CVEs published April 15, 2023
65 CVEs were published on April 15, 2023: 9 critical, 17 high.
- Published
- 65
- Critical
- 9
- High
- 17
- Medium
- 33
- Low
- 5
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 19
Most affected products
- SourceCodester Vehicle Service Management System
- 9
- alextselegidis/easyappointments
- 4
- janeczku/calibre-web · calibreweb
- 2
- xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- 2
- Google Analytics Top Content Widget Plugin
- 1
- IBOS
- 1
- KylinSoft youker-assistant
- 1
- mailman
- 1
- moxi624 Mogu Blog
- 1
- SourceCodester Complaint Management System
- 1
Critical 9
- CVE-2023-29210org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-notifica…
- CVE-2023-29209org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-legacy-n…
- CVE-2023-29206org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX pluginsxwiki-platform · org.xwiki.platform:xwiki-platform-skin-ski…
- CVE-2023-29205org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macroxwiki-platform · org.xwiki.platform:xwiki-platform-renderin…
- CVE-2023-29202org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-core-rendering… +1
- CVE-2023-29201org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerabilityxwiki-commons · org.xwiki.commons:xwiki-commons-xml
- CVE-2023-2027ZM Ajax Login & Register <= 2.0.2 - Authentication Bypasszanematthew ZM Ajax Login & Register
- CVE-2018-17452An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.
- CVE-2020-29007The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond exe
High 17
- CVE-2023-29208Data leak through deleted documents xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-29207Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macroxwiki-platform · org.xwiki.platform:xwiki-platform-flami… +5
- CVE-2023-2091KylinSoft youker-assistant adjust_cpufreq_scaling_governer os command injectionKylinSoft youker-assistant
- CVE-2018-15472An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.
- CVE-2018-17449An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.
- CVE-2018-17451An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.
- CVE-2018-17455An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.
- CVE-2020-17354LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated b
- CVE-2021-39295In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface.
- CVE-2021-43612In lldpd before 1.0.13, when decoding SONMP packets in the sonmp_decode function, it's possible to trigger an out-of-bounds heap read via sh
- CVE-2021-45464kvmtool through 39181fc allows an out-of-bounds write, related to virtio/balloon.c and virtio/pci.c.
- CVE-2022-2525Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-webjaneczku/calibre-web · calibreweb
- CVE-2022-45030A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secur
- CVE-2022-47522The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frame
- CVE-2023-2106Weak Password Requirements in janeczku/calibre-webjaneczku/calibre-web · calibreweb
- CVE-2023-22669Parsing of DWG files in Open Design Alliance Drawings SDK before 2023.6 lacks proper validation of the length of user-supplied XRecord data
- CVE-2023-22670A heap-based buffer overflow exists in the DXF file reading procedure in Open Design Alliance Drawings SDK before 2023.6.
Medium, low and unrated 39
- CVE-2015-10101Google Analytics Top Content Widget Plugin class-tgm-plugin-activation.php cross site scriptingGoogle Analytics Top Content Widget Plugin
- CVE-2023-29204URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcorexwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-29203Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…
- CVE-2023-2107IBOS del&op=recycle sql injectionIBOS
- CVE-2023-2101moxi624 Mogu Blog v2 uploadPicsByUrl uploadPictureByUrl absolute path traversalmoxi624 Mogu Blog
- CVE-2023-2100SourceCodester Vehicle Service Management System index.php cross site scriptingSourceCodester Vehicle Service Management System
- CVE-2023-2099SourceCodester Vehicle Service Management System Users.php cross site scriptingSourceCodester Vehicle Service Management System
- CVE-2023-2098SourceCodester Vehicle Service Management System topBarNav.php cross site scriptingSourceCodester Vehicle Service Management System
- CVE-2023-2097SourceCodester Vehicle Service Management System Master.php sql injectionSourceCodester Vehicle Service Management System
- CVE-2023-2096SourceCodester Vehicle Service Management System manage_inventory.php sql injectionSourceCodester Vehicle Service Management System
- CVE-2023-2095SourceCodester Vehicle Service Management System manage_category.php sql injectionSourceCodester Vehicle Service Management System
- CVE-2023-2094SourceCodester Vehicle Service Management System manage_mechanic.php sql injectionSourceCodester Vehicle Service Management System
- CVE-2023-2093SourceCodester Vehicle Service Management System Login.php sql injectionSourceCodester Vehicle Service Management System
- CVE-2023-2092SourceCodester Vehicle Service Management System view_service.php sql injectionSourceCodester Vehicle Service Management System
- CVE-2023-2090SourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view_designation.php sql injectionSourceCodester Employee and Visitor Gate Pass Logging System
- CVE-2023-2089SourceCodester Complaint Management System GET Parameter userprofile.php sql injectionSourceCodester Complaint Management System
- CVE-2018-17450An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.
- CVE-2018-17453An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.
- CVE-2018-17454An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.
- CVE-2018-17536An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.
- CVE-2018-17537An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1.
- CVE-2018-17883An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12.
- CVE-2019-14942An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6.
- CVE-2019-14944An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6.
- CVE-2020-27545libdwarf before 20201017 has a one-byte out-of-bounds read because of an invalid pointer dereference via an invalid line table in a crafted
- CVE-2020-28163libdwarf before 20201201 allows a dwarf_print_lines.c NULL pointer dereference and application crash via a DWARF5 line-table header that has
- CVE-2021-30153An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2.
- CVE-2021-34337An issue was discovered in Mailman Core before 3.3.5.mailman
- CVE-2022-43696OX App Suite before 7.10.6-rev20 allows XSS via upsell ads.
- CVE-2022-43697OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob.
- CVE-2022-43698OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list.
- CVE-2022-43699OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an advers
- CVE-2022-48177X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importMo
- CVE-2022-48178X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action fu
- CVE-2023-2102Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointmentsalextselegidis/easyappointments
- CVE-2023-2103Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointmentsalextselegidis/easyappointments
- CVE-2023-2104Improper Access Control in alextselegidis/easyappointmentsalextselegidis/easyappointments
- CVE-2023-2105Session Fixation in alextselegidis/easyappointmentsalextselegidis/easyappointments
- CVE-2023-24607Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4.