# CVEs published 2023-03-07

169 CVEs were published on March 7, 2023: 10 critical, 54 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-27476](https://cve.now/CVE-2023-27476.md): XML External Entity (XXE) Injection in OWSLib (CVSS 8.2, geopython OWSLib · owslib)
- [CVE-2023-25148](https://cve.now/CVE-2023-25148.md): A security agent link following vulnerability in Trend Micro Apex One could allow a local attacker to exploit the vulnerability by changing (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-25147](https://cve.now/CVE-2023-25147.md): An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypa (CVSS 6.7, Trend Micro Apex One)
- [CVE-2023-25146](https://cve.now/CVE-2023-25146.md): A security agent link following vulnerability in the Trend Micro Apex One agent could allow a local attacker to quarantine a file, delete th (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-25145](https://cve.now/CVE-2023-25145.md): A link following vulnerability in the scanning function of Trend Micro Apex One agent could allow a local attacker to escalate privileges on (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-25144](https://cve.now/CVE-2023-25144.md): An improper access control vulnerability in the Trend Micro Apex One agent could allow a local attacker to gain elevated privileges and crea (CVSS 7.8, Trend Micro Apex One)
- [CVE-2023-25143](https://cve.now/CVE-2023-25143.md): An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote c (CVSS 9.8, Trend Micro Apex One)
- [CVE-2023-1236](https://cve.now/CVE-2023-1236.md): Inappropriate implementation in Internals in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to spoof the origin of an iframe (no CVSS, Google Chrome)
- [CVE-2023-1235](https://cve.now/CVE-2023-1235.md): Type confusion in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to pot (no CVSS, Google Chrome)
- [CVE-2023-1234](https://cve.now/CVE-2023-1234.md): Inappropriate implementation in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to perform domain spoof (no CVSS, Google Chrome)
- [CVE-2023-1233](https://cve.now/CVE-2023-1233.md): Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to insta (no CVSS, Google Chrome)
- [CVE-2023-1232](https://cve.now/CVE-2023-1232.md): Insufficient policy enforcement in Resource Timing in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to obtain potentially s (no CVSS, Google Chrome)
- [CVE-2023-1231](https://cve.now/CVE-2023-1231.md): Inappropriate implementation in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to potentially spoof t (no CVSS, Google Chrome)
- [CVE-2023-1230](https://cve.now/CVE-2023-1230.md): Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 111.0.5563.64 allowed an attacker who convinced a user (no CVSS, Google Chrome)
- [CVE-2023-1229](https://cve.now/CVE-2023-1229.md): Inappropriate implementation in Permission prompts in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation re (no CVSS, Google Chrome)
- [CVE-2023-1228](https://cve.now/CVE-2023-1228.md): Insufficient policy enforcement in Intents in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to bypass navigation (CVSS 8.8, Google Chrome)
- [CVE-2023-1227](https://cve.now/CVE-2023-1227.md): Use after free in Core in Google Chrome on Lacros prior to 111.0.5563.64 allowed a remote attacker who convinced a user to engage in specifi (CVSS 8.8, Google Chrome)
- [CVE-2023-1226](https://cve.now/CVE-2023-1226.md): Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass content secu (no CVSS, Google Chrome)
- [CVE-2023-1225](https://cve.now/CVE-2023-1225.md): Insufficient policy enforcement in Navigation in Google Chrome on iOS prior to 111.0.5563.64 allowed a remote attacker to bypass same origin (no CVSS, Google Chrome)
- [CVE-2023-1224](https://cve.now/CVE-2023-1224.md): Insufficient policy enforcement in Web Payments API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to bypass navigation r (no CVSS, Google Chrome)
- [CVE-2023-1223](https://cve.now/CVE-2023-1223.md): Insufficient policy enforcement in Autofill in Google Chrome on Android prior to 111.0.5563.64 allowed a remote attacker to leak cross-origi (no CVSS, Google Chrome)
- [CVE-2023-1222](https://cve.now/CVE-2023-1222.md): Heap buffer overflow in Web Audio API in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corrupti (CVSS 8.8, Google Chrome)
- [CVE-2023-1221](https://cve.now/CVE-2023-1221.md): Insufficient policy enforcement in Extensions API in Google Chrome prior to 111.0.5563.64 allowed an attacker who convinced a user to instal (no CVSS, Google Chrome)
- [CVE-2023-1220](https://cve.now/CVE-2023-1220.md): Heap buffer overflow in UMA in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process to po (CVSS 8.8, Google Chrome)
- [CVE-2023-1219](https://cve.now/CVE-2023-1219.md): Heap buffer overflow in Metrics in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had compromised the renderer process t (CVSS 8.8, Google Chrome)
- [CVE-2023-1218](https://cve.now/CVE-2023-1218.md): Use after free in WebRTC in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2023-1217](https://cve.now/CVE-2023-1217.md): Stack buffer overflow in Crash reporting in Google Chrome on Windows prior to 111.0.5563.64 allowed a remote attacker who had compromised th (no CVSS, Google Chrome)
- [CVE-2023-1216](https://cve.now/CVE-2023-1216.md): Use after free in DevTools in Google Chrome prior to 111.0.5563.64 allowed a remote attacker who had convienced the user to engage in direct (CVSS 8.8, Google Chrome)
- [CVE-2023-1215](https://cve.now/CVE-2023-1215.md): Type confusion in CSS in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-1214](https://cve.now/CVE-2023-1214.md): Type confusion in V8 in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a crafted (CVSS 8.8, Google Chrome)
- [CVE-2023-1213](https://cve.now/CVE-2023-1213.md): Use after free in Swiftshader in Google Chrome prior to 111.0.5563.64 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2023-1263](https://cve.now/CVE-2023-1263.md): CMP – Coming Soon & Maintenance Plugin by NiteoThemes \<= 4.1.6 - Information Exposure (CVSS 5.3, CMP – Coming Soon & Maintenance Plugin by NiteoThemes)
- [CVE-2023-27485](https://cve.now/CVE-2023-27485.md): Insufficient verification of authorisation when accessing subresults in thmmniii/fbs-core (CVSS 4.3, thm-mni-ii feedbacksystem)
- [CVE-2023-27481](https://cve.now/CVE-2023-27481.md): Extract password hashes through export querying in directus (CVSS 4.3, directus)
- [CVE-2023-27480](https://cve.now/CVE-2023-27480.md): Data leak through a XAR import XXE attack in xwiki-platform-xar-model (CVSS 7.7, xwiki-platform · org.xwiki.platform:xwiki-platform-xar-model)
- [CVE-2023-27479](https://cve.now/CVE-2023-27479.md): Improper Neutralization of Directives in Dynamically Evaluated Code in org.xwiki.platform:xwiki-platform-panels-ui (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-panels-ui)
- [CVE-2023-27478](https://cve.now/CVE-2023-27478.md): Disclosure of unrelated data in libmemcached-awesome (CVSS 6.5, awesomized libmemcached)
- [CVE-2023-27475](https://cve.now/CVE-2023-27475.md): Goutil vulnerable to path traversal when unzipping files (CVSS 8.8, gookit goutil · github.com/gookit/goutil)
- [CVE-2023-1257](https://cve.now/CVE-2023-1257.md): CVE-2023-1257 (CVSS 7.6, MOXA UC-8580 Series · MOXA UC-8540 Series +8)
- [CVE-2022-41329](https://cve.now/CVE-2022-41329.md): An exposure of sensitive information to an unauthorized actor vulnerability \[CWE-200\] in Fortinet FortiProxy version 7.2.0 through 7.2.1 and (CVSS 5.2, Fortinet FortiProxy · Fortinet FortiOS)
- [CVE-2022-42476](https://cve.now/CVE-2022-42476.md): A relative path traversal vulnerability \[CWE-23\] vulnerability in Fortinet FortiOS 7.2.0 through 7.2.3, FortiOS 7.0.0 through 7.0.8, FortiOS (CVSS 7.8, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2022-45861](https://cve.now/CVE-2022-45861.md): An access of uninitialized pointer vulnerability \[CWE-824\] in the SSL VPN portal of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7. (CVSS 6.4, Fortinet FortiOS · Fortinet FortiProxy)
- [CVE-2022-27490](https://cve.now/CVE-2022-27490.md): A exposure of sensitive information to an unauthorized actor in Fortinet FortiManager version 6.0.0 through 6.0.4, FortiAnalyzer version 6.0 (CVSS 5.1, Fortinet FortiManager · Fortinet FortiAnalyzer +2)
- [CVE-2022-40676](https://cve.now/CVE-2022-40676.md): A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9. (CVSS 7.1, Fortinet FortiNAC)
- [CVE-2022-41328](https://cve.now/CVE-2022-41328.md): A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') \[CWE-22\] in Fortinet FortiOS version 7.2.0 th (CVSS 6.5, KEV, Fortinet FortiOS)
- [CVE-2022-22297](https://cve.now/CVE-2022-22297.md): An incomplete filtering of one or more instances of special elements vulnerability \[CWE-792\] in the command line interpreter of FortiWeb ver (CVSS 5.2, Fortinet FortiRecorder · Fortinet FortiWeb)
- [CVE-2023-23776](https://cve.now/CVE-2023-23776.md): An exposure of sensitive information to an unauthorized actor \[CWE-200\] vulnerability in FortiAnalyzer versions 7.2.0 through 7.2.1, 7.0.0 t (CVSS 4.6, Fortinet FortiAnalyzer)
- [CVE-2022-41333](https://cve.now/CVE-2022-41333.md): An uncontrolled resource consumption vulnerability \[CWE-400\] in FortiRecorder version 6.4.3 and below, 6.0.11 and below login authentication (CVSS 6.8, Fortinet FortiRecorder)
- [CVE-2022-39953](https://cve.now/CVE-2022-39953.md): A improper privilege management in Fortinet FortiNAC version 9.4.0 through 9.4.1, FortiNAC version 9.2.0 through 9.2.6, FortiNAC version 9.1 (CVSS 7.8, Fortinet FortiNAC)
- [CVE-2022-39951](https://cve.now/CVE-2022-39951.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0. (CVSS 7.2, Fortinet FortiWeb)
- [CVE-2023-25611](https://cve.now/CVE-2023-25611.md): A improper neutralization of formula elements in a CSV file vulnerability in Fortinet FortiAnalyzer 6.4.0 - 6.4.9, 7.0.0 - 7.0.5, and 7.2.0 (CVSS 4.0, Fortinet FortiAnalyzer)
- [CVE-2023-25605](https://cve.now/CVE-2023-25605.md): A improper access control vulnerability in Fortinet FortiSOAR 7.3.0 - 7.3.1 allows an attacker authenticated on the administrative interface (CVSS 7.5, Fortinet FortiSOAR)
- [CVE-2020-36670](https://cve.now/CVE-2020-36670.md): NEX-Forms \<= 7.7.1 - Missing Authorization on Various AJAX Actions (CVSS 6.3, webaways NEX-Forms – Ultimate Forms Plugin for WordPress)
- [CVE-2023-27522](https://cve.now/CVE-2023-27522.md): Apache HTTP Server: mod\_proxy\_uwsgi HTTP response splitting (CVSS 7.5, Apache Software Foundation Apache HTTP Server · uwsgi)
- [CVE-2023-25690](https://cve.now/CVE-2023-25690.md): Apache HTTP Server: HTTP request splitting with mod\_rewrite and mod\_proxy (CVSS 9.8, Apache Software Foundation Apache HTTP Server)
- [CVE-2023-1254](https://cve.now/CVE-2023-1254.md): SourceCodester Health Center Patient Record Management System birthing\_print.php cross site scripting (CVSS 3.5, SourceCodester Health Center Patient Record Management Syst…)
- [CVE-2023-1253](https://cve.now/CVE-2023-1253.md): SourceCodester Health Center Patient Record Management System login.php sql injection (CVSS 7.3, SourceCodester Health Center Patient Record Management Syst…)
- [CVE-2021-4333](https://cve.now/CVE-2021-4333.md): WP Statistics \<= 13.1.1 - Cross-Site Request Forgery to Arbitrary Plugin Activation and Deactivation (CVSS 6.5, veronalabs WP Statistics – Simple, privacy-friendly Google…)
- [CVE-2022-4932](https://cve.now/CVE-2022-4932.md): Total Upkeep \<= 1.14.13 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure (CVSS 4.3, Total Upkeep – WordPress Backup Plugin plus Restore & Migra…)
- [CVE-2022-4931](https://cve.now/CVE-2022-4931.md): The BackupWordPress plugin for WordPress is vulnerable to information disclosure in versions up to, and including 3.12. (CVSS 4.3, willmot BackUpWordPress)
- [CVE-2015-10087](https://cve.now/CVE-2015-10087.md): UpThemes Theme DesignFolio Plus unrestricted upload (CVSS 6.3, UpThemes Theme DesignFolio Plus)
- [CVE-2021-4332](https://cve.now/CVE-2021-4332.md): The Plus Addons for Elementor PRO \<= 4.1.9 & The Plus Addons for Elementor \<= 2.0.6 - Authenticated (Contributor+) Arbitrary File Read (CVSS 6.5, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2021-4331](https://cve.now/CVE-2021-4331.md): The Plus Addons for Elementor PRO \<= 4.1.9 & The Plus Addons for Elementor \<= 2.0.6 - Authenticated (Contributor+) Privilege Escalation (CVSS 8.8, posimyththemes The Plus Addons for Elementor – Addons for E…)
- [CVE-2021-4330](https://cve.now/CVE-2021-4330.md): Envato Elements \<= 2.0.10 & Template Kit \<= 1.0.13 - Authenticated (Contributor+) Arbitrary File Upload (CVSS 8.8, envato Template Kit – Import · Envato Elements – Photos & E…)
- [CVE-2020-36669](https://cve.now/CVE-2020-36669.md): JetBackup – WP Backup, Migrate & Restore \<= 1.3.9 - Cross-Site Request Forgery to Arbitrary File Upload (CVSS 8.8, backupguard JetBackup – Backup, Restore & Migrate)
- [CVE-2020-36668](https://cve.now/CVE-2020-36668.md): JetBackup – WP Backup, Migrate & Restore \<= 1.4.0 - Sensitive Information Disclosure (CVSS 4.3, backupguard JetBackup – Backup, Restore & Migrate)
- [CVE-2020-36667](https://cve.now/CVE-2020-36667.md): JetBackup – WP Backup, Migrate & Restore \<= 1.4.1 - Missing Authorization to Unauthorized Backup Location Change (CVSS 5.4, backupguard JetBackup – Backup, Restore & Migrate)
- [CVE-2021-44197](https://cve.now/CVE-2021-44197.md): XSS in UBIT Information Technologies Student Information Management System (CVSS 6.1, UBIT Information Technologies Student Information Managemen…)
- [CVE-2021-44196](https://cve.now/CVE-2021-44196.md): XSS in UBIT Information Technologies Student Information Management System (CVSS 6.1, UBIT Information Technologies Student Information Managemen…)
- [CVE-2022-3760](https://cve.now/CVE-2022-3760.md): SQLi in Mia-Med (CVSS 9.8, Mia Technology Mia-Med)
- [CVE-2022-40540](https://cve.now/CVE-2022-40540.md): Buffer copy without checking the size of input in Linux Kernel (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-40539](https://cve.now/CVE-2022-40539.md): Improper Validation of Array Index in Automotive Android OS (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-40537](https://cve.now/CVE-2022-40537.md): Improper Validation of Array Index in Bluetooth HOST (CVSS 7.3, Qualcomm Snapdragon)
- [CVE-2022-40535](https://cve.now/CVE-2022-40535.md): Buffer Over-read in WLAN (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-40531](https://cve.now/CVE-2022-40531.md): Incorrect type conversion in WLAN (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-40530](https://cve.now/CVE-2022-40530.md): Integer overflow to buffer overflow in WLAN (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-40527](https://cve.now/CVE-2022-40527.md): Reachable Assertion in WLAN Embedded SW (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-40515](https://cve.now/CVE-2022-40515.md): Double free in Video (CVSS 7.3, Qualcomm Snapdragon)
- [CVE-2022-33309](https://cve.now/CVE-2022-33309.md): Buiffer over-read in WLAN Firmware. (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33278](https://cve.now/CVE-2022-33278.md): Buffer copy without checking the size of input in HLOS (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2022-33272](https://cve.now/CVE-2022-33272.md): Reachable assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33260](https://cve.now/CVE-2022-33260.md): Stack based buffer overflow in Core (CVSS 5.9, Qualcomm Snapdragon)
- [CVE-2022-33257](https://cve.now/CVE-2022-33257.md): Time-of-check time-of-use race condition in Core (CVSS 9.3, Qualcomm Snapdragon)
- [CVE-2022-33256](https://cve.now/CVE-2022-33256.md): Improper validation of array index in Multi-mode call processor (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2022-33254](https://cve.now/CVE-2022-33254.md): Reachable assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33250](https://cve.now/CVE-2022-33250.md): Reachable assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33245](https://cve.now/CVE-2022-33245.md): Use after free in WLAN (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33244](https://cve.now/CVE-2022-33244.md): Reachable assertion in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33242](https://cve.now/CVE-2022-33242.md): Improper authentication in Qualcomm IPC (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2022-33213](https://cve.now/CVE-2022-33213.md): Memory Corruption in MODEM (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-25709](https://cve.now/CVE-2022-25709.md): Use of Out-of-range Pointer Offset in Data Modem (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-25705](https://cve.now/CVE-2022-25705.md): Integer Overflow to Buffer Overflow in Modem (CVSS 7.8, Qualcomm Snapdragon)
- [CVE-2022-25694](https://cve.now/CVE-2022-25694.md): Use of Out-of-range Pointer Offset in MODEM (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-25655](https://cve.now/CVE-2022-25655.md): Buffer copy without checking the size of input in WLAN HAL. (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-22075](https://cve.now/CVE-2022-22075.md): Information Exposure in Graphics (CVSS 6.2, Qualcomm Snapdragon)
- [CVE-2022-47459](https://cve.now/CVE-2022-47459.md): In wlan driver, there is a possible missing params check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47458](https://cve.now/CVE-2022-47458.md): In wlan driver, there is a possible missing params check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47457](https://cve.now/CVE-2022-47457.md): In wlan driver, there is a possible missing params check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47456](https://cve.now/CVE-2022-47456.md): In wlan driver, there is a possible missing params check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47455](https://cve.now/CVE-2022-47455.md): In wlan driver, there is a possible missing params check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47454](https://cve.now/CVE-2022-47454.md): In wlan driver, there is a possible missing params check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47453](https://cve.now/CVE-2022-47453.md): In wcn service, there is a possible missing params check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47484](https://cve.now/CVE-2022-47484.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47483](https://cve.now/CVE-2022-47483.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47482](https://cve.now/CVE-2022-47482.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47481](https://cve.now/CVE-2022-47481.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47480](https://cve.now/CVE-2022-47480.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47479](https://cve.now/CVE-2022-47479.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47478](https://cve.now/CVE-2022-47478.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47477](https://cve.now/CVE-2022-47477.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47476](https://cve.now/CVE-2022-47476.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47475](https://cve.now/CVE-2022-47475.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47474](https://cve.now/CVE-2022-47474.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47471](https://cve.now/CVE-2022-47471.md): In telephony service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47473](https://cve.now/CVE-2022-47473.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47472](https://cve.now/CVE-2022-47472.md): In telephony service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47462](https://cve.now/CVE-2022-47462.md): In telephone service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47461](https://cve.now/CVE-2022-47461.md): In telephone service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-47460](https://cve.now/CVE-2022-47460.md): In gpu device, there is a memory corruption due to a use after free. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-46257](https://cve.now/CVE-2022-46257.md): Information disclosure in GitHub Enterprise Server leading to unauthorized viewing of private repository names (no CVSS, GitHub Enterprise Server)
- [CVE-2023-1237](https://cve.now/CVE-2023-1237.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 3.4, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1238](https://cve.now/CVE-2023-1238.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 7.6, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1239](https://cve.now/CVE-2023-1239.md): Cross-site Scripting (XSS) - Reflected in answerdev/answer (CVSS 6.0, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1240](https://cve.now/CVE-2023-1240.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 8.0, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1241](https://cve.now/CVE-2023-1241.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 8.8, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1242](https://cve.now/CVE-2023-1242.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 8.0, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1243](https://cve.now/CVE-2023-1243.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 6.0, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1244](https://cve.now/CVE-2023-1244.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 9.3, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1245](https://cve.now/CVE-2023-1245.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 3.5, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1264](https://cve.now/CVE-2023-1264.md): NULL Pointer Dereference in vim/vim (CVSS 6.6, vim/vim)
- [CVE-2023-20620](https://cve.now/CVE-2023-20620.md): In adsp, there is a possible escalation of privilege due to a logic error. (no CVSS, MediaTek MT6879, MT6895, MT6983)
- [CVE-2023-20621](https://cve.now/CVE-2023-20621.md): In tinysys, there is a possible out of bounds write due to a missing bounds check. (no CVSS, MediaTek MT6739, MT6761, MT6762, MT6765, MT6771, MT6789, MT…)
- [CVE-2023-20623](https://cve.now/CVE-2023-20623.md): In ion, there is a possible escalation of privilege due to improper locking. (CVSS 6.4, MediaTek MT6580, MT6735, MT6737, MT6739, MT6753, MT6757, MT…)
- [CVE-2023-20624](https://cve.now/CVE-2023-20624.md): In vow, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT…)
- [CVE-2023-20625](https://cve.now/CVE-2023-20625.md): In adsp, there is a possible double free due to a race condition. (CVSS 6.4, MediaTek MT6739, MT6761, MT6765, MT6768, MT6769, MT6779, MT…)
- [CVE-2023-20626](https://cve.now/CVE-2023-20626.md): In msdc, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 6.7, MediaTek MT6739, MT6761, MT6765, MT6768, MT6771, MT6779, MT…)
- [CVE-2023-20627](https://cve.now/CVE-2023-20627.md): In pqframework, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983, MT8167, MT8168)
- [CVE-2023-20628](https://cve.now/CVE-2023-20628.md): In thermal, there is a possible memory corruption due to an uncaught exception. (CVSS 6.7, MediaTek MT6580, MT6739, MT6761, MT6762, MT6765, MT6768, MT…)
- [CVE-2023-20630](https://cve.now/CVE-2023-20630.md): In usb, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6735, MT6739, MT6761, MT6763, MT6765, MT…)
- [CVE-2023-20632](https://cve.now/CVE-2023-20632.md): In usb, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6735, MT6739, MT6761, MT6763, MT6765, MT…)
- [CVE-2023-20633](https://cve.now/CVE-2023-20633.md): In usb, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6735, MT6739, MT6761, MT6763, MT6765, MT…)
- [CVE-2023-20634](https://cve.now/CVE-2023-20634.md): In widevine, there is a possible out of bounds write due to improper input validation. (CVSS 6.7, MediaTek MT6762, MT6765, MT6768, MT6769, MT6779, MT6781, MT…)
- [CVE-2023-20635](https://cve.now/CVE-2023-20635.md): In keyinstall, there is a possible information disclosure due to an integer overflow. (CVSS 4.4, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2023-20636](https://cve.now/CVE-2023-20636.md): In display drm, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6895, MT6985, MT8168, MT8781)
- [CVE-2023-20637](https://cve.now/CVE-2023-20637.md): In ril, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983, MT8321, MT8765, MT8766, MT…)
- [CVE-2023-20638](https://cve.now/CVE-2023-20638.md): In ril, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6739, MT6753, MT6761, MT6762, MT6763, MT6765, MT…)
- [CVE-2023-20639](https://cve.now/CVE-2023-20639.md): In ril, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983, MT8321, MT8765, MT8766, MT…)
- [CVE-2023-20640](https://cve.now/CVE-2023-20640.md): In ril, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983, MT8791, MT8791T, MT8797)
- [CVE-2023-20641](https://cve.now/CVE-2023-20641.md): In ril, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983, MT8791, MT8791T, MT8797)
- [CVE-2023-20642](https://cve.now/CVE-2023-20642.md): In ril, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983, MT8321, MT8765, MT8766, MT…)
- [CVE-2023-20643](https://cve.now/CVE-2023-20643.md): In ril, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6739, MT6761, MT6762, MT6765, MT6768, MT6769, MT…)
- [CVE-2023-20644](https://cve.now/CVE-2023-20644.md): In ril, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6580, MT6739, MT6761, MT6765, MT6768, MT6779, MT…)
- [CVE-2023-20645](https://cve.now/CVE-2023-20645.md): In ril, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6739, MT6761, MT6762, MT6763, MT6765, MT6769, MT…)
- [CVE-2023-20646](https://cve.now/CVE-2023-20646.md): In ril, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6737, MT6739, MT6753, MT6757, MT6757C, MT6757CD,…)
- [CVE-2023-20647](https://cve.now/CVE-2023-20647.md): In ril, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6739, MT6761, MT6762, MT6765, MT6768, MT6779, MT…)
- [CVE-2023-20648](https://cve.now/CVE-2023-20648.md): In ril, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT…)
- [CVE-2023-20649](https://cve.now/CVE-2023-20649.md): In ril, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6761, MT6762, MT6763, MT6765, MT6768, MT6769, MT…)
- [CVE-2023-20650](https://cve.now/CVE-2023-20650.md): In apu, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6853, MT6853T, MT6873, MT6875, MT6877, MT6879, M…)
- [CVE-2023-20651](https://cve.now/CVE-2023-20651.md): In apu, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6853, MT6853T, MT6875, MT6877, MT6879, MT6883, M…)
- [CVE-2023-22847](https://cve.now/CVE-2023-22847.md): Information disclosure vulnerability exists in pg\_ivm versions prior to 1.5.1. (CVSS 4.3, IVM Development Group pg\_ivm)
- [CVE-2023-23554](https://cve.now/CVE-2023-23554.md): Uncontrolled search path element vulnerability exists in pg\_ivm versions prior to 1.5.1. (CVSS 8.8, IVM Development Group pg\_ivm)
- [CVE-2023-24775](https://cve.now/CVE-2023-24775.md): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \\member\\Member.php. (CVSS 9.8, funadmin/funadmin)
- [CVE-2023-24780](https://cve.now/CVE-2023-24780.md): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/columns. (CVSS 9.8, funadmin/funadmin)
- [CVE-2023-24781](https://cve.now/CVE-2023-24781.md): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \\member\\MemberLevel.php. (CVSS 9.8, funadmin/funadmin)
- [CVE-2023-25223](https://cve.now/CVE-2023-25223.md): CRMEB \<=1.3.4 is vulnerable to SQL Injection via /api/admin/user/list. (CVSS 7.2)
- [CVE-2023-25230](https://cve.now/CVE-2023-25230.md): A Server-Side Request Forgery (SSRF) in loonflow r2.0.14 allows attackers to force the application to make arbitrary requests via manipulati (no CVSS)
- [CVE-2023-26953](https://cve.now/CVE-2023-26953.md): onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Administrator module. (CVSS 4.8)
- [CVE-2023-26954](https://cve.now/CVE-2023-26954.md): onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the User Group module. (CVSS 5.4)
- [CVE-2023-26955](https://cve.now/CVE-2023-26955.md): onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Admin Group module. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.