# CVEs published 2023-03-21

80 CVEs were published on March 21, 2023: 9 critical, 36 high. Days are UTC.

- [CVE-2023-27856](https://cve.now/CVE-2023-27856.md): Rockwell Automation ThinManager ThinServer Path Traversal Download (CVSS 7.5, Rockwell Automation ThinManager ThinServer)
- [CVE-2023-27855](https://cve.now/CVE-2023-27855.md): Rockwell Automation ThinManager ThinServer Path Traversal Upload (CVSS 9.8, Rockwell Automation ThinManager ThinServer)
- [CVE-2022-46286](https://cve.now/CVE-2022-46286.md): CVE-2022-46286 (CVSS 5.5, VISAM VBASE)
- [CVE-2022-45468](https://cve.now/CVE-2022-45468.md): CVE-2022-45468 (CVSS 5.5, VISAM VBASE)
- [CVE-2022-45121](https://cve.now/CVE-2022-45121.md): CVE-2022-45121 (CVSS 5.5, VISAM VBASE)
- [CVE-2022-41696](https://cve.now/CVE-2022-41696.md): CVE-2022-41696 (CVSS 5.5, VISAM VBASE)
- [CVE-2022-43512](https://cve.now/CVE-2022-43512.md): CVE-2022-43512 (CVSS 5.5, VISAM VBASE)
- [CVE-2022-46300](https://cve.now/CVE-2022-46300.md): CVE-2022-46300 (CVSS 5.5, VISAM VBASE)
- [CVE-2023-1534](https://cve.now/CVE-2023-1534.md): Out of bounds read in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.8, Google Chrome)
- [CVE-2023-1533](https://cve.now/CVE-2023-1533.md): Use after free in WebProtect in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a (CVSS 8.8, Google Chrome)
- [CVE-2023-1532](https://cve.now/CVE-2023-1532.md): Out of bounds read in GPU Video in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption vi (CVSS 8.8, Google Chrome)
- [CVE-2023-1531](https://cve.now/CVE-2023-1531.md): Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2023-1530](https://cve.now/CVE-2023-1530.md): Use after free in PDF in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafte (CVSS 8.8, Google Chrome)
- [CVE-2023-1529](https://cve.now/CVE-2023-1529.md): Out of bounds memory access in WebHID in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corrupt (CVSS 9.8, Google Chrome)
- [CVE-2023-1528](https://cve.now/CVE-2023-1528.md): Use after free in Passwords in Google Chrome prior to 111.0.5563.110 allowed a remote attacker who had compromised the renderer process to p (CVSS 8.8, Google Chrome)
- [CVE-2023-1262](https://cve.now/CVE-2023-1262.md): Missing MAC layer security in Wi-SUN Linux Border Router (CVSS 8.2, silabs.com Wi-SUN Linux Border Router)
- [CVE-2023-1261](https://cve.now/CVE-2023-1261.md): Missing MAC layer security in Wi-SUN SDK (CVSS 8.2, silabs.com Wi-SUN SDK)
- [CVE-2023-1168](https://cve.now/CVE-2023-1168.md): Authenticated Remote Code Execution in Aruba CX Switches (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba CX 10000 Switch Seri…)
- [CVE-2023-0391](https://cve.now/CVE-2023-0391.md): MGT-COMMERCE CloudPanel Shared Certificate (CVSS 8.1, MGT-COMMERCE CloudPanel)
- [CVE-2018-25082](https://cve.now/CVE-2018-25082.md): zwczou WeChat SDK Python to\_xml xml external entity reference (CVSS 6.3, zwczou WeChat SDK Python · weixin-python)
- [CVE-2022-38452](https://cve.now/CVE-2022-38452.md): A command execution vulnerability exists in the hidden telnet service functionality of Netgear Orbi Router RBR750 4.6.8.5. (CVSS 7.2, Netgear Orbi Router RBR750)
- [CVE-2022-37337](https://cve.now/CVE-2022-37337.md): A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. (CVSS 9.1, Netgear Orbi Router RBR750)
- [CVE-2022-36429](https://cve.now/CVE-2022-36429.md): A command execution vulnerability exists in the ubus backend communications functionality of Netgear Orbi Satellite RBS750 4.6.8.5. (CVSS 7.2, Netgear Orbi Satellite RBS750)
- [CVE-2022-38458](https://cve.now/CVE-2022-38458.md): A cleartext transmission vulnerability exists in the Remote Management functionality of Netgear Orbi Router RBR750 4.6.8.5. (CVSS 6.5, Netgear Orbi Router RBR750)
- [CVE-2023-1306](https://cve.now/CVE-2023-1306.md): Rapid7 InsightCloudSec resource.db() method access (CVSS 8.8, Rapid7 InsightCloudSec)
- [CVE-2023-1305](https://cve.now/CVE-2023-1305.md): Rapid7 InsightCloudSec box object access (CVSS 8.1, Rapid7 InsightCloudSec)
- [CVE-2023-1304](https://cve.now/CVE-2023-1304.md): Rapid7 InsightCloudSec getattr() method access (CVSS 8.8, Rapid7 InsightCloudSec)
- [CVE-2023-25684](https://cve.now/CVE-2023-25684.md): IBM Security Key Lifecycle Manager SQL injection (CVSS 6.5, IBM Security Key Lifecycle Manager)
- [CVE-2023-25686](https://cve.now/CVE-2023-25686.md): IBM Security Key Lifecycle Manager information disclosure (CVSS 6.2, IBM Security Key Lifecycle Manager)
- [CVE-2023-28685](https://cve.now/CVE-2023-28685.md): Jenkins AbsInt a³ Plugin 1.1.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 7.1, Jenkins Project Jenkins AbsInt a³ Plugin · org.jenkins-ci.p…)
- [CVE-2023-25923](https://cve.now/CVE-2023-25923.md): IBM Security Key Lifecycle Manager denial of service (CVSS 2.7, IBM Security Key Lifecycle Manager)
- [CVE-2023-25688](https://cve.now/CVE-2023-25688.md): IBM Security Key Lifecycle Manager information disclosure (CVSS 4.3, IBM Security Key Lifecycle Manager)
- [CVE-2023-25687](https://cve.now/CVE-2023-25687.md): IBM Security Key Lifecycle Manager information disclosure (CVSS 4.3, IBM Security Key Lifecycle Manager)
- [CVE-2023-25924](https://cve.now/CVE-2023-25924.md): IBM Security Key Lifecycle Manager improper authorization (CVSS 5.4, IBM Security Key Lifecycle Manager)
- [CVE-2023-25689](https://cve.now/CVE-2023-25689.md): IBM Security Key Lifecycle Manager information disclosure (CVSS 2.7, IBM Security Key Lifecycle Manager)
- [CVE-2023-27873](https://cve.now/CVE-2023-27873.md): IBM Aspera Faspex information disclosure (CVSS 6.5, IBM Aspera Faspex)
- [CVE-2023-27874](https://cve.now/CVE-2023-27874.md): IBM Aspera Faspex XML external entity injection (CVSS 9.9, IBM Aspera Faspex)
- [CVE-2023-27871](https://cve.now/CVE-2023-27871.md): IBM Aspera Faspex information disclosure (CVSS 7.5, IBM Aspera Faspex)
- [CVE-2023-1154](https://cve.now/CVE-2023-1154.md): XSS in Pacsrapor (CVSS 6.1, Pacsrapor)
- [CVE-2023-1153](https://cve.now/CVE-2023-1153.md): SQLi in Pacsrapor (CVSS 9.8, Pacsrapor)
- [CVE-2023-1314](https://cve.now/CVE-2023-1314.md): Local Privilege Escalation Vulnerability in cloudflared's Installer (CVSS 7.5, cloudflared · github.com/cloudflare/cloudflared)
- [CVE-2016-15029](https://cve.now/CVE-2016-15029.md): Ydalb mapicoin stats.php cross site scripting (CVSS 3.5, Ydalb mapicoin)
- [CVE-2023-1462](https://cve.now/CVE-2023-1462.md): IDOR in Digikent (CVSS 8.8, Vadi Corporate Information Systems DigiKent)
- [CVE-2022-41785](https://cve.now/CVE-2022-41785.md): WordPress Photo Gallery – Image Gallery by Ape Plugin \<= 2.2.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4, Galleryape Gallery Images Ape)
- [CVE-2022-41831](https://cve.now/CVE-2022-41831.md): WordPress Glossary Plugin \<= 3.1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4, TCBarrett WP Glossary)
- [CVE-2022-42485](https://cve.now/CVE-2022-42485.md): WordPress Gallery with thumbnail slider Plugin \<= 6.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4, Galaxy Weblinks Gallery with thumbnail slider)
- [CVE-2022-42331](https://cve.now/CVE-2022-42331.md): x86: speculative vulnerability in 32bit SYSCALL path Due to an oversight in the very original Spectre/Meltdown security work (XSA-254), one (no CVSS, xen)
- [CVE-2022-42332](https://cve.now/CVE-2022-42332.md): x86 shadow plus log-dirty mode use-after-free In environments where host assisted address translation is necessary but Hardware Assisted Pag (no CVSS, xen)
- [CVE-2022-42333](https://cve.now/CVE-2022-42333.md): x86/HVM pinned cache attributes mis-handling T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerab (no CVSS, xen)
- [CVE-2022-42334](https://cve.now/CVE-2022-42334.md): x86/HVM pinned cache attributes mis-handling T\[his CNA information record relates to multiple CVEs; the text explains which aspects/vulnerab (no CVSS, xen)
- [CVE-2022-45635](https://cve.now/CVE-2022-45635.md): An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to gain access to sensitive account informa (CVSS 7.5)
- [CVE-2022-45636](https://cve.now/CVE-2022-45636.md): An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows attacker to unlock model(s) without authorization vi (CVSS 8.1)
- [CVE-2022-45637](https://cve.now/CVE-2022-45637.md): An insecure password reset issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 service via insecure expiry mechani (CVSS 9.8)
- [CVE-2023-1527](https://cve.now/CVE-2023-1527.md): Cross-site Scripting (XSS) - Generic in tsolucio/corebos (CVSS 8.3, tsolucio/corebos)
- [CVE-2023-1535](https://cve.now/CVE-2023-1535.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 8.3, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1536](https://cve.now/CVE-2023-1536.md): Cross-site Scripting (XSS) - Stored in answerdev/answer (CVSS 7.6, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1537](https://cve.now/CVE-2023-1537.md): Authentication Bypass by Capture-replay in answerdev/answer (CVSS 5.3, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1538](https://cve.now/CVE-2023-1538.md): Observable Timing Discrepancy in answerdev/answer (CVSS 5.3, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1539](https://cve.now/CVE-2023-1539.md): Improper Restriction of Excessive Authentication Attempts in answerdev/answer (CVSS 5.3, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1540](https://cve.now/CVE-2023-1540.md): Observable Response Discrepancy in answerdev/answer (CVSS 5.3, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1541](https://cve.now/CVE-2023-1541.md): Business Logic Errors in answerdev/answer (CVSS 6.0, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1542](https://cve.now/CVE-2023-1542.md): Business Logic Errors in answerdev/answer (CVSS 8.1, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1543](https://cve.now/CVE-2023-1543.md): Insufficient Session Expiration in answerdev/answer (CVSS 6.8, answerdev/answer · github.com/answerdev/answer)
- [CVE-2023-1545](https://cve.now/CVE-2023-1545.md): SQL Injection in nilsteampassnet/teampass (CVSS 7.5, nilsteampassnet/teampass)
- [CVE-2023-24709](https://cve.now/CVE-2023-24709.md): An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters. (CVSS 7.5)
- [CVE-2023-25134](https://cve.now/CVE-2023-25134.md): McAfee Total Protection prior to 16.0.50 may allow an adversary (with full administrative access) to modify a McAfee specific Component Obje (CVSS 6.7)
- [CVE-2023-26497](https://cve.now/CVE-2023-26497.md): An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto (CVSS 8.6)
- [CVE-2023-27087](https://cve.now/CVE-2023-27087.md): Permissions vulnerabiltiy found in Xuxueli xxl-job v2.2.0, v 2.3.0 and v.2.3.1 allows attacker to obtain sensitive information via the pageL (CVSS 7.5, com.xuxueli:xxl-job)
- [CVE-2023-27569](https://cve.now/CVE-2023-27569.md): The eo\_tags package before 1.3.0 for PrestaShop allows SQL injection via an HTTP User-Agent or Referer header. (CVSS 9.8)
- [CVE-2023-27570](https://cve.now/CVE-2023-27570.md): The eo\_tags package before 1.4.19 for PrestaShop allows SQL injection via a crafted \_ga cookie. (CVSS 9.8)
- [CVE-2023-27842](https://cve.now/CVE-2023-27842.md): Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via (CVSS 8.8)
- [CVE-2023-27977](https://cve.now/CVE-2023-27977.md): A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause access to delete files in (CVSS 6.5, Schneider Electric IGSS Data Server · Schneider Electric… +1)
- [CVE-2023-27978](https://cve.now/CVE-2023-27978.md): A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious pa (CVSS 7.8, Schneider Electric IGSS Data Server · Schneider Electric… +1)
- [CVE-2023-27979](https://cve.now/CVE-2023-27979.md): A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could allow the renaming of files in (CVSS 6.5, Schneider Electric IGSS Data Server · Schneider Electric… +1)
- [CVE-2023-27980](https://cve.now/CVE-2023-27980.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow the creation (CVSS 8.8, Schneider Electric IGSS Data Server · Schneider Electric… +1)
- [CVE-2023-27981](https://cve.now/CVE-2023-27981.md): A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists in Custom Reports that could cause a remote code (CVSS 7.8, Schneider Electric IGSS Data Server · Schneider Electric… +1)
- [CVE-2023-27982](https://cve.now/CVE-2023-27982.md): A CWE-345: Insufficient Verification of Data Authenticity vulnerability exists in the Data Server that could cause manipulation of dashboard (CVSS 8.8, Schneider Electric IGSS Data Server · Schneider Electric… +1)
- [CVE-2023-27983](https://cve.now/CVE-2023-27983.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of r (CVSS 6.5, Schneider Electric IGSS Data Server · Schneider Electric… +1)
- [CVE-2023-27984](https://cve.now/CVE-2023-27984.md): A CWE-20: Improper Input Validation vulnerability exists in Custom Reports that could cause a macro to be executed, potentially leading to r (CVSS 7.8, Schneider Electric IGSS Data Server · Schneider Electric… +1)
- [CVE-2023-28725](https://cve.now/CVE-2023-28725.md): General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute a (CVSS 9.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.