CVEs published in March 2023
2,723 vulnerabilities, 268 critical, 14 exploited.
- cocos cocos-engineCommand Injection in Cocos Engine workflow8.1 High
- discordrb project discordrbCommand injection in discordrb8.4 High
- onesignal react-native-onesignalOneSignal repository github action command injection7.3 High
- automatic question paper generator system project question paper generator system, sourcecodester automatic question paper generator system +1 moreSourceCodester Automatic Question Paper Generator System GET Parameter view_class.php sql injection6.3 Medium
- apimanPermissions bypass in Apiman could enable authenticated attacker to unpermitted API Key6.4 Medium
- brantburnett snappierStack references to locations outside buffers may become invalid if they exist during a GC compaction in Snappier7.0 High
- gocdStored XSS possible on VSM and Job Details pages via malicious pipeline label configuration in gocd5.4 Medium
- gocdSensitive information disclosure possible on misconfigured failed backups of non-H2 databases in gocd4.2 Medium
- lambdaisland uri`authority-regex` returns the wrong authority in lambdaisland/uri5.4 Medium
- pymedusa medusaOS Command Injection via GIT_PATH in pymedusa8.3 High
- nextcloud server, kiteworks security-advisories +1 moreDelete permissions are not saved when creating public share in Nextcloud server3.5 Low
- nextcloud server, kiteworks security-advisories +1 moreMissing brute force protection on password reset token in Nextcloud Server5.3 Medium
- google tensorflowDenial of Service in TensorFlow6.5 Medium
- sauter ey-as525f001 with moduweb, sauter-controls ey-as525f001 firmware +1 moreCVE-2023-286506.1 Medium
- sauter ey-as525f001 with moduweb, sauter-controls ey-as525f001 firmware +1 moreCVE-2023-286555.4 Medium
- sauter ey-as525f001 with moduweb, sauter-controls ey-as525f001 firmware +1 moreCVE-2023-223006.1 Medium
- sauter ey-as525f001 with moduweb, sauter-controls ey-as525f001 firmware +1 moreCVE-2023-279276.5 Medium
- sauter ey-as525f001 with moduweb, sauter-controls ey-as525f001 firmware +1 moreCVE-2023-286526.5 Medium
- pluck-cms pluck, pluck pluck-cms +1 moreAuthenticate Remote Code Execution in Pluck CMS7.2 High
- jetbrains hubIn JetBrains Hub before 2022.3.15573, 2022.2.15572, 2022.1.15583 reflected XSS in dashboards was...4.6 Medium
- miniorange oauth single sign on enterprise, oauth single sign on free, oauth single sign on premium +2 more +4 moreOAuth Single Sign On - SSO (OAuth Client) - IdP Deletion via CSRF6.5 Medium
- menu shortcode project shortcode, unknown menu shortcode +1 moremenu shortcode <= 1.0 - Contributor+ Stored XSS via Shortcode5.4 Medium
- hasthemes wc sales notificationWC Sales Notification < 1.2.3 - Arbitrary Plugin Activation via CSRF4.3 Medium
- hasthemes ht portfolioHT Portfolio < 1.1.6 - Arbitrary Plugin Activation via CSRF4.3 Medium
- mitchell bennis simple file listSimple File List < 6.0.10 - Admin+ Stored XSS4.8 Medium
- basix nex-formsNEX-Forms < 8.3.3 - Contributor+ Stored XSS5.4 Medium
- humanityco cookie notice & compliance for gdpr / ccpa, hu-manity cookie notice \& compliance for gdpr \/ ccpa +1 moreCookie Notice & Compliance for GDPR / CCPA < 2.4.7 - Contributor+ Stored XSS5.4 Medium
- unknown wp image carousel, wp image carousel project image carousel +1 moreWP Image Carousel <= 1.0.2 - Contributor+ Stored XSS5.4 Medium
- ooohboi steroids for elementor project steroids for elementor, unknown ooohboi steroids for elementor +1 moreOoohBoi Steroids for Elementor < 2.1.5 - Subscriber+ Attachment Deletion6.5 Medium
- hastech ht eventHT Event < 1.4.6 - Arbitrary Plugin Activation via CSRF4.3 Medium
- hasthemes preview link generatorPreview Link Generator < 1.0.4 - Arbitrary Plugin Activation via CSRF4.3 Medium
- really-simple-plugins complianz, unknown complianz premium +1 moreComplianz - GDPR/CCPA Cookie Consent < 6.4.2 - Contributor+ Stored XSS5.4 Medium
- hasthemes wp insuranceWP Insurance < 2.1.4 - Arbitrary Plugin Activation via CSRF6.5 Medium
- schedulicitySchedulicity - Easy Online Scheduling <= 2.21 - Contributor+ Stored XSS5.4 Medium
- hasthemes free woocommerce theme 99fy extensionFree WooCommerce Theme 99fy Extension < 1.2.8 - Arbitrary Plugin Activation via CSRF4.3 Medium
- hasthemes wp film studioWP Film Studio < 1.3.5 - Arbitrary Plugin Activation via CSRF6.5 Medium
- unknown wp statisticsWP Statistics < 14.0 - Authenticated SQLi8.8 High
- hasthemes wp newsWP News <= 1.1.9 - Arbitrary Plugin Activation via CSRF6.5 Medium
- unknown contact form 7 widget for elementor page builder & gutenberg blocks, hasthemes contact form 7 widget for elementor page builder \& gutenberg blocks +1 moreContact Form 7 Widget For Elementor Page Builder & Gutenberg Blocks < 1.1.6 - Arbitrary Plugin Activation via CSRF4.3 Medium
- e-plugins fitness-trainer, hotel listing, photographer-directory +17 more +19 moreMultiple e-plugins - Subscriber+ Privilege Escalation8.8 High
- unknown wp dark modeWP Dark Mode < 4.0.8 - Subscriber+ Local File Inclusion4.3 Medium
- unknown modern events calendar liteModern Events Calendar lite < 6.5.2 - Admin+ Stored XSS4.8 Medium
- hasthemes ht slider for elementorHT Slider For Elementor < 1.4.0 - Arbitrary Plugin Activation via CSRF4.3 Medium
- hasthemes ever compareEver Compare <= 1.2.3 - Arbitrary Plugin Activation via CSRF4.3 Medium
- miniorange oauth single sign onOAuth Single Sign On - SSO (OAuth Client) < 6.24.2 - IdP Discard via CSRF6.5 Medium
- hasthemes quickswishQuickSwish < 1.1.0 - Arbitrary Plugin Activation via CSRF4.3 Medium
- unknown wp shamsiWP Shamsi <= 4.3.3 - Subscriber+ Attachment Deletion6.5 Medium
- hasthemes coupon zenCoupon Zen < 1.0.6 - Arbitrary Plugin Activation via CSRF4.3 Medium
- nextendweb smart slider 3Smart Slider 3 < 3.5.1.14 - Contributor+ Stored XSS5.4 Medium
- hasthemes wp plugin managerWP Plugin Manager < 1.1.8 - Arbitrary Plugin Activation via CSRF4.3 Medium
- Show moreLoading…