Skip to content
OpenAdvisories

Archive

1 March 2023

Vulnerabilities first published on this day (UTC), newest first.

← February 2023 2023 / March /1 April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

53 results · Clear filters · Feed

  • Medium 4.3
    CVE-2020-5026

    IBM Financial Transaction Manager for Digital Payments for Multi-Platform 3.2.0 through 3.2.7 could allow a remote atta…

    IBM Financial Transaction Manager
  • Medium 4.3
    CVE-2020-5002

    IBM Financial Transaction Manager security bypass

    IBM Financial Transaction Manager 3.2.0 through 3.2.10 could allow an authenticated user to perform unauthorized actions due to improper validation. IBM X-Force ID: 192954.

    IBM Financial Transaction Manager
  • Medium 4.3
    CVE-2020-5001

    IBM Financial Transaction Manager path traversal

    IBM Financial Transaction Manager 3.2.0 through 3.2.7 could allow a remote attacker to traverse directories on the system. An attacker could send a specially-crafted URL request containing "dot dot" sequences (/../) to view arbitrary files on the system. IBM …

    IBM Financial Transaction Manager
  • Medium 6.5
    CVE-2022-43902

    IBM MQ denial of service

    IBM MQ 9.2 CD, 9.2 LTS, 9.3 CD, and 9.3 LTS is vulnerable to a denial of service attack caused by specially crafted PCF or MQSC messages. IBM X-Force ID: 240832.

    IBM MQ
  • Medium 6.3
    CVE-2023-22738

    Improper Preservation of Permissions in vantage6

    vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. Assigning existing users to a different organizations is currently possible. It may lead to unintended access: if a user from organization A is accidentally assign…

    vantage6 vantage6 vantage6 PyPI
  • Medium 6.3
    CVE-2023-1130

    SourceCodester Computer Parts Sales and Inventory System processlogin sql injection

    A vulnerability, which was classified as critical, was found in SourceCodester Computer Parts Sales and Inventory System 1.0. This affects an unknown part of the file processlogin. The manipulation of the argument user leads to sql injection. It is possible t…

    SourceCodester Computer Parts Sales and Inventory System
  • Medium 6.4
    CVE-2023-25931

    Medtronic Micro Clinician & InterStim X Clinician App Password Reset Issue

    Medtronic identified that the Pelvic Health clinician apps, which are installed on the Smart Programmer mobile device, have a password vulnerability that requires a security update to fix. Not updating could potentially result in unauthorized control of the c…

    Medtronic InsterStim Applications
  • Medium 5.1
    CVE-2023-0460

    Remote code execution in YouTube Android Player API SDK

    The YouTube Embedded 1.2 SDK binds to a service within the YouTube Main App. After binding, a remote context is created with the flags Context.CONTEXT_INCLUDE_CODE | Context.CONTEXT_IGNORE_SECURITY. This allows the client app to remotely load code from YouTub…

    Google YouTube Android Player API SDK Android
  • Medium 5.3
    CVE-2022-39228

    Observable Response Discrepancy in vantage6

    vantage6 is a privacy preserving federated learning infrastructure for secure insight exchange. vantage6 does not inform the user of wrong username/password combination if the username actually exists. This is an attempt to prevent bots from obtaining usernam…

    vantage6 vantage6 vantage6 PyPI
  • Medium 5.5
    CVE-2022-36021 EPSS 60%

    Redis string pattern matching can be abused to achieve Denial of Service

    Redis is an in-memory database that persists on disk. Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. T…

    Redis Redis redis redis Debian Ubuntu Azure Linux
  • Medium 4.3
    CVE-2022-47148

    WordPress WooCommerce PDF Invoices & Packing Slips Plugin <= 3.2.5 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in WP Overnight PDF Invoices & Packing Slips for WooCommerce plugin <= 3.2.5 leading to popup dismiss.

    WP Overnight PDF Invoices & Packing Slips for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2022-46806

    WordPress Cart All In One For WooCommerce Plugin <= 1.1.10 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme Cart All In One For WooCommerce plugin <= 1.1.10 leading to cart modification.

    villatheme Cart All In One For WooCommerce Web / CMS
  • Medium 5.4
    CVE-2022-46805

    WordPress Conditional Payments for WooCommerce Plugin <= 2.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Lauri Karisola / WP Trio Conditional Shipping for WooCommerce plugin <= 2.3.1 leading to activation/deactivation of plugin rulesets.

    Lauri Karisola / WP Trio Conditional Shipping for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2022-46798

    WordPress WooLentor Plugin <= 2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in HasThemes ShopLentor plugin <= 2.5.1 leading to plugin settings change.

    HasThemes ShopLentor
  • Medium 5.4
    CVE-2022-46797

    WordPress Conversios.io Plugin <= 5.2.3 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce plugin <= 5.2.3 leads to plugin settings change.

    Conversios All-in-one Google Analytics, Pixels and Product Feed Manager for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2022-45068

    WordPress Mercado Pago payments for WooCommerce Plugin <= 6.3.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Mercado Pago Mercado Pago payments for WooCommerce plugin <= 6.3.1.

    Mercado Pago Mercado Pago payments for WooCommerce Web / CMS
  • Medium 5.4
    CVE-2022-45804

    WordPress Robo Gallery Plugin <= 3.2.9 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in RoboSoft Photo Gallery, Images, Slider in Rbs Image Gallery plugin <= 3.2.9 leading to galleries hierarchy change, included plugin deactivate & activate.

    Robosoft Photo Gallery, Images, Slider in Rbs Image Gallery
  • Medium 4.3
    CVE-2022-40198

    WordPress TeraWallet – For WooCommerce Plugin <= 1.3.24 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in StandaloneTech TeraWallet – For WooCommerce plugin <= 1.3.24 leading to plugin settings change.

    StandaloneTech TeraWallet – For WooCommerce Web / CMS
  • Medium 4.3
    CVE-2022-38468

    WordPress NextGEN Gallery Plugin <= 3.28 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Imagely WordPress Gallery Plugin – NextGEN Gallery plugin <= 3.28 leading to thumbnail alteration.

    Imagely WordPress Gallery Plugin – NextGEN Gallery Web / CMS
  • Medium 4.3
    CVE-2023-23973

    WordPress Contact Us page - Contact people LITE Plugin <= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in a3rev Software Contact Us Page – Contact People plugin <= 3.7.0.

    a3rev Software Contact Us Page – Contact People
  • Medium 5.4
    CVE-2023-23974

    WordPress Quick Event Manager Plugin <= 9.7.4 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Fullworks Quick Event Manager plugin <= 9.7.4 affecting all registration actions (delete, delete all, edit, update).

    fullworks Quick Event Manager
  • Medium 5.4
    CVE-2023-23984

    WordPress Bubble Menu – circle floating menu Plugin <= 3.0.1 is vulnerable to Cross Site Request Forgery (CSRF)

    Cross-Site Request Forgery (CSRF) vulnerability in Wow-Company Bubble Menu – circle floating menu plugin <= 3.0.1 leading to form deletion.

    Wow-Company Bubble Menu – circle floating menu
  • Medium 5.5
    CVE-2021-4327

    SerenityOS TypedArray.cpp initialize_typed_array_from_array_buffer integer overflow

    A vulnerability was found in SerenityOS. It has been rated as critical. Affected by this issue is the function initialize_typed_array_from_array_buffer in the library Userland/Libraries/LibJS/Runtime/TypedArray.cpp. The manipulation leads to integer overflow.…

  • Medium 4.7
    CVE-2023-1112 Public exploit

    Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal

    A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative…

  • Medium 4.8
    CVE-2023-1117

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 5.4
    CVE-2023-1116

    Cross-site Scripting (XSS) - Stored in pimcore/pimcore

    Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.5.18.

    pimcore pimcore/pimcore pimcore/pimcore Packagist
  • Medium 6.5
    CVE-2023-24117

    Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepauth_5g parame…

  • Medium 5.5
    CVE-2023-24758

    libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse functi…

    libde265 libde265 Debian Ubuntu
  • Medium 6.5
    CVE-2023-24125

    Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey2_5g parame…

  • Medium 5.5
    CVE-2023-24754

    libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_weighted_pred_avg_8_sse functi…

    libde265 libde265 Debian Ubuntu
  • Medium 6.5
    CVE-2023-24126

    Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepkey4_5g parame…

  • Medium 6.5
    CVE-2023-24120

    Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wrlEn_5g paramete…

  • Medium 6.5
    CVE-2023-24123

    Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the wepauth parameter…

  • Medium 5.5
    CVE-2023-24757

    libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the put_unweighted_pred_16_fallback function a…

    libde265 libde265 Debian Ubuntu
  • Medium 6.5
    CVE-2023-24121

    Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the security_5g param…

  • Medium 6.5
    CVE-2023-24118

    Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the security paramete…

  • Medium 6.5
    CVE-2023-24119

    Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid parameter at…

  • Medium 6.5
    CVE-2023-24045

    In Dataiku DSS 11.2.1, an attacker can download other Dataiku files that were uploaded to the myfiles section by specif…

  • Medium 5.5
    CVE-2023-24756

    libde265 v1.0.10 was discovered to contain a NULL pointer dereference in the ff_hevc_put_unweighted_pred_8_sse function…

    libde265 libde265 Debian Ubuntu
  • Medium 6.5
    CVE-2023-24122

    Jensen of Scandinavia Eagle 1200AC V15.03.06.33_en was discovered to contain a stack overflow via the ssid_5g parameter…