# CVEs published 2023-04-12

104 CVEs were published on April 12, 2023: 2 critical, 44 high. Days are UTC.

- [CVE-2023-30532](https://cve.now/CVE-2023-30532.md): A missing permission check in Jenkins TurboScript Plugin 1.3 and earlier allows attackers with Item/Read permission to trigger builds of job (CVSS 6.5, Jenkins Project Jenkins TurboScript Plugin · org.jenkinsci.…)
- [CVE-2023-30531](https://cve.now/CVE-2023-30531.md): Jenkins Consul KV Builder Plugin 2.0.13 and earlier does not mask the HashiCorp Consul ACL Token on the global configuration form, increasin (CVSS 6.5, Jenkins Project Jenkins Consul KV Builder Plugin · org.jenk…)
- [CVE-2023-30530](https://cve.now/CVE-2023-30530.md): Jenkins Consul KV Builder Plugin 2.0.13 and earlier stores the HashiCorp Consul ACL Token unencrypted in its global configuration file on th (CVSS 4.3, Jenkins Project Jenkins Consul KV Builder Plugin · org.jenk…)
- [CVE-2023-30529](https://cve.now/CVE-2023-30529.md): Jenkins Lucene-Search Plugin 387.v938a\_ecb\_f7fe9 and earlier does not require POST requests for an HTTP endpoint, allowing attackers to rein (CVSS 4.3, Jenkins Project Jenkins Lucene-Search Plugin · org.jenkins-…)
- [CVE-2023-30528](https://cve.now/CVE-2023-30528.md): Jenkins WSO2 Oauth Plugin 1.0 and earlier does not mask the WSO2 Oauth client secret on the global configuration form, increasing the potent (CVSS 6.5, Jenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…)
- [CVE-2023-30527](https://cve.now/CVE-2023-30527.md): Jenkins WSO2 Oauth Plugin 1.0 and earlier stores the WSO2 Oauth client secret unencrypted in the global config.xml file on the Jenkins contr (CVSS 4.3, Jenkins Project Jenkins WSO2 Oauth Plugin · org.jenkins-ci.…)
- [CVE-2023-30526](https://cve.now/CVE-2023-30526.md): A missing permission check in Jenkins Report Portal Plugin 0.5 and earlier allows attackers with Overall/Read permission to connect to an at (CVSS 6.5, Jenkins Project Jenkins Report Portal Plugin · org.jenkins-…)
- [CVE-2023-30525](https://cve.now/CVE-2023-30525.md): A cross-site request forgery (CSRF) vulnerability in Jenkins Report Portal Plugin 0.5 and earlier allows attackers to connect to an attacker (CVSS 8.8, Jenkins Project Jenkins Report Portal Plugin · org.jenkins-…)
- [CVE-2023-30524](https://cve.now/CVE-2023-30524.md): Jenkins Report Portal Plugin 0.5 and earlier does not mask ReportPortal access tokens displayed on the configuration form, increasing the po (CVSS 4.3, Jenkins Project Jenkins Report Portal Plugin · org.jenkins-…)
- [CVE-2023-30523](https://cve.now/CVE-2023-30523.md): Jenkins Report Portal Plugin 0.5 and earlier stores ReportPortal access tokens unencrypted in job config.xml files on the Jenkins controller (CVSS 4.3, Jenkins Project Jenkins Report Portal Plugin · org.jenkins-…)
- [CVE-2023-30522](https://cve.now/CVE-2023-30522.md): A missing permission check in Jenkins Fogbugz Plugin 2.2.17 and earlier allows attackers with Item/Read permission to trigger builds of jobs (CVSS 4.3, Jenkins Project Jenkins Fogbugz Plugin · org.jenkins-ci.plu…)
- [CVE-2023-30521](https://cve.now/CVE-2023-30521.md): A missing permission check in Jenkins Assembla merge request builder Plugin 1.1.13 and earlier allows unauthenticated attackers to trigger b (CVSS 5.3, Jenkins Project Jenkins Assembla merge request builder Plug…)
- [CVE-2023-30520](https://cve.now/CVE-2023-30520.md): Jenkins Quay.io trigger Plugin 0.1 and earlier does not limit URL schemes for repository homepage URLs submitted via Quay.io trigger webhook (CVSS 5.4, Jenkins Project Jenkins Quay.io trigger Plugin · org.jenkin…)
- [CVE-2023-30519](https://cve.now/CVE-2023-30519.md): A missing permission check in Jenkins Quay.io trigger Plugin 0.1 and earlier allows unauthenticated attackers to trigger builds of jobs corr (CVSS 5.3, Jenkins Project Jenkins Quay.io trigger Plugin · org.jenkin…)
- [CVE-2023-30518](https://cve.now/CVE-2023-30518.md): A missing permission check in Jenkins Thycotic Secret Server Plugin 1.0.2 and earlier allows attackers with Overall/Read permission to enume (CVSS 4.3, Jenkins Project Jenkins Thycotic Secret Server Plugin · io.…)
- [CVE-2023-30517](https://cve.now/CVE-2023-30517.md): Jenkins NeuVector Vulnerability Scanner Plugin 1.22 and earlier unconditionally disables SSL/TLS certificate and hostname validation when co (CVSS 5.3, Jenkins Project Jenkins NeuVector Vulnerability Scanner Plu…)
- [CVE-2023-30516](https://cve.now/CVE-2023-30516.md): Jenkins Image Tag Parameter Plugin 2.0 improperly introduces an option to opt out of SSL/TLS certificate validation when connecting to Docke (CVSS 6.5, Jenkins Project Jenkins Image Tag Parameter Plugin · org.je…)
- [CVE-2023-30515](https://cve.now/CVE-2023-30515.md): Jenkins Thycotic DevOps Secrets Vault Plugin 1.0.0 and earlier does not properly mask (i.e., replace with asterisks) credentials in the buil (CVSS 7.5, Jenkins Project Jenkins Thycotic DevOps Secrets Vault Plugi…)
- [CVE-2023-30514](https://cve.now/CVE-2023-30514.md): Jenkins Azure Key Vault Plugin 187.va\_cd5fecd198a\_ and earlier does not properly mask (i.e., replace with asterisks) credentials in the buil (CVSS 7.5, Jenkins Project Jenkins Azure Key Vault Plugin · org.jenkin…)
- [CVE-2023-30513](https://cve.now/CVE-2023-30513.md): Jenkins Kubernetes Plugin 3909.v1f2c633e8590 and earlier does not properly mask (i.e., replace with asterisks) credentials in the build log (CVSS 7.5, Jenkins Project Jenkins Kubernetes Plugin · org.csanchez.je…)
- [CVE-2023-0006](https://cve.now/CVE-2023-0006.md): GlobalProtect App: Local File Deletion Vulnerability (CVSS 6.3, Palo Alto Networks GlobalProtect app)
- [CVE-2023-0005](https://cve.now/CVE-2023-0005.md): PAN-OS: Exposure of Sensitive Information Vulnerability (CVSS 4.1, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Ac… +1)
- [CVE-2023-0004](https://cve.now/CVE-2023-0004.md): PAN-OS: Local File Deletion Vulnerability (CVSS 6.5, Palo Alto Networks PAN-OS · Palo Alto Networks Prisma Ac… +1)
- [CVE-2023-1872](https://cve.now/CVE-2023-1872.md): Use-after-free in Linux kernel's io\_uring subsystem (CVSS 7.8, Linux Kernel)
- [CVE-2022-47605](https://cve.now/CVE-2022-47605.md): WordPress Custom 404 Pro Plugin \<= 3.7.0 is vulnerable to SQL Injection (SQLi) (CVSS 8.3, Kunal Nagar Custom 404 Pro)
- [CVE-2023-1874](https://cve.now/CVE-2023-1874.md): WP Data Access \<= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation (CVSS 7.5, peterschulznl WP Data Access – App Builder for Tables, Form…)
- [CVE-2023-1829](https://cve.now/CVE-2023-1829.md): Use-after-free in tcindex (traffic control index filter) in the Linux Kernel (CVSS 7.8, Linux Kernel)
- [CVE-2022-24350](https://cve.now/CVE-2022-24350.md): An issue was discovered in IhisiSmm in Insyde InsydeH2O with kernel 5.0 through 5.5. (CVSS 5.5)
- [CVE-2022-47053](https://cve.now/CVE-2022-47053.md): An arbitrary file upload vulnerability in the Digital Assets Manager module of DNN Corp DotNetNuke v7.0.0 to v9.10.2 allows attackers to exe (CVSS 5.4)
- [CVE-2022-48437](https://cve.now/CVE-2022-48437.md): An issue was discovered in x509/x509\_verify.c in LibreSSL before 3.6.1, and in OpenBSD before 7.2 errata 001. (CVSS 5.3)
- [CVE-2023-1906](https://cve.now/CVE-2023-1906.md): A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. (CVSS 5.5, ImageMagick)
- [CVE-2023-1990](https://cve.now/CVE-2023-1990.md): A use-after-free flaw was found in ndlc\_remove in drivers/nfc/st-nci/ndlc.c in the Linux Kernel. (CVSS 4.7, Linux)
- [CVE-2023-1992](https://cve.now/CVE-2023-1992.md): RPCoRDMA dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture fi (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-1993](https://cve.now/CVE-2023-1993.md): LISP dissector large loop in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture f (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-1994](https://cve.now/CVE-2023-1994.md): GQUIC dissector crash in Wireshark 4.0.0 to 4.0.4 and 3.6.0 to 3.6.12 allows denial of service via packet injection or crafted capture file (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2023-21582](https://cve.now/CVE-2023-21582.md): ZDI-CAN-18255: Adobe Digital Editions PDF File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Digital Editions)
- [CVE-2023-22235](https://cve.now/CVE-2023-22235.md): Adobe InCopy SVG file Use After Free Arbitrary code execution (CVSS 7.8, Adobe InCopy)
- [CVE-2023-22616](https://cve.now/CVE-2023-22616.md): An issue was discovered in Insyde InsydeH2O with kernel 5.2 through 5.5. (CVSS 7.8)
- [CVE-2023-22620](https://cve.now/CVE-2023-22620.md): An issue was discovered in SecurePoint UTM before 12.2.5.1. (CVSS 7.5)
- [CVE-2023-22897](https://cve.now/CVE-2023-22897.md): An issue was discovered in SecurePoint UTM before 12.2.5.1. (CVSS 6.5)
- [CVE-2023-23591](https://cve.now/CVE-2023-23591.md): The Logback component in Terminalfour before 8.3.14.1 allows OS administrators to obtain sensitive information from application server logs (CVSS 4.9)
- [CVE-2023-24511](https://cve.now/CVE-2023-24511.md): On affected platforms running Arista EOS with SNMP configured, a specially crafted packet can cause a memory leak in the snmpd process. (CVSS 5.3, Arista Networks EOS)
- [CVE-2023-24513](https://cve.now/CVE-2023-24513.md): On affected platforms running Arista CloudEOS a size check bypass issue in the Software Forwarding Engine (Sfe) may allow buffer over reads in later code. Additionally, depending on configured options this may cause a recomputation of the TCP checksum ... (CVSS 6.5, Arista Networks EOS)
- [CVE-2023-24545](https://cve.now/CVE-2023-24545.md): On affected platforms running Arista CloudEOS an issue in the Software Forwarding Engine (Sfe) can lead to a potential denial of service attack by sending malformed packets to the switch. (CVSS 7.5, Arista Networks EOS)
- [CVE-2023-26371](https://cve.now/CVE-2023-26371.md): Validate Your Inputs | Out-of-bounds Read (CWE-125) (CVSS 7.8, Adobe Dimension)
- [CVE-2023-26372](https://cve.now/CVE-2023-26372.md): ZDI-CAN-20284: Adobe Dimension USDZ File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Dimension)
- [CVE-2023-26373](https://cve.now/CVE-2023-26373.md): Adobe Dimension has an arbitrary address write vulnerability when parsing USDZ files (CVSS 7.8, Adobe Dimension)
- [CVE-2023-26374](https://cve.now/CVE-2023-26374.md): ZDI-CAN-20045: Adobe Dimension USD File Parsing Out-Of-Bounds Read Memory leak Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26375](https://cve.now/CVE-2023-26375.md): ZDI-CAN-20231: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26376](https://cve.now/CVE-2023-26376.md): ZDI-CAN-20155: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26377](https://cve.now/CVE-2023-26377.md): ZDI-CAN-20151: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26378](https://cve.now/CVE-2023-26378.md): ZDI-CAN-20148: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26379](https://cve.now/CVE-2023-26379.md): ZDI-CAN-20233: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26380](https://cve.now/CVE-2023-26380.md): ZDI-CAN-20150: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26381](https://cve.now/CVE-2023-26381.md): ZDI-CAN-20147: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26382](https://cve.now/CVE-2023-26382.md): ZDI-CAN-20156: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26383](https://cve.now/CVE-2023-26383.md): ZDI-CAN-20287: Adobe Substance 3D Stager USDA File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-26384](https://cve.now/CVE-2023-26384.md): ZDI-CAN-20279: Adobe Substance 3D Stager USD File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-26385](https://cve.now/CVE-2023-26385.md): ZDI-CAN-20267: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2023-26386](https://cve.now/CVE-2023-26386.md): ZDI-CAN-20266: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure Vulnerability (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2023-26387](https://cve.now/CVE-2023-26387.md): ZDI-CAN-20265: Adobe Substance 3D Stager USDC File Parsing Uninitialized Variable Information Disclosure Vulnerability (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2023-26388](https://cve.now/CVE-2023-26388.md): ZDI-CAN-20286: Adobe Substance 3D Stager USDZ File Parsing Memory Corruption Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-26389](https://cve.now/CVE-2023-26389.md): ZDI-CAN-20258: Adobe Substance 3D Stager USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-26390](https://cve.now/CVE-2023-26390.md): ZDI-CAN-20255: Adobe Substance 3D Stager USDA File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-26391](https://cve.now/CVE-2023-26391.md): ZDI-CAN-20256: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-26392](https://cve.now/CVE-2023-26392.md): ZDI-CAN-20235: Adobe Substance 3D Stager USD File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-26393](https://cve.now/CVE-2023-26393.md): ZDI-CAN-20234: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-26394](https://cve.now/CVE-2023-26394.md): ZDI-CAN-20236: Adobe Substance 3D Stager USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-26395](https://cve.now/CVE-2023-26395.md): Adobe Acrobat parsing PDF Out-of-bounds Write Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26396](https://cve.now/CVE-2023-26396.md): Adobe Acrobat Reader DC for macOS installer (AcroRdrDC\_2200220191\_MUI.pkg) contains a local privilege escalation vulnerability. (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26397](https://cve.now/CVE-2023-26397.md): \[ZS-VR-22-112\] Adobe Acrobat Out-of-bounds Read Memory leak (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-26400](https://cve.now/CVE-2023-26400.md): ZDI-CAN-20232: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26401](https://cve.now/CVE-2023-26401.md): ZDI-CAN-20278: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26402](https://cve.now/CVE-2023-26402.md): ZDI-CAN-20237: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Stager)
- [CVE-2023-26403](https://cve.now/CVE-2023-26403.md): ZDI-CAN-20259: Adobe Substance 3D Stager USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Substance3D - Stager)
- [CVE-2023-26404](https://cve.now/CVE-2023-26404.md): ZDI-CAN-20143: Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-26405](https://cve.now/CVE-2023-26405.md): ZDI-CAN-20712: Object Prototype pollution which leads to API Restrictions Bypass (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26406](https://cve.now/CVE-2023-26406.md): ZDI-CAN-20712: Net.HTTP.request URL restriction bypass (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26407](https://cve.now/CVE-2023-26407.md): ZDI-CAN-20712: Net.HTTP.request Arbitrary Command Execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26408](https://cve.now/CVE-2023-26408.md): ZDI-CAN-20712: AnnotsString Object prototype pollution Restrictions Bypass Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26417](https://cve.now/CVE-2023-26417.md): ZDI-CAN-20583: Adobe Acrobat Reader DC Popup Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26418](https://cve.now/CVE-2023-26418.md): ZDI-CAN-20311: Adobe Acrobat Reader DC AcroForm exportAsFDFStr Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26419](https://cve.now/CVE-2023-26419.md): ZDI-CAN-20274: Adobe Acrobat Reader DC AcroForm removeField Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26420](https://cve.now/CVE-2023-26420.md): ZDI-CAN-20227: Adobe Acrobat Reader DC AcroForm addField Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26421](https://cve.now/CVE-2023-26421.md): ZDI-CAN-19832: Adobe Acrobat Reader DC Doc Object Integer Underflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26422](https://cve.now/CVE-2023-26422.md): ZDI-CAN-20176: Adobe Acrobat Reader DC AcroForm deleteItemAt Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26423](https://cve.now/CVE-2023-26423.md): ZDI-CAN-20160: Adobe Acrobat Reader DC AcroForm insertItemAt Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26424](https://cve.now/CVE-2023-26424.md): ZDI-CAN-19833: Adobe Acrobat Reader DC PDF Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26425](https://cve.now/CVE-2023-26425.md): ZDI-CAN-19854: Adobe Acrobat Reader DC Annotation Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-26852](https://cve.now/CVE-2023-26852.md): An arbitrary file upload vulnerability in the upload plugin of Textpattern v4.8.8 and below allows attackers to execute arbitrary code by up (CVSS 7.2)
- [CVE-2023-27032](https://cve.now/CVE-2023-27032.md): Prestashop advancedpopupcreator v1.1.21 to v1.1.24 was discovered to contain a SQL injection vulnerability via the component AdvancedPopup:: (CVSS 9.8)
- [CVE-2023-27216](https://cve.now/CVE-2023-27216.md): An issue found in D-Link DSL-3782 v.1.03 allows remote authenticated users to execute arbitrary code as root via the network settings page. (CVSS 8.8)
- [CVE-2023-27703](https://cve.now/CVE-2023-27703.md): The Android version of pikpak v1.29.2 was discovered to contain an information leak via the debug interface. (CVSS 3.3)
- [CVE-2023-27704](https://cve.now/CVE-2023-27704.md): Void Tools Everything lower than v1.4.1.1022 was discovered to contain a Regular Expression Denial of Service (ReDoS). (CVSS 5.5)
- [CVE-2023-27775](https://cve.now/CVE-2023-27775.md): A stored HTML injection vulnerability in LiveAction LiveSP v21.1.2 allows attackers to execute arbitrary code via a crafted payload. (CVSS 5.4)
- [CVE-2023-27826](https://cve.now/CVE-2023-27826.md): SeowonIntech SWC 5100W WIMAX Bootloader 1.18.19.0, HW 0.0.7.0, and FW 1.11.0.1, 1.9.9.4 are vulnerable to OS Command Injection. (CVSS 8.8)
- [CVE-2023-27830](https://cve.now/CVE-2023-27830.md): TightVNC before v2.8.75 allows attackers to escalate privileges on the host operating system via replacing legitimate files with crafted fil (CVSS 9.0)
- [CVE-2023-28121](https://cve.now/CVE-2023-28121.md): An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on beha (no CVSS, WooCommerce Payments WordPress Plugin)
- [CVE-2023-28488](https://cve.now/CVE-2023-28488.md): client.c in gdhcp in ConnMan through 1.41 could be used by network-adjacent attackers (operating a crafted DHCP server) to cause a stack-bas (CVSS 6.5)
- [CVE-2023-29571](https://cve.now/CVE-2023-29571.md): Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc\_sweep at src/mjs\_gc.c. (CVSS 5.5)
- [CVE-2023-29574](https://cve.now/CVE-2023-29574.md): Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42avc component. (CVSS 5.5)
- [CVE-2023-29580](https://cve.now/CVE-2023-29580.md): yasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component yasm\_expr\_create at /libyasm/expr.c. (CVSS 5.5)
- [CVE-2023-29581](https://cve.now/CVE-2023-29581.md): yasm 1.3.0.55.g101bc has a segmentation violation in the function delete\_Token at modules/preprocs/nasm/nasm-pp.c. (CVSS 5.5)
- [CVE-2023-30512](https://cve.now/CVE-2023-30512.md): CubeFS through 3.2.1 allows Kubernetes cluster-level privilege escalation. (CVSS 6.5, github.com/cubefs/cubefs)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.