# CVEs published 2023-03-23

141 CVEs were published on March 23, 2023: 14 critical, 37 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-28445](https://cve.now/CVE-2023-28445.md): Deno improperly handles resizable ArrayBuffer (CVSS 10.0, denoland deno · Deno +2)
- [CVE-2023-28443](https://cve.now/CVE-2023-28443.md): directus vulnerable to Insertion of Sensitive Information into Log File (CVSS 4.2, directus)
- [CVE-2023-28442](https://cve.now/CVE-2023-28442.md): Geoserver for GeoNode sensitive information leak (CVSS 7.5, geonode)
- [CVE-2023-28441](https://cve.now/CVE-2023-28441.md): smartCARS 3 Password Stored as plain text in Error Log (CVSS 8.0, invernyx smartcars-3-bugs)
- [CVE-2023-1613](https://cve.now/CVE-2023-1613.md): Rebuild publish cross site scripting (CVSS 3.5, Rebuild)
- [CVE-2023-1612](https://cve.now/CVE-2023-1612.md): Rebuild list-file sql injection (CVSS 6.3, Rebuild)
- [CVE-2023-1610](https://cve.now/CVE-2023-1610.md): Rebuild list sql injection (CVSS 6.3, Rebuild)
- [CVE-2023-1609](https://cve.now/CVE-2023-1609.md): Zhong Bang CRMEB Java save cross site scripting (CVSS 3.5, Zhong Bang CRMEB Java)
- [CVE-2023-1608](https://cve.now/CVE-2023-1608.md): Zhong Bang CRMEB Java list getAdminList sql injection (CVSS 6.3, Zhong Bang CRMEB Java)
- [CVE-2023-1607](https://cve.now/CVE-2023-1607.md): novel-plus list sql injection (CVSS 4.7, novel-plus)
- [CVE-2023-28436](https://cve.now/CVE-2023-28436.md): Non-interactive Tailscale SSH sessions on FreeBSD may use the effective group ID of the tailscaled process (CVSS 5.7, tailscale · tailscale.com)
- [CVE-2023-25655](https://cve.now/CVE-2023-25655.md): baserCMS allows any file to be uploaded (CVSS 9.8, baserproject basercms · baserproject/basercms)
- [CVE-2023-25654](https://cve.now/CVE-2023-25654.md): baserCMS File Uploader Remote Code Execution (RCE) vulnerability (CVSS 9.8, baserproject basercms · baserproject/basercms)
- [CVE-2023-1606](https://cve.now/CVE-2023-1606.md): novel-plus DictController.java sql injection (CVSS 6.3, novel-plus)
- [CVE-2023-20558](https://cve.now/CVE-2023-20558.md): Insufficient control flow management in AmdCpmOemSmm may allow a privileged attacker to tamper with the SMM handler potentially leading to (CVSS 8.8, AMD Ryzen™ 2000 Series · AMD Ryzen™ 3000 Series +5)
- [CVE-2023-20559](https://cve.now/CVE-2023-20559.md): Insufficient control flow management in AmdCpmGpioInitSmm may allow a privileged attacker to tamper with the SMM handler potentially lead (CVSS 8.8, AMD Ryzen™ 2000 Series · AMD Ryzen™ 3000 Series +5)
- [CVE-2023-1603](https://cve.now/CVE-2023-1603.md): Permission bypass when importing or synchronizing entries in User vault in Devolutions Server 2022.3.13 and prior versions allows users w (CVSS 6.5, Devolutions Server)
- [CVE-2023-1202](https://cve.now/CVE-2023-1202.md): Permission bypass when importing or synchronizing entries in User vault in Devolutions Remote Desktop Manager 2023.1.9 and prior versions (CVSS 6.5, Devolutions Remote Desktop Manager)
- [CVE-2023-25456](https://cve.now/CVE-2023-25456.md): WordPress Klaviyo Plugin \<= 3.0.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Klaviyo)
- [CVE-2023-26008](https://cve.now/CVE-2023-26008.md): WordPress Top 10 Plugin \<= 3.2.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Ajay D'Souza Top 10 – Popular posts plugin for WordPress)
- [CVE-2023-25992](https://cve.now/CVE-2023-25992.md): WordPress CM Answers Plugin \<= 3.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, CreativeMindsSolutions CM Answers)
- [CVE-2023-23707](https://cve.now/CVE-2023-23707.md): WordPress Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files Plugin \<= 2.7.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Awsm Innovations Embed Any Document – Embed PDF, Word, Powe…)
- [CVE-2022-47145](https://cve.now/CVE-2022-47145.md): WordPress Blockonomics Plugin \<= 3.5.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, WordPress Bitcoin Payments – Blockonomics)
- [CVE-2022-47173](https://cve.now/CVE-2022-47173.md): WordPress Connect Contact Form 7, WooCommerce To Google Sheets & Other Platforms – Advanced Form Integration Plugin \<= 1.62.0 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, nasirahmed Connect Contact Form 7, WooCommerce To Google Sh…)
- [CVE-2022-47589](https://cve.now/CVE-2022-47589.md): WordPress CTT Expresso para WooCommerce Plugin \<= 3.2.11 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, this.functional CTT Expresso para WooCommerce)
- [CVE-2023-22702](https://cve.now/CVE-2023-22702.md): WordPress WPMobile.App — Android and iOS Mobile Application Plugin \<= 11.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, WPMobile.App — Android and iOS Mobile Application)
- [CVE-2023-23722](https://cve.now/CVE-2023-23722.md): WordPress WP eBay Product Feeds Plugin \<= 3.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Winwar Media WP eBay Product Feeds)
- [CVE-2023-23728](https://cve.now/CVE-2023-23728.md): WordPress WP Flipclock Plugin \<= 1.7.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Winwar Media WP Flipclock)
- [CVE-2023-23864](https://cve.now/CVE-2023-23864.md): WordPress Very Simple Google Maps Plugin \<= 2.8.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Michael Aronoff Very Simple Google Maps)
- [CVE-2023-23650](https://cve.now/CVE-2023-23650.md): WordPress MainWP Code Snippets Extension Plugin \<= 4.0.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, MainWP Code Snippets Extension)
- [CVE-2023-22712](https://cve.now/CVE-2023-22712.md): WordPress TemplatesNext ToolKit Plugin \<= 3.2.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, TemplatesNext ToolKit)
- [CVE-2023-22715](https://cve.now/CVE-2023-22715.md): WordPress WP-CommentNavi Plugin \<= 1.12.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Lester 'GaMerZ' Chan WP-CommentNavi)
- [CVE-2023-22716](https://cve.now/CVE-2023-22716.md): WordPress OOPSpam Anti-Spam Plugin \<= 1.1.35 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, OOPSpam Anti-Spam)
- [CVE-2022-47431](https://cve.now/CVE-2022-47431.md): WordPress Open RDW kenteken voertuiginformatie Plugin \<= 2.0.14 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Tussendoor internet & marketing Open RDW kenteken voertuigi…)
- [CVE-2023-28422](https://cve.now/CVE-2023-28422.md): WordPress Event Manager for WooCommerce Plugin \<= 3.8.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, MagePeople Team Event Manager and Tickets Selling Plugin fo…)
- [CVE-2023-22704](https://cve.now/CVE-2023-22704.md): WordPress teachPress Plugin \<= 8.1.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Michael Winkler teachPress)
- [CVE-2022-44742](https://cve.now/CVE-2022-44742.md): WordPress Community Events Plugin \<= 1.4.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, Yannick Lefebvre Community Events)
- [CVE-2022-45843](https://cve.now/CVE-2022-45843.md): WordPress Smart Slider 3 Plugin \<= 3.5.1.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4, Nextend Smart Slider)
- [CVE-2023-28684](https://cve.now/CVE-2023-28684.md): Jenkins remote-jobs-view-plugin Plugin 0.0.3 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 6.5, Jenkins Project Jenkins remote-jobs-view-plugin Plugin · co…)
- [CVE-2023-28683](https://cve.now/CVE-2023-28683.md): Jenkins Phabricator Differential Plugin 2.1.5 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 8.2, Jenkins Project Jenkins Phabricator Differential Plugin · o…)
- [CVE-2023-28682](https://cve.now/CVE-2023-28682.md): Jenkins Performance Publisher Plugin 8.09 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 8.2, Jenkins Project Jenkins Performance Publisher Plugin · org.…)
- [CVE-2023-28681](https://cve.now/CVE-2023-28681.md): Jenkins Visual Studio Code Metrics Plugin 1.7 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 8.2, Jenkins Project Jenkins Visual Studio Code Metrics Plugin ·…)
- [CVE-2023-28680](https://cve.now/CVE-2023-28680.md): Jenkins Crap4J Plugin 0.9 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks. (CVSS 7.5, Jenkins Project Jenkins Crap4J Plugin · org.jenkins-ci.plug…)
- [CVE-2023-28679](https://cve.now/CVE-2023-28679.md): Jenkins Mashup Portlets Plugin 1.1.2 and earlier provides the "Generic JS Portlet" feature that lets a user populate a portlet using a custo (CVSS 5.4, Jenkins Project Jenkins Mashup Portlets Plugin · javagh.jen…)
- [CVE-2023-28678](https://cve.now/CVE-2023-28678.md): Jenkins Cppcheck Plugin 1.26 and earlier does not escape file names from Cppcheck report files before showing them on the Jenkins UI, result (CVSS 5.4, Jenkins Project Jenkins Cppcheck Plugin · org.jenkins-ci.pl…)
- [CVE-2023-28677](https://cve.now/CVE-2023-28677.md): Jenkins Convert To Pipeline Plugin 1.0 and earlier uses basic string concatenation to convert Freestyle projects' Build Environment, Build S (CVSS 9.8, Jenkins Project Jenkins Convert To Pipeline Plugin · org.je…)
- [CVE-2023-28676](https://cve.now/CVE-2023-28676.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Convert To Pipeline Plugin 1.0 and earlier allows attackers to create a Pipelin (CVSS 8.8, Jenkins Project Jenkins Convert To Pipeline Plugin · org.je…)
- [CVE-2023-28675](https://cve.now/CVE-2023-28675.md): A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to connect to a previously conf (CVSS 4.3, Jenkins Project Jenkins OctoPerf Load Testing Plugin Plugin…)
- [CVE-2023-28674](https://cve.now/CVE-2023-28674.md): A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers to conne (CVSS 8.8, Jenkins Project Jenkins OctoPerf Load Testing Plugin Plugin…)
- [CVE-2023-28673](https://cve.now/CVE-2023-28673.md): A missing permission check in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.2 and earlier allows attackers with Overall/Read permission to (no CVSS, Jenkins Project Jenkins OctoPerf Load Testing Plugin Plugin…)
- [CVE-2023-28672](https://cve.now/CVE-2023-28672.md): Jenkins OctoPerf Load Testing Plugin Plugin 4.5.1 and earlier does not perform a permission check in a connection test HTTP endpoint, allowi (CVSS 6.5, Jenkins Project Jenkins OctoPerf Load Testing Plugin Plugin…)
- [CVE-2023-28671](https://cve.now/CVE-2023-28671.md): A cross-site request forgery (CSRF) vulnerability in Jenkins OctoPerf Load Testing Plugin Plugin 4.5.0 and earlier allows attackers to conne (CVSS 4.3, Jenkins Project Jenkins OctoPerf Load Testing Plugin Plugin…)
- [CVE-2023-28670](https://cve.now/CVE-2023-28670.md): Jenkins Pipeline Aggregator View Plugin 1.13 and earlier does not escape a variable representing the current view's URL in inline JavaScript (CVSS 5.4, Jenkins Project Jenkins Pipeline Aggregator View Plugin · c…)
- [CVE-2023-28669](https://cve.now/CVE-2023-28669.md): Jenkins JaCoCo Plugin 3.3.2 and earlier does not escape class and method names shown on the UI, resulting in a stored cross-site scripting ( (CVSS 5.4, Jenkins Project Jenkins JaCoCo Plugin · org.jenkins-ci.plug…)
- [CVE-2023-28668](https://cve.now/CVE-2023-28668.md): Jenkins Role-based Authorization Strategy Plugin 587.v2872c41fa\_e51 and earlier grants permissions even after they've been disabled. (CVSS 9.8, Jenkins Project Jenkins Role-based Authorization Strategy P…)
- [CVE-2022-4224](https://cve.now/CVE-2022-4224.md): CODESYS: Exposure of Resource to Wrong Sphere in CODESYS V3 (CVSS 8.8, CODESYS Control RTE · CODESYS Control Win +14)
- [CVE-2018-25048](https://cve.now/CVE-2018-25048.md): Codesys Runtime Improper Limitation of a Pathname (CVSS 8.8, CODESYS Control for BeagleBone · CODESYS Control for em… +14)
- [CVE-2023-1595](https://cve.now/CVE-2023-1595.md): novel-plus list sql injection (CVSS 4.7, novel-plus)
- [CVE-2023-1594](https://cve.now/CVE-2023-1594.md): novel-plus list MenuService sql injection (CVSS 7.3, novel-plus)
- [CVE-2023-1593](https://cve.now/CVE-2023-1593.md): SourceCodester Automatic Question Paper Generator System cross site scripting (CVSS 3.5, SourceCodester Automatic Question Paper Generator System)
- [CVE-2023-1592](https://cve.now/CVE-2023-1592.md): SourceCodester Automatic Question Paper Generator System GET Parameter view\_class.php sql injection (CVSS 6.3, SourceCodester Automatic Question Paper Generator System)
- [CVE-2023-1591](https://cve.now/CVE-2023-1591.md): SourceCodester Automatic Question Paper Generator System sql injection (CVSS 6.3, SourceCodester Automatic Question Paper Generator System)
- [CVE-2023-1590](https://cve.now/CVE-2023-1590.md): SourceCodester Online Tours & Travels Management System currency.php exec sql injection (CVSS 6.3, SourceCodester Online Tours & Travels Management System)
- [CVE-2023-1589](https://cve.now/CVE-2023-1589.md): SourceCodester Online Tours & Travels Management System approve\_delete.php exec sql injection (CVSS 6.3, SourceCodester Online Tours & Travels Management System)
- [CVE-2023-1410](https://cve.now/CVE-2023-1410.md): Stored XSS in Graphite FunctionDescription tooltip (CVSS 6.2, Grafana · github.com/grafana/grafana)
- [CVE-2023-1051](https://cve.now/CVE-2023-1051.md): XSS in As Koc Web Report System (CVSS 6.1, As Koc Energy Web Report System)
- [CVE-2023-1050](https://cve.now/CVE-2023-1050.md): SQLi in As Koc Web Report System (CVSS 9.8, As Koc Energy Web Report System)
- [CVE-2022-22512](https://cve.now/CVE-2022-22512.md): VARTA: Multiple devices prone to hard-coded credentials (CVSS 9.8, VARTA Storage Element backup · VARTA Storage Element S1 +5)
- [CVE-2023-26114](https://cve.now/CVE-2023-26114.md): Versions of the package code-server before 4.10.1 are vulnerable to Missing Origin Validation in WebSockets handshakes. (CVSS 8.2, code-server)
- [CVE-2020-19786](https://cve.now/CVE-2020-19786.md): File upload vulnerability in CSKaza CSZ CMS v.1.2.2 fixed in v1.2.4 allows attacker to execute aritrary commands and code via crafted PHP fi (CVSS 8.8)
- [CVE-2020-24857](https://cve.now/CVE-2020-24857.md): Cross Site Scripting vulnerabilty found in IXPManager v.5.6.0 allows attackers to excute arbitrary code via the looking glass component. (CVSS 6.1)
- [CVE-2022-28491](https://cve.now/CVE-2022-28491.md): TOTOLink outdoor CPE CP900 V6.3c.566\_B20171026 contains a command injection vulnerability in the NTPSyncWithHost function via the host\_name (no CVSS)
- [CVE-2022-28492](https://cve.now/CVE-2022-28492.md): TOTOLINK Technology CPE with firmware V6.3c.566 ,allows remote attackers to bypass Login. (no CVSS)
- [CVE-2022-28493](https://cve.now/CVE-2022-28493.md): A vulnerability in TOTOLINK CP900 V6.3c.566 allows attackers to start the Telnet service, (no CVSS)
- [CVE-2022-28494](https://cve.now/CVE-2022-28494.md): TOTOLink outdoor CPE CP900 V6.3c.566\_B20171026 is discovered to contain a command injection vulnerability in the setUpgradeFW function via t (no CVSS)
- [CVE-2022-28496](https://cve.now/CVE-2022-28496.md): TOTOLink outdoor CPE CP900 V6.3c.566\_B20171026 discovered to contain a command injection vulnerability in the setPasswordCfg function via th (no CVSS)
- [CVE-2022-28497](https://cve.now/CVE-2022-28497.md): TOTOLink outdoor CPE CP900 V6.3c.566\_B20171026 is discovered to contain a command injection vulnerability in the mtd\_write\_bootloader functi (no CVSS)
- [CVE-2022-30037](https://cve.now/CVE-2022-30037.md): XunRuiCMS v4.3.3 to v4.5.1 vulnerable to PHP file write and CMS PHP file inclusion, allows attackers to execute arbitrary php code, via the (no CVSS)
- [CVE-2022-3101](https://cve.now/CVE-2022-3101.md): A flaw was found in tripleo-ansible. (no CVSS, tripleo-ansible)
- [CVE-2022-3146](https://cve.now/CVE-2022-3146.md): A flaw was found in tripleo-ansible. (no CVSS, tripleo-ansible)
- [CVE-2022-36413](https://cve.now/CVE-2022-36413.md): Zoho ManageEngine ADSelfService Plus through 6203 is vulnerable to a brute-force attack that leads to a password reset on IDM applications. (no CVSS)
- [CVE-2023-0056](https://cve.now/CVE-2023-0056.md): An uncontrolled resource consumption vulnerability was discovered in HAProxy which could crash the service. (CVSS 6.5, haproxy)
- [CVE-2023-0590](https://cve.now/CVE-2023-0590.md): A use-after-free flaw was found in qdisc\_graft in net/sched/sch\_api.c in the Linux Kernel due to a race problem. (no CVSS, Kernel)
- [CVE-2023-1249](https://cve.now/CVE-2023-1249.md): A use-after-free flaw was found in the Linux kernel’s core dump subsystem. (CVSS 5.5, Kernel)
- [CVE-2023-1252](https://cve.now/CVE-2023-1252.md): A use-after-free flaw was found in the Linux kernel’s Ext4 File System in how a user triggers several file operations simultaneously with th (CVSS 7.8, Kernel)
- [CVE-2023-1289](https://cve.now/CVE-2023-1289.md): A vulnerability was discovered in ImageMagick where a specially created SVG file loads itself and causes a segmentation fault. (no CVSS, ImageMagick · Magick.NET-Q16-AnyCPU +18)
- [CVE-2023-1402](https://cve.now/CVE-2023-1402.md): Moodle: course participation report shows roles the user should not see (no CVSS, moodle · moodle/moodle)
- [CVE-2023-1513](https://cve.now/CVE-2023-1513.md): A flaw was found in KVM. (CVSS 3.3, Linux kernel)
- [CVE-2023-1544](https://cve.now/CVE-2023-1544.md): Qemu: pvrdma: out-of-bounds read in pvrdma\_ring\_next\_elem\_read() (CVSS 6.0, qemu)
- [CVE-2023-1605](https://cve.now/CVE-2023-1605.md): Denial of Service in radareorg/radare2 (CVSS 7.5, radareorg/radare2)
- [CVE-2023-20027](https://cve.now/CVE-2023-20027.md): Cisco IOS XE Software Virtual Fragmentation Reassembly Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2023-20029](https://cve.now/CVE-2023-20029.md): Cisco IOS XE Software Privilege Escalation Vulnerability (CVSS 4.4, Cisco IOS XE Software)
- [CVE-2023-20035](https://cve.now/CVE-2023-20035.md): Cisco IOS XE SD-WAN Software Command Injection Vulnerability (CVSS 7.8, Cisco IOS XE Software)
- [CVE-2023-20055](https://cve.now/CVE-2023-20055.md): Cisco DNA Center Privilege Escalation Vulnerability (CVSS 8.0, Cisco Digital Network Architecture Center)
- [CVE-2023-20056](https://cve.now/CVE-2023-20056.md): Cisco Access Point Software Denial of Service Vulnerability (CVSS 6.5, Cisco Aironet Access Point Software)
- [CVE-2023-20059](https://cve.now/CVE-2023-20059.md): Cisco DNA Center Information Disclosure Vulnerability (CVSS 4.3, Cisco Digital Network Architecture Center)
- [CVE-2023-20065](https://cve.now/CVE-2023-20065.md): A vulnerability in the Cisco IOx application hosting subsystem of Cisco IOS XE Software could allow an authenticated, local attacker to elev (CVSS 7.8, Cisco IOS XE Software)
- [CVE-2023-20066](https://cve.now/CVE-2023-20066.md): Cisco IOS XE Software Web UI Path Traversal Vulnerability (CVSS 6.5, Cisco IOS XE Software)
- [CVE-2023-20067](https://cve.now/CVE-2023-20067.md): Cisco IOS XE Software for Wireless LAN Controllers HTTP Client Profiling Denial of Service Vulnerability (CVSS 7.4, Cisco IOS XE Software)
- [CVE-2023-20072](https://cve.now/CVE-2023-20072.md): Cisco IOS XE Software Fragmented Tunnel Protocol Packet Denial of Service Vulnerability (CVSS 8.6, Cisco IOS XE Software)
- [CVE-2023-20080](https://cve.now/CVE-2023-20080.md): Cisco IOS and IOS XE Software IPv6 DHCP (DHCPv6) Relay and Server Denial of Service Vulnerability (CVSS 8.6, Cisco IOS)
- [CVE-2023-20081](https://cve.now/CVE-2023-20081.md): Cisco Adaptive Security Appliance Software, Firepower Threat Defense Software, IOS Software, and IOS XE Software IPv6 DHCP (DHCPv6) Client Denial of Service Vulnerability (CVSS 6.8, Cisco IOS)
- [CVE-2023-20082](https://cve.now/CVE-2023-20082.md): Cisco IOS XE Software for Cisco Catalyst 9300 Series Switches Secure Boot Bypass Vulnerability (CVSS 6.1, Cisco IOS XE ROMMON Software)
- [CVE-2023-20097](https://cve.now/CVE-2023-20097.md): Cisco Access Point Software Command Injection Vulnerability (CVSS 4.6, Cisco Aironet Access Point Software)
- [CVE-2023-20100](https://cve.now/CVE-2023-20100.md): Cisco IOS XE Software for Wireless LAN Controllers CAPWAP Join Denial of Service Vulnerability (CVSS 6.8, Cisco IOS XE Software)
- [CVE-2023-20107](https://cve.now/CVE-2023-20107.md): Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software Low-Entropy Keys Vulnerability (CVSS 5.3, Cisco Adaptive Security Appliance (ASA) Software)
- [CVE-2023-20112](https://cve.now/CVE-2023-20112.md): Cisco Access Point Software Association Request Denial of Service Vulnerability (CVSS 7.4, Cisco Aironet Access Point Software)
- [CVE-2023-20113](https://cve.now/CVE-2023-20113.md): Cisco SD-WAN vManage Software Cross-Site Request Forgery Vulnerability (CVSS 6.5, Cisco SD-WAN vManage)
- [CVE-2023-20859](https://cve.now/CVE-2023-20859.md): In Spring Vault, versions 3.0.x prior to 3.0.2 and versions 2.3.x prior to 2.3.3 and older versions, an application is vulnerable to inserti (no CVSS, Spring Vault, Spring Cloud Vault, Spring Cloud Config · org…)
- [CVE-2023-20861](https://cve.now/CVE-2023-20861.md): In Spring Framework versions 6.0.0 - 6.0.6, 5.3.0 - 5.3.25, 5.2.0.RELEASE - 5.2.22.RELEASE, and older unsupported versions, it is possible f (no CVSS, Spring Framework · org.springframework:spring-expression)
- [CVE-2023-23192](https://cve.now/CVE-2023-23192.md): IS Decisions UserLock MFA 11.01 is vulnerable to authentication bypass using scheduled task. (no CVSS)
- [CVE-2023-24295](https://cve.now/CVE-2023-24295.md): A stack overfow in SoftMaker Software GmbH FlexiPDF v3.0.3.0 allows attackers to execute arbitrary code after opening a crafted PDF file. (no CVSS)
- [CVE-2023-24655](https://cve.now/CVE-2023-24655.md): Simple Customer Relationship Management System v1.0 was discovered to contain a SQL injection vulnerability via the name parameter under the (no CVSS)
- [CVE-2023-24788](https://cve.now/CVE-2023-24788.md): NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/sales/customer\_delive (no CVSS, notrinos/notrinos-erp)
- [CVE-2023-26088](https://cve.now/CVE-2023-26088.md): In Malwarebytes before 4.5.23, a symbolic link may be used delete any arbitrary file on the system by exploiting the local quarantine system (no CVSS)
- [CVE-2023-26359](https://cve.now/CVE-2023-26359.md): Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution (CVSS 9.8, KEV, Adobe ColdFusion)
- [CVE-2023-26360](https://cve.now/CVE-2023-26360.md): Adobe ColdFusion Improper Access Control Arbitrary code execution (CVSS 8.6, KEV, Adobe ColdFusion)
- [CVE-2023-26361](https://cve.now/CVE-2023-26361.md): Adobe ColdFusion Directory Traversal Arbitrary file system read Vulnerability (CVSS 4.9, Adobe ColdFusion)
- [CVE-2023-26496](https://cve.now/CVE-2023-26496.md): An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto (CVSS 8.6)
- [CVE-2023-26498](https://cve.now/CVE-2023-26498.md): An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos Auto T51 (CVSS 8.6)
- [CVE-2023-27034](https://cve.now/CVE-2023-27034.md): PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability. (CVSS 9.8)
- [CVE-2023-27077](https://cve.now/CVE-2023-27077.md): Stack Overflow vulnerability found in 360 D901 allows a remote attacker to cause a Distributed Denial of Service (DDOS) via a crafted HTTP p (CVSS 7.5)
- [CVE-2023-27078](https://cve.now/CVE-2023-27078.md): A command injection issue was found in TP-Link MR3020 v.1\_150921 that allows a remote attacker to execute arbitrary commands via a crafted r (CVSS 9.8)
- [CVE-2023-27079](https://cve.now/CVE-2023-27079.md): Command Injection vulnerability found in Tenda G103 v.1.0.05 allows an attacker to obtain sensitive information via a crafted package (CVSS 7.5)
- [CVE-2023-27094](https://cve.now/CVE-2023-27094.md): An issue found in OpenGoofy Hippo4j v.1.4.3 allows attackers to escalate privileges via the ThreadPoolController of the tenant Management mo (CVSS 8.8, cn.hippo4j:hippo4j-all)
- [CVE-2023-27135](https://cve.now/CVE-2023-27135.md): TOTOlink A7100RU V7.4cu.2313\_B20191024 was discovered to contain a command injection vulnerability via the enabled parameter at /setting/set (CVSS 9.8)
- [CVE-2023-27249](https://cve.now/CVE-2023-27249.md): swfdump v0.9.2 was discovered to contain a heap buffer overflow in the function swf\_GetPlaceObject at swfobject.c. (CVSS 5.5)
- [CVE-2023-28329](https://cve.now/CVE-2023-28329.md): Moodle: authenticated sql injection via availability check (CVSS 6.3, moodle · moodle/moodle)
- [CVE-2023-28330](https://cve.now/CVE-2023-28330.md): Moodle: authenticated arbitrary file read through malformed backup file (CVSS 6.5, moodle · moodle/moodle)
- [CVE-2023-28331](https://cve.now/CVE-2023-28331.md): Moodle: xss risk when outputting database activity filter data (CVSS 6.1, moodle · moodle/moodle)
- [CVE-2023-28332](https://cve.now/CVE-2023-28332.md): Moodle: algebra filter xss when filter is misconfigured (no CVSS, moodle · moodle/moodle)
- [CVE-2023-28333](https://cve.now/CVE-2023-28333.md): Moodle: pix helper potential mustache code injection risk (CVSS 9.8, moodle · moodle/moodle)
- [CVE-2023-28334](https://cve.now/CVE-2023-28334.md): Moodle: users' name enumeration possible via idor on learning plans page (CVSS 4.3, moodle · moodle/moodle)
- [CVE-2023-28335](https://cve.now/CVE-2023-28335.md): Moodle: csrf risk in resetting all templates of a database activity (CVSS 8.8, moodle · moodle/moodle)
- [CVE-2023-28336](https://cve.now/CVE-2023-28336.md): Moodle: teacher can access names of users they do not have permission to access (no CVSS, moodle · moodle/moodle)
- [CVE-2023-28470](https://cve.now/CVE-2023-28470.md): In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication. (CVSS 5.3)
- [CVE-2023-28610](https://cve.now/CVE-2023-28610.md): The update process in OMICRON StationGuard and OMICRON StationScout before 2.21 can be exploited by providing a modified firmware update ima (CVSS 9.8)
- [CVE-2023-28611](https://cve.now/CVE-2023-28611.md): Incorrect authorization in OMICRON StationGuard 1.10 through 2.20 and StationScout 1.30 through 2.20 allows an attacker to bypass intended a (CVSS 9.8)
- [CVE-2023-28758](https://cve.now/CVE-2023-28758.md): An issue was discovered in Veritas NetBackup before 8.3.0.2. (CVSS 7.1)
- [CVE-2023-28759](https://cve.now/CVE-2023-28759.md): An issue was discovered in Veritas NetBackup before 10.0 on Windows. (CVSS 7.8)
- [CVE-2023-28772](https://cve.now/CVE-2023-28772.md): An issue was discovered in the Linux kernel before 5.13.3. (CVSS 6.7)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.