# CVEs published 2023-03-03

55 CVEs were published on March 3, 2023: 8 critical, 16 high. Days are UTC.

- [CVE-2023-26486](https://cve.now/CVE-2023-26486.md): Vega \`scale\` expression function cross site scripting (CVSS 6.5, vega · vega-functions)
- [CVE-2023-26487](https://cve.now/CVE-2023-26487.md): Vega has cross-site scripting vulnerability in \`lassoAppend\` function (CVSS 6.5, vega · vega-functions)
- [CVE-2023-23929](https://cve.now/CVE-2023-23929.md): Refresh tokens do not expire in Vantage6 (CVSS 8.8, vantage6)
- [CVE-2023-26490](https://cve.now/CVE-2023-26490.md): mailcow is vulnerable to shell command injection via xoauth2 authentication in imapsync​ (CVSS 7.3, mailcow-dockerized)
- [CVE-2023-26047](https://cve.now/CVE-2023-26047.md): teler-waf contains detection rule bypass via entities payload (CVSS 6.5, kitabisa teler-waf · github.com/kitabisa/teler-waf)
- [CVE-2023-26491](https://cve.now/CVE-2023-26491.md): RSSHub is vulnerable to cross-site scripting (XSS) via unvalidated URL parameters (CVSS 5.4, DIYgod RSSHub · rsshub)
- [CVE-2023-27290](https://cve.now/CVE-2023-27290.md): IBM Observability with Instana missing authentication (CVSS 9.1, IBM Observability with Instana)
- [CVE-2023-26483](https://cve.now/CVE-2023-26483.md): gosaml2 vulnerable to Denial of Service via deflate decompression bomb (CVSS 5.3, russellhaering gosaml2 · github.com/russellhaering/gosaml2)
- [CVE-2023-23927](https://cve.now/CVE-2023-23927.md): Craft CMS stored cross-site scripting vulnerability (CVSS 6.1, craftcms cms · craftcms/cms)
- [CVE-2023-26492](https://cve.now/CVE-2023-26492.md): Directus vulnerable to Server-Side Request Forgery On File Import (CVSS 5.0, directus)
- [CVE-2023-0968](https://cve.now/CVE-2023-0968.md): Watu Quiz \<= 3.3.9 - Reflected Cross-Site Scripting (CVSS 6.1, prasunsen Watu Quiz)
- [CVE-2023-26488](https://cve.now/CVE-2023-26488.md): OpenZeppelin Contracts contains Incorrect Calculation (CVSS 6.5, openzeppelin-contracts · @openzeppelin/contracts +1)
- [CVE-2023-1165](https://cve.now/CVE-2023-1165.md): Zhong Bang CRMEB Java list sql injection (CVSS 5.5, Zhong Bang CRMEB Java)
- [CVE-2023-0957](https://cve.now/CVE-2023-0957.md): An issue was discovered in Gitpod versions prior to release-2022.11.2.16. (CVSS 8.2, Gitpod)
- [CVE-2023-0578](https://cve.now/CVE-2023-0578.md): Multiple XSS in ASOS Information Technologies' Book Cites (CVSS 6.1, ASOS Information Technologies Book Cites)
- [CVE-2023-1164](https://cve.now/CVE-2023-1164.md): KylinSoft kylin-activation File Import improper authorization (CVSS 8.4, KylinSoft kylin-activation)
- [CVE-2023-0577](https://cve.now/CVE-2023-0577.md): Multiple XSS in ASOS Information Technologies' Sobiad (CVSS 6.1, ASOS Information Technologies SOBIAD)
- [CVE-2023-1163](https://cve.now/CVE-2023-1163.md): DrayTek Vigor 2960 Web Management Interface mainfunction.cgi getSyslogFile path traversal (CVSS 6.5, DrayTek Vigor)
- [CVE-2023-1162](https://cve.now/CVE-2023-1162.md): DrayTek Vigor 2960 Web Management Interface mainfunction.cgi command injection (CVSS 7.2, DrayTek Vigor)
- [CVE-2023-0457](https://cve.now/CVE-2023-0457.md): Information Disclosure Vulnerability in MELSEC Series (CVSS 7.5, Mitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES ·… +109)
- [CVE-2021-36689](https://cve.now/CVE-2021-36689.md): An issue discovered in com.samourai.wallet.PinEntryActivity.java in Streetside Samourai Wallet 0.99.96i allows attackers to view sensitive i (no CVSS)
- [CVE-2022-2835](https://cve.now/CVE-2022-2835.md): A flaw was found in coreDNS. (CVSS 4.4, coreDNS · github.com/coredns/coredns)
- [CVE-2022-2837](https://cve.now/CVE-2022-2837.md): A flaw was found in coreDNS. (CVSS 6.1, coreDNS · github.com/coredns/coredns)
- [CVE-2022-41862](https://cve.now/CVE-2022-41862.md): In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. (CVSS 3.7, postgresql)
- [CVE-2022-45551](https://cve.now/CVE-2022-45551.md): An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command t (CVSS 9.8)
- [CVE-2022-45552](https://cve.now/CVE-2022-45552.md): An Insecure Permissions vulnerability in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to obtain sensitive inf (no CVSS)
- [CVE-2022-45553](https://cve.now/CVE-2022-45553.md): An issue discovered in Shenzhen Zhibotong Electronics WBT WE1626 Router v 21.06.18 allows attacker to execute arbitrary commands via serial (no CVSS)
- [CVE-2022-45988](https://cve.now/CVE-2022-45988.md): starsoftcomm CooCare 5.304 allows local attackers to escalate privileges and execute arbitrary commands via a crafted file upload. (CVSS 7.8)
- [CVE-2022-4645](https://cve.now/CVE-2022-4645.md): LibTIFF 4.4.0 has an out-of-bounds read in tiffcp in tools/tiffcp.c:948, allowing attackers to cause a denial-of-service via a crafted tiff (CVSS 6.8, libtiff)
- [CVE-2022-46973](https://cve.now/CVE-2022-46973.md): Report v0.9.8.6 was discovered to contain a Server-Side Request Forgery (SSRF) vulnerability. (CVSS 9.8)
- [CVE-2022-47664](https://cve.now/CVE-2022-47664.md): Libde265 1.0.9 is vulnerable to Buffer Overflow in ff\_hevc\_put\_hevc\_qpel\_pixels\_8\_sse (CVSS 7.8)
- [CVE-2022-47665](https://cve.now/CVE-2022-47665.md): Libde265 1.0.9 has a heap buffer overflow vulnerability in de265\_image::set\_SliceAddrRS(int, int, int) (CVSS 7.8)
- [CVE-2023-1160](https://cve.now/CVE-2023-1160.md): Use of Platform-Dependent Third Party Components in cockpit-hq/cockpit (CVSS 4.0, cockpit-hq/cockpit)
- [CVE-2023-1170](https://cve.now/CVE-2023-1170.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2023-20061](https://cve.now/CVE-2023-20061.md): Cisco Unified Intelligence Center Vulnerabilities (CVSS 6.5, Cisco Unified Intelligence Center)
- [CVE-2023-20062](https://cve.now/CVE-2023-20062.md): Cisco Unified Intelligence Center Vulnerabilities (CVSS 6.5, Cisco Unified Intelligence Center)
- [CVE-2023-20069](https://cve.now/CVE-2023-20069.md): Cisco Prime Infrastructure and Evolved Programmable Network Manager Stored Cross-Site Scripting Vulnerability (CVSS 5.4, Cisco Prime Infrastructure)
- [CVE-2023-20078](https://cve.now/CVE-2023-20078.md): Cisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI Vulnerabilities (CVSS 9.8, Cisco IP Phones with Multiplatform Firmware)
- [CVE-2023-20079](https://cve.now/CVE-2023-20079.md): Cisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI Vulnerabilities (CVSS 9.8, Cisco IP Phones with Multiplatform Firmware)
- [CVE-2023-20088](https://cve.now/CVE-2023-20088.md): Cisco Finesse Reverse Proxy VPN-less Access to Finesse Desktop Denial of Service Vulnerability (CVSS 5.3, Cisco Unified Contact Center Enterprise)
- [CVE-2023-20104](https://cve.now/CVE-2023-20104.md): Cisco Webex App for Web Cross-Site Scripting Vulnerability (CVSS 6.1, Cisco Webex Teams)
- [CVE-2023-23313](https://cve.now/CVE-2023-23313.md): Certain Draytek products are vulnerable to Cross Site Scripting (XSS) via the wlogin.cgi script and user\_login.cgi script of the router's we (CVSS 6.1)
- [CVE-2023-24641](https://cve.now/CVE-2023-24641.md): Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateview.php. (CVSS 9.8)
- [CVE-2023-24642](https://cve.now/CVE-2023-24642.md): Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateTxtview.php. (CVSS 9.8)
- [CVE-2023-24643](https://cve.now/CVE-2023-24643.md): Judging Management System v1.0 was discovered to contain a SQL injection vulnerability via the sid parameter at /php-jms/updateBlankTxtview. (no CVSS)
- [CVE-2023-25402](https://cve.now/CVE-2023-25402.md): CleverStupidDog yf-exam 1.8.0 is vulnerable to File Upload. (CVSS 7.5)
- [CVE-2023-25403](https://cve.now/CVE-2023-25403.md): CleverStupidDog yf-exam v 1.8.0 is vulnerable to Authentication Bypass. (CVSS 7.5)
- [CVE-2023-26213](https://cve.now/CVE-2023-26213.md): On Barracuda CloudGen WAN Private Edge Gateway devices before 8 webui-sdwan-1089-8.3.1-174141891, an OS command injection vulnerability exis (CVSS 7.2)
- [CVE-2023-26604](https://cve.now/CVE-2023-26604.md): systemd before 247 does not adequately block local privilege escalation for some Sudo configurations, e.g., plausible sudoers files in which (CVSS 7.8)
- [CVE-2023-26779](https://cve.now/CVE-2023-26779.md): CleverStupidDog yf-exam v 1.8.0 is vulnerable to Deserialization which can lead to remote code execution (RCE). (CVSS 9.8)
- [CVE-2023-27560](https://cve.now/CVE-2023-27560.md): Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields. (CVSS 7.5, phpseclib/phpseclib)
- [CVE-2023-27561](https://cve.now/CVE-2023-27561.md): runc through 1.1.4 has Incorrect Access Control leading to Escalation of Privileges, related to libcontainer/rootfs\_linux.go. (CVSS 7.0, github.com/opencontainers/runc)
- [CVE-2023-27566](https://cve.now/CVE-2023-27566.md): Cubism Core in Live2D Cubism Editor 4.2.03 allows out-of-bounds write via a crafted Section Offset Table or Count Info Table in an MOC3 file (no CVSS)
- [CVE-2023-27567](https://cve.now/CVE-2023-27567.md): In OpenBSD 7.2, a TCP packet with destination port 0 that matches a pf divert-to rule can crash the kernel. (no CVSS)
- [CVE-2023-27574](https://cve.now/CVE-2023-27574.md): ShadowsocksX-NG 1.10.0 signs with com.apple.security.get-task-allow entitlements because of CODE\_SIGNING\_INJECT\_BASE\_ENTITLEMENTS. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.