CVEs published March 5, 2023
26 CVEs were published on March 5, 2023: 0 critical, 3 high.
- Published
- 26
- Critical
- 0
- High
- 3
- Medium
- 7
- Low
- 7
- Unrated
- 9
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- DOS Co. SS1 and Rakuraku PC Cloud
- 3
- JTEKT ELECTRONICS Kostac PLC Programming Software
- 3
- EC-CUBE CO. EC-CUBE 4 series
- 2
- ayttm
- 1
- cfire24 ajaxlife
- 1
- EC-CUBE CO. EC-CUBE 4 series, EC-CUBE 3 series, and EC-CUBE…
- 1
- flame.js
- 1
- icret/easyimages2.0
- 1
- iGamingModules flashgames
- 1
- json-logic-js
- 1
High 3
- CVE-2023-0734Improper Authorization in wallabag/wallabagwallabag/wallabag
- CVE-2023-22421Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and JTEKT ELECTRONICS Kostac PLC Programming Software
- CVE-2023-22424Use-after-free vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and earlJTEKT ELECTRONICS Kostac PLC Programming Software
Medium, low and unrated 23
- CVE-2015-10090Landing Pages Plugin cross site scriptingLanding Pages Plugin
- CVE-2014-125092MaxButtons Plugin maxbuttons-button.php maxbuttons_strip_px cross site scriptingMaxButtons Plugin
- CVE-2006-10001Subscribe to Comments Plugin subscribe-to-comments.php cross site scriptingSubscribe to Comments Plugin
- CVE-2022-4927ualbertalib NEOSDiscovery _refworks.html.erb reverse tabnabbingualbertalib NEOSDiscovery
- CVE-2021-4329json-logic-js logic.js command injectionjson-logic-js
- CVE-2015-10089flame.js cross site scriptingflame.js
- CVE-2023-1180SourceCodester Health Center Patient Record Management System hematology_print.php cross site scriptingSourceCodester Health Center Patient Record Management Syst…
- CVE-2023-1179SourceCodester Computer Parts Sales and Inventory System Add Supplier cross site scriptingSourceCodester Computer Parts Sales and Inventory System
- CVE-2015-10088ayttm proxy.c http_connect format stringayttm
- CVE-2008-10003iGamingModules flashgames game.php sql injectioniGamingModules flashgames
- CVE-2008-10002cfire24 ajaxlife cross site scriptingcfire24 ajaxlife
- CVE-2023-1181Cross-site Scripting (XSS) - Stored in icret/easyimages2.0icret/easyimages2.0
- CVE-2023-22335Improper access control vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attDOS Co. SS1 and Rakuraku PC Cloud
- CVE-2023-22336Path traversal vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remote attacker to DOS Co. SS1 and Rakuraku PC Cloud
- CVE-2023-22344Use of hard-coded credentials vulnerability in SS1 Ver.13.0.0.40 and earlier and Rakuraku PC Cloud Agent Ver.2.1.8 and earlier allows a remoDOS Co. SS1 and Rakuraku PC Cloud
- CVE-2023-22419Out-of-bounds read vulnerability exists in Kostac PLC Programming Software (Former name: Koyo PLC Programming Software) Version 1.6.9.0 and JTEKT ELECTRONICS Kostac PLC Programming Software
- CVE-2023-22432Open redirect vulnerability exists in web2py versions prior to 2.23.1.web2py
- CVE-2023-22438Cross-site scripting vulnerability in Contents Management of EC-CUBE 4 series (EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-EC-CUBE CO. EC-CUBE 4 series, EC-CUBE 3 series, and EC-CUBE…
- CVE-2023-22838Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1,EC-CUBE CO. EC-CUBE 4 series
- CVE-2023-25077Cross-site scripting vulnerability in Authentication Key Settings of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1, and EC-CUBE 4.2.0EC-CUBE CO. EC-CUBE 4 series
- CVE-2023-26510Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security p
- CVE-2023-27635debmany in debian-goodies 0.88.1 allows attackers to execute arbitrary shell commands (because of an eval call) via a crafted .deb file.
- CVE-2023-27641The REPORT (after z but before a) parameter in wa.exe in L-Soft LISTSERV 16.5 before 17 allows an attacker to conduct XSS attacks via a craf