CVEs published March 27, 2023
180 CVEs were published on March 27, 2023: 14 critical, 56 high.
- Published
- 180
- Critical
- 14
- High
- 56
- Medium
- 76
- Low
- 4
- Unrated
- 30
- Now in CISA KEV
- 0
- Fix available
- 80
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 20
- Adobe Substance3D - Stager
- 16
- Delta Electronics InfraSuite Device Master
- 13
- SAUTER EY-AS525F001 with moduWeb
- 5
- HGiga MailSherlock
- 4
- kernel
- 4
- Linux kernel
- 4
- Adobe Magento Commerce · magento/community-edition +1
- 3
- JetBrains TeamCity
- 3
- gocd
- 2
Critical 14
- CVE-2022-42447Cross-origin resource sharing vulnerability affects HCL CompassHCL Software HCL Compass2.0
- CVE-2023-1140CVE-2023-1140Delta Electronics InfraSuite Device Master
- CVE-2023-1136CVE-2023-1136Delta Electronics InfraSuite Device Master
- CVE-2023-1133CVE-2023-1133Delta Electronics InfraSuite Device Master
- CVE-2022-4126Use of Default PasswordABB RCCMD
- CVE-2018-25083The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name.pullit
- CVE-2022-46415DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool.
- CVE-2022-46416Parrot Bebop 4.7.1.
- CVE-2022-48348The MediaProvider module has a vulnerability of unauthorized data read.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48349The control component has a spoofing vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48353Some smartphones have configuration issues.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-24838HGiga PowerStation - Information LeakageHGiga PowerStation
- CVE-2023-25909HGiga Inc. OAKlouds - Arbitrary File UploadHGiga OAKlouds
- CVE-2023-28883In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint.
High 56
- CVE-2023-26493Command Injection in Cocos Engine workflowcocos-engine
- CVE-2023-28102Command injection in discordrbshardlab discordrb · discordrb
- CVE-2023-28430OneSignal repository github action command injectionreact-native-onesignal
- CVE-2023-28638Stack references to locations outside buffers may become invalid if they exist during a GC compaction in Snappierbrantburnett Snappier · Snappier
- CVE-2023-28627OS Command Injection via GIT_PATH in pymedusapymedusa Medusa
- CVE-2023-25828Authenticate Remote Code Execution in Pluck CMSpluck-cms
- CVE-2023-0955WP Statistics < 14.0 - Authenticated SQLiWP Statistics
- CVE-2020-36666Multiple e-plugins - Subscriber+ Privilege Escalationdirectory-pro · final-user-wp-frontend-user-profiles +9
- CVE-2023-0441Gallery Blocks with Lightbox < 3.0.8 - Subscriber+ Arbitrary Options UpdateGallery Blocks with Lightbox. Image Gallery, (HTML5 video ,…
- CVE-2023-1399 N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate prKeysight Technologies N6854A Geolocation Server
- CVE-2023-1135 In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory peDelta Electronics InfraSuite Device Master
- CVE-2023-1145 Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the DeviDelta Electronics InfraSuite Device Master
- CVE-2023-1141CVE-2023-1141Delta Electronics InfraSuite Device Master
- CVE-2023-1142CVE-2023-1142Delta Electronics InfraSuite Device Master
- CVE-2023-1134CVE-2023-1134Delta Electronics InfraSuite Device Master
- CVE-2023-1143CVE-2023-1143Delta Electronics InfraSuite Device Master
- CVE-2023-1144CVE-2023-1144Delta Electronics InfraSuite Device Master
- CVE-2023-1138CVE-2023-1138Delta Electronics InfraSuite Device Master
- CVE-2023-1139CVE-2023-1139Delta Electronics InfraSuite Device Master
- CVE-2023-27296Apache InLong: JDBC Deserialization Vulnerability in InLongApache Software Foundation Apache InLong · org.apache.inlon…
- CVE-2022-47146WordPress Real Estate 7 Theme <= 3.3.1 is vulnerable to Cross Site Scripting (XSS)Contempoinc Real Estate 7 WordPress
- CVE-2022-46843WordPress Woocommerce Vietnam Checkout Plugin <= 2.0.4 is vulnerable to Cross Site Scripting (XSS)Le Van Toan Woocommerce Vietnam Checkout
- CVE-2022-47925Insufficient Input Validation in the Endpoint of the csaf-validator-serviceSecvisogram csaf-validator-service
- CVE-2022-3116The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance.Heimdal Software Kerberos
- CVE-2022-48350The HUAWEI Messaging app has a vulnerability of unauthorized file access.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48351The secure OS module has configuration defects.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48352Some smartphones have data initialization issues.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-0494A vulnerability was found in X.Org.xorg-x11-server
- CVE-2023-1078A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol.Linux kernel
- CVE-2023-1380A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the LinuKernel
- CVE-2023-1647Improper Access Control in calcom/cal.comcalcom/cal.com
- CVE-2023-1655Heap-based Buffer Overflow in gpac/gpacgpac/gpac
- CVE-2023-1665Improper Restriction of Excessive Authentication Attempts in linagora/twakelinagora/twake
- CVE-2023-20860Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequesSpring Framework · org.springframework:spring +1
- CVE-2023-22247Adobe Commerce XML Injection Arbitrary file system readAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-24094An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets.
- CVE-2023-24835Softnext SPAM SQR - Code InjectionSoftnext SPAM SQR
- CVE-2023-24837HGiga PowerStation - Command InjectionHGiga PowerStation
- CVE-2023-24840HGiga MailSherlock - SQL InjectionHGiga MailSherlock
- CVE-2023-24841HGiga MailSherlock - Command InjectionHGiga MailSherlock
- CVE-2023-25017Rifartek IOT Wall - Broken Access ControlRifartek IOT Wall
- CVE-2023-25863Adobe Substance 3D Stager USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25864Adobe Substance 3D Stager FBX File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25865Adobe Substance 3D Stager OBJ File Parsing Memory Corruption Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25866Adobe Substance 3D Stager OBJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25867Adobe Substance 3D Stager PCX File Parsing Memory Corruption Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25868Adobe Substance 3D Stager SVG File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25869Adobe Substance 3D Stager SVG File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25870Adobe Substance 3D Stager SVG File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25871Adobe Substance 3D Stager SVG File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25872Adobe Substance 3D Stager SVG File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25873Adobe Substance 3D Stager SVG File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25874Adobe Substance 3D Stager SVG File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25908Adobe Photoshop SVG file Use After Free Arbitrary code executionAdobe Photoshop
- CVE-2023-28596Local Privilege Escalation in Zoom for macOS InstallersZoom Video Communications Zoom Client for Meetings for IT A…
- CVE-2023-28597Improper trust boundary implementation for SMB in Zoom ClientsZoom Video Communications Zoom
Medium, low and unrated 110
- CVE-2023-1666SourceCodester Automatic Question Paper Generator System GET Parameter view_class.php sql injectionSourceCodester Automatic Question Paper Generator System
- CVE-2023-28640Permissions bypass in Apiman could enable authenticated attacker to unpermitted API Keyapiman · io.apiman:apiman-manager-api-rest-impl
- CVE-2023-28629Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocdgocd
- CVE-2023-28630Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocdgocd
- CVE-2023-28628`authority-regex` returns the wrong authority in lambdaisland/urilambdaisland uri · lambdaisland:uri
- CVE-2023-25817Delete permissions are not saved when creating public share in Nextcloud servernextcloud security-advisories
- CVE-2023-25818Missing brute force protection on password reset token in Nextcloud Servernextcloud security-advisories
- CVE-2023-25661Denial of Service in TensorFlowtensorflow · tensorflow-cpu
- CVE-2023-28650CVE-2023-28650SAUTER EY-AS525F001 with moduWeb
- CVE-2023-28655CVE-2023-28655SAUTER EY-AS525F001 with moduWeb
- CVE-2023-22300CVE-2023-22300SAUTER EY-AS525F001 with moduWeb
- CVE-2023-27927CVE-2023-27927SAUTER EY-AS525F001 with moduWeb
- CVE-2023-28652CVE-2023-28652SAUTER EY-AS525F001 with moduWeb
- CVE-2022-48429In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible JetBrains Hub
- CVE-2023-1092OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRFMiniOrange OAuth Single Sign On Free · MiniOrange OAuth… +2
- CVE-2023-0395menu shortcode <= 1.0 - Contributor+ Stored XSS via Shortcodemenu shortcode
- CVE-2023-1087WC Sales Notification < 1.2.3 - Arbitrary Plugin Activation via CSRFWC Sales Notification
- CVE-2023-0497HT Portfolio < 1.1.6 - Arbitrary Plugin Activation via CSRFHT Portfolio
- CVE-2023-1025Simple File List < 6.0.10 - Admin+ Stored XSSSimple File List
- CVE-2023-0272NEX-Forms < 8.3.3 - Contributor+ Stored XSSNEX-Forms
- CVE-2023-0823Cookie Notice & Compliance for GDPR / CCPA < 2.4.7 - Contributor+ Stored XSSCookie Notice & Compliance for GDPR / CCPA
- CVE-2023-0589WP Image Carousel <= 1.0.2 - Contributor+ Stored XSSWP Image Carousel
- CVE-2023-0336OoohBoi Steroids for Elementor < 2.1.5 - Subscriber+ Attachment DeletionOoohBoi Steroids for Elementor
- CVE-2023-0496HT Event < 1.4.6 - Arbitrary Plugin Activation via CSRFHT Event
- CVE-2023-1086Preview Link Generator < 1.0.4 - Arbitrary Plugin Activation via CSRFPreview Link Generator
- CVE-2023-1069Complianz - GDPR/CCPA Cookie Consent < 6.4.2 - Contributor+ Stored XSSComplianz · really-simple-plugins/complianz-gdpr
- CVE-2023-0501WP Insurance < 2.1.4 - Arbitrary Plugin Activation via CSRFWP Insurance
- CVE-2023-0491Schedulicity - Easy Online Scheduling <= 2.21 - Contributor+ Stored XSSSchedulicity
- CVE-2023-0500WP Film Studio < 1.3.5 - Arbitrary Plugin Activation via CSRFWP Film Studio
- CVE-2023-0503Free WooCommerce Theme 99fy Extension < 1.2.8 - Arbitrary Plugin Activation via CSRFFree WooCommerce Theme 99fy Extension
- CVE-2023-0502WP News <= 1.1.9 - Arbitrary Plugin Activation via CSRFWP News
- CVE-2023-0484Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks < 1.1.6 - Arbitrary Plugin Activation via CSRFContact Form 7 Widget For Elementor Page Builder & Gutenber…
- CVE-2023-0467WP Dark Mode < 4.0.8 - Subscriber+ Local File InclusionWP Dark Mode
- CVE-2023-1400Modern Events Calendar lite < 6.5.2 - Admin+ Stored XSSModern Events Calendar Lite
- CVE-2023-0495HT Slider For Elementor < 1.4.0 - Arbitrary Plugin Activation via CSRFHT Slider For Elementor
- CVE-2023-0505Ever Compare <= 1.2.3 - Arbitrary Plugin Activation via CSRFEver Compare
- CVE-2023-1093OAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRFOAuth Single Sign On
- CVE-2023-0499QuickSwish < 1.1.0 - Arbitrary Plugin Activation via CSRFQuickSwish
- CVE-2023-0335WP Shamsi <= 4.3.3 - Subscriber+ Attachment DeletionWP Shamsi
- CVE-2023-1089Coupon Zen < 1.0.6 - Arbitrary Plugin Activation via CSRFCoupon Zen
- CVE-2023-0660Smart Slider 3 < 3.5.1.14 - Contributor+ Stored XSSSmart Slider
- CVE-2023-1088WP Plugin Manager < 1.1.8 - Arbitrary Plugin Activation via CSRFWP Plugin Manager
- CVE-2023-0498WP Education < 1.2.7 - Arbitrary Plugin Activation via CSRFWP Education
- CVE-2023-0816Formidable Forms < 6.1 - IP SpoofingFormidable Forms
- CVE-2023-0504HT Politic < 2.3.8 - Arbitrary Plugin Activation via CSRFHT Politic
- CVE-2022-48428In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possibleJetBrains TeamCity
- CVE-2022-48427In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possibleJetBrains TeamCity
- CVE-2022-48426In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possibleJetBrains TeamCity
- CVE-2023-1137CVE-2023-1137Delta Electronics InfraSuite Device Master
- CVE-2023-22707WordPress Greenshift – animation and page builder blocks Plugin <= 4.9.9 is vulnerable to Cross Site Scripting (XSS)Wpsoul Greenshift – animation and page builder blocks
- CVE-2022-30705WordPress WordPress Ping Optimizer Plugin <= 2.35.1.2.3 is vulnerable to Cross Site Request Forgery (CSRF)Pankaj Jha WordPress Ping Optimizer
- CVE-2022-47924Arbitrary Code Execution using the validate function of csaf-validator-libSecvisogram csaf-validator-lib
- CVE-2021-3923A flaw was found in the Linux kernel's implementation of RDMA over infiniband.kernel
- CVE-2022-2237A flaw was found in the Keycloak Node.js Adapter.Keycloak · keycloak-connect
- CVE-2022-32199db_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the
- CVE-2022-39043Juiker app - Information LeakageJuiker app
- CVE-2022-41354An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications.github.com/argoproj/argo-cd · github.com/argoproj/argo-cd/v2
- CVE-2022-48291The Bluetooth module has an authentication bypass vulnerability in the pairing process.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48346The HwContacts module has a logic bypass vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48347The MediaProvider module has a vulnerability in permission verification.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48354The Bluetooth module has a heap out-of-bounds write vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48355The Bluetooth module has a heap out-of-bounds read vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48356The facial recognition module has a vulnerability in input parameter verification.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48357Some products have the double fetch vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48358The BatteryHealthActivity has a redirection vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48359The recovery mode for updates has a vulnerability that causes arbitrary disk modification.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48360The facial recognition module has a vulnerability in file permission control.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-48361The Always On Display (AOD) has a path traversal vulnerability in theme files.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-0179A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel.kernel
- CVE-2023-0210A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems.Linux Kernel
- CVE-2023-0241pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability.pgadmin · pgadmin4
- CVE-2023-0326An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization headeGitLab DAST API scanner
- CVE-2023-0778A Time-of-check Time-of-use (TOCTOU) flaw was found in podman.podman · github.com/containers/podman/v4
- CVE-2023-1073A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB devicekernel
- CVE-2023-1074A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol.kernel
- CVE-2023-1075A flaw was found in the Linux Kernel.Linus kernel
- CVE-2023-1076A flaw was found in the Linux Kernel.Linux kernel
- CVE-2023-1077In the Linux kernel, pick_next_rt_entity() may return a type confused entry, not detected by the BUG_ON condition, as the confused entry wilLinux kernel
- CVE-2023-1079A flaw was found in the Linux kernel.Linux kernel
- CVE-2023-1637A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power managementKernel
- CVE-2023-1654Denial of Service in gpac/gpacgpac/gpac
- CVE-2023-22249Adobe Commerce Stored XSS Arbitrary code executionAdobe Magento Commerce · magento/community-edition
- CVE-2023-22250Adobe Commerce Improper Access Control Security feature bypassAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-22251Adobe Commerce Incorrect Authorization Security feature bypassAdobe Magento Commerce · magento/community-edition +1
- CVE-2023-22902Openfind Mail2000 - XSSOpenfind Mail2000
- CVE-2023-24366An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request.
- CVE-2023-24834WisdomGarden Tronclass ilearn - Broken Access ControlWisdomGarden Tronclass ilearn
- CVE-2023-24839HGiga MailSherlock - Reflected XSSHGiga MailSherlock
- CVE-2023-24842HGiga MailSherlock - Broken Access ControlHGiga MailSherlock
- CVE-2023-25018Rifartek IOT Wall - Reflected XSSRifartek IOT Wall
- CVE-2023-25261Certain Stimulsoft GmbH products are affected by: Remote Code Execution.
- CVE-2023-25263In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decry
- CVE-2023-25875Adobe Substance 3D Stager OBJ File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25876Adobe Substance 3D Stager OBJ File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25877Adobe Substance 3D Stager OBJ File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Substance3D - Stager
- CVE-2023-25878Adobe Substance 3D Stager OBJ File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26547The InputMethod module has a vulnerability of serialization/deserialization mismatch.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-26548The pgmng module has a vulnerability in serialization/deserialization.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-26549The SystemUI module has a vulnerability of repeated app restart due to improper parameters.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-26924LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion.
- CVE-2023-26958Phpgurukul Park Ticketing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Admin Name parameter.
- CVE-2023-26959Phpgurukul Park Ticketing Management System 1.0 is vulnerable to SQL Injection via the User Name parameter.
- CVE-2023-27096Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyCocn.hippo4j:hippo4j-all
- CVE-2023-27241SourceCodester Water Billing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the lastname text box unde
- CVE-2023-27245A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a
- CVE-2023-27847SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategorycla
- CVE-2023-28866In the Linux kernel through 6.2.8, net/bluetooth/hci_sync.c allows out-of-bounds access because amp_init1[] and amp_init2[] are supposed to
- CVE-2023-28867In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption.com.graphql-java:graphql-java
- CVE-2023-28884In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index.
- CVE-2023-28885The MyLink infotainment system (build 2021.3.26) in General Motors Chevrolet Equinox 2021 vehicles allows attackers to cause a denial of ser