CVEs published April 16, 2023
38 CVEs were published on April 16, 2023: 10 critical, 8 high.
- Published
- 38
- Critical
- 10
- High
- 8
- Medium
- 18
- Low
- 1
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- Huawei HarmonyOS · Huawei EMUI
- 3
- xwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…
- 2
- xwiki-platform · org.xwiki.platform:xwiki-platform-panels-ui
- 2
- Car Rental by BestWebSoft
- 1
- Code Tides Advanced Floating Content
- 1
- Jose Mortellaro Freesoul Deactivate Plugins – Plugin manage…
- 1
- Kilian Evang Ultimate Noindex Nofollow Tool II
- 1
- Magneticlab Sàrl Homepage Pop-up
- 1
- openzeppelin-contracts · @openzeppelin/contracts +1
- 1
- Silkalns Activello
- 1
Critical 10
- CVE-2023-29511xwiki-platform-administration-ui vulnerable to privilege escalationxwiki-platform · org.xwiki.platform:xwiki-platform-administ…
- CVE-2023-30537org.xwiki.platform:xwiki-platform-flamingo-theme-ui vulnerable to privilege escalationxwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…
- CVE-2023-29509org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-flamingo…
- CVE-2023-29507org.xwiki.platform:xwiki-platform-oldcore makes Incorrect Use of Privileged APIs with DocumentAuthorsxwiki-platform · org.xwiki.platform:xwiki-platform-oldcore
- CVE-2023-29214org.xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-panels-ui
- CVE-2023-29212xwiki.platform:xwiki-platform-panels-ui Eval Injection vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-panels-ui
- CVE-2023-29211org.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-wiki-ui-…
- CVE-2022-48312The HwPCAssistant module has the out-of-bounds read/write vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2021-33990Liferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders.html exists.
- CVE-2022-34128The Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP code in the POST data to front/upload.php.
High 8
- CVE-2023-29508org.xwiki.platform:xwiki-platform-livedata-macro vulnerable to Cross-site Scriptingxwiki-platform · org.xwiki.platform:xwiki-platform-livedata…
- CVE-2021-36520A SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign-evaluation?id= URI.
- CVE-2022-34126The Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in the front/cra.send.php file parameter.
- CVE-2022-34127The Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal in the inc/cri.class.php file parameter.
- CVE-2022-37255TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603.
- CVE-2022-38840cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE) issue via XML file upload, which leads to l
- CVE-2022-38841Linksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell metacharacters to the diagnostics traceroute pa
- CVE-2022-40946On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via the sys_token paramet
Medium, low and unrated 20
- CVE-2022-45849WordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)Silkalns Activello
- CVE-2022-44734WordPress Car Rental by BestWebSoft Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)Car Rental by BestWebSoft
- CVE-2022-43458WordPress Advanced Floating Content Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)Code Tides Advanced Floating Content
- CVE-2022-43480WordPress Homepage Pop-up Plugin <= 1.2.5 is vulnerable to Cross Site Scripting (XSS)Magneticlab Sàrl Homepage Pop-up
- CVE-2023-22687WordPress Freesoul Deactivate Plugins – Plugin manager and cleanup Plugin <= 1.9.4.0 is vulnerable to Sensitive Data ExposureJose Mortellaro Freesoul Deactivate Plugins – Plugin manage…
- CVE-2023-30474WordPress Ultimate Noindex Nofollow Tool II Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)Kilian Evang Ultimate Noindex Nofollow Tool II
- CVE-2023-27610WordPress Transbank Webpay REST Plugin <= 1.6.6 is vulnerable to SQL InjectionTransbankDevelopers Transbank Webpay REST
- CVE-2023-2108SourceCodester Judging Management System edit_contestant.php sql injectionSourceCodester Judging Management System
- CVE-2022-48314The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-30542GovernorCompatibilityBravo may trim proposal calldataopenzeppelin-contracts · @openzeppelin/contracts +1
- CVE-2022-48313The Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing process.Huawei HarmonyOS · Huawei EMUI
- CVE-2023-29506org.xwiki.platform:xwiki-platform-security-authentication-default XSS with authenticated endpointsxwiki-platform · org.xwiki.platform:xwiki-platform-security…
- CVE-2022-28353In the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is vulnerable to XSS.
- CVE-2022-30076ENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a series of student usernames such as s10000 thro
- CVE-2022-34125front/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access to sensitive information via a _log/ pathn
- CVE-2022-37186In LemonLDAP::NG before 2.0.15.
- CVE-2022-37306OX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.
- CVE-2022-37704Amanda 3.5.1 allows privilege escalation from the regular user backup to root.
- CVE-2022-37705A privilege escalation flaw was found in Amanda 3.5.1 in which the backup user can acquire root privileges.
- CVE-2023-30772The Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power/supply/da9150-charger.c if a physically pro