CVEs published in March 2023
2,723 vulnerabilities, 268 critical, 14 exploited.
- oceanwp ocean extraWordPress Ocean Extra Plugin <= 2.1.2 is vulnerable to Cross Site Scripting (XSS)5.5 Medium
- getshortcodes shortcodes ultimate, unknown wordpress shortcodes plugin — shortcodes ultimate +1 moreWordPress Shortcodes Ultimate Plugin <= 5.12.6 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- labib ahmed image hover effects for wpbakery page builderWordPress Image Hover Effects For WPBakery Page Builder Plugin <= 4.0 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- gtmetrix, gtmetrix for wordpress +1 moreWordPress GTmetrix for WordPress Plugin <= 0.4.5 is vulnerable to Cross Site Scripting (XSS)3.8 Low
- catchsquare wp smart preloaderWordPress WP Smart Preloader Plugin <= 1.15 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- heateor fancy comments, team heateor fancy comments wordpress +1 moreWordPress Fancy Comments WordPress Plugin <= 1.2.10 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- rapid7 nexposeRapid7 Nexpose Forced Browsing4.3 Medium
- apache software foundation uima ducc, apache unstructured information management architecture +1 moreApache UIMA DUCC: DUCC (EOL) allows RCE8.8 High
- dizayn vira-investingInformation disclosure in Vira-Investing7.5 High
- dizayn vira-investingXSS in Vira-Investing6.1 Medium
grub2SUSESecurity update for grub2No score- hashicorp vault, vault enterprise +1 moreVault Vulnerable to SQL Injection When Configuring the Microsoft SQL Database Storage Backend6.5 Medium
- hashicorp vault, vault enterprise +1 moreVault PKI Issuer Endpoint Did Not Correctly Authorize Access to Issuer Metadata6.5 Medium
- hashicorp vault, vault enterprise +1 moreVault Vulnerable to Cache-Timing Attacks During Seal and Unseal Operations5.0 Medium
- 3cx3CX DesktopApp through 18.12.416 has embedded malicious code, as exploited in the wild in March...7.8 High
- payara serverPayara Server allows remote attackers to load malicious code on the server once a JNDI directory scan is performed9.8 Critical
- zcbs zbbs, zcbs, zcbs zpbs +2 moreZCBS Zijper Collectie Beheer Systeem (ZCBS), Zijper Publication Management System (ZPBS), and...6.1 Medium
- deepset haystack, deepset-ai deepset-ai/haystack +1 moreUse of Hard-coded, Security-relevant Constants in deepset-ai/haystack9.1 Critical
- linux kernelA flaw use after free in the Linux kernel Xircom 16-bit PCMCIA (PC-card) Ethernet driver was...7.8 High
- red-gate sql monitorRed Gate SQL Monitor 11.0.14 through 12.1.46 has Incorrect Access Control, exploitable remotely...8.8 High
- pdfzorroPDFZorro PDFZorro Online r20220428 using TCPDF 6.2.5, despite having workflows claiming to...7.5 High
- avanquest pdfescapeAvanquest Software RAD PDF (PDFEscape Online) 3.19.2.2 is vulnerable to Information Leak /...7.5 High
- rocket software unidata, universe +1 moreWeak encryption in UniRPC protocol7.5 High
- rocket software unidata, universe +1 moreHeap corruption in UniRPC service8.8 High
- rocket software unidata, universe +1 moreMemory exhaustion in LZ4 decompression in UniRPC daemon9.8 Critical
- rocket software unidata, universe +1 moreStack buffer overflow in UniRPC service8.8 High
- rocket software unidata, universe +1 moreBuffer overflow in UniRPC library function8.8 High
- rocket software unidata, universe +1 moreStack buffer overflow in UniRPC library function9.8 Critical
- rocket software unidata, universe +1 moreAuthentication bypass in UniRPC's udadmin service9.8 Critical
- rocket software unidata, universe +1 moreStack buffer overflow in UniRPC's udadmin_server service9.8 Critical
- forgerock ldap connector, forgerock inc. openidm and java remote connector server (rcs) +1 moreWhen the LDAP connector is started with StartTLS configured, LDAP BIND credentials are transmitted insecurely, prior to establishing the TLS connection.7.5 High
- rocket software unidata, universe +1 moreHeap buffer overflow in unirpcd9.8 Critical
- collne inc. welcart e-commerce, welcart e-commerce +1 moreWordPress Welcart e-Commerce Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS)7.1 High
- joomunited wp table managerWordPress WP Table Manager Plugin <= 3.5.2 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- unknown gallery – image and video gallery with thumbnails, wpdevart image and video gallery with thumbnails +1 moreWordPress Responsive Image Gallery, Gallery Album Plugin <= 2.0.1 is vulnerable to Cross Site Scripting (XSS)7.1 High
- usersnapWordPress Usersnap Plugin <= 4.16 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- mr digital simple image popupWordPress Simple Image Popup Plugin <= 1.3.6 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- quantumcloud ai chatbot, wpbot +1 moreWordPress AI ChatBot Plugin <= 4.3.0 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- thimpress wp pipesWordPress WP Pipes Plugin <= 1.33 is vulnerable to SQL Injection (SQLi)8.2 High
- kiwitcms kiwi, kiwi tcms +1 moreStored cross site scripting via SVG file upload in Kiwi TCMS7.6 High
- linuxfoundation runcrootless: `/sys/fs/cgroup` is writable when cgroupns isn't unshared in runc5.0 Medium
drupal/xray_auditPackagistThis module is a tool for developers, analysts, and administrators that allows them to generate reports on a given Drupal installation. The module does not sufficiently sanitize some data presented in…No score- f5 nginx agent, nginx instance manager +1 moreNGINX Agent vulnerability CVE-2023-15505.5 Medium
- forcepoint cloud security gateway (csg), cloud security gateway, web security +2 moreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...6.1 Medium
- forcepoint cloud security gateway (csg), cloud security gateway, web security +2 moreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...6.1 Medium
- forcepoint cloud security gateway (csg), cloud security gateway, web security +2 moreImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')...6.1 Medium
- jeffrey-wp media library categoriesWordPress Media Library Categories Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- microsoft zstd, facebook zstandard +1 morezstd vulnerable to buffer overrun7.5 High
- megamain mega main menuMega Main Menu <= 2.2.2 - Authenticated (Administrator+) Cross-Site Scripting5.5 Medium
- statamic cms, xunruicms +1 moreXunrui CMS main.html information disclosure4.3 Medium
- Show moreLoading…