CVEs published April 14, 2023
111 CVEs were published on April 14, 2023: 21 critical, 30 high. 1 is now in CISA KEV.
- Published
- 111
- Critical
- 21
- High
- 30
- Medium
- 48
- Low
- 6
- Unrated
- 6
- Now in CISA KEV
- 1
- Fix available
- 17
Most affected products
- Campcodes Advanced Online Voting System
- 9
- Autodesk AutoCAD
- 5
- Campcodes Online Traffic Offense Management System
- 5
- Campcodes Video Sharing Website
- 4
- novel-plus
- 3
- DedeCMS
- 2
- DTS Electronics Redline Router
- 2
- EyouCms
- 2
- Apache Software Foundation Apache OFBiz
- 1
- authzed spicedb · github.com/authzed/spicedb
- 1
Critical 21
- CVE-2023-29199vm2 Sandbox escape vulnerabilitypatriksimek vm2 · vm2
- CVE-2022-3748Improper authorization that can lead to account impersonationForgeRock Access Management
- CVE-2023-1833Authentication Bypass in Redline RouterDTS Electronics Redline Router
- CVE-2023-1803Authentication Bypass in Redline RouterDTS Electronics Redline Router
- CVE-2023-1617Improper Authentication Mechanism in B&R VC4 VisualizationB&R Industrial Automation B&R VC4
- CVE-2023-1863SQLi in Eskom Computer Water Metering SoftwareEskom Water Metering Software
- CVE-2021-46880x509/x509_verify.c in LibreSSL before 3.4.2, and OpenBSD before 7.0 errata 006, allows authentication bypass because an error for an unverif
- CVE-2022-45173An issue was discovered in LIVEBOX Collaboration vDesk through v018.
- CVE-2022-45174An issue was discovered in LIVEBOX Collaboration vDesk through v018.
- CVE-2022-47027Timmystudios Fast Typing Keyboard v1.275.1.162 allows unauthorized apps to overwrite arbitrary files in its internal storage via a dictionar
- CVE-2023-2034Unrestricted Upload of File with Dangerous Type in froxlor/froxlorfroxlor/froxlor
- CVE-2023-26463strongSwan 5.9.8 and 5.9.9 potentially allows remote code execution because it uses a variable named "public" for two different purposes wit
- CVE-2023-27648Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrary c
- CVE-2023-27654An issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a escalation of privileges via the TTMultiProvider component.
- CVE-2023-29622Purchase Order Management v1.0 was discovered to contain a SQL injection vulnerability via the password parameter at /purchase_order/admin/l
- CVE-2023-29798TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTracero
- CVE-2023-29800TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFir
- CVE-2023-29801TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServ
- CVE-2023-29802TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg
- CVE-2023-29803TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the pid parameter in the disconnectVPN
- CVE-2023-29805WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the pro_stor_canceltrans_handler_part_19 function.
High 30
- CVE-2023-30535Snowflake JDBC vulnerable to command injection via SSO URL authenticationsnowflakedb snowflake-jdbc · net.snowflake:snowflake-jdbc
- CVE-2023-29193SpiceDB binding metrics port to untrusted networks and can leak command-line flagsauthzed spicedb · github.com/authzed/spicedb
- CVE-2023-2073Campcodes Online Traffic Offense Management System Login.php sql injectionCampcodes Online Traffic Offense Management System
- CVE-2023-29018 OpenFeature Operator vulnerable to Cluster-level Privilege Escalationopen-feature-operator · github.com/open-feature/open-featur…
- CVE-2023-29013HTTP header parsing could cause a deny of servicetraefik · github.com/traefik/traefik/v2
- CVE-2023-2033Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a craftedGoogle Chrome
- CVE-2022-47501Apache OFBiz: Arbitrary file reading vulnerabilityApache Software Foundation Apache OFBiz
- CVE-2023-1285Signal Handler Race Condition vulnerability in Mitsubishi Electric India GC-ENET-COM whose first 2 digits of 11-digit serial number of unit Mitsubishi Electric India GC-ENET-COM
- CVE-2022-45178An issue was discovered in LIVEBOX Collaboration vDesk through v018.
- CVE-2023-2008Kernel: udmabuf: improper validation of array index leading to local privilege escalationLinux kernel · Red Hat Enterprise Linux
- CVE-2023-26969Atropim 1.5.26 is vulnerable to Directory Traversal.
- CVE-2023-27193An issue found in DUALSPACE v.1.1.3 allows a local attacker to gain privileges via the key_ad_new_user_avoid_time field.
- CVE-2023-27643An issue found in POWERAMP 925-bundle-play and Poweramp 954-uni allows a remote attacker to cause a denial of service via the Rescan button
- CVE-2023-27647An issue found in DUALSPACE Lock Master v.2.2.4 allows a local attacker to cause a denial of service or gain sensitive information via the c
- CVE-2023-27649SQL injection vulnerability found in Trusted Tools Free Music v.2.1.0.47, v.2.0.0.46, v.1.9.1.45, v.1.8.2.43 allows a remote attacker to cau
- CVE-2023-27651An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges via the update_info field of the _default_
- CVE-2023-27653An issue found in WHOv.1.0.28, v.1.0.30, v.1.0.32 allows an attacker to cause a denial of service via the SharedPreference files.
- CVE-2023-27912A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 can force an Out-of-Bound Read.Autodesk AutoCAD
- CVE-2023-27913A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 can be used to cause an Integer Overflow.Autodesk AutoCAD
- CVE-2023-27914A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 can be used to write beyond the allocated buffer causing a Stack Autodesk AutoCAD
- CVE-2023-27915A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by read access violAutodesk AutoCAD
- CVE-2023-29067A maliciously crafted X_B file when parsed through Autodesk® AutoCAD® 2023 could lead to memory corruption vulnerability by write access vioAutodesk AutoCAD
- CVE-2023-29584mp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the MP4GetVideoProfileLevel function at /src/mp4.cpp.
- CVE-2023-29621Purchase Order Management v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary
- CVE-2023-29625Employee Performance Evaluation System v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execu
- CVE-2023-29626Yoga Class Registration System 1.0 was discovered to contain a SQL injection vulnerability via the cid parameter at /admin/login.php.
- CVE-2023-29627Online Pizza Ordering v1.0 was discovered to contain an arbitrary file upload vulnerability which allows attackers to execute arbitrary code
- CVE-2023-29804WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the sys_smb_pwdmod function.
- CVE-2023-29850SENAYAN Library Management System (SLiMS) Bulian v9.5.2 does not strip exif data from uploaded images.
- CVE-2023-30459SmartPTT SCADA 1.1.0.0 allows remote code execution (when the attacker has administrator privileges) by writing a malicious C# script and ex
Medium, low and unrated 60
- CVE-2023-24934Microsoft Defender Security Feature Bypass VulnerabilityMicrosoft Malware Protection Platform
- CVE-2023-2077Campcodes Online Traffic Offense Management System view_details.php cross site scriptingCampcodes Online Traffic Offense Management System
- CVE-2023-2076Campcodes Online Traffic Offense Management System Users.phpp cross site scriptingCampcodes Online Traffic Offense Management System
- CVE-2023-2075Campcodes Online Traffic Offense Management System view_details.php sql injectionCampcodes Online Traffic Offense Management System
- CVE-2023-2074Campcodes Online Traffic Offense Management System Master.php sql injectionCampcodes Online Traffic Offense Management System
- CVE-2023-29194vitess allows users to create keyspaces that can deny access to already existing keyspacesvitessio vitess · vitess.io/vitess
- CVE-2023-29529matrix-js-sdk vulnerable to invisible eavesdropping in group callsmatrix-org matrix-js-sdk · matrix-js-sdk
- CVE-2023-28085An HPE OneView Global Dashboard (OVGD) appliance dump may expose OVGD user account credentialsHewlett Packard Enterprise (HPE) HPE OneView Global Dashboa…
- CVE-2023-28091HPE OneView virtual appliance "Migrate server hardware" option may expose sensitive information in an HPE OneView support dumpHewlett Packard Enterprise (HPE) HPE OneView
- CVE-2023-2059DedeCMS select_templets.php path traversalDedeCMS
- CVE-2023-2058EyouCms HTTP POST Request cross site scriptingEyouCms
- CVE-2023-2057EyouCms New Picture cross site scriptingEyouCms
- CVE-2023-2056DedeCMS module_main.php GetSystemFile code injectionDedeCMS
- CVE-2023-2055Campcodes Advanced Online Voting System config_save.php cross site scriptingCampcodes Advanced Online Voting System
- CVE-2023-2054Campcodes Advanced Online Voting System positions_delete.php sql injectionCampcodes Advanced Online Voting System
- CVE-2023-2053Campcodes Advanced Online Voting System candidates_row.php sql injectionCampcodes Advanced Online Voting System
- CVE-2023-2052Campcodes Advanced Online Voting System ballot_down.php sql injectionCampcodes Advanced Online Voting System
- CVE-2023-2051Campcodes Advanced Online Voting System positions_row.php sql injectionCampcodes Advanced Online Voting System
- CVE-2023-2050Campcodes Advanced Online Voting System positions_add.php sql injectionCampcodes Advanced Online Voting System
- CVE-2023-2049Campcodes Advanced Online Voting System ballot_up.php sql injectionCampcodes Advanced Online Voting System
- CVE-2023-2048Campcodes Advanced Online Voting System voters_row.php sql injectionCampcodes Advanced Online Voting System
- CVE-2023-2047Campcodes Advanced Online Voting System login.php sql injectionCampcodes Advanced Online Voting System
- CVE-2023-2044Control iD iDSecure Dispositivos Page cross site scriptingControl iD iDSecure
- CVE-2023-2043Control iD RHiD Edit a sql injectionControl iD RHiD
- CVE-2023-2042DataGear JDBC Server deserializationDataGear
- CVE-2023-2041novel-plus sql injectionnovel-plus
- CVE-2023-2040novel-plus sql injectionnovel-plus
- CVE-2023-2039novel-plus sql injectionnovel-plus
- CVE-2023-2038Campcodes Video Sharing Website admin_class.php sql injectionCampcodes Video Sharing Website
- CVE-2023-2037Campcodes Video Sharing Website watch.php sql injectionCampcodes Video Sharing Website
- CVE-2023-2036Campcodes Video Sharing Website upload.php sql injectionCampcodes Video Sharing Website
- CVE-2023-2035Campcodes Video Sharing Website signup.php sql injectionCampcodes Video Sharing Website
- CVE-2023-26123Versions of the package raysan5/raylib before 4.5.0 are vulnerable to Cross-site Scripting (XSS) such that the SetClipboardText API does notraysan5/raylib
- CVE-2022-45170An issue was discovered in LIVEBOX Collaboration vDesk through v018.
- CVE-2022-45175An issue was discovered in LIVEBOX Collaboration vDesk through v018.
- CVE-2022-45180An issue was discovered in LIVEBOX Collaboration vDesk through v018.
- CVE-2022-46886There exists an open redirect within the response list update functionality of ServiceNow.ServiceNow
- CVE-2023-22949An issue was discovered in TigerGraph Enterprise Free Edition 3.x.
- CVE-2023-25597A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a sh
- CVE-2023-26559A directory traversal vulnerability in Oxygen XML Web Author before 25.0.0.3 build 2023021715 and Oxygen Content Fusion before 5.0.3 build 2
- CVE-2023-26756The login page of Revive Adserver v5.4.1 is vulnerable to brute force attacks.
- CVE-2023-26980PAX Technology PAX A920 Pro PayDroid 8.1suffers from a Race Condition vulnerability, which allows attackers to bypass the payment software a
- CVE-2023-27571An issue was discovered in DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10.
- CVE-2023-27572An issue was discovered in CommScope Arris DG3450 Cable Gateway AR01.02.056.18_041520_711.NCS.10.
- CVE-2023-27666Auto Dealer Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the name parameter at /classes/S
- CVE-2023-27890The Export User plugin through 2.0 for MyBB allows XSS during the process of an admin generating DSGVO data for a user, via the Custom User
- CVE-2023-29085An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos
- CVE-2023-29086An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos
- CVE-2023-29087An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos
- CVE-2023-29088An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos
- CVE-2023-29089An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos
- CVE-2023-29090An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos
- CVE-2023-29091An issue was discovered in Samsung Exynos Mobile Processor, Automotive Processor and Modem for Exynos Modem 5123, Exynos Modem 5300, Exynos
- CVE-2023-29132Irssi 1.3.x and 1.4.x before 1.4.4 has a use-after-free because of use of a stale special collector reference.
- CVE-2023-29383In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger).
- CVE-2023-29491ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malfor
- CVE-2023-29569Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via ffi_cb_impl_wpwwwww at src/mjs_ffi.c.
- CVE-2023-29623Purchase Order Management v1.0 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the password parameter at
- CVE-2023-29799TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpMode
- CVE-2023-29847AeroCMS v0.0.1 was discovered to contain multiple stored cross-site scripting (XSS) vulnerabilities via the comment_author and comment_conte