# CVEs published 2023-04-15

65 CVEs were published on April 15, 2023: 9 critical, 17 high. Days are UTC.

- [CVE-2015-10101](https://cve.now/CVE-2015-10101.md): Google Analytics Top Content Widget Plugin class-tgm-plugin-activation.php cross site scripting (CVSS 3.5, Google Analytics Top Content Widget Plugin)
- [CVE-2023-29210](https://cve.now/CVE-2023-29210.md): org.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-notifica…)
- [CVE-2023-29209](https://cve.now/CVE-2023-29209.md): org.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-legacy-n…)
- [CVE-2023-29208](https://cve.now/CVE-2023-29208.md): Data leak through deleted documents (CVSS 7.5, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-29207](https://cve.now/CVE-2023-29207.md): Improper Neutralization of Script-Related HTML Tags (XSS) in the LiveTable Macro (CVSS 8.9, xwiki-platform · org.xwiki.platform:xwiki-platform-flami… +5)
- [CVE-2023-29206](https://cve.now/CVE-2023-29206.md): org.xwiki.platform:xwiki-platform-skin-skinx vulnerable to basic Cross-site Scripting by exploiting JSX or SSX plugins (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-skin-ski…)
- [CVE-2023-29205](https://cve.now/CVE-2023-29205.md): org.xwiki.platform:xwiki-platform-rendering-xwiki vulnerable to stored cross-site scripting via HTML and raw macro (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-renderin…)
- [CVE-2023-29204](https://cve.now/CVE-2023-29204.md): URL Redirection to Untrusted Site ('Open Redirect') in org.xwiki.platform:xwiki-platform-oldcore (CVSS 4.7, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-29203](https://cve.now/CVE-2023-29203.md): Unauthenticated user can have information about hidden users on subwikis through uorgsuggest.vm (CVSS 3.7, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2023-29202](https://cve.now/CVE-2023-29202.md): org.xwiki.platform:xwiki-platform-rendering-macro-rss Cross-site Scripting vulnerability (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-core-rendering… +1)
- [CVE-2023-29201](https://cve.now/CVE-2023-29201.md): org.xwiki.commons:xwiki-commons-xml Cross-site Scripting vulnerability (CVSS 9.1, xwiki-commons · org.xwiki.commons:xwiki-commons-xml)
- [CVE-2023-2107](https://cve.now/CVE-2023-2107.md): IBOS del&op=recycle sql injection (CVSS 6.3, IBOS)
- [CVE-2023-2101](https://cve.now/CVE-2023-2101.md): moxi624 Mogu Blog v2 uploadPicsByUrl uploadPictureByUrl absolute path traversal (CVSS 4.3, moxi624 Mogu Blog)
- [CVE-2023-2100](https://cve.now/CVE-2023-2100.md): SourceCodester Vehicle Service Management System index.php cross site scripting (CVSS 3.5, SourceCodester Vehicle Service Management System)
- [CVE-2023-2099](https://cve.now/CVE-2023-2099.md): SourceCodester Vehicle Service Management System Users.php cross site scripting (CVSS 3.5, SourceCodester Vehicle Service Management System)
- [CVE-2023-2098](https://cve.now/CVE-2023-2098.md): SourceCodester Vehicle Service Management System topBarNav.php cross site scripting (CVSS 3.5, SourceCodester Vehicle Service Management System)
- [CVE-2023-2097](https://cve.now/CVE-2023-2097.md): SourceCodester Vehicle Service Management System Master.php sql injection (CVSS 6.3, SourceCodester Vehicle Service Management System)
- [CVE-2023-2096](https://cve.now/CVE-2023-2096.md): SourceCodester Vehicle Service Management System manage\_inventory.php sql injection (CVSS 6.3, SourceCodester Vehicle Service Management System)
- [CVE-2023-2095](https://cve.now/CVE-2023-2095.md): SourceCodester Vehicle Service Management System manage\_category.php sql injection (CVSS 6.3, SourceCodester Vehicle Service Management System)
- [CVE-2023-2094](https://cve.now/CVE-2023-2094.md): SourceCodester Vehicle Service Management System manage\_mechanic.php sql injection (CVSS 6.3, SourceCodester Vehicle Service Management System)
- [CVE-2023-2093](https://cve.now/CVE-2023-2093.md): SourceCodester Vehicle Service Management System Login.php sql injection (CVSS 6.3, SourceCodester Vehicle Service Management System)
- [CVE-2023-2092](https://cve.now/CVE-2023-2092.md): SourceCodester Vehicle Service Management System view\_service.php sql injection (CVSS 6.3, SourceCodester Vehicle Service Management System)
- [CVE-2023-2090](https://cve.now/CVE-2023-2090.md): SourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view\_designation.php sql injection (CVSS 6.3, SourceCodester Employee and Visitor Gate Pass Logging System)
- [CVE-2023-2091](https://cve.now/CVE-2023-2091.md): KylinSoft youker-assistant adjust\_cpufreq\_scaling\_governer os command injection (CVSS 7.8, KylinSoft youker-assistant)
- [CVE-2023-2027](https://cve.now/CVE-2023-2027.md): ZM Ajax Login & Register \<= 2.0.2 - Authentication Bypass (CVSS 9.8, zanematthew ZM Ajax Login & Register)
- [CVE-2023-2089](https://cve.now/CVE-2023-2089.md): SourceCodester Complaint Management System GET Parameter userprofile.php sql injection (CVSS 6.3, SourceCodester Complaint Management System)
- [CVE-2018-15472](https://cve.now/CVE-2018-15472.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. (CVSS 7.5)
- [CVE-2018-17449](https://cve.now/CVE-2018-17449.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. (CVSS 7.5)
- [CVE-2018-17450](https://cve.now/CVE-2018-17450.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. (CVSS 4.3)
- [CVE-2018-17451](https://cve.now/CVE-2018-17451.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. (CVSS 8.8)
- [CVE-2018-17452](https://cve.now/CVE-2018-17452.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. (CVSS 9.8)
- [CVE-2018-17453](https://cve.now/CVE-2018-17453.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. (CVSS 5.3)
- [CVE-2018-17454](https://cve.now/CVE-2018-17454.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. (CVSS 5.4)
- [CVE-2018-17455](https://cve.now/CVE-2018-17455.md): An issue was discovered in GitLab Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. (CVSS 7.5)
- [CVE-2018-17536](https://cve.now/CVE-2018-17536.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. (CVSS 5.4)
- [CVE-2018-17537](https://cve.now/CVE-2018-17537.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.1.7, 11.2.x before 11.2.4, and 11.3.x before 11.3.1. (CVSS 5.4)
- [CVE-2018-17883](https://cve.now/CVE-2018-17883.md): An issue was discovered in Open Ticket Request System (OTRS) 6.0.x before 6.0.12. (CVSS 6.1)
- [CVE-2019-14942](https://cve.now/CVE-2019-14942.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. (CVSS 5.9)
- [CVE-2019-14944](https://cve.now/CVE-2019-14944.md): An issue was discovered in GitLab Community and Enterprise Edition before 11.11.8, 12 before 12.0.6, and 12.1 before 12.1.6. (CVSS 6.5)
- [CVE-2020-17354](https://cve.now/CVE-2020-17354.md): LilyPond before 2.24 allows attackers to bypass the -dsafe protection mechanism via output-def-lookup or output-def-scope, as demonstrated b (CVSS 8.6)
- [CVE-2020-27545](https://cve.now/CVE-2020-27545.md): libdwarf before 20201017 has a one-byte out-of-bounds read because of an invalid pointer dereference via an invalid line table in a crafted (CVSS 6.5)
- [CVE-2020-28163](https://cve.now/CVE-2020-28163.md): libdwarf before 20201201 allows a dwarf\_print\_lines.c NULL pointer dereference and application crash via a DWARF5 line-table header that has (CVSS 6.5)
- [CVE-2020-29007](https://cve.now/CVE-2020-29007.md): The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond exe (CVSS 9.8)
- [CVE-2021-30153](https://cve.now/CVE-2021-30153.md): An issue was discovered in the VisualEditor extension in MediaWiki before 1.31.13, and 1.32.x through 1.35.x before 1.35.2. (CVSS 4.3)
- [CVE-2021-34337](https://cve.now/CVE-2021-34337.md): An issue was discovered in Mailman Core before 3.3.5. (CVSS 6.3, mailman)
- [CVE-2021-39295](https://cve.now/CVE-2021-39295.md): In OpenBMC 2.9, crafted IPMI messages allow an attacker to cause a denial of service to the BMC via the netipmid (IPMI lan+) interface. (CVSS 7.5)
- [CVE-2021-43612](https://cve.now/CVE-2021-43612.md): In lldpd before 1.0.13, when decoding SONMP packets in the sonmp\_decode function, it's possible to trigger an out-of-bounds heap read via sh (CVSS 7.5)
- [CVE-2021-45464](https://cve.now/CVE-2021-45464.md): kvmtool through 39181fc allows an out-of-bounds write, related to virtio/balloon.c and virtio/pci.c. (CVSS 8.8)
- [CVE-2022-2525](https://cve.now/CVE-2022-2525.md): Improper Restriction of Excessive Authentication Attempts in janeczku/calibre-web (CVSS 7.3, janeczku/calibre-web · calibreweb)
- [CVE-2022-43696](https://cve.now/CVE-2022-43696.md): OX App Suite before 7.10.6-rev20 allows XSS via upsell ads. (CVSS 6.1)
- [CVE-2022-43697](https://cve.now/CVE-2022-43697.md): OX App Suite before 7.10.6-rev30 allows XSS via an activity tracking adapter defined by jslob. (CVSS 6.1)
- [CVE-2022-43698](https://cve.now/CVE-2022-43698.md): OX App Suite before 7.10.6-rev30 allows SSRF because changing a POP3 account disregards the deny-list. (CVSS 4.3)
- [CVE-2022-43699](https://cve.now/CVE-2022-43699.md): OX App Suite before 7.10.6-rev30 allows SSRF because e-mail account discovery disregards the deny-list and thus can be attacked by an advers (CVSS 4.3)
- [CVE-2022-45030](https://cve.now/CVE-2022-45030.md): A SQL injection vulnerability in rConfig 3.9.7 exists via lib/ajaxHandlers/ajaxCompareGetCmdDates.php?command= (this may interact with secur (CVSS 8.8)
- [CVE-2022-47522](https://cve.now/CVE-2022-47522.md): The IEEE 802.11 specifications through 802.11ax allow physically proximate attackers to intercept (possibly cleartext) target-destined frame (CVSS 7.5)
- [CVE-2022-48177](https://cve.now/CVE-2022-48177.md): X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the adin/importMo (CVSS 5.4)
- [CVE-2022-48178](https://cve.now/CVE-2022-48178.md): X2CRM Open Source Sales CRM 6.6 and 6.9 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the Create Action fu (CVSS 5.4)
- [CVE-2023-2102](https://cve.now/CVE-2023-2102.md): Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments (CVSS 6.8, alextselegidis/easyappointments)
- [CVE-2023-2103](https://cve.now/CVE-2023-2103.md): Cross-site Scripting (XSS) - Stored in alextselegidis/easyappointments (CVSS 4.3, alextselegidis/easyappointments)
- [CVE-2023-2104](https://cve.now/CVE-2023-2104.md): Improper Access Control in alextselegidis/easyappointments (CVSS 5.4, alextselegidis/easyappointments)
- [CVE-2023-2105](https://cve.now/CVE-2023-2105.md): Session Fixation in alextselegidis/easyappointments (CVSS 5.4, alextselegidis/easyappointments)
- [CVE-2023-2106](https://cve.now/CVE-2023-2106.md): Weak Password Requirements in janeczku/calibre-web (CVSS 7.3, janeczku/calibre-web · calibreweb)
- [CVE-2023-22669](https://cve.now/CVE-2023-22669.md): Parsing of DWG files in Open Design Alliance Drawings SDK before 2023.6 lacks proper validation of the length of user-supplied XRecord data (CVSS 7.8)
- [CVE-2023-22670](https://cve.now/CVE-2023-22670.md): A heap-based buffer overflow exists in the DXF file reading procedure in Open Design Alliance Drawings SDK before 2023.6. (CVSS 7.8)
- [CVE-2023-24607](https://cve.now/CVE-2023-24607.md): Qt before 6.4.3 allows a denial of service via a crafted string when the SQL ODBC driver plugin is used and the size of SQLTCHAR is 4. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.