Skip to content
Noroxi

By publication date

Exploited and new serious CVEs: March 2023

95 records · 15 KEV. In publication order.

Included: records in CISA KEV, with a weaponized exploit, with EPSS of 10% or more, with a public PoC and published in the last 3 years, and CVSS 7+ records published in the last 90 days. All other records are in search and vendor pages.

Month boundaries are UTC, the same rule as the publication date on each record page.

  • CVE-2023-20032
    48Plan

    On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file p

    CriticalCVSS 9.8No exploitEPSS 29%

    clamav · clamavMar 1, 2023

  • CVE-2022-36021
    40Plan

    Redis string pattern matching can be abused to achieve Denial of Service

    MediumCVSS 5.5No exploitEPSS 59%

    redis · redisMar 1, 2023

  • CVE-2023-0507
    26Monitor

    Grafana is an open-source platform for monitoring and observability.

    MediumCVSS 5.4No exploitEPSS 15%

    grafana · grafanaMar 1, 2023

  • CVE-2023-26477
    61This week

    org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability

    CriticalCVSS 9.8No exploitEPSS 74%

    xwiki · xwikiMar 2, 2023

  • CVE-2023-0084
    33Monitor

    Metform Elementor Contact Form Builder <= 3.1.2 - Unauthenticated Stored Cross-Site Scripting

    MediumCVSS 6.1Proof of conceptEPSS 28%

    wpmet · metform elementor contact form builderMar 2, 2023

  • CVE-2023-26475
    54Plan

    XWiki Platform vulnerable to Remote Code Execution in Annotations

    HighCVSS 8.8No exploitEPSS 63%

    xwiki · xwikiMar 2, 2023

  • CVE-2023-0656
    42Plan

    A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which

    HighCVSS 7.5Proof of conceptEPSS 41%

    sonicwall · sonicosMar 2, 2023

  • CVE-2023-1162
    43Plan

    DrayTek Vigor 2960 Web Management Interface mainfunction.cgi command injection

    HighCVSS 8.8No exploitEPSS 26%

    draytek · vigor 2960 firmwareMar 3, 2023

  • CVE-2022-45551
    46Plan

    An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command t

    CriticalCVSS 9.8No exploitEPSS 23%

    zbt · we1626 firmwareMar 3, 2023

  • CVE-2023-20078
    42Plan

    Cisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI Vulnerabilities

    CriticalCVSS 9.8No exploitEPSS 10%

    cisco · ip phone 6871 firmwareMar 3, 2023

  • CVE-2023-20079
    33Monitor

    Cisco IP Phone 6800, 7800, 7900, and 8800 Series Web UI Vulnerabilities

    HighCVSS 7.5No exploitEPSS 10%

    cisco · ip phone 6871 firmwareMar 3, 2023

  • CVE-2021-36393
    55Plan

    In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses.

    CriticalCVSS 9.8Proof of conceptEPSS 52%

    moodle · moodleMar 6, 2023

  • CVE-2023-24734
    45Plan

    An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a cra

    CriticalCVSS 9.8No exploitEPSS 20%

    sigb · pmbMar 6, 2023

  • CVE-2023-26601
    40Plan

    Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus be

    HighCVSS 7.5No exploitEPSS 34%

    zohocorp · manageengine assetexplorerMar 6, 2023

  • CVE-2019-8720
    65This week

    A vulnerability was found in WebKit.

    HighCVSS 8.8KEVWeaponizedEPSS 1%

    webkitgtk · webkitgtkMar 6, 2023

  • CVE-2023-25690
    64This week

    Apache HTTP Server: HTTP request splitting with mod_rewrite and mod_proxy

    CriticalCVSS 9.8Proof of conceptEPSS 84%

    apache · http serverMar 7, 2023

  • CVE-2022-41328
    61This week

    A improper limitation of a pathname to a restricted directory vulnerability ('path traversal') [CWE-22] in Fortinet FortiOS version 7.2.0 th

    HighCVSS 7.1KEVWeaponizedEPSS 10%

    fortinet · fortiosMar 7, 2023

  • CVE-2023-24775
    45Plan

    Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php.

    CriticalCVSS 9.8Proof of conceptEPSS 19%

    funadmin · funadminMar 7, 2023

  • CVE-2023-27482
    62This week

    homeassistant is an open source home automation tool.

    CriticalCVSS 10.0Proof of conceptEPSS 72%

    home-assistant · home-assistantMar 8, 2023

  • CVE-2023-25573
    45Plan

    Improper access control to download file in metersphere

    HighCVSS 7.5Proof of conceptEPSS 51%

    metersphere · metersphereMar 9, 2023

  • CVE-2023-0050
    49Plan

    An issue has been discovered in GitLab affecting all versions starting from 13.7 before 15.7.8, all versions starting from 15.8 before 15.8.

    MediumCVSS 5.4No exploitEPSS 92%

    gitlab · gitlabMar 9, 2023

  • CVE-2023-27853
    45Plan

    NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to

    CriticalCVSS 9.8No exploitEPSS 19%

    netgear · rax30 firmwareMar 10, 2023

  • CVE-2022-44574
    49Plan

    An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on

    HighCVSS 7.5No exploitEPSS 62%

    ivanti · avalancheMar 10, 2023

  • CVE-2023-27532
    84Now

    Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained.

    HighCVSS 7.5KEVWeaponizedEPSS 81%

    veeam · veeam backup \& replicationMar 10, 2023

  • CVE-2023-24033
    49Plan

    The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly chec

    CriticalCVSS 9.8No exploitEPSS 32%

    samsung · exynos modem 5300 firmwareMar 13, 2023

  • CVE-2022-31474
    49Plan

    WordPress BackupBuddy Plugin 8.5.8.0-8.7.4.1 is vulnerable to Directory Traversal

    HighCVSS 7.5Proof of conceptEPSS 63%

    ithemes · backupbuddyMar 13, 2023

  • CVE-2023-27063
    39Monitor

    Tenda V15V1.0 V15.11.0.14(1521_3190_1058) was discovered to contain a buffer overflow vulnerability via the DNSDomainName parameter in the f

    CriticalCVSS 9.8No exploitEPSS 1%

    tenda · w15e firmwareMar 13, 2023

  • CVE-2023-25279
    48Plan

    OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload.

    CriticalCVSS 9.8No exploitEPSS 30%

    dlink · dir-820l firmwareMar 13, 2023

  • CVE-2022-39214
    38Monitor

    Authenticated users of Combodo iTop can take over any account

    HighCVSS 7.5No exploitEPSS 25%

    combodo · itopMar 14, 2023

  • CVE-2023-23383
    22Monitor

    Service Fabric Explorer Spoofing Vulnerability

    MediumCVSS 4.7No exploitEPSS 11%

    microsoft · azure service fabricMar 14, 2023

  • CVE-2023-23397
    98Now

    Microsoft Outlook Elevation of Privilege Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    microsoft · 365 appsMar 14, 2023

  • CVE-2023-24880
    70This week

    Windows SmartScreen Security Feature Bypass Vulnerability

    MediumCVSS 4.4KEVWeaponizedEPSS 78%

    microsoft · windows 10 1607Mar 14, 2023

  • CVE-2023-28343
    64This week

    OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timez

    CriticalCVSS 9.8Proof of conceptEPSS 84%

    apsystems · energy communication unit firmwareMar 14, 2023

  • CVE-2023-27598
    30Monitor

    OpenSIPS has vulnerability in the parse_via() function

    HighCVSS 7.5No exploitEPSS 0%

    opensips · opensipsMar 15, 2023

  • CVE-2023-1389
    95Now

    TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability in the country form o

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    tp-link · archer ax21 firmwareMar 15, 2023

  • CVE-2023-28461
    89Now

    Array Networks Array AG Series and vxAG (9.4.0.481 and earlier) allow remote code execution.

    CriticalCVSS 9.8KEVWeaponizedEPSS 68%

    arraynetworks · arrayos agMar 15, 2023

  • CVE-2023-25280
    98Now

    OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload with t

    CriticalCVSS 9.8KEVWeaponizedEPSS 97%

    dlink · dir-820l firmwareMar 15, 2023

  • CVE-2022-43604
    43Plan

    An out-of-bounds write vulnerability exists in the GetAttributeList attribute_count_request functionality of EIP Stack Group OpENer developm

    CriticalCVSS 9.8No exploitEPSS 14%

    opener project · openerMar 16, 2023

  • CVE-2022-43605
    43Plan

    An out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer developm

    CriticalCVSS 9.8No exploitEPSS 14%

    opener project · openerMar 16, 2023

  • CVE-2023-1454
    50Plan

    jeecg-boot qurestSql sql injection

    CriticalCVSS 9.8Proof of conceptEPSS 35%

    jeecg · jeecg bootMar 17, 2023

  • CVE-2023-27253
    62This week

    A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbi

    HighCVSS 8.8WeaponizedEPSS 89%

    netgate · pfsenseMar 17, 2023

  • CVE-2023-0631
    53Plan

    Paid Memberships Pro < 2.9.12 - Subscriber+ SQL Injection

    HighCVSS 8.8No exploitEPSS 60%

    strangerstudios · paid memberships proMar 20, 2023

  • CVE-2023-28425
    40Plan

    Specially crafted MSETNX command can lead to denial-of-service

    MediumCVSS 5.5No exploitEPSS 58%

    redis · redisMar 20, 2023

  • CVE-2022-43663
    43Plan

    An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05.

    CriticalCVSS 9.8No exploitEPSS 14%

    wellintech · kinghistorianMar 20, 2023

  • CVE-2022-45124
    34Monitor

    An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05.

    HighCVSS 7.5No exploitEPSS 13%

    wellintech · kinghistorianMar 20, 2023

  • CVE-2023-27842
    36Monitor

    Insecure Permissions vulnerability found in Extplorer File manager eXtplorer v.2.1.15 allows a remote attacker to execute arbitrary code via

    HighCVSS 8.8Proof of conceptEPSS 2%

    extplorer · extplorerMar 21, 2023

  • CVE-2023-26497
    45Plan

    An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto

    CriticalCVSS 9.8No exploitEPSS 21%

    samsung · exynos modem 5300 firmwareMar 21, 2023

  • CVE-2023-24709
    43Plan

    An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters.

    HighCVSS 7.5Proof of conceptEPSS 44%

    paradox · ipr512 firmwareMar 21, 2023

  • CVE-2023-27855
    60This week

    Rockwell Automation ThinManager ThinServer Path Traversal Upload

    CriticalCVSS 9.8WeaponizedEPSS 13%

    rockwellautomation · thinmanagerMar 21, 2023

  • CVE-2023-27856
    60This week

    Rockwell Automation ThinManager ThinServer Path Traversal Download

    HighCVSS 7.5WeaponizedEPSS 77%

    rockwellautomation · thinmanagerMar 21, 2023

  • CVE-2023-28725
    42Plan

    General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute a

    CriticalCVSS 9.1No exploitEPSS 20%

    generalbytes · crypto application serverMar 21, 2023

  • CVE-2023-27857
    36Monitor

    Rockwell Automation ThinManager ThinServer Heap-Based Buffer Overflow

    HighCVSS 7.5No exploitEPSS 18%

    rockwellautomation · thinmanagerMar 21, 2023

  • CVE-2023-1578
    54Plan

    SQL Injection in pimcore/pimcore

    HighCVSS 8.8No exploitEPSS 62%

    pimcore · pimcoreMar 22, 2023

  • CVE-2023-0386
    63This week

    A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux

    HighCVSS 7.8KEVWeaponizedEPSS 7%

    linux · linux kernelMar 22, 2023

  • CVE-2023-28432
    85Now

    Minio Information Disclosure in Cluster Deployment

    HighCVSS 7.5KEVWeaponizedEPSS 83%

    minio · minioMar 22, 2023

  • CVE-2023-28434
    67This week

    MinIO is vulnerable to privilege escalation on Linux/MacOS

    HighCVSS 8.8KEVWeaponizedEPSS 7%

    minio · minioMar 22, 2023

  • CVE-2023-28662
    52Plan

    The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerabilit

    CriticalCVSS 9.8Proof of conceptEPSS 42%

    codemenschen · gift vouchersMar 22, 2023

  • CVE-2023-26498
    45Plan

    An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, Exynos Auto T51

    CriticalCVSS 9.8No exploitEPSS 21%

    samsung · exynos modem 5300 firmwareMar 22, 2023

  • CVE-2023-26496
    45Plan

    An issue was discovered in Samsung Baseband Modem Chipset for Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto

    CriticalCVSS 9.8No exploitEPSS 21%

    samsung · exynos modem 5300 firmwareMar 22, 2023

  • CVE-2023-26359
    74This week

    Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution

    CriticalCVSS 9.8KEVWeaponizedEPSS 16%

    adobe · coldfusionMar 23, 2023

  • CVE-2023-26360
    93Now

    Adobe ColdFusion Improper Access Control Arbitrary code execution

    HighCVSS 8.6KEVWeaponizedEPSS 97%

    adobe · coldfusionMar 23, 2023

  • CVE-2023-26361
    37Monitor

    Adobe ColdFusion Directory Traversal Arbitrary file system read Vulnerability

    MediumCVSS 4.9No exploitEPSS 58%

    adobe · coldfusionMar 23, 2023

  • CVE-2023-27034
    57Plan

    PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.

    CriticalCVSS 9.8Proof of conceptEPSS 58%

    joommasters · jms blogMar 23, 2023

  • CVE-2022-42948
    70This week

    Cobalt Strike 4.7.1 fails to properly escape HTML tags when they are displayed on Swing components.

    CriticalCVSS 9.8KEVWeaponizedEPSS 2%

    helpsystems · cobalt strikeMar 24, 2023

  • CVE-2023-1177
    60This week

    Path Traversal: '\..\filename' in mlflow/mlflow

    CriticalCVSS 9.8Proof of conceptEPSS 69%

    lfprojects · mlflowMar 24, 2023

  • CVE-2023-20963
    61This week

    In WorkSource, there is a possible parcel mismatch.

    HighCVSS 7.8KEVWeaponizedEPSS 1%

    google · androidMar 24, 2023

  • CVE-2023-26801
    60This week

    LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a com

    CriticalCVSS 9.8No exploitEPSS 69%

    lb-link · bl-lte300 firmwareMar 26, 2023

  • CVE-2023-26802
    54Plan

    An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authe

    CriticalCVSS 9.8Proof of conceptEPSS 48%

    dcnglobal · dcbi-netlog-lab firmwareMar 26, 2023

  • CVE-2023-1133
    60This week

    Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on por

    CriticalCVSS 9.8WeaponizedEPSS 50%

    deltaww · infrasuite device masterMar 27, 2023

  • CVE-2022-48428
    41Plan

    In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible

    MediumCVSS 5.4No exploitEPSS 67%

    jetbrains · teamcityMar 27, 2023

  • CVE-2023-1380
    33Monitor

    A slab-out-of-bound read problem was found in brcmf_get_assoc_ies in drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c in the Linu

    HighCVSS 7.1No exploitEPSS 16%

    redhat · enterprise linuxMar 27, 2023

  • CVE-2023-22249
    37Monitor

    Adobe Commerce Stored XSS Arbitrary code execution

    MediumCVSS 4.8No exploitEPSS 58%

    adobe · commerceMar 27, 2023

  • CVE-2023-0210
    52Plan

    A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems.

    HighCVSS 7.5No exploitEPSS 71%

    linux · linux kernelMar 27, 2023

  • CVE-2023-27394
    44Plan

    Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability.

    CriticalCVSS 9.8No exploitEPSS 17%

    propumpservice · osprey pump controller firmwareMar 28, 2023

  • CVE-2022-27643
    43Plan

    This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.9

    HighCVSS 8.8No exploitEPSS 25%

    netgear · r6400 firmwareMar 29, 2023

  • CVE-2022-28685
    36Monitor

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802

    HighCVSS 7.8No exploitEPSS 17%

    aveva · aveva edgeMar 29, 2023

  • CVE-2022-2560
    59Plan

    This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server.

    CriticalCVSS 9.1No exploitEPSS 77%

    enterprisedt · completeftp serverMar 29, 2023

  • CVE-2022-36969
    32Monitor

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2

    HighCVSS 7.1No exploitEPSS 13%

    aveva · aveva edgeMar 29, 2023

  • CVE-2022-36971
    39Monitor

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490.

    HighCVSS 8.8No exploitEPSS 14%

    ivanti · avalancheMar 29, 2023

  • CVE-2022-36974
    64This week

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490.

    CriticalCVSS 9.8No exploitEPSS 84%

    ivanti · avalancheMar 29, 2023

  • CVE-2022-36980
    57Plan

    This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490.

    HighCVSS 8.1No exploitEPSS 82%

    ivanti · avalancheMar 29, 2023

  • CVE-2022-36981
    64This week

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101.

    CriticalCVSS 9.8No exploitEPSS 83%

    ivanti · avalancheMar 29, 2023

  • CVE-2022-36982
    52Plan

    This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101.

    HighCVSS 7.5No exploitEPSS 73%

    ivanti · avalancheMar 29, 2023

  • CVE-2022-42424
    58Plan

    This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.

    HighCVSS 8.8No exploitEPSS 76%

    centreon · centreonMar 29, 2023

  • CVE-2022-42425
    58Plan

    This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.

    HighCVSS 8.8No exploitEPSS 76%

    centreon · centreonMar 29, 2023

  • CVE-2022-42427
    58Plan

    This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.

    HighCVSS 8.8No exploitEPSS 76%

    centreon · centreonMar 29, 2023

  • CVE-2022-42429
    58Plan

    This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.

    HighCVSS 8.8No exploitEPSS 76%

    centreon · centreonMar 29, 2023

  • CVE-2022-43634
    45Plan

    This vulnerability allows remote attackers to execute arbitrary code on affected installations of Netatalk.

    CriticalCVSS 9.8No exploitEPSS 18%

    netatalk · netatalkMar 29, 2023

  • CVE-2022-43650
    35Monitor

    This vulnerability allows remote attackers to disclose sensitive information on affected installations of RARLAB WinRAR 6.11.0.0.

    HighCVSS 7.1No exploitEPSS 23%

    rarlab · winrarMar 29, 2023

  • CVE-2023-28502
    60This week

    Stack buffer overflow in UniRPC's udadmin_server service

    CriticalCVSS 9.8WeaponizedEPSS 61%

    rocketsoftware · unidataMar 29, 2023

  • CVE-2023-28503
    60This week

    Authentication bypass in UniRPC's udadmin service

    CriticalCVSS 9.8WeaponizedEPSS 62%

    rocketsoftware · unidataMar 29, 2023

  • CVE-2023-25076
    59Plan

    A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80d

    CriticalCVSS 9.8No exploitEPSS 65%

    sniproxy project · sniproxyMar 30, 2023

  • CVE-2022-43473
    27Monitor

    A blind XML External Entity (XXE) vulnerability exists in the Add UCS Device functionality of ManageEngine OpManager 12.6.168.

    MediumCVSS 5.4No exploitEPSS 19%

    zohocorp · manageengine opmanagerMar 30, 2023

  • CVE-2023-26482
    40Plan

    Scope of workflow operations is not validated in nextcloud server

    HighCVSS 8.8WeaponizedEPSS 4%

    nextcloud · nextcloud serverMar 30, 2023

  • CVE-2023-27159
    41Plan

    Appwrite up to v1.2.1 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /v1/avatars/favicon.

    HighCVSS 7.5Proof of conceptEPSS 36%

    appwrite · appwriteMar 31, 2023