# CVEs published 2023-03-19

14 CVEs were published on March 19, 2023: 3 critical, 5 high. Days are UTC.

- [CVE-2023-1501](https://cve.now/CVE-2023-1501.md): RockOA acloudCosAction.php.SQL runAction unrestricted upload (CVSS 6.3, RockOA)
- [CVE-2023-1500](https://cve.now/CVE-2023-1500.md): code-projects Simple Art Gallery adminHome.php cross site scripting (CVSS 3.5, code-projects Simple Art Gallery)
- [CVE-2023-1499](https://cve.now/CVE-2023-1499.md): code-projects Simple Art Gallery adminHome.php sql injection (CVSS 6.3, code-projects Simple Art Gallery)
- [CVE-2023-1498](https://cve.now/CVE-2023-1498.md): code-projects Responsive Hotel Site Newsletter Log messages.php sql injection (CVSS 6.3, code-projects Responsive Hotel Site)
- [CVE-2023-1497](https://cve.now/CVE-2023-1497.md): SourceCodester Simple and Nice Shopping Cart Script uploaderm.php unrestricted upload (CVSS 6.3, SourceCodester Simple and Nice Shopping Cart Script)
- [CVE-2022-48422](https://cve.now/CVE-2022-48422.md): ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc\_s.so.1 in the cur (CVSS 7.8)
- [CVE-2022-48423](https://cve.now/CVE-2022-48423.md): In the Linux kernel before 6.1.3, fs/ntfs3/record.c does not validate resident attribute names. (CVSS 7.8)
- [CVE-2022-48424](https://cve.now/CVE-2022-48424.md): In the Linux kernel before 6.1.3, fs/ntfs3/inode.c does not validate the attribute name offset. (CVSS 7.8)
- [CVE-2022-48425](https://cve.now/CVE-2022-48425.md): In the Linux kernel through 6.2.7, fs/ntfs3/inode.c has an invalid kfree because it does not validate MFT flags before replaying logs. (CVSS 7.8)
- [CVE-2023-1496](https://cve.now/CVE-2023-1496.md): Cross-site Scripting (XSS) - Reflected in imgproxy/imgproxy (CVSS 6.5, imgproxy/imgproxy · github.com/imgproxy/imgproxy/v3 +2)
- [CVE-2023-26805](https://cve.now/CVE-2023-26805.md): Tenda W20E v15.11.0.6 (US\_W20EV4.0br\_v15.11.0.6(1068\_1546\_841)\_CN\_TDC) is vulnerable to Buffer Overflow via function formIPMacBindModify. (CVSS 9.8)
- [CVE-2023-26806](https://cve.now/CVE-2023-26806.md): Tenda W20E v15.11.0.6(US\_W20EV4.0br\_v15.11.0.6(1068\_1546\_841 is vulnerable to Buffer Overflow via function formSetSysTime, (CVSS 9.8)
- [CVE-2023-26905](https://cve.now/CVE-2023-26905.md): An issue was discovered in Alphaware - Simple E-Commerce System v1.0. (CVSS 9.8)
- [CVE-2023-28617](https://cve.now/CVE-2023-28617.md): org-babel-execute:latex in ob-latex.el in Org Mode through 9.6.1 for GNU Emacs allows attackers to execute arbitrary commands via a file nam (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.