CVEs published in March 2023
2,723 vulnerabilities, 268 critical, 14 exploited.
-
com.intuit.karate:karate-coreMaven Karate has vulnerable dependency on json-smart package (CVE-2023-1370) 7.1 High - nextcloud talk, kiteworks security-advisories +1 more Chat room membership disclosed via autocompletion in Nextcloud talk 3.5 Low
- nextcloud server, kiteworks security-advisories +1 more User without download rights can download older version of that file in nextcloud server 5.7 Medium
- nextcloud richdocuments, kiteworks security-advisories +1 more Secure view can be bypassed by using internal API endpoint in Nextcloud richdocuments 5.7 Medium
- github cmark-gfm Quadratic complexity may lead to a denial of service in cmark-gfm 5.3 Medium
- github cmark-gfm Quadratic complexity may lead to a denial of service in cmark-gfm 5.3 Medium
- earnings and expense tracker app project and expense tracker app, sourcecodester earnings and expense tracker app +1 more SourceCodester Earnings and Expense Tracker App manage_user.php sql injection 6.3 Medium
- jeecg boot, unspecified jeecg-boot +1 more jeecg-boot API Documentation improper authentication 5.3 Medium
-
imagemagickUbuntu imagemagick regression No score -
atomys.codes/stud42Go Stud42 vulnerable to denial of service 7.5 High - 202-ecommerce paypal Improper neutralization of SQL parameter in PayPal module for PrestaShop 9.8 Critical
- abb ac500 v2, ac500 cpu firmware +1 more Improper Check for Unusual or Exceptional Conditions 5.3 Medium
- delta electronics dx-2100-l1-cn, deltaww dx-2100l1-cn firmware +1 more CVE-2023-0432 9.0 Critical
- akuvox e11, e11 firmware +1 more CVE-2023-0344 9.1 Critical
- akuvox e11, e11 firmware +1 more CVE-2023-0343 6.5 Medium
-
grub2openSUSE Security update for grub2 No score - rockoa Rockoa Configuration File webmainConfig.php code injection 6.3 Medium
-
spincrates.io spin-rs initialisation failure in `Once::try_call_once` can lead to undefined behaviour for other initialisers No score - mattermost, mattermost server +1 more Information disclosure in linked message previews 6.5 Medium
- datagear DataGear Diagram Type cross site scripting 3.5 Low
- sourcecodester grade point average gpa calculator, grade point average \(gpa\) calculator project point average \(gpa\) calculator +1 more SourceCodester Grade Point Average GPA Calculator Master.php get_scale cross site scripting 3.5 Low
- mattermost, mattermost server +1 more Stored XSS via SVG attachment on Boards 7.3 High
- mattermost, mattermost server +1 more Unsanitized events sent over Websocket to regular users in a High Availability environment 4.3 Medium
- mattermost, mattermost server +1 more Unauthorized email invite to a private channel 4.2 Medium
- sourcecodester grade point average gpa calculator, grade point average \(gpa\) calculator project point average \(gpa\) calculator +1 more SourceCodester Grade Point Average GPA Calculator Master.php get_scale sql injection 6.3 Medium
- sourcecodester grade point average gpa calculator, grade point average \(gpa\) calculator project point average \(gpa\) calculator +1 more SourceCodester Grade Point Average GPA Calculator index.php information disclosure 4.3 Medium
- ykm crm, ykmbilisim ykm crm +1 more XSS in YKM CRM 6.1 Medium
- abb flow-x, flow-x\/c firmware, flow-x\/k firmware +6 more +8 more Flow-X disclosure of sensitive information to unauthenticated users 5.3 Medium
- panasonic aiseg2, aiseg2 firmware +1 more Panasonic AiSEG2 versions 2.00J through 2.93A allows adjacent attackers bypass authentication due... 9.6 Critical
- panasonic aiseg2, aiseg2 firmware +1 more Panasonic AiSEG2 versions 2.80F through 2.93A allows remote attackers to execute arbitrary OS... 7.5 High
-
xapianMageia Updated xapian packages fix security vulnerability No score -
perl-Cpanel-JSON-XSMageia Updated perl-Cpanel-JSON-XS packages fix security vulnerability No score - mediawiki, fedoraproject fedora +1 more X-Forwarded-For header allows brute-forcing autoblocked IP addresses 9.8 Critical
- mediawiki An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3.... 5.3 Medium
- mediawiki An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with... 6.5 Medium
- mediawiki An issue was discovered in the GrowthExperiments extension for MediaWiki through 1.39.3. The... 4.3 Medium
- artifex ghostscript, debian linux +1 more In Artifex Ghostscript through 10.01.0, there is a buffer overflow leading to potential... 9.8 Critical
- vtex apps-graphql The VTEX [email protected] GraphQL API module does not properly restrict unauthorized access to... 7.5 High
- lemonldap-ng lemonldap\ An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the... 9.8 Critical
- ruby-lang ruby, time, debian linux +1 more +3 more Ruby Time component ReDoS issue 5.3 Medium
- ruby-lang uri, debian linux, fedoraproject fedora +2 more Ruby URI component ReDoS issue 5.3 Medium
- linux kernel, netapp h300s firmware, h410c firmware +3 more +5 more hci_conn_cleanup in net/bluetooth/hci_conn.c in the Linux kernel through 6.2.9 has a use-after... 7.8 High
- rbaskets request baskets request-baskets vulnerable to Server-Side Request Forgery 6.5 Medium
- openapi-generator openapi generator OpenAPI Generator vulnerable to Server-Side Request Forgery 9.1 Critical
- forem forem up to v2022.11.11 was discovered to contain a Server-Side Request Forgery (SSRF) via the... 7.2 High
- appwrite Appwrite Server-Side Request Forgery vulnerability 7.5 High
- dlink dir-882 firmware An information disclosure vulnerability exists in the Syslog functionality of D-LINK DIR-882 1.30... 7.5 High
- myprestamodules frequently asked questions page SQL injection vulnerability found in PrestaSHp faqs v.3.1.6 allows a remote attacker to escalate... 9.8 Critical
- gladinet centrestack An unrestricted file upload vulnerability in the administrative portal branding component of... 7.2 High
- gladinet centrestack An authentication bypass vulnerability in the Password Reset component of Gladinet CentreStack... 9.8 Critical
- Show olderLoading…