CVEs published March 23, 2023
141 CVEs were published on March 23, 2023: 14 critical, 37 high. 2 are now in CISA KEV.
- Published
- 141
- Critical
- 14
- High
- 37
- Medium
- 63
- Low
- 4
- Unrated
- 23
- Now in CISA KEV
- 2
- Fix available
- 35
Most affected products
- moodle · moodle/moodle
- 9
- Cisco IOS XE Software
- 8
- Jenkins Project Jenkins OctoPerf Load Testing Plugin Plugin…
- 5
- novel-plus
- 4
- Adobe ColdFusion
- 3
- Cisco Aironet Access Point Software
- 3
- Kernel
- 3
- Rebuild
- 3
- SourceCodester Automatic Question Paper Generator System
- 3
- AMD Ryzen™ 2000 Series · AMD Ryzen™ 3000 Series +5
- 2
Critical 14
- CVE-2023-28445Deno improperly handles resizable ArrayBufferdenoland deno · Deno +2
- CVE-2023-25655baserCMS allows any file to be uploadedbaserproject basercms · baserproject/basercms
- CVE-2023-25654baserCMS File Uploader Remote Code Execution (RCE) vulnerabilitybaserproject basercms · baserproject/basercms
- CVE-2023-28677Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build SJenkins Project Jenkins Convert To Pipeline Plugin · org.je…
- CVE-2023-28668Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa_e51 and earlier grants permissions even after they've been disabled.Jenkins Project Jenkins Role-based Authorization Strategy P…
- CVE-2023-1050SQLi in As Koc Web Report SystemAs Koc Energy Web Report System
- CVE-2022-22512VARTA: Multiple devices prone to hard-coded credentialsVARTA Storage Element backup · VARTA Storage Element S1 +5
- CVE-2023-26359Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code executionAdobe ColdFusion
- CVE-2023-27034PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.
- CVE-2023-27078A command injection issue was found in TP-Link MR3020 v.1_150921 that allows a remote attacker to execute arbitrary commands via a crafted r
- CVE-2023-27135TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/set
- CVE-2023-28333Moodle: pix helper potential mustache code injection riskmoodle · moodle/moodle
- CVE-2023-28610The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update ima
- CVE-2023-28611Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended a
High 37
- CVE-2023-28442Geoserver for GeoNode sensitive information leakgeonode
- CVE-2023-28441smartCARS 3 Password Stored as plain text in Error Loginvernyx smartcars-3-bugs
- CVE-2023-20558 Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to AMD Ryzen™ 2000 Series · AMD Ryzen™ 3000 Series +5
- CVE-2023-20559 Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially leadAMD Ryzen™ 2000 Series · AMD Ryzen™ 3000 Series +5
- CVE-2022-47145WordPress Blockonomics Plugin <= 3.5.7 is vulnerable to Cross Site Scripting (XSS)WordPress Bitcoin Payments – Blockonomics
- CVE-2022-47431WordPress Open RDW kenteken voertuiginformatie Plugin <= 2.0.14 is vulnerable to Cross Site Scripting (XSS)Tussendoor internet & marketing Open RDW kenteken voertuigi…
- CVE-2023-22704WordPress teachPress Plugin <= 8.1.8 is vulnerable to Cross Site Scripting (XSS)Michael Winkler teachPress
- CVE-2023-28683Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins Project Jenkins Phabricator Differential Plugin · o…
- CVE-2023-28682Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins Project Jenkins Performance Publisher Plugin · org.…
- CVE-2023-28681Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins Project Jenkins Visual Studio Code Metrics Plugin ·…
- CVE-2023-28680Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins Project Jenkins Crap4J Plugin · org.jenkins-ci.plug…
- CVE-2023-28676A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a PipelinJenkins Project Jenkins Convert To Pipeline Plugin · org.je…
- CVE-2023-28674A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to conneJenkins Project Jenkins OctoPerf Load Testing Plugin Plugin…
- CVE-2022-4224CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3CODESYS Control RTE · CODESYS Control Win +14
- CVE-2018-25048Codesys Runtime Improper Limitation of a PathnameCODESYS Control for BeagleBone · CODESYS Control for em… +14
- CVE-2023-1594novel-plus list MenuService sql injectionnovel-plus
- CVE-2023-26114Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes.code-server
- CVE-2020-19786File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP fi
- CVE-2023-1252A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with thKernel
- CVE-2023-1605Denial of Service in radareorg/radare2radareorg/radare2
- CVE-2023-20027Cisco IOS XE Software Virtual Fragmentation Reassembly Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2023-20035Cisco IOS XE SD-WAN Software Command Injection VulnerabilityCisco IOS XE Software
- CVE-2023-20055Cisco DNA Center Privilege Escalation VulnerabilityCisco Digital Network Architecture Center
- CVE-2023-20065A vulnerability in the Cisco IOx application hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elevCisco IOS XE Software
- CVE-2023-20067Cisco IOS XE Software for Wireless LAN Controllers HTTP Client Profiling Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2023-20072Cisco IOS XE Software Fragmented Tunnel Protocol Packet Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2023-20080Cisco IOS and IOS XE Software IPv6 DHCP (DHCPv6) Relay and Server Denial of Service VulnerabilityCisco IOS
- CVE-2023-20112Cisco Access Point Software Association Request Denial of Service VulnerabilityCisco Aironet Access Point Software
- CVE-2023-26360Adobe ColdFusion Improper Access Control Arbitrary code executionAdobe ColdFusion
- CVE-2023-26496An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto
- CVE-2023-26498An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos Auto T51
- CVE-2023-27077Stack Overflow vulnerability found in 360 D901 allows a remote attacker to cause a Distributed Denial of Service (DDOS) via a crafted HTTP p
- CVE-2023-27079Command Injection vulnerability found in Tenda G103 v.1.0.05 allows an attacker to obtain sensitive information via a crafted package
- CVE-2023-27094An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management mocn.hippo4j:hippo4j-all
- CVE-2023-28335Moodle: csrf risk in resetting all templates of a database activitymoodle · moodle/moodle
- CVE-2023-28758An issue was discovered in Veritas NetBackup before 8.3.0.2.
- CVE-2023-28759An issue was discovered in Veritas NetBackup before 10.0 on Windows.
Medium, low and unrated 90
- CVE-2023-28443directus vulnerable to Insertion of Sensitive Information into Log Filedirectus
- CVE-2023-1613Rebuild publish cross site scriptingRebuild
- CVE-2023-1612Rebuild list-file sql injectionRebuild
- CVE-2023-1610Rebuild list sql injectionRebuild
- CVE-2023-1609Zhong Bang CRMEB Java save cross site scriptingZhong Bang CRMEB Java
- CVE-2023-1608Zhong Bang CRMEB Java list getAdminList sql injectionZhong Bang CRMEB Java
- CVE-2023-1607novel-plus list sql injectionnovel-plus
- CVE-2023-28436Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled processtailscale · tailscale.com
- CVE-2023-1606novel-plus DictController.java sql injectionnovel-plus
- CVE-2023-1603 Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users wDevolutions Server
- CVE-2023-1202Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions Devolutions Remote Desktop Manager
- CVE-2023-25456WordPress Klaviyo Plugin <= 3.0.7 is vulnerable to Cross Site Scripting (XSS)Klaviyo
- CVE-2023-26008WordPress Top 10 Plugin <= 3.2.4 is vulnerable to Cross Site Scripting (XSS)Ajay D'Souza Top 10 – Popular posts plugin for WordPress
- CVE-2023-25992WordPress CM Answers Plugin <= 3.1.9 is vulnerable to Cross Site Scripting (XSS)CreativeMindsSolutions CM Answers
- CVE-2023-23707WordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin <= 2.7.1 is vulnerable to Cross Site Scripting (XSS)Awsm Innovations Embed Any Document – Embed PDF, Word, Powe…
- CVE-2022-47173WordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin <= 1.62.0 is vulnerable to Cross Site Scripting (XSS)nasirahmed Connect Contact Form 7, WooCommerce To Google Sh…
- CVE-2022-47589WordPress CTT Expresso para WooCommerce Plugin <= 3.2.11 is vulnerable to Cross Site Scripting (XSS)this.functional CTT Expresso para WooCommerce
- CVE-2023-22702WordPress WPMobile.App — Android and iOS Mobile Application Plugin <= 11.13 is vulnerable to Cross Site Scripting (XSS)WPMobile.App — Android and iOS Mobile Application
- CVE-2023-23722WordPress WP eBay Product Feeds Plugin <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)Winwar Media WP eBay Product Feeds
- CVE-2023-23728WordPress WP Flipclock Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)Winwar Media WP Flipclock
- CVE-2023-23864WordPress Very Simple Google Maps Plugin <= 2.8.4 is vulnerable to Cross Site Scripting (XSS)Michael Aronoff Very Simple Google Maps
- CVE-2023-23650WordPress MainWP Code Snippets Extension Plugin <= 4.0.2 is vulnerable to Cross Site Scripting (XSS)MainWP Code Snippets Extension
- CVE-2023-22712WordPress TemplatesNext ToolKit Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)TemplatesNext ToolKit
- CVE-2023-22715WordPress WP-CommentNavi Plugin <= 1.12.1 is vulnerable to Cross Site Scripting (XSS)Lester 'GaMerZ' Chan WP-CommentNavi
- CVE-2023-22716WordPress OOPSpam Anti-Spam Plugin <= 1.1.35 is vulnerable to Cross Site Scripting (XSS)OOPSpam Anti-Spam
- CVE-2023-28422WordPress Event Manager for WooCommerce Plugin <= 3.8.6 is vulnerable to Cross Site Scripting (XSS)MagePeople Team Event Manager and Tickets Selling Plugin fo…
- CVE-2022-44742WordPress Community Events Plugin <= 1.4.8 is vulnerable to Cross Site Scripting (XSS)Yannick Lefebvre Community Events
- CVE-2022-45843WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to Cross Site Scripting (XSS)Nextend Smart Slider
- CVE-2023-28684Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins Project Jenkins remote-jobs-view-plugin Plugin · co…
- CVE-2023-28679Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custoJenkins Project Jenkins Mashup Portlets Plugin · javagh.jen…
- CVE-2023-28678Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, resultJenkins Project Jenkins Cppcheck Plugin · org.jenkins-ci.pl…
- CVE-2023-28675A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously confJenkins Project Jenkins OctoPerf Load Testing Plugin Plugin…
- CVE-2023-28673A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission toJenkins Project Jenkins OctoPerf Load Testing Plugin Plugin…
- CVE-2023-28672Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowiJenkins Project Jenkins OctoPerf Load Testing Plugin Plugin…
- CVE-2023-28671A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to conneJenkins Project Jenkins OctoPerf Load Testing Plugin Plugin…
- CVE-2023-28670Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScriptJenkins Project Jenkins Pipeline Aggregator View Plugin · c…
- CVE-2023-28669Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting (Jenkins Project Jenkins JaCoCo Plugin · org.jenkins-ci.plug…
- CVE-2023-1595novel-plus list sql injectionnovel-plus
- CVE-2023-1593SourceCodester Automatic Question Paper Generator System cross site scriptingSourceCodester Automatic Question Paper Generator System
- CVE-2023-1592SourceCodester Automatic Question Paper Generator System GET Parameter view_class.php sql injectionSourceCodester Automatic Question Paper Generator System
- CVE-2023-1591SourceCodester Automatic Question Paper Generator System sql injectionSourceCodester Automatic Question Paper Generator System
- CVE-2023-1590SourceCodester Online Tours & Travels Management System currency.php exec sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2023-1589SourceCodester Online Tours & Travels Management System approve_delete.php exec sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2023-1410Stored XSS in Graphite FunctionDescription tooltipGrafana · github.com/grafana/grafana
- CVE-2023-1051XSS in As Koc Web Report SystemAs Koc Energy Web Report System
- CVE-2020-24857Cross Site Scripting vulnerabilty found in IXPManager v.5.6.0 allows attackers to excute arbitrary code via the looking glass component.
- CVE-2022-28491TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host_name
- CVE-2022-28492TOTOLINK Technology CPE with firmware V6.3c.566 ,allows remote attackers to bypass Login.
- CVE-2022-28493A vulnerability in TOTOLINK CP900 V6.3c.566 allows attackers to start the Telnet service,
- CVE-2022-28494TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via t
- CVE-2022-28496TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via th
- CVE-2022-28497TOTOLink outdoor CPE CP900 V6.3c.566_B20171026 is discovered to contain a command injection vulnerability in the mtd_write_bootloader functi
- CVE-2022-30037XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the
- CVE-2022-3101A flaw was found in tripleo-ansible.tripleo-ansible
- CVE-2022-3146A flaw was found in tripleo-ansible.tripleo-ansible
- CVE-2022-36413Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications.
- CVE-2023-0056An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service.haproxy
- CVE-2023-0590A use-after-free flaw was found in qdisc_graft in net/sched/sch_api.c in the Linux Kernel due to a race problem.Kernel
- CVE-2023-1249A use-after-free flaw was found in the Linux kernel’s core dump subsystem.Kernel
- CVE-2023-1289A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault.ImageMagick · Magick.NET-Q16-AnyCPU +18
- CVE-2023-1402Moodle: course participation report shows roles the user should not seemoodle · moodle/moodle
- CVE-2023-1513A flaw was found in KVM.Linux kernel
- CVE-2023-1544Qemu: pvrdma: out-of-bounds read in pvrdma_ring_next_elem_read()qemu
- CVE-2023-20029Cisco IOS XE Software Privilege Escalation VulnerabilityCisco IOS XE Software
- CVE-2023-20056Cisco Access Point Software Denial of Service VulnerabilityCisco Aironet Access Point Software
- CVE-2023-20059Cisco DNA Center Information Disclosure VulnerabilityCisco Digital Network Architecture Center
- CVE-2023-20066Cisco IOS XE Software Web UI Path Traversal VulnerabilityCisco IOS XE Software
- CVE-2023-20081Cisco Adaptive Security Appliance Software, Firepower Threat Defense Software, IOS Software, and IOS XE Software IPv6 DHCP (DHCPv6) Client Denial of Service VulnerabilityCisco IOS
- CVE-2023-20082Cisco IOS XE Software for Cisco Catalyst 9300 Series Switches Secure Boot Bypass VulnerabilityCisco IOS XE ROMMON Software
- CVE-2023-20097Cisco Access Point Software Command Injection VulnerabilityCisco Aironet Access Point Software
- CVE-2023-20100Cisco IOS XE Software for Wireless LAN Controllers CAPWAP Join Denial of Service VulnerabilityCisco IOS XE Software
- CVE-2023-20107Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys VulnerabilityCisco Adaptive Security Appliance (ASA) Software
- CVE-2023-20113Cisco SD-WAN vManage Software Cross-Site Request Forgery VulnerabilityCisco SD-WAN vManage
- CVE-2023-20859In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to insertiSpring Vault, Spring Cloud Vault, Spring Cloud Config · org…
- CVE-2023-20861In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible fSpring Framework · org.springframework:spring-expression
- CVE-2023-23192IS Decisions UserLock MFA 11.01 is vulnerable to authentication bypass using scheduled task.
- CVE-2023-24295A stack overfow in SoftMaker Software GmbH FlexiPDF v3.0.3.0 allows attackers to execute arbitrary code after opening a crafted PDF file.
- CVE-2023-24655Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the
- CVE-2023-24788NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/sales/customer_delivenotrinos/notrinos-erp
- CVE-2023-26088In Malwarebytes before 4.5.23, a symbolic link may be used delete any arbitrary file on the system by exploiting the local quarantine system
- CVE-2023-26361Adobe ColdFusion Directory Traversal Arbitrary file system read VulnerabilityAdobe ColdFusion
- CVE-2023-27249swfdump v0.9.2 was discovered to contain a heap buffer overflow in the function swf_GetPlaceObject at swfobject.c.
- CVE-2023-28329Moodle: authenticated sql injection via availability checkmoodle · moodle/moodle
- CVE-2023-28330Moodle: authenticated arbitrary file read through malformed backup filemoodle · moodle/moodle
- CVE-2023-28331Moodle: xss risk when outputting database activity filter datamoodle · moodle/moodle
- CVE-2023-28332Moodle: algebra filter xss when filter is misconfiguredmoodle · moodle/moodle
- CVE-2023-28334Moodle: users' name enumeration possible via idor on learning plans pagemoodle · moodle/moodle
- CVE-2023-28336Moodle: teacher can access names of users they do not have permission to accessmoodle · moodle/moodle
- CVE-2023-28470In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication.
- CVE-2023-28772An issue was discovered in the Linux kernel before 5.13.3.