CVEs published April 12, 2023
104 CVEs were published on April 12, 2023: 2 critical, 44 high.
- Published
- 104
- Critical
- 2
- High
- 44
- Medium
- 56
- Low
- 1
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Adobe Acrobat Reader
- 16
- Adobe Dimension
- 15
- Adobe Substance3D - Stager
- 14
- Jenkins Project Jenkins Report Portal Plugin · org.jenkins-…
- 4
- Arista Networks EOS
- 3
- Wireshark Foundation Wireshark
- 3
- Jenkins Project Jenkins Consul KV Builder Plugin · org.jenk…
- 2
- Jenkins Project Jenkins Quay.io trigger Plugin · org.jenkin…
- 2
- Jenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…
- 2
- Linux Kernel
- 2
Critical 2
- CVE-2023-27032Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup::
- CVE-2023-27830TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted fil
High 44
- CVE-2023-30525A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attackerJenkins Project Jenkins Report Portal Plugin · org.jenkins-…
- CVE-2023-30515Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the builJenkins Project Jenkins Thycotic DevOps Secrets Vault Plugi…
- CVE-2023-30514Jenkins Azure Key Vault Plugin 187.va_cd5fecd198a_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the builJenkins Project Jenkins Azure Key Vault Plugin · org.jenkin…
- CVE-2023-30513Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log Jenkins Project Jenkins Kubernetes Plugin · org.csanchez.je…
- CVE-2023-1872Use-after-free in Linux kernel's io_uring subsystemLinux Kernel
- CVE-2022-47605WordPress Custom 404 Pro Plugin <= 3.7.0 is vulnerable to SQL Injection (SQLi)Kunal Nagar Custom 404 Pro
- CVE-2023-1874WP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalationpeterschulznl WP Data Access – App Builder for Tables, Form…
- CVE-2023-1829Use-after-free in tcindex (traffic control index filter) in the Linux KernelLinux Kernel
- CVE-2023-21582ZDI-CAN-18255: Adobe Digital Editions PDF File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Digital Editions
- CVE-2023-22235Adobe InCopy SVG file Use After Free Arbitrary code executionAdobe InCopy
- CVE-2023-22616An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5.
- CVE-2023-22620An issue was discovered in SecurePoint UTM before 12.2.5.1.
- CVE-2023-24545On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch.Arista Networks EOS
- CVE-2023-26371Validate Your Inputs | Out-of-bounds Read (CWE-125)Adobe Dimension
- CVE-2023-26372ZDI-CAN-20284: Adobe Dimension USDZ File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Dimension
- CVE-2023-26373Adobe Dimension has an arbitrary address write vulnerability when parsing USDZ filesAdobe Dimension
- CVE-2023-26383ZDI-CAN-20287: Adobe Substance 3D Stager USDA File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26384ZDI-CAN-20279: Adobe Substance 3D Stager USD File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26388ZDI-CAN-20286: Adobe Substance 3D Stager USDZ File Parsing Memory Corruption Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26389ZDI-CAN-20258: Adobe Substance 3D Stager USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26390ZDI-CAN-20255: Adobe Substance 3D Stager USDA File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26391ZDI-CAN-20256: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26392ZDI-CAN-20235: Adobe Substance 3D Stager USD File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26393ZDI-CAN-20234: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26394ZDI-CAN-20236: Adobe Substance 3D Stager USD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26395Adobe Acrobat parsing PDF Out-of-bounds Write Arbitrary code execution Adobe Acrobat Reader
- CVE-2023-26396Adobe Acrobat Reader DC for macOS installer (AcroRdrDC_2200220191_MUI.pkg) contains a local privilege escalation vulnerability.Adobe Acrobat Reader
- CVE-2023-26402ZDI-CAN-20237: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26405ZDI-CAN-20712: Object Prototype pollution which leads to API Restrictions BypassAdobe Acrobat Reader
- CVE-2023-26406ZDI-CAN-20712: Net.HTTP.request URL restriction bypassAdobe Acrobat Reader
- CVE-2023-26407ZDI-CAN-20712: Net.HTTP.request Arbitrary Command ExecutionAdobe Acrobat Reader
- CVE-2023-26408ZDI-CAN-20712: AnnotsString Object prototype pollution Restrictions Bypass VulnerabilityAdobe Acrobat Reader
- CVE-2023-26417ZDI-CAN-20583: Adobe Acrobat Reader DC Popup Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-26418ZDI-CAN-20311: Adobe Acrobat Reader DC AcroForm exportAsFDFStr Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-26419ZDI-CAN-20274: Adobe Acrobat Reader DC AcroForm removeField Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-26420ZDI-CAN-20227: Adobe Acrobat Reader DC AcroForm addField Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-26421ZDI-CAN-19832: Adobe Acrobat Reader DC Doc Object Integer Underflow Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-26422ZDI-CAN-20176: Adobe Acrobat Reader DC AcroForm deleteItemAt Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-26423ZDI-CAN-20160: Adobe Acrobat Reader DC AcroForm insertItemAt Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-26424ZDI-CAN-19833: Adobe Acrobat Reader DC PDF Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-26425ZDI-CAN-19854: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-26852An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by up
- CVE-2023-27216An issue found in D-Link DSL-3782 v.1.03 allows remote authenticated users to execute arbitrary code as root via the network settings page.
- CVE-2023-27826SeowonIntech SWC 5100W WIMAX Bootloader 1.18.19.0, HW 0.0.7.0, and FW 1.11.0.1, 1.9.9.4 are vulnerable to OS Command Injection.
Medium, low and unrated 58
- CVE-2023-30532A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of jobJenkins Project Jenkins TurboScript Plugin · org.jenkinsci.…
- CVE-2023-30531Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasinJenkins Project Jenkins Consul KV Builder Plugin · org.jenk…
- CVE-2023-30530Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on thJenkins Project Jenkins Consul KV Builder Plugin · org.jenk…
- CVE-2023-30529Jenkins Lucene-Search Plugin 387.v938a_ecb_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to reinJenkins Project Jenkins Lucene-Search Plugin · org.jenkins-…
- CVE-2023-30528Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potentJenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…
- CVE-2023-30527Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins contrJenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…
- CVE-2023-30526A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an atJenkins Project Jenkins Report Portal Plugin · org.jenkins-…
- CVE-2023-30524Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the poJenkins Project Jenkins Report Portal Plugin · org.jenkins-…
- CVE-2023-30523Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controllerJenkins Project Jenkins Report Portal Plugin · org.jenkins-…
- CVE-2023-30522A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobsJenkins Project Jenkins Fogbugz Plugin · org.jenkins-ci.plu…
- CVE-2023-30521A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger bJenkins Project Jenkins Assembla merge request builder Plug…
- CVE-2023-30520Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhookJenkins Project Jenkins Quay.io trigger Plugin · org.jenkin…
- CVE-2023-30519A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corrJenkins Project Jenkins Quay.io trigger Plugin · org.jenkin…
- CVE-2023-30518A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enumeJenkins Project Jenkins Thycotic Secret Server Plugin · io.…
- CVE-2023-30517Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when coJenkins Project Jenkins NeuVector Vulnerability Scanner Plu…
- CVE-2023-30516Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to DockeJenkins Project Jenkins Image Tag Parameter Plugin · org.je…
- CVE-2023-0006GlobalProtect App: Local File Deletion VulnerabilityPalo Alto Networks GlobalProtect app
- CVE-2023-0005PAN-OS: Exposure of Sensitive Information VulnerabilityPalo Alto Networks PAN-OS · Palo Alto Networks Prisma Ac… +1
- CVE-2023-0004PAN-OS: Local File Deletion VulnerabilityPalo Alto Networks PAN-OS · Palo Alto Networks Prisma Ac… +1
- CVE-2022-24350An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5.
- CVE-2022-47053An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to exe
- CVE-2022-48437An issue was discovered in x509/x509_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001.
- CVE-2023-1906A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c.ImageMagick
- CVE-2023-1990A use-after-free flaw was found in ndlc_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel.Linux
- CVE-2023-1992RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture fiWireshark Foundation Wireshark
- CVE-2023-1993LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture fWireshark Foundation Wireshark
- CVE-2023-1994GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture fileWireshark Foundation Wireshark
- CVE-2023-22897An issue was discovered in SecurePoint UTM before 12.2.5.1.
- CVE-2023-23591The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs
- CVE-2023-24511On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process.Arista Networks EOS
- CVE-2023-24513On affected platforms running Arista CloudEOS a size check bypass issue in the Software Forwarding Engine (Sfe) may allow buffer over reads in later code. Additionally, depending on configured options this may cause a recomputation of the TCP checksum ...Arista Networks EOS
- CVE-2023-26374ZDI-CAN-20045: Adobe Dimension USD File Parsing Out-Of-Bounds Read Memory leak VulnerabilityAdobe Dimension
- CVE-2023-26375ZDI-CAN-20231: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26376ZDI-CAN-20155: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26377ZDI-CAN-20151: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26378ZDI-CAN-20148: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26379ZDI-CAN-20233: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26380ZDI-CAN-20150: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26381ZDI-CAN-20147: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26382ZDI-CAN-20156: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26385ZDI-CAN-20267: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26386ZDI-CAN-20266: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26387ZDI-CAN-20265: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26397[ZS-VR-22-112] Adobe Acrobat Out-of-bounds Read Memory leakAdobe Acrobat Reader
- CVE-2023-26400ZDI-CAN-20232: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26401ZDI-CAN-20278: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-26403ZDI-CAN-20259: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Substance3D - Stager
- CVE-2023-26404ZDI-CAN-20143: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-27703The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface.
- CVE-2023-27704Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service (ReDoS).
- CVE-2023-27775A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload.
- CVE-2023-28121An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behaWooCommerce Payments WordPress Plugin
- CVE-2023-28488client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-bas
- CVE-2023-29571Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c.
- CVE-2023-29574Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42avc component.
- CVE-2023-29580yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm_expr_create at /libyasm/expr.c.
- CVE-2023-29581yasm 1.3.0.55.g101bc has a segmentation violation in the function delete_Token at modules/preprocs/nasm/nasm-pp.c.
- CVE-2023-30512CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation.github.com/cubefs/cubefs