# CVEs published 2023-04-13

42 CVEs were published on April 13, 2023: 7 critical, 20 high. Days are UTC.

- [CVE-2023-1326](https://cve.now/CVE-2023-1326.md): local privilege escalation in apport-cli (CVSS 7.7, Canonical Apport)
- [CVE-2022-45358](https://cve.now/CVE-2022-45358.md): WordPress Activello Theme \<= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4, Silkalns Activello)
- [CVE-2022-44625](https://cve.now/CVE-2022-44625.md): WordPress Cyklodev WP Notify Plugin \<= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, Zephilou Cyklodev WP Notify)
- [CVE-2022-45064](https://cve.now/CVE-2022-45064.md): Apache Sling Engine: Include-based XSS (CVSS 8.0, Apache Software Foundation Apache Sling Engine · org.apache…)
- [CVE-2022-48468](https://cve.now/CVE-2022-48468.md): protobuf-c before 1.4.1 has an unsigned integer overflow in parse\_required\_member. (CVSS 5.5)
- [CVE-2023-2014](https://cve.now/CVE-2023-2014.md): Cross-site Scripting (XSS) - Generic in microweber/microweber (CVSS 5.3, microweber/microweber)
- [CVE-2023-2021](https://cve.now/CVE-2023-2021.md): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass (CVSS 5.8, nilsteampassnet/teampass)
- [CVE-2023-20863](https://cve.now/CVE-2023-20863.md): In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL… (CVSS 6.5, Spring Framework · org.springframework:spring-expression)
- [CVE-2023-20866](https://cve.now/CVE-2023-20866.md): In Spring Session version 3.0.0, the session id can be logged to the standard output stream. (CVSS 6.5, Spring Session · org.springframework.session:spring-session…)
- [CVE-2023-22948](https://cve.now/CVE-2023-22948.md): An issue was discovered in TigerGraph Enterprise Free Edition 3.x. (CVSS 4.9)
- [CVE-2023-22950](https://cve.now/CVE-2023-22950.md): An issue was discovered in TigerGraph Enterprise Free Edition 3.x. (CVSS 6.5)
- [CVE-2023-22951](https://cve.now/CVE-2023-22951.md): An issue was discovered in TigerGraph Enterprise Free Edition 3.x. (CVSS 8.8)
- [CVE-2023-24509](https://cve.now/CVE-2023-24509.md): On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol… (CVSS 9.3, Arista Networks Arista EOS)
- [CVE-2023-25954](https://cve.now/CVE-2023-25954.md): KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print'… (CVSS 5.5, Kyocera Document Solutions, TA Triumph-Adler GmbH, and Oliv…)
- [CVE-2023-26263](https://cve.now/CVE-2023-26263.md): All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the… (CVSS 5.5)
- [CVE-2023-26264](https://cve.now/CVE-2023-26264.md): All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license… (CVSS 5.5)
- [CVE-2023-26398](https://cve.now/CVE-2023-26398.md): ZDI-CAN-20310: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26409](https://cve.now/CVE-2023-26409.md): ZDI-CAN-20313: Adobe Substance 3D Designer USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26410](https://cve.now/CVE-2023-26410.md): ZDI-CAN-20309: Adobe Substance 3D Designer USD File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26411](https://cve.now/CVE-2023-26411.md): ZDI-CAN-20312: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26412](https://cve.now/CVE-2023-26412.md): ZDI-CAN-20314: Adobe Substance 3D Designer USDA File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26413](https://cve.now/CVE-2023-26413.md): ZDI-CAN-20315: Adobe Substance 3D Designer USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26414](https://cve.now/CVE-2023-26414.md): ZDI-CAN-20316: Adobe Substance 3D Designer USD File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26415](https://cve.now/CVE-2023-26415.md): ZDI-CAN-20317: Adobe Substance 3D Designer DAE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26416](https://cve.now/CVE-2023-26416.md): ZDI-CAN-20318: Adobe Substance 3D Designer DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26918](https://cve.now/CVE-2023-26918.md): Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be… (CVSS 9.8)
- [CVE-2023-27667](https://cve.now/CVE-2023-27667.md): Auto Dealer Management System v1.0 was discovered to contain a SQL injection vulnerability. (CVSS 9.8)
- [CVE-2023-27746](https://cve.now/CVE-2023-27746.md): BlackVue DR750-2CH LTE v.1.012\_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute… (CVSS 9.8)
- [CVE-2023-27747](https://cve.now/CVE-2023-27747.md): BlackVue DR750-2CH LTE v.1.012\_2022.10.26 does not employ authentication in its web server. (CVSS 7.5)
- [CVE-2023-27748](https://cve.now/CVE-2023-27748.md): BlackVue DR750-2CH LTE v.1.012\_2022.10.26 does not employ authenticity check for uploaded firmware. (CVSS 9.8)
- [CVE-2023-27772](https://cve.now/CVE-2023-27772.md): libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient\_setOrigin() at… (CVSS 7.5)
- [CVE-2023-27779](https://cve.now/CVE-2023-27779.md): AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form. (CVSS 9.8)
- [CVE-2023-27812](https://cve.now/CVE-2023-27812.md): bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete\_file() function. (no CVSS)
- [CVE-2023-29084](https://cve.now/CVE-2023-29084.md): Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings. (CVSS 7.2)
- [CVE-2023-29573](https://cve.now/CVE-2023-29573.md): Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component. (CVSS 5.5)
- [CVE-2023-29597](https://cve.now/CVE-2023-29597.md): bloofox v0.5.2 was discovered to contain a SQL injection vulnerability via the component… (no CVSS)
- [CVE-2023-29598](https://cve.now/CVE-2023-29598.md): lmxcms v1.4.1 was discovered to contain a SQL injection vulnerability via the setbook parameter at index.php. (CVSS 9.8)
- [CVE-2023-30630](https://cve.now/CVE-2023-30630.md): Dmidecode before 3.5 allows -dump-bin to overwrite a local file. (CVSS 7.1)
- [CVE-2023-30635](https://cve.now/CVE-2023-30635.md): TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error) upon an attempt to get a timestamp from the Placement Driver. (CVSS 7.5)
- [CVE-2023-30636](https://cve.now/CVE-2023-30636.md): TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error, with RpcStatus UNAVAILABLE for "not leader") upon an attempt… (CVSS 7.5)
- [CVE-2023-30637](https://cve.now/CVE-2023-30637.md): Baidu braft 1.1.2 has a memory leak related to use of the new operator in example/atomic/atomic\_server. (CVSS 7.5)
- [CVE-2023-30638](https://cve.now/CVE-2023-30638.md): Atos Unify OpenScape SBC 10 before 10R3.1.3, OpenScape Branch 10 before 10R3.1.2, and OpenScape BCF 10 before 10R10.7.0 allow remote… (CVSS 7.2)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2023-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.