CVEs published April 13, 2023
42 CVEs were published on April 13, 2023: 7 critical, 20 high.
- Published
- 42
- Critical
- 7
- High
- 20
- Medium
- 13
- Low
- 0
- Unrated
- 2
- Now in CISA KEV
- 0
- Fix available
- 6
Most affected products
- Adobe Substance3D - Designer
- 9
- Apache Software Foundation Apache Sling Engine · org.apache…
- 1
- Arista Networks Arista EOS
- 1
- Canonical Apport
- 1
- Kyocera Document Solutions, TA Triumph-Adler GmbH, and Oliv…
- 1
- microweber/microweber
- 1
- nilsteampassnet/teampass
- 1
- Silkalns Activello
- 1
- Spring Framework · org.springframework:spring-expression
- 1
- Spring Session · org.springframework.session:spring-session…
- 1
Critical 7
- CVE-2023-24509On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading t ...Arista Networks Arista EOS
- CVE-2023-26918Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be e
- CVE-2023-27667Auto Dealer Management System v1.0 was discovered to contain a SQL injection vulnerability.
- CVE-2023-27746BlackVue DR750-2CH LTE v.1.012_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force
- CVE-2023-27748BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authenticity check for uploaded firmware.
- CVE-2023-27779AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form.
- CVE-2023-29598lmxcms v1.4.1 was discovered to contain a SQL injection vulnerability via the setbook parameter at index.php.
High 20
- CVE-2023-1326local privilege escalation in apport-cliCanonical Apport
- CVE-2022-45064Apache Sling Engine: Include-based XSSApache Software Foundation Apache Sling Engine · org.apache…
- CVE-2023-22951An issue was discovered in TigerGraph Enterprise Free Edition 3.x.
- CVE-2023-26398ZDI-CAN-20310: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26409ZDI-CAN-20313: Adobe Substance 3D Designer USD File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26410ZDI-CAN-20309: Adobe Substance 3D Designer USD File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26411ZDI-CAN-20312: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26412ZDI-CAN-20314: Adobe Substance 3D Designer USDA File Parsing Stack-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26413ZDI-CAN-20315: Adobe Substance 3D Designer USD File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26414ZDI-CAN-20316: Adobe Substance 3D Designer USD File Parsing Use-After-Free Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26415ZDI-CAN-20317: Adobe Substance 3D Designer DAE File Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-26416ZDI-CAN-20318: Adobe Substance 3D Designer DAE File Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe Substance3D - Designer
- CVE-2023-27747BlackVue DR750-2CH LTE v.1.012_2022.10.26 does not employ authentication in its web server.
- CVE-2023-27772libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient_setOrigin() at /client/client_con
- CVE-2023-29084Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.
- CVE-2023-30630Dmidecode before 3.5 allows -dump-bin to overwrite a local file.
- CVE-2023-30635TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error) upon an attempt to get a timestamp from the Placement Driver.
- CVE-2023-30636TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error, with RpcStatus UNAVAILABLE for "not leader") upon an attempt t
- CVE-2023-30637Baidu braft 1.1.2 has a memory leak related to use of the new operator in example/atomic/atomic_server.
- CVE-2023-30638Atos Unify OpenScape SBC 10 before 10R3.1.3, OpenScape Branch 10 before 10R3.1.2, and OpenScape BCF 10 before 10R10.7.0 allow remote authent
Medium, low and unrated 15
- CVE-2022-45358WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)Silkalns Activello
- CVE-2022-44625WordPress Cyklodev WP Notify Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)Zephilou Cyklodev WP Notify
- CVE-2022-48468protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.
- CVE-2023-2014Cross-site Scripting (XSS) - Generic in microweber/microwebermicroweber/microweber
- CVE-2023-2021Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampassnilsteampassnet/teampass
- CVE-2023-20863In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL exSpring Framework · org.springframework:spring-expression
- CVE-2023-20866In Spring Session version 3.0.0, the session id can be logged to the standard output stream.Spring Session · org.springframework.session:spring-session…
- CVE-2023-22948An issue was discovered in TigerGraph Enterprise Free Edition 3.x.
- CVE-2023-22950An issue was discovered in TigerGraph Enterprise Free Edition 3.x.
- CVE-2023-25954KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 Kyocera Document Solutions, TA Triumph-Adler GmbH, and Oliv…
- CVE-2023-26263All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServi
- CVE-2023-26264All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsi
- CVE-2023-27812bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete_file() function.
- CVE-2023-29573Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component.
- CVE-2023-29597bloofox v0.5.2 was discovered to contain a SQL injection vulnerability via the component /index.php?mode=content&page=pages&action=edit&eid=