CVEs published March 9, 2023
58 CVEs were published on March 9, 2023: 5 critical, 15 high.
- Published
- 58
- Critical
- 5
- High
- 15
- Medium
- 22
- Low
- 5
- Unrated
- 11
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- GitLab
- 10
- Horner Automation Cscape Envision RV
- 3
- SourceCodester Sales Tracker Management System
- 3
- Cisco IOS XR Software
- 2
- Dassault Systèmes ENOVIA Live Collaboration
- 2
- GitLab DAST
- 2
- metersphere
- 2
- SourceCodester File Tracker Manager System
- 2
- Akinsoft Wolvox
- 1
- crossplane · github.com/crossplane/crossplane
- 1
Critical 5
- CVE-2023-1287ENOVIA Live Collaboration V6R2013xE is affected by an XSL template injection vulnerabilityDassault Systèmes ENOVIA Live Collaboration
- CVE-2023-1251SQLi in WolvoxAkinsoft Wolvox
- CVE-2023-26957onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \admin\controller\plugins.
- CVE-2023-27202Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/receipt.php.
- CVE-2023-27203Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /billing/home.php.
High 15
- CVE-2023-0621CVE-2023-0621Horner Automation Cscape Envision RV
- CVE-2023-0623CVE-2023-0623Horner Automation Cscape Envision RV
- CVE-2023-0622CVE-2023-0622Horner Automation Cscape Envision RV
- CVE-2023-27490Missing proper state, nonce and PKCE checks for OAuth authentication in next-authnextauthjs next-auth · next-auth
- CVE-2023-25814Arbitrary File Read Vulnerability in meterspheremetersphere
- CVE-2023-25573Improper access control to download file in meterspheremetersphere
- CVE-2023-1294SourceCodester File Tracker Manager System POST Parameter login.php sql injectionSourceCodester File Tracker Manager System
- CVE-2023-26109All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to impropenode-bluetooth-serial-port
- CVE-2023-26110All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user inputnode-bluetooth
- CVE-2022-3767Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every GitLab DAST
- CVE-2023-0050An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.GitLab
- CVE-2023-20049Cisco IOS XR Software for ASR 9000 Series Routers Bidirectional Forwarding Detection Denial of Service VulnerabilityCisco IOS XR Software
- CVE-2023-26948onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download.
- CVE-2023-27985emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI.
- CVE-2023-27986emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped
Medium, low and unrated 38
- CVE-2023-1303UCMS System File Management Module fileedit.php unrestricted uploadUCMS
- CVE-2023-1302SourceCodester File Tracker Manager System borrow1.php cross site scriptingSourceCodester File Tracker Manager System
- CVE-2023-1301SourceCodester Friendly Island Pizza Website and Ordering System GET Parameter deleteorder.php sql injectionSourceCodester Friendly Island Pizza Website and Ordering S…
- CVE-2023-1300SourceCodester COVID 19 Testing Management System POST Parameter patient-report.php sql injectionSourceCodester COVID 19 Testing Management System
- CVE-2023-27484Unchecked fieldpath index in Composition's patches can lead to arbitrary memory allocation in crossplanecrossplane · github.com/crossplane/crossplane
- CVE-2023-27483fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtimecrossplane-runtime · github.com/crossplane/crossplane-runti…
- CVE-2023-1288ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerabilityDassault Systèmes ENOVIA Live Collaboration
- CVE-2023-0845Consul Server Panic when Ingress and API Gateways Configured with PeeringHashiCorp Consul · github.com/hashicorp/consul
- CVE-2023-26209A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and before allows a remFortinet FortiDeceptor
- CVE-2023-26208A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.x and before allows Fortinet FortiAuthenticator
- CVE-2022-29056A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0, version 6.2.0 throuFortinet FortiMail
- CVE-2023-1293SourceCodester Online Graduate Tracer System admin_cs.php mysqli_query sql injectionSourceCodester Online Graduate Tracer System
- CVE-2023-1292SourceCodester Sales Tracker Management System Master.php delete_client sql injectionSourceCodester Sales Tracker Management System
- CVE-2023-1291SourceCodester Sales Tracker Management System manage_client.php sql injectionSourceCodester Sales Tracker Management System
- CVE-2023-1290SourceCodester Sales Tracker Management System view_client.php sql injectionSourceCodester Sales Tracker Management System
- CVE-2021-34125An issue discovered in Yuneec Mantis Q and PX4-Autopilot v 1.11.3 and below allow attacker to gain access to sensitive information via vario
- CVE-2022-3381An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15.9 prior to 15.9.2.GitLab
- CVE-2022-3758An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.GitLab
- CVE-2022-4289An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version GitLab
- CVE-2022-4317An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request heaGitLab DAST
- CVE-2022-4331An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15GitLab
- CVE-2022-4462An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8.GitLab
- CVE-2023-0223An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8.GitLab
- CVE-2023-0483An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8.GitLab
- CVE-2023-1072An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4GitLab
- CVE-2023-1084An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versioGitLab
- CVE-2023-1286Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-20064Cisco IOS XR Software Bootloader Unauthenticated Information Disclosure VulnerabilityCisco IOS XR Software
- CVE-2023-27204Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/manage_user.php.
- CVE-2023-27205Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /kruxton/sales_report.php.
- CVE-2023-27206A cross-site scripting (XSS) vulnerability in /kruxton/navbar.php of Best POS Management System 1.0 allows attackers to execute arbitrary we
- CVE-2023-27207Online Pizza Ordering System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/manage_user.php.
- CVE-2023-27208A cross-site scripting (XSS) vulnerability in /php-opos/login.php of Online Pizza Ordering System 1.0 allows attackers to execute arbitrary
- CVE-2023-27210Online Pizza Ordering System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/view_order.php.
- CVE-2023-27211A cross-site scripting (XSS) vulnerability in /admin/navbar.php of Online Pizza Ordering System 1.0 allows attackers to execute arbitrary we
- CVE-2023-27212A cross-site scripting (XSS) vulnerability in /php-opos/signup.php of Online Pizza Ordering System 1.0 allows attackers to execute arbitrary
- CVE-2023-27213Online Student Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter at /eduauth/stude
- CVE-2023-27214Online Student Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the fromdate and todate parameter