CVEs published March 16, 2023
106 CVEs were published on March 16, 2023: 13 critical, 43 high. 1 is now in CISA KEV.
- Published
- 106
- Critical
- 13
- High
- 43
- Medium
- 35
- Low
- 3
- Unrated
- 12
- Now in CISA KEV
- 1
- Fix available
- 30
Most affected products
- Dell PowerEdge Platform
- 18
- Samsung Mobile Devices
- 11
- EIP Stack Group OpENer
- 3
- flatpak
- 2
- pimcore · pimcore/pimcore
- 2
- Zoom Video Communications Zoom (for Android, iOS, Linux, ma…
- 2
- ABB Pulsar Plus System Controller NE843_S · ABB Infinity DC…
- 1
- AVEVA Plant SCADA · AVEVA Telemetry Server
- 1
- cn.hippo4j:hippo4j-core
- 1
- dablelv go-huge-util · github.com/dablelv/go-huge-util
- 1
Critical 13
- CVE-2022-43605An out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer developmEIP Stack Group OpENer
- CVE-2022-43604An out-of-bounds write vulnerability exists in the GetAttributeList attribute_count_request functionality of EIP Stack Group OpENer developmEIP Stack Group OpENer
- CVE-2023-1256CVE-2023-1256AVEVA Plant SCADA · AVEVA Telemetry Server
- CVE-2023-0811 Omron CJ1M unit v4.0 and prior has improper access controls on the memory region where the UM password is stored.Omron CJ1M SYSMAC CJ-series · Omron CJ1M SYSMAC CS-series +1
- CVE-2023-28100TIOCLINUX can send commands outside sandbox if running on a virtual consoleflatpak
- CVE-2020-19947Cross Site Scripting vulnerability found in Markdown Edit allows a remote attacker to execute arbitrary code via the edit parameter of the w
- CVE-2020-22647An issue found in DepositGame v.1.0 allows an attacker to gain sensitive information via the GetBonusWithdraw and withdraw functions.
- CVE-2023-21456Path traversal vulnerability in Galaxy Themes Service prior to SMR Mar-2023 Release 1 allows attacker to access arbitrary file with system uSamsung Mobile Devices
- CVE-2023-23150SA-WR915ND router firmware v17.35.1 was discovered to be vulnerable to code execution.
- CVE-2023-25280OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with t
- CVE-2023-27040Simple Image Gallery v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the username parameter.
- CVE-2023-27041School Registration and Fee System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at/bilal final/edit_use
- CVE-2023-27250Online Book Store Project v1.0 is vulnerable to SQL Injection via /bookstore/bookPerPub.php.
High 43
- CVE-2022-43441A code execution vulnerability exists in the Statement Bindings functionality of Ghost Foundation node-sqlite3 5.1.1.Ghost Foundation node-sqlite3 · sqlite3
- CVE-2022-43606A use-of-uninitialized-pointer vulnerability exists in the Forward Open connection_management_entry functionality of EIP Stack Group OpENer EIP Stack Group OpENer
- CVE-2023-0598GE Digital Proficy Code InjectionGE Digital Proficy iFIX
- CVE-2023-28108Pimcore has improper quoting of columns when calling methods "getByUuid" & "exists" on UUID Modelpimcore · pimcore/pimcore
- CVE-2023-28105Go-huge-util vulnerable to path traversal when unzipping filesdablelv go-huge-util · github.com/dablelv/go-huge-util
- CVE-2023-28104silverstripe/graphql Denial of Service vulnerabilitysilverstripe-graphql · silverstripe/graphql
- CVE-2021-36821WordPress Forminator plugin <= 1.14.11 - Stored Cross-Site Scripting (XSS) vulnerabilityWPMU DEV Forminator
- CVE-2023-1432SourceCodester Online Food Ordering System POST Request access controlSourceCodester Online Food Ordering System
- CVE-2023-27875IBM Aspera Faspex improper access controlsIBM Aspera Faspex
- CVE-2022-34423 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34422 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34421 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34420 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34419 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34418 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34417 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34416 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34415 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34414 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34413 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34412 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34411 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34410 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34409 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34408 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34407 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2022-34406 Dell PowerEdge BIOS and Dell Precision BIOS contain an Improper SMM communication buffer verification vulnerability.Dell PowerEdge Platform
- CVE-2023-24571 Dell BIOS contains an Improper Input Validation vulnerability.Dell Embedded Box PC 3000 , CPG BIOS
- CVE-2021-31637An issue found in UwAmp v.1.1, 1.2, 1.3, 2.0, 2.1, 2.2, 2.2.1, 3.0.0, 3.0.1, 3.0.2 allows a remote attacker to execute arbitrary code via a
- CVE-2022-4009In affected versions of Octopus Deploy it is possible for a user to introduce code via offline package creationOctopus Deploy Octopus Server
- CVE-2023-1390A remote denial of service vulnerability was found in the Linux kernel’s TIPC kernel module.Linux kernel
- CVE-2023-22883Local Privilege Escalation in Zoom for Windows InstallersZoom Video Communications Zoom Client for Meetings for IT A…
- CVE-2023-26768Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the compileTranslationTab
- CVE-2023-27059A cross-site scripting (XSS) vulnerability in the Edit Group function of ChurchCRM v4.5.3 allows attackers to execute arbitrary web scripts
- CVE-2023-27707SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /d
- CVE-2023-27709SQL injection vulnerability found in DedeCMS v.5.7.106 allows a remote attacker to execute arbitrary code via the rank_* parameter in the /d
- CVE-2023-27783An issue found in TCPreplay tcprewrite v.4.4.3 allows a remote attacker to cause a denial of service via the tcpedit_dlt_cleanup function at
- CVE-2023-27784An issue found in TCPReplay v.4.4.3 allows a remote attacker to cause a denial of service via the read_hexstring function at the utils.c:309
- CVE-2023-27785An issue found in TCPreplay TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the parse endpoints function.
- CVE-2023-27786An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the macinstring function.
- CVE-2023-27787An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the parse_list function at the list.c:81 endpoin
- CVE-2023-27788An issue found in TCPrewrite v.4.4.3 allows a remote attacker to cause a denial of service via the ports2PORT function at the portmap.c:69 e
- CVE-2023-27789An issue found in TCPprep v.4.4.3 allows a remote attacker to cause a denial of service via the cidr2cidr function at the cidr.c:178 endpoin
Medium, low and unrated 50
- CVE-2023-1436Infinite recursion in Jettison leads to denial of service when creating a crafted JSONArrayjettison · org.codehaus.jettison:jettison
- CVE-2023-27494Streamlit Cross-site Scripting vulnerabilitystreamlit
- CVE-2023-23935Presence of restricted personal Discourse messages may be leaked if tagged with a tag discourse
- CVE-2023-28109Play With Docker vulnerable to Authorization Bypass Through User-Controlled Keyplay-with-docker · github.com/play-with-docker/play-with-do…
- CVE-2023-28106Pimcore vulnerable to Cross-site Scripting in UrlSlug Data typepimcore · pimcore/pimcore
- CVE-2023-28110JumpServer Koko vulnerable to Command Injection for Kubernetes Connection jumpserver
- CVE-2023-28101Flatpak metadata with ANSI control codes can cause misleading terminal outputflatpak
- CVE-2023-1433SourceCodester Gadget Works Online Ordering System Products unrestricted uploadSourceCodester Gadget Works Online Ordering System
- CVE-2022-26080Easily guessable session ID's in NE843 Pulsar Plus ControllerABB Pulsar Plus System Controller NE843_S · ABB Infinity DC…
- CVE-2023-1431The WP Simple Shopping Cart plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 4.6.3 duewptipsntricks WordPress Simple Shopping Cart
- CVE-2022-41554WordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)John West Slideshow SE
- CVE-2022-40699WordPress Yet Another Stars Rating Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)Dario Curvino Yasr – Yet Another Stars Rating
- CVE-2022-38971WordPress BuddyForms Plugin <= 2.7.5 is vulnerable to Cross Site Scripting (XSS)ThemeKraft Post Form – Registration Form – Profile Form for…
- CVE-2022-38063WordPress Social Login WP Plugin <= 5.0.0.0 is vulnerable to Cross Site Request Forgery (CSRF)Social Login WP
- CVE-2023-1429Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore
- CVE-2023-21449Improper access control vulnerability in Call application prior to SMR Mar-2023 Release 1 allows local attackers to access sensitive informaSamsung Mobile Devices
- CVE-2023-21452Improper usage of implicit intent in Bluetooth prior to SMR Mar-2023 Release 1 allows attacker to get MAC address of connected device.Samsung Mobile Devices
- CVE-2023-21453Improper input validation vulnerability in SoftSim TA prior to SMR Mar-2023 Release 1 allows local attackers access to protected data.Samsung Mobile Devices
- CVE-2023-21454Improper authorization in Samsung Keyboard prior to SMR Mar-2023 Release 1 allows physical attacker to access users text history on the lockSamsung Mobile Devices
- CVE-2023-21455Improper authorization implementation in Exynos baseband prior to SMR Mar-2023 Release 1 allows incorrect handling of unencrypted message.Samsung Mobile Devices
- CVE-2023-21457Improper access control vulnerability in Bluetooth prior to SMR Mar-2023 Release 1 allows attackers to send file via Bluetooth without relatSamsung Mobile Devices
- CVE-2023-21458Improper privilege management vulnerability in PhoneStatusBarPolicy in System UI prior to SMR Mar-2023 Release 1 allows attacker to turn offSamsung Mobile Devices
- CVE-2023-21459Use after free vulnerability in decon driver prior to SMR Mar-2023 Release 1 allows attackers to cause memory access fault.Samsung Mobile Devices
- CVE-2023-21460Improper authentication in SecSettings prior to SMR Mar-2023 Release 1 allows attacker to reset the setting.Samsung Mobile Devices
- CVE-2023-21461Improper authorization vulnerability in AutoPowerOnOffConfirmDialog in Settings prior to SMR Mar-2023 Release 1 allows local attacker to turSamsung Mobile Devices
- CVE-2023-21462The sensitive information exposure vulnerability in Quick Share Agent prior to versions 3.5.14.18 in Android 12 and 3.5.16.20 in Android 13 Samsung Mobile Quick Share Agent
- CVE-2023-21463Improper access control vulnerability in MyFiles application prior to versions 12.2.09.0 in Android 11, 13.1.03.501 in Android 12 and 14.1.0Samsung Mobile MyFiles
- CVE-2023-21464Improper access control in Samsung Calendar prior to versions 12.4.02.9000 in Android 13 and 12.3.08.2000 in Android 12 allows local attackeSamsung Mobile Samsung Calendar
- CVE-2023-21465Improper access control vulnerability in BixbyTouch prior to version 3.2.02.5 in China models allows untrusted applications access local filSamsung Mobile Bixby Touch
- CVE-2023-22880Information Disclosure in Zoom for Windows ClientsZoom Video Communications Zoom for Windows · Zoom Video… +1
- CVE-2023-22881Denial of Service in Zoom ClientsZoom Video Communications Zoom (for Android, iOS, Linux, ma…
- CVE-2023-22882Denial of Service in Zoom ClientsZoom Video Communications Zoom (for Android, iOS, Linux, ma…
- CVE-2023-24671VX Search v13.8 and v14.7 was discovered to contain an unquoted service path vulnerability which allows attackers to execute arbitrary comma
- CVE-2023-24760An issue found in Ofcms v.1.1.4 allows a remote attacker to to escalate privileges via the respwd method in SysUserController.
- CVE-2023-24795Command execution vulnerability was discovered in JHR-N916R router firmware version<=21.11.1.1483.
- CVE-2023-25281A stack overflow vulnerability exists in pingV4Msg component in D-Link DIR820LA1_FW105B03, allows attackers to cause a denial of service via
- CVE-2023-26767Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the lou_logFile function
- CVE-2023-26769Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a denial of service via the resolveSubt
- CVE-2023-26784SQL Injection vulnerability found in Kirin Fortress Machine v.1.7-2020-0610 allows attackers to execute arbitrary code via the /admin.php?co
- CVE-2023-26951onekeyadmin v1.3.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Member List module.
- CVE-2023-27037Qibosoft QiboCMS v7 was discovered to contain a remote code execution (RCE) vulnerability via the Get_Title function at label_set_rs.php
- CVE-2023-27084Permissions vulnerability found in isoftforce Dreamer CMS v.4.0.1 allows local attackers to obtain sensitive information via the AttachmentC
- CVE-2023-27095Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker toescalate privileges via the AddUser method of the Uscn.hippo4j:hippo4j-core
- CVE-2023-27130Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via an arbitrarily supplied U
- CVE-2023-27131Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code viathe Post Editorparameter.
- CVE-2023-27711Cross Site Scripting vulnerability found in Typecho v.1.2.0 allows a remote attacker to execute arbitrary code via the Comment Manager /admi
- CVE-2023-28113russh may use insecure Diffie-Hellman keyswarp-tech russh · russh
- CVE-2023-28155The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protorequest · @cypress/request
- CVE-2023-28486Sudo before 1.9.13 does not escape control characters in log messages.
- CVE-2023-28487Sudo before 1.9.13 does not escape control characters in sudoreplay output.