CVEs published March 6, 2023
101 CVEs were published on March 6, 2023: 4 critical, 17 high. 1 is now in CISA KEV.
- Published
- 101
- Critical
- 4
- High
- 17
- Medium
- 35
- Low
- 16
- Unrated
- 29
- Now in CISA KEV
- 1
- Fix available
- 46
Most affected products
- Moodle · moodle/moodle
- 12
- BlogEngine.NET
- 3
- FabulaTech Webcam for Remote Desktop
- 3
- ECshop
- 2
- icplayer
- 2
- kernel
- 2
- M-Files New Web
- 2
- phpipam/phpipam
- 2
- Samba
- 2
- @nestjs/core
- 1
Critical 4
- CVE-2023-0979SQLi in MedDataPACSMedDataPACS
- CVE-2022-4328WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File UploadWooCommerce Checkout Field Manager
- CVE-2023-0839Improper Error Handling in inSCADAProMIS Process inSCADA
- CVE-2022-45141Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assuSamba
High 17
- CVE-2023-27472HTML tags in entity names in the tree view are not sanitised in quickentity-editor-next atampy25 quickentity-editor-next
- CVE-2023-27474HTML Injection in Password Reset email to custom Reset URL in directusdirectus
- CVE-2023-22857Stored cross-site scripting in BlogEngine.NET version 3.3.8.0BlogEngine.NET
- CVE-2023-22856Stored cross-site scripting in BlogEngine.NET version 3.3.8.0BlogEngine.NET
- CVE-2023-26111All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to @nubosoftware/node-static · node-static
- CVE-2023-26106All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file.dot-lens
- CVE-2019-8720A vulnerability was found in WebKit.webkitgtk
- CVE-2021-36395In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service.Moodle · moodle/moodle
- CVE-2021-36396In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a bMoodle · moodle/moodle
- CVE-2022-3424A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru_file_unlocked_ioctl function is called by the kernel
- CVE-2022-45142The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to tSamba
- CVE-2022-4904A flaw was found in the c-ares package.c-ares
- CVE-2023-0093Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowOkta Advanced Server Access
- CVE-2023-1211 SQL Injection in phpipam/phpipamphpipam/phpipam
- CVE-2023-24217AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.
- CVE-2023-24763In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0.
- CVE-2023-24789jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component.org.jeecgframework.boot:jeecg-boot-parent
Medium, low and unrated 80
- CVE-2017-20181hgzojer Vocable Trainer VocableTrainerProvider.java path traversalhgzojer Vocable Trainer
- CVE-2008-10004Email Registration email_registration.module email_registration_user sql injectionEmail Registration
- CVE-2015-10095woo-popup Plugin class-woo-popup-admin.php cross site scriptingwoo-popup Plugin
- CVE-2023-23939Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lowerAzure setup-kubectl
- CVE-2023-26054Credentials inlined to Git URLs could end up in provenance attestation in BuildKitmoby buildkit · github.com/moby/buildkit
- CVE-2023-25169Yearly Review Plugin leaking anonymised users data in discourse-yearly-reviewdiscourse-yearly-review
- CVE-2023-22481Sensitive information exposure in the logs of greader API in FreshRSSFreshRSS
- CVE-2023-1201Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below allows an authenticated attacker that posseDevolutions Server
- CVE-2023-1203Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell ModuDevolutions Remote Desktop Manager PowerShell Module
- CVE-2023-1200ehuacui bbs cross site scriptingehuacui bbs
- CVE-2022-4930nuxsmin sysPass URL cross site scriptingnuxsmin sysPass
- CVE-2015-10094Fastly Plugin api.php post cross site scriptingFastly Plugin
- CVE-2023-0069WPaudio MP3 Player <= 4.0.2 - Contributor+ Stored XSSWPaudio MP3 Player
- CVE-2023-0065i2 Pros & Cons <= 1.3.1 - Contributor+ Stored XSSi2 Pros & Cons
- CVE-2023-0064eVision Responsive Column Layout Shortcodes <= 2.3 - Contributor+ Stored XSSeVision Responsive Column Layout Shortcodes
- CVE-2023-0377Scriptless Social Sharing < 3.2.2 - Contributor+ Stored XSSScriptless Social Sharing
- CVE-2023-0212Advanced Recent Posts <= 0.6.14 - Contributor+ Stored XSSAdvanced Recent Posts
- CVE-2023-0068Product GTIN (EAN, UPC, ISBN) for WooCommerce <= 1.1.1 - Contributor+ Stored XSSProduct GTIN (EAN, UPC, ISBN) for WooCommerce
- CVE-2023-0063Synved Shortcodes <= 1.6.36 - Contributor+ Stored XSSWordPress Shortcodes
- CVE-2023-0078Resume Builder <= 3.1.1 - Subscriber+ Stored XSSResume Builder
- CVE-2023-0165Cost Calculator <= 1.8 - Contributor+ Stored XSSCost Calculator
- CVE-2022-4265Replyable < 2.2.10 - Subscriber+ PHP Object InjectionReplyable
- CVE-2023-0328WPCode < 2.0.7 - Contributor+ WPCode Library Auth Key Update/DeletionWPCode
- CVE-2023-0076Download Attachments < 1.3 - Contributor+ Stored XSSDownload Attachments
- CVE-2022-2178XSS in Saysis' StarcitiesSaysis Starcities
- CVE-2022-4862XSS vulnerability in M-Files WebM-Files New Web
- CVE-2022-3284Insecure way of passing a download keyM-Files New Web
- CVE-2017-20180Zerocoin libzerocoin Proof CoinSpend.cpp CoinSpend data authenticitylibzerocoin
- CVE-2023-1191fastcms ZIP File TemplateController.java path traversalfastcms
- CVE-2023-1190xiaozhuai imageinfo imageinfo.hpp buffer overflowxiaozhuai imageinfo
- CVE-2023-1189WiseCleaner Wise Folder Hider IoControlCode WiseFs64.sys 0x222410 denial of serviceWiseCleaner Wise Folder Hider
- CVE-2023-1188FabulaTech Webcam for Remote Desktop IoControlCode ftwebcam.sys 0x222018 denial of serviceFabulaTech Webcam for Remote Desktop
- CVE-2023-1187FabulaTech Webcam for Remote Desktop Global Variable ftwebcam.sys denial of serviceFabulaTech Webcam for Remote Desktop
- CVE-2023-1186FabulaTech Webcam for Remote Desktop IOCTL ftwebcam.sys 0x222018 null pointer dereferenceFabulaTech Webcam for Remote Desktop
- CVE-2023-1185ECshop New Product unrestricted uploadECshop
- CVE-2023-1184ECshop Backup Database database.php unrestricted uploadECshop
- CVE-2023-22858Stored cross-site scripting in BlogEngine.NET version 3.3.8.0BlogEngine.NET
- CVE-2015-10093Mark User as Spammer Plugin plugin.php user_row_actions cross site scriptingMark User as Spammer Plugin
- CVE-2015-10092Qtranslate Slug Plugin class-qtranslate-slug.php add_slug_meta_box cross site scriptingQtranslate Slug Plugin
- CVE-2023-26108Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe.@nestjs/core
- CVE-2023-26107All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametrisketchsvg
- CVE-2015-10091ByWater Solutions bywater-koha-xslt systempreferences.pl StringSearch sql injectionByWater Solutions bywater-koha-xslt
- CVE-2022-4929icplayer tts-utils.js cross site scriptingicplayer
- CVE-2022-4928icplayer presenter.js AddonText_Selection_create cross site scriptingicplayer
- CVE-2021-20251A flaw was found in samba.samba
- CVE-2021-35377Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidia
- CVE-2021-36392In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses.Moodle · moodle/moodle
- CVE-2021-36393In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.Moodle · moodle/moodle
- CVE-2021-36394In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.Moodle · moodle/moodle
- CVE-2021-36397In Moodle, insufficient capability checks meant message deletions were not limited to the current user.Moodle · moodle/moodle
- CVE-2021-36398In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk.Moodle · moodle/moodle
- CVE-2021-36399In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk.Moodle · moodle/moodle
- CVE-2021-36400In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions.Moodle · moodle/moodle
- CVE-2021-36401In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk.Moodle · moodle/moodle
- CVE-2021-36402In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk.Moodle · moodle/moodle
- CVE-2021-36403In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which mayMoodle · moodle/moodle
- CVE-2021-36713Cross Site Scripting (XSS) vulnerability in the DataTables plug-in 1.9.2 for jQuery allows attackers to run arbitrary code via the sBaseName
- CVE-2022-3277An uncontrolled resource consumption flaw was found in openstack-neutron.openstack-neutron · neutron
- CVE-2022-3707A double-free memory flaw was found in the Linux kernel.kernel
- CVE-2022-3854A flaw was found in Ceph, relating to the URL processing on RGW backends.ceph
- CVE-2022-4134A flaw was found in openstack-glance.openstack · glance
- CVE-2022-42248QlikView 12.60.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the QvsViewClient functionality.
- CVE-2022-44875KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SY
- CVE-2022-46395An issue was discovered in the Arm Mali GPU Kernel Driver.
- CVE-2022-48364The undo_mark_statuses_as_sensitive method in app/services/approve_appeal_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server'
- CVE-2023-0330Qemu: lsi53c895a: dma reentrancy issue leads to stack overflowqemu
- CVE-2023-1161ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or craWireshark Foundation Wireshark
- CVE-2023-1197Cross-site Scripting (XSS) - Stored in uvdesk/community-skeletonuvdesk/community-skeleton
- CVE-2023-1212Cross-site Scripting (XSS) - Stored in phpipam/phpipamphpipam/phpipam
- CVE-2023-24733PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z
- CVE-2023-24734An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a cra
- CVE-2023-24735PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac_css/pmb.php.
- CVE-2023-24736PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure_act.php.
- CVE-2023-24737PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export_z
- CVE-2023-24776Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \controller\Addon.php.funadmin/funadmin
- CVE-2023-25304An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack file.
- CVE-2023-26600ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer throu
- CVE-2023-26601Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus be
- CVE-2023-26949An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary co
- CVE-2023-27891rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session.pretix