# CVEs published 2023-03-31

58 CVEs were published on March 31, 2023: 11 critical, 14 high. Days are UTC.

- [CVE-2023-28845](https://cve.now/CVE-2023-28845.md): Chat room membership disclosed via autocompletion in Nextcloud talk (CVSS 3.5, nextcloud security-advisories)
- [CVE-2023-28844](https://cve.now/CVE-2023-28844.md): User without download rights can download older version of that file in nextcloud server (CVSS 5.7, nextcloud security-advisories)
- [CVE-2023-28645](https://cve.now/CVE-2023-28645.md): Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments (CVSS 5.7, nextcloud security-advisories)
- [CVE-2023-24824](https://cve.now/CVE-2023-24824.md): Quadratic complexity may lead to a denial of service in cmark-gfm (CVSS 5.3, github cmark-gfm)
- [CVE-2023-26485](https://cve.now/CVE-2023-26485.md): Quadratic complexity may lead to a denial of service in cmark-gfm (CVSS 5.3, github cmark-gfm)
- [CVE-2023-1785](https://cve.now/CVE-2023-1785.md): SourceCodester Earnings and Expense Tracker App manage\_user.php sql injection (CVSS 6.3, SourceCodester Earnings and Expense Tracker App)
- [CVE-2023-1784](https://cve.now/CVE-2023-1784.md): jeecg-boot API Documentation improper authentication (CVSS 5.3, jeecg-boot · org.jeecgframework.boot:jeecg-boot-parent)
- [CVE-2023-28843](https://cve.now/CVE-2023-28843.md): Improper neutralization of SQL parameter in PayPal module for PrestaShop (CVSS 9.8, 202ecommerce paypal)
- [CVE-2022-3192](https://cve.now/CVE-2022-3192.md): Improper Check for Unusual or Exceptional Conditions (CVSS 5.3, ABB AC500)
- [CVE-2023-0432](https://cve.now/CVE-2023-0432.md): CVE-2023-0432 (CVSS 9.0, Delta Electronics DX-2100-L1-CN)
- [CVE-2023-0344](https://cve.now/CVE-2023-0344.md): CVE-2023-0344 (CVSS 9.1, Akuvox E11)
- [CVE-2023-0343](https://cve.now/CVE-2023-0343.md): CVE-2023-0343 (CVSS 6.5, Akuvox E11)
- [CVE-2023-1773](https://cve.now/CVE-2023-1773.md): Rockoa Configuration File webmainConfig.php code injection (CVSS 6.3, Rockoa)
- [CVE-2023-1777](https://cve.now/CVE-2023-1777.md): Information disclosure in linked message previews (CVSS 6.5, Mattermost · github.com/mattermost/mattermost-server/v6 +1)
- [CVE-2023-1772](https://cve.now/CVE-2023-1772.md): DataGear Diagram Type cross site scripting (CVSS 3.5, DataGear)
- [CVE-2023-1771](https://cve.now/CVE-2023-1771.md): SourceCodester Grade Point Average GPA Calculator Master.php get\_scale cross site scripting (CVSS 3.5, SourceCodester Grade Point Average GPA Calculator)
- [CVE-2023-1776](https://cve.now/CVE-2023-1776.md): Stored XSS via SVG attachment on Boards (CVSS 7.3, Mattermost · github.com/mattermost/mattermost-server/v6 +2)
- [CVE-2023-1775](https://cve.now/CVE-2023-1775.md): Unsanitized events sent over Websocket to regular users in a High Availability environment (CVSS 4.3, Mattermost · github.com/mattermost/mattermost-server +2)
- [CVE-2023-1774](https://cve.now/CVE-2023-1774.md): Unauthorized email invite to a private channel (CVSS 4.2, Mattermost · github.com/mattermost/mattermost-server +2)
- [CVE-2023-1770](https://cve.now/CVE-2023-1770.md): SourceCodester Grade Point Average GPA Calculator Master.php get\_scale sql injection (CVSS 6.3, SourceCodester Grade Point Average GPA Calculator)
- [CVE-2023-1769](https://cve.now/CVE-2023-1769.md): SourceCodester Grade Point Average GPA Calculator index.php information disclosure (CVSS 4.3, SourceCodester Grade Point Average GPA Calculator)
- [CVE-2023-1060](https://cve.now/CVE-2023-1060.md): XSS in YKM CRM (CVSS 6.1, YKM CRM)
- [CVE-2023-1258](https://cve.now/CVE-2023-1258.md): Flow-X disclosure of sensitive information to unauthenticated users (CVSS 5.3, ABB Flow-X)
- [CVE-2023-28727](https://cve.now/CVE-2023-28727.md): Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due to mishandling of X-Forwarded-For headers. (CVSS 9.6, Panasonic AiSEG2)
- [CVE-2023-28726](https://cve.now/CVE-2023-28726.md): Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS commands. (CVSS 7.5, Panasonic AiSEG2)
- [CVE-2022-46021](https://cve.now/CVE-2022-46021.md): X-Man 1.0 has a SQL injection vulnerability, which can cause data leakage. (CVSS 7.5)
- [CVE-2022-47188](https://cve.now/CVE-2022-47188.md): Improper Input Validation in Generex CS141 (CVSS 7.5, Generex UPS CS141)
- [CVE-2022-47189](https://cve.now/CVE-2022-47189.md): DoS via file upload vulnerability at Generex CS141 (CVSS 7.5, Generex UPS CS141)
- [CVE-2022-47190](https://cve.now/CVE-2022-47190.md): RCE via file upload vulnerability in Generex CS141 (CVSS 10.0, Generex UPS CS141)
- [CVE-2022-47191](https://cve.now/CVE-2022-47191.md): Privilege Escalation via file upload vulnerability at Generex CS141 (CVSS 4.3, Generex UPS CS141)
- [CVE-2022-47192](https://cve.now/CVE-2022-47192.md): Admin password reset via file upload vulnerability in Generex CS141 (CVSS 8.8, Generex UPS CS141)
- [CVE-2022-4899](https://cve.now/CVE-2022-4899.md): A vulnerability was found in zstd v1.4.10, where an attacker can supply empty string as an argument to the command line tool to cause buffer (CVSS 7.5, zstd · github.com/facebook/zstd)
- [CVE-2023-1753](https://cve.now/CVE-2023-1753.md): Weak Password Requirements in thorsten/phpmyfaq (CVSS 5.5, thorsten/phpmyfaq)
- [CVE-2023-1754](https://cve.now/CVE-2023-1754.md): Improper Neutralization of Input During Web Page Generation in thorsten/phpmyfaq (CVSS 4.7, thorsten/phpmyfaq)
- [CVE-2023-1755](https://cve.now/CVE-2023-1755.md): Cross-site Scripting (XSS) - Generic in thorsten/phpmyfaq (CVSS 8.4, thorsten/phpmyfaq)
- [CVE-2023-1759](https://cve.now/CVE-2023-1759.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 4.7, thorsten/phpmyfaq)
- [CVE-2023-1760](https://cve.now/CVE-2023-1760.md): Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq (CVSS 8.1, thorsten/phpmyfaq)
- [CVE-2023-1761](https://cve.now/CVE-2023-1761.md): Cross-site Scripting in thorsten/phpmyfaq (CVSS 6.3, thorsten/phpmyfaq)
- [CVE-2023-1762](https://cve.now/CVE-2023-1762.md): Improper Privilege Management in thorsten/phpmyfaq (CVSS 7.2, thorsten/phpmyfaq)
- [CVE-2023-23594](https://cve.now/CVE-2023-23594.md): An authentication bypass vulnerability in the web client interface for the CL4NX printer before firmware version 1.13.3-u724\_r2 provides rem (CVSS 9.8)
- [CVE-2023-26829](https://cve.now/CVE-2023-26829.md): An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack before 13.5.9808 allows remote attackers to s (CVSS 9.8)
- [CVE-2023-26830](https://cve.now/CVE-2023-26830.md): An unrestricted file upload vulnerability in the administrative portal branding component of Gladinet CentreStack before 13.5.9808 allows au (no CVSS)
- [CVE-2023-26858](https://cve.now/CVE-2023-26858.md): SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate privileges via the faqsBudgetModuleFrontCon (no CVSS)
- [CVE-2023-26925](https://cve.now/CVE-2023-26925.md): An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-882 1.30. (CVSS 7.5)
- [CVE-2023-27159](https://cve.now/CVE-2023-27159.md): Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon. (CVSS 7.5, appwrite/server-ce)
- [CVE-2023-27160](https://cve.now/CVE-2023-27160.md): forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /articles/{id}. (CVSS 7.2)
- [CVE-2023-27162](https://cve.now/CVE-2023-27162.md): openapi-generator up to v6.4.0 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/gen/clients/{language}. (CVSS 9.1, org.openapitools:openapi-generator-project)
- [CVE-2023-27163](https://cve.now/CVE-2023-27163.md): request-baskets up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /api/baskets/{name}. (CVSS 6.5, github.com/darklynx/request-baskets)
- [CVE-2023-28464](https://cve.now/CVE-2023-28464.md): hci\_conn\_cleanup in net/bluetooth/hci\_conn.c in the Linux kernel through 6.2.9 has a use-after-free (observed in hci\_conn\_hash\_flush) becaus (no CVSS)
- [CVE-2023-28755](https://cve.now/CVE-2023-28755.md): A ReDoS issue was discovered in the URI component through 0.12.0 in Ruby through 3.2.1. (CVSS 5.3, uri)
- [CVE-2023-28756](https://cve.now/CVE-2023-28756.md): A ReDoS issue was discovered in the Time component through 0.2.1 in Ruby through 3.2.1. (no CVSS, time)
- [CVE-2023-28862](https://cve.now/CVE-2023-28862.md): An issue was discovered in LemonLDAP::NG before 2.16.1. (CVSS 9.8)
- [CVE-2023-28877](https://cve.now/CVE-2023-28877.md): The VTEX apps-graphql@2.x GraphQL API module does not properly restrict unauthorized access to private configuration data. (CVSS 7.5)
- [CVE-2023-28879](https://cve.now/CVE-2023-28879.md): In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential corruption of data internal to the PostScript interp (CVSS 9.8)
- [CVE-2023-29137](https://cve.now/CVE-2023-29137.md): An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. (CVSS 4.3)
- [CVE-2023-29139](https://cve.now/CVE-2023-29139.md): An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. (CVSS 6.5)
- [CVE-2023-29140](https://cve.now/CVE-2023-29140.md): An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. (CVSS 5.3)
- [CVE-2023-29141](https://cve.now/CVE-2023-29141.md): An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. (CVSS 9.8, mediawiki/core)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-03-31
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.