CVEs published in March 2023
2,723 vulnerabilities, 268 critical, 14 exploited.
veganpmVega vulnerable to arbitrary code execution when clicking href linksNo score- keycloak, redhat openshift container platform, openshift container platform for ibm linuxone +2 more +4 moreKeycloak vulnerable to user impersonation via stolen UUID code5.0 Medium
- keycloak, redhat keycloak node.js adapter, single sign-on +2 morekeycloak-connect contains Open redirect vulnerability in the Node.js adapter6.1 Medium
- gosaml2 project gosaml2gosaml2 vulnerable to Denial of Service via deflate decompression bomb5.3 Medium
- vega, vega-functions project vega-functions +1 moreVega `scale` expression function cross site scripting6.5 Medium
- vega, vega-functions project vega-functions +1 moreVega has cross-site scripting vulnerability in `lassoAppend` function6.5 Medium
- rittal cmc iii, cmc iii firmware +1 moreRittal CMC III Improper Access Control4.6 Medium
- github enterprise serverCode injection in GitHub Enterprise Server leading to arbitrary environment variables in GitHub Actions4.1 Medium
- ibm spectrum symphonyIBM Spectrum Symphony HOST header injection5.4 Medium
- ibm maximo application suite, maximo asset management +1 moreIBM Maximo Asset Management cross-site scripting6.4 Medium
- saleorSaleor is vulnerable to unauthenticated information disclosure via Python exceptions3.7 Low
- xwiki commons, xwiki-commons +1 moreXWiki Commons may allow privilege escalation to programming rights via user's first name10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform allows macro execution as any user without programming rights through the context macro5.4 Medium
- xwiki, xwiki xwiki-platform +1 moreIn XWiki Platform, saving a document with a large object number leads to persistent OOM errors5.7 Medium
- wpmet metform elementor contact form builder, roxnor metform – contact form, survey, quiz, & custom form builder for elementor +1 moreMetform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting7.2 High
- saleorSaleor is vulnerable to staff-authenticated error message information disclosure vulnerability via Python exceptions6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform users may execute anything with superadmin right through comments and async macro10.0 Critical
- lionfish cms project cms狮子鱼CMS ApiController.class.php goods_detail sql injection6.3 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform allows unprivileged users to make arbitrary select queries using DatabaseListProperty and suggest.vm6.5 Medium
- elf-parser project elf-parserfinixbit elf-parser elf_parser.cpp get_segments denial of service2.8 Low
- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author10.0 Critical
- code-projects health center patient record management system, health center patient record management system project center patient record management system +1 moreSourceCodester Health Center Patient Record Management System fecalysis_form.php cross site scripting3.5 Low
- xwiki, xwiki xwiki-platform +1 moreTwo XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor7.5 High
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-store-filesystem-oldcore has Exposed Dangerous Method or Function6.6 Medium
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-rendering-parser vulnerable to Improper Handling of Exceptional Conditions6.5 Medium
- xwiki, xwiki xwiki-platform +1 moreXWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data8.9 High
- nicdark cost calculatorCost Calculator <= 1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting6.4 Medium
- wpmet metform elementor contact form builder, roxnor metform – contact form, survey, quiz, & custom form builder for elementor +1 moreMetform Elementor Contact Form Builder <= 3.2.1 - reCaptcha Protection Bypass5.3 Medium
- dell powerscale onefsDell PowerScale OneFS 9.4.0.x contains exposure of sensitive information to an unauthorized actor...6.7 Medium
python-pipUbuntupython-pip regressionNo score- xwiki, xwiki xwiki-platform +1 moreXWiki Platform vulnerable to Remote Code Execution in Annotations10.0 Critical
libredwgOSS-FuzzHeap-buffer-overflow in json_cquoteNo scorehdf5OSS-FuzzHeap-buffer-overflow in H5L__extern_traverseNo score- bytecodealliance wasmtime, cranelift-codegen +1 moreGuest-controlled out-of-bounds read/write on x86_64 in wasmtime10.0 Critical
- glox useroam hotspotSQLi in Glox Technology's Useroam Hotspot9.8 Critical
- yordam library automation systemXSS in Yordam Library Automation System5.4 Medium
- yordam library automation systemIDOR in Yordam Library Automation System6.5 Medium
- yordam library automation systemIDOR in Yordam Library Automation System6.5 Medium
- electronic medical records system project medical records system, sourcecodester electronic medical records system +1 moreSourceCodester Electronic Medical Records System Cookie administrator.php sql injection6.3 Medium
- gradleGradle usage of long IDs for PGP keys opens potential for collision attacks6.6 Medium
- amazon opensearch, opensearch security, embysupport security +2 moreTime discrepancy in authentication responses in OpenSearch5.3 Medium
- redisInteger Overflow in several Redis commands can lead to denial of service.5.5 Medium
- abb symphony plus s+ operations, symphony plus s\+ operations +1 moreImproper authentication vulnerability in S+ Operations8.8 High
- nvidia cuda toolkitNVIDIA CUDA Toolkit SDK contains a bug in cuobjdump, where a local user running the tool against...3.3 Low
- nvidia cuda toolkitNVIDIA CUDA Toolkit SDK contains a vulnerability in cuobjdump, where a local user running the...4.4 Medium
- sauter-controls bacnetstac, sauter controls modunet300 (ey-am300f001, ey-am300f002), nova 106 (eyk300f001) bacnet communication card +7 more +9 moreSAUTER Controls Nova 200–220 Series Cleartext Transmission of Sensitive Information7.5 High
- yf-exam project yf-examCleverStupidDog yf-exam v 1.8.0 is vulnerable to SQL Injection.9.8 Critical
- btcpayserver btcpayserver/btcpayserver, btcpay server +1 moreImproper Neutralization of Equivalent Special Elements in btcpayserver/btcpayserver5.7 Medium
- Show moreLoading…