CVEs published March 31, 2023
58 CVEs were published on March 31, 2023: 11 critical, 14 high.
- Published
- 58
- Critical
- 11
- High
- 14
- Medium
- 26
- Low
- 3
- Unrated
- 4
- Now in CISA KEV
- 0
- Fix available
- 29
Most affected products
- thorsten/phpmyfaq
- 7
- Generex UPS CS141
- 5
- nextcloud security-advisories
- 3
- SourceCodester Grade Point Average GPA Calculator
- 3
- Akuvox E11
- 2
- github cmark-gfm
- 2
- Mattermost · github.com/mattermost/mattermost-server +2
- 2
- Panasonic AiSEG2
- 2
- 202ecommerce paypal
- 1
- ABB AC500
- 1
Critical 11
- CVE-2023-28843Improper neutralization of SQL parameter in PayPal module for PrestaShop202ecommerce paypal
- CVE-2023-0432CVE-2023-0432Delta Electronics DX-2100-L1-CN
- CVE-2023-0344CVE-2023-0344Akuvox E11
- CVE-2023-28727Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Forwarded-For headers.Panasonic AiSEG2
- CVE-2022-47190RCE via file upload vulnerability in Generex CS141Generex UPS CS141
- CVE-2023-23594An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724_r2 provides rem
- CVE-2023-26829An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to s
- CVE-2023-27162openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}.org.openapitools:openapi-generator-project
- CVE-2023-28862An issue was discovered in LemonLDAP::NG before 2.16.1.
- CVE-2023-28879In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interp
- CVE-2023-29141An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3.mediawiki/core
High 14
- CVE-2023-1776Stored XSS via SVG attachment on BoardsMattermost · github.com/mattermost/mattermost-server/v6 +2
- CVE-2023-28726Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS commands.Panasonic AiSEG2
- CVE-2022-46021X-Man 1.0 has a SQL injection vulnerability, which can cause data leakage.
- CVE-2022-47188Improper Input Validation in Generex CS141Generex UPS CS141
- CVE-2022-47189DoS via file upload vulnerability at Generex CS141Generex UPS CS141
- CVE-2022-47192Admin password reset via file upload vulnerability in Generex CS141Generex UPS CS141
- CVE-2022-4899A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause bufferzstd · github.com/facebook/zstd
- CVE-2023-1755Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1760Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1762Improper Privilege Management in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-26925An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-882 1.30.
- CVE-2023-27159Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon.appwrite/server-ce
- CVE-2023-27160forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /articles/{id}.
- CVE-2023-28877The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration data.
Medium, low and unrated 33
- CVE-2023-28845Chat room membership disclosed via autocompletion in Nextcloud talknextcloud security-advisories
- CVE-2023-28844User without download rights can download older version of that file in nextcloud servernextcloud security-advisories
- CVE-2023-28645Secure view can be bypassed by using internal API endpoint in Nextcloud richdocumentsnextcloud security-advisories
- CVE-2023-24824Quadratic complexity may lead to a denial of service in cmark-gfmgithub cmark-gfm
- CVE-2023-26485Quadratic complexity may lead to a denial of service in cmark-gfmgithub cmark-gfm
- CVE-2023-1785SourceCodester Earnings and Expense Tracker App manage_user.php sql injectionSourceCodester Earnings and Expense Tracker App
- CVE-2023-1784jeecg-boot API Documentation improper authenticationjeecg-boot · org.jeecgframework.boot:jeecg-boot-parent
- CVE-2022-3192 Improper Check for Unusual or Exceptional ConditionsABB AC500
- CVE-2023-0343CVE-2023-0343Akuvox E11
- CVE-2023-1773Rockoa Configuration File webmainConfig.php code injectionRockoa
- CVE-2023-1777Information disclosure in linked message previewsMattermost · github.com/mattermost/mattermost-server/v6 +1
- CVE-2023-1772DataGear Diagram Type cross site scriptingDataGear
- CVE-2023-1771SourceCodester Grade Point Average GPA Calculator Master.php get_scale cross site scriptingSourceCodester Grade Point Average GPA Calculator
- CVE-2023-1775Unsanitized events sent over Websocket to regular users in a High Availability environmentMattermost · github.com/mattermost/mattermost-server +2
- CVE-2023-1774Unauthorized email invite to a private channelMattermost · github.com/mattermost/mattermost-server +2
- CVE-2023-1770SourceCodester Grade Point Average GPA Calculator Master.php get_scale sql injectionSourceCodester Grade Point Average GPA Calculator
- CVE-2023-1769SourceCodester Grade Point Average GPA Calculator index.php information disclosureSourceCodester Grade Point Average GPA Calculator
- CVE-2023-1060XSS in YKM CRMYKM CRM
- CVE-2023-1258Flow-X disclosure of sensitive information to unauthenticated usersABB Flow-X
- CVE-2022-47191Privilege Escalation via file upload vulnerability at Generex CS141Generex UPS CS141
- CVE-2023-1753Weak Password Requirements in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1754Improper Neutralization of Input During Web Page Generation in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1759Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-1761Cross-site Scripting in thorsten/phpmyfaqthorsten/phpmyfaq
- CVE-2023-26830An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows au
- CVE-2023-26858SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontCon
- CVE-2023-27163request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}.github.com/darklynx/request-baskets
- CVE-2023-28464hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci_conn_hash_flush) becaus
- CVE-2023-28755A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1.uri
- CVE-2023-28756A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1.time
- CVE-2023-29137An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3.
- CVE-2023-29139An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3.
- CVE-2023-29140An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3.