# CVEs published 2023-04-03

45 CVEs were published on April 3, 2023: 4 critical, 14 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-4771](https://cve.now/CVE-2022-4771.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 5.4, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2022-4770](https://cve.now/CVE-2022-4770.md): Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information (CVSS 4.3, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2022-4769](https://cve.now/CVE-2022-4769.md): Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information (CVSS 4.3, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2022-43772](https://cve.now/CVE-2022-43772.md): Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File (CVSS 3.8, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2022-3960](https://cve.now/CVE-2022-3960.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') (CVSS 6.3, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2022-43941](https://cve.now/CVE-2022-43941.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (CVSS 7.1, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2022-43771](https://cve.now/CVE-2022-43771.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 6.5, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2022-43940](https://cve.now/CVE-2022-43940.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 8.8, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2022-43939](https://cve.now/CVE-2022-43939.md): Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions (CVSS 8.6, KEV, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2022-43938](https://cve.now/CVE-2022-43938.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') (CVSS 8.8, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2022-43773](https://cve.now/CVE-2022-43773.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource (CVSS 8.8, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2023-28854](https://cve.now/CVE-2023-28854.md): nophp vulnerable to shell command injection on httpd user when sending a password-setting mail or mail-login mail (CVSS 8.0, paijp nophp)
- [CVE-2022-43769](https://cve.now/CVE-2022-43769.md): Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CVSS 8.8, KEV, Hitachi Vantara Pentaho Business Analytics Server)
- [CVE-2023-28851](https://cve.now/CVE-2023-28851.md): Silverstripe Form Capture vulnerable to Stored Cross-Site Scripting (CVSS 6.1, bigfork silverstripe-form-capture · bigfork/silverstripe… +1)
- [CVE-2023-28850](https://cve.now/CVE-2023-28850.md): Pimcore Perspective Editor vulnerable to Cross-site Scripting in perspective name (CVSS 6.1, pimcore perspective-editor · pimcore/perspective-editor)
- [CVE-2023-28837](https://cve.now/CVE-2023-28837.md): Wagtail vulnerable to denial-of-service via memory exhaustion when uploading large files (CVSS 4.9, wagtail)
- [CVE-2023-28834](https://cve.now/CVE-2023-28834.md): Full path of data directory exposed to Nextcloud server users (CVSS 3.5, nextcloud security-advisories)
- [CVE-2023-0977](https://cve.now/CVE-2023-0977.md): A heap-based overflow vulnerability in Trellix Agent (Windows and Linux) version 5.7.8 and earlier, allows a remote user to alter the page (CVSS 6.7, Trellix Agent)
- [CVE-2023-0975](https://cve.now/CVE-2023-0975.md): A vulnerability exists in Trellix Agent for Windows version 5.7.8 and earlier, that allows local users, during install/upgrade workflow, to (CVSS 8.2, Trellix Agent)
- [CVE-2022-38072](https://cve.now/CVE-2022-38072.md): An improper array index validation vulnerability exists in the stl\_fix\_normal\_directions functionality of ADMesh Master Commit 767a105 and v (CVSS 6.5, ADMesh · libslic3r)
- [CVE-2023-0399](https://cve.now/CVE-2023-0399.md): Image Over Image For WPBakery Page Builder \< 3.0 - Contributor+ Stored XSS (CVSS 5.4, Image Over Image For WPBakery Page Builder)
- [CVE-2023-1377](https://cve.now/CVE-2023-1377.md): Solidres \<= 0.9.4 - Multiple Reflected XSS (CVSS 6.1, Solidres)
- [CVE-2023-1330](https://cve.now/CVE-2023-1330.md): Redirection \< 1.1.4 - Redirect Creation via CSRF (CVSS 6.5, Redirection)
- [CVE-2023-1124](https://cve.now/CVE-2023-1124.md): Shopping Cart & eCommerce Store \< 5.4.3 - Admin+ LFI (CVSS 7.2, Shopping Cart & eCommerce Store)
- [CVE-2023-0820](https://cve.now/CVE-2023-0820.md): User Role by BestWebSoft \< 1.6.7 - Privilege Escalation via CSRF (CVSS 8.8, User Role by BestWebSoft)
- [CVE-2023-1766](https://cve.now/CVE-2023-1766.md): XSS in Panon (CVSS 6.1, Akbim Computer Panon)
- [CVE-2023-1765](https://cve.now/CVE-2023-1765.md): SQLi in Panon (CVSS 9.8, Akbim Computer Panon)
- [CVE-2023-28625](https://cve.now/CVE-2023-28625.md): mod\_auth\_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied (CVSS 7.5, mod\_auth\_openidc)
- [CVE-2023-26529](https://cve.now/CVE-2023-26529.md): WordPress DupeOff Plugin \<= 1.6 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, DupeOff.com DupeOff)
- [CVE-2023-26269](https://cve.now/CVE-2023-26269.md): Apache James server: Privilege escalation through unauthenticated JMX (CVSS 7.8, Apache Software Foundation Apache James server · org.apache…)
- [CVE-2023-26119](https://cve.now/CVE-2023-26119.md): Versions of the package net.sourceforge.htmlunit:htmlunit from 0 and before 3.0.0 are vulnerable to Remote Code Execution (RCE) via XSTL, wh (CVSS 9.8, net.sourceforge.htmlunit:htmlunit)
- [CVE-2023-26112](https://cve.now/CVE-2023-26112.md): All versions of the package configobj are vulnerable to Regular Expression Denial of Service (ReDoS) via the validate function, using (.+?)\\ (CVSS 3.7, configobj)
- [CVE-2022-27665](https://cve.now/CVE-2022-27665.md): Reflected XSS (via AngularJS sandbox escape expressions) exists in Progress Ipswitch WS\_FTP Server 8.6.0. (no CVSS)
- [CVE-2022-36440](https://cve.now/CVE-2022-36440.md): A reachable assertion was found in Frrouting frr-bgpd 8.3.0 in the peek\_for\_as4\_capability function. (no CVSS)
- [CVE-2022-38922](https://cve.now/CVE-2022-38922.md): BluePage CMS thru 3.9 processes an insufficiently sanitized HTTP Header Cookie value allowing MySQL Injection in the 'users-cookie-settings' (CVSS 9.8)
- [CVE-2022-38923](https://cve.now/CVE-2022-38923.md): BluePage CMS thru v3.9 processes an insufficiently sanitized HTTP Header allowing MySQL Injection in the 'User-Agent' field using a Time-bas (CVSS 9.8)
- [CVE-2023-0225](https://cve.now/CVE-2023-0225.md): A flaw was found in Samba. (CVSS 4.3, Samba)
- [CVE-2023-0614](https://cve.now/CVE-2023-0614.md): The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was insufficient and an attac (CVSS 7.7, Samba)
- [CVE-2023-0922](https://cve.now/CVE-2023-0922.md): The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset passwords over a signed- (CVSS 5.9, Samba)
- [CVE-2023-1579](https://cve.now/CVE-2023-1579.md): Heap based buffer overflow in binutils-gdb/bfd/libbfd.c in bfd\_getl64. (CVSS 7.8, binutils)
- [CVE-2023-1611](https://cve.now/CVE-2023-1611.md): A use-after-free flaw was found in btrfs\_search\_slot in fs/btrfs/ctree.c in btrfs in the Linux Kernel.This flaw allows an attacker to crash (CVSS 6.3, Kernel)
- [CVE-2023-24724](https://cve.now/CVE-2023-24724.md): A stored cross site scripting (XSS) vulnerability was discovered in the user management module of the SAS 9.4 Admin Console, due to insuffic (CVSS 5.4)
- [CVE-2023-26916](https://cve.now/CVE-2023-26916.md): libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lys\_parse\_mem at lys\_parse\_mem.c. (no CVSS)
- [CVE-2023-28836](https://cve.now/CVE-2023-28836.md): Wagtail vulnerable to stored Cross-site Scripting attack via ModelAdmin views (CVSS 6.4, wagtail)
- [CVE-2023-29218](https://cve.now/CVE-2023-29218.md): The Twitter Recommendation Algorithm through ec83d01 allows attackers to cause a denial of service (reduction of reputation score) by arrang (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.