# CVEs published 2023-03-27

180 CVEs were published on March 27, 2023: 14 critical, 56 high. Days are UTC.

- [CVE-2022-42447](https://cve.now/CVE-2022-42447.md): Cross-origin resource sharing vulnerability affects HCL Compass (CVSS 9.6, HCL Software HCL Compass2.0)
- [CVE-2023-26493](https://cve.now/CVE-2023-26493.md): Command Injection in Cocos Engine workflow (CVSS 8.1, cocos-engine)
- [CVE-2023-28102](https://cve.now/CVE-2023-28102.md): Command injection in discordrb (CVSS 8.4, shardlab discordrb · discordrb)
- [CVE-2023-28430](https://cve.now/CVE-2023-28430.md): OneSignal repository github action command injection (CVSS 7.3, react-native-onesignal)
- [CVE-2023-1666](https://cve.now/CVE-2023-1666.md): SourceCodester Automatic Question Paper Generator System GET Parameter view\_class.php sql injection (CVSS 6.3, SourceCodester Automatic Question Paper Generator System)
- [CVE-2023-28640](https://cve.now/CVE-2023-28640.md): Permissions bypass in Apiman could enable authenticated attacker to unpermitted API Key (CVSS 6.4, apiman · io.apiman:apiman-manager-api-rest-impl)
- [CVE-2023-28638](https://cve.now/CVE-2023-28638.md): Stack references to locations outside buffers may become invalid if they exist during a GC compaction in Snappier (CVSS 7.0, brantburnett Snappier · Snappier)
- [CVE-2023-28629](https://cve.now/CVE-2023-28629.md): Stored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd (CVSS 5.4, gocd)
- [CVE-2023-28630](https://cve.now/CVE-2023-28630.md): Sensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd (CVSS 4.2, gocd)
- [CVE-2023-28628](https://cve.now/CVE-2023-28628.md): \`authority-regex\` returns the wrong authority in lambdaisland/uri (CVSS 5.4, lambdaisland uri · lambdaisland:uri)
- [CVE-2023-28627](https://cve.now/CVE-2023-28627.md): OS Command Injection via GIT\_PATH in pymedusa (CVSS 8.3, pymedusa Medusa)
- [CVE-2023-25817](https://cve.now/CVE-2023-25817.md): Delete permissions are not saved when creating public share in Nextcloud server (CVSS 3.5, nextcloud security-advisories)
- [CVE-2023-25818](https://cve.now/CVE-2023-25818.md): Missing brute force protection on password reset token in Nextcloud Server (CVSS 5.3, nextcloud security-advisories)
- [CVE-2023-25661](https://cve.now/CVE-2023-25661.md): Denial of Service in TensorFlow (CVSS 6.5, tensorflow · tensorflow-cpu)
- [CVE-2023-28650](https://cve.now/CVE-2023-28650.md): CVE-2023-28650 (CVSS 6.1, SAUTER EY-AS525F001 with moduWeb)
- [CVE-2023-28655](https://cve.now/CVE-2023-28655.md): CVE-2023-28655 (CVSS 5.4, SAUTER EY-AS525F001 with moduWeb)
- [CVE-2023-22300](https://cve.now/CVE-2023-22300.md): CVE-2023-22300 (CVSS 6.1, SAUTER EY-AS525F001 with moduWeb)
- [CVE-2023-27927](https://cve.now/CVE-2023-27927.md): CVE-2023-27927 (CVSS 6.5, SAUTER EY-AS525F001 with moduWeb)
- [CVE-2023-28652](https://cve.now/CVE-2023-28652.md): CVE-2023-28652 (CVSS 6.5, SAUTER EY-AS525F001 with moduWeb)
- [CVE-2023-25828](https://cve.now/CVE-2023-25828.md): Authenticate Remote Code Execution in Pluck CMS (CVSS 7.2, pluck-cms)
- [CVE-2022-48429](https://cve.now/CVE-2022-48429.md): In JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was possible (CVSS 4.6, JetBrains Hub)
- [CVE-2023-1092](https://cve.now/CVE-2023-1092.md): OAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF (CVSS 6.5, MiniOrange OAuth Single Sign On Free · MiniOrange OAuth… +2)
- [CVE-2023-0395](https://cve.now/CVE-2023-0395.md): menu shortcode \<= 1.0 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, menu shortcode)
- [CVE-2023-1087](https://cve.now/CVE-2023-1087.md): WC Sales Notification \< 1.2.3 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, WC Sales Notification)
- [CVE-2023-0497](https://cve.now/CVE-2023-0497.md): HT Portfolio \< 1.1.6 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, HT Portfolio)
- [CVE-2023-1025](https://cve.now/CVE-2023-1025.md): Simple File List \< 6.0.10 - Admin+ Stored XSS (CVSS 4.8, Simple File List)
- [CVE-2023-0272](https://cve.now/CVE-2023-0272.md): NEX-Forms \< 8.3.3 - Contributor+ Stored XSS (CVSS 5.4, NEX-Forms)
- [CVE-2023-0823](https://cve.now/CVE-2023-0823.md): Cookie Notice & Compliance for GDPR / CCPA \< 2.4.7 - Contributor+ Stored XSS (CVSS 5.4, Cookie Notice & Compliance for GDPR / CCPA)
- [CVE-2023-0589](https://cve.now/CVE-2023-0589.md): WP Image Carousel \<= 1.0.2 - Contributor+ Stored XSS (CVSS 5.4, WP Image Carousel)
- [CVE-2023-0336](https://cve.now/CVE-2023-0336.md): OoohBoi Steroids for Elementor \< 2.1.5 - Subscriber+ Attachment Deletion (CVSS 6.5, OoohBoi Steroids for Elementor)
- [CVE-2023-0496](https://cve.now/CVE-2023-0496.md): HT Event \< 1.4.6 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, HT Event)
- [CVE-2023-1086](https://cve.now/CVE-2023-1086.md): Preview Link Generator \< 1.0.4 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, Preview Link Generator)
- [CVE-2023-1069](https://cve.now/CVE-2023-1069.md): Complianz - GDPR/CCPA Cookie Consent \< 6.4.2 - Contributor+ Stored XSS (CVSS 5.4, Complianz · really-simple-plugins/complianz-gdpr)
- [CVE-2023-0501](https://cve.now/CVE-2023-0501.md): WP Insurance \< 2.1.4 - Arbitrary Plugin Activation via CSRF (CVSS 6.5, WP Insurance)
- [CVE-2023-0491](https://cve.now/CVE-2023-0491.md): Schedulicity - Easy Online Scheduling \<= 2.21 - Contributor+ Stored XSS (CVSS 6.5, Schedulicity)
- [CVE-2023-0500](https://cve.now/CVE-2023-0500.md): WP Film Studio \< 1.3.5 - Arbitrary Plugin Activation via CSRF (CVSS 6.5, WP Film Studio)
- [CVE-2023-0503](https://cve.now/CVE-2023-0503.md): Free WooCommerce Theme 99fy Extension \< 1.2.8 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, Free WooCommerce Theme 99fy Extension)
- [CVE-2023-0955](https://cve.now/CVE-2023-0955.md): WP Statistics \< 14.0 - Authenticated SQLi (CVSS 8.8, WP Statistics)
- [CVE-2023-0502](https://cve.now/CVE-2023-0502.md): WP News \<= 1.1.9 - Arbitrary Plugin Activation via CSRF (CVSS 6.5, WP News)
- [CVE-2023-0484](https://cve.now/CVE-2023-0484.md): Contact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks \< 1.1.6 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, Contact Form 7 Widget For Elementor Page Builder & Gutenber…)
- [CVE-2020-36666](https://cve.now/CVE-2020-36666.md): Multiple e-plugins - Subscriber+ Privilege Escalation (CVSS 8.8, directory-pro · final-user-wp-frontend-user-profiles +9)
- [CVE-2023-0467](https://cve.now/CVE-2023-0467.md): WP Dark Mode \< 4.0.8 - Subscriber+ Local File Inclusion (CVSS 4.3, WP Dark Mode)
- [CVE-2023-1400](https://cve.now/CVE-2023-1400.md): Modern Events Calendar lite \< 6.5.2 - Admin+ Stored XSS (CVSS 4.8, Modern Events Calendar Lite)
- [CVE-2023-0495](https://cve.now/CVE-2023-0495.md): HT Slider For Elementor \< 1.4.0 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, HT Slider For Elementor)
- [CVE-2023-0505](https://cve.now/CVE-2023-0505.md): Ever Compare \<= 1.2.3 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, Ever Compare)
- [CVE-2023-1093](https://cve.now/CVE-2023-1093.md): OAuth Single Sign On - SSO (OAuth Client) \< 6.24.2 - IdP Discard via CSRF (CVSS 6.5, OAuth Single Sign On)
- [CVE-2023-0499](https://cve.now/CVE-2023-0499.md): QuickSwish \< 1.1.0 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, QuickSwish)
- [CVE-2023-0335](https://cve.now/CVE-2023-0335.md): WP Shamsi \<= 4.3.3 - Subscriber+ Attachment Deletion (CVSS 6.5, WP Shamsi)
- [CVE-2023-1089](https://cve.now/CVE-2023-1089.md): Coupon Zen \< 1.0.6 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, Coupon Zen)
- [CVE-2023-0660](https://cve.now/CVE-2023-0660.md): Smart Slider 3 \< 3.5.1.14 - Contributor+ Stored XSS (CVSS 5.4, Smart Slider)
- [CVE-2023-1088](https://cve.now/CVE-2023-1088.md): WP Plugin Manager \< 1.1.8 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, WP Plugin Manager)
- [CVE-2023-0498](https://cve.now/CVE-2023-0498.md): WP Education \< 1.2.7 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, WP Education)
- [CVE-2023-0816](https://cve.now/CVE-2023-0816.md): Formidable Forms \< 6.1 - IP Spoofing (CVSS 6.5, Formidable Forms)
- [CVE-2023-0441](https://cve.now/CVE-2023-0441.md): Gallery Blocks with Lightbox \< 3.0.8 - Subscriber+ Arbitrary Options Update (CVSS 8.1, Gallery Blocks with Lightbox. Image Gallery, (HTML5 video ,…)
- [CVE-2023-0504](https://cve.now/CVE-2023-0504.md): HT Politic \< 2.3.8 - Arbitrary Plugin Activation via CSRF (CVSS 4.3, HT Politic)
- [CVE-2022-48428](https://cve.now/CVE-2022-48428.md): In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2022-48427](https://cve.now/CVE-2022-48427.md): In JetBrains TeamCity before 2022.10.3 stored XSS on “Pending changes” and “Changes” tabs was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2022-48426](https://cve.now/CVE-2022-48426.md): In JetBrains TeamCity before 2022.10.3 stored XSS in Perforce connection settings was possible (CVSS 4.6, JetBrains TeamCity)
- [CVE-2023-1399](https://cve.now/CVE-2023-1399.md): N6854A Geolocation Server versions 2.4.2 are vulnerable to untrusted data deserialization, which may allow a malicious actor to escalate pr (CVSS 7.8, Keysight Technologies N6854A Geolocation Server)
- [CVE-2023-1135](https://cve.now/CVE-2023-1135.md): In Delta Electronics InfraSuite Device Master versions prior to 1.0.5, an attacker could set incorrect directory pe (CVSS 7.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1145](https://cve.now/CVE-2023-1145.md): Delta Electronics InfraSuite Device Master versions prior to 1.0.5 are affected by a deserialization vulnerability targeting the Devi (CVSS 7.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1140](https://cve.now/CVE-2023-1140.md): CVE-2023-1140 (CVSS 9.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1141](https://cve.now/CVE-2023-1141.md): CVE-2023-1141 (CVSS 8.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1136](https://cve.now/CVE-2023-1136.md): CVE-2023-1136 (CVSS 9.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1142](https://cve.now/CVE-2023-1142.md): CVE-2023-1142 (CVSS 7.5, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1134](https://cve.now/CVE-2023-1134.md): CVE-2023-1134 (CVSS 7.1, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1143](https://cve.now/CVE-2023-1143.md): CVE-2023-1143 (CVSS 8.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1137](https://cve.now/CVE-2023-1137.md): CVE-2023-1137 (CVSS 6.5, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1144](https://cve.now/CVE-2023-1144.md): CVE-2023-1144 (CVSS 8.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1138](https://cve.now/CVE-2023-1138.md): CVE-2023-1138 (CVSS 7.5, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1139](https://cve.now/CVE-2023-1139.md): CVE-2023-1139 (CVSS 8.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-1133](https://cve.now/CVE-2023-1133.md): CVE-2023-1133 (CVSS 9.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-27296](https://cve.now/CVE-2023-27296.md): Apache InLong: JDBC Deserialization Vulnerability in InLong (CVSS 8.8, Apache Software Foundation Apache InLong · org.apache.inlon…)
- [CVE-2023-22707](https://cve.now/CVE-2023-22707.md): WordPress Greenshift – animation and page builder blocks Plugin \<= 4.9.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Wpsoul Greenshift – animation and page builder blocks)
- [CVE-2022-47146](https://cve.now/CVE-2022-47146.md): WordPress Real Estate 7 Theme \<= 3.3.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Contempoinc Real Estate 7 WordPress)
- [CVE-2022-46843](https://cve.now/CVE-2022-46843.md): WordPress Woocommerce Vietnam Checkout Plugin \<= 2.0.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, Le Van Toan Woocommerce Vietnam Checkout)
- [CVE-2022-30705](https://cve.now/CVE-2022-30705.md): WordPress WordPress Ping Optimizer Plugin \<= 2.35.1.2.3 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Pankaj Jha WordPress Ping Optimizer)
- [CVE-2022-47924](https://cve.now/CVE-2022-47924.md): Arbitrary Code Execution using the validate function of csaf-validator-lib (CVSS 6.5, Secvisogram csaf-validator-lib)
- [CVE-2022-47925](https://cve.now/CVE-2022-47925.md): Insufficient Input Validation in the Endpoint of the csaf-validator-service (CVSS 7.5, Secvisogram csaf-validator-service)
- [CVE-2022-4126](https://cve.now/CVE-2022-4126.md): Use of Default Password (CVSS 9.6, ABB RCCMD)
- [CVE-2018-25083](https://cve.now/CVE-2018-25083.md): The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name. (CVSS 9.8, pullit)
- [CVE-2021-3923](https://cve.now/CVE-2021-3923.md): A flaw was found in the Linux kernel's implementation of RDMA over infiniband. (CVSS 2.3, kernel)
- [CVE-2022-2237](https://cve.now/CVE-2022-2237.md): A flaw was found in the Keycloak Node.js Adapter. (CVSS 6.1, Keycloak · keycloak-connect)
- [CVE-2022-3116](https://cve.now/CVE-2022-3116.md): The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance. (CVSS 7.5, Heimdal Software Kerberos)
- [CVE-2022-32199](https://cve.now/CVE-2022-32199.md): db\_convert.php in ScriptCase through 9.9.008 is vulnerable to Arbitrary File Deletion by an admin via a directory traversal sequence in the (CVSS 6.5)
- [CVE-2022-39043](https://cve.now/CVE-2022-39043.md): Juiker app - Information Leakage (CVSS 2.4, Juiker app)
- [CVE-2022-41354](https://cve.now/CVE-2022-41354.md): An access control issue in Argo CD v2.4.12 and below allows unauthenticated attackers to enumerate existing applications. (no CVSS, github.com/argoproj/argo-cd · github.com/argoproj/argo-cd/v2)
- [CVE-2022-46415](https://cve.now/CVE-2022-46415.md): DJI Spark 01.00.0900 allows remote attackers to prevent legitimate terminal connections by exhausting the DHCP IP address pool. (CVSS 9.1)
- [CVE-2022-46416](https://cve.now/CVE-2022-46416.md): Parrot Bebop 4.7.1. (CVSS 9.1)
- [CVE-2022-48291](https://cve.now/CVE-2022-48291.md): The Bluetooth module has an authentication bypass vulnerability in the pairing process. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48346](https://cve.now/CVE-2022-48346.md): The HwContacts module has a logic bypass vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48347](https://cve.now/CVE-2022-48347.md): The MediaProvider module has a vulnerability in permission verification. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48348](https://cve.now/CVE-2022-48348.md): The MediaProvider module has a vulnerability of unauthorized data read. (CVSS 9.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48349](https://cve.now/CVE-2022-48349.md): The control component has a spoofing vulnerability. (CVSS 9.1, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48350](https://cve.now/CVE-2022-48350.md): The HUAWEI Messaging app has a vulnerability of unauthorized file access. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48351](https://cve.now/CVE-2022-48351.md): The secure OS module has configuration defects. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48352](https://cve.now/CVE-2022-48352.md): Some smartphones have data initialization issues. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48353](https://cve.now/CVE-2022-48353.md): Some smartphones have configuration issues. (CVSS 9.8, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48354](https://cve.now/CVE-2022-48354.md): The Bluetooth module has a heap out-of-bounds write vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48355](https://cve.now/CVE-2022-48355.md): The Bluetooth module has a heap out-of-bounds read vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48356](https://cve.now/CVE-2022-48356.md): The facial recognition module has a vulnerability in input parameter verification. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48357](https://cve.now/CVE-2022-48357.md): Some products have the double fetch vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48358](https://cve.now/CVE-2022-48358.md): The BatteryHealthActivity has a redirection vulnerability. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48359](https://cve.now/CVE-2022-48359.md): The recovery mode for updates has a vulnerability that causes arbitrary disk modification. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48360](https://cve.now/CVE-2022-48360.md): The facial recognition module has a vulnerability in file permission control. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-48361](https://cve.now/CVE-2022-48361.md): The Always On Display (AOD) has a path traversal vulnerability in theme files. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-0179](https://cve.now/CVE-2023-0179.md): A buffer overflow vulnerability was found in the Netfilter subsystem in the Linux Kernel. (no CVSS, kernel)
- [CVE-2023-0210](https://cve.now/CVE-2023-0210.md): A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems. (no CVSS, Linux Kernel)
- [CVE-2023-0241](https://cve.now/CVE-2023-0241.md): pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. (no CVSS, pgadmin · pgadmin4)
- [CVE-2023-0326](https://cve.now/CVE-2023-0326.md): An issue has been discovered in GitLab DAST API scanner affecting all versions starting from 1.6.50 before 2.11.0, where Authorization heade (CVSS 5.0, GitLab DAST API scanner)
- [CVE-2023-0494](https://cve.now/CVE-2023-0494.md): A vulnerability was found in X.Org. (CVSS 7.8, xorg-x11-server)
- [CVE-2023-0778](https://cve.now/CVE-2023-0778.md): A Time-of-check Time-of-use (TOCTOU) flaw was found in podman. (CVSS 6.8, podman · github.com/containers/podman/v4)
- [CVE-2023-1073](https://cve.now/CVE-2023-1073.md): A memory corruption flaw was found in the Linux kernel’s human interface device (HID) subsystem in how a user inserts a malicious USB device (CVSS 6.6, kernel)
- [CVE-2023-1074](https://cve.now/CVE-2023-1074.md): A memory leak flaw was found in the Linux kernel's Stream Control Transmission Protocol. (CVSS 5.5, kernel)
- [CVE-2023-1075](https://cve.now/CVE-2023-1075.md): A flaw was found in the Linux Kernel. (CVSS 3.3, Linus kernel)
- [CVE-2023-1076](https://cve.now/CVE-2023-1076.md): A flaw was found in the Linux Kernel. (CVSS 5.5, Linux kernel)
- [CVE-2023-1077](https://cve.now/CVE-2023-1077.md): In the Linux kernel, pick\_next\_rt\_entity() may return a type confused entry, not detected by the BUG\_ON condition, as the confused entry wil (no CVSS, Linux kernel)
- [CVE-2023-1078](https://cve.now/CVE-2023-1078.md): A flaw was found in the Linux Kernel in RDS (Reliable Datagram Sockets) protocol. (CVSS 7.8, Linux kernel)
- [CVE-2023-1079](https://cve.now/CVE-2023-1079.md): A flaw was found in the Linux kernel. (CVSS 6.8, Linux kernel)
- [CVE-2023-1380](https://cve.now/CVE-2023-1380.md): A slab-out-of-bound read problem was found in brcmf\_get\_assoc\_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linu (CVSS 7.1, Kernel)
- [CVE-2023-1637](https://cve.now/CVE-2023-1637.md): A flaw that boot CPU could be vulnerable for the speculative execution behavior kind of attacks in the Linux kernel X86 CPU Power management (CVSS 5.5, Kernel)
- [CVE-2023-1647](https://cve.now/CVE-2023-1647.md): Improper Access Control in calcom/cal.com (CVSS 8.8, calcom/cal.com)
- [CVE-2023-1654](https://cve.now/CVE-2023-1654.md): Denial of Service in gpac/gpac (CVSS 4.8, gpac/gpac)
- [CVE-2023-1655](https://cve.now/CVE-2023-1655.md): Heap-based Buffer Overflow in gpac/gpac (CVSS 7.8, gpac/gpac)
- [CVE-2023-1665](https://cve.now/CVE-2023-1665.md): Improper Restriction of Excessive Authentication Attempts in linagora/twake (CVSS 7.8, linagora/twake)
- [CVE-2023-20860](https://cve.now/CVE-2023-20860.md): Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "\*\*" as a pattern in Spring Security configuration with the mvcReques (CVSS 7.5, Spring Framework · org.springframework:spring +1)
- [CVE-2023-22247](https://cve.now/CVE-2023-22247.md): Adobe Commerce XML Injection Arbitrary file system read (CVSS 7.5, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2023-22249](https://cve.now/CVE-2023-22249.md): Adobe Commerce Stored XSS Arbitrary code execution (CVSS 4.8, Adobe Magento Commerce · magento/community-edition)
- [CVE-2023-22250](https://cve.now/CVE-2023-22250.md): Adobe Commerce Improper Access Control Security feature bypass (CVSS 5.3, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2023-22251](https://cve.now/CVE-2023-22251.md): Adobe Commerce Incorrect Authorization Security feature bypass (CVSS 4.3, Adobe Magento Commerce · magento/community-edition +1)
- [CVE-2023-22902](https://cve.now/CVE-2023-22902.md): Openfind Mail2000 - XSS (CVSS 5.4, Openfind Mail2000)
- [CVE-2023-24094](https://cve.now/CVE-2023-24094.md): An issue in the bridge2 component of MikroTik RouterOS v6.40.5 allows attackers to cause a Denial of Service (DoS) via crafted packets. (CVSS 7.5)
- [CVE-2023-24366](https://cve.now/CVE-2023-24366.md): An arbitrary file download vulnerability in rConfig v6.8.0 allows attackers to download sensitive files via a crafted HTTP request. (CVSS 6.5)
- [CVE-2023-24834](https://cve.now/CVE-2023-24834.md): WisdomGarden Tronclass ilearn - Broken Access Control (CVSS 6.5, WisdomGarden Tronclass ilearn)
- [CVE-2023-24835](https://cve.now/CVE-2023-24835.md): Softnext SPAM SQR - Code Injection (CVSS 7.2, Softnext SPAM SQR)
- [CVE-2023-24837](https://cve.now/CVE-2023-24837.md): HGiga PowerStation - Command Injection (CVSS 8.8, HGiga PowerStation)
- [CVE-2023-24838](https://cve.now/CVE-2023-24838.md): HGiga PowerStation - Information Leakage (CVSS 9.8, HGiga PowerStation)
- [CVE-2023-24839](https://cve.now/CVE-2023-24839.md): HGiga MailSherlock - Reflected XSS (CVSS 6.1, HGiga MailSherlock)
- [CVE-2023-24840](https://cve.now/CVE-2023-24840.md): HGiga MailSherlock - SQL Injection (CVSS 7.2, HGiga MailSherlock)
- [CVE-2023-24841](https://cve.now/CVE-2023-24841.md): HGiga MailSherlock - Command Injection (CVSS 7.2, HGiga MailSherlock)
- [CVE-2023-24842](https://cve.now/CVE-2023-24842.md): HGiga MailSherlock - Broken Access Control (CVSS 5.3, HGiga MailSherlock)
- [CVE-2023-25017](https://cve.now/CVE-2023-25017.md): Rifartek IOT Wall - Broken Access Control (CVSS 8.1, Rifartek IOT Wall)
- [CVE-2023-25018](https://cve.now/CVE-2023-25018.md): Rifartek IOT Wall - Reflected XSS (CVSS 5.4, Rifartek IOT Wall)
- [CVE-2023-25261](https://cve.now/CVE-2023-25261.md): Certain Stimulsoft GmbH products are affected by: Remote Code Execution. (no CVSS)
- [CVE-2023-25263](https://cve.now/CVE-2023-25263.md): In Stimulsoft Designer (Desktop) 2023.1.5, and 2023.1.4, once an attacker decompiles the Stimulsoft.report.dll the attacker is able to decry (no CVSS)
- [CVE-2023-25863](https://cve.now/CVE-2023-25863.md): Adobe Substance 3D Stager USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25864](https://cve.now/CVE-2023-25864.md): Adobe Substance 3D Stager FBX File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25865](https://cve.now/CVE-2023-25865.md): Adobe Substance 3D Stager OBJ File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25866](https://cve.now/CVE-2023-25866.md): Adobe Substance 3D Stager OBJ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25867](https://cve.now/CVE-2023-25867.md): Adobe Substance 3D Stager PCX File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25868](https://cve.now/CVE-2023-25868.md): Adobe Substance 3D Stager SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25869](https://cve.now/CVE-2023-25869.md): Adobe Substance 3D Stager SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25870](https://cve.now/CVE-2023-25870.md): Adobe Substance 3D Stager SVG File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25871](https://cve.now/CVE-2023-25871.md): Adobe Substance 3D Stager SVG File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25872](https://cve.now/CVE-2023-25872.md): Adobe Substance 3D Stager SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25873](https://cve.now/CVE-2023-25873.md): Adobe Substance 3D Stager SVG File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25874](https://cve.now/CVE-2023-25874.md): Adobe Substance 3D Stager SVG File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-25875](https://cve.now/CVE-2023-25875.md): Adobe Substance 3D Stager OBJ File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2023-25876](https://cve.now/CVE-2023-25876.md): Adobe Substance 3D Stager OBJ File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2023-25877](https://cve.now/CVE-2023-25877.md): Adobe Substance 3D Stager OBJ File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2023-25878](https://cve.now/CVE-2023-25878.md): Adobe Substance 3D Stager OBJ File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2023-25908](https://cve.now/CVE-2023-25908.md): Adobe Photoshop SVG file Use After Free Arbitrary code execution (CVSS 7.8, Adobe Photoshop)
- [CVE-2023-25909](https://cve.now/CVE-2023-25909.md): HGiga Inc. OAKlouds - Arbitrary File Upload (CVSS 9.8, HGiga OAKlouds)
- [CVE-2023-26547](https://cve.now/CVE-2023-26547.md): The InputMethod module has a vulnerability of serialization/deserialization mismatch. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-26548](https://cve.now/CVE-2023-26548.md): The pgmng module has a vulnerability in serialization/deserialization. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-26549](https://cve.now/CVE-2023-26549.md): The SystemUI module has a vulnerability of repeated app restart due to improper parameters. (no CVSS, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-26924](https://cve.now/CVE-2023-26924.md): LLVM a0dab4950 has a segmentation fault in mlir::outlineSingleBlockRegion. (no CVSS)
- [CVE-2023-26958](https://cve.now/CVE-2023-26958.md): Phpgurukul Park Ticketing Management System 1.0 is vulnerable to Cross Site Scripting (XSS) via the Admin Name parameter. (no CVSS)
- [CVE-2023-26959](https://cve.now/CVE-2023-26959.md): Phpgurukul Park Ticketing Management System 1.0 is vulnerable to SQL Injection via the User Name parameter. (no CVSS)
- [CVE-2023-27096](https://cve.now/CVE-2023-27096.md): Insecure Permissions vulnerability found in OpenGoofy Hippo4j v.1.4.3 allows attacker to obtain sensitive information via the ConfigVerifyCo (no CVSS, cn.hippo4j:hippo4j-all)
- [CVE-2023-27241](https://cve.now/CVE-2023-27241.md): SourceCodester Water Billing System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the lastname text box unde (no CVSS)
- [CVE-2023-27245](https://cve.now/CVE-2023-27245.md): A cross-site scripting (XSS) vulnerability in File Management Project 1.0.0 allows attackers to execute arbitrary web scripts or HTML via a (no CVSS)
- [CVE-2023-27847](https://cve.now/CVE-2023-27847.md): SQL injection vulnerability found in PrestaShop xipblog v.2.0.1 and before allow a remote attacker to gain privileges via the xipcategorycla (no CVSS)
- [CVE-2023-28596](https://cve.now/CVE-2023-28596.md): Local Privilege Escalation in Zoom for macOS Installers (CVSS 7.8, Zoom Video Communications Zoom Client for Meetings for IT A…)
- [CVE-2023-28597](https://cve.now/CVE-2023-28597.md): Improper trust boundary implementation for SMB in Zoom Clients (CVSS 8.3, Zoom Video Communications Zoom)
- [CVE-2023-28866](https://cve.now/CVE-2023-28866.md): In the Linux kernel through 6.2.8, net/bluetooth/hci\_sync.c allows out-of-bounds access because amp\_init1\[\] and amp\_init2\[\] are supposed to (CVSS 5.3)
- [CVE-2023-28867](https://cve.now/CVE-2023-28867.md): In GraphQL Java (aka graphql-java) before 20.1, an attacker can send a crafted GraphQL query that causes stack consumption. (no CVSS, com.graphql-java:graphql-java)
- [CVE-2023-28883](https://cve.now/CVE-2023-28883.md): In Cerebrate 1.13, a blind SQL injection exists in the searchAll API endpoint. (CVSS 9.8)
- [CVE-2023-28884](https://cve.now/CVE-2023-28884.md): In MISP 2.4.169, app/Lib/Tools/CustomPaginationTool.php allows XSS in the community index. (no CVSS)
- [CVE-2023-28885](https://cve.now/CVE-2023-28885.md): The MyLink infotainment system (build 2021.3.26) in General Motors Chevrolet Equinox 2021 vehicles allows attackers to cause a denial of ser (CVSS 6.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.