CVEs published March 14, 2023
161 CVEs were published on March 14, 2023: 13 critical, 70 high. 2 are now in CISA KEV.
- Published
- 161
- Critical
- 13
- High
- 70
- Medium
- 65
- Low
- 7
- Unrated
- 6
- Now in CISA KEV
- 2
- Fix available
- 84
Most affected products
- Microsoft Windows
- 50
- Siemens Tecnomatix Plant Simulation
- 9
- Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- 8
- Microsoft Dynamics 365 (on-premises)
- 6
- Siemens RUGGEDCOM CROSSBOW
- 4
- Firmanet Software and Technology Customer Relation Manager
- 3
- SAP BusinessObjects Business Intelligence Platform
- 3
- SAP NetWeaver AS for ABAP and ABAP Platform
- 3
- Combodo iTop
- 2
- HashiCorp Nomad · github.com/hashicorp/nomad
- 2
Critical 13
- CVE-2023-23415Internet Control Message Protocol (ICMP) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-21708Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-23397Microsoft Outlook Elevation of Privilege VulnerabilityMicrosoft Office LTSC · Microsoft Outlook +2
- CVE-2023-23392HTTP Protocol Stack Remote Code Execution VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2022-39214Authenticated users of Combodo iTop can take over any accountCombodo iTop
- CVE-2023-25589Unauthenticated Arbitrary User Creation Leads to Complete System CompromiseHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2023-25957A vulnerability has been identified in Mendix SAML (Mendix 7 compatible) (All versions >= V1.16.4 < V1.17.3), Mendix SAML (Mendix 8 compatibSiemens Mendix SAML
- CVE-2023-27500Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP PlatformNetWeaver AS for ABAP and ABAP Platform
- CVE-2023-27269Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP PlatformSAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2023-25617OS Command Execution vulnerability in SAP Business Objects Business Intelligence Platform (Adaptive Job Server)SAP Business Objects · sap-ai-sdk-base
- CVE-2023-25616Code Injection vulnerability in SAP Business Objects Business Intelligence Platform (CMC)SAP Business Objects Business Intelligence Platform
- CVE-2023-23857Improper Access Control in SAP NetWeaver AS for JavaSAP NetWeaver AS for Java
- CVE-2023-26511A Hard Coded Admin Credentials issue in the Web-UI Admin Panel in Propius MachineSelector 6.6.0 and 6.6.1 allows remote attackers to gain ac
High 70
- CVE-2023-27590Rizin has stack-based buffer overflow when parsing GDB registers profile filesrizinorg rizin
- CVE-2023-27588Unauthenticated path traversal vulnerability in Hasura GraphQL Enginehasura graphql-engine
- CVE-2023-24892Microsoft Edge (Chromium-based) Webview2 Spoofing VulnerabilityMicrosoft Edge
- CVE-2023-24876Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24913Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24872Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24871Windows Bluetooth Service Remote Code Execution VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2023-24910Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows · Microsoft Office 2019 for Mac +3
- CVE-2023-24909Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24869Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24908Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24868Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24907Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24867Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24864Microsoft PostScript and PCL6 Class Printer Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-24861Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-24859Windows Internet Key Exchange (IKE) Extension Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-24858Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-23423Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23422Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23421Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23420Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23419Windows Resilient File System (ReFS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23418Windows Resilient File System (ReFS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23417Windows Partition Management Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23416Windows Cryptographic Services Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-23414Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-23413Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-23412Windows Accounts Picture Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23410Windows HTTP.sys Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23407Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-23406Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-23405Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-23404Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-23402Windows Media Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-23401Windows Media Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-23400Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-24930Microsoft OneDrive for MacOS Elevation of Privilege VulnerabilityMicrosoft OneDrive for MacOS Installer
- CVE-2023-24856Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-23403Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-23399Microsoft Excel Remote Code Execution VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2023-23398Microsoft Excel Spoofing VulnerabilityMicrosoft Office · Microsoft 365 Apps for Enterprise +1
- CVE-2023-23393Windows BrokerInfrastructure Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23388Windows Bluetooth Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23385Windows Point-to-Point Protocol over Ethernet (PPPoE) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23383Service Fabric Explorer Spoofing VulnerabilityMicrosoft Azure Service Fabric 9.0 for Linux · Microsoft… +2
- CVE-2022-39216Combodo iTop's weak password reset token leads to account takeoverCombodo iTop
- CVE-2023-25593Reflected Cross Site Scripting Vulnerabilities (XSS) in ClearPass Policy Manager Web-Based Management InterfaceHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2023-25592Reflected Cross Site Scripting Vulnerabilities (XSS) in ClearPass Policy Manager Web-Based Management InterfaceHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2023-25591Authenticated Information Disclosure in ClearPass Policy Manager Web-Based Management InterfaceHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2023-25590Local Privilege Escalation in ClearPass OnGuard Linux AgentHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2023-1299Nomad Job Submitter Privilege Escalation Using Workload IdentityHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2023-27463A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3).Siemens RUGGEDCOM CROSSBOW
- CVE-2023-27406A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006).Siemens Tecnomatix Plant Simulation
- CVE-2023-27405A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006).Siemens Tecnomatix Plant Simulation
- CVE-2023-27404A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006).Siemens Tecnomatix Plant Simulation
- CVE-2023-27403A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006).Siemens Tecnomatix Plant Simulation
- CVE-2023-27402A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006).Siemens Tecnomatix Plant Simulation
- CVE-2023-27401A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006).Siemens Tecnomatix Plant Simulation
- CVE-2023-27400A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006).Siemens Tecnomatix Plant Simulation
- CVE-2023-27399A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006).Siemens Tecnomatix Plant Simulation
- CVE-2023-27398A vulnerability has been identified in Tecnomatix Plant Simulation (All versions < V2201.0006).Siemens Tecnomatix Plant Simulation
- CVE-2023-27893Arbitrary Code Execution in SAP Solution Manager and ABAP managed systems (ST-PI)SAP Solution Manager and ABAP managed systems
- CVE-2023-27501Directory Traversal vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform SAP NetWeaver AS for ABAP and ABAP Platform
- CVE-2023-27498Memory Corruption vulnerability in SAP Host Agent (SAPOSCOL)Host Agent
- CVE-2023-26459Server Side Request Forgery (SSRF) vulnerability in SAP NetWeaver AS for ABAP and ABAP PlatformSAP NetWeaver AS for ABAP and ABAP Platform
- CVE-2023-26262An issue was discovered in Sitecore XP/XM 10.3.
- CVE-2023-27585PJSIP is a free and open source multimedia communication library written in C.pjsip pjproject
- CVE-2023-28144KDAB Hotspot 1.3.x and 1.4.x through 1.4.1, in a non-default configuration, allows privilege escalation because of race conditions involving
- CVE-2023-28339OpenDoas through 6.8.2, when TIOCSTI is available, allows privilege escalation because of sharing a terminal with the original session.
Medium, low and unrated 78
- CVE-2023-28005A vulnerability in Trend Micro Endpoint Encryption Full Disk Encryption version 6.0.0.3204 and below could allow an attacker with physical aTrend Micro Endpoint Encryption Full Disk Encryption
- CVE-2023-27589Minio vulnerable to denial of access by an admin privileged user for root credentialminio
- CVE-2023-24890Microsoft OneDrive for iOS Security Feature Bypass VulnerabilityMicrosoft OneDrive for iOS
- CVE-2023-24880Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-24911Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-24870Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-24906Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-24866Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-24865Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-24863Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-24862Windows Secure Channel Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-24857Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-23411Windows Hyper-V Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-23409Client Server Run-Time Subsystem (CSRSS) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-23408Azure Apache Ambari Spoofing VulnerabilityMicrosoft Azure HDInsight
- CVE-2023-24891Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-24882Microsoft OneDrive for Android Information Disclosure VulnerabilityMicrosoft OneDrive for Android
- CVE-2023-24923Microsoft OneDrive for Android Information Disclosure VulnerabilityMicrosoft OneDrive for Android
- CVE-2023-24922Microsoft Dynamics 365 (On-Premises) Information Disclosure VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-24921Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-24920Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-24879Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-24919Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-23396Microsoft Excel Denial of Service VulnerabilityMicrosoft Office Online Server · Microsoft Office Web Apps…
- CVE-2023-23395Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2023-23394Client Server Run-Time Subsystem (CSRSS) Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-23391Office for Android Spoofing VulnerabilityMicrosoft Office for Android
- CVE-2023-23389Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Malware Protection Engine
- CVE-2023-1397SourceCodester Online Student Management System profile.php cross site scriptingSourceCodester Online Student Management System
- CVE-2023-25596Authenticated Sensitive Information Disclosure in ClearPass Policy ManagerHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2023-25595Sensitive Information Disclosure in ClearPass OnGuard Ubuntu AgentHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2023-25594Authorization Bypass Leading to Privilege Escalation in ClearPass Policy Manager Web-Based Management InterfaceHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2023-1296Nomad ACLs Can Not Deny Access to Workload's Own VariablesHashiCorp Nomad · github.com/hashicorp/nomad
- CVE-2023-1398XiaoBingBy TeaCMS upload path traversalXiaoBingBy TeaCMS
- CVE-2023-1396SourceCodester Online Tours & Travels Management System traveller_details.php cross site scriptingSourceCodester Online Tours & Travels Management System
- CVE-2023-1395SourceCodester Yoga Class Registration System list.php query cross site scriptingSourceCodester Yoga Class Registration System
- CVE-2023-1394SourceCodester Online Graduate Tracer System bsitemp.php mysqli_query sql injectionSourceCodester Online Graduate Tracer System
- CVE-2023-1392SourceCodester Online Pizza Ordering System save_menu unrestricted uploadSourceCodester Online Pizza Ordering System
- CVE-2023-1391SourceCodester Online Tours & Travels Management System ab.php unrestricted uploadSourceCodester Online Tours & Travels Management System
- CVE-2023-27462A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.3).Siemens RUGGEDCOM CROSSBOW
- CVE-2023-27310A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2).Siemens RUGGEDCOM CROSSBOW
- CVE-2023-27309A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.2).Siemens RUGGEDCOM CROSSBOW
- CVE-2022-47143WordPress Multiple Page Generator Plugin – MPG Plugin <= 3.3.9 is vulnerable to Cross Site Request Forgery (CSRF)Themeisle Multiple Page Generator Plugin – MPG
- CVE-2022-47141WordPress WP Dynamic Keywords Injector Plugin <= 2.3.15 is vulnerable to Cross Site Request Forgery (CSRF)Seerox WP Dynamic Keywords Injector
- CVE-2022-47422WordPress WordPress Stripe Donation and Payment Plugin Plugin <= 3.1.5 is vulnerable to Cross Site Request Forgery (CSRF)HM Plugin Accept Stripe Donation – AidWP
- CVE-2022-47147WordPress ipBlockList Plugin <= 1.0 is vulnerable to Cross Site Request Forgery (CSRF)Kesz1 Technologies ipBlockList
- CVE-2022-47443WordPress Multi Rating Plugin <= 5.0.5 is vulnerable to Cross Site Request Forgery (CSRF)Daniel Powney Multi Rating
- CVE-2022-23791XSS in Firmanet Software and Technology Customer Relation ManagerFirmanet Software and Technology Customer Relation Manager
- CVE-2022-23790XSS in Firmanet Software and Technology Customer Relation ManagerFirmanet Software and Technology Customer Relation Manager
- CVE-2021-4195XSS in Firmanet Software and Technology Customer Relation ManagerFirmanet Software and Technology Customer Relation Manager
- CVE-2022-47154WordPress CSS JS Manager Plugin <= 2.4.49 is vulnerable to Cross Site Request Forgery (CSRF)Pi Websolution CSS JS Manager, Async JavaScript, Defer Rend…
- CVE-2022-47155WordPress Slider by Supsystic Plugin <= 1.8.5 is vulnerable to Cross Site Request Forgery (CSRF)Slider by Supsystic
- CVE-2022-47162WordPress DH – Anti AdBlocker Plugin <= 36 is vulnerable to Cross Site Request Forgery (CSRF)Dannie Herdyawan DH – Anti AdBlocker
- CVE-2022-47163WordPress WP CSV to Database Plugin <= 2.6 is vulnerable to Cross Site Request Forgery (CSRF)Tips and Tricks HQ, josh401 WP CSV to Database – Insert CSV…
- CVE-2022-47171WordPress IP Vault – WP Firewall Plugin <= 1.1 is vulnerable to Cross Site Scripting (XSS)Paul C. Schroeder IP Vault – WP Firewall
- CVE-2022-47595WordPress WP Google Maps Plugin <= 9.0.15 is vulnerable to Path TraversalWP Go Maps
- CVE-2023-27895Information Disclosure vulnerability in SAP Authenticator for AndroidSAP Authenticator for Android
- CVE-2023-27894Sensitive Information Disclosure in the SAP BusinessObjects Business Intelligence platformSAP BusinessObjects Business Intelligence Platform
- CVE-2023-27896Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platformSAP BusinessObjects Business Intelligence Platform
- CVE-2023-27271Server Side Request Forgery (SSRF) in the SAP BusinessObjects Business Intelligence platformSAP BusinessObjects Business Intelligence Platform
- CVE-2023-27270Denial of Service (DoS) in SAP NetWeaver AS for ABAP and ABAP PlatformSAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2023-27268Improper Access Control in SAP NetWeaver AS Java (Object Analyzing Service)SAP NetWeaver AS Java
- CVE-2023-26461XML External Entity (XXE) vulnerability in SAP NetWeaver (SAP Enterprise Portal)NetWeaver
- CVE-2023-26460Improper Access Control in SAP NetWeaver AS Java (Cache Management Service)SAP NetWeaver AS for Java
- CVE-2023-26457Cross-Site Scripting (XSS) vulnerability in SAP Content ServerSAP Content Server
- CVE-2023-25618Denial of Service (DoS) vulnerability in SAP NetWeaver AS for ABAP and ABAP PlatformSAP NetWeaver AS for ABAP and ABAP Platform
- CVE-2023-25615SQL Injection vulnerability in SAP ABAP PlatformSAP ABAP Platform
- CVE-2023-24526Improper Access Control in SAP NetWeaver AS Java (Classload Service)SAP NetWeaver AS Java for Classload Service
- CVE-2023-0021Cross-Site Scripting (XSS) vulnerability in SAP NetWeaverSAP_SE SAP NetWeaver
- CVE-2023-1327Netgear RAX30 (AX2400), prior to version 1.0.6.74, was affected by an authentication bypass vulnerability, allowing an unauthenticated attacNetgear RAX30
- CVE-2023-24180Libelfin v0.3 was discovered to contain an integer overflow in the load function at elf/mmap_loader.cc.
- CVE-2023-24279A cross-site scripting (XSS) vulnerability in Open Networking Foundation ONOS from version v1.9.0 to v2.7.0 allows attackers to execute arbiorg.onosproject:onos-archetypes
- CVE-2023-25206PrestaShop ws_productreviews < 3.6.2 is vulnerable to SQL Injection.
- CVE-2023-27069A stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts o
- CVE-2023-27070A stored cross-site scripting (XSS) vulnerability in TotalJS OpenPlatform commit b80b09d allows attackers to execute arbitrary web scripts o
- CVE-2023-27073A Cross-Site Request Forgery (CSRF) in Online Food Ordering System v1.0 allows attackers to change user details and credentials via a crafte
- CVE-2023-27074BP Monitoring Management System v1.0 was discovered to contain a SQL injection vulnerability via the emailid parameter in the login page.
- CVE-2023-28343OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timez