2 March 2023

10 results · Clear filters · Feed

• High 7.2
  CVE-2023-0084 Public exploit EPSS 29%

  Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting

  The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for…

  roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Web / CMS
  Mar 2, 2023
• High 7.5
  CVE-2023-26476

  Two XWiki Platform UIs Expose Sensitive Information to an Unauthorized Actor

  XWiki Platform is a generic wiki platform. Starting in version 3.2-m3, users can deduce the content of the password fields by repeated call to `LiveTableResults` and `WikisLiveTableResultsMacros`. The issue can be fixed by upgrading to versions 14.7-rc-1, 13.…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-livetable-ui org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Maven
  Mar 2, 2023
• High 8.9
  CVE-2023-26480

  XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data

  XWiki Platform is a generic wiki platform. Starting in version 12.10, a user without script rights can introduce a stored cross-site scripting by using the Live Data macro. This has been patched in XWiki 14.9, 14.4.7, and 13.10.10. There are no known workarou…

  xwiki xwiki-platform org.xwiki.platform:xwiki-platform-livedata-macro Maven
  Mar 2, 2023
• High 8.8
  CVE-2023-0228

  Improper authentication vulnerability in S+ Operations

  Improper Authentication vulnerability in ABB Symphony Plus S+ Operations.This issue affects Symphony Plus S+ Operations: from 2.X through 2.1 SP2, 2.2, from 3.X through 3.3 SP1, 3.3 SP2.

  ABB Symphony Plus S+ Operations ICS / OT
  Mar 2, 2023
• High 7.5
  CVE-2023-0053

  SAUTER Controls Nova 200–220 Series Cleartext Transmission of Sensitive Information

  SAUTER Controls Nova 200–220 Series with firmware version 3.3-006 and prior and BACnetstac version 4.2.1 and prior have only FTP and Telnet available for device management. Any sensitive information communicated through these protocols, such as credentials, i…

  SAUTER Controls Nova 230 (EYK230F001) DDC with BACnet connection moduNet300 (EY-AM300F001, EY-AM300F002) Nova 220 (EYK220F001) DDC with BACnet connection
  Mar 2, 2023
• High 8.8
  CVE-2023-1101

  SonicOS SSLVPN improper restriction of excessive MFA attempts vulnerability allows an authenticated attacker to use exc…

  SonicWall SonicOS Network devices
  Mar 2, 2023
• High 7.8
  CVE-2023-1118

  A flaw use after free in the Linux kernel integrated infrared receiver/transceiver driver was found in the way user det…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu Azure Linux
  Mar 2, 2023
• High 8.8
  CVE-2023-25358

  A use-after-free vulnerability in WebCore::RenderLayer::addChild in WebKitGTK before 2.36.8 allows attackers to execute…

  qtwebkit-source qtwebkit-opensource-src webkit2gtk webkitgtk Debian Ubuntu
  Mar 2, 2023
• High 8.8
  CVE-2023-25360

  A use-after-free vulnerability in WebCore::RenderLayer::renderer in WebKitGTK before 2.36.8 allows attackers to execute…

  webkit2gtk webkitgtk wpewebkit Debian Ubuntu
  Mar 2, 2023
• High 8.8
  CVE-2023-25361

  A use-after-free vulnerability in WebCore::RenderLayer::setNextSibling in WebKitGTK before 2.36.8 allows attackers to e…

  webkit2gtk webkitgtk wpewebkit Debian Ubuntu
  Mar 2, 2023