CVEs published March 3, 2023
55 CVEs were published on March 3, 2023: 8 critical, 16 high.
- Published
- 55
- Critical
- 8
- High
- 16
- Medium
- 23
- Low
- 1
- Unrated
- 7
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- Cisco IP Phones with Multiplatform Firmware
- 2
- Cisco Unified Intelligence Center
- 2
- coreDNS · github.com/coredns/coredns
- 2
- DrayTek Vigor
- 2
- vega · vega-functions
- 2
- ASOS Information Technologies Book Cites
- 1
- ASOS Information Technologies SOBIAD
- 1
- Cisco Prime Infrastructure
- 1
- Cisco Unified Contact Center Enterprise
- 1
- Cisco Webex Teams
- 1
Critical 8
- CVE-2023-27290IBM Observability with Instana missing authenticationIBM Observability with Instana
- CVE-2022-45551An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command t
- CVE-2022-46973Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability.
- CVE-2023-20078Cisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI VulnerabilitiesCisco IP Phones with Multiplatform Firmware
- CVE-2023-20079Cisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI VulnerabilitiesCisco IP Phones with Multiplatform Firmware
- CVE-2023-24641Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateview.php.
- CVE-2023-24642Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateTxtview.php.
- CVE-2023-26779CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE).
High 16
- CVE-2023-23929Refresh tokens do not expire in Vantage6vantage6
- CVE-2023-26490mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsyncmailcow-dockerized
- CVE-2023-0957An issue was discovered in Gitpod versions prior to release-2022.11.2.16.Gitpod
- CVE-2023-1164KylinSoft kylin-activation File Import improper authorizationKylinSoft kylin-activation
- CVE-2023-1162DrayTek Vigor 2960 Web Management Interface mainfunction.cgi command injectionDrayTek Vigor
- CVE-2023-0457Information Disclosure Vulnerability in MELSEC SeriesMitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES ·… +109
- CVE-2022-45988starsoftcomm CooCare 5.304 allows local attackers to escalate privileges and execute arbitrary commands via a crafted file upload.
- CVE-2022-47664Libde265 1.0.9 is vulnerable to Buffer Overflow in ff_hevc_put_hevc_qpel_pixels_8_sse
- CVE-2022-47665Libde265 1.0.9 has a heap buffer overflow vulnerability in de265_image::set_SliceAddrRS(int, int, int)
- CVE-2023-1170Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2023-25402CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload.
- CVE-2023-25403CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass.
- CVE-2023-26213On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exis
- CVE-2023-26604systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which
- CVE-2023-27560Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields.phpseclib/phpseclib
- CVE-2023-27561runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs_linux.go.github.com/opencontainers/runc
Medium, low and unrated 31
- CVE-2023-26486Vega `scale` expression function cross site scriptingvega · vega-functions
- CVE-2023-26487Vega has cross-site scripting vulnerability in `lassoAppend` functionvega · vega-functions
- CVE-2023-26047teler-waf contains detection rule bypass via entities payloadkitabisa teler-waf · github.com/kitabisa/teler-waf
- CVE-2023-26491RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parametersDIYgod RSSHub · rsshub
- CVE-2023-26483gosaml2 vulnerable to Denial of Service via deflate decompression bombrussellhaering gosaml2 · github.com/russellhaering/gosaml2
- CVE-2023-23927Craft CMS stored cross-site scripting vulnerabilitycraftcms cms · craftcms/cms
- CVE-2023-26492Directus vulnerable to Server-Side Request Forgery On File Importdirectus
- CVE-2023-0968Watu Quiz <= 3.3.9 - Reflected Cross-Site Scriptingprasunsen Watu Quiz
- CVE-2023-26488OpenZeppelin Contracts contains Incorrect Calculationopenzeppelin-contracts · @openzeppelin/contracts +1
- CVE-2023-1165Zhong Bang CRMEB Java list sql injectionZhong Bang CRMEB Java
- CVE-2023-0578Multiple XSS in ASOS Information Technologies' Book CitesASOS Information Technologies Book Cites
- CVE-2023-0577Multiple XSS in ASOS Information Technologies' SobiadASOS Information Technologies SOBIAD
- CVE-2023-1163DrayTek Vigor 2960 Web Management Interface mainfunction.cgi getSyslogFile path traversalDrayTek Vigor
- CVE-2021-36689An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive i
- CVE-2022-2835A flaw was found in coreDNS.coreDNS · github.com/coredns/coredns
- CVE-2022-2837A flaw was found in coreDNS.coreDNS · github.com/coredns/coredns
- CVE-2022-41862In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption.postgresql
- CVE-2022-45552An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive inf
- CVE-2022-45553An issue discovered in Shenzhen Zhibotong Electronics WBT WE1626 Router v 21.06.18 allows attacker to execute arbitrary commands via serial
- CVE-2022-4645LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff libtiff
- CVE-2023-1160Use of Platform-Dependent Third Party Components in cockpit-hq/cockpitcockpit-hq/cockpit
- CVE-2023-20061Cisco Unified Intelligence Center VulnerabilitiesCisco Unified Intelligence Center
- CVE-2023-20062Cisco Unified Intelligence Center VulnerabilitiesCisco Unified Intelligence Center
- CVE-2023-20069Cisco Prime Infrastructure and Evolved Programmable Network Manager Stored Cross-Site Scripting VulnerabilityCisco Prime Infrastructure
- CVE-2023-20088Cisco Finesse Reverse Proxy VPN-less Access to Finesse Desktop Denial of Service VulnerabilityCisco Unified Contact Center Enterprise
- CVE-2023-20104Cisco Webex App for Web Cross-Site Scripting VulnerabilityCisco Webex Teams
- CVE-2023-23313Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user_login.cgi script of the router's we
- CVE-2023-24643Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateBlankTxtview.
- CVE-2023-27566Cubism Core in Live2D Cubism Editor 4.2.03 allows out-of-bounds write via a crafted Section Offset Table or Count Info Table in an MOC3 file
- CVE-2023-27567In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel.
- CVE-2023-27574ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-task-allow entitlements because of CODE_SIGNING_INJECT_BASE_ENTITLEMENTS.