CVEs published March 15, 2023
73 CVEs were published on March 15, 2023: 4 critical, 17 high. 2 are now in CISA KEV.
- Published
- 73
- Critical
- 4
- High
- 17
- Medium
- 27
- Low
- 4
- Unrated
- 21
- Now in CISA KEV
- 2
- Fix available
- 24
Most affected products
- opensips
- 11
- IBM Robotic Process Automation
- 3
- NETGEAR Nighthawk WiFi6 Router
- 2
- Simple Art Gallery
- 2
- SourceCodester Friendly Island Pizza Website and Ordering S…
- 2
- AFS Analytics
- 1
- Apache Software Foundation Apache Airflow · apache-airflow
- 1
- Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Porta…
- 1
- Ernest Marcinko Ajax Search Lite
- 1
- hap-wi roxy-wi
- 1
Critical 4
- CVE-2022-44580WordPress Plugin for Google Reviews Plugin <= 2.2.3 is vulnerable to SQL InjectionRichPlugins Plugin for Google Reviews
- CVE-2020-27507The Kamailio SIP before 5.5.0 server mishandles INVITE requests with duplicated fields and overlength tag, leading to a buffer overflow that
- CVE-2023-27239Tenda AX3 V16.03.12.11 was discovered to contain a stack overflow via the shareSpeed parameter at /goform/WifiGuestSet.
- CVE-2023-28461Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution.
High 17
- CVE-2023-28097OpenSIPS has vulnerability in the Content-Length Parseropensips
- CVE-2023-28095OpenSIPS has vulnerability in the building the local negative repliesopensips
- CVE-2023-27601OpenSIPS has vulnerability in the codec_delete_XX() functionsopensips
- CVE-2023-27600OpenSIPS has vulnerability in the codec_delete_XX() functionsopensips
- CVE-2023-27599OpenSIPS has vulnerability in the parse_to_param() functionopensips
- CVE-2023-26484On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specskubevirt · kubevirt.io/kubevirt
- CVE-2023-27598OpenSIPS has vulnerability in the parse_via() functionopensips
- CVE-2023-27597OpenSIPS has vulnerability in the parse_uri() functionopensips
- CVE-2023-27596OpenSIPS has vulnerability in the codec_delete_XX() functionsopensips
- CVE-2023-25804Roxy-WI vulnerable to Limited Path Traversal in name parameterhap-wi roxy-wi
- CVE-2023-26284IBM MQ Certified Container improper access controlsIBM MQ Certified Container
- CVE-2022-4313A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy ConTenable.io, Tenable.sc and Nessus
- CVE-2023-1389TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form oTP-Link Archer AX21
- CVE-2023-24229DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system c
- CVE-2023-25345Directory traversal vulnerability in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to read arbitrary files via the includeswig-templates · swig
- CVE-2023-28450An issue was discovered in Dnsmasq before 2.90.
- CVE-2023-28466do_tls_getsockopt in net/tls/tls_main.c in the Linux kernel through 6.2.6 lacks a lock_sock call, leading to a race condition (with a result
Medium, low and unrated 52
- CVE-2023-1421Reflected XSS in OAuth flow completion endpointsMattermost
- CVE-2023-28099OpenSIPS has vulnerability in the ds_is_in_list() functionopensips
- CVE-2023-28098OpenSIPS has vulnerability in the Digest Authentication Parseropensips
- CVE-2023-28096OpenSIPS has memory leak in cJSON libopensips
- CVE-2023-22591IBM Robotic Process Automation session fixationIBM Robotic Process Automation
- CVE-2022-46773IBM Robotic Process Automation security bypassIBM Robotic Process Automation
- CVE-2023-25680IBM Robotic Process Automation information disclosureIBM Robotic Process Automation
- CVE-2020-4556IBM Financial Transaction Manager information disclosureIBM Financial Transaction Manager
- CVE-2023-22876IBM Sterling B2B Integrator information disclosureIBM Sterling B2B Integrator
- CVE-2022-46774IBM Manage Application security bypassIBM Manage Application
- CVE-2020-4927IBM Spectrum Scale information disclosureIBM Spectrum Scale
- CVE-2022-43874IBM App Connect Enterprise Certified ContainerIBM App Connect Enterprise Certified Container
- CVE-2022-37940Potential security vulnerabilities have been identified in the HPE FlexFabric 5700 Switch Series.Hewlett Packard Enterprise (HPE) HPE FlexFabric 5700 Switch…
- CVE-2023-1418SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter cashconfirm.php cross site scriptingSourceCodester Friendly Island Pizza Website and Ordering S…
- CVE-2023-1416Simple Art Gallery adminHome.php sql injectionSimple Art Gallery
- CVE-2023-1379SourceCodester Friendly Island Pizza Website and Ordering System POST Parameter addmem.php sql injectionSourceCodester Friendly Island Pizza Website and Ordering S…
- CVE-2022-37402WordPress AFS Analytics Plugin <= 4.18 is vulnerable to Cross Site Scripting (XSS)AFS Analytics
- CVE-2023-1415Simple Art Gallery adminHome.php sliderPicSubmit unrestricted uploadSimple Art Gallery
- CVE-2022-34148WordPress Backup Guard Plugin <= 1.6.9.0 is vulnerable to Cross Site Scripting (XSS)JetBackup – WP Backup, Migrate & Restore
- CVE-2022-38456WordPress Ajax Search Lite Plugin <= 4.10.3 is vulnerable to Sensitive Data ExposureErnest Marcinko Ajax Search Lite
- CVE-2023-0322XSS in Talent Software UNISTalent Software UNIS
- CVE-2022-47427WordPress My Calendar Plugin <= 3.3.24.1 is vulnerable to Cross Site Request Forgery (CSRF)Joseph C Dolson My Calendar
- CVE-2023-25708WordPress WP VR – 360 Panorama and Virtual Tour Builder For WordPress Plugin <= 8.2.7 is vulnerable to Cross Site Request Forgery (CSRF)Rextheme WP VR – 360 Panorama and Virtual Tour Builder For…
- CVE-2023-25709WordPress Locatoraid Store Locator Plugin <= 3.9.11 is vulnerable to Cross Site Request Forgery (CSRF)Plainware Locatoraid Store Locator
- CVE-2023-25968WordPress Client Portal – Private user pages and login Plugin <= 1.1.8 is vulnerable to Cross Site Request Forgery (CSRF)Cozmoslabs, Madalin Ungureanu, Antohe Cristian Client Porta…
- CVE-2023-25695Information disclosure in Apache AirflowApache Software Foundation Apache Airflow · apache-airflow
- CVE-2023-1407SourceCodester Student Study Center Desk Management System manage_user.php sql injectionSourceCodester Student Study Center Desk Management System
- CVE-2022-45155obs-service-go_modules: arbitrary directory deleteopenSUSE Factory
- CVE-2023-0100In Eclipse BIRT, starting from version 2.6.2, the default configuration allowed to retrieve a report from the same host using an absolute HTThe Eclipse Foundation Eclipse BIRT · org.eclipse.birt:org.…
- CVE-2023-24468Broken access control in Advanced Authentication versions prior to 6.4.1.1 and 6.3.7.2NetIQ Advanced Authentication
- CVE-2023-24726Art Gallery Management System v1.0 was discovered to contain a SQL injection vulnerability via the viewid parameter on the enquiry page.
- CVE-2023-24728Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the contact parameter in the
- CVE-2023-24729Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the address parameter in the
- CVE-2023-24730Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the company parameter in the
- CVE-2023-24731Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the query parameter in the us
- CVE-2023-24732Simple Customer Relationship Management System v1.0 as discovered to contain a SQL injection vulnerability via the gender parameter in the u
- CVE-2023-25267An issue was discovered in GFI Kerio Connect 9.4.1 patch 1 (fixed in 10.0.0).
- CVE-2023-25282A heap overflow vulnerability in D-Link DIR820LA1_FW106B02 allows attackers to cause a denial of service via the config.log_to_syslog and lo
- CVE-2023-25344An issue was discovered in swig-templates thru 2.0.4 and swig thru 1.4.2, allows attackers to execute arbitrary code via crafted Object.prot
- CVE-2023-26084The armv8_dec_aes_gcm_full() API of Arm AArch64cryptolib before 86065c6 fails to the verify the authentication tag of AES-GCM protected data
- CVE-2023-26912Cross site scripting (XSS) vulnerability in xenv S-mall-ssm thru commit 3d9e77f7d80289a30f67aaba1ae73e375d33ef71 on Feb 17, 2020, allows loc
- CVE-2023-27102Libde265 v1.0.11 was discovered to contain a segmentation violation via the function decoder_context::process_slice_segment_header at decctx
- CVE-2023-27103Libde265 v1.0.11 was discovered to contain a heap buffer overflow via the function derive_collocated_motion_vectors at motion.cc.
- CVE-2023-27234A Cross-Site Request Forgery (CSRF) in /Sys/index.html of Jizhicms v2.4.5 allows attackers to arbitrarily make configuration changes within
- CVE-2023-27235An arbitrary file upload vulnerability in the \admin\c\CommonController.php component of Jizhicms v2.4.5 allows attackers to execute arbitra
- CVE-2023-27240Tenda AX3 V16.03.12.11 was discovered to contain a command injection vulnerability via the lanip parameter at /goform/AdvSetLanip.
- CVE-2023-27757An arbitrary file upload vulnerability in the /admin/user/uploadImg component of PerfreeBlog v3.1.1 allows attackers to execute arbitrary co
- CVE-2023-27781jpegoptim v1.5.2 was discovered to contain a heap overflow in the optimize function at jpegoptim.c.
- CVE-2023-28337When uploading a firmware image to a Netgear Nighthawk Wifi6 Router (RAX30), a hidden “forceFWUpdate” parameter may be provided to force theNETGEAR Nighthawk WiFi6 Router
- CVE-2023-28338Any request send to a Netgear Nighthawk Wifi6 Router (RAX30)'s web service containing a “Content-Type” of “multipartboundary=” will result iNETGEAR Nighthawk WiFi6 Router
- CVE-2023-28371In Stellarium through 1.2, attackers can write to files that are typically unintended, such as ones with absolute pathnames or ..
- CVE-2023-28460A command injection vulnerability was discovered in Array Networks APV products.