CVEs published March 8, 2023
55 CVEs were published on March 8, 2023: 16 critical, 17 high.
- Published
- 55
- Critical
- 16
- High
- 17
- Medium
- 15
- Low
- 4
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- 7
- funadmin/funadmin
- 3
- bytecodealliance wasmtime · wasmtime +1
- 2
- GitLab
- 2
- kernel
- 2
- proofpoint enterprise_protection
- 2
- alextselegidis/easyappointments
- 1
- Apache Software Foundation Apache Dubbo · org.apache.dubbo:…
- 1
- btcpayserver/btcpayserver
- 1
- builderio/qwik · @builder.io/qwik
- 1
Critical 16
- CVE-2023-26489Guest-controlled out-of-bounds read/write on x86_64 in wasmtimebytecodealliance wasmtime · wasmtime +1
- CVE-2023-27905Jenkins update-center2 3.13 and 3.14 renders the required Jenkins core version on plugin download index pages without sanitization, resultinJenkins Project Jenkins update-center2 · org.jenkins-ci:upd…
- CVE-2023-27898Jenkins 2.270 through 2.393 (both inclusive), LTS 2.277.1 through 2.375.3 (both inclusive) does not escape the Jenkins version a plugin depeJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-1267SQLi in Ulkem Company's PtteM KartUlkem Company PtteM Kart
- CVE-2023-0090Proofpoint Enterprise Protection webservices unauthenticated RCEproofpoint enterprise_protection
- CVE-2021-33351Cross Site Scripting Vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before and fixed in v.1.3.7 allows attackers to esca
- CVE-2021-33352An issue in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute arbitrary code via a phar f
- CVE-2021-33353Directory Traversal vulnerability in Wyomind Help Desk Magento 2 extension v.1.3.6 and before fixed in v.1.3.7 allows attacker to execute ar
- CVE-2023-1283 Code Injection in builderio/qwikbuilderio/qwik · @builder.io/qwik
- CVE-2023-22889SmartBear Zephyr Enterprise through 7.15.0 mishandles user-defined input during report generation.
- CVE-2023-24773Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/list.funadmin/funadmin
- CVE-2023-24777Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/table/list.funadmin/funadmin
- CVE-2023-24782Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the id parameter at /databases/database/edit.funadmin/funadmin
- CVE-2023-26261In UBIKA WAAP Gateway/Cloud through 6.10, a blind XPath injection leads to an authentication bypass by stealing the session of another conne
- CVE-2023-26922SQL injection vulnerability found in Varisicte matrix-gui v.2 allows a remote attacker to execute arbitrary code via the shell_exect paramet
- CVE-2023-27482homeassistant is an open source home automation tool.home-assistant core · home-assistant supervisor
High 17
- CVE-2023-24533Incorrect multiplication of unreduced P-256 scalars in filippo.io/nistecfilippo.io/nistec
- CVE-2023-27486Insufficient authorization validation between zones when xCAT zones are enabledxcat2 xcat-core
- CVE-2023-1277kylin-system-updater Update InstallSnap command injectionkylin-system-updater
- CVE-2023-27901Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-27900Jenkins 2.393 and earlier, LTS 2.375.3 and earlier uses the Apache Commons FileUpload library without specifying limits for the number of reJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-27899Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2022-20929A vulnerability in the upgrade signature verification of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticatedCisco Enterprise NFV Infrastructure Software
- CVE-2023-0089Proofpoint Enterprise Protection webutils authenticated RCEproofpoint enterprise_protection
- CVE-2018-25081Bitwarden through 2023.2.1 offers password auto-fill within a cross-domain IFRAME element.
- CVE-2021-33639REMAP cmd of SVM driver can be used to remap read only memory as read-write, then cause read only memory/file modified.kernel
- CVE-2022-46394An issue was discovered in the Arm Mali GPU Kernel Driver.
- CVE-2023-0030A use-after-free flaw was found in the Linux kernel’s nouveau driver in how a user triggers a memory overflow that causes the nvkm_vma_tail kernel
- CVE-2023-22890SmartBear Zephyr Enterprise through 7.15.0 allows unauthenticated users to upload large files, which could exhaust the local drive space, ca
- CVE-2023-22891There exists a privilege escalation vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by authorized users
- CVE-2023-22892There exists an information disclosure vulnerability in SmartBear Zephyr Enterprise through 7.15.0 that could be exploited by unauthenticate
- CVE-2023-26956onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/curd/code.
- CVE-2023-27088feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java.
Medium, low and unrated 22
- CVE-2022-37939A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers.Hewlett Packard Enterprise (HPE) HPE Superdome Flex Servers…
- CVE-2023-24532Incorrect calculation on P256 curves in crypto/internal/nistecGo standard library crypto/internal/nistec · stdlib
- CVE-2023-23760Path traversal in GitHub Enterprise Server leading to remote code executionGitHub Enterprise Server
- CVE-2023-1278IBOS index.php cross site scriptingIBOS
- CVE-2023-1276SUL1SS_shop Order.php sql injectionSUL1SS_shop
- CVE-2023-1275SourceCodester Phone Shop Sales Managements System CAPTCHA index.php cross site scriptingSourceCodester Phone Shop Sales Managements System
- CVE-2023-27904Jenkins 2.393 and earlier, LTS 2.375.3 and earlier prints an error stack trace on agent-related pages when agent connections are broken, potJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-27903Jenkins 2.393 and earlier, LTS 2.375.3 and earlier creates a temporary file in the default temporary directory with the default permissions Jenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2023-27902Jenkins 2.393 and earlier, LTS 2.375.3 and earlier shows temporary directories related to job workspaces, which allows attackers with Item/WJenkins Project Jenkins · org.jenkins-ci.main:jenkins-core
- CVE-2022-46752 Dell BIOS contains an Improper Authorization vulnerability.Dell CPG BIOS
- CVE-2023-23638Apache Dubbo Deserialization Vulnerability Gadgets BypassApache Software Foundation Apache Dubbo · org.apache.dubbo:…
- CVE-2022-4007A issue has been discovered in GitLab CE/EE affecting all versions from 15.3 prior to 15.7.8, version 15.8 prior to 15.8.4, and version 15.9GitLab
- CVE-2022-4315An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 2.0 before 3.0.55, which sends custom request headGitLab
- CVE-2023-1269Use of Hard-coded Credentials in alextselegidis/easyappointmentsalextselegidis/easyappointments
- CVE-2023-1270Cross-site Scripting in btcpayserver/btcpayserverbtcpayserver/btcpayserver
- CVE-2023-24282An arbitrary file upload vulnerability in Poly Trio 8800 7.2.2.1094 allows attackers to execute arbitrary code via a crafted ringtone file.
- CVE-2023-24657phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass parameter at /subnet-masks/po
- CVE-2023-25395TOTOlink A7100RU V7.4cu.2313_B20191024 router was discovered to contain a command injection vulnerability via the ou parameter at /setting/d
- CVE-2023-26950onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Title parameter under the Adding Cate
- CVE-2023-26952onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Add Menu module.
- CVE-2023-27477wasmtime is a fast and secure runtime for WebAssembly.bytecodealliance wasmtime · wasmtime +1
- CVE-2023-27974Bitwarden through 2023.2.1 offers password auto-fill when the second-level domain matches, e.g., a password stored for an example.com hostin