CVEs published March 22, 2023
84 CVEs were published on March 22, 2023: 7 critical, 21 high. 3 are now in CISA KEV.
- Published
- 84
- Critical
- 7
- High
- 21
- Medium
- 44
- Low
- 9
- Unrated
- 3
- Now in CISA KEV
- 3
- Fix available
- 18
Most affected products
- Adobe Experience Manager
- 18
- Adobe Illustrator
- 5
- DataGear
- 3
- SourceCodester Student Study Center Desk Management System
- 3
- github.com/gophish/gophish
- 2
- Kernel
- 2
- minio · github.com/minio/minio
- 2
- SourceCodester E-Commerce System
- 2
- Adobe Creative Cloud
- 1
- Apache Software Foundation Apache Tomcat · org.apache.tomca…
- 1
Critical 7
- CVE-2023-27060LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function.
- CVE-2023-27100Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE
- CVE-2023-27224An issue found in NginxProxyManager v.2.9.19 allows an attacker to execute arbitrary code via a lua script to the configuration file.
- CVE-2023-27637An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop.
- CVE-2023-27638An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop.
- CVE-2023-28662The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerabilitGift Cards (Gift Vouchers and Packages) WordPress Plugin
- CVE-2023-28667The Lead Generated WordPress Plugin, version <= 1.23, was affected by an unauthenticated insecure deserialization issue.Lead Generated WordPress Plugin
High 21
- CVE-2023-28434MinIO is vulnerable to privilege escalation on Linux/MacOSminio · github.com/minio/minio
- CVE-2023-28433Minio Privilege Escalation on Windows via Path separator manipulationminio · github.com/minio/minio
- CVE-2023-28432Minio Information Disclosure in Cluster Deploymentminio
- CVE-2023-28431Frontier's modexp precompile is slow for even modulusparitytech frontier · pallet-evm-precompile-modexp
- CVE-2023-28119crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bombcrewjam saml · github.com/crewjam/saml
- CVE-2023-28117Sentry SDK leaks sensitive session information when `sendDefaultPII` is set to `True`getsentry sentry-python · sentry-sdk
- CVE-2023-0870Form Can Be Manipulated with Cross-Site Request Forgery (CSRF)The OpenNMS Group Meridian · The OpenNMS Group Horizon +1
- CVE-2023-1580Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial ofDevolutions Gateway
- CVE-2023-0464Excessive Resource Usage Verifying X.509 Policy ConstraintsOpenSSL
- CVE-2023-1281UAF in Linux kernel's tcindex (traffic control index filter) implementationLinux Kernel
- CVE-2023-27857Rockwell Automation ThinManager ThinServer Heap-Based Buffer OverflowRockwell Automation ThinManager ThinServer
- CVE-2022-4095A use-after-free flaw was found in Linux kernel before 5.19.2.Kernel
- CVE-2022-45003Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.github.com/gophish/gophish
- CVE-2023-0386A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the LinuxKernel
- CVE-2023-25859Adobe Illustrator Improper Input Validation Remote Code Execution VulnerabilityAdobe Illustrator
- CVE-2023-25860Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Illustrator
- CVE-2023-25861Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Illustrator
- CVE-2023-26358Adobe Creative Cloud AdobeExtensionService.exe local privilege escalation vulnerabilityAdobe Creative Cloud
- CVE-2023-26426Adobe Illustrator (Beta) has a UAF vulnerability when parsing SVG files Arbitrary code executionAdobe Illustrator
- CVE-2023-28659The Waiting: One-click Countdowns WordPress Plugin, version <= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbcWaiting: One-click Countdowns WordPress Plugin
- CVE-2023-28663The Formidable PRO2PDF WordPress Plugin, version < 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ paramFormidable PRO2PDF WordPress Plugin
Medium, low and unrated 56
- CVE-2023-26283IBM WebSphere Application Server cross-site scriptingIBM WebSphere Application Server
- CVE-2022-43863IBM QRadar SIEM privilege escalationIBM QRadar SIEM
- CVE-2023-28439ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying processckeditor4
- CVE-2023-28438Pimcore vulnerable to improper quoting of filters in Custom Reportspimcore · pimcore/pimcore
- CVE-2023-28114`cilium-cli` disables etcd authorization for clustermesh clusterscilium-cli · github.com/cilium/cilium-cli
- CVE-2023-25820Nextcloud Server and Enterprise Server missing brute force protection on password confirmation modalnextcloud security-advisories
- CVE-2023-1573DataGear Graph Dataset cross site scriptingDataGear
- CVE-2023-1571DataGear pagingQueryData sql injectionDataGear
- CVE-2023-1570syoyo tinydng tiny_dng_loader.h __interceptor_memcpy heap-based overflowsyoyo tinydng
- CVE-2023-1569SourceCodester E-Commerce System cross site scriptingSourceCodester E-Commerce System
- CVE-2023-1568SourceCodester Student Study Center Desk Management System GET Parameter index.php cross site scriptingSourceCodester Student Study Center Desk Management System
- CVE-2023-1567SourceCodester Student Study Center Desk Management System assign.php cross site scriptingSourceCodester Student Study Center Desk Management System
- CVE-2023-1566SourceCodester Medical Certificate Generator App action.php sql injectionSourceCodester Medical Certificate Generator App
- CVE-2023-1565FeiFeiCMS Extension Tool slide_add.html cross site scriptingFeiFeiCMS
- CVE-2023-1574Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on WindoDevolutions Remote Desktop Manager
- CVE-2023-1564SourceCodester Air Cargo Management System GET Parameter update_status.php sql injectionSourceCodester Air Cargo Management System
- CVE-2023-1563SourceCodester Student Study Center Desk Management System assign.php sql injectionSourceCodester Student Study Center Desk Management System
- CVE-2023-1572DataGear Plugin cross site scriptingDataGear
- CVE-2023-1561code-projects Simple Online Hotel Reservation System add_room.php unrestricted uploadcode-projects Simple Online Hotel Reservation System
- CVE-2023-1560TinyTIFF File tinytiffreader.c buffer overflowTinyTIFF
- CVE-2023-1559SourceCodester Storage Unit Rental Management System unrestricted uploadSourceCodester Storage Unit Rental Management System
- CVE-2023-1558Simple and Beautiful Shopping Cart System uploadera.php unrestricted uploadSimple and Beautiful Shopping Cart System
- CVE-2023-1557SourceCodester E-Commerce System Username access controlSourceCodester E-Commerce System
- CVE-2023-1556SourceCodester Judging Management System summary_results.php sql injectionSourceCodester Judging Management System
- CVE-2023-1562Full name revealed via /plugins/focalboard/api/v2/usersMattermost
- CVE-2023-28708Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurationsApache Software Foundation Apache Tomcat · org.apache.tomca…
- CVE-2022-45004Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.github.com/gophish/gophish
- CVE-2022-45634An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows authenticated attacker to gain access to sensitive a
- CVE-2023-1578 SQL Injection in pimcore/pimcorepimcore/pimcore
- CVE-2023-21615Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-21616Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79)Adobe Experience Manager
- CVE-2023-22252AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2023-22253AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2023-22254AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2023-22256AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2023-22257AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2023-22258AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2023-22259AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2023-22260AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2023-22261AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2023-22262AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2023-22263AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2023-22264AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2023-22265AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2023-22266AEM URL Redirection to Untrusted Site Security feature bypassAdobe Experience Manager
- CVE-2023-22269AEM Reflected XSS Arbitrary code executionAdobe Experience Manager
- CVE-2023-22271AEM Weak Cryptography for Passwords Security feature bypassAdobe Experience Manager
- CVE-2023-25862Adobe Illustrator Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Illustrator
- CVE-2023-26913EVOLUCARE ECSIMAGING (aka ECS Imaging) < 6.21.5 is vulnerable to Cross Site Scripting (XSS) via new_movie.
- CVE-2023-27054A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML v
- CVE-2023-27754vox2mesh 1.0 has stack-overflow in main.cpp, this is stack-overflow caused by incorrect use of memcpy() funciton.
- CVE-2023-28660The Events Made Easy WordPress Plugin, version <= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search_name' paEvents Made Easy WordPress Plugin
- CVE-2023-28661The WP Popup Banners WordPress Plugin, version <= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameteWP Popup Banners WordPress Plugin
- CVE-2023-28664The Meta Data and Taxonomies Filter WordPress plugin, in versions < 1.3.1, is affected by a reflected cross-site scripting vulnerability in Meta Data and Taxonomies Filter WordPress Plugin
- CVE-2023-28665The Woo Bulk Price Update WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page'Woo Bulk Price Update WordPress Plugin
- CVE-2023-28666The InPost Gallery WordPress plugin, in versions < 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' paraInPost Gallery WordPress Plugin