CVEs published April 13, 2023
42 CVEs were published on April 13, 2023: 7 critical, 20 high. Browse them by severity, product and exploitation status.
- Published
- 42
- Critical
- 7
- High
- 20
- Medium
- 13
- Low
- 0
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Adobe Substance3D - Designer
- 9
- Apache Software Foundation Apache Sling Engine · org.apache…
- 1
- Arista Networks Arista EOS
- 1
- Canonical Apport
- 1
- Kyocera Document Solutions, TA Triumph-Adler GmbH, and Oliv…
- 1
- microweber/microweber
- 1
- nilsteampassnet/teampass
- 1
- Silkalns Activello
- 1
- Spring Framework · org.springframework:spring-expression
- 1
- Spring Session · org.springframework.session:spring-session…
- 1
Critical 7
- CVE-2023-24509On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol…Arista Networks Arista EOS
- CVE-2023-26918Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be…
- CVE-2023-27667Auto Dealer Management System v1.0 was discovered to contain a SQL injection vulnerability.
- CVE-2023-27746BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute…
- CVE-2023-27748BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware.
- CVE-2023-27779AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form.
- CVE-2023-29598lmxcms v1.4.1 was discovered to contain a SQL injection vulnerability via the setbook parameter at index.php.
High 20
- CVE-2023-1326local privilege escalation in apport-cliCanonical Apport
- CVE-2022-45064Apache Sling Engine: Include-based XSSApache Software Foundation Apache Sling Engine · org.apache…
- CVE-2023-22951An issue was discovered in TigerGraph Enterprise Free Edition 3.x.
- CVE-2023-26398ZDI-CAN-20310: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26409ZDI-CAN-20313: Adobe Substance 3D Designer USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26410ZDI-CAN-20309: Adobe Substance 3D Designer USD File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26411ZDI-CAN-20312: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26412ZDI-CAN-20314: Adobe Substance 3D Designer USDA File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26413ZDI-CAN-20315: Adobe Substance 3D Designer USD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26414ZDI-CAN-20316: Adobe Substance 3D Designer USD File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26415ZDI-CAN-20317: Adobe Substance 3D Designer DAE File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26416ZDI-CAN-20318: Adobe Substance 3D Designer DAE File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-27747BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authentication in its web server.
- CVE-2023-27772libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() at…
- CVE-2023-29084Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.
- CVE-2023-30630Dmidecode before 3.5 allows -dump-bin to overwrite a local file.
- CVE-2023-30635TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error) upon an attempt to get a timestamp from the Placement Driver.
- CVE-2023-30636TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error, with RpcStatus UNAVAILABLE for "not leader") upon an attempt…
- CVE-2023-30637Baidu braft 1.1.2 has a memory leak related to use of the new operator in example/atomic/atomic_server.
- CVE-2023-30638Atos Unify OpenScape SBC 10 before 10R3.1.3, OpenScape Branch 10 before 10R3.1.2, and OpenScape BCF 10 before 10R10.7.0 allow remote…
Medium, low and unrated 15
- CVE-2022-45358WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)Silkalns Activello
- CVE-2022-44625WordPress Cyklodev WP Notify Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)Zephilou Cyklodev WP Notify
- CVE-2022-48468protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
- CVE-2023-2014Cross-site Scripting (XSS) - Generic in microweber/microwebermicroweber/microweber
- CVE-2023-2021Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampassnilsteampassnet/teampass
- CVE-2023-20863In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL…Spring Framework · org.springframework:spring-expression
- CVE-2023-20866In Spring Session version 3.0.0, the session id can be logged to the standard output stream.Spring Session · org.springframework.session:spring-session…
- CVE-2023-22948An issue was discovered in TigerGraph Enterprise Free Edition 3.x.
- CVE-2023-22950An issue was discovered in TigerGraph Enterprise Free Edition 3.x.
- CVE-2023-25954KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print'…Kyocera Document Solutions, TA Triumph-Adler GmbH, and Oliv…
- CVE-2023-26263All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the…
- CVE-2023-26264All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license…
- CVE-2023-27812bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function.
- CVE-2023-29573Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.
- CVE-2023-29597bloofox v0.5.2 was discovered to contain a SQL injection vulnerability via the component…