# CVEs published 2023-04-13

42 CVEs were published on April 13, 2023: 7 critical, 20 high. Days are UTC.

- [CVE-2023-1326](https://cve.now/CVE-2023-1326.md): local privilege escalation in apport-cli (CVSS 7.7, Canonical Apport)
- [CVE-2022-45358](https://cve.now/CVE-2022-45358.md): WordPress Activello Theme \<= 1.4.4 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.4, Silkalns Activello)
- [CVE-2022-44625](https://cve.now/CVE-2022-44625.md): WordPress Cyklodev WP Notify Plugin \<= 1.2.1 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, Zephilou Cyklodev WP Notify)
- [CVE-2022-45064](https://cve.now/CVE-2022-45064.md): Apache Sling Engine: Include-based XSS (CVSS 8.0, Apache Software Foundation Apache Sling Engine · org.apache…)
- [CVE-2022-48468](https://cve.now/CVE-2022-48468.md): protobuf-c before 1.4.1 has an unsigned integer overflow in parse\_required\_member. (CVSS 5.5)
- [CVE-2023-2014](https://cve.now/CVE-2023-2014.md): Cross-site Scripting (XSS) - Generic in microweber/microweber (CVSS 5.3, microweber/microweber)
- [CVE-2023-2021](https://cve.now/CVE-2023-2021.md): Cross-site Scripting (XSS) - Stored in nilsteampassnet/teampass (CVSS 5.8, nilsteampassnet/teampass)
- [CVE-2023-20863](https://cve.now/CVE-2023-20863.md): In spring framework versions prior to 5.2.24 release+ ,5.3.27+ and 6.0.8+ , it is possible for a user to provide a specially crafted SpEL ex (CVSS 6.5, Spring Framework · org.springframework:spring-expression)
- [CVE-2023-20866](https://cve.now/CVE-2023-20866.md): In Spring Session version 3.0.0, the session id can be logged to the standard output stream. (CVSS 6.5, Spring Session · org.springframework.session:spring-session…)
- [CVE-2023-22948](https://cve.now/CVE-2023-22948.md): An issue was discovered in TigerGraph Enterprise Free Edition 3.x. (CVSS 4.9)
- [CVE-2023-22950](https://cve.now/CVE-2023-22950.md): An issue was discovered in TigerGraph Enterprise Free Edition 3.x. (CVSS 6.5)
- [CVE-2023-22951](https://cve.now/CVE-2023-22951.md): An issue was discovered in TigerGraph Enterprise Free Edition 3.x. (CVSS 8.8)
- [CVE-2023-24509](https://cve.now/CVE-2023-24509.md): On affected modular platforms running Arista EOS equipped with both redundant supervisor modules and having the redundancy protocol configured with RPR or SSO, an existing unprivileged user can login to the standby supervisor as a root user, leading t ... (CVSS 9.3, Arista Networks Arista EOS)
- [CVE-2023-25954](https://cve.now/CVE-2023-25954.md): KYOCERA Mobile Print' v3.2.0.230119 and earlier, 'UTAX/TA MobilePrint' v3.2.0.230119 and earlier, and 'Olivetti Mobile Print' v3.2.0.230119 (CVSS 5.5, Kyocera Document Solutions, TA Triumph-Adler GmbH, and Oliv…)
- [CVE-2023-26263](https://cve.now/CVE-2023-26263.md): All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServi (CVSS 5.5)
- [CVE-2023-26264](https://cve.now/CVE-2023-26264.md): All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsi (CVSS 5.5)
- [CVE-2023-26398](https://cve.now/CVE-2023-26398.md): ZDI-CAN-20310: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26409](https://cve.now/CVE-2023-26409.md): ZDI-CAN-20313: Adobe Substance 3D Designer USD File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26410](https://cve.now/CVE-2023-26410.md): ZDI-CAN-20309: Adobe Substance 3D Designer USD File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26411](https://cve.now/CVE-2023-26411.md): ZDI-CAN-20312: Adobe Substance 3D Designer USDC File Parsing Out-Of-Bounds Read Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26412](https://cve.now/CVE-2023-26412.md): ZDI-CAN-20314: Adobe Substance 3D Designer USDA File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26413](https://cve.now/CVE-2023-26413.md): ZDI-CAN-20315: Adobe Substance 3D Designer USD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26414](https://cve.now/CVE-2023-26414.md): ZDI-CAN-20316: Adobe Substance 3D Designer USD File Parsing Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26415](https://cve.now/CVE-2023-26415.md): ZDI-CAN-20317: Adobe Substance 3D Designer DAE File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26416](https://cve.now/CVE-2023-26416.md): ZDI-CAN-20318: Adobe Substance 3D Designer DAE File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Substance3D - Designer)
- [CVE-2023-26918](https://cve.now/CVE-2023-26918.md): Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be e (CVSS 9.8)
- [CVE-2023-27667](https://cve.now/CVE-2023-27667.md): Auto Dealer Management System v1.0 was discovered to contain a SQL injection vulnerability. (CVSS 9.8)
- [CVE-2023-27746](https://cve.now/CVE-2023-27746.md): BlackVue DR750-2CH LTE v.1.012\_2022.10.26 was discovered to contain a weak default passphrase which can be easily cracked via a brute force (CVSS 9.8)
- [CVE-2023-27747](https://cve.now/CVE-2023-27747.md): BlackVue DR750-2CH LTE v.1.012\_2022.10.26 does not employ authentication in its web server. (CVSS 7.5)
- [CVE-2023-27748](https://cve.now/CVE-2023-27748.md): BlackVue DR750-2CH LTE v.1.012\_2022.10.26 does not employ authenticity check for uploaded firmware. (CVSS 9.8)
- [CVE-2023-27772](https://cve.now/CVE-2023-27772.md): libiec61850 v1.5.1 was discovered to contain a segmentation violation via the function ControlObjectClient\_setOrigin() at /client/client\_con (CVSS 7.5)
- [CVE-2023-27779](https://cve.now/CVE-2023-27779.md): AM Presencia v3.7.3 was discovered to contain a SQL injection vulnerability via the user parameter in the login form. (CVSS 9.8)
- [CVE-2023-27812](https://cve.now/CVE-2023-27812.md): bloofox v0.5.2 was discovered to contain an arbitrary file deletion vulnerability via the delete\_file() function. (no CVSS)
- [CVE-2023-29084](https://cve.now/CVE-2023-29084.md): Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings. (CVSS 7.2)
- [CVE-2023-29573](https://cve.now/CVE-2023-29573.md): Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp4info component. (CVSS 5.5)
- [CVE-2023-29597](https://cve.now/CVE-2023-29597.md): bloofox v0.5.2 was discovered to contain a SQL injection vulnerability via the component /index.php?mode=content&page=pages&action=edit&eid= (no CVSS)
- [CVE-2023-29598](https://cve.now/CVE-2023-29598.md): lmxcms v1.4.1 was discovered to contain a SQL injection vulnerability via the setbook parameter at index.php. (CVSS 9.8)
- [CVE-2023-30630](https://cve.now/CVE-2023-30630.md): Dmidecode before 3.5 allows -dump-bin to overwrite a local file. (CVSS 7.1)
- [CVE-2023-30635](https://cve.now/CVE-2023-30635.md): TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error) upon an attempt to get a timestamp from the Placement Driver. (CVSS 7.5)
- [CVE-2023-30636](https://cve.now/CVE-2023-30636.md): TiKV 6.1.2 allows remote attackers to cause a denial of service (fatal error, with RpcStatus UNAVAILABLE for "not leader") upon an attempt t (CVSS 7.5)
- [CVE-2023-30637](https://cve.now/CVE-2023-30637.md): Baidu braft 1.1.2 has a memory leak related to use of the new operator in example/atomic/atomic\_server. (CVSS 7.5)
- [CVE-2023-30638](https://cve.now/CVE-2023-30638.md): Atos Unify OpenScape SBC 10 before 10R3.1.3, OpenScape Branch 10 before 10R3.1.2, and OpenScape BCF 10 before 10R10.7.0 allow remote authent (CVSS 7.2)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.