CVEs published March 13, 2023
82 CVEs were published on March 13, 2023: 15 critical, 30 high.
- Published
- 82
- Critical
- 15
- High
- 30
- Medium
- 27
- Low
- 2
- Unrated
- 8
- Now in CISA KEV
- 0
- Fix available
- 28
Most affected products
- Akuvox E11
- 10
- Docker Desktop
- 2
- hap-wi roxy-wi
- 2
- Octopus Deploy Octopus Server
- 2
- SourceCodester Online Pizza Ordering System
- 2
- unilogies/bumsys
- 2
- 10Web Map Builder for Google Maps
- 1
- A2 Hosting A2 Optimized WP
- 1
- Akuvok E11
- 1
- alextselegidis/easyappointments
- 1
Critical 15
- CVE-2023-27582Full authentication bypass if SASL authorization username is specifiedfoxcpp maddy · github.com/foxcpp/maddy
- CVE-2023-27583Panindex uses hard coded cyptographic keypx-org PanIndex
- CVE-2023-0345CVE-2023-0345Akuvox E11
- CVE-2023-0352CVE-2023-0352Akuvox E11
- CVE-2023-0354CVE-2023-0354Akuvox E11
- CVE-2023-003710WebMapBuilder < 1.0.73 - Unauthenticated SQLi10Web Map Builder for Google Maps
- CVE-2022-38074WordPress WP Statistics Plugin <= 13.2.10 is vulnerable to SQL InjectionVeronaLabs WP Statistics
- CVE-2021-45423A Buffer Overflow vulnerabilityexists in Pev 0.81 via the pe_exports function from exports.c..
- CVE-2023-24762OS Command injection vulnerability in D-Link DIR-867 DIR_867_FW1.30B07 allows attackers to execute arbitrary commands via a crafted LocalIPA
- CVE-2023-25207PrestaShop dpdfrance <6.1.3 is vulnerable to SQL Injection via dpdfrance/ajax.php.
- CVE-2023-25279OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.
- CVE-2023-27052E-Commerce System v1.0 ws discovered to contain a SQL injection vulnerability via the id parameter at /admin/delete_user.php.
- CVE-2023-27061Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the wifiFilterListRemark parameter i
- CVE-2023-27063Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the DNSDomainName parameter in the f
- CVE-2023-28154Webpack 5 before 5.76.0 does not avoid cross-realm object access.webpack
High 30
- CVE-2023-0346CVE-2023-0346Akuvox E11
- CVE-2023-0347CVE-2023-0347Akuvox E11
- CVE-2023-0348CVE-2023-0348Akuvox E11
- CVE-2023-0349CVE-2023-0349Akuvox E11
- CVE-2023-0351CVE-2023-0351Akuvox E11
- CVE-2023-27581github-slug-action vulnerable to arbitrary code executionrlespinasse github-slug-action
- CVE-2023-0353CVE-2023-0353Akuvox E11
- CVE-2023-25802Roxy-WI has Path Traversal vulnerabilityhap-wi roxy-wi
- CVE-2023-27580CodeIgniter Shield Password Shucking Vulnerabilitycodeigniter4 shield · codeigniter4/shield
- CVE-2022-31474WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory TraversaliThemes BackupBuddy
- CVE-2023-1372WH Testimonials <= 3.0.0 - Unauthenticated Stored Cross-Site Scriptingwebhostings WH Testimonials
- CVE-2023-0629Docker Desktop before 4.17.0 allows an unprivileged user to bypass Enhanced Container Isolation restrictions via the raw Docker socket and launch privileged containersDocker Desktop
- CVE-2023-1370Stack exhaustion in json-smart leads to denial of service when parsing malformed JSONjson-smart · net.minidev:json-smart
- CVE-2023-1368XHCMS POST Parameter login.php sql injectionXHCMS
- CVE-2023-1365SourceCodester Online Pizza Ordering System ajax.php sql injectionSourceCodester Online Pizza Ordering System
- CVE-2023-1361 SQL Injection in unilogies/bumsysunilogies/bumsys
- CVE-2023-1362Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsysunilogies/bumsys
- CVE-2023-24033The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly chec
- CVE-2023-24579McAfee Total Protection prior to 16.0.51 allows attackers to trick a victim into uninstalling the application via the command prompt.
- CVE-2023-25283A stack overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the reserveDHCP_HostName_1.1.1
- CVE-2023-25803Roxy-WI is a Web interface for managing Haproxy, Nginx, Apache, and Keepalived servers.hap-wi roxy-wi
- CVE-2023-26072An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 22
- CVE-2023-26073An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 22
- CVE-2023-26074An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 850, Exynos 980, Exynos 1080, Exynos 1280, Exynos 22
- CVE-2023-26076An issue was discovered in Samsung Mobile Chipset and Baseband Modem Chipset for Exynos 1280, Exynos 2200, Exynos Modem 5123, Exynos Modem 5
- CVE-2023-27010Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst.
- CVE-2023-27062Tenda V15V1.0 was discovered to contain a buffer overflow vulnerability via the gotoUrl parameter in the formPortalAuth function.
- CVE-2023-27064Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the index parameter in the formDelDn
- CVE-2023-27065Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the picName parameter in the formDel
- CVE-2023-27587ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing sensitive informatiorozbb readtomyshoe
Medium, low and unrated 37
- CVE-2023-0350CVE-2023-0350Akuvox E11
- CVE-2023-0355CVE-2023-0355Akuvok E11
- CVE-2023-1378SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter paypalsuccess.php sql injectionSourceCodester Friendly Island Pizza Website and Ordering S…
- CVE-2023-0973Step Tools Third-PartyStep Tools v18SP1 ifcmesh library
- CVE-2023-25170PrestaShop has possible CSRF token fixationPrestaShop · prestashop/prestashop
- CVE-2022-4466WordPress Infinite Scroll - Ajax Load More < 5.6.0.3 - Contributor+ Stored XSSWordPress Infinite Scroll
- CVE-2023-0073Client Logo Carousel <= 3.0.0 - Contributor+ Stored XSSClient Logo Carousel
- CVE-2023-0219FluentSMTP < 2.2.3 - Stored XSS via Email LogsFluentSMTP
- CVE-2023-0844Namaste! LMS < 2.6 - Admin+ Stored XSSNamaste! LMS
- CVE-2022-4661Woo Products Widgets For Elementor < 1.0.8 - Contributor+ Stored XSS via ShortcodeWidgets for WooCommerce Products on Elementor
- CVE-2023-0538Campaign URL Builder < 1.8.2 - Contributor+ Stored XSSCampaign URL Builder
- CVE-2023-0172Juicer < 1.11 - Contributor+ Stored XSSEmbed, curate & aggregate social media feeds into your webs…
- CVE-2023-0749Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content DisclosureOcean Extra
- CVE-2023-0772Popup Builder by OptinMonster < 2.12.2 - Subscriber+ Arbitrary Post Content DisclosurePopup Builder by OptinMonster
- CVE-2022-4652Video Background < 2.7.5 - Contributor+ Stored XSS via ShortcodeVideo Background
- CVE-2023-0066Companion Sitemap Generator <= 4.5.1.1 - Contributor+ Stored XSSCompanion Sitemap Generator
- CVE-2023-0477Auto Featured Image < 3.9.16 - Author+ Arbitrary File UploadAuto Featured Image
- CVE-2023-25973WordPress Auto Affiliate Links Plugin <= 6.3.0.2 is vulnerable to Cross Site Request Forgery (CSRF)Lucian Apostol Auto Affiliate Links
- CVE-2023-23711WordPress A2 Optimized WP Plugin <= 3.0.4 is vulnerable to Cross Site Request Forgery (CSRF)A2 Hosting A2 Optimized WP
- CVE-2023-22700WordPress PixelYourSite – Your smart PIXEL (TAG) Manager Plugin <= 9.3.0 is vulnerable to Cross Site Request Forgery (CSRF)PixelYourSite – Your smart PIXEL (TAG) Manager
- CVE-2023-25991WordPress RegistrationMagic Plugin <= 5.1.9.2 is vulnerable to Cross Site Request Forgery (CSRF)RegistrationMagic
- CVE-2023-0978 A command injection vulnerability in Trellix Intelligent Sandbox CLI for version 5.2 and earlier, allows a local user to inject and executeTrellix Intelligent Sandbox
- CVE-2023-1374Solidres <= 0.9.4 - Authenticated (Admin+) Stored Cross-Site ScriptingSolidres – Hotel booking plugin for WordPress
- CVE-2023-0628Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URLDocker Desktop
- CVE-2022-47440WordPress My Tickets Plugin <= 1.9.10 is vulnerable to Cross Site Request Forgery (CSRF)Joseph C Dolson My Tickets
- CVE-2022-47166WordPress Void Contact Form 7 Widget For Elementor Page Builder Plugin <= 2.1.1 is vulnerable to Cross Site Request Forgery (CSRF)voidCoders Void Contact Form 7 Widget For Elementor Page Bu…
- CVE-2023-1369TG Soft Vir.IT eXplorer IoControlCode VIRAGTLT.sys 0x82730088 denial of serviceTG Soft Vir.IT eXplorer
- CVE-2023-1366SourceCodester Yoga Class Registration System manage_category.php query sql injectionSourceCodester Yoga Class Registration System
- CVE-2023-0888Authenticated eval injection in B. Braun Space Battery pack SP with Wi-Fi B. Braun Space Battery Pack SP with Wi-Fi
- CVE-2023-1364SourceCodester Online Pizza Ordering System GET Parameter category.php sql injectionSourceCodester Online Pizza Ordering System
- CVE-2023-1363SourceCodester Computer Parts Sales and Inventory System Add User Account cross site scriptingSourceCodester Computer Parts Sales and Inventory System
- CVE-2022-2258In affected versions of Octopus Deploy it is possible for a user to view Tagsets without being explicitly assigned permissions to view theseOctopus Deploy Octopus Server
- CVE-2022-2259In affected versions of Octopus Deploy it is possible for a user to view Workerpools without being explicitly assigned permissions to view tOctopus Deploy Octopus Server
- CVE-2023-1367 Code Injection in alextselegidis/easyappointmentsalextselegidis/easyappointments
- CVE-2023-24577McAfee Total Protection prior to 16.0.50 allows attackers to elevate user privileges due to Improper Link Resolution via registry keys.
- CVE-2023-24578McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading.
- CVE-2023-27093Cross Site Scripting vulnerability found in My-Blog allows attackers to cause a denial of service via the Post function.