CVEs published April 10, 2023
78 CVEs were published on April 10, 2023: 19 critical, 20 high. 2 are now in CISA KEV.
- Published
- 78
- Critical
- 19
- High
- 20
- Medium
- 32
- Low
- 6
- Unrated
- 1
- Now in CISA KEV
- 2
- Fix available
- 42
Most affected products
- Apache Software Foundation Apache Linkis · org.apache.linki…
- 5
- Apple macOS
- 4
- Pegasystems RPA: Synchronization Engine
- 3
- Simple Giveaways
- 3
- All-In-One Security
- 2
- WP Tiles
- 2
- yuan1994 tpAdmin · yuan1994/tpadmin
- 2
- Apple iOS
- 1
- Apple iOS and iPadOS
- 1
- Apple iOS and iPadOS · Apple macOS
- 1
Critical 19
- CVE-2023-1478Hummingbird < 3.4.2 - Unauthenticated Path Traversal Hummingbird
- CVE-2023-29216Apache Linkis DatasourceManager module has a deserialization command executionApache Software Foundation Apache Linkis · org.apache.linki…
- CVE-2023-27987Apache Linkis gateway module token authentication bypassApache Software Foundation Apache Linkis · org.apache.linki…
- CVE-2023-27603Apache Linkis Mangaer module engineConn material upload exists Zip Slip issueApache Software Foundation Apache Linkis · org.apache.linki…
- CVE-2023-27602Apache Linkis publicsercice module unrestricted upload of fileApache Software Foundation Apache Linkis · org.apache.linki…
- CVE-2023-29215Apache Linkis JDBC EngineCon has a deserialization command executionApache Software Foundation Apache Linkis · org.apache.linki…
- CVE-2022-41976An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application
- CVE-2022-46709A memory corruption issue was addressed with improved state management.Apple macOS
- CVE-2023-26063Certain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type.
- CVE-2023-26064Certain Lexmark devices through 2023-02-19 have an Out-of-bounds Write.
- CVE-2023-26065Certain Lexmark devices through 2023-02-19 have an Integer Overflow.
- CVE-2023-26066Certain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.
- CVE-2023-26068Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).
- CVE-2023-26069Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 3 of 4).
- CVE-2023-26070Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 4 of 4).
- CVE-2023-27076Command injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter.
- CVE-2023-27178An arbitrary file upload vulnerability in the upload function of GDidees CMS 3.9.1 allows attackers to execute arbitrary code via a crafted
- CVE-2023-27650An issue found in APUS Group Launcher v.3.10.73 and v.3.10.88 allows a remote attacker to execute arbitrary code via the FONT_FILE parameter
- CVE-2023-29375An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, a
High 20
- CVE-2023-29005No Rate Limiting on Login AUTH DBdpgaspar Flask-AppBuilder · flask-appbuilder
- CVE-2023-1381WP Meta SEO < 4.5.5 - Author+ PHAR DeserializationWP Meta SEO
- CVE-2023-1425Groundhogg Contacts < 2.7.9.4 - Admin+ SQLiWordPress CRM, Email & Marketing Automation for WordPress |…
- CVE-2023-1406JetEngine < 3.1.3.1 - Author+ Remote Code ExecutionJetEngine
- CVE-2020-36077SQL injection vulnerability found in Tailor Mangement System v.1 allows a remote attacker to execute arbitrary code via the customer paramet
- CVE-2021-45985In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read.
- CVE-2022-42858A memory corruption issue was addressed with improved input validation.Apple macOS
- CVE-2022-46716A logic issue was addressed with improved state management.Apple macOS
- CVE-2023-1668A flaw was found in openvswitch (OVS).openvswitch
- CVE-2023-26067Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).
- CVE-2023-26466A user with non-Admin access can change a configuration file on the client to modify the Server URL.Pegasystems RPA: Synchronization Engine
- CVE-2023-26467A man in the middle can redirect traffic to a malicious server in a compromised configuration.Pegasystems RPA: Synchronization Engine
- CVE-2023-26495An issue was discovered in Open Design Alliance Drawings SDK before 2024.1.
- CVE-2023-26774An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sales.php component of
- CVE-2023-26860SQL injection vulnerability found in PrestaShop Igbudget v.1.0.3 and before allow a remote attacker to gain privileges via the LgBudgetBudge
- CVE-2023-26919delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape.
- CVE-2023-26986An issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary commands on a victim host via user interaction w
- CVE-2023-28093A user with a compromised configuration can start an unsigned binary as a service.Pegasystems RPA: Synchronization Engine
- CVE-2023-28205A use after free issue was addressed with improved memory management.Apple iOS and iPadOS · Apple Safari +1
- CVE-2023-28206An out-of-bounds write issue was addressed with improved input validation.Apple iOS and iPadOS · Apple macOS
Medium, low and unrated 39
- CVE-2023-29192SilverwareGames.io users with access to the game upload panel are able to edit download links for games uploaded by other developersmesosoi silverwaregames-io-issue-tracker
- CVE-2018-25084Ping Identity Self-Service Account Manager SSAMController.java cross site scriptingPing Identity Self-Service Account Manager
- CVE-2015-10100Dynamic Widgets Plugin dynwid_class.php sql injectionDynamic Widgets Plugin
- CVE-2023-1971yuan1994 tpAdmin Upload.php remote server-side request forgeryyuan1994 tpAdmin · yuan1994/tpadmin
- CVE-2023-1970yuan1994 tpAdmin Upload.php Upload unrestricted uploadyuan1994 tpAdmin · yuan1994/tpadmin
- CVE-2023-1969SourceCodester Online Eyewear Shop GET Parameter manage_stock.php sql injectionSourceCodester Online Eyewear Shop
- CVE-2023-0546FluentForms < 4.3.25 - Contributor+ Stored XSS via Custom HTML Form FieldContact Form Plugin
- CVE-2023-0157All-In-One Security (AIOS) < 5.1.5 - Admin+ Stored XSSAll-In-One Security
- CVE-2022-4827WP Tiles <= 1.1.2 - Contributor+ Stored XSSWP Tiles
- CVE-2023-1121Simple Giveaways < 2.45.1 - Admin+ Stored Cross-Site ScriptingSimple Giveaways
- CVE-2023-0874Klaviyo <= 3.0.10 - Admin+ Stored XSSKlaviyo
- CVE-2023-0423WordPress Amazon S3 Plugin < 1.6 - Reflected XSSWordPress Amazon S3 Plugin
- CVE-2023-0422Article Directory <= 1.3 - Admin+ Stored XSSArticle Directory
- CVE-2023-1120Simple Giveaways < 2.45.1 - Admin+ Stored XSSSimple Giveaways
- CVE-2023-0156All-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via TraversalAll-In-One Security
- CVE-2023-0983Stylish Cost Calculator Premium < 7.9.0 - Unauthenticated Stored XSSStylish Cost Calculator Premium
- CVE-2023-0605Auto Rename Media On Upload < 1.1.0 - Admin+ Stored XSSAuto Rename Media On Upload
- CVE-2023-1426WP Tiles <= 1.1.2 - Subscriber+ Draft/Private Post Title DisclosureWP Tiles
- CVE-2023-0893Time Sheets < 1.29.3 - Admin+ Stored XSSTime Sheets
- CVE-2023-1122Simple Giveaways < 2.45.1 - Editor+ Stored Cross-Site ScriptingSimple Giveaways
- CVE-2023-0363Scheduled Announcements Widget < 1.0 - Contributor+ Stored XSSScheduled Announcements Widget
- CVE-2015-10099CP Appointment Calendar Plugin dex_appointments.php dex_process_ready_to_go_appointment sql injectionCP Appointment Calendar Plugin
- CVE-2023-26120This affects all versions of the package com.xuxueli:xxl-job.com.xuxueli:xxl-job
- CVE-2014-125098Dart http_server Directory Listing virtual_directory.dart VirtualDirectory cross site scriptingDart http_server
- CVE-2014-125097BestWebSoft Facebook Like Button facebook-button-plugin.php fcbkbttn_settings_page cross site scriptingBestWebSoft Facebook Like Button
- CVE-2014-125096Fancy Gallery Plugin Options Page class.options.php cross site scriptingFancy Gallery Plugin
- CVE-2022-32871A logic issue was addressed with improved restrictions.Apple iOS
- CVE-2022-37462A stored Cross-Site Scripting (XSS) vulnerability in the Chat gadget in Upstream Works Agent Desktop for Cisco Finesse through 4.2.12 and 5.
- CVE-2022-39048Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment_redirectServicenow Now Platform
- CVE-2022-46703A logic issue was addressed with improved restrictions.Apple macOS
- CVE-2022-46717A logic issue was addressed with improved restrictions.Apple iOS and iPadOS
- CVE-2023-1916A flaw was found in tiffcrop, a program distributed by the libtiff package.libtiff
- CVE-2023-24181LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the co
- CVE-2023-24721A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML.
- CVE-2023-25392Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.bigflow
- CVE-2023-26773Cross Site Scripting vulnerability found in Sales Tracker Management System v.1.0 allows a remote attacker to gain privileges via the produc
- CVE-2023-26788Veritas Appliance v4.1.0.1 is affected by Host Header Injection attacks.
- CVE-2023-29376An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, a
- CVE-2023-30456An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8.