Skip to content
OpenAdvisories

Archive

March 2023

Vulnerabilities first published in this month (UTC), newest first.

← February 2023 2023 / March April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

93 results · Clear filters · Feed

  • Critical 9.8
    CVE-2023-27100 Public exploit

    Improper restriction of excessive authentication attempts in the SSHGuard component of Netgate pfSense Plus software v2…

  • Medium 6.1
    CVE-2022-45004 Public exploit

    Gophish vulnerable to Cross-site Scripting via crafted landing page

    Gophish through 0.12.1 was discovered to contain a cross-site scripting (XSS) vulnerability via a crafted landing page.

    github.com/gophish/gophish Go
  • High 7.5
    CVE-2022-45003 Public exploit

    Gophish vulnerable to Denial of Service via crafted payload involving autofocus

    Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.

    github.com/gophish/gophish Go
  • High 7.5
    CVE-2023-27856 Public exploit EPSS 77%

    Rockwell Automation ThinManager ThinServer Path Traversal Download

    In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.e…

    Rockwell Automation ThinManager® ThinServer™ ICS / OT
  • Critical 9.8
    CVE-2023-27855 Public exploit EPSS 13%

    Rockwell Automation ThinManager ThinServer Path Traversal Upload

    In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker could potentially exploit this vulnerability to upload arbitrary files to any directory on the disk dri…

    Rockwell Automation ThinManager® ThinServer™ ICS / OT
  • High 7.5
    CVE-2023-1545 Public exploit

    SQL Injection in nilsteampassnet/teampass

    SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.

    nilsteampassnet nilsteampassnet/teampass nilsteampassnet/teampass Packagist
  • High 7.5
    CVE-2023-24709 Public exploit EPSS 44%

    An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and …

  • High 8.8
    CVE-2023-27842 Public exploit

    Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execu…

    extplorer Ubuntu
  • Unscored —
    CVE-2023-0630 Public exploit Scanner template

    Slimstat Analytics < 4.9.3.3 - Subscriber+ SQL Injection

    The Slimstat Analytics WordPress plugin before 4.9.3.3 does not prevent subscribers from rendering shortcodes that concatenates attributes directly into an SQL query.

    Web / CMS
  • Medium 6.3
    CVE-2023-1498 Public exploit

    code-projects Responsive Hotel Site Newsletter Log messages.php sql injection

    A vulnerability classified as critical has been found in code-projects Responsive Hotel Site 1.0. Affected is an unknown function of the file messages.php of the component Newsletter Log Handler. The manipulation of the argument title leads to sql injection. …

    code-projects Responsive Hotel Site
  • Medium 6.1
    CVE-2023-24278 Public exploit Scanner template

    Squidex before 7.4.0 was discovered to contain a squid.svg cross-site scripting (XSS) vulnerability.

  • Medium 6.3
    CVE-2023-1454 Public exploit Scanner template EPSS 36%

    jeecg-boot qurestSql sql injection

    A vulnerability classified as critical has been found in jeecg-boot 3.5.0. This affects an unknown part of the file jmreport/qurestSql. The manipulation of the argument apiSelectId leads to sql injection. It is possible to initiate the attack remotely. The ex…

    org.jeecgframework.boot:jeecg-boot-common Maven
  • Unscored —
    CVE-2023-27253 Public exploit EPSS 90%

    A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated atta…

  • High 8.8
    CVE-2023-1389 Exploited Public exploit Scanner template EPSS 100%

    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability …

    KEV May 1, 2023
  • High 8.2
    CVE-2023-24892 Public exploit

    Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability

    Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability

    Microsoft Microsoft Edge (Chromium-based) Browsers
  • High 8.8
    CVE-2023-24871 Public exploit

    Windows Bluetooth Service Remote Code Execution Vulnerability

    Windows Bluetooth Service Remote Code Execution Vulnerability

    Microsoft Windows Server 2022 Windows 10 Version 21H2 Windows 10 Version 22H2 Windows
  • Medium 4.5
    CVE-2023-23408 Public exploit

    Azure Apache Ambari Spoofing Vulnerability

    Azure Apache Ambari Spoofing Vulnerability

    Microsoft Azure HDInsight
  • High 7.8
    CVE-2023-23399 Public exploit

    Microsoft Excel Remote Code Execution Vulnerability

    Microsoft Excel Remote Code Execution Vulnerability

    Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office LTSC for Mac 2021
  • Critical 9.8
    CVE-2023-23397 Exploited Public exploit EPSS 97%

    Microsoft Outlook Elevation of Privilege Vulnerability

    Microsoft Outlook Elevation of Privilege Vulnerability

    Microsoft Microsoft 365 Apps for Enterprise Microsoft Office LTSC 2021 Microsoft Office 2019
    KEV Mar 14, 2023
  • Medium 6.5
    CVE-2023-23396 Public exploit

    Microsoft Excel Denial of Service Vulnerability

    Microsoft Excel Denial of Service Vulnerability

    Microsoft Microsoft Office Online Server Microsoft Office Web Apps Server 2013 Service Pack 1
  • High 8.8
    CVE-2023-23388 Public exploit

    Windows Bluetooth Driver Elevation of Privilege Vulnerability

    Windows Bluetooth Driver Elevation of Privilege Vulnerability

    Microsoft Windows Server 2019 Windows Server 2019 (Server Core installation) Windows 10 Version 1809 Windows
  • Unscored —
    CVE-2023-28343 Public exploit Scanner template EPSS 85%

    OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/manageme…

  • High 7.2
    CVE-2023-26262 Public exploit

    An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload …

  • High 7.8
    CVE-2023-27010 Public exploit

    Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability al…

  • High 7.4
    CVE-2023-27587 Public exploit Scanner template

    ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing…

    rozbb readtomyshoe
  • High 7.5
    CVE-2023-27532 Exploited · Ransomware Public exploit EPSS 81%

    Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database…

    KEV Aug 22, 2023
  • Low 3.5
    CVE-2023-26209 Public exploit

    A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiDeceptor 3.1.x and…

    Fortinet FortiDeceptor Network devices
  • Low 3.5
    CVE-2023-26208 Public exploit

    A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiAuthenticator 6.4.…

    Fortinet FortiAuthenticator Network devices
  • Low 3.5
    CVE-2022-29056 Public exploit

    A improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiMail version 6.4.0…

    Fortinet FortiMail Network devices
  • Medium 5.0
    CVE-2023-23638 Public exploit

    Apache Dubbo Deserialization Vulnerability Gadgets Bypass

    A deserialization vulnerability existed when dubbo generic invoke, which could lead to malicious code execution. This issue affects Apache Dubbo 2.7.x version 2.7.21 and prior versions; Apache Dubbo 3.0.x version 3.0.13 and prior versions; Apache Dubbo 3.1.x …

    Apache Software Foundation Apache Dubbo org.apache.dubbo:dubbo Maven
  • Critical 9.8
    CVE-2023-0090 Public exploit

    Proofpoint Enterprise Protection webservices unauthenticated RCE

    The webservices in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows for an anonymous user to execute remote code through 'eval injection'. Exploitation requires network access to the webservices API, but such access is a non-stan…

    Proofpoint Enterprise Protection
  • High 8.8
    CVE-2023-0089 Public exploit

    Proofpoint Enterprise Protection webutils authenticated RCE

    The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'. This affects all versions 8.20.0 and below.

    Proofpoint Enterprise Protection
  • Medium 6.1
    CVE-2023-24657 Public exploit Scanner template

    phpipam v1.6 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the closeClass paramete…

  • Medium 6.8
    CVE-2022-41333 Public exploit

    An uncontrolled resource consumption vulnerability [CWE-400] in FortiRecorder version 6.4.3 and below, 6.0.11 and below…

    Fortinet FortiRecorder Network devices
  • Critical 9.8
    CVE-2023-25690 Public exploit EPSS 84%

    Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

    Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. Configurations are affected when mod_proxy is enabled along with some form of RewriteRule or ProxyPassMatch in which a non-specific patter…

    Apache Software Foundation Apache HTTP Server apache2 apache2 Debian Ubuntu Azure Linux Alpine
  • Critical 9.8
    CVE-2023-24775 Public exploit EPSS 20%

    SQL Injection in Funadmin

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.

    funadmin/funadmin Packagist
  • Low 3.3
    CVE-2023-1189 Public exploit

    WiseCleaner Wise Folder Hider IoControlCode WiseFs64.sys 0x222410 denial of service

    A vulnerability was found in WiseCleaner Wise Folder Hider 4.4.3.202. It has been declared as problematic. Affected by this vulnerability is the function 0x222400/0x222404/0x222410 in the library WiseFs64.sys of the component IoControlCode Handler. The manipu…

    Wisecleaner Wise Folder Hider
  • High 7.2
    CVE-2023-1211 Public exploit

    SQL Injection in phpipam/phpipam

    SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.

    phpipam phpipam/phpipam
  • High 8.8
    CVE-2023-24217 Public exploit

    AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.

  • Unscored —
    CVE-2022-46395 Public exploit

    An issue was discovered in the Arm Mali GPU Kernel Driver. A non-privileged user can make improper GPU processing opera…