CVEs published March 10, 2023
69 CVEs were published on March 10, 2023: 6 critical, 13 high. 1 is now in CISA KEV.
- Published
- 69
- Critical
- 6
- High
- 13
- Medium
- 40
- Low
- 2
- Unrated
- 8
- Now in CISA KEV
- 1
- Fix available
- 16
Most affected products
- shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- 14
- osticket/osticket
- 6
- NETGEAR Nighthawk WiFi6 Router
- 5
- OpenHarmony
- 5
- SourceCodester Online Graduate Tracer System
- 3
- wabt
- 3
- lmxcms
- 2
- Saysis Starcities
- 2
- @stoqey/gnuplot
- 1
- Ad Blocking Detector Plugin
- 1
Critical 6
- CVE-2023-1198SQLi in Saysis StarcitiesSaysis Starcities
- CVE-2023-1091SQL Injection found in ALPATA's Licensed Warehousing Automation SystemAlpata Licensed Warehousing Automation System
- CVE-2023-1307Authentication Bypass by Primary Weakness in froxlor/froxlorfroxlor/froxlor
- CVE-2023-24774Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \controller\auth\Auth.php.funadmin/funadmin
- CVE-2023-27852NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a buffer overflow vulnerability in various CGI mechanisms that could allow an atNETGEAR Nighthawk WiFi6 Router
- CVE-2023-27853NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to NETGEAR Nighthawk WiFi6 Router
High 13
- CVE-2023-26464Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppenderApache Software Foundation Apache Log4j · org.apache.log… +1
- CVE-2023-1246Files or Directories Accessible to External Parties in Saysis StarcitiesSaysis Starcities
- CVE-2023-22436The kernel subsystem function check_permission_for_set_tokenid has an UAF vulnerability.OpenHarmony
- CVE-2021-27788HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerabilityHCL Software Verse
- CVE-2023-1205NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 is vulnerable to cross-site request forgery attacks on all endpoints due to improperly imNETGEAR Nighthawk WiFi6 Router
- CVE-2023-1313Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpitcockpit-hq/cockpit
- CVE-2023-1320Cross-site Scripting (XSS) - Stored in osticket/osticketosticket/osticket
- CVE-2023-23328A File Upload vulnerability exists in AvantFAX 3.3.7.
- CVE-2023-26075An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 22
- CVE-2023-27161Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories.
- CVE-2023-27530A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could alhttps://github.com/rack/rack · rack
- CVE-2023-27532Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained.Veeam Backup & Replication
- CVE-2023-27851NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that unintentionally allows users with upload permissioNETGEAR Nighthawk WiFi6 Router
Medium, low and unrated 50
- CVE-2023-24999Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy OperationHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-27577Path Traversal Vulnerability in `LESS` Parser allows reading of sensitive server files in flarumflarum framework · flarum/core
- CVE-2023-1335RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ucss_connect'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1338RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'attach_rule'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1337RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'clear_uucss_logs'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1336RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'ajax_deactivate'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1339RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'uucss_update_rule'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1346RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'clear_page_cache'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1345RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'queue_posts'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1344RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'uucss_update_rule'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1343RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'attach_rule'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1342RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'ucss_connect'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1341RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'ajax_deactivate'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1340RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgery via 'clear_uucss_logs'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1334RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'queue_posts'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1333RapidLoad Power-Up for Autoptimize <= 1.7.1 - Missing Authorization in 'clear_page_cache'shakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-1328Guizhou 115cms index unrestricted uploadGuizhou 115cms
- CVE-2023-1322lmxcms BookAction.class.php reply sql injectionlmxcms
- CVE-2023-1321lmxcms AcquisiAction.class.php update sql injectionlmxcms
- CVE-2023-25947The bundle management subsystem has a improper input validation when installing a HAP package.OpenHarmony
- CVE-2023-24465Communication Wi-Fi subsystem has a null pointer reference vulnerability when receving external data.OpenHarmony
- CVE-2023-22301The kernel subsystem hmdfs has a arbitrary memory accessing vulnerability.OpenHarmony
- CVE-2023-0083The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access.OpenHarmony
- CVE-2023-1311SourceCodester Friendly Island Pizza Website and Ordering System GET Parameter large.php sql injectionSourceCodester Friendly Island Pizza Website and Ordering S…
- CVE-2023-1310SourceCodester Online Graduate Tracer System prof.php sql injectionSourceCodester Online Graduate Tracer System
- CVE-2023-1309SourceCodester Online Graduate Tracer System search_it.php sql injectionSourceCodester Online Graduate Tracer System
- CVE-2023-1308SourceCodester Online Graduate Tracer System adminlog.php sql injectionSourceCodester Online Graduate Tracer System
- CVE-2017-20182Mobile Vikings Django AJAX Utilities Backslash pagination.js Pagination cross site scriptingMobile Vikings Django AJAX Utilities · django-ajax-utilities
- CVE-2014-125093Ad Blocking Detector Plugin ad-blocking-detector.php information disclosureAd Blocking Detector Plugin
- CVE-2013-10020MMDeveloper A Forms Plugin a-forms.php cross site scriptingMMDeveloper A Forms Plugin
- CVE-2021-33360An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child_pro@stoqey/gnuplot
- CVE-2022-44574An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties onIvanti Avalanche
- CVE-2022-48111A cross-site scripting (XSS) vulnerability in the check_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attacker
- CVE-2023-0746XSS Vulnerability in GigaVue-FMGigamon GigaVUE-FM
- CVE-2023-1312Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore
- CVE-2023-1315Cross-site Scripting (XSS) - Reflected in osticket/osticketosticket/osticket
- CVE-2023-1316Cross-site Scripting (XSS) - Stored in osticket/osticketosticket/osticket
- CVE-2023-1317Cross-site Scripting (XSS) - Reflected in osticket/osticketosticket/osticket
- CVE-2023-1318Cross-site Scripting (XSS) - Generic in osticket/osticketosticket/osticket
- CVE-2023-1319Cross-site Scripting (XSS) - Stored in osticket/osticketosticket/osticket
- CVE-2023-23326A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7.
- CVE-2023-23327An Information Disclosure vulnerability exists in AvantFAX 3.3.7.
- CVE-2023-23911An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a useRocket.Chat
- CVE-2023-27114radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm_dis at p/wasm/wasm.c.
- CVE-2023-27115WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat_compute_size.wabt
- CVE-2023-27116WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType.
- CVE-2023-27117WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator.wabt
- CVE-2023-27119WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild.wabt
- CVE-2023-27164An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file.
- CVE-2023-27850NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a file sharing mechanism that allows users with access to this feature to accessNETGEAR Nighthawk WiFi6 Router