CVEs published March 17, 2023
57 CVEs were published on March 17, 2023: 2 critical, 9 high.
- Published
- 57
- Critical
- 2
- High
- 9
- Medium
- 40
- Low
- 4
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 9
Most affected products
- discourse
- 6
- cilium · github.com/cilium/cilium
- 3
- Filseclab Twister Antivirus
- 3
- GPAC
- 3
- SourceCodester Automatic Question Paper Generator System
- 3
- SourceCodester Canteen Management System
- 3
- SourceCodester Medicine Tracker System
- 3
- SourceCodester Student Study Center Desk Management System
- 3
- MP4v2
- 2
- SourceCodester Online Pizza Ordering System
- 2
Critical 2
High 9
- CVE-2023-28116Buffer overflow in L2CAP due to misconfigured MTUcontiki-ng
- CVE-2023-25069TXOne StellarOne has an improper access control privilege escalation vulnerability in every version before V2.0.1160 that could allow a maliTrend Micro TXOne Networks StellarOne
- CVE-2023-27591Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metricsminiflux · miniflux.app/v2 +1
- CVE-2023-1471WP Popup Banners <= 1.2.5 - Authenticated (Subscriber+) SQL Injectionaccess-keys WP Popup Banners
- CVE-2023-1172The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 ladela WordPress Online Booking and Scheduling Plugin – Boo…
- CVE-2023-1464SourceCodester Medicine Tracker System improper authenticationSourceCodester Medicine Tracker System
- CVE-2023-1444Filseclab Twister Antivirus IoControlCode fildds.sys 0x8011206B denial of serviceFilseclab Twister Antivirus
- CVE-2021-21548 Dell EMC Unisphere for PowerMax versions before 9.1.0.27, Dell EMC Unisphere for PowerMax Virtual Appliance versions before 9.1.0.27, and PUnisphere for PowerMax, Dell EMC Unisphere for PowerMax Vir…
- CVE-2023-24678A vulnerability in Centralite Pearl Thermostat 0x04075010 allows attackers to cause a Denial of Service (DoS) via a crafted Zigbee message.
Medium, low and unrated 46
- CVE-2023-27595Cilium eBPF filters may be temporarily removed during agent restartcilium · github.com/cilium/cilium
- CVE-2023-27594Cilium vulnerable to potential network policy bypass when routing IPv6 traffic cilium · github.com/cilium/cilium
- CVE-2023-27593cilium-agent container can access the host via `hostPath` mountcilium · github.com/cilium/cilium
- CVE-2023-27592Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handlerminiflux · miniflux.app/v2
- CVE-2023-28112Discourse's SSRF protection missing for some FastImage requestsdiscourse
- CVE-2023-28111Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addressesdiscourse
- CVE-2023-0027Rockwell Automation Modbus TCP AOI Server Could Leak Sensitive InformationRockwell Automation Modbus TCP Server Add On Instructions
- CVE-2023-28107Discourse vulnerable to multisite DoS by spamming backupsdiscourse
- CVE-2023-25172Discourse vulnerable to Cross-site Scripting - user name displayed on postdiscourse
- CVE-2022-46867WordPress Universal Star Rating Plugin <= 2.1.0 is vulnerable to Cross Site Request Forgery (CSRF)Chasil Universal Star Rating
- CVE-2022-46854WordPress Launchpad – Coming Soon & Maintenance Mode Plugin Plugin <= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF)Obox Themes Launchpad – Coming Soon & Maintenance Mode Plug…
- CVE-2023-26040Discourse chat messages susceptible to Cross-site Scripting through chat excerptsdiscourse
- CVE-2023-1475SourceCodester Canteen Management System createuser.php query sql injectionSourceCodester Canteen Management System
- CVE-2023-1474SourceCodester Automatic Question Paper Generator System GET Parameter manage_question_paper.php sql injectionSourceCodester Automatic Question Paper Generator System
- CVE-2023-1472RapidLoad Power-Up for Autoptimize <= 1.7.1 - Cross-Site Request Forgeryshakee93 RapidLoad AI – Optimize Web Vitals Automatically
- CVE-2023-23622Discourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all usersdiscourse
- CVE-2022-45817WordPress GC Testimonials Plugin <= 1.3.2 is vulnerable to Cross Site Scripting (XSS)Erin Garscadden GC Testimonials
- CVE-2022-45814WordPress WP Calendar Plugin <= 1.5.3 is vulnerable to Cross Site Scripting (XSS)Fabian von Allmen WP Calendar
- CVE-2022-43461WordPress Slideshow SE Plugin <= 2.5.5 is vulnerable to Cross Site Scripting (XSS)John West Slideshow SE
- CVE-2023-1470eCommerce Product Catalog plugin for WordPress <= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scriptingimplecode eCommerce Product Catalog Plugin for WordPress
- CVE-2023-1469The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec_coupon[code]’ parameter in versions umra13 WP Express Checkout
- CVE-2023-1468SourceCodester Student Study Center Desk Management System Report sql injectionSourceCodester Student Study Center Desk Management System
- CVE-2023-1467SourceCodester Student Study Center Desk Management System POST Parameter path traversalSourceCodester Student Study Center Desk Management System
- CVE-2023-1466SourceCodester Student Study Center Desk Management System view_student sql injectionSourceCodester Student Study Center Desk Management System
- CVE-2023-1461SourceCodester Canteen Management System createCategories.php query sql injectionSourceCodester Canteen Management System
- CVE-2023-1460SourceCodester Online Pizza Ordering System Password Change improper authenticationSourceCodester Online Pizza Ordering System
- CVE-2023-1459SourceCodester Canteen Management System changeUsername.php sql injectionSourceCodester Canteen Management System
- CVE-2023-1455SourceCodester Online Pizza Ordering System Login Page sql injectionSourceCodester Online Pizza Ordering System
- CVE-2023-1454jeecg-boot qurestSql sql injectionjeecg-boot · org.jeecgframework.boot:jeecg-boot-common
- CVE-2023-1453Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 access controlWatchdog Anti-Virus
- CVE-2023-1452GPAC load_text.c buffer overflowGPAC
- CVE-2023-1451MP4v2 mp4track.cpp GetSampleFileOffset denial of serviceMP4v2
- CVE-2023-1450MP4v2 mp4trackdump.cpp DumpTrack denial of serviceMP4v2
- CVE-2023-1449GPAC av_parsers.c gf_av1_reset_state double freeGPAC
- CVE-2023-1448GPAC mpegts.c gf_m2ts_process_sdt heap-based overflowGPAC
- CVE-2023-1447SourceCodester Medicine Tracker System cross site scriptingSourceCodester Medicine Tracker System
- CVE-2023-1446Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 denial of serviceWatchdog Anti-Virus
- CVE-2023-1445Filseclab Twister Antivirus IoControlCode fildds.sys 0x80112053 denial of serviceFilseclab Twister Antivirus
- CVE-2023-1443Filseclab Twister Antivirus IoControlCode fildds.sys 0x80112053 denial of serviceFilseclab Twister Antivirus
- CVE-2023-1442Meizhou Qingyunke QYKCMS Update api.php unrestricted uploadMeizhou Qingyunke QYKCMS
- CVE-2023-1441SourceCodester Automatic Question Paper Generator System GET Parameter view_course.php sql injectionSourceCodester Automatic Question Paper Generator System
- CVE-2023-1440SourceCodester Automatic Question Paper Generator System GET Parameter manage_user.php sql injectionSourceCodester Automatic Question Paper Generator System
- CVE-2023-1439SourceCodester Medicine Tracker System GET Parameter view_details.php sql injectionSourceCodester Medicine Tracker System
- CVE-2023-1463Authorization Bypass Through User-Controlled Key in nilsteampassnet/teampassnilsteampassnet/teampass
- CVE-2023-27253A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbi
- CVE-2023-28531ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints.