# CVEs published 2023-03-09

58 CVEs were published on March 9, 2023: 5 critical, 15 high. Days are UTC.

- [CVE-2023-1303](https://cve.now/CVE-2023-1303.md): UCMS System File Management Module fileedit.php unrestricted upload (CVSS 6.3, UCMS)
- [CVE-2023-1302](https://cve.now/CVE-2023-1302.md): SourceCodester File Tracker Manager System borrow1.php cross site scripting (CVSS 3.5, SourceCodester File Tracker Manager System)
- [CVE-2023-1301](https://cve.now/CVE-2023-1301.md): SourceCodester Friendly Island Pizza Website and Ordering System GET Parameter deleteorder.php sql injection (CVSS 6.3, SourceCodester Friendly Island Pizza Website and Ordering S…)
- [CVE-2023-1300](https://cve.now/CVE-2023-1300.md): SourceCodester COVID 19 Testing Management System POST Parameter patient-report.php sql injection (CVSS 6.3, SourceCodester COVID 19 Testing Management System)
- [CVE-2023-0621](https://cve.now/CVE-2023-0621.md): CVE-2023-0621 (CVSS 7.8, Horner Automation Cscape Envision RV)
- [CVE-2023-0623](https://cve.now/CVE-2023-0623.md): CVE-2023-0623 (CVSS 7.8, Horner Automation Cscape Envision RV)
- [CVE-2023-0622](https://cve.now/CVE-2023-0622.md): CVE-2023-0622 (CVSS 7.8, Horner Automation Cscape Envision RV)
- [CVE-2023-27490](https://cve.now/CVE-2023-27490.md): Missing proper state, nonce and PKCE checks for OAuth authentication in next-auth (CVSS 8.1, nextauthjs next-auth · next-auth)
- [CVE-2023-27484](https://cve.now/CVE-2023-27484.md): Unchecked fieldpath index in Composition's patches can lead to arbitrary memory allocation in crossplane (CVSS 6.2, crossplane · github.com/crossplane/crossplane)
- [CVE-2023-27483](https://cve.now/CVE-2023-27483.md): fieldpath's Paved.SetValue allows growing arrays up to arbitrary sizes in crossplane-runtime (CVSS 5.9, crossplane-runtime · github.com/crossplane/crossplane-runti…)
- [CVE-2023-25814](https://cve.now/CVE-2023-25814.md): Arbitrary File Read Vulnerability in metersphere (CVSS 7.1, metersphere)
- [CVE-2023-25573](https://cve.now/CVE-2023-25573.md): Improper access control to download file in metersphere (CVSS 8.6, metersphere)
- [CVE-2023-1288](https://cve.now/CVE-2023-1288.md): ENOVIA Live Collaboration V6R2013xE is affected by an XML External Entity injection (XXE) vulnerability (CVSS 6.8, Dassault Systèmes ENOVIA Live Collaboration)
- [CVE-2023-1287](https://cve.now/CVE-2023-1287.md): ENOVIA Live Collaboration V6R2013xE is affected by an XSL template injection vulnerability (CVSS 9.0, Dassault Systèmes ENOVIA Live Collaboration)
- [CVE-2023-0845](https://cve.now/CVE-2023-0845.md): Consul Server Panic when Ingress and API Gateways Configured with Peering (CVSS 4.9, HashiCorp Consul · github.com/hashicorp/consul)
- [CVE-2023-26209](https://cve.now/CVE-2023-26209.md): A improper restriction of excessive authentication attempts vulnerability \[CWE-307\] in Fortinet FortiDeceptor 3.1.x and before allows a rem (CVSS 3.5, Fortinet FortiDeceptor)
- [CVE-2023-26208](https://cve.now/CVE-2023-26208.md): A improper restriction of excessive authentication attempts vulnerability \[CWE-307\] in Fortinet FortiAuthenticator 6.4.x and before allows (CVSS 3.5, Fortinet FortiAuthenticator)
- [CVE-2022-29056](https://cve.now/CVE-2022-29056.md): A improper restriction of excessive authentication attempts vulnerability \[CWE-307\] in Fortinet FortiMail version 6.4.0, version 6.2.0 throu (CVSS 3.5, Fortinet FortiMail)
- [CVE-2023-1294](https://cve.now/CVE-2023-1294.md): SourceCodester File Tracker Manager System POST Parameter login.php sql injection (CVSS 7.3, SourceCodester File Tracker Manager System)
- [CVE-2023-1293](https://cve.now/CVE-2023-1293.md): SourceCodester Online Graduate Tracer System admin\_cs.php mysqli\_query sql injection (CVSS 5.0, SourceCodester Online Graduate Tracer System)
- [CVE-2023-1292](https://cve.now/CVE-2023-1292.md): SourceCodester Sales Tracker Management System Master.php delete\_client sql injection (CVSS 6.3, SourceCodester Sales Tracker Management System)
- [CVE-2023-1291](https://cve.now/CVE-2023-1291.md): SourceCodester Sales Tracker Management System manage\_client.php sql injection (CVSS 6.3, SourceCodester Sales Tracker Management System)
- [CVE-2023-1290](https://cve.now/CVE-2023-1290.md): SourceCodester Sales Tracker Management System view\_client.php sql injection (CVSS 6.3, SourceCodester Sales Tracker Management System)
- [CVE-2023-1251](https://cve.now/CVE-2023-1251.md): SQLi in Wolvox (CVSS 9.8, Akinsoft Wolvox)
- [CVE-2023-26109](https://cve.now/CVE-2023-26109.md): All versions of the package node-bluetooth-serial-port are vulnerable to Buffer Overflow via the findSerialPortChannel method due to imprope (CVSS 7.3, node-bluetooth-serial-port)
- [CVE-2023-26110](https://cve.now/CVE-2023-26110.md): All versions of the package node-bluetooth are vulnerable to Buffer Overflow via the findSerialPortChannel method due to improper user input (CVSS 7.3, node-bluetooth)
- [CVE-2021-34125](https://cve.now/CVE-2021-34125.md): An issue discovered in Yuneec Mantis Q and PX4-Autopilot v 1.11.3 and below allow attacker to gain access to sensitive information via vario (no CVSS)
- [CVE-2022-3381](https://cve.now/CVE-2022-3381.md): An issue has been discovered in GitLab affecting all versions starting from 10.0 to 15.7.8, 15.8 prior to 15.8.4 and 15.9 prior to 15.9.2. (CVSS 4.3, GitLab)
- [CVE-2022-3758](https://cve.now/CVE-2022-3758.md): An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8. (CVSS 5.4, GitLab)
- [CVE-2022-3767](https://cve.now/CVE-2022-3767.md): Missing validation in DAST analyzer affecting all versions from 1.11.0 prior to 3.0.32, allows custom request headers to be sent with every (CVSS 7.7, GitLab DAST)
- [CVE-2022-4289](https://cve.now/CVE-2022-4289.md): An issue has been discovered in GitLab affecting all versions starting from 15.3 before 15.7.8, versions of 15.8 before 15.8.4, and version (CVSS 6.4, GitLab)
- [CVE-2022-4317](https://cve.now/CVE-2022-4317.md): An issue has been discovered in GitLab DAST analyzer affecting all versions starting from 1.47 before 3.0.51, which sends custom request hea (CVSS 5.0, GitLab DAST)
- [CVE-2022-4331](https://cve.now/CVE-2022-4331.md): An issue has been discovered in GitLab EE affecting all versions starting from 15.1 before 15.7.8, all versions starting from 15.8 before 15 (CVSS 5.7, GitLab)
- [CVE-2022-4462](https://cve.now/CVE-2022-4462.md): An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.7.8, all versions starting from 15.8 before 15.8. (CVSS 5.0, GitLab)
- [CVE-2023-0050](https://cve.now/CVE-2023-0050.md): An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8. (CVSS 8.7, GitLab)
- [CVE-2023-0223](https://cve.now/CVE-2023-0223.md): An issue has been discovered in GitLab affecting all versions starting from 15.5 before 15.7.8, all versions starting from 15.8 before 15.8. (CVSS 5.3, GitLab)
- [CVE-2023-0483](https://cve.now/CVE-2023-0483.md): An issue has been discovered in GitLab affecting all versions starting from 12.1 before 15.7.8, all versions starting from 15.8 before 15.8. (CVSS 5.5, GitLab)
- [CVE-2023-1072](https://cve.now/CVE-2023-1072.md): An issue has been discovered in GitLab affecting all versions starting from 9.0 before 15.7.8, all versions starting from 15.8 before 15.8.4 (CVSS 4.3, GitLab)
- [CVE-2023-1084](https://cve.now/CVE-2023-1084.md): An issue has been discovered in GitLab CE/EE affecting all versions before 15.7.8, all versions starting from 15.8 before 15.8.4, all versio (CVSS 2.7, GitLab)
- [CVE-2023-1286](https://cve.now/CVE-2023-1286.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.8, pimcore/pimcore)
- [CVE-2023-20049](https://cve.now/CVE-2023-20049.md): Cisco IOS XR Software for ASR 9000 Series Routers Bidirectional Forwarding Detection Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XR Software)
- [CVE-2023-20064](https://cve.now/CVE-2023-20064.md): Cisco IOS XR Software Bootloader Unauthenticated Information Disclosure Vulnerability (CVSS 4.6, Cisco IOS XR Software)
- [CVE-2023-26948](https://cve.now/CVE-2023-26948.md): onekeyadmin v1.3.9 was discovered to contain an arbitrary file read vulnerability via the component /admin1/file/download. (CVSS 7.5)
- [CVE-2023-26957](https://cve.now/CVE-2023-26957.md): onekeyadmin v1.3.9 was discovered to contain an arbitrary file delete vulnerability via the component \\admin\\controller\\plugins. (CVSS 9.1)
- [CVE-2023-27202](https://cve.now/CVE-2023-27202.md): Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/receipt.php. (CVSS 9.8)
- [CVE-2023-27203](https://cve.now/CVE-2023-27203.md): Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /billing/home.php. (CVSS 9.8)
- [CVE-2023-27204](https://cve.now/CVE-2023-27204.md): Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /kruxton/manage\_user.php. (no CVSS)
- [CVE-2023-27205](https://cve.now/CVE-2023-27205.md): Best POS Management System 1.0 was discovered to contain a SQL injection vulnerability via the month parameter at /kruxton/sales\_report.php. (no CVSS)
- [CVE-2023-27206](https://cve.now/CVE-2023-27206.md): A cross-site scripting (XSS) vulnerability in /kruxton/navbar.php of Best POS Management System 1.0 allows attackers to execute arbitrary we (no CVSS)
- [CVE-2023-27207](https://cve.now/CVE-2023-27207.md): Online Pizza Ordering System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/manage\_user.php. (no CVSS)
- [CVE-2023-27208](https://cve.now/CVE-2023-27208.md): A cross-site scripting (XSS) vulnerability in /php-opos/login.php of Online Pizza Ordering System 1.0 allows attackers to execute arbitrary (no CVSS)
- [CVE-2023-27210](https://cve.now/CVE-2023-27210.md): Online Pizza Ordering System 1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/view\_order.php. (no CVSS)
- [CVE-2023-27211](https://cve.now/CVE-2023-27211.md): A cross-site scripting (XSS) vulnerability in /admin/navbar.php of Online Pizza Ordering System 1.0 allows attackers to execute arbitrary we (no CVSS)
- [CVE-2023-27212](https://cve.now/CVE-2023-27212.md): A cross-site scripting (XSS) vulnerability in /php-opos/signup.php of Online Pizza Ordering System 1.0 allows attackers to execute arbitrary (no CVSS)
- [CVE-2023-27213](https://cve.now/CVE-2023-27213.md): Online Student Management System v1.0 was discovered to contain a SQL injection vulnerability via the searchdata parameter at /eduauth/stude (no CVSS)
- [CVE-2023-27214](https://cve.now/CVE-2023-27214.md): Online Student Management System v1.0 was discovered to contain multiple SQL injection vulnerabilities via the fromdate and todate parameter (no CVSS)
- [CVE-2023-27985](https://cve.now/CVE-2023-27985.md): emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to shell command injections through a crafted mailto: URI. (CVSS 7.8)
- [CVE-2023-27986](https://cve.now/CVE-2023-27986.md): emacsclient-mail.desktop in Emacs 28.1 through 28.2 is vulnerable to Emacs Lisp code injections through a crafted mailto: URI with unescaped (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.