# CVEs published 2023-04-10

78 CVEs were published on April 10, 2023: 19 critical, 20 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-29192](https://cve.now/CVE-2023-29192.md): SilverwareGames.io users with access to the game upload panel are able to edit download links for games uploaded by other developers (CVSS 2.7, mesosoi silverwaregames-io-issue-tracker)
- [CVE-2023-29005](https://cve.now/CVE-2023-29005.md): No Rate Limiting on Login AUTH DB (CVSS 7.5, dpgaspar Flask-AppBuilder · flask-appbuilder)
- [CVE-2018-25084](https://cve.now/CVE-2018-25084.md): Ping Identity Self-Service Account Manager SSAMController.java cross site scripting (CVSS 3.5, Ping Identity Self-Service Account Manager)
- [CVE-2015-10100](https://cve.now/CVE-2015-10100.md): Dynamic Widgets Plugin dynwid\_class.php sql injection (CVSS 6.3, Dynamic Widgets Plugin)
- [CVE-2023-1971](https://cve.now/CVE-2023-1971.md): yuan1994 tpAdmin Upload.php remote server-side request forgery (CVSS 6.3, yuan1994 tpAdmin · yuan1994/tpadmin)
- [CVE-2023-1970](https://cve.now/CVE-2023-1970.md): yuan1994 tpAdmin Upload.php Upload unrestricted upload (CVSS 6.3, yuan1994 tpAdmin · yuan1994/tpadmin)
- [CVE-2023-1969](https://cve.now/CVE-2023-1969.md): SourceCodester Online Eyewear Shop GET Parameter manage\_stock.php sql injection (CVSS 6.3, SourceCodester Online Eyewear Shop)
- [CVE-2023-1381](https://cve.now/CVE-2023-1381.md): WP Meta SEO \< 4.5.5 - Author+ PHAR Deserialization (CVSS 8.8, WP Meta SEO)
- [CVE-2023-0546](https://cve.now/CVE-2023-0546.md): FluentForms \< 4.3.25 - Contributor+ Stored XSS via Custom HTML Form Field (CVSS 5.4, Contact Form Plugin)
- [CVE-2023-0157](https://cve.now/CVE-2023-0157.md): All-In-One Security (AIOS) \< 5.1.5 - Admin+ Stored XSS (CVSS 4.8, All-In-One Security)
- [CVE-2022-4827](https://cve.now/CVE-2022-4827.md): WP Tiles \<= 1.1.2 - Contributor+ Stored XSS (CVSS 5.4, WP Tiles)
- [CVE-2023-1121](https://cve.now/CVE-2023-1121.md): Simple Giveaways \< 2.45.1 - Admin+ Stored Cross-Site Scripting (CVSS 4.8, Simple Giveaways)
- [CVE-2023-0874](https://cve.now/CVE-2023-0874.md): Klaviyo \<= 3.0.10 - Admin+ Stored XSS (CVSS 4.8, Klaviyo)
- [CVE-2023-0423](https://cve.now/CVE-2023-0423.md): WordPress Amazon S3 Plugin \< 1.6 - Reflected XSS (CVSS 4.8, WordPress Amazon S3 Plugin)
- [CVE-2023-0422](https://cve.now/CVE-2023-0422.md): Article Directory \<= 1.3 - Admin+ Stored XSS (CVSS 4.8, Article Directory)
- [CVE-2023-1120](https://cve.now/CVE-2023-1120.md): Simple Giveaways \< 2.45.1 - Admin+ Stored XSS (CVSS 4.8, Simple Giveaways)
- [CVE-2023-0156](https://cve.now/CVE-2023-0156.md): All-In-One Security (AIOS) \< 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal (CVSS 4.9, All-In-One Security)
- [CVE-2023-1478](https://cve.now/CVE-2023-1478.md): Hummingbird \< 3.4.2 - Unauthenticated Path Traversal (CVSS 9.8, Hummingbird)
- [CVE-2023-0983](https://cve.now/CVE-2023-0983.md): Stylish Cost Calculator Premium \< 7.9.0 - Unauthenticated Stored XSS (CVSS 6.1, Stylish Cost Calculator Premium)
- [CVE-2023-0605](https://cve.now/CVE-2023-0605.md): Auto Rename Media On Upload \< 1.1.0 - Admin+ Stored XSS (CVSS 4.8, Auto Rename Media On Upload)
- [CVE-2023-1425](https://cve.now/CVE-2023-1425.md): Groundhogg Contacts \< 2.7.9.4 - Admin+ SQLi (CVSS 7.2, WordPress CRM, Email & Marketing Automation for WordPress |…)
- [CVE-2023-1426](https://cve.now/CVE-2023-1426.md): WP Tiles \<= 1.1.2 - Subscriber+ Draft/Private Post Title Disclosure (CVSS 6.5, WP Tiles)
- [CVE-2023-1406](https://cve.now/CVE-2023-1406.md): JetEngine \< 3.1.3.1 - Author+ Remote Code Execution (CVSS 8.8, JetEngine)
- [CVE-2023-0893](https://cve.now/CVE-2023-0893.md): Time Sheets \< 1.29.3 - Admin+ Stored XSS (CVSS 4.8, Time Sheets)
- [CVE-2023-1122](https://cve.now/CVE-2023-1122.md): Simple Giveaways \< 2.45.1 - Editor+ Stored Cross-Site Scripting (CVSS 4.8, Simple Giveaways)
- [CVE-2023-0363](https://cve.now/CVE-2023-0363.md): Scheduled Announcements Widget \< 1.0 - Contributor+ Stored XSS (CVSS 5.4, Scheduled Announcements Widget)
- [CVE-2015-10099](https://cve.now/CVE-2015-10099.md): CP Appointment Calendar Plugin dex\_appointments.php dex\_process\_ready\_to\_go\_appointment sql injection (CVSS 6.3, CP Appointment Calendar Plugin)
- [CVE-2023-29216](https://cve.now/CVE-2023-29216.md): Apache Linkis DatasourceManager module has a deserialization command execution (CVSS 9.8, Apache Software Foundation Apache Linkis · org.apache.linki…)
- [CVE-2023-27987](https://cve.now/CVE-2023-27987.md): Apache Linkis gateway module token authentication bypass (CVSS 9.1, Apache Software Foundation Apache Linkis · org.apache.linki…)
- [CVE-2023-27603](https://cve.now/CVE-2023-27603.md): Apache Linkis Mangaer module engineConn material upload exists Zip Slip issue (CVSS 9.8, Apache Software Foundation Apache Linkis · org.apache.linki…)
- [CVE-2023-27602](https://cve.now/CVE-2023-27602.md): Apache Linkis publicsercice module unrestricted upload of file (CVSS 9.8, Apache Software Foundation Apache Linkis · org.apache.linki…)
- [CVE-2023-29215](https://cve.now/CVE-2023-29215.md): Apache Linkis JDBC EngineCon has a deserialization command execution (CVSS 9.8, Apache Software Foundation Apache Linkis · org.apache.linki…)
- [CVE-2023-26120](https://cve.now/CVE-2023-26120.md): This affects all versions of the package com.xuxueli:xxl-job. (CVSS 5.4, com.xuxueli:xxl-job)
- [CVE-2014-125098](https://cve.now/CVE-2014-125098.md): Dart http\_server Directory Listing virtual\_directory.dart VirtualDirectory cross site scripting (CVSS 4.3, Dart http\_server)
- [CVE-2014-125097](https://cve.now/CVE-2014-125097.md): BestWebSoft Facebook Like Button facebook-button-plugin.php fcbkbttn\_settings\_page cross site scripting (CVSS 3.5, BestWebSoft Facebook Like Button)
- [CVE-2014-125096](https://cve.now/CVE-2014-125096.md): Fancy Gallery Plugin Options Page class.options.php cross site scripting (CVSS 3.5, Fancy Gallery Plugin)
- [CVE-2020-36077](https://cve.now/CVE-2020-36077.md): SQL injection vulnerability found in Tailor Mangement System v.1 allows a remote attacker to execute arbitrary code via the customer paramet (CVSS 8.8)
- [CVE-2021-45985](https://cve.now/CVE-2021-45985.md): In Lua 5.4.3, an erroneous finalizer called during a tail call leads to a heap-based buffer over-read. (CVSS 7.5)
- [CVE-2022-32871](https://cve.now/CVE-2022-32871.md): A logic issue was addressed with improved restrictions. (CVSS 2.4, Apple iOS)
- [CVE-2022-37462](https://cve.now/CVE-2022-37462.md): A stored Cross-Site Scripting (XSS) vulnerability in the Chat gadget in Upstream Works Agent Desktop for Cisco Finesse through 4.2.12 and 5. (CVSS 5.4)
- [CVE-2022-39048](https://cve.now/CVE-2022-39048.md): Cross-Site Scripting (XSS) vulnerability in ServiceNow UI page assessment\_redirect (CVSS 6.1, Servicenow Now Platform)
- [CVE-2022-41976](https://cve.now/CVE-2022-41976.md): An privilege escalation issue was discovered in Scada-LTS 2.7.1.1 build 2948559113 allows remote attackers, authenticated in the application (CVSS 9.9)
- [CVE-2022-42858](https://cve.now/CVE-2022-42858.md): A memory corruption issue was addressed with improved input validation. (CVSS 7.8, Apple macOS)
- [CVE-2022-46703](https://cve.now/CVE-2022-46703.md): A logic issue was addressed with improved restrictions. (CVSS 5.5, Apple macOS)
- [CVE-2022-46709](https://cve.now/CVE-2022-46709.md): A memory corruption issue was addressed with improved state management. (CVSS 9.8, Apple macOS)
- [CVE-2022-46716](https://cve.now/CVE-2022-46716.md): A logic issue was addressed with improved state management. (CVSS 7.5, Apple macOS)
- [CVE-2022-46717](https://cve.now/CVE-2022-46717.md): A logic issue was addressed with improved restrictions. (CVSS 2.4, Apple iOS and iPadOS)
- [CVE-2023-1668](https://cve.now/CVE-2023-1668.md): A flaw was found in openvswitch (OVS). (CVSS 8.2, openvswitch)
- [CVE-2023-1916](https://cve.now/CVE-2023-1916.md): A flaw was found in tiffcrop, a program distributed by the libtiff package. (no CVSS, libtiff)
- [CVE-2023-24181](https://cve.now/CVE-2023-24181.md): LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the co (CVSS 5.4)
- [CVE-2023-24721](https://cve.now/CVE-2023-24721.md): A cross-site scripting (XSS) vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary web scripts or HTML. (CVSS 5.4)
- [CVE-2023-25392](https://cve.now/CVE-2023-25392.md): Allegro Tech BigFlow \<1.6 is vulnerable to Missing SSL Certificate Validation. (CVSS 5.9, bigflow)
- [CVE-2023-26063](https://cve.now/CVE-2023-26063.md): Certain Lexmark devices through 2023-02-19 access a Resource By Using an Incompatible Type. (CVSS 9.8)
- [CVE-2023-26064](https://cve.now/CVE-2023-26064.md): Certain Lexmark devices through 2023-02-19 have an Out-of-bounds Write. (CVSS 9.8)
- [CVE-2023-26065](https://cve.now/CVE-2023-26065.md): Certain Lexmark devices through 2023-02-19 have an Integer Overflow. (CVSS 9.8)
- [CVE-2023-26066](https://cve.now/CVE-2023-26066.md): Certain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index. (CVSS 9.8)
- [CVE-2023-26067](https://cve.now/CVE-2023-26067.md): Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4). (CVSS 8.1)
- [CVE-2023-26068](https://cve.now/CVE-2023-26068.md): Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4). (CVSS 9.8)
- [CVE-2023-26069](https://cve.now/CVE-2023-26069.md): Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 3 of 4). (CVSS 9.8)
- [CVE-2023-26070](https://cve.now/CVE-2023-26070.md): Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 4 of 4). (CVSS 9.8)
- [CVE-2023-26466](https://cve.now/CVE-2023-26466.md): A user with non-Admin access can change a configuration file on the client to modify the Server URL. (CVSS 7.8, Pegasystems RPA: Synchronization Engine)
- [CVE-2023-26467](https://cve.now/CVE-2023-26467.md): A man in the middle can redirect traffic to a malicious server in a compromised configuration. (CVSS 8.1, Pegasystems RPA: Synchronization Engine)
- [CVE-2023-26495](https://cve.now/CVE-2023-26495.md): An issue was discovered in Open Design Alliance Drawings SDK before 2024.1. (CVSS 7.8)
- [CVE-2023-26773](https://cve.now/CVE-2023-26773.md): Cross Site Scripting vulnerability found in Sales Tracker Management System v.1.0 allows a remote attacker to gain privileges via the produc (CVSS 6.1)
- [CVE-2023-26774](https://cve.now/CVE-2023-26774.md): An issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access sensitive information via sales.php component of (CVSS 7.5)
- [CVE-2023-26788](https://cve.now/CVE-2023-26788.md): Veritas Appliance v4.1.0.1 is affected by Host Header Injection attacks. (CVSS 6.1)
- [CVE-2023-26860](https://cve.now/CVE-2023-26860.md): SQL injection vulnerability found in PrestaShop Igbudget v.1.0.3 and before allow a remote attacker to gain privileges via the LgBudgetBudge (CVSS 8.8)
- [CVE-2023-26919](https://cve.now/CVE-2023-26919.md): delight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. (CVSS 7.2)
- [CVE-2023-26986](https://cve.now/CVE-2023-26986.md): An issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary commands on a victim host via user interaction w (CVSS 7.8)
- [CVE-2023-27076](https://cve.now/CVE-2023-27076.md): Command injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute arbitrary code via a the language parameter. (CVSS 9.8)
- [CVE-2023-27178](https://cve.now/CVE-2023-27178.md): An arbitrary file upload vulnerability in the upload function of GDidees CMS 3.9.1 allows attackers to execute arbitrary code via a crafted (CVSS 9.8)
- [CVE-2023-27650](https://cve.now/CVE-2023-27650.md): An issue found in APUS Group Launcher v.3.10.73 and v.3.10.88 allows a remote attacker to execute arbitrary code via the FONT\_FILE parameter (CVSS 9.8)
- [CVE-2023-28093](https://cve.now/CVE-2023-28093.md): A user with a compromised configuration can start an unsigned binary as a service. (CVSS 7.5, Pegasystems RPA: Synchronization Engine)
- [CVE-2023-28205](https://cve.now/CVE-2023-28205.md): A use after free issue was addressed with improved memory management. (CVSS 8.8, KEV, Apple iOS and iPadOS · Apple Safari +1)
- [CVE-2023-28206](https://cve.now/CVE-2023-28206.md): An out-of-bounds write issue was addressed with improved input validation. (CVSS 8.6, KEV, Apple iOS and iPadOS · Apple macOS)
- [CVE-2023-29375](https://cve.now/CVE-2023-29375.md): An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, a (CVSS 9.8)
- [CVE-2023-29376](https://cve.now/CVE-2023-29376.md): An issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1 before 14.1.7826, 14.2 before 14.2.7930, a (CVSS 5.4)
- [CVE-2023-30456](https://cve.now/CVE-2023-30456.md): An issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.