 8.8)
- [CVE-2023-25360](https://cve.now/CVE-2023-25360.md): A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute code remotely. (CVSS 8.8)
- [CVE-2023-25361](https://cve.now/CVE-2023-25361.md): A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to execute code remotely. (CVSS 8.8)
- [CVE-2023-25362](https://cve.now/CVE-2023-25362.md): A use-after-free vulnerability in WebCore::RenderLayer::repaintBlockSelectionGaps in WebKitGTK before 2.36.8 allows attackers to execute cod (no CVSS)
- [CVE-2023-25363](https://cve.now/CVE-2023-25363.md): A use-after-free vulnerability in WebCore::RenderLayer::updateDescendantDependentFlags in WebKitGTK before 2.36.8 allows attackers to execut (no CVSS)
- [CVE-2023-26780](https://cve.now/CVE-2023-26780.md): CleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.