Skip to content
OpenAdvisories

Archive

March 2023

Vulnerabilities first published in this month (UTC), newest first.

← February 2023 2023 / March April 2023 →
  1. 184
  2. 258
  3. 356
  4. 48
  5. 526
  6. 6101
  7. 7170
  8. 856
  9. 959
  10. 1069
  11. 118
  12. 1211
  13. 1383
  14. 14163
  15. 1578
  16. 16109
  17. 1757
  18. 1823
  19. 1914
  20. 2062
  21. 2180
  22. 2285
  23. 23141
  24. 24202
  25. 2513
  26. 2615
  27. 27181
  28. 28149
  29. 29233
  30. 3065
  31. 3160
All Critical High Medium Low Exploited only Public exploit

93 results · Clear filters · Feed

  • Medium 5.4
    CVE-2022-44875 Public exploit

    KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows a…

  • Medium 5.4
    CVE-2022-42248 Public exploit

    QlikView 12.60.2 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the QvsViewClient funct…

  • Critical 9.8
    CVE-2021-36394 Public exploit

    Moodle Session Fixation vulnerability

    In Moodle, a remote code execution risk was identified in the Shibboleth authentication plugin.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Critical 9.8
    CVE-2021-36393 Public exploit EPSS 52%

    Moodle SQL Injection vulnerability

    In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • High 7.5
    CVE-2021-36396 Public exploit

    Moodle vulnerable to Server-Side Request Forgery

    In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.

    moodle/moodle moodle Web / CMS Ubuntu Packagist
  • Medium 6.1
    CVE-2023-22432 Public exploit Scanner template

    Open redirect in web2py

    Open redirect vulnerability exists in web2py versions prior to 2.23.1. When using the tool, a web2py user may be redirected to an arbitrary website by accessing a specially crafted URL. As a result, the user may become a victim of a phishing attack.

    web2py web2py web2py web2py Ubuntu PyPI
  • Critical 9.1
    CVE-2023-27290 Public exploit

    IBM Observability with Instana missing authentication

    Docker based datastores for IBM Instana (IBM Observability with Instana 239-0 through 239-2, 241-0 through 241-2, and 243-0) do not currently require authentication. Due to this, an attacker within the network could access the datastores with read/write acces…

    IBM Observability with Instana
  • Unscored —
    CVE-2023-27566 Public exploit

    Cubism Core in Live2D Cubism Editor 4.2.03 allows out-of-bounds write via a crafted Section Offset Table or Count Info …

  • High 7.8
    CVE-2022-45988 Public exploit

    starsoftcomm CooCare 5.304 allows local attackers to escalate privileges and execute arbitrary commands via a crafted f…

  • High 7.2
    CVE-2023-0084 Public exploit EPSS 29%

    Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting

    The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for…

    roxnor MetForm – Contact Form, Survey, Quiz, & Custom Form Builder for Elementor Web / CMS
  • Unscored —
    CVE-2023-0656 Public exploit EPSS 41%

    A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of …

    SonicWall SonicOS Network devices
  • Medium 4.7
    CVE-2023-1112 Public exploit

    Drag and Drop Multiple File Upload Contact Form 7 admin-ajax.php path traversal

    A vulnerability was found in Drag and Drop Multiple File Upload Contact Form 7 5.0.6.1 on WordPress. It has been classified as critical. Affected is an unknown function of the file admin-ajax.php. The manipulation of the argument upload_name leads to relative…

  • Medium 6.6
    CVE-2022-3294 Public exploit

    Node address isn't always verified when proxying

    Users may have access to secure endpoints in the control plane network. Kubernetes clusters are only affected if an untrusted user can modify Node objects and send proxy requests to them. Kubernetes supports node proxying, which allows clients of kube-apiserv…

    Kubernetes Kubernetes k8s.io/kubernetes kubernetes Debian Go