# CVEs published 2023-03-06

101 CVEs were published on March 6, 2023: 4 critical, 17 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2017-20181](https://cve.now/CVE-2017-20181.md): hgzojer Vocable Trainer VocableTrainerProvider.java path traversal (CVSS 5.3, hgzojer Vocable Trainer)
- [CVE-2008-10004](https://cve.now/CVE-2008-10004.md): Email Registration email\_registration.module email\_registration\_user sql injection (CVSS 6.3, Email Registration)
- [CVE-2015-10095](https://cve.now/CVE-2015-10095.md): woo-popup Plugin class-woo-popup-admin.php cross site scripting (CVSS 3.5, woo-popup Plugin)
- [CVE-2023-23939](https://cve.now/CVE-2023-23939.md): Azure/setup-kubectl: Escalation of privilege vulnerability for v3 and lower (CVSS 3.9, Azure setup-kubectl)
- [CVE-2023-27472](https://cve.now/CVE-2023-27472.md): HTML tags in entity names in the tree view are not sanitised in quickentity-editor-next (CVSS 8.2, atampy25 quickentity-editor-next)
- [CVE-2023-26054](https://cve.now/CVE-2023-26054.md): Credentials inlined to Git URLs could end up in provenance attestation in BuildKit (CVSS 6.5, moby buildkit · github.com/moby/buildkit)
- [CVE-2023-25169](https://cve.now/CVE-2023-25169.md): Yearly Review Plugin leaking anonymised users data in discourse-yearly-review (CVSS 3.1, discourse-yearly-review)
- [CVE-2023-22481](https://cve.now/CVE-2023-22481.md): Sensitive information exposure in the logs of greader API in FreshRSS (CVSS 4.0, FreshRSS)
- [CVE-2023-1201](https://cve.now/CVE-2023-1201.md): Improper access control in the secure messages feature in Devolutions Server 2022.3.12 and below allows an authenticated attacker that posse (no CVSS, Devolutions Server)
- [CVE-2023-27474](https://cve.now/CVE-2023-27474.md): HTML Injection in Password Reset email to custom Reset URL in directus (CVSS 8.0, directus)
- [CVE-2023-1203](https://cve.now/CVE-2023-1203.md): Improper removal of sensitive data in the entry edit feature of Hub Business submodule in Devolutions Remote Desktop Manager PowerShell Modu (no CVSS, Devolutions Remote Desktop Manager PowerShell Module)
- [CVE-2023-1200](https://cve.now/CVE-2023-1200.md): ehuacui bbs cross site scripting (CVSS 3.5, ehuacui bbs)
- [CVE-2022-4930](https://cve.now/CVE-2022-4930.md): nuxsmin sysPass URL cross site scripting (CVSS 3.5, nuxsmin sysPass)
- [CVE-2015-10094](https://cve.now/CVE-2015-10094.md): Fastly Plugin api.php post cross site scripting (CVSS 2.4, Fastly Plugin)
- [CVE-2023-0979](https://cve.now/CVE-2023-0979.md): SQLi in MedDataPACS (CVSS 9.8, MedDataPACS)
- [CVE-2023-0069](https://cve.now/CVE-2023-0069.md): WPaudio MP3 Player \<= 4.0.2 - Contributor+ Stored XSS (CVSS 5.4, WPaudio MP3 Player)
- [CVE-2023-0065](https://cve.now/CVE-2023-0065.md): i2 Pros & Cons \<= 1.3.1 - Contributor+ Stored XSS (no CVSS, i2 Pros & Cons)
- [CVE-2023-0064](https://cve.now/CVE-2023-0064.md): eVision Responsive Column Layout Shortcodes \<= 2.3 - Contributor+ Stored XSS (no CVSS, eVision Responsive Column Layout Shortcodes)
- [CVE-2023-0377](https://cve.now/CVE-2023-0377.md): Scriptless Social Sharing \< 3.2.2 - Contributor+ Stored XSS (no CVSS, Scriptless Social Sharing)
- [CVE-2022-4328](https://cve.now/CVE-2022-4328.md): WooCommerce Checkout Field Manager \< 18.0 - Unauthenticated Arbitrary File Upload (CVSS 9.8, WooCommerce Checkout Field Manager)
- [CVE-2023-0212](https://cve.now/CVE-2023-0212.md): Advanced Recent Posts \<= 0.6.14 - Contributor+ Stored XSS (no CVSS, Advanced Recent Posts)
- [CVE-2023-0068](https://cve.now/CVE-2023-0068.md): Product GTIN (EAN, UPC, ISBN) for WooCommerce \<= 1.1.1 - Contributor+ Stored XSS (no CVSS, Product GTIN (EAN, UPC, ISBN) for WooCommerce)
- [CVE-2023-0063](https://cve.now/CVE-2023-0063.md): Synved Shortcodes \<= 1.6.36 - Contributor+ Stored XSS (no CVSS, WordPress Shortcodes)
- [CVE-2023-0078](https://cve.now/CVE-2023-0078.md): Resume Builder \<= 3.1.1 - Subscriber+ Stored XSS (CVSS 5.4, Resume Builder)
- [CVE-2023-0165](https://cve.now/CVE-2023-0165.md): Cost Calculator \<= 1.8 - Contributor+ Stored XSS (no CVSS, Cost Calculator)
- [CVE-2022-4265](https://cve.now/CVE-2022-4265.md): Replyable \< 2.2.10 - Subscriber+ PHP Object Injection (no CVSS, Replyable)
- [CVE-2023-0328](https://cve.now/CVE-2023-0328.md): WPCode \< 2.0.7 - Contributor+ WPCode Library Auth Key Update/Deletion (no CVSS, WPCode)
- [CVE-2023-0076](https://cve.now/CVE-2023-0076.md): Download Attachments \< 1.3 - Contributor+ Stored XSS (no CVSS, Download Attachments)
- [CVE-2022-2178](https://cve.now/CVE-2022-2178.md): XSS in Saysis' Starcities (CVSS 6.1, Saysis Starcities)
- [CVE-2022-4862](https://cve.now/CVE-2022-4862.md): XSS vulnerability in M-Files Web (CVSS 5.0, M-Files New Web)
- [CVE-2022-3284](https://cve.now/CVE-2022-3284.md): Insecure way of passing a download key (CVSS 6.5, M-Files New Web)
- [CVE-2017-20180](https://cve.now/CVE-2017-20180.md): Zerocoin libzerocoin Proof CoinSpend.cpp CoinSpend data authenticity (CVSS 4.6, libzerocoin)
- [CVE-2023-1191](https://cve.now/CVE-2023-1191.md): fastcms ZIP File TemplateController.java path traversal (CVSS 4.7, fastcms)
- [CVE-2023-1190](https://cve.now/CVE-2023-1190.md): xiaozhuai imageinfo imageinfo.hpp buffer overflow (CVSS 4.8, xiaozhuai imageinfo)
- [CVE-2023-1189](https://cve.now/CVE-2023-1189.md): WiseCleaner Wise Folder Hider IoControlCode WiseFs64.sys 0x222410 denial of service (CVSS 3.3, WiseCleaner Wise Folder Hider)
- [CVE-2023-1188](https://cve.now/CVE-2023-1188.md): FabulaTech Webcam for Remote Desktop IoControlCode ftwebcam.sys 0x222018 denial of service (CVSS 3.3, FabulaTech Webcam for Remote Desktop)
- [CVE-2023-1187](https://cve.now/CVE-2023-1187.md): FabulaTech Webcam for Remote Desktop Global Variable ftwebcam.sys denial of service (CVSS 3.3, FabulaTech Webcam for Remote Desktop)
- [CVE-2023-1186](https://cve.now/CVE-2023-1186.md): FabulaTech Webcam for Remote Desktop IOCTL ftwebcam.sys 0x222018 null pointer dereference (CVSS 3.3, FabulaTech Webcam for Remote Desktop)
- [CVE-2023-0839](https://cve.now/CVE-2023-0839.md): Improper Error Handling in inSCADA (CVSS 9.8, ProMIS Process inSCADA)
- [CVE-2023-1185](https://cve.now/CVE-2023-1185.md): ECshop New Product unrestricted upload (CVSS 4.7, ECshop)
- [CVE-2023-1184](https://cve.now/CVE-2023-1184.md): ECshop Backup Database database.php unrestricted upload (CVSS 4.7, ECshop)
- [CVE-2023-22858](https://cve.now/CVE-2023-22858.md): Stored cross-site scripting in BlogEngine.NET version 3.3.8.0 (CVSS 5.3, BlogEngine.NET)
- [CVE-2015-10093](https://cve.now/CVE-2015-10093.md): Mark User as Spammer Plugin plugin.php user\_row\_actions cross site scripting (CVSS 2.6, Mark User as Spammer Plugin)
- [CVE-2023-22857](https://cve.now/CVE-2023-22857.md): Stored cross-site scripting in BlogEngine.NET version 3.3.8.0 (CVSS 8.5, BlogEngine.NET)
- [CVE-2023-22856](https://cve.now/CVE-2023-22856.md): Stored cross-site scripting in BlogEngine.NET version 3.3.8.0 (CVSS 8.5, BlogEngine.NET)
- [CVE-2015-10092](https://cve.now/CVE-2015-10092.md): Qtranslate Slug Plugin class-qtranslate-slug.php add\_slug\_meta\_box cross site scripting (CVSS 3.5, Qtranslate Slug Plugin)
- [CVE-2023-26108](https://cve.now/CVE-2023-26108.md): Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. (CVSS 3.7, @nestjs/core)
- [CVE-2023-26107](https://cve.now/CVE-2023-26107.md): All versions of the package sketchsvg are vulnerable to Arbitrary Code Injection when invoking shell.exec without sanitization nor parametri (CVSS 6.9, sketchsvg)
- [CVE-2023-26111](https://cve.now/CVE-2023-26111.md): All versions of the package @nubosoftware/node-static; all versions of the package node-static are vulnerable to Directory Traversal due to (CVSS 7.5, @nubosoftware/node-static · node-static)
- [CVE-2023-26106](https://cve.now/CVE-2023-26106.md): All versions of the package dot-lens are vulnerable to Prototype Pollution via the set() function in index.js file. (CVSS 7.5, dot-lens)
- [CVE-2015-10091](https://cve.now/CVE-2015-10091.md): ByWater Solutions bywater-koha-xslt systempreferences.pl StringSearch sql injection (CVSS 4.7, ByWater Solutions bywater-koha-xslt)
- [CVE-2022-4929](https://cve.now/CVE-2022-4929.md): icplayer tts-utils.js cross site scripting (CVSS 3.5, icplayer)
- [CVE-2022-4928](https://cve.now/CVE-2022-4928.md): icplayer presenter.js AddonText\_Selection\_create cross site scripting (CVSS 3.5, icplayer)
- [CVE-2019-8720](https://cve.now/CVE-2019-8720.md): A vulnerability was found in WebKit. (CVSS 8.8, KEV, webkitgtk)
- [CVE-2021-20251](https://cve.now/CVE-2021-20251.md): A flaw was found in samba. (no CVSS, samba)
- [CVE-2021-35377](https://cve.now/CVE-2021-35377.md): Cross Site Scripting vulnerability found in VICIdial v2.14-610c and v.2.10-415c allows attackers execute arbitrary code via the /agc/vicidia (no CVSS)
- [CVE-2021-36392](https://cve.now/CVE-2021-36392.md): In Moodle, an SQL injection risk was identified in the library fetching a user's enrolled courses. (no CVSS, Moodle · moodle/moodle)
- [CVE-2021-36393](https://cve.now/CVE-2021-36393.md): In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. (no CVSS, Moodle · moodle/moodle)
- [CVE-2021-36394](https://cve.now/CVE-2021-36394.md): In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin. (no CVSS, Moodle · moodle/moodle)
- [CVE-2021-36395](https://cve.now/CVE-2021-36395.md): In Moodle, the file repository's URL parsing required additional recursion handling to mitigate the risk of recursion denial of service. (CVSS 7.5, Moodle · moodle/moodle)
- [CVE-2021-36396](https://cve.now/CVE-2021-36396.md): In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a b (CVSS 7.5, Moodle · moodle/moodle)
- [CVE-2021-36397](https://cve.now/CVE-2021-36397.md): In Moodle, insufficient capability checks meant message deletions were not limited to the current user. (CVSS 5.3, Moodle · moodle/moodle)
- [CVE-2021-36398](https://cve.now/CVE-2021-36398.md): In moodle, ID numbers displayed in the web service token list required additional sanitizing to prevent a stored XSS risk. (CVSS 5.4, Moodle · moodle/moodle)
- [CVE-2021-36399](https://cve.now/CVE-2021-36399.md): In Moodle, ID numbers displayed in the quiz override screens required additional sanitizing to prevent a stored XSS risk. (CVSS 5.4, Moodle · moodle/moodle)
- [CVE-2021-36400](https://cve.now/CVE-2021-36400.md): In Moodle, insufficient capability checks made it possible to remove other users' calendar URL subscriptions. (CVSS 5.3, Moodle · moodle/moodle)
- [CVE-2021-36401](https://cve.now/CVE-2021-36401.md): In Moodle, ID numbers exported in HTML data formats required additional sanitizing to prevent a local stored XSS risk. (CVSS 4.8, Moodle · moodle/moodle)
- [CVE-2021-36402](https://cve.now/CVE-2021-36402.md): In Moodle, Users' names required additional sanitizing in the account confirmation email, to prevent a self-registration phishing risk. (CVSS 5.3, Moodle · moodle/moodle)
- [CVE-2021-36403](https://cve.now/CVE-2021-36403.md): In Moodle, in some circumstances, email notifications of messages could have the link back to the original message hidden by HTML, which may (CVSS 5.3, Moodle · moodle/moodle)
- [CVE-2021-36713](https://cve.now/CVE-2021-36713.md): Cross Site Scripting (XSS) vulnerability in the DataTables plug-in 1.9.2 for jQuery allows attackers to run arbitrary code via the sBaseName (CVSS 6.1)
- [CVE-2022-3277](https://cve.now/CVE-2022-3277.md): An uncontrolled resource consumption flaw was found in openstack-neutron. (CVSS 6.5, openstack-neutron · neutron)
- [CVE-2022-3424](https://cve.now/CVE-2022-3424.md): A use-after-free flaw was found in the Linux kernel’s SGI GRU driver in the way the first gru\_file\_unlocked\_ioctl function is called by the (CVSS 7.8, kernel)
- [CVE-2022-3707](https://cve.now/CVE-2022-3707.md): A double-free memory flaw was found in the Linux kernel. (CVSS 5.5, kernel)
- [CVE-2022-3854](https://cve.now/CVE-2022-3854.md): A flaw was found in Ceph, relating to the URL processing on RGW backends. (CVSS 6.5, ceph)
- [CVE-2022-4134](https://cve.now/CVE-2022-4134.md): A flaw was found in openstack-glance. (CVSS 2.8, openstack · glance)
- [CVE-2022-42248](https://cve.now/CVE-2022-42248.md): QlikView 12.60.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the QvsViewClient functionality. (CVSS 5.4)
- [CVE-2022-44875](https://cve.now/CVE-2022-44875.md): KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SY (CVSS 5.4)
- [CVE-2022-45141](https://cve.now/CVE-2022-45141.md): Since the Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability was disclosed by Microsoft on Nov 8 2022 and per RFC8429 it is assu (CVSS 9.8, Samba)
- [CVE-2022-45142](https://cve.now/CVE-2022-45142.md): The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to t (CVSS 7.5, Samba)
- [CVE-2022-46395](https://cve.now/CVE-2022-46395.md): An issue was discovered in the Arm Mali GPU Kernel Driver. (no CVSS)
- [CVE-2022-48364](https://cve.now/CVE-2022-48364.md): The undo\_mark\_statuses\_as\_sensitive method in app/services/approve\_appeal\_service.rb in Mastodon 3.5.x before 3.5.3 does not use the server' (CVSS 4.3)
- [CVE-2022-4904](https://cve.now/CVE-2022-4904.md): A flaw was found in the c-ares package. (CVSS 8.6, c-ares)
- [CVE-2023-0093](https://cve.now/CVE-2023-0093.md): Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrow (CVSS 8.8, Okta Advanced Server Access)
- [CVE-2023-0330](https://cve.now/CVE-2023-0330.md): Qemu: lsi53c895a: dma reentrancy issue leads to stack overflow (CVSS 5.3, qemu)
- [CVE-2023-1161](https://cve.now/CVE-2023-1161.md): ISO 15765 and ISO 10681 dissector crash in Wireshark 4.0.0 to 4.0.3 and 3.6.0 to 3.6.11 allows denial of service via packet injection or cra (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-1197](https://cve.now/CVE-2023-1197.md): Cross-site Scripting (XSS) - Stored in uvdesk/community-skeleton (CVSS 4.3, uvdesk/community-skeleton)
- [CVE-2023-1211](https://cve.now/CVE-2023-1211.md): SQL Injection in phpipam/phpipam (CVSS 7.2, phpipam/phpipam)
- [CVE-2023-1212](https://cve.now/CVE-2023-1212.md): Cross-site Scripting (XSS) - Stored in phpipam/phpipam (CVSS 5.9, phpipam/phpipam)
- [CVE-2023-24217](https://cve.now/CVE-2023-24217.md): AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability. (CVSS 8.8)
- [CVE-2023-24733](https://cve.now/CVE-2023-24733.md): PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export\_z (no CVSS)
- [CVE-2023-24734](https://cve.now/CVE-2023-24734.md): An arbitrary file upload vulnerability in the camera\_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a cra (no CVSS)
- [CVE-2023-24735](https://cve.now/CVE-2023-24735.md): PMB v7.4.6 was discovered to contain an open redirect vulnerability via the component /opac\_css/pmb.php. (no CVSS)
- [CVE-2023-24736](https://cve.now/CVE-2023-24736.md): PMB v7.4.6 was discovered to contain a remote code execution (RCE) vulnerability via the component /sauvegarde/restaure\_act.php. (no CVSS)
- [CVE-2023-24737](https://cve.now/CVE-2023-24737.md): PMB v7.4.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the query parameter at /admin/convert/export\_z (no CVSS)
- [CVE-2023-24763](https://cve.now/CVE-2023-24763.md): In the module "Xen Forum" (xenforum) for PrestaShop, an authenticated user can perform SQL injection in versions up to 2.13.0. (CVSS 8.8)
- [CVE-2023-24776](https://cve.now/CVE-2023-24776.md): Funadmin v3.2.0 was discovered to contain a remote code execution (RCE) vulnerability via the component \\controller\\Addon.php. (no CVSS, funadmin/funadmin)
- [CVE-2023-24789](https://cve.now/CVE-2023-24789.md): jeecg-boot v3.4.4 was discovered to contain an authenticated SQL injection vulnerability via the building block report component. (CVSS 8.8, org.jeecgframework.boot:jeecg-boot-parent)
- [CVE-2023-25304](https://cve.now/CVE-2023-25304.md): An issue in Prism Launcher up to v6.1 allows attackers to perform a directory traversal via importing a crafted .mrpack file. (no CVSS)
- [CVE-2023-26600](https://cve.now/CVE-2023-26600.md): ManageEngine ServiceDesk Plus through 14104, ServiceDesk Plus MSP through 14000, Support Center Plus through 14000, and Asset Explorer throu (no CVSS)
- [CVE-2023-26601](https://cve.now/CVE-2023-26601.md): Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus be (no CVSS)
- [CVE-2023-26949](https://cve.now/CVE-2023-26949.md): An arbitrary file upload vulnerability in the component /admin1/config/update of onekeyadmin v1.3.9 allows attackers to execute arbitrary co (no CVSS)
- [CVE-2023-27891](https://cve.now/CVE-2023-27891.md): rami.io pretix before 4.17.1 allows OAuth application authorization from a logged-out session. (no CVSS, pretix)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.