Skip to content
OpenAdvisories

Archive

March 2023

Vulnerabilities first published in this month (UTC), newest first.

← February 2023 2023 / March April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

15 results · Clear filters · Feed

  • Critical 9.1
    CVE-2023-26482 Public exploit

    Scope of workflow operations is not validated in nextcloud server

    Nextcloud server is an open source home cloud implementation. In affected versions a missing scope validation allowed users to create workflows which are designed to be only available for administrators. Some workflows are designed to be RCE by invoking defin…

    Nextcloud security-advisories
  • Critical 9.8
    CVE-2023-28503 Public exploit EPSS 61%

    Authentication bypass in UniRPC's udadmin service

    Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to byp…

    Rocket Software UniVerse UniData
  • Critical 9.8
    CVE-2023-28502 Public exploit EPSS 60%

    Stack buffer overflow in UniRPC's udadmin_server service

    Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the "udadmin" service that can lead to remote code execution as the root user.

    Rocket Software UniVerse UniData
  • Critical 9.8
    CVE-2022-45460 Public exploit

    Multiple Xiongmai NVR devices, including MBD6304T V4.02.R11.00000117.10001.131900.00000 and NBD6808T-PL V4.02.R11.C7431…

  • Critical 9.8
    CVE-2023-1133 Public exploit EPSS 50%

    CVE-2023-1133

    Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. The service accepts the unverified UDP packets and deserializes the content, which could allow…

    Delta Electronics InfraSuite Device Master ICS / OT
  • Critical 9.3
    CVE-2023-1177 Public exploit Scanner template EPSS 70%

    Path Traversal: '\..\filename' in mlflow/mlflow

    Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1.

    MLflow mlflow/mlflow mlflow PyPI
  • Critical 9.8
    CVE-2023-27100 Public exploit

    Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v2…

  • Critical 9.8
    CVE-2023-27855 Public exploit EPSS 13%

    Rockwell Automation ThinManager ThinServer Path Traversal Upload

    In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk dri…

    Rockwell Automation ThinManager® ThinServer™ ICS / OT
  • Critical 9.8
    CVE-2023-23397 Exploited Public exploit EPSS 97%

    Microsoft Outlook Elevation of Privilege Vulnerability

    Microsoft Outlook Elevation of Privilege Vulnerability

    Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office 2019
    KEV Mar 14, 2023
  • Critical 9.8
    CVE-2023-0090 Public exploit

    Proofpoint Enterprise Protection webservices unauthenticated RCE

    The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-stan…

    Proofpoint Enterprise Protection
  • Critical 9.8
    CVE-2023-25690 Public exploit EPSS 84%

    Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

    Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  • Critical 9.8
    CVE-2023-24775 Public exploit EPSS 20%

    SQL Injection in Funadmin

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.

    funadmin/funadmin Packagist
  • Critical 9.8
    CVE-2021-36394 Public exploit

    Moodle Session Fixation vulnerability

    In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2021-36393 Public exploit EPSS 52%

    Moodle SQL Injection vulnerability

    In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Critical 9.1
    CVE-2023-27290 Public exploit

    IBM Observability with Instana missing authentication

    Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write acces…

    IBM Observability with Instana