# CVEs published 2023-03-22

84 CVEs were published on March 22, 2023: 7 critical, 21 high. 3 are now in CISA KEV. Days are UTC.

- [CVE-2023-26283](https://cve.now/CVE-2023-26283.md): IBM WebSphere Application Server cross-site scripting (CVSS 5.4, IBM WebSphere Application Server)
- [CVE-2022-43863](https://cve.now/CVE-2022-43863.md): IBM QRadar SIEM privilege escalation (CVSS 6.7, IBM QRadar SIEM)
- [CVE-2023-28439](https://cve.now/CVE-2023-28439.md): ckeditor4 plugins vulnerable to cross-site scripting caused by the editor instance destroying process (CVSS 4.7, ckeditor4)
- [CVE-2023-28438](https://cve.now/CVE-2023-28438.md): Pimcore vulnerable to improper quoting of filters in Custom Reports (CVSS 6.2, pimcore · pimcore/pimcore)
- [CVE-2023-28434](https://cve.now/CVE-2023-28434.md): MinIO is vulnerable to privilege escalation on Linux/MacOS (CVSS 8.8, KEV, minio · github.com/minio/minio)
- [CVE-2023-28433](https://cve.now/CVE-2023-28433.md): Minio Privilege Escalation on Windows via Path separator manipulation (CVSS 8.8, minio · github.com/minio/minio)
- [CVE-2023-28432](https://cve.now/CVE-2023-28432.md): Minio Information Disclosure in Cluster Deployment (CVSS 7.5, KEV, minio)
- [CVE-2023-28431](https://cve.now/CVE-2023-28431.md): Frontier's modexp precompile is slow for even modulus (CVSS 7.5, paritytech frontier · pallet-evm-precompile-modexp)
- [CVE-2023-28119](https://cve.now/CVE-2023-28119.md): crewjam/saml vulnerable to Denial Of Service Via Deflate Decompression Bomb (CVSS 7.5, crewjam saml · github.com/crewjam/saml)
- [CVE-2023-28117](https://cve.now/CVE-2023-28117.md): Sentry SDK leaks sensitive session information when \`sendDefaultPII\` is set to \`True\` (CVSS 7.6, getsentry sentry-python · sentry-sdk)
- [CVE-2023-28114](https://cve.now/CVE-2023-28114.md): \`cilium-cli\` disables etcd authorization for clustermesh clusters (CVSS 4.8, cilium-cli · github.com/cilium/cilium-cli)
- [CVE-2023-25820](https://cve.now/CVE-2023-25820.md): Nextcloud Server and Enterprise Server missing brute force protection on password confirmation modal (CVSS 4.2, nextcloud security-advisories)
- [CVE-2023-0870](https://cve.now/CVE-2023-0870.md): Form Can Be Manipulated with Cross-Site Request Forgery (CSRF) (CVSS 8.1, The OpenNMS Group Meridian · The OpenNMS Group Horizon +1)
- [CVE-2023-1580](https://cve.now/CVE-2023-1580.md): Uncontrolled resource consumption in the logging feature in Devolutions Gateway 2023.1.1 and earlier allows an attacker to cause a denial of (CVSS 7.5, Devolutions Gateway)
- [CVE-2023-0464](https://cve.now/CVE-2023-0464.md): Excessive Resource Usage Verifying X.509 Policy Constraints (CVSS 7.5, OpenSSL)
- [CVE-2023-1573](https://cve.now/CVE-2023-1573.md): DataGear Graph Dataset cross site scripting (CVSS 3.5, DataGear)
- [CVE-2023-1571](https://cve.now/CVE-2023-1571.md): DataGear pagingQueryData sql injection (CVSS 6.3, DataGear)
- [CVE-2023-1570](https://cve.now/CVE-2023-1570.md): syoyo tinydng tiny\_dng\_loader.h \_\_interceptor\_memcpy heap-based overflow (CVSS 3.3, syoyo tinydng)
- [CVE-2023-1569](https://cve.now/CVE-2023-1569.md): SourceCodester E-Commerce System cross site scripting (CVSS 3.5, SourceCodester E-Commerce System)
- [CVE-2023-1568](https://cve.now/CVE-2023-1568.md): SourceCodester Student Study Center Desk Management System GET Parameter index.php cross site scripting (CVSS 3.5, SourceCodester Student Study Center Desk Management System)
- [CVE-2023-1567](https://cve.now/CVE-2023-1567.md): SourceCodester Student Study Center Desk Management System assign.php cross site scripting (CVSS 3.5, SourceCodester Student Study Center Desk Management System)
- [CVE-2023-1566](https://cve.now/CVE-2023-1566.md): SourceCodester Medical Certificate Generator App action.php sql injection (CVSS 6.3, SourceCodester Medical Certificate Generator App)
- [CVE-2023-1281](https://cve.now/CVE-2023-1281.md): UAF in Linux kernel's tcindex (traffic control index filter) implementation (CVSS 7.8, Linux Kernel)
- [CVE-2023-1565](https://cve.now/CVE-2023-1565.md): FeiFeiCMS Extension Tool slide\_add.html cross site scripting (CVSS 3.5, FeiFeiCMS)
- [CVE-2023-1574](https://cve.now/CVE-2023-1574.md): Information disclosure in the user creation feature of a MSSQL data source in Devolutions Remote Desktop Manager 2023.1.9 and below on Windo (CVSS 6.5, Devolutions Remote Desktop Manager)
- [CVE-2023-1564](https://cve.now/CVE-2023-1564.md): SourceCodester Air Cargo Management System GET Parameter update\_status.php sql injection (CVSS 6.3, SourceCodester Air Cargo Management System)
- [CVE-2023-1563](https://cve.now/CVE-2023-1563.md): SourceCodester Student Study Center Desk Management System assign.php sql injection (CVSS 6.3, SourceCodester Student Study Center Desk Management System)
- [CVE-2023-1572](https://cve.now/CVE-2023-1572.md): DataGear Plugin cross site scripting (CVSS 2.0, DataGear)
- [CVE-2023-1561](https://cve.now/CVE-2023-1561.md): code-projects Simple Online Hotel Reservation System add\_room.php unrestricted upload (CVSS 6.3, code-projects Simple Online Hotel Reservation System)
- [CVE-2023-1560](https://cve.now/CVE-2023-1560.md): TinyTIFF File tinytiffreader.c buffer overflow (CVSS 2.8, TinyTIFF)
- [CVE-2023-1559](https://cve.now/CVE-2023-1559.md): SourceCodester Storage Unit Rental Management System unrestricted upload (CVSS 4.7, SourceCodester Storage Unit Rental Management System)
- [CVE-2023-1558](https://cve.now/CVE-2023-1558.md): Simple and Beautiful Shopping Cart System uploadera.php unrestricted upload (CVSS 6.3, Simple and Beautiful Shopping Cart System)
- [CVE-2023-1557](https://cve.now/CVE-2023-1557.md): SourceCodester E-Commerce System Username access control (CVSS 6.3, SourceCodester E-Commerce System)
- [CVE-2023-1556](https://cve.now/CVE-2023-1556.md): SourceCodester Judging Management System summary\_results.php sql injection (CVSS 6.3, SourceCodester Judging Management System)
- [CVE-2023-1562](https://cve.now/CVE-2023-1562.md): Full name revealed via /plugins/focalboard/api/v2/users (CVSS 3.5, Mattermost)
- [CVE-2023-28708](https://cve.now/CVE-2023-28708.md): Apache Tomcat: JSESSIONID Cookie missing secure attribute in some configurations (CVSS 4.3, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2023-27857](https://cve.now/CVE-2023-27857.md): Rockwell Automation ThinManager ThinServer Heap-Based Buffer Overflow (CVSS 7.5, Rockwell Automation ThinManager ThinServer)
- [CVE-2022-4095](https://cve.now/CVE-2022-4095.md): A use-after-free flaw was found in Linux kernel before 5.19.2. (CVSS 7.8, Kernel)
- [CVE-2022-45003](https://cve.now/CVE-2022-45003.md): Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus. (CVSS 7.5, github.com/gophish/gophish)
- [CVE-2022-45004](https://cve.now/CVE-2022-45004.md): Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page. (CVSS 6.1, github.com/gophish/gophish)
- [CVE-2022-45634](https://cve.now/CVE-2022-45634.md): An issue discovered in MEGAFEIS, BOFEI DBD+ Application for IOS & Android v1.4.4 allows authenticated attacker to gain access to sensitive a (CVSS 4.3)
- [CVE-2023-0386](https://cve.now/CVE-2023-0386.md): A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux (CVSS 7.8, KEV, Kernel)
- [CVE-2023-1578](https://cve.now/CVE-2023-1578.md): SQL Injection in pimcore/pimcore (CVSS 6.7, pimcore/pimcore)
- [CVE-2023-21615](https://cve.now/CVE-2023-21615.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-21616](https://cve.now/CVE-2023-21616.md): Adobe Experience Manager | Cross-site Scripting (Reflected XSS) (CWE-79) (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22252](https://cve.now/CVE-2023-22252.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22253](https://cve.now/CVE-2023-22253.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22254](https://cve.now/CVE-2023-22254.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22256](https://cve.now/CVE-2023-22256.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22257](https://cve.now/CVE-2023-22257.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22258](https://cve.now/CVE-2023-22258.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22259](https://cve.now/CVE-2023-22259.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22260](https://cve.now/CVE-2023-22260.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22261](https://cve.now/CVE-2023-22261.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22262](https://cve.now/CVE-2023-22262.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22263](https://cve.now/CVE-2023-22263.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22264](https://cve.now/CVE-2023-22264.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22265](https://cve.now/CVE-2023-22265.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22266](https://cve.now/CVE-2023-22266.md): AEM URL Redirection to Untrusted Site Security feature bypass (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22269](https://cve.now/CVE-2023-22269.md): AEM Reflected XSS Arbitrary code execution (CVSS 5.4, Adobe Experience Manager)
- [CVE-2023-22271](https://cve.now/CVE-2023-22271.md): AEM Weak Cryptography for Passwords Security feature bypass (CVSS 5.3, Adobe Experience Manager)
- [CVE-2023-25859](https://cve.now/CVE-2023-25859.md): Adobe Illustrator Improper Input Validation Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2023-25860](https://cve.now/CVE-2023-25860.md): Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2023-25861](https://cve.now/CVE-2023-25861.md): Adobe Illustrator Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Illustrator)
- [CVE-2023-25862](https://cve.now/CVE-2023-25862.md): Adobe Illustrator Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Illustrator)
- [CVE-2023-26358](https://cve.now/CVE-2023-26358.md): Adobe Creative Cloud AdobeExtensionService.exe local privilege escalation vulnerability (CVSS 8.6, Adobe Creative Cloud)
- [CVE-2023-26426](https://cve.now/CVE-2023-26426.md): Adobe Illustrator (Beta) has a UAF vulnerability when parsing SVG files Arbitrary code execution (CVSS 7.8, Adobe Illustrator)
- [CVE-2023-26913](https://cve.now/CVE-2023-26913.md): EVOLUCARE ECSIMAGING (aka ECS Imaging) \< 6.21.5 is vulnerable to Cross Site Scripting (XSS) via new\_movie. (no CVSS)
- [CVE-2023-27054](https://cve.now/CVE-2023-27054.md): A cross-site scripting (XSS) vulnerability in MiroTalk P2P before commit f535b35 allows attackers to execute arbitrary web scripts or HTML v (CVSS 6.1)
- [CVE-2023-27060](https://cve.now/CVE-2023-27060.md): LightCMS v1.3.7 was discovered to contain a remote code execution (RCE) vulnerability via the image:make function. (CVSS 9.8)
- [CVE-2023-27100](https://cve.now/CVE-2023-27100.md): Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v22.05.1 and pfSense CE (CVSS 9.8)
- [CVE-2023-27224](https://cve.now/CVE-2023-27224.md): An issue found in NginxProxyManager v.2.9.19 allows an attacker to execute arbitrary code via a lua script to the configuration file. (CVSS 9.8)
- [CVE-2023-27637](https://cve.now/CVE-2023-27637.md): An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. (CVSS 9.8)
- [CVE-2023-27638](https://cve.now/CVE-2023-27638.md): An issue was discovered in the tshirtecommerce (aka Custom Product Designer) component 2.1.4 for PrestaShop. (CVSS 9.8)
- [CVE-2023-27754](https://cve.now/CVE-2023-27754.md): vox2mesh 1.0 has stack-overflow in main.cpp, this is stack-overflow caused by incorrect use of memcpy() funciton. (CVSS 5.5)
- [CVE-2023-28659](https://cve.now/CVE-2023-28659.md): The Waiting: One-click Countdowns WordPress Plugin, version \<= 0.6.2, is affected by an authenticated SQL injection vulnerability in the pbc (CVSS 8.8, Waiting: One-click Countdowns WordPress Plugin)
- [CVE-2023-28660](https://cve.now/CVE-2023-28660.md): The Events Made Easy WordPress Plugin, version \<= 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'search\_name' pa (no CVSS, Events Made Easy WordPress Plugin)
- [CVE-2023-28661](https://cve.now/CVE-2023-28661.md): The WP Popup Banners WordPress Plugin, version \<= 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' paramete (no CVSS, WP Popup Banners WordPress Plugin)
- [CVE-2023-28662](https://cve.now/CVE-2023-28662.md): The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version \<= 4.3.1, is affected by an unauthenticated SQL injection vulnerabilit (CVSS 9.8, Gift Cards (Gift Vouchers and Packages) WordPress Plugin)
- [CVE-2023-28663](https://cve.now/CVE-2023-28663.md): The Formidable PRO2PDF WordPress Plugin, version \< 3.11, is affected by an authenticated SQL injection vulnerability in the ‘fieldmap’ param (CVSS 8.8, Formidable PRO2PDF WordPress Plugin)
- [CVE-2023-28664](https://cve.now/CVE-2023-28664.md): The Meta Data and Taxonomies Filter WordPress plugin, in versions \< 1.3.1, is affected by a reflected cross-site scripting vulnerability in (CVSS 5.4, Meta Data and Taxonomies Filter WordPress Plugin)
- [CVE-2023-28665](https://cve.now/CVE-2023-28665.md): The Woo Bulk Price Update WordPress plugin, in versions \< 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'page' (CVSS 5.4, Woo Bulk Price Update WordPress Plugin)
- [CVE-2023-28666](https://cve.now/CVE-2023-28666.md): The InPost Gallery WordPress plugin, in versions \< 2.2.2, is affected by a reflected cross-site scripting vulnerability in the 'imgurl' para (CVSS 5.4, InPost Gallery WordPress Plugin)
- [CVE-2023-28667](https://cve.now/CVE-2023-28667.md): The Lead Generated WordPress Plugin, version \<= 1.23, was affected by an unauthenticated insecure deserialization issue. (CVSS 9.8, Lead Generated WordPress Plugin)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-22
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.