Archive
March 2023
Vulnerabilities first published in this month (UTC), newest first.
38 results · Clear filters · Feed
-
High 8.1CVE-2023-26984 Public exploit
An issue in the password reset function of Peppermint v0.2.4 allows attackers to access the emails and passwords of the…
-
High 8.0CVE-2022-27646 Public exploit
This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R67…
-
High 7.1CVE-2023-28447 Public exploit
Cross site scripting vulnerability in Javascript escaping in smarty/smarty
Smarty is a template engine for PHP. In affected versions smarty did not properly escape javascript code. An attacker could exploit this vulnerability to execute arbitrary JavaScript code in the context of the user's browser session. This may lead to unauthor…
-
High 7.5CVE-2023-25262 Public exploit
Stimulsoft GmbH Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Server Side Request Forgery (SSRF). TThe Reporting …
-
High 7.5CVE-2023-25260 Public exploit
Stimulsoft Designer (Web) 2023.1.3 is vulnerable to Local File Inclusion.
-
High 8.1CVE-2023-26493 Public exploit
Command Injection in Cocos Engine workflow
Cocos Engine is an open-source framework for building 2D & 3D real-time rendering and interactive content. In the github repo for Cocos Engine the `web-interface-check.yml` was subject to command injection. The `web-interface-check.yml` was triggered when a p…
-
High 7.8CVE-2023-1665 Public exploit
Improper Restriction of Excessive Authentication Attempts in linagora/twake
Improper Restriction of Excessive Authentication Attempts in GitHub repository linagora/twake prior to 0.0.0.
-
High 7.5CVE-2023-20860 Public exploit
Spring Framework is vulnerable to security bypass via mvcRequestMatcher pattern mismatch
Spring Framework running version 6.0.0 - 6.0.6 or 5.3.0 - 5.3.25 using "**" as a pattern in Spring Security configuration with the mvcRequestMatcher creates a mismatch in pattern matching between Spring Security and Spring MVC, and the potential for a securit…
-
High 7.8CVE-2023-20955 Public exploit
In onPrepareOptionsMenu of AppInfoDashboardFragment.java, there is a possible way to bypass admin restrictions and unin…
-
High 7.8
In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional…
KEV Apr 13, 2023 -
High 7.8CVE-2023-20911 Public exploit
In addPermission of PermissionManagerServiceImpl.java , there is a possible failure to persist permission settings due …
-
High 8.8CVE-2023-24788 Public exploit
NotrinosERP vulnerable to SQL Injection
NotrinosERP v0.7 was discovered to contain a SQL injection vulnerability via the OrderNumber parameter at /NotrinosERP/sales/customer_delivery.php.
-
High 8.6
Adobe ColdFusion Improper Access Control Arbitrary code execution
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does n…
KEV Mar 15, 2023 -
High 8.8
MinIO is vulnerable to privilege escalation on Linux/MacOS
Minio is a Multi-Cloud Object Storage framework. Prior to RELEASE.2023-03-20T20-16-18Z, an attacker can use crafted requests to bypass metadata bucket name checking and put an object into any bucket while processing `PostPolicyBucket`. To carry out this attac…
KEV Sep 19, 2023 -
High 7.5
Minio Information Disclosure in Cluster Deployment
Minio is a Multi-Cloud Object Storage framework. In a cluster deployment starting with RELEASE.2019-12-17T23-16-33Z and prior to RELEASE.2023-03-20T20-16-18Z, MinIO returns all environment variables, including `MINIO_SECRET_KEY` and `MINIO_ROOT_PASSWORD`, res…
KEV Apr 21, 2023 -
High 7.5CVE-2023-0464 Public exploit
Excessive Resource Usage Verifying X.509 Policy Constraints
A security vulnerability has been identified in all supported versions of OpenSSL related to the verification of X.509 certificate chains that include policy constraints. Attackers may be able to exploit this vulnerability by creating a malicious certificate …
-
High 7.8CVE-2023-1281 Public exploit
UAF in Linux kernel's tcindex (traffic control index filter) implementation
Use After Free vulnerability in Linux kernel traffic control index filter (tcindex) allows Privilege Escalation. The imperfect hash area can be updated while packets are traversing, which will cause a use-after-free when 'tcf_exts_exec()' is called with the d…
-
High 7.8
A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities w…
KEV Jun 17, 2025 -
High 7.5CVE-2022-45003 Public exploit
Gophish vulnerable to Denial of Service via crafted payload involving autofocus
Gophish through 0.12.1 allows attackers to cause a Denial of Service (DoS) via a crafted payload involving autofocus.
-
High 7.5
Rockwell Automation ThinManager ThinServer Path Traversal Download
In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files on the disk drive where ThinServer.e…
-
High 7.5CVE-2023-1545 Public exploit
SQL Injection in nilsteampassnet/teampass
SQL Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.0.23.
-
High 7.5
An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and …
-
High 8.8CVE-2023-27842 Public exploit
Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execu…
-
High 8.8
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability …
KEV May 1, 2023 -
High 8.2CVE-2023-24892 Public exploit
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability
Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability
-
High 8.8CVE-2023-24871 Public exploit
Windows Bluetooth Service Remote Code Execution Vulnerability
Windows Bluetooth Service Remote Code Execution Vulnerability
-
High 7.8CVE-2023-23399 Public exploit
Microsoft Excel Remote Code Execution Vulnerability
Microsoft Excel Remote Code Execution Vulnerability
-
High 8.8CVE-2023-23388 Public exploit
Windows Bluetooth Driver Elevation of Privilege Vulnerability
Windows Bluetooth Driver Elevation of Privilege Vulnerability
-
High 7.2CVE-2023-26262 Public exploit
An issue was discovered in Sitecore XP/XM 10.3. As an authenticated Sitecore user, a unrestricted language file upload …
-
High 7.8CVE-2023-27010 Public exploit
Wondershare Dr.Fone v12.9.6 was discovered to contain weak permissions for the service WsDrvInst. This vulnerability al…
-
High 7.4
ReadtoMyShoe, a web app that lets users upload articles and listen to them later, generates an error message containing…
-
High 7.5
Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database…
KEV Aug 22, 2023 -
High 8.8CVE-2023-0089 Public exploit
Proofpoint Enterprise Protection webutils authenticated RCE
The webutils in Proofpoint Enterprise Protection (PPS/POD) contain a vulnerability that allows an authenticated user to execute remote code through 'eval injection'. This affects all versions 8.20.0 and below.
-
High 7.2CVE-2023-1211 Public exploit
SQL Injection in phpipam/phpipam
SQL Injection in GitHub repository phpipam/phpipam prior to v1.5.2.
-
High 8.8CVE-2023-24217 Public exploit
AgileBio Electronic Lab Notebook v4.234 was discovered to contain a local file inclusion vulnerability.
-
High 7.5CVE-2021-36396 Public exploit
Moodle vulnerable to Server-Side Request Forgery
In Moodle, insufficient redirect handling made it possible to blindly bypass cURL blocked hosts/allowed ports restrictions, resulting in a blind SSRF risk.
-
High 7.8CVE-2022-45988 Public exploit
starsoftcomm CooCare 5.304 allows local attackers to escalate privileges and execute arbitrary commands via a crafted f…
-
High 7.2
Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting
The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. This makes it possible for…