# CVEs published 2023-03-17

57 CVEs were published on March 17, 2023: 2 critical, 9 high. Days are UTC.

- [CVE-2023-28116](https://cve.now/CVE-2023-28116.md): Buffer overflow in L2CAP due to misconfigured MTU (CVSS 8.1, contiki-ng)
- [CVE-2023-28115](https://cve.now/CVE-2023-28115.md): Snappy vulnerable to PHAR deserialization, allowing remote code execution (CVSS 9.8, KnpLabs snappy · knplabs/knp-snappy)
- [CVE-2023-27595](https://cve.now/CVE-2023-27595.md): Cilium eBPF filters may be temporarily removed during agent restart (CVSS 6.5, cilium · github.com/cilium/cilium)
- [CVE-2023-25069](https://cve.now/CVE-2023-25069.md): TXOne StellarOne has an improper access control privilege escalation vulnerability in every version before V2.0.1160 that could allow a mali (CVSS 8.8, Trend Micro TXOne Networks StellarOne)
- [CVE-2023-27594](https://cve.now/CVE-2023-27594.md): Cilium vulnerable to potential network policy bypass when routing IPv6 traffic (CVSS 4.2, cilium · github.com/cilium/cilium)
- [CVE-2023-27593](https://cve.now/CVE-2023-27593.md): cilium-agent container can access the host via \`hostPath\` mount (CVSS 4.4, cilium · github.com/cilium/cilium)
- [CVE-2023-27591](https://cve.now/CVE-2023-27591.md): Unauthenticated Miniflux user can bypass allowed networks check to obtain Prometheus metrics (CVSS 7.5, miniflux · miniflux.app/v2 +1)
- [CVE-2023-27592](https://cve.now/CVE-2023-27592.md): Stored XSS in Miniflux when opening a broken image due to unescaped ServerError in proxy handler (CVSS 4.8, miniflux · miniflux.app/v2)
- [CVE-2023-28112](https://cve.now/CVE-2023-28112.md): Discourse's SSRF protection missing for some FastImage requests (CVSS 5.9, discourse)
- [CVE-2023-28111](https://cve.now/CVE-2023-28111.md): Discourse vulnerable to SSRF protection bypass possible with IPv4-mapped IPv6 addresses (CVSS 5.7, discourse)
- [CVE-2023-0027](https://cve.now/CVE-2023-0027.md): Rockwell Automation Modbus TCP AOI Server Could Leak Sensitive Information (CVSS 5.3, Rockwell Automation Modbus TCP Server Add On Instructions)
- [CVE-2023-28107](https://cve.now/CVE-2023-28107.md): Discourse vulnerable to multisite DoS by spamming backups (CVSS 4.5, discourse)
- [CVE-2023-25172](https://cve.now/CVE-2023-25172.md): Discourse vulnerable to Cross-site Scripting - user name displayed on post (CVSS 4.4, discourse)
- [CVE-2022-46867](https://cve.now/CVE-2022-46867.md): WordPress Universal Star Rating Plugin \<= 2.1.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, Chasil Universal Star Rating)
- [CVE-2022-46854](https://cve.now/CVE-2022-46854.md): WordPress Launchpad – Coming Soon & Maintenance Mode Plugin Plugin \<= 1.0.13 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Obox Themes Launchpad – Coming Soon & Maintenance Mode Plug…)
- [CVE-2023-26040](https://cve.now/CVE-2023-26040.md): Discourse chat messages susceptible to Cross-site Scripting through chat excerpts (CVSS 6.5, discourse)
- [CVE-2023-1475](https://cve.now/CVE-2023-1475.md): SourceCodester Canteen Management System createuser.php query sql injection (CVSS 6.3, SourceCodester Canteen Management System)
- [CVE-2023-1474](https://cve.now/CVE-2023-1474.md): SourceCodester Automatic Question Paper Generator System GET Parameter manage\_question\_paper.php sql injection (CVSS 6.3, SourceCodester Automatic Question Paper Generator System)
- [CVE-2023-1472](https://cve.now/CVE-2023-1472.md): RapidLoad Power-Up for Autoptimize \<= 1.7.1 - Cross-Site Request Forgery (CVSS 6.3, shakee93 RapidLoad AI – Optimize Web Vitals Automatically)
- [CVE-2023-23622](https://cve.now/CVE-2023-23622.md): Discourse: Presence of read restricted topics may be leaked if tagged with a tag that is visible to all users (CVSS 4.3, discourse)
- [CVE-2022-45817](https://cve.now/CVE-2022-45817.md): WordPress GC Testimonials Plugin \<= 1.3.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4, Erin Garscadden GC Testimonials)
- [CVE-2022-45814](https://cve.now/CVE-2022-45814.md): WordPress WP Calendar Plugin \<= 1.5.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4, Fabian von Allmen WP Calendar)
- [CVE-2022-43461](https://cve.now/CVE-2022-43461.md): WordPress Slideshow SE Plugin \<= 2.5.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, John West Slideshow SE)
- [CVE-2023-1470](https://cve.now/CVE-2023-1470.md): eCommerce Product Catalog plugin for WordPress \<= 3.3.8 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, implecode eCommerce Product Catalog Plugin for WordPress)
- [CVE-2023-1471](https://cve.now/CVE-2023-1471.md): WP Popup Banners \<= 1.2.5 - Authenticated (Subscriber+) SQL Injection (CVSS 8.8, access-keys WP Popup Banners)
- [CVE-2023-1469](https://cve.now/CVE-2023-1469.md): The WP Express Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘pec\_coupon\[code\]’ parameter in versions u (CVSS 4.4, mra13 WP Express Checkout)
- [CVE-2023-1172](https://cve.now/CVE-2023-1172.md): The Bookly plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the full name value in versions up to, and including, 21.5 (CVSS 7.2, ladela WordPress Online Booking and Scheduling Plugin – Boo…)
- [CVE-2023-1468](https://cve.now/CVE-2023-1468.md): SourceCodester Student Study Center Desk Management System Report sql injection (CVSS 6.3, SourceCodester Student Study Center Desk Management System)
- [CVE-2023-1467](https://cve.now/CVE-2023-1467.md): SourceCodester Student Study Center Desk Management System POST Parameter path traversal (CVSS 6.5, SourceCodester Student Study Center Desk Management System)
- [CVE-2023-1466](https://cve.now/CVE-2023-1466.md): SourceCodester Student Study Center Desk Management System view\_student sql injection (CVSS 6.3, SourceCodester Student Study Center Desk Management System)
- [CVE-2023-1464](https://cve.now/CVE-2023-1464.md): SourceCodester Medicine Tracker System improper authentication (CVSS 7.3, SourceCodester Medicine Tracker System)
- [CVE-2023-1152](https://cve.now/CVE-2023-1152.md): SQLi in Utarit Persolus (CVSS 9.8, Utarit Information Technologies Persolus)
- [CVE-2023-1461](https://cve.now/CVE-2023-1461.md): SourceCodester Canteen Management System createCategories.php query sql injection (CVSS 6.3, SourceCodester Canteen Management System)
- [CVE-2023-1460](https://cve.now/CVE-2023-1460.md): SourceCodester Online Pizza Ordering System Password Change improper authentication (CVSS 6.5, SourceCodester Online Pizza Ordering System)
- [CVE-2023-1459](https://cve.now/CVE-2023-1459.md): SourceCodester Canteen Management System changeUsername.php sql injection (CVSS 6.3, SourceCodester Canteen Management System)
- [CVE-2023-1455](https://cve.now/CVE-2023-1455.md): SourceCodester Online Pizza Ordering System Login Page sql injection (CVSS 5.6, SourceCodester Online Pizza Ordering System)
- [CVE-2023-1454](https://cve.now/CVE-2023-1454.md): jeecg-boot qurestSql sql injection (CVSS 6.3, jeecg-boot · org.jeecgframework.boot:jeecg-boot-common)
- [CVE-2023-1453](https://cve.now/CVE-2023-1453.md): Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 access control (CVSS 4.4, Watchdog Anti-Virus)
- [CVE-2023-1452](https://cve.now/CVE-2023-1452.md): GPAC load\_text.c buffer overflow (CVSS 5.3, GPAC)
- [CVE-2023-1451](https://cve.now/CVE-2023-1451.md): MP4v2 mp4track.cpp GetSampleFileOffset denial of service (CVSS 3.3, MP4v2)
- [CVE-2023-1450](https://cve.now/CVE-2023-1450.md): MP4v2 mp4trackdump.cpp DumpTrack denial of service (CVSS 3.3, MP4v2)
- [CVE-2023-1449](https://cve.now/CVE-2023-1449.md): GPAC av\_parsers.c gf\_av1\_reset\_state double free (CVSS 5.3, GPAC)
- [CVE-2023-1448](https://cve.now/CVE-2023-1448.md): GPAC mpegts.c gf\_m2ts\_process\_sdt heap-based overflow (CVSS 5.3, GPAC)
- [CVE-2023-1447](https://cve.now/CVE-2023-1447.md): SourceCodester Medicine Tracker System cross site scripting (CVSS 3.5, SourceCodester Medicine Tracker System)
- [CVE-2023-1446](https://cve.now/CVE-2023-1446.md): Watchdog Anti-Virus IoControlCode wsdk-driver.sys 0x80002008 denial of service (CVSS 5.5, Watchdog Anti-Virus)
- [CVE-2023-1445](https://cve.now/CVE-2023-1445.md): Filseclab Twister Antivirus IoControlCode fildds.sys 0x80112053 denial of service (CVSS 3.3, Filseclab Twister Antivirus)
- [CVE-2023-1444](https://cve.now/CVE-2023-1444.md): Filseclab Twister Antivirus IoControlCode fildds.sys 0x8011206B denial of service (CVSS 7.5, Filseclab Twister Antivirus)
- [CVE-2023-1443](https://cve.now/CVE-2023-1443.md): Filseclab Twister Antivirus IoControlCode fildds.sys 0x80112053 denial of service (CVSS 6.5, Filseclab Twister Antivirus)
- [CVE-2023-1442](https://cve.now/CVE-2023-1442.md): Meizhou Qingyunke QYKCMS Update api.php unrestricted upload (CVSS 4.7, Meizhou Qingyunke QYKCMS)
- [CVE-2023-1441](https://cve.now/CVE-2023-1441.md): SourceCodester Automatic Question Paper Generator System GET Parameter view\_course.php sql injection (CVSS 6.3, SourceCodester Automatic Question Paper Generator System)
- [CVE-2023-1440](https://cve.now/CVE-2023-1440.md): SourceCodester Automatic Question Paper Generator System GET Parameter manage\_user.php sql injection (CVSS 6.3, SourceCodester Automatic Question Paper Generator System)
- [CVE-2023-1439](https://cve.now/CVE-2023-1439.md): SourceCodester Medicine Tracker System GET Parameter view\_details.php sql injection (CVSS 6.3, SourceCodester Medicine Tracker System)
- [CVE-2021-21548](https://cve.now/CVE-2021-21548.md): Dell EMC Unisphere for PowerMax versions before 9.1.0.27, Dell EMC Unisphere for PowerMax Virtual Appliance versions before 9.1.0.27, and P (CVSS 7.4, Unisphere for PowerMax, Dell EMC Unisphere for PowerMax Vir…)
- [CVE-2023-1463](https://cve.now/CVE-2023-1463.md): Authorization Bypass Through User-Controlled Key in nilsteampassnet/teampass (CVSS 6.3, nilsteampassnet/teampass)
- [CVE-2023-24678](https://cve.now/CVE-2023-24678.md): A vulnerability in Centralite Pearl Thermostat 0x04075010 allows attackers to cause a Denial of Service (DoS) via a crafted Zigbee message. (CVSS 7.5)
- [CVE-2023-27253](https://cve.now/CVE-2023-27253.md): A command injection vulnerability in the function restore\_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbi (no CVSS)
- [CVE-2023-28531](https://cve.now/CVE-2023-28531.md): ssh-add in OpenSSH before 9.3 adds smartcard keys to ssh-agent without the intended per-hop destination constraints. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.