# CVEs published 2023-03-18 23 CVEs were published on March 18, 2023: 1 critical, 3 high. Days are UTC. - [CVE-2023-1495](https://cve.now/CVE-2023-1495.md): Rebuild list queryListOfConfig sql injection (CVSS 6.3, Rebuild) - [CVE-2023-1494](https://cve.now/CVE-2023-1494.md): IBOS ApiController.php sql injection (CVSS 6.3, IBOS) - [CVE-2023-1493](https://cve.now/CVE-2023-1493.md): Max Secure Anti Virus Plus IoControlCode MaxProctetor64.sys 0x220019 denial of service (CVSS 5.5, Max Secure Anti Virus Plus) - [CVE-2023-1492](https://cve.now/CVE-2023-1492.md): Max Secure Anti Virus Plus IoControlCode MaxProc64.sys 0x220019 denial of service (CVSS 5.5, Max Secure Anti Virus Plus) - [CVE-2023-1491](https://cve.now/CVE-2023-1491.md): Max Secure Anti Virus Plus IoControlCode MaxCryptMon.sys 0x220020 access control (CVSS 4.4, Max Secure Anti Virus Plus) - [CVE-2023-1490](https://cve.now/CVE-2023-1490.md): Max Secure Anti Virus Plus IoControlCode SDActMon.sys 0x220020 access control (CVSS 4.4, Max Secure Anti Virus Plus) - [CVE-2023-1489](https://cve.now/CVE-2023-1489.md): Lespeed WiseCleaner Wise System Monitor IoControlCode WiseHDInfo64.dll 0x9C402088 access control (CVSS 7.8, Lespeed WiseCleaner Wise System Monitor) - [CVE-2023-1488](https://cve.now/CVE-2023-1488.md): Lespeed WiseCleaner Wise System Monitor IoControlCode WiseHDInfo64.dll 0x9C40A0E0 denial of service (CVSS 3.3, Lespeed WiseCleaner Wise System Monitor) - [CVE-2023-1487](https://cve.now/CVE-2023-1487.md): Lespeed WiseCleaner Wise System Monitor IoControlCode WiseHDInfo64.dll 0x9C40A0E0 denial of service (CVSS 5.5, Lespeed WiseCleaner Wise System Monitor) - [CVE-2023-1486](https://cve.now/CVE-2023-1486.md): Lespeed WiseCleaner Wise Force Deleter IoControlCode WiseUnlock64.sys 0x220004 access control (CVSS 4.4, Lespeed WiseCleaner Wise Force Deleter) - [CVE-2023-1485](https://cve.now/CVE-2023-1485.md): SourceCodester Young Entrepreneur E-Negosyo System GET Parameter index.php cross site scripting (CVSS 3.5, SourceCodester Young Entrepreneur E-Negosyo System) - [CVE-2023-1484](https://cve.now/CVE-2023-1484.md): xzjie cms upload unrestricted upload (CVSS 6.3, xzjie cms) - [CVE-2023-1483](https://cve.now/CVE-2023-1483.md): XiaoBingBy TeaCMS getallarticleinfo sql injection (CVSS 6.3, XiaoBingBy TeaCMS) - [CVE-2023-1482](https://cve.now/CVE-2023-1482.md): HkCms External Plugin code injection (CVSS 4.7, HkCms) - [CVE-2023-1481](https://cve.now/CVE-2023-1481.md): SourceCodester Monitoring of Students Cyber Accounts System POST Parameter cross site scripting (CVSS 3.5, SourceCodester Monitoring of Students Cyber Accounts System) - [CVE-2023-1480](https://cve.now/CVE-2023-1480.md): SourceCodester Monitoring of Students Cyber Accounts System POST Parameter login.php sql injection (CVSS 6.3, SourceCodester Monitoring of Students Cyber Accounts System) - [CVE-2023-1479](https://cve.now/CVE-2023-1479.md): SourceCodester Simple Music Player save\_music.php unrestricted upload (CVSS 6.3, SourceCodester Simple Music Player) - [CVE-2023-26113](https://cve.now/CVE-2023-26113.md): Versions of the package collection.js before 6.8.1 are vulnerable to Prototype Pollution via the extend function in Collection.js/dist/node/ (CVSS 7.5, collection.js) - [CVE-2021-46877](https://cve.now/CVE-2021-46877.md): jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient (CVSS 7.5, com.fasterxml.jackson.core:jackson-databind) - [CVE-2023-24278](https://cve.now/CVE-2023-24278.md): Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability. (CVSS 6.1) - [CVE-2023-28606](https://cve.now/CVE-2023-28606.md): js/event-graph.js in MISP before 2.4.169 allows XSS via event-graph node tooltips. (CVSS 6.1) - [CVE-2023-28607](https://cve.now/CVE-2023-28607.md): js/event-graph.js in MISP before 2.4.169 allows XSS via the event-graph relationship tooltip. (CVSS 6.1) - [CVE-2023-28609](https://cve.now/CVE-2023-28609.md): api/auth.go in Ansible Semaphore before 2.8.89 mishandles authentication. (CVSS 9.8, github.com/ansible-semaphore/semaphore) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2023-03-18 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.