CVEs published March 21, 2023
80 CVEs were published on March 21, 2023: 9 critical, 36 high.
- Published
- 80
- Critical
- 9
- High
- 36
- Medium
- 28
- Low
- 3
- Unrated
- 4
- Now in CISA KEV
- 0
- Fix available
- 32
Most affected products
- answerdev/answer · github.com/answerdev/answer
- 9
- Schneider Electric IGSS Data Server · Schneider Electric… +1
- 8
- Google Chrome
- 7
- IBM Security Key Lifecycle Manager
- 7
- VISAM VBASE
- 6
- xen
- 4
- IBM Aspera Faspex
- 3
- Netgear Orbi Router RBR750
- 3
- Rapid7 InsightCloudSec
- 3
- Pacsrapor
- 2
Critical 9
- CVE-2023-27855Rockwell Automation ThinManager ThinServer Path Traversal UploadRockwell Automation ThinManager ThinServer
- CVE-2023-1529Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruptGoogle Chrome
- CVE-2022-37337A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5.Netgear Orbi Router RBR750
- CVE-2023-27874IBM Aspera Faspex XML external entity injectionIBM Aspera Faspex
- CVE-2023-1153SQLi in PacsraporPacsrapor
- CVE-2022-45637An insecure password reset issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 service via insecure expiry mechani
- CVE-2023-27569The eo_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header.
- CVE-2023-27570The eo_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted _ga cookie.
- CVE-2023-28725General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute a
High 36
- CVE-2023-27856Rockwell Automation ThinManager ThinServer Path Traversal DownloadRockwell Automation ThinManager ThinServer
- CVE-2023-1534Out of bounds read in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2023-1533Use after free in WebProtect in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via aGoogle Chrome
- CVE-2023-1532Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption viGoogle Chrome
- CVE-2023-1531Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2023-1530Use after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafteGoogle Chrome
- CVE-2023-1528Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
- CVE-2023-1262Missing MAC layer security in Wi-SUN Linux Border Routersilabs.com Wi-SUN Linux Border Router
- CVE-2023-1261Missing MAC layer security in Wi-SUN SDKsilabs.com Wi-SUN SDK
- CVE-2023-1168Authenticated Remote Code Execution in Aruba CX SwitchesHewlett Packard Enterprise (HPE) Aruba CX 10000 Switch Seri…
- CVE-2023-0391MGT-COMMERCE CloudPanel Shared CertificateMGT-COMMERCE CloudPanel
- CVE-2022-38452A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5.Netgear Orbi Router RBR750
- CVE-2022-36429A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5.Netgear Orbi Satellite RBS750
- CVE-2023-1306Rapid7 InsightCloudSec resource.db() method accessRapid7 InsightCloudSec
- CVE-2023-1305Rapid7 InsightCloudSec box object access Rapid7 InsightCloudSec
- CVE-2023-1304Rapid7 InsightCloudSec getattr() method accessRapid7 InsightCloudSec
- CVE-2023-28685Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins Project Jenkins AbsInt a³ Plugin · org.jenkins-ci.p…
- CVE-2023-27871IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2023-1314Local Privilege Escalation Vulnerability in cloudflared's Installercloudflared · github.com/cloudflare/cloudflared
- CVE-2023-1462IDOR in DigikentVadi Corporate Information Systems DigiKent
- CVE-2022-45635An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account informa
- CVE-2022-45636An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) without authorization vi
- CVE-2023-1527Cross-site Scripting (XSS) - Generic in tsolucio/corebostsolucio/corebos
- CVE-2023-1535Cross-site Scripting (XSS) - Stored in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-1536Cross-site Scripting (XSS) - Stored in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-1542Business Logic Errors in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-1545 SQL Injection in nilsteampassnet/teampassnilsteampassnet/teampass
- CVE-2023-24709An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters.
- CVE-2023-26497An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto
- CVE-2023-27087Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageLcom.xuxueli:xxl-job
- CVE-2023-27842Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via
- CVE-2023-27978A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious paSchneider Electric IGSS Data Server · Schneider Electric… +1
- CVE-2023-27980A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation Schneider Electric IGSS Data Server · Schneider Electric… +1
- CVE-2023-27981A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code Schneider Electric IGSS Data Server · Schneider Electric… +1
- CVE-2023-27982A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboardSchneider Electric IGSS Data Server · Schneider Electric… +1
- CVE-2023-27984A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to rSchneider Electric IGSS Data Server · Schneider Electric… +1
Medium, low and unrated 35
- CVE-2022-46286CVE-2022-46286VISAM VBASE
- CVE-2022-45468CVE-2022-45468VISAM VBASE
- CVE-2022-45121CVE-2022-45121VISAM VBASE
- CVE-2022-41696CVE-2022-41696VISAM VBASE
- CVE-2022-43512CVE-2022-43512VISAM VBASE
- CVE-2022-46300CVE-2022-46300VISAM VBASE
- CVE-2018-25082zwczou WeChat SDK Python to_xml xml external entity referencezwczou WeChat SDK Python · weixin-python
- CVE-2022-38458A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8.5.Netgear Orbi Router RBR750
- CVE-2023-25684IBM Security Key Lifecycle Manager SQL injectionIBM Security Key Lifecycle Manager
- CVE-2023-25686IBM Security Key Lifecycle Manager information disclosureIBM Security Key Lifecycle Manager
- CVE-2023-25923IBM Security Key Lifecycle Manager denial of serviceIBM Security Key Lifecycle Manager
- CVE-2023-25688IBM Security Key Lifecycle Manager information disclosureIBM Security Key Lifecycle Manager
- CVE-2023-25687IBM Security Key Lifecycle Manager information disclosureIBM Security Key Lifecycle Manager
- CVE-2023-25924IBM Security Key Lifecycle Manager improper authorizationIBM Security Key Lifecycle Manager
- CVE-2023-25689IBM Security Key Lifecycle Manager information disclosureIBM Security Key Lifecycle Manager
- CVE-2023-27873IBM Aspera Faspex information disclosureIBM Aspera Faspex
- CVE-2023-1154XSS in PacsraporPacsrapor
- CVE-2016-15029Ydalb mapicoin stats.php cross site scriptingYdalb mapicoin
- CVE-2022-41785WordPress Photo Gallery – Image Gallery by Ape Plugin <= 2.2.8 is vulnerable to Cross Site Scripting (XSS)Galleryape Gallery Images Ape
- CVE-2022-41831WordPress Glossary Plugin <= 3.1.2 is vulnerable to Cross Site Scripting (XSS)TCBarrett WP Glossary
- CVE-2022-42485WordPress Gallery with thumbnail slider Plugin <= 6.0 is vulnerable to Cross Site Scripting (XSS)Galaxy Weblinks Gallery with thumbnail slider
- CVE-2022-42331x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one xen
- CVE-2022-42332x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Pagxen
- CVE-2022-42333x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabxen
- CVE-2022-42334x86/HVM pinned cache attributes mis-handling T[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerabxen
- CVE-2023-1537Authentication Bypass by Capture-replay in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-1538Observable Timing Discrepancy in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-1539Improper Restriction of Excessive Authentication Attempts in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-1540Observable Response Discrepancy in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-1541Business Logic Errors in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-1543Insufficient Session Expiration in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-25134McAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee specific Component Obje
- CVE-2023-27977A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files inSchneider Electric IGSS Data Server · Schneider Electric… +1
- CVE-2023-27979A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in Schneider Electric IGSS Data Server · Schneider Electric… +1
- CVE-2023-27983A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of rSchneider Electric IGSS Data Server · Schneider Electric… +1