CVEs published April 3, 2023
45 CVEs were published on April 3, 2023: 4 critical, 14 high. 2 are now in CISA KEV.
- Published
- 45
- Critical
- 4
- High
- 14
- Medium
- 20
- Low
- 3
- Unrated
- 4
- Now in CISA KEV
- 2
- Fix available
- 29
Most affected products
- Hitachi Vantara Pentaho Business Analytics Server
- 12
- Samba
- 3
- Akbim Computer Panon
- 2
- Trellix Agent
- 2
- wagtail
- 2
- ADMesh · libslic3r
- 1
- Apache Software Foundation Apache James server · org.apache…
- 1
- bigfork silverstripe-form-capture · bigfork/silverstripe… +1
- 1
- binutils
- 1
- configobj
- 1
Critical 4
- CVE-2023-1765SQLi in PanonAkbim Computer Panon
- CVE-2023-26119Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, whnet.sourceforge.htmlunit:htmlunit
- CVE-2022-38922BluePage CMS thru 3.9 processes an insufficiently sanitized HTTP Header Cookie value allowing MySQL Injection in the 'users-cookie-settings'
- CVE-2022-38923BluePage CMS thru v3.9 processes an insufficiently sanitized HTTP Header allowing MySQL Injection in the 'User-Agent' field using a Time-bas
High 14
- CVE-2022-43941Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference Hitachi Vantara Pentaho Business Analytics Server
- CVE-2022-43940Hitachi Vantara Pentaho Business Analytics Server - Incorrect AuthorizationHitachi Vantara Pentaho Business Analytics Server
- CVE-2022-43939Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization DecisionsHitachi Vantara Pentaho Business Analytics Server
- CVE-2022-43938Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') Hitachi Vantara Pentaho Business Analytics Server
- CVE-2022-43773Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource Hitachi Vantara Pentaho Business Analytics Server
- CVE-2023-28854nophp vulnerable to shell command injection on httpd user when sending a password-setting mail or mail-login mailpaijp nophp
- CVE-2022-43769Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)Hitachi Vantara Pentaho Business Analytics Server
- CVE-2023-0975 A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, toTrellix Agent
- CVE-2023-1124Shopping Cart & eCommerce Store < 5.4.3 - Admin+ LFIShopping Cart & eCommerce Store
- CVE-2023-0820User Role by BestWebSoft < 1.6.7 - Privilege Escalation via CSRFUser Role by BestWebSoft
- CVE-2023-28625mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is suppliedmod_auth_openidc
- CVE-2023-26269Apache James server: Privilege escalation through unauthenticated JMXApache Software Foundation Apache James server · org.apache…
- CVE-2023-0614The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attacSamba
- CVE-2023-1579Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd_getl64.binutils
Medium, low and unrated 27
- CVE-2022-4771Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Hitachi Vantara Pentaho Business Analytics Server
- CVE-2022-4770Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information Hitachi Vantara Pentaho Business Analytics Server
- CVE-2022-4769Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information Hitachi Vantara Pentaho Business Analytics Server
- CVE-2022-43772Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File Hitachi Vantara Pentaho Business Analytics Server
- CVE-2022-3960Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') Hitachi Vantara Pentaho Business Analytics Server
- CVE-2022-43771Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Hitachi Vantara Pentaho Business Analytics Server
- CVE-2023-28851Silverstripe Form Capture vulnerable to Stored Cross-Site Scriptingbigfork silverstripe-form-capture · bigfork/silverstripe… +1
- CVE-2023-28850Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective namepimcore perspective-editor · pimcore/perspective-editor
- CVE-2023-28837Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large fileswagtail
- CVE-2023-28834Full path of data directory exposed to Nextcloud server usersnextcloud security-advisories
- CVE-2023-0977 A heap-based overflow vulnerability in Trellix Agent (Windows and Linux) version 5.7.8 and earlier, allows a remote user to alter the page Trellix Agent
- CVE-2022-38072An improper array index validation vulnerability exists in the stl_fix_normal_directions functionality of ADMesh Master Commit 767a105 and vADMesh · libslic3r
- CVE-2023-0399Image Over Image For WPBakery Page Builder < 3.0 - Contributor+ Stored XSSImage Over Image For WPBakery Page Builder
- CVE-2023-1377Solidres <= 0.9.4 - Multiple Reflected XSSSolidres
- CVE-2023-1330Redirection < 1.1.4 - Redirect Creation via CSRFRedirection
- CVE-2023-1766XSS in PanonAkbim Computer Panon
- CVE-2023-26529WordPress DupeOff Plugin <= 1.6 is vulnerable to Cross Site Scripting (XSS)DupeOff.com DupeOff
- CVE-2023-26112All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\configobj
- CVE-2022-27665Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS_FTP Server 8.6.0.
- CVE-2022-36440A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek_for_as4_capability function.
- CVE-2023-0225A flaw was found in Samba.Samba
- CVE-2023-0922The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed-Samba
- CVE-2023-1611A use-after-free flaw was found in btrfs_search_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash Kernel
- CVE-2023-24724A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insuffic
- CVE-2023-26916libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys_parse_mem at lys_parse_mem.c.
- CVE-2023-28836Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin viewswagtail
- CVE-2023-29218The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arrang