CVEs published April 4, 2023
165 CVEs were published on April 4, 2023: 20 critical, 68 high. 1 is now in CISA KEV.
- Published
- 165
- Critical
- 20
- High
- 68
- Medium
- 50
- Low
- 3
- Unrated
- 24
- Now in CISA KEV
- 1
- Fix available
- 37
Most affected products
- Qualcomm Snapdragon
- 33
- Google Chrome
- 14
- envoyproxy envoy
- 6
- nextcloud security-advisories
- 5
- Nexx Smart Alarm NXAL-100 · Nexx Smart Plug NXPG-100W +1
- 5
- Dell PowerScale OneFS
- 3
- moby · github.com/docker/docker
- 3
- Sophos Web Appliance
- 3
- editor.md
- 2
- github.com/phachon/mm-wiki
- 2
Critical 20
- CVE-2023-1748CVE-2023-1748Nexx Smart Alarm NXAL-100 · Nexx Smart Plug NXPG-100W +1
- CVE-2023-1728Unrestricted Upload of File with Dangerous Type in Fernus LMSFernus Informatics LMS
- CVE-2022-33288Buffer copy without checking the size of input in CoreQualcomm Snapdragon
- CVE-2022-33269Integer overflow or wraparound in CoreQualcomm Snapdragon
- CVE-2022-33259Buffer copy without checking the size of input in ModemQualcomm Snapdragon
- CVE-2022-33231Double free in CoreQualcomm Snapdragon
- CVE-2022-33211Improper Input Validation in MODEMQualcomm Snapdragon
- CVE-2022-25745Always Incorrect Control Flow Implementation in MODEMQualcomm Snapdragon
- CVE-2022-25740Buffer Copy Without Checking Size of Input in MODEMQualcomm Snapdragon
- CVE-2022-25678Buffer Copy Without Checking Size of Input in MODEMQualcomm Snapdragon
- CVE-2020-19279Directory Traversal vulnerability found in B3log Wide allows a an attacker to escalate privileges via symbolic links.
- CVE-2020-19695Buffer Overflow found in Nginx NJS allows a remote attacker to execute arbitrary code via the njs_object_property parameter of the njs/njs_v
- CVE-2020-20913SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic_title parameter.net.mingsoft:ms-mcms
- CVE-2020-20914SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter.
- CVE-2020-20915SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSite
- CVE-2020-21487Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via th
- CVE-2023-1671A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution Sophos Web Appliance
- CVE-2023-26750SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code vi
- CVE-2023-26866GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3_V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerab
- CVE-2023-26921OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd.
High 68
- CVE-2023-1820Heap buffer overflow in Browser History in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in Google Chrome
- CVE-2023-1818Use after free in Vulkan in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially exploit heap corruption via a crafGoogle Chrome
- CVE-2023-1815Use after free in Networking APIs in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specifGoogle Chrome
- CVE-2023-1812Out of bounds memory access in DOM Bindings in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform out of bounds memorGoogle Chrome
- CVE-2023-1811Use after free in Frames in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI intGoogle Chrome
- CVE-2023-1810Heap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process tGoogle Chrome
- CVE-2023-29003SvelteKit has Insufficient Cross-Site Request Forgery Protectionsveltejs kit · @sveltejs/kit
- CVE-2023-28853Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP databasemastodon
- CVE-2023-28840moby/moby's dockerd daemon encrypted overlay network may be unauthenticatedmoby · github.com/docker/docker
- CVE-2023-27493Envoy doesn't escape HTTP header valuesenvoyproxy envoy
- CVE-2023-1752CVE-2023-1752Nexx Smart Alarm NXAL-100 · Nexx Smart Plug NXPG-100W +1
- CVE-2023-1751CVE-2023-1751Nexx Smart Alarm NXAL-100 · Nexx Smart Plug NXPG-100W +1
- CVE-2023-1750CVE-2023-1750Nexx Smart Alarm NXAL-100 · Nexx Smart Plug NXPG-100W +1
- CVE-2023-27487Envoy client may fake the header `x-envoy-original-path`envoyproxy envoy
- CVE-2023-25941 Dell PowerScale OneFS versions 8.2.x-9.5.0.x contain an elevation of privilege vulnerability.Dell PowerScale OneFS
- CVE-2023-21630Integer Overflow in Multimedia FrameworkQualcomm Snapdragon
- CVE-2022-40532Integer overflow or wraparound in WLANQualcomm Snapdragon
- CVE-2022-40503Buffer over-read in Bluetooth Host.Qualcomm Snapdragon
- CVE-2022-33295Buffer over-read in ModemQualcomm Snapdragon
- CVE-2022-33294NULL pointer dereference in ModemQualcomm Snapdragon
- CVE-2022-33291Buffer over-read in ModemQualcomm Snapdragon
- CVE-2022-33287Buffer over-read in ModemQualcomm Snapdragon
- CVE-2022-33282Integer overflow to buffer overflow in Automotive MultimediaQualcomm Snapdragon
- CVE-2022-33270Time-of-check time-of-use race condition in ModemQualcomm Snapdragon
- CVE-2022-33258Buffer over-read in ModemQualcomm Snapdragon
- CVE-2022-33228Buffer over-read in ModemQualcomm Snapdragon
- CVE-2022-33223Null pointer dereference in ModemQualcomm Snapdragon
- CVE-2022-33222Buffer over-read in ModemQualcomm Snapdragon
- CVE-2022-25747Buffer Over-read in MODEMQualcomm Snapdragon
- CVE-2022-25739Null Point Dereference in MODEMQualcomm Snapdragon
- CVE-2022-25737Use of Uninitialized Variable in MODEMQualcomm Snapdragon
- CVE-2022-25731Incorrect Calculation of Buffer Size in MODEMQualcomm Snapdragon
- CVE-2022-25730Buffer Over-read in MODEMQualcomm Snapdragon
- CVE-2022-25726Buffer Over-read in MODEMQualcomm Snapdragon
- CVE-2020-19278Cross Site Request Forgery vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via the system/github.com/phachon/mm-wiki
- CVE-2020-21060SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrato
- CVE-2020-21514An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default passwfluentd-ui
- CVE-2020-23257Buffer Overflow vulnerability found in Espruino 2v05.41 allows an attacker to cause a denial of service via the function jsvGarbageCollectMa
- CVE-2020-23258An issue found in Jsish v.3.0.11 allows a remote attacker to cause a denial of service via the Jsi_ValueIsNumber function in ./src/jsiValue.
- CVE-2020-23259An issue found in Jsish v.3.0.11 and before allows an attacker to cause a denial of service via the Jsi_Strlen function in the src/jsiChar.c
- CVE-2022-48226An issue was discovered in Acuant AcuFill SDK before 10.22.02.03.
- CVE-2022-48227An issue was discovered in Acuant AsureID Sentinel before 5.2.149.
- CVE-2022-4934A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administratorSophos Web Appliance
- CVE-2023-0265Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server.Uvdesk · uvdesk/community-skeleton
- CVE-2023-0480VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance administrator's account.VitalPBX
- CVE-2023-0835markdown-pdf 11.0.0 - Local File Read via Server Side XSSmarkdown-pdf
- CVE-2023-25303ATLauncher <= 3.4.26.0 is vulnerable to Directory Traversal.
- CVE-2023-25305PolyMC Launcher <= 1.4.3 is vulnerable to Directory Traversal.
- CVE-2023-25355CoreDial sipXcom up to and including 21.04 is vulnerable to Insecure Permissions.
- CVE-2023-25356CoreDial sipXcom up to and including 21.04 is vulnerable to Improper Neutralization of Argument Delimiters in a Command.
- CVE-2023-26733Buffer Overflow vulnerability found in tinyTIFF v.3.0 allows a local attacker to cause a denial of service via the TinyTiffReader_readNextFr
- CVE-2023-26855The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictiona
- CVE-2023-26976Tenda AC6 v15.03.05.09_multi was discovered to contain a stack overflow via the ssid parameter in the form_fast_setting_wifi_set function.
- CVE-2023-26991SWFTools v0.9.2 was discovered to contain a stack-use-after-scope in the swf_ReadSWF2 function in lib/rfxswf.c.
- CVE-2023-27089Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login par
- CVE-2023-27759An issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsC
- CVE-2023-27760An issue found in Wondershare Technology Co, Ltd Filmora v.12.0.9 allows a remote attacker to execute arbitrary commands via the filmora_set
- CVE-2023-27761An issue found in Wondershare Technology Co., Ltd UniConverter v.14.0.0 allows a remote attacker to execute arbitrary commands via the unico
- CVE-2023-27762An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democre
- CVE-2023-27763An issue found in Wondershare Technology Co.,Ltd MobileTrans v.4.0.2 allows a remote attacker to execute arbitrary commands via the mobiletr
- CVE-2023-27764An issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote attacker to execute arbitrary commands via the repairit_se
- CVE-2023-27765An issue found in Wondershare Technology Co.,Ltd Recoverit v.10.6.3 allows a remote attacker to execute arbitrary commands via the recoverit
- CVE-2023-27766An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_
- CVE-2023-27767An issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone_setu
- CVE-2023-27768An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement
- CVE-2023-27769An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreader
- CVE-2023-27770An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-max
- CVE-2023-27771An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the won
Medium, low and unrated 77
- CVE-2023-1823Inappropriate implementation in FedCM in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions viGoogle Chrome
- CVE-2023-1822Incorrect security UI in Navigation in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform domain spoofing via a craftGoogle Chrome
- CVE-2023-1821Inappropriate implementation in WebShare in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially hide the contents Google Chrome
- CVE-2023-1819Out of bounds read in Accessibility in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform an out of bounds memory reaGoogle Chrome
- CVE-2023-1817Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigationGoogle Chrome
- CVE-2023-1816Incorrect security UI in Picture In Picture in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially perform navigatGoogle Chrome
- CVE-2023-1814Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass downGoogle Chrome
- CVE-2023-1813Inappropriate implementation in Extensions in Google Chrome prior to 112.0.5615.49 allowed an attacker who convinced a user to install a malGoogle Chrome
- CVE-2023-28841moby/moby's dockerd daemon encrypted overlay network traffic may be unencryptedmoby · github.com/docker/docker
- CVE-2023-28842moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticatedmoby · github.com/docker/docker
- CVE-2023-27496Envoy may crash when a redirect url without a state param is received in the oauth filterenvoyproxy envoy
- CVE-2023-1840Sp*tify Play Button for WordPress <= 2.07 - Authenticated (Administrator+) Stored Cross-Site Scriptingjonkastonka Sp*tify Play Button for WordPress
- CVE-2023-27492Envoy may crash when a large request body is processed in Lua filterenvoyproxy envoy
- CVE-2023-27491Envoy forwards invalid Http2/Http3 downstream headersenvoyproxy envoy
- CVE-2023-27488Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.envoyproxy envoy
- CVE-2023-1749CVE-2023-1749Nexx Smart Alarm NXAL-100 · Nexx Smart Plug NXPG-100W +1
- CVE-2023-26437Deterred spoofing attempts can lead to authoritative servers being marked unavailablePowerDNS Recursor
- CVE-2022-48435In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log fileJetBrains PhpStorm
- CVE-2023-23977WordPress Heateor Social Comments Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)Team Heateor WordPress Social Comments Plugin for Vkontakte…
- CVE-2023-29000Nextcloud Desktop client does not verify received singed certificate in end-to-end encryptionnextcloud security-advisories
- CVE-2023-28999Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE foldersnextcloud security-advisories
- CVE-2023-28998Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keysnextcloud security-advisories
- CVE-2023-23870WordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)wpdevart Responsive Vertical Icon Menu
- CVE-2023-28997Nextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access filesnextcloud security-advisories
- CVE-2023-28848CSRF protection on user_oidc login returned the expected token in case of an errornextcloud security-advisories
- CVE-2023-23878WordPress WP Google Map Plugin Plugin <= 4.3.9 is vulnerable to Cross Site Scripting (XSS)flippercode WordPress Plugin for Google Maps – WP MAPS
- CVE-2023-23821WordPress Interactive Polish Map Plugin <= 1.2 is vulnerable to Cross Site Scripting (XSS)Marcin Pietrzak Interactive Polish Map
- CVE-2023-23686WordPress Simple Staff List Plugin <= 2.2.2 is vulnerable to Cross Site Scripting (XSS)Brett Shumaker Simple Staff List
- CVE-2022-41633WordPress Community by PeepSo Plugin <= 6.0.2.0 is vulnerable to Cross Site Request Forgery (CSRF)Community by PeepSo – Social Network, Membership, Registrat…
- CVE-2023-23685WordPress Portfolio – WordPress Portfolio Plugin Plugin <= 2.8.10 is vulnerable to Cross Site Scripting (XSS)RadiusTheme Portfolio – WordPress Portfolio Plugin
- CVE-2023-25942 Dell PowerScale OneFS versions 8.2.x-9.4.x contain an uncontrolled resource consumption vulnerability.Dell PowerScale OneFS
- CVE-2023-25940 Dell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access vulnerability in isi_gather_info.Dell PowerScale OneFS
- CVE-2023-1827SourceCodester Centralized Covid Vaccination Records System GET Parameter manage_location.php sql injectionSourceCodester Centralized Covid Vaccination Records System
- CVE-2023-1826SourceCodester Online Computer and Laptop Store index.php unrestricted uploadSourceCodester Online Computer and Laptop Store
- CVE-2023-1768Symmetric agent data encryption fails silentlyTribe29 Checkmk
- CVE-2022-33302Improper validation of array index in User Identity ModuleQualcomm Snapdragon
- CVE-2022-33301Incorrect type conversion or cast in AudioQualcomm Snapdragon
- CVE-2022-33298Use after free in ModemQualcomm Snapdragon
- CVE-2022-33297Buffer overread in Linux SensorsQualcomm Snapdragon
- CVE-2022-33296Integer overflow to buffer overflow in ModemQualcomm Snapdragon
- CVE-2022-33289Improper validation of array index in ModemQualcomm Snapdragon
- CVE-2020-19277Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code igithub.com/phachon/mm-wiki
- CVE-2020-19692Buffer Overflow vulnerabilty found in Nginx NJS v.0feca92 allows a remote attacker to execute arbitrary code via the njs_module_read in the
- CVE-2020-19693An issue found in Espruino Espruino 6ea4c0a allows an attacker to execute arbitrrary code via oldFunc parameter of the jswrap_object.c:jswra
- CVE-2020-19697Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted scripteditor.md
- CVE-2020-19698Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted scripteditor.md
- CVE-2020-19699Cross Site Scripting vulnerability found in KOHGYLW Kiftd v.1.0.18 allows a remote attacker to execute arbitrary code via the <ifram> tag in
- CVE-2020-19850An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.directus
- CVE-2020-20521Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter.
- CVE-2020-20522Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the registering user parame
- CVE-2020-22533Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter
- CVE-2020-23260An issue found in Jsish v.3.0.11 and before allows an attacker to cause a denial of service via the StringReplaceCmd function in the src/jsi
- CVE-2020-23327Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload i
- CVE-2020-29312An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function.
- CVE-2020-36692A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScriSophos Web Appliance
- CVE-2021-28235Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function.go.etcd.io/etcd/v3
- CVE-2021-31707Permissions vulnerability found in KiteCMS allows a remote attacker to execute arbitrary code via the upload file type.
- CVE-2021-3267File Upload vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the uploadFile function.
- CVE-2022-47870A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows remote attackers to i
- CVE-2022-48221An issue was discovered in Acuant AcuFill SDK before 10.22.02.03.
- CVE-2022-48222An issue was discovered in Acuant AcuFill SDK before 10.22.02.03.
- CVE-2022-48223An issue was discovered in Acuant AcuFill SDK before 10.22.02.03.
- CVE-2022-48224An issue was discovered in Acuant AcuFill SDK before 10.22.02.03.
- CVE-2022-48225An issue was discovered in Acuant AcuFill SDK before 10.22.02.03.
- CVE-2022-48228An issue was discovered in Acuant AsureID Sentinel before 5.2.149.
- CVE-2023-0325Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application.Uvdesk · uvdesk/community-skeleton
- CVE-2023-0357Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application.Helpy
- CVE-2023-0486VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link.VitalPBX
- CVE-2023-0738OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application.OrangeScrum
- CVE-2023-26775File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the asse
- CVE-2023-26776Cross Site Scripting vulnerability found in Monitorr v.1.7.6 allows a remote attacker to execute arbitrary code via the title parameter of t
- CVE-2023-26777Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary command
- CVE-2023-26974Irfanview v4.62 allows a user-mode write access violation via a crafted JPEG 2000 file starting at JPEG2000+0x0000000000001bf0.
- CVE-2023-27091An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s).
- CVE-2023-27734An issue found in Eteran edb-debugger v.1.3.0 allows a local attacker to causea denial of service via the collect_symbols function in plugin
- CVE-2023-28613An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300.
- CVE-2023-29323ascii_load_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit