CVEs published April 11, 2023
236 CVEs were published on April 11, 2023: 12 critical, 111 high. 3 are now in CISA KEV.
- Published
- 236
- Critical
- 12
- High
- 111
- Medium
- 104
- Low
- 9
- Unrated
- 0
- Now in CISA KEV
- 3
- Fix available
- 114
Most affected products
- Microsoft Windows
- 56
- Microsoft Windows Server
- 15
- Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- 11
- Microsoft Visual Studio
- 4
- SAP Application Interface Framework
- 4
- SourceCodester Online Computer and Laptop Store
- 4
- answerdev/answer · github.com/answerdev/answer
- 3
- Contec CO. CONPROSYS IoT Gateway products
- 3
- Fortinet FortiClientWindows
- 3
- Microsoft Windows Server · Microsoft Windows
- 3
Critical 12
- CVE-2023-28250Windows Pragmatic General Multicast (PGM) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-21554Microsoft Message Queuing (MSMQ) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-41331A missing authentication for critical function vulnerability [CWE-306] in FortiPresence infrastructure server before version 1.2.1 allows a Fortinet FortiPresence
- CVE-2023-28489A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05).Siemens CP-8031 MASTER MODULE · Siemens CP-8050 MASTER MODU…
- CVE-2023-28765Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )SAP BusinessObjects Business Intelligence Platform
- CVE-2023-27497Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)SAP Diagnostics Agent
- CVE-2023-27267Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge)SAP Diagnostics Agent
- CVE-2020-19802File Upload vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the upload file type paramete
- CVE-2023-27192An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the key_wifi_safe_net_check_url, KEY_
- CVE-2023-27645An issue found in POWERAMP audioplayer build 925 bundle play and build 954 allows a remote attacker to gain privileges via the reverb and EQ
- CVE-2023-28808Some Hikvision Hybrid SAN/Cluster Storage products have an access control vulnerability which can be used to obtain the admin permission.hikvision DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A72024/…
- CVE-2023-29492Novi Survey before 8.9.43676 allows remote attackers to execute arbitrary code on the server in the context of the service account.
High 111
- CVE-2023-28311Microsoft Word Remote Code Execution VulnerabilityMicrosoft Office 2019 for Mac · Microsoft 365 Apps for E… +1
- CVE-2023-28304Microsoft ODBC and OLE DB Remote Code Execution VulnerabilityMicrosoft ODBC Driver 17 for SQL Server · Microsoft OLE… +2
- CVE-2023-28302Microsoft Message Queuing (MSMQ) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-28296Visual Studio Remote Code Execution VulnerabilityMicrosoft Visual Studio
- CVE-2023-28293Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28262Visual Studio Elevation of Privilege VulnerabilityMicrosoft Visual Studio
- CVE-2023-28260.NET DLL Hijacking Remote Code Execution VulnerabilityMicrosoft .NET · Microsoft Visual Studio +5
- CVE-2023-28254Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-28275Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-28252Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28274Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28273Windows Clip Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28272Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28248Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28247Windows Network File System Information Disclosure VulnerabilityMicrosoft Windows Server
- CVE-2023-28246Windows Registry Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2023-28268Netlogon RPC Elevation of Privilege VulnerabilityMicrosoft Windows Server
- CVE-2023-28244Windows Kerberos Elevation of Privilege VulnerabilityMicrosoft Windows Server
- CVE-2023-28243Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-28241Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-28240Windows Network Load Balancing Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-28238Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-28237Windows Kernel Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-28236Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28234Windows Secure Channel Denial of Service VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2023-28233Windows Secure Channel Denial of Service VulnerabilityMicrosoft Windows Server · Microsoft Windows
- CVE-2023-28232Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-28231DHCP Server Service Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-28229Windows CNG Key Isolation Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28227Windows Bluetooth Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-28225Windows NTLM Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28224Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-28220Layer 2 Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-28219Layer 2 Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24929Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24887Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24928Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24886Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24927Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24885Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24926Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24884Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24925Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24924Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-24912Windows Graphics Component Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-24860Microsoft Defender Denial of Service VulnerabilityMicrosoft Malware Protection Engine
- CVE-2023-23375Microsoft ODBC and OLE DB Remote Code Execution VulnerabilityMicrosoft OLE DB Driver 18 for SQL Server · Microsoft OL… +2
- CVE-2023-24893Visual Studio Code Remote Code Execution VulnerabilityMicrosoft Visual Studio Code
- CVE-2023-28309Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-28300Azure Service Connector Security Feature Bypass VulnerabilityMicrosoft Azure Service Connector
- CVE-2023-28297Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28292Raw Image Extension Remote Code Execution VulnerabilityMicrosoft Raw Image Extension
- CVE-2023-28291Raw Image Extension Remote Code Execution VulnerabilityMicrosoft Raw Image Extension
- CVE-2023-28288Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft Share… +1
- CVE-2023-28285Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office 2019 for Mac · Microsoft 365 Apps for E… +1
- CVE-2023-28222Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28221Windows Error Reporting Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28218Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-28217Windows Network Address Translation (NAT) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-28216Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-24931Windows Secure Channel Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-24914Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-23384Microsoft SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server 2008 Service Pack · Microsoft SQL S… +2
- CVE-2023-21769Microsoft Message Queuing (MSMQ) Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-21727Remote Procedure Call Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-27487A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptorFortinet FortiDeceptor · Fortinet FortiSandbox
- CVE-2022-43946Multiple vulnerabilities including an incorrect permission assignment for critical resource [CWE-732] vulnerability and a time-of-check timeFortinet FortiClientWindows
- CVE-2022-43955An improper neutralization of input during web page generation [CWE-79] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3Fortinet FortiWeb
- CVE-2022-42470A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allFortinet FortiClientWindows
- CVE-2022-40682A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attackeFortinet FortiClientWindows
- CVE-2022-40679An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in FortiADC 5.x all versions, 6.0 all versions, Fortinet FortiDDoS · Fortinet FortiDDoS-F +1
- CVE-2023-27995A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an auFortinet FortiSOAR
- CVE-2022-41330An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') [CWE-79] in Fortinet FortiOS version 7Fortinet FortiProxy · Fortinet FortiOS
- CVE-2023-28062 Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability.Dell PPDM Reporting
- CVE-2022-47338In telecom service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2023-29053A vulnerability has been identified in JT Open (All versions < V11.3.2.0), JT Utilities (All versions < V13.3.0.0).Siemens JT Open · Siemens JT Utilities
- CVE-2023-28766A vulnerability has been identified in SIPROTEC 5 6MD85 (CP300) (All versions >= V7.80 < V9.40), SIPROTEC 5 6MD86 (CP300) (All versions >= VSiemens SIPROTEC 5 6MD85 · Siemens SIPROTEC 5 6MD86 +35
- CVE-2023-26293A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation PSiemens Totally Integrated Automation Portal (TIA Portal)
- CVE-2022-43768A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +13
- CVE-2022-43767A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +13
- CVE-2022-43716A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions < V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30-Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +13
- CVE-2023-26122All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization.safe-eval
- CVE-2023-26121All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its psafe-eval
- CVE-2023-29186Directory/Path Traversal vulnerability in SAP NetWeaver.SAP NetWeaver
- CVE-2020-19803Cross Site Request Forgery vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the background
- CVE-2021-46878An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb_pack_msgpack_to_json_format leads to type confusion bug
- CVE-2021-46879An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in
- CVE-2022-38604Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability.
- CVE-2023-1974Exposure of Sensitive Information Through Metadata in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-1975Insertion of Sensitive Information Into Sent Data in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-1989Kernel: use after free bug in btsdio_remove due to race conditionlinux · Red Hat Enterprise Linux +1
- CVE-2023-22282WAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path.ELECOM CO. WAB-MAT
- CVE-2023-22429Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which mWolt Delivery: Food and more
- CVE-2023-22612An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2023-22613An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2023-22614An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2023-22615An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2023-24544Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product.BUFFALO BS-GSL and BS-GS series
- CVE-2023-25407Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control.
- CVE-2023-25409Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control.
- CVE-2023-25413Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control.
- CVE-2023-25755Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory JTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-25950HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate usHAProxy Technologies HAProxy
- CVE-2023-26588Use of hard-coded credentials vulnerability in Buffalo network devices allows an attacker to access the debug function of the product.BUFFALO BS-GSL and BS-GS series
- CVE-2023-26593CENTUM series provided by Yokogawa Electric Corporation are vulnerable to cleartext storage of sensitive information.Yokogawa Electric CENTUM series
- CVE-2023-26917libyang from v2.0.164 to v2.1.30 was discovered to contain a NULL pointer dereference via the function lysp_stmt_validate_value at lys_parse
- CVE-2023-26964An issue was discovered in hyper v0.13.7.h2
- CVE-2023-27179GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdow
- CVE-2023-27191An issue found in DUALSPACE Super Secuirty v.2.3.7 allows an attacker to cause a denial of service via the SharedPreference files.
- CVE-2023-27389Inadequate encryption strength vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker with an administrativeContec CO. CONPROSYS IoT Gateway products
- CVE-2023-27917OS command injection vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker who can access Network MaintenanContec CO. CONPROSYS IoT Gateway products
Medium, low and unrated 113
- CVE-2023-28312Azure Machine Learning Information Disclosure VulnerabilityMicrosoft Azure Machine Learning
- CVE-2023-28308Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-28307Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-28306Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-28299Visual Studio Spoofing VulnerabilityMicrosoft Visual Studio
- CVE-2023-28263Visual Studio Information Disclosure VulnerabilityMicrosoft Visual Studio
- CVE-2023-28256Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-28278Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-28255Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-28277Windows DNS Server Information Disclosure VulnerabilityMicrosoft Windows Server
- CVE-2023-28276Windows Group Policy Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-28253Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-28249Windows Boot Manager Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-28271Windows Kernel Memory Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-28270Windows Lock Screen Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-28269Windows Boot Manager Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-28267Remote Desktop Protocol Client Information Disclosure VulnerabilityMicrosoft Windows · Microsoft Remote Desktop client for Win…
- CVE-2023-28266Windows Common Log File System Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-28235Windows Lock Screen Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-28228Windows Spoofing VulnerabilityMicrosoft Windows
- CVE-2023-28226Windows Enroll Engine Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2023-28223Windows Domain Name Service Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-24883Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-28314Microsoft Dynamics 365 (on-premises) Cross-site Scripting VulnerabilityMicrosoft Dynamics 365 (on-premises)
- CVE-2023-28313Microsoft Dynamics 365 Customer Voice Cross-Site Scripting VulnerabilityMicrosoft Send Customer Voice survey from Dynamics
- CVE-2023-28305Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2023-28298Windows Kernel Denial of Service VulnerabilityMicrosoft Windows
- CVE-2023-21729Remote Procedure Call Runtime Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2023-28301Microsoft Edge (Chromium-based) Tampering VulnerabilityMicrosoft Edge for Android
- CVE-2023-24935Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2023-28284Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2023-1988SourceCodester Online Computer and Laptop Store cross site scriptingSourceCodester Online Computer and Laptop Store
- CVE-2023-1987SourceCodester Online Computer and Laptop Store update_order_status sql injectionSourceCodester Online Computer and Laptop Store
- CVE-2023-1986SourceCodester Online Computer and Laptop Store delete_order sql injectionSourceCodester Online Computer and Laptop Store
- CVE-2023-1939No access control for the OTP key on OTP entriesDevolutions Remote Desktop Manager
- CVE-2023-1980Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factorDevolutions Remote Desktop Manager
- CVE-2023-1985SourceCodester Online Computer and Laptop Store save_brand sql injectionSourceCodester Online Computer and Laptop Store
- CVE-2023-1984SourceCodester Complaint Management System POST Parameter check_availability.php sql injectionSourceCodester Complaint Management System
- CVE-2023-1983SourceCodester Sales Tracker Management System GET Parameter manage_product.php sql injectionSourceCodester Sales Tracker Management System
- CVE-2022-35850An improper neutralization of script-related HTML tags in a web page vulnerability [CWE-80] in FortiAuthenticator versions 6.4.0 through 6.4Fortinet FortiAuthenticator
- CVE-2022-42469A permissive list of allowed inputs vulnerability [CWE-183] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW Fortinet FortiOS
- CVE-2023-22642An improper certificate validation vulnerability [CWE-295] in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8Fortinet FortiAnalyzer · Fortinet FortiManager
- CVE-2022-27485A improper neutralization of special elements used in an sql command ('sql injection') vulnerability [CWE-89] in Fortinet FortiSandbox versiFortinet FortiSandbox
- CVE-2022-43947An improper restriction of excessive authentication attempts vulnerability [CWE-307] in Fortinet FortiOS version 7.2.0 through 7.2.3 and befFortinet FortiOS · Fortinet FortiProxy
- CVE-2022-43952An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability [CWE-79] in FortiADC version 7.1.1 andFortinet FortiADC
- CVE-2022-42477An improper input validation vulnerability [CWE-20] in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may Fortinet FortiAnalyzer
- CVE-2023-22641A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, Fortinet FortiOS · Fortinet FortiProxy
- CVE-2022-43948A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0.Fortinet FortiWeb · Fortinet FortiADC
- CVE-2022-43951An exposure of sensitive information to an unauthorized actor vulnerability [CWE-200] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 anFortinet FortiNAC
- CVE-2023-22635A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 allFortinet FortiClientMac
- CVE-2022-43770Hitachi Vantara Pentaho Business Analytics Server - Incorrect AuthorizationHitachi Vantara Pentaho Business Analytics Server
- CVE-2022-3695Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation Hitachi Vantara Pentaho Business Analytics Server
- CVE-2023-1552ToolboxST Deserialization of Untrusted Configuration DataGE Gas Power ToolboxST
- CVE-2023-30465Apache InLong: SQL injection in apache inLong 1.5.0Apache Software Foundation Apache InLong · org.apache.in… +1
- CVE-2023-0645Out of Bounds read in libjxlLibjxl
- CVE-2022-47468In telecom service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-47467In telecom service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-47466In telecom service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-47465In vdsp service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-47464In telecom service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-47463In telecom service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-47362In telecom service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-47337In media service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-47336In telecom service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2022-47335In telecom service, there is a missing permission check.Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…
- CVE-2023-29054A vulnerability has been identified in SCALANCE X200-4P IRT (All versions < V5.5.2), SCALANCE X201-3P IRT (All versions < V5.5.2), SCALANCE Siemens SCALANCE X200-4P IRT · Siemens SCALANCE X201-3P… +8
- CVE-2023-28828A vulnerability has been identified in Polarion ALM (All versions < V22R2).Siemens Polarion ALM
- CVE-2023-27464A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions < V3.7.1), Mendix Forgot Password (Mendix Siemens Mendix Forgot Password
- CVE-2023-23588A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager < 4.09.00Siemens SIMATIC IPC1047 · Siemens SIMATIC IPC1047E +4
- CVE-2023-29189HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI)SAP CRM
- CVE-2023-29187DLL Hijacking vulnerability in SapSetup (Software Installation Program)SapSetup
- CVE-2023-29185Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages)SAP NetWeaver AS for ABAP
- CVE-2023-29112Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring)SAP Application Interface Framework
- CVE-2023-29111Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service)SAP Application Interface Framework
- CVE-2023-29110Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)SAP Application Interface Framework
- CVE-2023-29109Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard)SAP Application Interface Framework
- CVE-2023-29108IP filter vulnerability in ABAP Platform and SAP Web Dispatcher ABAP Platform and SAP Web Dispatcher
- CVE-2023-28763Denial of Service in SAP NetWeaver AS for ABAP and ABAP PlatformSAP NetWeaver AS for ABAP and ABAP Platform
- CVE-2023-28761Missing Authentication check in SAP NetWeaver Enterprise PortalSAP NetWeaver Enterprise Portal
- CVE-2023-27897Code Injection vulnerability in SAP CRMSAP CRM
- CVE-2023-27499Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTMLSAP_SE GUI for HTML
- CVE-2023-26458 Information Disclosure vulnerability in SAP Landscape ManagementSAP Landscape Management
- CVE-2023-24527Improper Access Control in SAP NetWeaver AS Java for Deploy ServiceSAP NetWeaver AS Java for Deploy Service
- CVE-2023-1903Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0)SAP HCM Fiori App My Forms
- CVE-2020-24736Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script
- CVE-2020-9009The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database (via action
- CVE-2022-43293Wacom Driver 6.3.46-1 for Windows was discovered to contain an arbitrary file write vulnerability via the component \Wacom\Wacom_Tablet.exe.
- CVE-2022-46396An issue was discovered in the Arm Mali Kernel Driver.
- CVE-2023-1976Password Aging with Long Expiration in answerdev/answeranswerdev/answer · github.com/answerdev/answer
- CVE-2023-22808An issue was discovered in the Arm Android Gralloc Module.
- CVE-2023-23277Snippet-box 1.0.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-23572Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an adminSEIKO EPSON printers/network interface Web Config
- CVE-2023-23575Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypass access restriction Contec CO. CONPROSYS IoT Gateway products
- CVE-2023-24182LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the compo
- CVE-2023-24464Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the proBUFFALO BS-GS series
- CVE-2023-25411Aten PE8108 2.4.232 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2023-25414Aten PE8108 2.4.232 is vulnerable to denial of service (DOS).
- CVE-2023-25415Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control.
- CVE-2023-25955National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE).Ministry of Land, Infrastructure, Transport and Tourism, Ja…
- CVE-2023-26260OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to partial access of a customer's account by an attac
- CVE-2023-26551mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp<cpdec while loop.
- CVE-2023-26552mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a decimal point.
- CVE-2023-26553mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when copying the trailing number.
- CVE-2023-26554mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write when adding a '\0' character.
- CVE-2023-26555praecis_parse in ntpd/refclock_palisade.c in NTP 4.2.8p15 has an out-of-bounds write.
- CVE-2023-26845A Cross-Site Request Forgery (CSRF) in OpenCATS 0.9.7 allows attackers to force users into submitting web requests via unspecified vectors.
- CVE-2023-26846A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2023-26847A stored cross-site scripting (XSS) vulnerability in OpenCATS v0.9.7 allows attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2023-27520Cross-site request forgery (CSRF) vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote unauthenticated attackeSEIKO EPSON printers/network interface Web Config
- CVE-2023-28340Zoho ManageEngine Applications Manager through 16320 allows the admin user to conduct an XXE attack.
- CVE-2023-28341Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to in
- CVE-2023-28368TP-Link L2 switch T2600G-28SQ firmware versions prior to 'T2600G-28SQ(UN)_V1_1.0.6 Build 20230227' uses vulnerable SSH host keys.TP-Link Corporation Limited T2600G-28SQ
- CVE-2023-29576Bento4 v1.6.0-639 was discovered to contain a segmentation violation via the AP4_TrunAtom::SetDataOffset(int) function in Ap4TrunAtom.h.