# CVEs published 2023-04-04

165 CVEs were published on April 4, 2023: 20 critical, 68 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-1823](https://cve.now/CVE-2023-1823.md): Inappropriate implementation in FedCM in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass navigation restrictions vi (no CVSS, Google Chrome)
- [CVE-2023-1822](https://cve.now/CVE-2023-1822.md): Incorrect security UI in Navigation in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform domain spoofing via a craft (no CVSS, Google Chrome)
- [CVE-2023-1821](https://cve.now/CVE-2023-1821.md): Inappropriate implementation in WebShare in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially hide the contents (no CVSS, Google Chrome)
- [CVE-2023-1820](https://cve.now/CVE-2023-1820.md): Heap buffer overflow in Browser History in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in (CVSS 8.8, Google Chrome)
- [CVE-2023-1819](https://cve.now/CVE-2023-1819.md): Out of bounds read in Accessibility in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform an out of bounds memory rea (no CVSS, Google Chrome)
- [CVE-2023-1818](https://cve.now/CVE-2023-1818.md): Use after free in Vulkan in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially exploit heap corruption via a craf (CVSS 8.8, Google Chrome)
- [CVE-2023-1817](https://cve.now/CVE-2023-1817.md): Insufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49 allowed a remote attacker to bypass navigation (no CVSS, Google Chrome)
- [CVE-2023-1816](https://cve.now/CVE-2023-1816.md): Incorrect security UI in Picture In Picture in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to potentially perform navigat (no CVSS, Google Chrome)
- [CVE-2023-1815](https://cve.now/CVE-2023-1815.md): Use after free in Networking APIs in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specif (CVSS 8.8, Google Chrome)
- [CVE-2023-1814](https://cve.now/CVE-2023-1814.md): Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to bypass down (no CVSS, Google Chrome)
- [CVE-2023-1813](https://cve.now/CVE-2023-1813.md): Inappropriate implementation in Extensions in Google Chrome prior to 112.0.5615.49 allowed an attacker who convinced a user to install a mal (no CVSS, Google Chrome)
- [CVE-2023-1812](https://cve.now/CVE-2023-1812.md): Out of bounds memory access in DOM Bindings in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to perform out of bounds memor (CVSS 8.8, Google Chrome)
- [CVE-2023-1811](https://cve.now/CVE-2023-1811.md): Use after free in Frames in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who convinced a user to engage in specific UI int (CVSS 8.8, Google Chrome)
- [CVE-2023-1810](https://cve.now/CVE-2023-1810.md): Heap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who had compromised the renderer process t (CVSS 8.8, Google Chrome)
- [CVE-2023-29003](https://cve.now/CVE-2023-29003.md): SvelteKit has Insufficient Cross-Site Request Forgery Protection (CVSS 8.8, sveltejs kit · @sveltejs/kit)
- [CVE-2023-28853](https://cve.now/CVE-2023-28853.md): Mastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database (CVSS 7.7, mastodon)
- [CVE-2023-28840](https://cve.now/CVE-2023-28840.md): moby/moby's dockerd daemon encrypted overlay network may be unauthenticated (CVSS 7.5, moby · github.com/docker/docker)
- [CVE-2023-28841](https://cve.now/CVE-2023-28841.md): moby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted (CVSS 6.8, moby · github.com/docker/docker)
- [CVE-2023-28842](https://cve.now/CVE-2023-28842.md): moby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated (CVSS 6.8, moby · github.com/docker/docker)
- [CVE-2023-27496](https://cve.now/CVE-2023-27496.md): Envoy may crash when a redirect url without a state param is received in the oauth filter (CVSS 6.5, envoyproxy envoy)
- [CVE-2023-27493](https://cve.now/CVE-2023-27493.md): Envoy doesn't escape HTTP header values (CVSS 8.1, envoyproxy envoy)
- [CVE-2023-1840](https://cve.now/CVE-2023-1840.md): Sp\*tify Play Button for WordPress \<= 2.07 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 4.4, jonkastonka Sp\*tify Play Button for WordPress)
- [CVE-2023-27492](https://cve.now/CVE-2023-27492.md): Envoy may crash when a large request body is processed in Lua filter (CVSS 4.8, envoyproxy envoy)
- [CVE-2023-27491](https://cve.now/CVE-2023-27491.md): Envoy forwards invalid Http2/Http3 downstream headers (CVSS 5.4, envoyproxy envoy)
- [CVE-2023-27488](https://cve.now/CVE-2023-27488.md): Envoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received. (CVSS 5.4, envoyproxy envoy)
- [CVE-2023-1748](https://cve.now/CVE-2023-1748.md): CVE-2023-1748 (CVSS 9.3, Nexx Smart Alarm NXAL-100 · Nexx Smart Plug NXPG-100W +1)
- [CVE-2023-1752](https://cve.now/CVE-2023-1752.md): CVE-2023-1752 (CVSS 8.1, Nexx Smart Alarm NXAL-100 · Nexx Smart Plug NXPG-100W +1)
- [CVE-2023-1749](https://cve.now/CVE-2023-1749.md): CVE-2023-1749 (CVSS 6.5, Nexx Smart Alarm NXAL-100 · Nexx Smart Plug NXPG-100W +1)
- [CVE-2023-1751](https://cve.now/CVE-2023-1751.md): CVE-2023-1751 (CVSS 7.5, Nexx Smart Alarm NXAL-100 · Nexx Smart Plug NXPG-100W +1)
- [CVE-2023-1750](https://cve.now/CVE-2023-1750.md): CVE-2023-1750 (CVSS 7.1, Nexx Smart Alarm NXAL-100 · Nexx Smart Plug NXPG-100W +1)
- [CVE-2023-27487](https://cve.now/CVE-2023-27487.md): Envoy client may fake the header \`x-envoy-original-path\` (CVSS 8.2, envoyproxy envoy)
- [CVE-2023-26437](https://cve.now/CVE-2023-26437.md): Deterred spoofing attempts can lead to authoritative servers being marked unavailable (CVSS 3.4, PowerDNS Recursor)
- [CVE-2022-48435](https://cve.now/CVE-2022-48435.md): In JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file (CVSS 3.3, JetBrains PhpStorm)
- [CVE-2023-23977](https://cve.now/CVE-2023-23977.md): WordPress Heateor Social Comments Plugin \<= 1.6.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Team Heateor WordPress Social Comments Plugin for Vkontakte…)
- [CVE-2023-29000](https://cve.now/CVE-2023-29000.md): Nextcloud Desktop client does not verify received singed certificate in end-to-end encryption (CVSS 5.4, nextcloud security-advisories)
- [CVE-2023-28999](https://cve.now/CVE-2023-28999.md): Nextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders (CVSS 6.9, nextcloud security-advisories)
- [CVE-2023-28998](https://cve.now/CVE-2023-28998.md): Nextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys (CVSS 6.7, nextcloud security-advisories)
- [CVE-2023-23870](https://cve.now/CVE-2023-23870.md): WordPress Responsive Vertical Icon Menu Plugin \<= 1.5.8 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, wpdevart Responsive Vertical Icon Menu)
- [CVE-2023-28997](https://cve.now/CVE-2023-28997.md): Nextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access files (CVSS 6.7, nextcloud security-advisories)
- [CVE-2023-28848](https://cve.now/CVE-2023-28848.md): CSRF protection on user\_oidc login returned the expected token in case of an error (CVSS 4.8, nextcloud security-advisories)
- [CVE-2023-23878](https://cve.now/CVE-2023-23878.md): WordPress WP Google Map Plugin Plugin \<= 4.3.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, flippercode WordPress Plugin for Google Maps – WP MAPS)
- [CVE-2023-23821](https://cve.now/CVE-2023-23821.md): WordPress Interactive Polish Map Plugin \<= 1.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.9, Marcin Pietrzak Interactive Polish Map)
- [CVE-2023-23686](https://cve.now/CVE-2023-23686.md): WordPress Simple Staff List Plugin \<= 2.2.2 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Brett Shumaker Simple Staff List)
- [CVE-2022-41633](https://cve.now/CVE-2022-41633.md): WordPress Community by PeepSo Plugin \<= 6.0.2.0 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 5.4, Community by PeepSo – Social Network, Membership, Registrat…)
- [CVE-2023-23685](https://cve.now/CVE-2023-23685.md): WordPress Portfolio – WordPress Portfolio Plugin Plugin \<= 2.8.10 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, RadiusTheme Portfolio – WordPress Portfolio Plugin)
- [CVE-2023-25942](https://cve.now/CVE-2023-25942.md): Dell PowerScale OneFS versions 8.2.x-9.4.x contain an uncontrolled resource consumption vulnerability. (CVSS 6.5, Dell PowerScale OneFS)
- [CVE-2023-25941](https://cve.now/CVE-2023-25941.md): Dell PowerScale OneFS versions 8.2.x-9.5.0.x contain an elevation of privilege vulnerability. (CVSS 7.8, Dell PowerScale OneFS)
- [CVE-2023-25940](https://cve.now/CVE-2023-25940.md): Dell PowerScale OneFS version 9.5.0.0 contains improper link resolution before file access vulnerability in isi\_gather\_info. (CVSS 6.7, Dell PowerScale OneFS)
- [CVE-2023-1827](https://cve.now/CVE-2023-1827.md): SourceCodester Centralized Covid Vaccination Records System GET Parameter manage\_location.php sql injection (CVSS 6.3, SourceCodester Centralized Covid Vaccination Records System)
- [CVE-2023-1826](https://cve.now/CVE-2023-1826.md): SourceCodester Online Computer and Laptop Store index.php unrestricted upload (CVSS 6.3, SourceCodester Online Computer and Laptop Store)
- [CVE-2023-1728](https://cve.now/CVE-2023-1728.md): Unrestricted Upload of File with Dangerous Type in Fernus LMS (CVSS 9.8, Fernus Informatics LMS)
- [CVE-2023-1768](https://cve.now/CVE-2023-1768.md): Symmetric agent data encryption fails silently (CVSS 3.7, Tribe29 Checkmk)
- [CVE-2023-21630](https://cve.now/CVE-2023-21630.md): Integer Overflow in Multimedia Framework (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-40532](https://cve.now/CVE-2022-40532.md): Integer overflow or wraparound in WLAN (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-40503](https://cve.now/CVE-2022-40503.md): Buffer over-read in Bluetooth Host. (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33302](https://cve.now/CVE-2022-33302.md): Improper validation of array index in User Identity Module (CVSS 6.8, Qualcomm Snapdragon)
- [CVE-2022-33301](https://cve.now/CVE-2022-33301.md): Incorrect type conversion or cast in Audio (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33298](https://cve.now/CVE-2022-33298.md): Use after free in Modem (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-33297](https://cve.now/CVE-2022-33297.md): Buffer overread in Linux Sensors (CVSS 6.8, Qualcomm Snapdragon)
- [CVE-2022-33296](https://cve.now/CVE-2022-33296.md): Integer overflow to buffer overflow in Modem (CVSS 5.9, Qualcomm Snapdragon)
- [CVE-2022-33295](https://cve.now/CVE-2022-33295.md): Buffer over-read in Modem (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33294](https://cve.now/CVE-2022-33294.md): NULL pointer dereference in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33291](https://cve.now/CVE-2022-33291.md): Buffer over-read in Modem (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33289](https://cve.now/CVE-2022-33289.md): Improper validation of array index in Modem (CVSS 6.8, Qualcomm Snapdragon)
- [CVE-2022-33288](https://cve.now/CVE-2022-33288.md): Buffer copy without checking the size of input in Core (CVSS 9.3, Qualcomm Snapdragon)
- [CVE-2022-33287](https://cve.now/CVE-2022-33287.md): Buffer over-read in Modem (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33282](https://cve.now/CVE-2022-33282.md): Integer overflow to buffer overflow in Automotive Multimedia (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-33270](https://cve.now/CVE-2022-33270.md): Time-of-check time-of-use race condition in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33269](https://cve.now/CVE-2022-33269.md): Integer overflow or wraparound in Core (CVSS 9.3, Qualcomm Snapdragon)
- [CVE-2022-33259](https://cve.now/CVE-2022-33259.md): Buffer copy without checking the size of input in Modem (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2022-33258](https://cve.now/CVE-2022-33258.md): Buffer over-read in Modem (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33231](https://cve.now/CVE-2022-33231.md): Double free in Core (CVSS 9.3, Qualcomm Snapdragon)
- [CVE-2022-33228](https://cve.now/CVE-2022-33228.md): Buffer over-read in Modem (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33223](https://cve.now/CVE-2022-33223.md): Null pointer dereference in Modem (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33222](https://cve.now/CVE-2022-33222.md): Buffer over-read in Modem (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33211](https://cve.now/CVE-2022-33211.md): Improper Input Validation in MODEM (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2022-25747](https://cve.now/CVE-2022-25747.md): Buffer Over-read in MODEM (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-25745](https://cve.now/CVE-2022-25745.md): Always Incorrect Control Flow Implementation in MODEM (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2022-25740](https://cve.now/CVE-2022-25740.md): Buffer Copy Without Checking Size of Input in MODEM (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2022-25739](https://cve.now/CVE-2022-25739.md): Null Point Dereference in MODEM (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-25737](https://cve.now/CVE-2022-25737.md): Use of Uninitialized Variable in MODEM (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-25731](https://cve.now/CVE-2022-25731.md): Incorrect Calculation of Buffer Size in MODEM (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-25730](https://cve.now/CVE-2022-25730.md): Buffer Over-read in MODEM (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-25726](https://cve.now/CVE-2022-25726.md): Buffer Over-read in MODEM (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-25678](https://cve.now/CVE-2022-25678.md): Buffer Copy Without Checking Size of Input in MODEM (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2020-19277](https://cve.now/CVE-2020-19277.md): Cross Site Scripting vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via javascript code i (CVSS 5.4, github.com/phachon/mm-wiki)
- [CVE-2020-19278](https://cve.now/CVE-2020-19278.md): Cross Site Request Forgery vulnerability found in Phachon mm-wiki v.0.1.2 allows a remote attacker to execute arbitrary code via the system/ (CVSS 8.8, github.com/phachon/mm-wiki)
- [CVE-2020-19279](https://cve.now/CVE-2020-19279.md): Directory Traversal vulnerability found in B3log Wide allows a an attacker to escalate privileges via symbolic links. (CVSS 9.8)
- [CVE-2020-19692](https://cve.now/CVE-2020-19692.md): Buffer Overflow vulnerabilty found in Nginx NJS v.0feca92 allows a remote attacker to execute arbitrary code via the njs\_module\_read in the (no CVSS)
- [CVE-2020-19693](https://cve.now/CVE-2020-19693.md): An issue found in Espruino Espruino 6ea4c0a allows an attacker to execute arbitrrary code via oldFunc parameter of the jswrap\_object.c:jswra (no CVSS)
- [CVE-2020-19695](https://cve.now/CVE-2020-19695.md): Buffer Overflow found in Nginx NJS allows a remote attacker to execute arbitrary code via the njs\_object\_property parameter of the njs/njs\_v (CVSS 9.8)
- [CVE-2020-19697](https://cve.now/CVE-2020-19697.md): Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script (CVSS 6.1, editor.md)
- [CVE-2020-19698](https://cve.now/CVE-2020-19698.md): Cross Site Scripting vulnerability found in Pandao Editor.md v.1.5.0 allows a remote attacker to execute arbitrary code via a crafted script (CVSS 6.1, editor.md)
- [CVE-2020-19699](https://cve.now/CVE-2020-19699.md): Cross Site Scripting vulnerability found in KOHGYLW Kiftd v.1.0.18 allows a remote attacker to execute arbitrary code via the \<ifram\> tag in (CVSS 6.1)
- [CVE-2020-19850](https://cve.now/CVE-2020-19850.md): An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests. (CVSS 6.5, directus)
- [CVE-2020-20521](https://cve.now/CVE-2020-20521.md): Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the comment parameter. (CVSS 6.1)
- [CVE-2020-20522](https://cve.now/CVE-2020-20522.md): Cross Site Scripting vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the registering user parame (CVSS 6.1)
- [CVE-2020-20913](https://cve.now/CVE-2020-20913.md): SQL Injection vulnerability found in Ming-Soft MCMS v.4.7.2 allows a remote attacker to execute arbitrary code via basic\_title parameter. (CVSS 9.8, net.mingsoft:ms-mcms)
- [CVE-2020-20914](https://cve.now/CVE-2020-20914.md): SQL Injection vulnerability found in San Luan PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via the sql parameter. (CVSS 9.8)
- [CVE-2020-20915](https://cve.now/CVE-2020-20915.md): SQL Injection vulnerability found in PublicCMS v.4.0 allows a remote attacker to execute arbitrary code via sql parameter of the the SysSite (CVSS 9.8)
- [CVE-2020-21060](https://cve.now/CVE-2020-21060.md): SQL injection vulnerability found in PHPMyWind v.5.6 allows a remote attacker to gain privileges via the delete function of the administrato (CVSS 8.8)
- [CVE-2020-21487](https://cve.now/CVE-2020-21487.md): Cross Site Scripting vulnerability found in Netgate pfSense 2.4.4 and ACME package v.0.6.3 allows attackers to execute arbitrary code via th (CVSS 9.6)
- [CVE-2020-21514](https://cve.now/CVE-2020-21514.md): An issue was discovered in Fluent-ui v.1.2.2 allows attackers to gain escalated privileges and execute arbitrary code due to a default passw (CVSS 8.8, fluentd-ui)
- [CVE-2020-22533](https://cve.now/CVE-2020-22533.md): Cross Site Scripting vulnerability found in Zentao allows a remote attacker to execute arbitrary code via the lang parameter (CVSS 6.1)
- [CVE-2020-23257](https://cve.now/CVE-2020-23257.md): Buffer Overflow vulnerability found in Espruino 2v05.41 allows an attacker to cause a denial of service via the function jsvGarbageCollectMa (CVSS 7.5)
- [CVE-2020-23258](https://cve.now/CVE-2020-23258.md): An issue found in Jsish v.3.0.11 allows a remote attacker to cause a denial of service via the Jsi\_ValueIsNumber function in ./src/jsiValue. (CVSS 7.5)
- [CVE-2020-23259](https://cve.now/CVE-2020-23259.md): An issue found in Jsish v.3.0.11 and before allows an attacker to cause a denial of service via the Jsi\_Strlen function in the src/jsiChar.c (CVSS 7.5)
- [CVE-2020-23260](https://cve.now/CVE-2020-23260.md): An issue found in Jsish v.3.0.11 and before allows an attacker to cause a denial of service via the StringReplaceCmd function in the src/jsi (no CVSS)
- [CVE-2020-23327](https://cve.now/CVE-2020-23327.md): Cross Site Scripting vulnerability found in ZblogCN ZblogPHP v.1.0 allows a local attacker to execute arbitrary code via a crafted payload i (no CVSS)
- [CVE-2020-29312](https://cve.now/CVE-2020-29312.md): An issue found in Zend Framework v.3.1.3 and before allow a remote attacker to execute arbitrary code via the unserialize function. (no CVSS)
- [CVE-2020-36692](https://cve.now/CVE-2020-36692.md): A reflected XSS via POST vulnerability in report scheduler of Sophos Web Appliance versions older than 4.3.10.4 allows execution of JavaScri (CVSS 6.5, Sophos Web Appliance)
- [CVE-2021-28235](https://cve.now/CVE-2021-28235.md): Authentication vulnerability found in Etcd-io v.3.4.10 allows remote attackers to escalate privileges via the debug function. (no CVSS, go.etcd.io/etcd/v3)
- [CVE-2021-31707](https://cve.now/CVE-2021-31707.md): Permissions vulnerability found in KiteCMS allows a remote attacker to execute arbitrary code via the upload file type. (no CVSS)
- [CVE-2021-3267](https://cve.now/CVE-2021-3267.md): File Upload vulnerability found in KiteCMS v.1.1 allows a remote attacker to execute arbitrary code via the uploadFile function. (no CVSS)
- [CVE-2022-47870](https://cve.now/CVE-2022-47870.md): A Cross Site Scripting (XSS) vulnerability in the web SQL monitor login page in Redgate SQL Monitor 12.1.31.893 allows remote attackers to i (CVSS 6.1)
- [CVE-2022-48221](https://cve.now/CVE-2022-48221.md): An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. (no CVSS)
- [CVE-2022-48222](https://cve.now/CVE-2022-48222.md): An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. (no CVSS)
- [CVE-2022-48223](https://cve.now/CVE-2022-48223.md): An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. (no CVSS)
- [CVE-2022-48224](https://cve.now/CVE-2022-48224.md): An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. (no CVSS)
- [CVE-2022-48225](https://cve.now/CVE-2022-48225.md): An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. (no CVSS)
- [CVE-2022-48226](https://cve.now/CVE-2022-48226.md): An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. (CVSS 8.4)
- [CVE-2022-48227](https://cve.now/CVE-2022-48227.md): An issue was discovered in Acuant AsureID Sentinel before 5.2.149. (CVSS 7.8)
- [CVE-2022-48228](https://cve.now/CVE-2022-48228.md): An issue was discovered in Acuant AsureID Sentinel before 5.2.149. (CVSS 5.5)
- [CVE-2022-4934](https://cve.now/CVE-2022-4934.md): A post-auth command injection vulnerability in the exception wizard of Sophos Web Appliance older than version 4.3.10.4 allows administrator (CVSS 7.2, Sophos Web Appliance)
- [CVE-2023-0265](https://cve.now/CVE-2023-0265.md): Uvdesk version 1.1.1 allows an authenticated remote attacker to execute commands on the server. (CVSS 8.8, Uvdesk · uvdesk/community-skeleton)
- [CVE-2023-0325](https://cve.now/CVE-2023-0325.md): Uvdesk version 1.1.1 allows an unauthenticated remote attacker to exploit a stored XSS in the application. (CVSS 6.1, Uvdesk · uvdesk/community-skeleton)
- [CVE-2023-0357](https://cve.now/CVE-2023-0357.md): Helpy version 2.8.0 allows an unauthenticated remote attacker to exploit an XSS stored in the application. (CVSS 6.1, Helpy)
- [CVE-2023-0480](https://cve.now/CVE-2023-0480.md): VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance administrator's account. (CVSS 8.8, VitalPBX)
- [CVE-2023-0486](https://cve.now/CVE-2023-0486.md): VitalPBX version 3.2.3-8 allows an unauthenticated external attacker to obtain the instance's administrator account via a malicious link. (CVSS 6.1, VitalPBX)
- [CVE-2023-0738](https://cve.now/CVE-2023-0738.md): OrangeScrum version 2.0.11 allows an external attacker to obtain arbitrary user accounts from the application. (CVSS 6.1, OrangeScrum)
- [CVE-2023-0835](https://cve.now/CVE-2023-0835.md): markdown-pdf 11.0.0 - Local File Read via Server Side XSS (CVSS 8.2, markdown-pdf)
- [CVE-2023-1671](https://cve.now/CVE-2023-1671.md): A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10.4 allows execution (CVSS 9.8, KEV, Sophos Web Appliance)
- [CVE-2023-25303](https://cve.now/CVE-2023-25303.md): ATLauncher \<= 3.4.26.0 is vulnerable to Directory Traversal. (CVSS 7.1)
- [CVE-2023-25305](https://cve.now/CVE-2023-25305.md): PolyMC Launcher \<= 1.4.3 is vulnerable to Directory Traversal. (CVSS 7.1)
- [CVE-2023-25355](https://cve.now/CVE-2023-25355.md): CoreDial sipXcom up to and including 21.04 is vulnerable to Insecure Permissions. (CVSS 8.8)
- [CVE-2023-25356](https://cve.now/CVE-2023-25356.md): CoreDial sipXcom up to and including 21.04 is vulnerable to Improper Neutralization of Argument Delimiters in a Command. (CVSS 8.8)
- [CVE-2023-26733](https://cve.now/CVE-2023-26733.md): Buffer Overflow vulnerability found in tinyTIFF v.3.0 allows a local attacker to cause a denial of service via the TinyTiffReader\_readNextFr (CVSS 7.8)
- [CVE-2023-26750](https://cve.now/CVE-2023-26750.md): SQL injection vulnerability found in Yii Framework Yii 2 Framework before v.2.0.47 allows the a remote attacker to execute arbitrary code vi (CVSS 9.8)
- [CVE-2023-26775](https://cve.now/CVE-2023-26775.md): File Upload vulnerability found in Monitorr v.1.7.6 allows a remote attacker t oexecute arbitrary code via a crafted file upload to the asse (no CVSS)
- [CVE-2023-26776](https://cve.now/CVE-2023-26776.md): Cross Site Scripting vulnerability found in Monitorr v.1.7.6 allows a remote attacker to execute arbitrary code via the title parameter of t (CVSS 6.1)
- [CVE-2023-26777](https://cve.now/CVE-2023-26777.md): Cross Site Scripting vulnerability found in : louislam Uptime Kuma v.1.19.6 and before allows a remote attacker to execute arbitrary command (CVSS 6.1)
- [CVE-2023-26855](https://cve.now/CVE-2023-26855.md): The hashing algorithm of ChurchCRM v4.5.3 utilizes a non-random salt value which allows attackers to use precomputed hash tables or dictiona (CVSS 7.5)
- [CVE-2023-26866](https://cve.now/CVE-2023-26866.md): GreenPacket OH736's WR-1200 Indoor Unit, OT-235 with firmware versions M-IDU-1.6.0.3\_V1.1 and MH-46360-2.0.3-R5-GP respectively are vulnerab (CVSS 9.8)
- [CVE-2023-26921](https://cve.now/CVE-2023-26921.md): OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql\_atfwd. (CVSS 9.8)
- [CVE-2023-26974](https://cve.now/CVE-2023-26974.md): Irfanview v4.62 allows a user-mode write access violation via a crafted JPEG 2000 file starting at JPEG2000+0x0000000000001bf0. (CVSS 5.5)
- [CVE-2023-26976](https://cve.now/CVE-2023-26976.md): Tenda AC6 v15.03.05.09\_multi was discovered to contain a stack overflow via the ssid parameter in the form\_fast\_setting\_wifi\_set function. (CVSS 7.5)
- [CVE-2023-26991](https://cve.now/CVE-2023-26991.md): SWFTools v0.9.2 was discovered to contain a stack-use-after-scope in the swf\_ReadSWF2 function in lib/rfxswf.c. (CVSS 7.8)
- [CVE-2023-27089](https://cve.now/CVE-2023-27089.md): Cross Site Scripting vulnerability found in Ehuacui BBS allows attackers to cause a denial of service via a crafted payload in the login par (CVSS 8.2)
- [CVE-2023-27091](https://cve.now/CVE-2023-27091.md): An unauthorized access issue found in XiaoBingby TeaCMS 2.3.3 allows attackers to escalate privileges via the id and keywords parameter(s). (no CVSS)
- [CVE-2023-27734](https://cve.now/CVE-2023-27734.md): An issue found in Eteran edb-debugger v.1.3.0 allows a local attacker to causea denial of service via the collect\_symbols function in plugin (CVSS 5.5)
- [CVE-2023-27759](https://cve.now/CVE-2023-27759.md): An issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsC (CVSS 7.8)
- [CVE-2023-27760](https://cve.now/CVE-2023-27760.md): An issue found in Wondershare Technology Co, Ltd Filmora v.12.0.9 allows a remote attacker to execute arbitrary commands via the filmora\_set (CVSS 7.8)
- [CVE-2023-27761](https://cve.now/CVE-2023-27761.md): An issue found in Wondershare Technology Co., Ltd UniConverter v.14.0.0 allows a remote attacker to execute arbitrary commands via the unico (CVSS 7.8)
- [CVE-2023-27762](https://cve.now/CVE-2023-27762.md): An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democre (CVSS 7.8)
- [CVE-2023-27763](https://cve.now/CVE-2023-27763.md): An issue found in Wondershare Technology Co.,Ltd MobileTrans v.4.0.2 allows a remote attacker to execute arbitrary commands via the mobiletr (CVSS 7.8)
- [CVE-2023-27764](https://cve.now/CVE-2023-27764.md): An issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote attacker to execute arbitrary commands via the repairit\_se (CVSS 7.8)
- [CVE-2023-27765](https://cve.now/CVE-2023-27765.md): An issue found in Wondershare Technology Co.,Ltd Recoverit v.10.6.3 allows a remote attacker to execute arbitrary commands via the recoverit (CVSS 7.8)
- [CVE-2023-27766](https://cve.now/CVE-2023-27766.md): An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel\_setup\_ (CVSS 7.8)
- [CVE-2023-27767](https://cve.now/CVE-2023-27767.md): An issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone\_setu (CVSS 7.8)
- [CVE-2023-27768](https://cve.now/CVE-2023-27768.md): An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement (CVSS 7.8)
- [CVE-2023-27769](https://cve.now/CVE-2023-27769.md): An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreader (CVSS 7.8)
- [CVE-2023-27770](https://cve.now/CVE-2023-27770.md): An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-max (CVSS 7.8)
- [CVE-2023-27771](https://cve.now/CVE-2023-27771.md): An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the won (CVSS 7.8)
- [CVE-2023-28613](https://cve.now/CVE-2023-28613.md): An issue was discovered in Samsung Exynos Mobile Processor and Baseband Modem Processor for Exynos 1280, Exynos 2200, and Exynos Modem 5300. (CVSS 6.8)
- [CVE-2023-29323](https://cve.now/CVE-2023-29323.md): ascii\_load\_sockaddr in smtpd in OpenBSD before 7.1 errata 024 and 7.2 before errata 020, and OpenSMTPD Portable before 7.0.0-portable commit (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.