# CVEs published 2023-03-10 69 CVEs were published on March 10, 2023: 6 critical, 13 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2023-24999](https://cve.now/CVE-2023-24999.md): Vault Fails to Verify if the AppRole SecretID Belongs to Role During a Destroy Operation (CVSS 4.4, HashiCorp Vault · github.com/hashicorp/vault) - [CVE-2023-27577](https://cve.now/CVE-2023-27577.md): Path Traversal Vulnerability in \`LESS\` Parser allows reading of sensitive server files in flarum (CVSS 6.6, flarum framework · flarum/core) - [CVE-2023-1335](https://cve.now/CVE-2023-1335.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Missing Authorization in 'ucss\_connect' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1338](https://cve.now/CVE-2023-1338.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Missing Authorization in 'attach\_rule' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1337](https://cve.now/CVE-2023-1337.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Missing Authorization in 'clear\_uucss\_logs' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1336](https://cve.now/CVE-2023-1336.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Missing Authorization in 'ajax\_deactivate' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1339](https://cve.now/CVE-2023-1339.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Missing Authorization in 'uucss\_update\_rule' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1346](https://cve.now/CVE-2023-1346.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Cross-Site Request Forgery via 'clear\_page\_cache' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1345](https://cve.now/CVE-2023-1345.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Cross-Site Request Forgery via 'queue\_posts' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1344](https://cve.now/CVE-2023-1344.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Cross-Site Request Forgery via 'uucss\_update\_rule' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1343](https://cve.now/CVE-2023-1343.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Cross-Site Request Forgery via 'attach\_rule' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1342](https://cve.now/CVE-2023-1342.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Cross-Site Request Forgery via 'ucss\_connect' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1341](https://cve.now/CVE-2023-1341.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Cross-Site Request Forgery via 'ajax\_deactivate' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1340](https://cve.now/CVE-2023-1340.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Cross-Site Request Forgery via 'clear\_uucss\_logs' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1334](https://cve.now/CVE-2023-1334.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Missing Authorization in 'queue\_posts' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1333](https://cve.now/CVE-2023-1333.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Missing Authorization in 'clear\_page\_cache' (CVSS 4.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically) - [CVE-2023-1328](https://cve.now/CVE-2023-1328.md): Guizhou 115cms index unrestricted upload (CVSS 4.7, Guizhou 115cms) - [CVE-2023-1322](https://cve.now/CVE-2023-1322.md): lmxcms BookAction.class.php reply sql injection (CVSS 6.3, lmxcms) - [CVE-2023-1321](https://cve.now/CVE-2023-1321.md): lmxcms AcquisiAction.class.php update sql injection (CVSS 6.3, lmxcms) - [CVE-2023-26464](https://cve.now/CVE-2023-26464.md): Apache Log4j 1.x (EOL) allows DoS in Chainsaw and SocketAppender (CVSS 7.5, Apache Software Foundation Apache Log4j · org.apache.log… +1) - [CVE-2023-1246](https://cve.now/CVE-2023-1246.md): Files or Directories Accessible to External Parties in Saysis Starcities (CVSS 7.5, Saysis Starcities) - [CVE-2023-1198](https://cve.now/CVE-2023-1198.md): SQLi in Saysis Starcities (CVSS 9.8, Saysis Starcities) - [CVE-2023-25947](https://cve.now/CVE-2023-25947.md): The bundle management subsystem has a improper input validation when installing a HAP package. (CVSS 6.2, OpenHarmony) - [CVE-2023-24465](https://cve.now/CVE-2023-24465.md): Communication Wi-Fi subsystem has a null pointer reference vulnerability when receving external data. (CVSS 5.5, OpenHarmony) - [CVE-2023-22436](https://cve.now/CVE-2023-22436.md): The kernel subsystem function check\_permission\_for\_set\_tokenid has an UAF vulnerability. (CVSS 7.8, OpenHarmony) - [CVE-2023-22301](https://cve.now/CVE-2023-22301.md): The kernel subsystem hmdfs has a arbitrary memory accessing vulnerability. (CVSS 6.5, OpenHarmony) - [CVE-2023-0083](https://cve.now/CVE-2023-0083.md): The ArkUI framework subsystem doesn't check the input parameter,causing type confusion and invalid memory access. (CVSS 4.0, OpenHarmony) - [CVE-2023-1311](https://cve.now/CVE-2023-1311.md): SourceCodester Friendly Island Pizza Website and Ordering System GET Parameter large.php sql injection (CVSS 6.3, SourceCodester Friendly Island Pizza Website and Ordering S…) - [CVE-2023-1310](https://cve.now/CVE-2023-1310.md): SourceCodester Online Graduate Tracer System prof.php sql injection (CVSS 6.3, SourceCodester Online Graduate Tracer System) - [CVE-2023-1309](https://cve.now/CVE-2023-1309.md): SourceCodester Online Graduate Tracer System search\_it.php sql injection (CVSS 6.3, SourceCodester Online Graduate Tracer System) - [CVE-2023-1308](https://cve.now/CVE-2023-1308.md): SourceCodester Online Graduate Tracer System adminlog.php sql injection (CVSS 6.3, SourceCodester Online Graduate Tracer System) - [CVE-2023-1091](https://cve.now/CVE-2023-1091.md): SQL Injection found in ALPATA's Licensed Warehousing Automation System (CVSS 9.8, Alpata Licensed Warehousing Automation System) - [CVE-2021-27788](https://cve.now/CVE-2021-27788.md): HCL Verse is susceptible to a Cross Site Scripting (XSS) vulnerability (CVSS 8.3, HCL Software Verse) - [CVE-2017-20182](https://cve.now/CVE-2017-20182.md): Mobile Vikings Django AJAX Utilities Backslash pagination.js Pagination cross site scripting (CVSS 3.5, Mobile Vikings Django AJAX Utilities · django-ajax-utilities) - [CVE-2014-125093](https://cve.now/CVE-2014-125093.md): Ad Blocking Detector Plugin ad-blocking-detector.php information disclosure (CVSS 4.3, Ad Blocking Detector Plugin) - [CVE-2013-10020](https://cve.now/CVE-2013-10020.md): MMDeveloper A Forms Plugin a-forms.php cross site scripting (CVSS 3.5, MMDeveloper A Forms Plugin) - [CVE-2021-33360](https://cve.now/CVE-2021-33360.md): An issue found in Stoqey gnuplot v.0.0.3 and earlier allows attackers to execute arbitrary code via the src/index.ts, plotCallack, child\_pro (no CVSS, @stoqey/gnuplot) - [CVE-2022-44574](https://cve.now/CVE-2022-44574.md): An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on (no CVSS, Ivanti Avalanche) - [CVE-2022-48111](https://cve.now/CVE-2022-48111.md): A cross-site scripting (XSS) vulnerability in the check\_login function of SIPE s.r.l WI400 between version 8 and 11 included allows attacker (CVSS 6.1) - [CVE-2023-0746](https://cve.now/CVE-2023-0746.md): XSS Vulnerability in GigaVue-FM (CVSS 6.3, Gigamon GigaVUE-FM) - [CVE-2023-1205](https://cve.now/CVE-2023-1205.md): NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 is vulnerable to cross-site request forgery attacks on all endpoints due to improperly im (CVSS 8.8, NETGEAR Nighthawk WiFi6 Router) - [CVE-2023-1307](https://cve.now/CVE-2023-1307.md): Authentication Bypass by Primary Weakness in froxlor/froxlor (CVSS 9.8, froxlor/froxlor) - [CVE-2023-1312](https://cve.now/CVE-2023-1312.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 5.2, pimcore/pimcore) - [CVE-2023-1313](https://cve.now/CVE-2023-1313.md): Unrestricted Upload of File with Dangerous Type in cockpit-hq/cockpit (CVSS 7.2, cockpit-hq/cockpit) - [CVE-2023-1315](https://cve.now/CVE-2023-1315.md): Cross-site Scripting (XSS) - Reflected in osticket/osticket (CVSS 5.4, osticket/osticket) - [CVE-2023-1316](https://cve.now/CVE-2023-1316.md): Cross-site Scripting (XSS) - Stored in osticket/osticket (CVSS 4.5, osticket/osticket) - [CVE-2023-1317](https://cve.now/CVE-2023-1317.md): Cross-site Scripting (XSS) - Reflected in osticket/osticket (CVSS 5.4, osticket/osticket) - [CVE-2023-1318](https://cve.now/CVE-2023-1318.md): Cross-site Scripting (XSS) - Generic in osticket/osticket (CVSS 5.4, osticket/osticket) - [CVE-2023-1319](https://cve.now/CVE-2023-1319.md): Cross-site Scripting (XSS) - Stored in osticket/osticket (CVSS 4.8, osticket/osticket) - [CVE-2023-1320](https://cve.now/CVE-2023-1320.md): Cross-site Scripting (XSS) - Stored in osticket/osticket (CVSS 7.1, osticket/osticket) - [CVE-2023-23326](https://cve.now/CVE-2023-23326.md): A Stored Cross-Site Scripting (XSS) vulnerability exists in AvantFAX 3.3.7. (CVSS 5.4) - [CVE-2023-23327](https://cve.now/CVE-2023-23327.md): An Information Disclosure vulnerability exists in AvantFAX 3.3.7. (CVSS 4.9) - [CVE-2023-23328](https://cve.now/CVE-2023-23328.md): A File Upload vulnerability exists in AvantFAX 3.3.7. (CVSS 8.8) - [CVE-2023-23911](https://cve.now/CVE-2023-23911.md): An improper access control vulnerability exists prior to v6 that could allow an attacker to break the E2E encryption of a chat room by a use (no CVSS, Rocket.Chat) - [CVE-2023-24774](https://cve.now/CVE-2023-24774.md): Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \\controller\\auth\\Auth.php. (CVSS 9.8, funadmin/funadmin) - [CVE-2023-26075](https://cve.now/CVE-2023-26075.md): An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 22 (CVSS 7.6) - [CVE-2023-27114](https://cve.now/CVE-2023-27114.md): radare2 v5.8.3 was discovered to contain a segmentation fault via the component wasm\_dis at p/wasm/wasm.c. (CVSS 5.5) - [CVE-2023-27115](https://cve.now/CVE-2023-27115.md): WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::cat\_compute\_size. (no CVSS, wabt) - [CVE-2023-27116](https://cve.now/CVE-2023-27116.md): WebAssembly v1.0.29 discovered to contain an abort in CWriter::MangleType. (no CVSS) - [CVE-2023-27117](https://cve.now/CVE-2023-27117.md): WebAssembly v1.0.29 was discovered to contain a heap overflow via the component component wabt::Node::operator. (no CVSS, wabt) - [CVE-2023-27119](https://cve.now/CVE-2023-27119.md): WebAssembly v1.0.29 was discovered to contain a segmentation fault via the component wabt::Decompiler::WrapChild. (CVSS 5.5, wabt) - [CVE-2023-27161](https://cve.now/CVE-2023-27161.md): Jellyfin up to v10.7.7 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /Repositories. (CVSS 7.5) - [CVE-2023-27164](https://cve.now/CVE-2023-27164.md): An arbitrary file upload vulnerability in Halo up to v1.6.1 allows attackers to execute arbitrary code via a crafted .md file. (no CVSS) - [CVE-2023-27530](https://cve.now/CVE-2023-27530.md): A DoS vulnerability exists in Rack \