# CVEs published 2023-04-11 236 CVEs were published on April 11, 2023: 12 critical, 111 high. 3 are now in CISA KEV. Days are UTC. - [CVE-2023-28312](https://cve.now/CVE-2023-28312.md): Azure Machine Learning Information Disclosure Vulnerability (CVSS 6.5, Microsoft Azure Machine Learning) - [CVE-2023-28311](https://cve.now/CVE-2023-28311.md): Microsoft Word Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2019 for Mac · Microsoft 365 Apps for E… +1) - [CVE-2023-28308](https://cve.now/CVE-2023-28308.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server) - [CVE-2023-28307](https://cve.now/CVE-2023-28307.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server) - [CVE-2023-28306](https://cve.now/CVE-2023-28306.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server) - [CVE-2023-28304](https://cve.now/CVE-2023-28304.md): Microsoft ODBC and OLE DB Remote Code Execution Vulnerability (CVSS 7.8, Microsoft ODBC Driver 17 for SQL Server · Microsoft OLE… +2) - [CVE-2023-28302](https://cve.now/CVE-2023-28302.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2023-28299](https://cve.now/CVE-2023-28299.md): Visual Studio Spoofing Vulnerability (CVSS 5.5, Microsoft Visual Studio) - [CVE-2023-28296](https://cve.now/CVE-2023-28296.md): Visual Studio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio) - [CVE-2023-28293](https://cve.now/CVE-2023-28293.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2023-28263](https://cve.now/CVE-2023-28263.md): Visual Studio Information Disclosure Vulnerability (CVSS 5.5, Microsoft Visual Studio) - [CVE-2023-28262](https://cve.now/CVE-2023-28262.md): Visual Studio Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Visual Studio) - [CVE-2023-28260](https://cve.now/CVE-2023-28260.md): .NET DLL Hijacking Remote Code Execution Vulnerability (CVSS 7.8, Microsoft .NET · Microsoft Visual Studio +5) - [CVE-2023-28256](https://cve.now/CVE-2023-28256.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server) - [CVE-2023-28278](https://cve.now/CVE-2023-28278.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server) - [CVE-2023-28255](https://cve.now/CVE-2023-28255.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server) - [CVE-2023-28277](https://cve.now/CVE-2023-28277.md): Windows DNS Server Information Disclosure Vulnerability (CVSS 4.9, Microsoft Windows Server) - [CVE-2023-28254](https://cve.now/CVE-2023-28254.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 7.2, Microsoft Windows Server) - [CVE-2023-28276](https://cve.now/CVE-2023-28276.md): Windows Group Policy Security Feature Bypass Vulnerability (CVSS 4.4, Microsoft Windows) - [CVE-2023-28253](https://cve.now/CVE-2023-28253.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2023-28275](https://cve.now/CVE-2023-28275.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-28252](https://cve.now/CVE-2023-28252.md): Windows Common Log File System Driver Elevation of Privilege Vulnerability (CVSS 7.8, KEV, Microsoft Windows) - [CVE-2023-28274](https://cve.now/CVE-2023-28274.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2023-28273](https://cve.now/CVE-2023-28273.md): Windows Clip Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2023-28250](https://cve.now/CVE-2023-28250.md): Windows Pragmatic General Multicast (PGM) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2023-28249](https://cve.now/CVE-2023-28249.md): Windows Boot Manager Security Feature Bypass Vulnerability (CVSS 6.2, Microsoft Windows) - [CVE-2023-28272](https://cve.now/CVE-2023-28272.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2023-28271](https://cve.now/CVE-2023-28271.md): Windows Kernel Memory Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2023-28248](https://cve.now/CVE-2023-28248.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2023-28247](https://cve.now/CVE-2023-28247.md): Windows Network File System Information Disclosure Vulnerability (CVSS 7.5, Microsoft Windows Server) - [CVE-2023-28270](https://cve.now/CVE-2023-28270.md): Windows Lock Screen Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2023-28246](https://cve.now/CVE-2023-28246.md): Windows Registry Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows) - [CVE-2023-28269](https://cve.now/CVE-2023-28269.md): Windows Boot Manager Security Feature Bypass Vulnerability (CVSS 6.2, Microsoft Windows) - [CVE-2023-28268](https://cve.now/CVE-2023-28268.md): Netlogon RPC Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows Server) - [CVE-2023-28244](https://cve.now/CVE-2023-28244.md): Windows Kerberos Elevation of Privilege Vulnerability (CVSS 8.1, Microsoft Windows Server) - [CVE-2023-28267](https://cve.now/CVE-2023-28267.md): Remote Desktop Protocol Client Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows · Microsoft Remote Desktop client for Win…) - [CVE-2023-28243](https://cve.now/CVE-2023-28243.md): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-28266](https://cve.now/CVE-2023-28266.md): Windows Common Log File System Driver Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2023-28241](https://cve.now/CVE-2023-28241.md): Windows Secure Socket Tunneling Protocol (SSTP) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2023-28240](https://cve.now/CVE-2023-28240.md): Windows Network Load Balancing Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server) - [CVE-2023-28238](https://cve.now/CVE-2023-28238.md): Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2023-28237](https://cve.now/CVE-2023-28237.md): Windows Kernel Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2023-28236](https://cve.now/CVE-2023-28236.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2023-28235](https://cve.now/CVE-2023-28235.md): Windows Lock Screen Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows) - [CVE-2023-28234](https://cve.now/CVE-2023-28234.md): Windows Secure Channel Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server · Microsoft Windows) - [CVE-2023-28233](https://cve.now/CVE-2023-28233.md): Windows Secure Channel Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows Server · Microsoft Windows) - [CVE-2023-28232](https://cve.now/CVE-2023-28232.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2023-28231](https://cve.now/CVE-2023-28231.md): DHCP Server Service Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows Server) - [CVE-2023-28229](https://cve.now/CVE-2023-28229.md): Windows CNG Key Isolation Service Elevation of Privilege Vulnerability (CVSS 7.0, KEV, Microsoft Windows) - [CVE-2023-28228](https://cve.now/CVE-2023-28228.md): Windows Spoofing Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2023-28227](https://cve.now/CVE-2023-28227.md): Windows Bluetooth Driver Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2023-28226](https://cve.now/CVE-2023-28226.md): Windows Enroll Engine Security Feature Bypass Vulnerability (CVSS 5.3, Microsoft Windows) - [CVE-2023-28225](https://cve.now/CVE-2023-28225.md): Windows NTLM Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2023-28224](https://cve.now/CVE-2023-28224.md): Windows Point-to-Point Protocol over Ethernet (PPPoE) Remote Code Execution Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2023-28223](https://cve.now/CVE-2023-28223.md): Windows Domain Name Service Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server) - [CVE-2023-28220](https://cve.now/CVE-2023-28220.md): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2023-28219](https://cve.now/CVE-2023-28219.md): Layer 2 Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows) - [CVE-2023-24929](https://cve.now/CVE-2023-24929.md): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-24887](https://cve.now/CVE-2023-24887.md): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-24928](https://cve.now/CVE-2023-24928.md): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-24886](https://cve.now/CVE-2023-24886.md): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-24927](https://cve.now/CVE-2023-24927.md): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-24885](https://cve.now/CVE-2023-24885.md): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-24926](https://cve.now/CVE-2023-24926.md): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-24884](https://cve.now/CVE-2023-24884.md): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-24925](https://cve.now/CVE-2023-24925.md): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-24883](https://cve.now/CVE-2023-24883.md): Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability (CVSS 6.5, Microsoft Windows) - [CVE-2023-24924](https://cve.now/CVE-2023-24924.md): Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-24912](https://cve.now/CVE-2023-24912.md): Windows Graphics Component Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows) - [CVE-2023-24860](https://cve.now/CVE-2023-24860.md): Microsoft Defender Denial of Service Vulnerability (CVSS 7.5, Microsoft Malware Protection Engine) - [CVE-2023-23375](https://cve.now/CVE-2023-23375.md): Microsoft ODBC and OLE DB Remote Code Execution Vulnerability (CVSS 7.8, Microsoft OLE DB Driver 18 for SQL Server · Microsoft OL… +2) - [CVE-2023-21554](https://cve.now/CVE-2023-21554.md): Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability (CVSS 9.8, Microsoft Windows) - [CVE-2023-24893](https://cve.now/CVE-2023-24893.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code) - [CVE-2023-28314](https://cve.now/CVE-2023-28314.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 6.1, Microsoft Dynamics 365 (on-premises)) - [CVE-2023-28313](https://cve.now/CVE-2023-28313.md): Microsoft Dynamics 365 Customer Voice Cross-Site Scripting Vulnerability (CVSS 6.1, Microsoft Send Customer Voice survey from Dynamics) - [CVE-2023-28309](https://cve.now/CVE-2023-28309.md): Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability (CVSS 7.6, Microsoft Dynamics 365 (on-premises)) - [CVE-2023-28305](https://cve.now/CVE-2023-28305.md): Windows DNS Server Remote Code Execution Vulnerability (CVSS 6.6, Microsoft Windows Server) - [CVE-2023-28300](https://cve.now/CVE-2023-28300.md): Azure Service Connector Security Feature Bypass Vulnerability (CVSS 7.5, Microsoft Azure Service Connector) - [CVE-2023-28298](https://cve.now/CVE-2023-28298.md): Windows Kernel Denial of Service Vulnerability (CVSS 5.5, Microsoft Windows) - [CVE-2023-28297](https://cve.now/CVE-2023-28297.md): Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-28292](https://cve.now/CVE-2023-28292.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Raw Image Extension) - [CVE-2023-28291](https://cve.now/CVE-2023-28291.md): Raw Image Extension Remote Code Execution Vulnerability (CVSS 8.4, Microsoft Raw Image Extension) - [CVE-2023-28288](https://cve.now/CVE-2023-28288.md): Microsoft SharePoint Server Spoofing Vulnerability (CVSS 8.1, Microsoft SharePoint Enterprise Server · Microsoft Share… +1) - [CVE-2023-28285](https://cve.now/CVE-2023-28285.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2019 for Mac · Microsoft 365 Apps for E… +1) - [CVE-2023-28222](https://cve.now/CVE-2023-28222.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows) - [CVE-2023-28221](https://cve.now/CVE-2023-28221.md): Windows Error Reporting Service Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2023-28218](https://cve.now/CVE-2023-28218.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2023-28217](https://cve.now/CVE-2023-28217.md): Windows Network Address Translation (NAT) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2023-28216](https://cve.now/CVE-2023-28216.md): Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2023-24931](https://cve.now/CVE-2023-24931.md): Windows Secure Channel Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2023-24914](https://cve.now/CVE-2023-24914.md): Win32k Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows) - [CVE-2023-23384](https://cve.now/CVE-2023-23384.md): Microsoft SQL Server Remote Code Execution Vulnerability (CVSS 7.3, Microsoft SQL Server 2008 Service Pack · Microsoft SQL S… +2) - [CVE-2023-21769](https://cve.now/CVE-2023-21769.md): Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows) - [CVE-2023-21729](https://cve.now/CVE-2023-21729.md): Remote Procedure Call Runtime Information Disclosure Vulnerability (CVSS 4.3, Microsoft Windows) - [CVE-2023-21727](https://cve.now/CVE-2023-21727.md): Remote Procedure Call Runtime Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows) - [CVE-2023-28301](https://cve.now/CVE-2023-28301.md): Microsoft Edge (Chromium-based) Tampering Vulnerability (CVSS 3.7, Microsoft Edge for Android) - [CVE-2023-24935](https://cve.now/CVE-2023-24935.md): Microsoft Edge (Chromium-based) Spoofing Vulnerability (CVSS 6.1, Microsoft Edge) - [CVE-2023-28284](https://cve.now/CVE-2023-28284.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 4.3, Microsoft Edge) - [CVE-2023-1988](https://cve.now/CVE-2023-1988.md): SourceCodester Online Computer and Laptop Store cross site scripting (CVSS 3.5, SourceCodester Online Computer and Laptop Store) - [CVE-2023-1987](https://cve.now/CVE-2023-1987.md): SourceCodester Online Computer and Laptop Store update\_order\_status sql injection (CVSS 6.3, SourceCodester Online Computer and Laptop Store) - [CVE-2023-1986](https://cve.now/CVE-2023-1986.md): SourceCodester Online Computer and Laptop Store delete\_order sql injection (CVSS 6.3, SourceCodester Online Computer and Laptop Store) - [CVE-2023-1939](https://cve.now/CVE-2023-1939.md): No access control for the OTP key on OTP entries (CVSS 4.3, Devolutions Remote Desktop Manager) - [CVE-2023-1980](https://cve.now/CVE-2023-1980.md): Two factor authentication bypass on login in Devolutions Remote Desktop Manager 2022.3.35 and earlier allow user to cancel the two factor (CVSS 6.5, Devolutions Remote Desktop Manager) - [CVE-2023-1985](https://cve.now/CVE-2023-1985.md): SourceCodester Online Computer and Laptop Store save\_brand sql injection (CVSS 6.3, SourceCodester Online Computer and Laptop Store) - [CVE-2023-1984](https://cve.now/CVE-2023-1984.md): SourceCodester Complaint Management System POST Parameter check\_availability.php sql injection (CVSS 6.3, SourceCodester Complaint Management System) - [CVE-2023-1983](https://cve.now/CVE-2023-1983.md): SourceCodester Sales Tracker Management System GET Parameter manage\_product.php sql injection (CVSS 6.3, SourceCodester Sales Tracker Management System) - [CVE-2022-35850](https://cve.now/CVE-2022-35850.md): An improper neutralization of script-related HTML tags in a web page vulnerability \[CWE-80\] in FortiAuthenticator versions 6.4.0 through 6.4 (CVSS 4.2, Fortinet FortiAuthenticator) - [CVE-2022-42469](https://cve.now/CVE-2022-42469.md): A permissive list of allowed inputs vulnerability \[CWE-183\] in FortiGate version 7.2.3 and below, version 7.0.9 and below Policy-based NGFW (CVSS 4.1, Fortinet FortiOS) - [CVE-2023-22642](https://cve.now/CVE-2023-22642.md): An improper certificate validation vulnerability \[CWE-295\] in FortiAnalyzer and FortiManager 7.2.0 through 7.2.1, 7.0.0 through 7.0.5, 6.4.8 (CVSS 6.8, Fortinet FortiAnalyzer · Fortinet FortiManager) - [CVE-2022-27485](https://cve.now/CVE-2022-27485.md): A improper neutralization of special elements used in an sql command ('sql injection') vulnerability \[CWE-89\] in Fortinet FortiSandbox versi (CVSS 6.2, Fortinet FortiSandbox) - [CVE-2022-43947](https://cve.now/CVE-2022-43947.md): An improper restriction of excessive authentication attempts vulnerability \[CWE-307\] in Fortinet FortiOS version 7.2.0 through 7.2.3 and bef (CVSS 4.7, Fortinet FortiOS · Fortinet FortiProxy) - [CVE-2022-27487](https://cve.now/CVE-2022-27487.md): A improper privilege management in Fortinet FortiSandbox version 4.2.0 through 4.2.2, 4.0.0 through 4.0.2 and before 3.2.3 and FortiDeceptor (CVSS 8.3, Fortinet FortiDeceptor · Fortinet FortiSandbox) - [CVE-2022-43946](https://cve.now/CVE-2022-43946.md): Multiple vulnerabilities including an incorrect permission assignment for critical resource \[CWE-732\] vulnerability and a time-of-check time (CVSS 7.3, Fortinet FortiClientWindows) - [CVE-2022-43955](https://cve.now/CVE-2022-43955.md): An improper neutralization of input during web page generation \[CWE-79\] in the FortiWeb web interface 7.0.0 through 7.0.3, 6.3.0 through 6.3 (CVSS 8.0, Fortinet FortiWeb) - [CVE-2022-43952](https://cve.now/CVE-2022-43952.md): An improper neutralization of input during web page generation ('Cross-site Scripting') vulnerability \[CWE-79\] in FortiADC version 7.1.1 and (CVSS 3.3, Fortinet FortiADC) - [CVE-2022-42477](https://cve.now/CVE-2022-42477.md): An improper input validation vulnerability \[CWE-20\] in FortiAnalyzer version 7.2.1 and below, version 7.0.6 and below, 6.4 all versions may (CVSS 6.5, Fortinet FortiAnalyzer) - [CVE-2023-22641](https://cve.now/CVE-2023-22641.md): A url redirection to untrusted site ('open redirect') in Fortinet FortiOS version 7.2.0 through 7.2.3, FortiOS version 7.0.0 through 7.0.9, (CVSS 4.1, Fortinet FortiOS · Fortinet FortiProxy) - [CVE-2022-43948](https://cve.now/CVE-2022-43948.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 7.0.0 through 7.0. (CVSS 6.5, Fortinet FortiWeb · Fortinet FortiADC) - [CVE-2022-41331](https://cve.now/CVE-2022-41331.md): A missing authentication for critical function vulnerability \[CWE-306\] in FortiPresence infrastructure server before version 1.2.1 allows a (CVSS 9.3, Fortinet FortiPresence) - [CVE-2022-42470](https://cve.now/CVE-2022-42470.md): A relative path traversal vulnerability in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 all (CVSS 7.1, Fortinet FortiClientWindows) - [CVE-2022-40682](https://cve.now/CVE-2022-40682.md): A incorrect authorization in Fortinet FortiClient (Windows) 7.0.0 - 7.0.7, 6.4.0 - 6.4.9, 6.2.0 - 6.2.9 and 6.0.0 - 6.0.10 allows an attacke (CVSS 7.1, Fortinet FortiClientWindows) - [CVE-2022-40679](https://cve.now/CVE-2022-40679.md): An improper neutralization of special elements used in an OS command vulnerability \[CWE-78\] in FortiADC 5.x all versions, 6.0 all versions, (CVSS 7.1, Fortinet FortiDDoS · Fortinet FortiDDoS-F +1) - [CVE-2022-43951](https://cve.now/CVE-2022-43951.md): An exposure of sensitive information to an unauthorized actor vulnerability \[CWE-200\] in FortiNAC 9.4.1 and below, 9.2.6 and below, 9.1.8 an (CVSS 4.8, Fortinet FortiNAC) - [CVE-2023-27995](https://cve.now/CVE-2023-27995.md): A improper neutralization of special elements used in a template engine vulnerability in Fortinet FortiSOAR 7.3.0 through 7.3.1 allows an au (CVSS 7.2, Fortinet FortiSOAR) - [CVE-2022-41330](https://cve.now/CVE-2022-41330.md): An improper neutralization of input during web page generation vulnerability ('Cross-site Scripting') \[CWE-79\] in Fortinet FortiOS version 7 (CVSS 8.3, Fortinet FortiProxy · Fortinet FortiOS) - [CVE-2023-22635](https://cve.now/CVE-2023-22635.md): A download of code without Integrity check vulnerability \[CWE-494\] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all (CVSS 6.9, Fortinet FortiClientMac) - [CVE-2022-43770](https://cve.now/CVE-2022-43770.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 5.4, Hitachi Vantara Pentaho Business Analytics Server) - [CVE-2022-3695](https://cve.now/CVE-2022-3695.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation (CVSS 6.5, Hitachi Vantara Pentaho Business Analytics Server) - [CVE-2023-1552](https://cve.now/CVE-2023-1552.md): ToolboxST Deserialization of Untrusted Configuration Data (CVSS 2.9, GE Gas Power ToolboxST) - [CVE-2023-30465](https://cve.now/CVE-2023-30465.md): Apache InLong: SQL injection in apache inLong 1.5.0 (CVSS 5.3, Apache Software Foundation Apache InLong · org.apache.in… +1) - [CVE-2023-28062](https://cve.now/CVE-2023-28062.md): Dell PPDM versions 19.12, 19.11 and 19.10, contain an improper access control vulnerability. (CVSS 8.8, Dell PPDM Reporting) - [CVE-2023-0645](https://cve.now/CVE-2023-0645.md): Out of Bounds read in libjxl (CVSS 5.3, Libjxl) - [CVE-2022-47468](https://cve.now/CVE-2022-47468.md): In telecom service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…) - [CVE-2022-47467](https://cve.now/CVE-2022-47467.md): In telecom service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…) - [CVE-2022-47466](https://cve.now/CVE-2022-47466.md): In telecom service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…) - [CVE-2022-47465](https://cve.now/CVE-2022-47465.md): In vdsp service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…) - [CVE-2022-47464](https://cve.now/CVE-2022-47464.md): In telecom service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…) - [CVE-2022-47463](https://cve.now/CVE-2022-47463.md): In telecom service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…) - [CVE-2022-47362](https://cve.now/CVE-2022-47362.md): In telecom service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…) - [CVE-2022-47338](https://cve.now/CVE-2022-47338.md): In telecom service, there is a missing permission check. (CVSS 7.1, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…) - [CVE-2022-47337](https://cve.now/CVE-2022-47337.md): In media service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…) - [CVE-2022-47336](https://cve.now/CVE-2022-47336.md): In telecom service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…) - [CVE-2022-47335](https://cve.now/CVE-2022-47335.md): In telecom service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…) - [CVE-2023-29054](https://cve.now/CVE-2023-29054.md): A vulnerability has been identified in SCALANCE X200-4P IRT (All versions \< V5.5.2), SCALANCE X201-3P IRT (All versions \< V5.5.2), SCALANCE (CVSS 6.7, Siemens SCALANCE X200-4P IRT · Siemens SCALANCE X201-3P… +8) - [CVE-2023-29053](https://cve.now/CVE-2023-29053.md): A vulnerability has been identified in JT Open (All versions \< V11.3.2.0), JT Utilities (All versions \< V13.3.0.0). (CVSS 7.8, Siemens JT Open · Siemens JT Utilities) - [CVE-2023-28828](https://cve.now/CVE-2023-28828.md): A vulnerability has been identified in Polarion ALM (All versions \< V22R2). (CVSS 5.9, Siemens Polarion ALM) - [CVE-2023-28766](https://cve.now/CVE-2023-28766.md): A vulnerability has been identified in SIPROTEC 5 6MD85 (CP300) (All versions \>= V7.80 \< V9.40), SIPROTEC 5 6MD86 (CP300) (All versions \>= V (CVSS 7.5, Siemens SIPROTEC 5 6MD85 · Siemens SIPROTEC 5 6MD86 +35) - [CVE-2023-28489](https://cve.now/CVE-2023-28489.md): A vulnerability has been identified in CP-8031 MASTER MODULE (All versions \< CPCI85 V05), CP-8050 MASTER MODULE (All versions \< CPCI85 V05). (CVSS 9.8, Siemens CP-8031 MASTER MODULE · Siemens CP-8050 MASTER MODU…) - [CVE-2023-27464](https://cve.now/CVE-2023-27464.md): A vulnerability has been identified in Mendix Forgot Password (Mendix 7 compatible) (All versions \< V3.7.1), Mendix Forgot Password (Mendix (CVSS 5.3, Siemens Mendix Forgot Password) - [CVE-2023-26293](https://cve.now/CVE-2023-26293.md): A vulnerability has been identified in Totally Integrated Automation Portal (TIA Portal) V15 (All versions), Totally Integrated Automation P (CVSS 7.3, Siemens Totally Integrated Automation Portal (TIA Portal)) - [CVE-2023-23588](https://cve.now/CVE-2023-23588.md): A vulnerability has been identified in SIMATIC IPC1047 (All versions), SIMATIC IPC1047E (All versions with maxView Storage Manager \< 4.09.00 (CVSS 6.2, Siemens SIMATIC IPC1047 · Siemens SIMATIC IPC1047E +4) - [CVE-2022-43768](https://cve.now/CVE-2022-43768.md): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions \< V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30- (CVSS 7.5, Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +13) - [CVE-2022-43767](https://cve.now/CVE-2022-43767.md): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions \< V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30- (CVSS 7.5, Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +13) - [CVE-2022-43716](https://cve.now/CVE-2022-43716.md): A vulnerability has been identified in SIMATIC CP 1242-7 V2 (6GK7242-7KX31-0XE0) (All versions \< V3.4.29), SIMATIC CP 1243-1 (6GK7243-1BX30- (CVSS 7.5, Siemens SIMATIC CP 1242-7 · Siemens SIMATIC CP 1243-1 +13) - [CVE-2023-26122](https://cve.now/CVE-2023-26122.md): All versions of the package safe-eval are vulnerable to Sandbox Bypass due to improper input sanitization. (CVSS 8.8, safe-eval) - [CVE-2023-26121](https://cve.now/CVE-2023-26121.md): All versions of the package safe-eval are vulnerable to Prototype Pollution via the safeEval function, due to improper sanitization of its p (CVSS 7.5, safe-eval) - [CVE-2023-29189](https://cve.now/CVE-2023-29189.md): HTTP Verb Tampering vulnerability in SAP CRM (WebClient UI) (CVSS 5.4, SAP CRM) - [CVE-2023-29187](https://cve.now/CVE-2023-29187.md): DLL Hijacking vulnerability in SapSetup (Software Installation Program) (CVSS 6.7, SapSetup) - [CVE-2023-29186](https://cve.now/CVE-2023-29186.md): Directory/Path Traversal vulnerability in SAP NetWeaver. (CVSS 8.7, SAP NetWeaver) - [CVE-2023-29185](https://cve.now/CVE-2023-29185.md): Denial of Service (DOS) in SAP NetWeaver AS for ABAP (Business Server Pages) (CVSS 5.3, SAP NetWeaver AS for ABAP) - [CVE-2023-29112](https://cve.now/CVE-2023-29112.md): Code Injection vulnerability in SAP Application Interface Framework (Message Monitoring) (CVSS 3.7, SAP Application Interface Framework) - [CVE-2023-29111](https://cve.now/CVE-2023-29111.md): Information Disclosure vulnerability in SAP Application Interface Framework (ODATA service) (CVSS 3.1, SAP Application Interface Framework) - [CVE-2023-29110](https://cve.now/CVE-2023-29110.md): Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard) (CVSS 3.7, SAP Application Interface Framework) - [CVE-2023-29109](https://cve.now/CVE-2023-29109.md): Code Injection vulnerability in SAP Application Interface Framework (Message Dashboard) (CVSS 4.4, SAP Application Interface Framework) - [CVE-2023-29108](https://cve.now/CVE-2023-29108.md): IP filter vulnerability in ABAP Platform and SAP Web Dispatcher (CVSS 5.0, ABAP Platform and SAP Web Dispatcher) - [CVE-2023-28765](https://cve.now/CVE-2023-28765.md): Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management ) (CVSS 9.8, SAP BusinessObjects Business Intelligence Platform) - [CVE-2023-28763](https://cve.now/CVE-2023-28763.md): Denial of Service in SAP NetWeaver AS for ABAP and ABAP Platform (CVSS 6.5, SAP NetWeaver AS for ABAP and ABAP Platform) - [CVE-2023-28761](https://cve.now/CVE-2023-28761.md): Missing Authentication check in SAP NetWeaver Enterprise Portal (CVSS 6.5, SAP NetWeaver Enterprise Portal) - [CVE-2023-27897](https://cve.now/CVE-2023-27897.md): Code Injection vulnerability in SAP CRM (CVSS 6.0, SAP CRM) - [CVE-2023-27499](https://cve.now/CVE-2023-27499.md): Cross-Site Scripting (XSS) vulnerability in SAP GUI for HTML (CVSS 6.1, SAP\_SE GUI for HTML) - [CVE-2023-27497](https://cve.now/CVE-2023-27497.md): Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector) (CVSS 10.0, SAP Diagnostics Agent) - [CVE-2023-27267](https://cve.now/CVE-2023-27267.md): Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge) (CVSS 9.0, SAP Diagnostics Agent) - [CVE-2023-26458](https://cve.now/CVE-2023-26458.md): Information Disclosure vulnerability in SAP Landscape Management (CVSS 6.8, SAP Landscape Management) - [CVE-2023-24527](https://cve.now/CVE-2023-24527.md): Improper Access Control in SAP NetWeaver AS Java for Deploy Service (CVSS 5.3, SAP NetWeaver AS Java for Deploy Service) - [CVE-2023-1903](https://cve.now/CVE-2023-1903.md): Missing Authorization check in SAP HCM Fiori App My Forms (Fiori 2.0) (CVSS 4.3, SAP HCM Fiori App My Forms) - [CVE-2020-19802](https://cve.now/CVE-2020-19802.md): File Upload vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the upload file type paramete (CVSS 9.8) - [CVE-2020-19803](https://cve.now/CVE-2020-19803.md): Cross Site Request Forgery vulnerability found in Milken DoyoCMS v.2.3 allows a remote attacker to execute arbitrary code via the background (CVSS 8.8) - [CVE-2020-24736](https://cve.now/CVE-2020-24736.md): Buffer Overflow vulnerability found in SQLite3 v.3.27.1 and before allows a local attacker to cause a denial of service via a crafted script (CVSS 5.5) - [CVE-2020-9009](https://cve.now/CVE-2020-9009.md): The ShipStation.com plugin 1.1 and earlier for CS-Cart allows remote attackers to insert arbitrary information into the database (via action (CVSS 3.7) - [CVE-2021-46878](https://cve.now/CVE-2021-46878.md): An issue was discovered in Treasure Data Fluent Bit 1.7.1, erroneous parsing in flb\_pack\_msgpack\_to\_json\_format leads to type confusion bug (CVSS 7.8) - [CVE-2021-46879](https://cve.now/CVE-2021-46879.md): An issue was discovered in Treasure Data Fluent Bit 1.7.1, a wrong variable is used to get the msgpack data resulting in a heap overflow in (CVSS 7.8) - [CVE-2022-38604](https://cve.now/CVE-2022-38604.md): Wacom Driver 6.3.46-1 for Windows and lower was discovered to contain an arbitrary file deletion vulnerability. (CVSS 7.3) - [CVE-2022-43293](https://cve.now/CVE-2022-43293.md): Wacom Driver 6.3.46-1 for Windows was discovered to contain an arbitrary file write vulnerability via the component \\Wacom\\Wacom\_Tablet.exe. (CVSS 5.9) - [CVE-2022-46396](https://cve.now/CVE-2022-46396.md): An issue was discovered in the Arm Mali Kernel Driver. (CVSS 4.4) - [CVE-2023-1974](https://cve.now/CVE-2023-1974.md): Exposure of Sensitive Information Through Metadata in answerdev/answer (CVSS 7.7, answerdev/answer · github.com/answerdev/answer) - [CVE-2023-1975](https://cve.now/CVE-2023-1975.md): Insertion of Sensitive Information Into Sent Data in answerdev/answer (CVSS 7.6, answerdev/answer · github.com/answerdev/answer) - [CVE-2023-1976](https://cve.now/CVE-2023-1976.md): Password Aging with Long Expiration in answerdev/answer (CVSS 4.6, answerdev/answer · github.com/answerdev/answer) - [CVE-2023-1989](https://cve.now/CVE-2023-1989.md): Kernel: use after free bug in btsdio\_remove due to race condition (CVSS 7.0, linux · Red Hat Enterprise Linux +1) - [CVE-2023-22282](https://cve.now/CVE-2023-22282.md): WAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path. (CVSS 7.3, ELECOM CO. WAB-MAT) - [CVE-2023-22429](https://cve.now/CVE-2023-22429.md): Android App 'Wolt Delivery: Food and more' version 4.27.2 and earlier uses hard-coded credentials (API key for an external service), which m (CVSS 7.8, Wolt Delivery: Food and more) - [CVE-2023-22612](https://cve.now/CVE-2023-22612.md): An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 8.8) - [CVE-2023-22613](https://cve.now/CVE-2023-22613.md): An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 8.8) - [CVE-2023-22614](https://cve.now/CVE-2023-22614.md): An issue was discovered in ChipsetSvcSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 8.8) - [CVE-2023-22615](https://cve.now/CVE-2023-22615.md): An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 8.4) - [CVE-2023-22808](https://cve.now/CVE-2023-22808.md): An issue was discovered in the Arm Android Gralloc Module. (CVSS 3.3) - [CVE-2023-23277](https://cve.now/CVE-2023-23277.md): Snippet-box 1.0.0 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1) - [CVE-2023-23572](https://cve.now/CVE-2023-23572.md): Cross-site scripting vulnerability in SEIKO EPSON printers/network interface Web Config allows a remote authenticated attacker with an admin (CVSS 4.8, SEIKO EPSON printers/network interface Web Config) - [CVE-2023-23575](https://cve.now/CVE-2023-23575.md): Improper access control vulnerability in CONPROSYS IoT Gateway products allows a remote authenticated attacker to bypass access restriction (CVSS 4.3, Contec CO. CONPROSYS IoT Gateway products) - [CVE-2023-24182](https://cve.now/CVE-2023-24182.md): LuCI openwrt-22.03 branch git-22.361.69894-438c598 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the compo (CVSS 5.4) - [CVE-2023-24464](https://cve.now/CVE-2023-24464.md): Stored-cross-site scripting vulnerability in Buffalo network devices allows an attacker with access to the web management console of the pro (CVSS 5.4, BUFFALO BS-GS series) - [CVE-2023-24544](https://cve.now/CVE-2023-24544.md): Improper access control vulnerability in Buffalo network devices allows a network-adjacent attacker to obtain specific files of the product. (CVSS 8.1, BUFFALO BS-GSL and BS-GS series) - [CVE-2023-25407](https://cve.now/CVE-2023-25407.md): Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. (CVSS 7.2) - [CVE-2023-25409](https://cve.now/CVE-2023-25409.md): Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. (CVSS 8.1) - [CVE-2023-25411](https://cve.now/CVE-2023-25411.md): Aten PE8108 2.4.232 is vulnerable to Cross Site Request Forgery (CSRF). (CVSS 4.3) - [CVE-2023-25413](https://cve.now/CVE-2023-25413.md): Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. (CVSS 7.5) - [CVE-2023-25414](https://cve.now/CVE-2023-25414.md): Aten PE8108 2.4.232 is vulnerable to denial of service (DOS). (CVSS 5.3) - [CVE-2023-25415](https://cve.now/CVE-2023-25415.md): Aten PE8108 2.4.232 is vulnerable to Incorrect Access Control. (CVSS 5.3) - [CVE-2023-25755](https://cve.now/CVE-2023-25755.md): Screen Creator Advance 2 Ver.0.1.1.4 Build01A and earlier is vulnerable to improper restriction of operations within the bounds of a memory (CVSS 7.8, JTEKT ELECTRONICS Screen Creator Advance) - [CVE-2023-25950](https://cve.now/CVE-2023-25950.md): HTTP request/response smuggling vulnerability in HAProxy version 2.7.0, and 2.6.1 to 2.6.7 allows a remote attacker to alter a legitimate us (CVSS 7.3, HAProxy Technologies HAProxy) - [CVE-2023-25955](https://cve.now/CVE-2023-25955.md): National land numerical information data conversion tool all versions improperly restricts XML external entity references (XXE). (CVSS 5.5, Ministry of Land, Infrastructure, Transport and Tourism, Ja…) - [CVE-2023-26260](https://cve.now/CVE-2023-26260.md): OXID eShop 6.2.x before 6.4.4 and 6.5.x before 6.5.2 allows session hijacking, leading to partial access of a customer's account by an attac (CVSS 5.4) - [CVE-2023-26551](https://cve.now/CVE-2023-26551.md): mstolfp in libntp/mstolfp.c in NTP 4.2.8p15 has an out-of-bounds write in the cp\