CVEs published March 28, 2023
148 CVEs were published on March 28, 2023: 16 critical, 83 high.
- Published
- 148
- Critical
- 16
- High
- 83
- Medium
- 45
- Low
- 1
- Unrated
- 3
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- Adobe Dimension
- 58
- ProPump and Controls Osprey Pump Controller
- 9
- Netatalk
- 6
- Hitachi Energy SDM600
- 5
- DriverGenius
- 4
- Canon imageCLASS MF644Cdw
- 3
- TP-Link TL-WR940N
- 3
- Apache Software Foundation Apache Fineract
- 2
- com.veracode.jenkins:veracode-scan
- 2
- Foxit PDF Reader
- 2
Critical 16
- CVE-2023-28398CVE-2023-28398ProPump and Controls Osprey Pump Controller
- CVE-2023-27394CVE-2023-27394ProPump and Controls Osprey Pump Controller
- CVE-2023-27886CVE-2023-27886ProPump and Controls Osprey Pump Controller
- CVE-2023-28654CVE-2023-28654ProPump and Controls Osprey Pump Controller
- CVE-2023-28326Apache OpenMeetings: allows user impersonationApache Software Foundation Apache OpenMeetings · org.apache…
- CVE-2022-3682SDM600 file permission validationHitachi Energy SDM600
- CVE-2022-0194This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk.Netatalk
- CVE-2022-23121This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk.Netatalk
- CVE-2022-23122This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk.Netatalk
- CVE-2022-23125This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk.Netatalk
- CVE-2022-45460Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431119.12001.130000.0000
- CVE-2022-46387ConEmu through 220807 and Cmder before 1.3.21 report the title of the terminal, including control characters, which allows an attacker to ch
- CVE-2023-27229TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the upBw parameter at /setting/setWan
- CVE-2023-27231TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the downBw parameter at /setting/setW
- CVE-2023-27232TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wanStrategy parameter at /setting
- CVE-2023-27821Databasir v1.0.7 was discovered to contain a remote code execution (RCE) vulnerability via the mockDataScript parameter.
High 83
- CVE-2023-1676DriverGenius IOCTL mydrivers64.sys 0x9C402088 memory corruptionDriverGenius
- CVE-2023-1518CP Plus KVMS Pro versions 2.01.0.T.190521 and prior are vulnerable to sensitive credentials being leaked because they are insufficiently pCP Plus KVMS Pro
- CVE-2022-36060Prototype pollution in matrix-react-sdkmatrix-org matrix-react-sdk · matrix-react-sdk
- CVE-2023-28103Prototype pollution in matrix-react-sdkmatrix-org matrix-react-sdk · matrix-react-sdk
- CVE-2023-1516RoboDK versions 5.5.3 and prior contain an insecure permission assignment to critical directories vulnerability, which could allow a localRoboDK
- CVE-2023-28427Prototype pollution in matrix-js-sdkmatrix-org matrix-js-sdk · matrix-js-sdk
- CVE-2022-36059Prototype pollution in matrix-js-sdkmatrix-org matrix-js-sdk · matrix-js-sdk
- CVE-2023-1674SourceCodester School Registration and Fee System POST Parameter login.php sql injectionSourceCodester School Registration and Fee System
- CVE-2023-28712CVE-2023-28712ProPump and Controls Osprey Pump Controller
- CVE-2023-28718CVE-2023-28718ProPump and Controls Osprey Pump Controller
- CVE-2023-27286IBM Aspera code executionIBM Aspera
- CVE-2023-28447Cross site scripting vulnerability in Javascript escaping in smarty/smartysmarty-php smarty · smarty/smarty
- CVE-2023-27284IBM Aspera code executionIBM Aspera
- CVE-2023-28648CVE-2023-28648ProPump and Controls Osprey Pump Controller
- CVE-2023-28637DataEase AWS redshift data source exists for remote code execution vulnerabilitydataease
- CVE-2023-28375CVE-2023-28375ProPump and Controls Osprey Pump Controller
- CVE-2023-28395CVE-2023-28395ProPump and Controls Osprey Pump Controller
- CVE-2022-3685SDM600 software privilege levelHitachi Energy SDM600
- CVE-2022-3684SDM600 endpoint vulnerability Hitachi Energy SDM600
- CVE-2022-3683SDM600 API web services authorization validationHitachi Energy SDM600
- CVE-2023-25195Apache Fineract: SSRF template type vulnerability in certain authenticated usersApache Software Foundation Apache Fineract
- CVE-2022-45831WordPress Image Hover Effects - Caption Hover with Carousel Plugin <= 2.8 is vulnerable to Cross Site Scripting (XSS)biplob018 Image Hover Effects for Elementor with Lightbox a…
- CVE-2022-45825WordPress WPComplete Plugin <= 2.9.4 is vulnerable to Cross Site Scripting (XSS)iThemes WPComplete
- CVE-2020-8889The ShipStation.com plugin 1.0 for CS-Cart allows remote attackers to obtain sensitive information (via action=export) because a typo result
- CVE-2022-1229This vulnerability allows remote attackers to execute arbitrary code on affected installations of Bentley MicroStation CONNECT 10.16.2.034.Bentley MicroStation CONNECT
- CVE-2022-24352This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 prior to 211210 rTP-Link AC1750
- CVE-2022-24353This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 1.1.4 Build 20211TP-Link AC1750
- CVE-2022-24672This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 Canon imageCLASS MF644Cdw
- CVE-2022-24673This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers.Canon imageCLASS MF644Cdw
- CVE-2022-24674This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 Canon imageCLASS MF644Cdw
- CVE-2022-24907This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543.Foxit PDF Reader
- CVE-2022-24908This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.1.0.52543.Foxit PDF Reader
- CVE-2022-46397FP.io VPP (Vector Packet Processor) 22.10, 22.06, 22.02, 21.10, 21.06, 21.01, 20.09, 20.05, 20.01, 19.08, and 19.04 Generates a Predictable
- CVE-2023-23330amano Xparc parking solutions 7.1.3879 was discovered to be vulnerable to local file inclusion.
- CVE-2023-24304Improper input validation in the PDF.dll plugin of IrfanView v4.60 allows attackers to execute arbitrary code via opening a crafted PDF file
- CVE-2023-24308A potential memory vulnerability due to insufficient input validation in PDFXEditCore.x64.dll in PDF-XChange Editor version 9.3 by Tracker S
- CVE-2023-25260Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.
- CVE-2023-25262Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF).
- CVE-2023-25879ZDI-CAN-19389: Adobe Dimension OBJ File Improper Input Validation Remote Code ExecutionAdobe Dimension
- CVE-2023-25880ZDI-CAN-19412: Adobe Dimension GLTF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25881ZDI-CAN-19390: Adobe Dimension OBJ File Improper Input Validation Remote Code ExecutionAdobe Dimension
- CVE-2023-25882ZDI-CAN-19385: Adobe Dimension OBJ File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25883ZDI-CAN-19386: Adobe Dimension FBX File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25884ZDI-CAN-19411: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25885ZDI-CAN-19480: Adobe Dimension USD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25886ZDI-CAN-19452: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25887ZDI-CAN-19450: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25888ZDI-CAN-19451: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25889ZDI-CAN-19466: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25890ZDI-CAN-19493: Adobe Dimension USD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25891ZDI-CAN-19542: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25892ZDI-CAN-19523: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25893ZDI-CAN-19539: Adobe Dimension USD File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25894ZDI-CAN-19543: Adobe Dimension USD File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25895ZDI-CAN-19540: Adobe Dimension USD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25896ZDI-CAN-19541: Adobe Dimension USD File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25897ZDI-CAN-19520: Adobe Dimension USD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25898ZDI-CAN-19521: Adobe Dimension USD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25899ZDI-CAN-19522: Adobe Dimension USD File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25900ZDI-CAN-19559: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25901ZDI-CAN-19508: Adobe Dimension USD File Improper Input Validation Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25902ZDI-CAN-19560: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25903Adobe Dimension USDZ files Integer Overflow or Wraparound Arbitrary code execution Adobe Dimension
- CVE-2023-25904Adobe Dimension Out-of-bounds Read USDZ file Arbitrary code executionAdobe Dimension
- CVE-2023-25905ZDI-CAN-20031: Adobe Dimension OBJ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25906ZDI-CAN-20046: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-25907ZDI-CAN-20216: Adobe Dimension USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-26071An issue was discovered in MCUBO ICT through 10.12.4 (aka 6.0.2).
- CVE-2023-26327ZDI-CAN-20217: Adobe Dimension GLTF File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26328ZDI-CAN-20212: Adobe Dimension USD File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-26329ZDI-CAN-20213: Adobe Dimension OBJ File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26330ZDI-CAN-20146: Adobe Dimension USD File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-26331ZDI-CAN-20145: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26332ZDI-CAN-20144: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26333ZDI-CAN-20214: Adobe Dimension USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-26334ZDI-CAN-20149: Adobe Dimension USD File Parsing Uninitialized Pointer Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26335ZDI-CAN-20215: Adobe Dimension USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-26336ZDI-CAN-20275: Adobe Dimension USD File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-26337ZDI-CAN-20285: Adobe Dimension USDA File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-26923Musescore 3.0 to 4.0.1 has a stack buffer overflow vulnerability that occurs when reading misconfigured midi files.
- CVE-2023-27246An arbitrary file upload vulnerability in the Virtual Disk of MK-Auth 23.01K4.9 allows attackers to execute arbitrary code via uploading a c
- CVE-2023-27700MuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /accessory/picdel.html.
- CVE-2023-27701MuYuCMS v2.2 was discovered to contain an arbitrary file deletion vulnerability via the component /database/sqldel.html.
Medium, low and unrated 49
- CVE-2023-1682Xunrui CMS Install.txt direct requestXunrui CMS
- CVE-2023-1681Xunrui CMS test.php information disclosureXunrui CMS
- CVE-2023-1679DriverGenius IOCTL mydrivers64.sys 0x9C40A108 memory corruptionDriverGenius
- CVE-2023-1678DriverGenius IOCTL mydrivers64.sys 0x9C40A0E0 memory corruptionDriverGenius
- CVE-2023-1677DriverGenius IOCTL mydrivers64.sys 0x9c402084 denial of serviceDriverGenius
- CVE-2023-1675SourceCodester School Registration and Fee System GET Parameter edit_stud.php sql injectionSourceCodester School Registration and Fee System
- CVE-2023-28631Attacker controlled data in AST nodes is not validated in comrakkivikakk comrak · comrak
- CVE-2023-28626Quadratic runtime when parsing Markdown in comrakkivikakk comrak · comrak
- CVE-2023-0775Bluetooth LE Invalid prepare write request command leads to denial of servicesilabs.com GSDK
- CVE-2023-0466Certificate policy check not enabledOpenSSL
- CVE-2023-0465Invalid certificate policies in leaf certificates are silently ignoredOpenSSL
- CVE-2022-3686SDM600 API permission checkHitachi Energy SDM600
- CVE-2023-25197apache fineract: SQL injection vulnerability in certain procedure calls Apache Software Foundation apache fineract
- CVE-2023-25196Apache Fineract: SQL injection vulnerability Apache Software Foundation Apache Fineract
- CVE-2023-25704WordPress Interactive SVG Image Map Builder Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)Mehjabin Orthi Interactive SVG Image Map Builder
- CVE-2022-47170WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) Plugin <= 1.5.48 is vulnerable to Cross Site Scripting (XSS)Unlimited Elements For Elementor
- CVE-2022-46863WordPress Quick Event Manager Plugin <= 9.6.4 is vulnerable to Cross Site Scripting (XSS)Fullworks Quick Event Manager
- CVE-2022-46855WordPress Responsive Pricing Table Plugin <= 5.1.6 is vulnerable to Cross Site Scripting (XSS)WP Darko Responsive Pricing Table
- CVE-2022-46848WordPress Visualizer Plugin <= 3.9.1 is vulnerable to Cross Site Scripting (XSS)Themeisle Visualizer: Tables and Charts Manager for WordPre…
- CVE-2022-0650This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 2TP-Link TL-WR940N
- CVE-2022-1230This vulnerability allows local attackers to execute arbitrary code on affected installations of Samsung Galaxy S21 prior to 4.5.40.5 phonesSamsung Galaxy S21
- CVE-2022-23123This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk.Netatalk
- CVE-2022-23124This vulnerability allows remote attackers to disclose sensitive information on affected installations of Netatalk.Netatalk
- CVE-2022-24972This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of TP-Link TL-WR940N 3.20.1TP-Link TL-WR940N
- CVE-2022-24973This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR940N 3.20.1 Build 2TP-Link TL-WR940N
- CVE-2022-47529Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts
- CVE-2023-20903This disclosure regards a vulnerability related to UAA refresh tokens and external identity providers.Assuming that an external identity proCloud Foundry
- CVE-2023-25721Veracode Scan Jenkins Plugin before 23.3.19.0, when the "Connect using proxy" option is enabled and configured with proxy credentials and whcom.veracode.jenkins:veracode-scan
- CVE-2023-25722A credential-leak issue was discovered in related Veracode products before 2023-03-27.com.veracode.jenkins:veracode-scan
- CVE-2023-26338ZDI-CAN-19410: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26339ZDI-CAN-19388: Adobe Dimension OBJ File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26340ZDI-CAN-19387: Adobe Dimension OBJ File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26341ZDI-CAN-19391: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26342ZDI-CAN-19413: Adobe Dimension GLB File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26343ZDI-CAN-19465: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26344ZDI-CAN-19467: Adobe Dimension USD File Access of Uninitialized Pointer Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26345ZDI-CAN-19494: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26346ZDI-CAN-19495: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26348ZDI-CAN-19518: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26349ZDI-CAN-20218: Adobe Dimension USDZ File Parsing Use-After-Free Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26350ZDI-CAN-19510: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26351ZDI-CAN-19507: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26352ZDI-CAN-19509: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26353ZDI-CAN-19511: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26354ZDI-CAN-19519: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26355ZDI-CAN-19512: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26356ZDI-CAN-19506: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-27008A Cross-site scripting (XSS) vulnerability in the function encrypt_password() in login.tmpl.php in ATutor 2.2.1 allows remote attackers to i
- CVE-2023-27247Cynet Client Agent v4.6.0.8010 allows attackers with Administrator rights to disable the EDR functions by disabling process privilege tokens