CVEs published March 30, 2023
65 CVEs were published on March 30, 2023: 7 critical, 17 high.
- Published
- 65
- Critical
- 7
- High
- 17
- Medium
- 35
- Low
- 5
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 20
Most affected products
- nextcloud security-advisories
- 7
- https://github.com/curl/curl
- 6
- SourceCodester Young Entrepreneur E-Negosyo System
- 5
- angular · org.webjars.bower:angular +2
- 3
- HashiCorp Vault · github.com/hashicorp/vault
- 3
- IBOS
- 3
- OpenImageIO Project OpenImageIO
- 3
- AcyMailing Newsletter Plugin for Joomla in the Enterprise v…
- 2
- Kernel
- 2
- Virames Vira-Investing
- 2
Critical 7
- CVE-2023-26482Scope of workflow operations is not validated in nextcloud servernextcloud security-advisories
- CVE-2023-25076A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80dSNIProxy
- CVE-2023-1725SSRF in Infoline Project Management SystemInfoline Project Management System
- CVE-2023-28731Unauthenticated RCE affecting the AcyMailing plugin for JoomlaAcyMailing Newsletter Plugin for Joomla in the Enterprise v…
- CVE-2023-1712Use of Hard-coded, Security-relevant Constants in deepset-ai/haystackdeepset-ai/haystack · farm-haystack
- CVE-2023-27533A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on malihttps://github.com/curl/curl
- CVE-2023-28462A JNDI rebind operation in the default ORB listener in Payara Server 4.1.2.191 (Enterprise), 5.20.0 and newer (Enterprise), and 5.2020.1 andfish.payara.server:payara-aggregator
High 17
- CVE-2023-1737SourceCodester Young Entrepreneur E-Negosyo System login.php sql injectionSourceCodester Young Entrepreneur E-Negosyo System
- CVE-2023-1734SourceCodester Young Entrepreneur E-Negosyo System unrestricted uploadSourceCodester Young Entrepreneur E-Negosyo System
- CVE-2022-23522Arbitrary File Write when Extracting Tarballs retrieved from a remote location using in mindsdbmindsdb
- CVE-2023-22845An out-of-bounds read vulnerability exists in the TGAInput::decode_pixel() functionality of OpenImageIO Project OpenImageIO v2.4.7.1.OpenImageIO Project OpenImageIO
- CVE-2023-24472A denial of service vulnerability exists in the FitsOutput::close() functionality of OpenImageIO Project OpenImageIO v2.4.7.1.OpenImageIO Project OpenImageIO
- CVE-2023-28733Stored XSS affecting the AcyMailing plugin for Joomla AcyMailing Newsletter Plugin for Joomla in the Enterprise v…
- CVE-2023-28935Apache UIMA DUCC: DUCC (EOL) allows RCEApache Software Foundation Apache UIMA DUCC · org.apache.ui…
- CVE-2023-1014Information disclosure in Vira-InvestingVirames Vira-Investing
- CVE-2022-30350Avanquest Software RAD PDF (PDFEscape Online) 3.19.2.2 is vulnerable to Information Leak / Disclosure.
- CVE-2022-30351PDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to correctly remove redacted information from a supp
- CVE-2022-4744A double-free flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user registers the device when the register_Kernel
- CVE-2022-47542Red Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely for Escalation of Privileges.
- CVE-2023-1393A flaw was found in X.Org Server Overlay Window.xorg-server
- CVE-2023-1670A flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was found.A local user could use this flaw to crashKernel
- CVE-2023-27534A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as https://github.com/curl/curl
- CVE-2023-27538An authentication bypass vulnerability exists in libcurl prior to v8.0.0 where it reuses a previously established SSH connection despite thehttps://github.com/curl/curl
- CVE-2023-290593CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March 2023.
Medium, low and unrated 41
- CVE-2023-1747IBOS mark&op=delFromSend sql injectionIBOS
- CVE-2023-1746Dreamer CMS File Upload cross site scriptingDreamer CMS
- CVE-2023-1745KMPlayer SHFOLDER.dll uncontrolled search pathKMPlayer
- CVE-2023-1744IBOS htaccess unrestricted uploadIBOS
- CVE-2023-1743SourceCodester Grade Point Average GPA Calculator index.php cross site scriptingSourceCodester Grade Point Average GPA Calculator
- CVE-2023-1742IBOS Report Search getlist sql injectionIBOS
- CVE-2023-1741jeecg-boot Sleep Command SysDictMapper.java sql injectionjeecg-boot · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2023-1740SourceCodester Air Cargo Management System GET Parameter manage_user.php sql injectionSourceCodester Air Cargo Management System
- CVE-2022-42452HCL Launch is vulnerable to HTML injection.HCL Software HCL Launch
- CVE-2023-1739SourceCodester Simple and Beautiful Shopping Cart System upload.php unrestricted uploadSourceCodester Simple and Beautiful Shopping Cart System
- CVE-2023-1738SourceCodester Young Entrepreneur E-Negosyo System sql injectionSourceCodester Young Entrepreneur E-Negosyo System
- CVE-2023-28846Denial of Service in unpoly-railsunpoly-rails
- CVE-2023-1736SourceCodester Young Entrepreneur E-Negosyo System sql injectionSourceCodester Young Entrepreneur E-Negosyo System
- CVE-2023-1735SourceCodester Young Entrepreneur E-Negosyo System passwordrecover.php sql injectionSourceCodester Young Entrepreneur E-Negosyo System
- CVE-2023-28835Insecure randomness for default password in nextcloudnextcloud security-advisories
- CVE-2023-28833Unrestricted filenames for logo or favicon as admin in the theming settings in nextcloud servernextcloud security-advisories
- CVE-2023-28644Reference fetch can saturate the server bandwidth for 10 seconds in nextcloud servernextcloud security-advisories
- CVE-2023-28643Potential share collision for recipients when caching is enabled in nextcloud servernextcloud security-advisories
- CVE-2023-28646App lockout in nextcloud Android app can be bypassed via thirdparty appsnextcloud security-advisories
- CVE-2023-28647App pin of the iOS app can be bypassed in Nextcloud iOSnextcloud security-advisories
- CVE-2022-43473A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168.ManageEngine OpManager
- CVE-2023-24473An information disclosure vulnerability exists in the TGAInput::read_tga2_header functionality of OpenImageIO Project OpenImageIO v2.4.7.1.OpenImageIO Project OpenImageIO
- CVE-2023-28732Missing access control affecting the AcyMailing plugin for JoomlaAcyMailing Newsletter Plugin for Joomla
- CVE-2023-24399WordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)OceanWP Ocean Extra
- CVE-2023-25040WordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Cross Site Scripting (XSS)Vova Anokhin WordPress Shortcodes Plugin — Shortcodes Ultim…
- CVE-2023-23681WordPress Image Hover Effects For WPBakery Page Builder Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)Labib Ahmed Image Hover Effects For WPBakery Page Builder
- CVE-2023-23677WordPress GTmetrix for WordPress Plugin <= 0.4.5 is vulnerable to Cross Site Scripting (XSS)GTmetrix for WordPress
- CVE-2023-23675WordPress WP Smart Preloader Plugin <= 1.15 is vulnerable to Cross Site Scripting (XSS)Catchsquare WP Smart Preloader
- CVE-2023-23670WordPress Fancy Comments WordPress Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)Team Heateor Fancy Comments WordPress
- CVE-2023-1699Rapid7 Nexpose Forced BrowsingRapid7 Nexpose
- CVE-2023-1013XSS in Vira-InvestingVirames Vira-Investing
- CVE-2023-26116Versions of the package angular from 1.2.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the angular.copy() utility fuangular · org.webjars.bower:angular +2
- CVE-2023-26118Versions of the package angular from 1.4.9 are vulnerable to Regular Expression Denial of Service (ReDoS) via the <input type="url"> elementangular · org.webjars.bower:angular +2
- CVE-2023-26117Versions of the package angular from 1.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the $resource service due to tangular · org.webjars.bower:angular +2
- CVE-2023-0620Vault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage BackendHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-0665Vault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer MetadataHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-25000Vault Vulnerable to Cache-Timing Attacks During Seal and Unseal OperationsHashiCorp Vault · github.com/hashicorp/vault
- CVE-2023-26692ZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and Zijper Image Bank Management System (ZBBS) 4.1
- CVE-2023-27535An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials beihttps://github.com/curl/curl
- CVE-2023-27536An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connectihttps://github.com/curl/curl
- CVE-2023-27537A double free vulnerability exists in libcurl <8.0.0 when sharing HSTS data between separate "handles".https://github.com/curl/curl