CVEs published April 17, 2023
85 CVEs were published on April 17, 2023: 11 critical, 29 high.
- Published
- 85
- Critical
- 11
- High
- 29
- Medium
- 41
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 60
Most affected products
- Juniper Networks Junos OS
- 18
- Juniper Networks Junos OS Evolved
- 5
- Electra Central AC unit
- 4
- Autodesk FBX SDK
- 3
- Autodesk Maya USD Plugin
- 3
- W4 Post List
- 3
- Apache Software Foundation Apache Superset · apache-superset
- 2
- Gallery by BestWebSoft
- 2
- nextcloud security-advisories
- 2
- Pricing Tables For WPBakery Page Builder
- 2
Critical 11
- CVE-2023-30547Sandbox Escape in vm2patriksimek vm2 · vm2
- CVE-2023-29213org.xwiki.platform:xwiki-platform-logging-ui Injection vulnerabilityxwiki-platform · org.xwiki.platform:xwiki-platform-logging-…
- CVE-2023-1873SQLi in BircardFaturamatik Bircard
- CVE-2023-1723SQLi in Veragroup Mobile AssistantVeragroup Mobile Assistant
- CVE-2023-30771Apache IoTDB Workbench: apache/iotdb-web-workbench: forge the JWTToken to access workbenchApache Software Foundation Apache IoTDB Workbench · apache-…
- CVE-2023-24831Apache IoTDB grafana-connector Login Bypass VulnerabilityApache Software Foundation Apache IoTDB · org.apache.iot… +1
- CVE-2021-33797Buffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1.mujs
- CVE-2023-24501Electra Central AC unit – Hardcoded CredentialsElectra Central AC unit
- CVE-2023-27844SQL injection vulnerability found in PrestaShopleurlrewrite v.1.0 and before allow a remote attacker to gain privileges via the Dispatcher::
- CVE-2023-29665D-Link DIR823G_V1.0.2B05 was discovered to contain a stack overflow via the NewPassword parameters in SetPasswdSettings.
- CVE-2023-30769Rab13s ExploitDogecoin Node
High 29
- CVE-2023-1831User password logged in audit logsMattermost
- CVE-2023-0277WC Fields Factory <= 4.1.5 - ShopManager+ SQLiWC Fields Factory
- CVE-2023-0765Gallery by BestWebSoft < 4.7.0 - Author+ SQL InjectionGallery by BestWebSoft
- CVE-2023-2017Improper Control of Generation of Code in Twig Rendered Views in ShopwareShopware AG Shopware · shopware/platform +1
- CVE-2023-1109PHOENIX CONTACT: Directory Traversal Vulnerability in ENERGY AXC PU Web servicePHOENIX CONTACT ENERGY AXC PU · PHOENIX CONTACT SMARTRTU… +2
- CVE-2023-30770A stack-based buffer overflow vulnerability was found in the ADMASUSTOR ADM
- CVE-2023-24500 Electra Central AC unit – Adjacent attacker may cause the unit to load unauthorized FWElectra Central AC unit
- CVE-2023-24502 Electra Central AC unit – Easily calculated passwordElectra Central AC unit
- CVE-2023-24503 Electra Smart Kit for Split AC – Adjacent attacker may cause the unit to load unauthorized FWElectra OSK201
- CVE-2023-24504 Electra Central AC unit – Adjacent attacker may cause the unit to connect to unauthorized update serverElectra Central AC unit
- CVE-2023-25010A malicious actor may convince a victim to open a malicious USD file that may trigger an uninitialized variable which may result in code exeAutodesk Maya USD Plugin
- CVE-2023-27705APNG_Optimizer v1.4 was discovered to contain a buffer overflow via the component /apngopt/ubuntu.png.
- CVE-2023-27733DedeCMS v5.7.106 was discovered to contain a SQL injection vulnerability via the component /dede/sys_sql_query.php.
- CVE-2023-27755go-bbs v1 was discovered to contain an arbitrary file download vulnerability via the component /api/v1/download.
- CVE-2023-27906A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds read vulnerability which may result iAutodesk Maya USD Plugin
- CVE-2023-27907A malicious actor may convince a victim to open a malicious USD file that may trigger an out-of-bounds write vulnerability which may result Autodesk Maya USD Plugin
- CVE-2023-27909An Out-Of-Bounds Write Vulnerability in Autodesk® FBX® SDK version 2020 or prior may lead to code execution through maliciously crafted FBX Autodesk FBX SDK
- CVE-2023-27910A user may be tricked into opening a malicious FBX file that may exploit a stack buffer overflow vulnerability in Autodesk® FBX® SDK 2020 orAutodesk FBX SDK
- CVE-2023-27911A user may be tricked into opening a malicious FBX file that may exploit a heap buffer overflow vulnerability in Autodesk® FBX® SDK 2020 or Autodesk FBX SDK
- CVE-2023-28960Junos OS Evolved: Docker repository is world-writeable, allowing low-privileged local user to inject files into Docker containersJuniper Networks Junos OS Evolved
- CVE-2023-28964Junos OS and Junos OS Evolved: Malformed BGP flowspec update causes RPD crashJuniper Networks Junos OS
- CVE-2023-28966Junos OS Evolved: Local low-privileged user with shell access can execute CLI commands as rootJuniper Networks Junos OS Evolved
- CVE-2023-28967Junos OS and Junos OS Evolved: An attacker sending genuine BGP packets causes an RPD crashJuniper Networks Junos OS
- CVE-2023-28971Paragon Active Assurance: Enabling the timescaledb enables IP forwardingJuniper Networks Paragon Active Assurance
- CVE-2023-28973Junos OS Evolved: The 'sysmanctl' shell command allows a local user to gain access to some administrative actions Juniper Networks Junos OS Evolved
- CVE-2023-28974Junos OS: MX Series: In a BBE scenario upon receipt of specific malformed packets from subscribers the process bbe-smgd will crashJuniper Networks Junos OS
- CVE-2023-28976Junos OS: MX Series: If a specific traffic rate goes above the DDoS threshold it will lead to an FPC crashJuniper Networks Junos OS
- CVE-2023-28982Junos OS and Junos OS Evolved: In a BGP rib sharding scenario when a route is frequently updated an rpd memory leak will occurJuniper Networks Junos OS
- CVE-2023-28983Junos OS Evolved: Shell Injection vulnerability in the gNOI serverJuniper Networks Junos OS Evolved
Medium, low and unrated 45
- CVE-2023-30541TransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contractsopenzeppelin-contracts · @openzeppelin/contracts +1
- CVE-2023-30540Chat poll data can still be queried from API after purging history in Nextcloud talknextcloud security-advisories
- CVE-2023-30539Users can set up workflows using restricted and invisible system tags in Nextcloudnextcloud security-advisories
- CVE-2023-30536Insecure header validation in slim/psr7slimphp Slim-Psr7 · slim/psr7
- CVE-2023-29197Improper header name validation in guzzlehttp/psr7guzzle psr7 · guzzlehttp/psr7
- CVE-2023-30543`chainId` may be outdated if user changes chains as part of connection in @web3-reactUniswap web3-react · @web3-react/coinbase-wallet +3
- CVE-2023-30548Path traversal vulnerability in gatsby-plugin-sharpgatsbyjs gatsby · gatsby-plugin-sharp
- CVE-2023-2130SourceCodester Purchase Order Management System GET Parameter view_details.php sql injectionSourceCodester Purchase Order Management System
- CVE-2015-10103InternalError503 Forget It settings.js infinite loopInternalError503 Forget It
- CVE-2023-29004Path Traversal Vulnerability in hap-wi/roxy-wi hap-wi roxy-wi
- CVE-2015-10102Freshdesk Plugin redirectFreshdesk Plugin
- CVE-2023-25504Apache Superset: Possible SSRF on import datasetsApache Software Foundation Apache Superset · apache-superset
- CVE-2023-27525Apache Superset: Incorrect default permissions for Gamma roleApache Software Foundation Apache Superset · apache-superset
- CVE-2023-1473Responsive WordPress Slideshows 3.29.0 - Reflected XSSSlider, Gallery, and Carousel by MetaSlider
- CVE-2023-1371W4 Post List < 2.4.6 - Subscriber+ Password Protected Post Content DisclosureW4 Post List
- CVE-2023-1413WP VR < 8.2.9 - Reflected XSSWP VR
- CVE-2023-1274Pricing Tables For WPBakery Page Builder < 3.0 - Subscriber+ LFIPricing Tables For WPBakery Page Builder
- CVE-2023-1331Redirection < 1.1.5 - Plugin Reset via CSRFRedirection
- CVE-2023-0367Pricing Tables For WPBakery Page Builder < 3.0 - Contributor+ Stored XSSPricing Tables For WPBakery Page Builder
- CVE-2023-1373W4 Post List < 2.4.6 - Reflected XSSW4 Post List
- CVE-2023-0889TF Random Numbers < 2.0.1 - Subscriber+ Arbitrary Option UpdateThemeflection Numbers
- CVE-2023-1282Drag and Drop Multiple File Upload PRO - Reflected Cross-Site ScriptingDrag and Drop Multiple File Upload PRO - Contact Form 7 Sta…
- CVE-2023-1427Photo Gallery by 10Web < 1.8.15 - Admin+ Path TraversalPhoto Gallery by 10Web
- CVE-2023-1325Easy Forms for MailChimp < 6.8.7 - Contributor+ Stored XSSEasy Forms for Mailchimp
- CVE-2023-0374W4 Post List < 2.4.6 - Contributor+ Stored XSSW4 Post List
- CVE-2023-0764Gallery by BestWebSoft < 4.7.0 - Author+ Stored Cross-Site ScriptingGallery by BestWebSoft
- CVE-2023-22946Apache Spark proxy-user privilege escalation from malicious configuration classApache Software Foundation Apache Spark · pyspark +2
- CVE-2022-44726The TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.
- CVE-2022-46389Cross-Site Scripting (XSS) vulnerability found on logout functionalityServiceNow Now Platform
- CVE-2023-1697Junos OS: QFX10000 Series, PTX1000 Series: The dcpfe process will crash when a malformed ethernet frame is receivedJuniper Networks Junos OS
- CVE-2023-2109Cross-site Scripting (XSS) - DOM in chatwoot/chatwootchatwoot/chatwoot
- CVE-2023-28959Junos OS: QFX10002: PFE wedges and restarts upon receipt of specific malformed packetsJuniper Networks Junos OS
- CVE-2023-28961Junos OS: ACX Series: IPv6 firewall filter is not installed in PFE when "from next-header ah" is usedJuniper Networks Junos OS
- CVE-2023-28962Junos OS: Unauthenticated access vulnerability in J-WebJuniper Networks Junos OS
- CVE-2023-28963Junos OS: User-controlled input vulnerability in J-WebJuniper Networks Junos OS
- CVE-2023-28965Junos OS: QFX10002: Failure of storm control feature may lead to Denial of ServiceJuniper Networks Junos OS
- CVE-2023-28968Junos OS: SRX Series: Policies that rely on JDPI-Decoder actions may fail openJuniper Networks Junos OS · Juniper Networks AppID Servi… +1
- CVE-2023-28970Junos OS: JRR200: Kernel crash upon receipt of a specific packetJuniper Networks Junos OS
- CVE-2023-28972Junos OS: NFX Series: 'set system ports console insecure' allows root password recoveryJuniper Networks Junos OS
- CVE-2023-28975Junos OS: The kernel will crash when certain USB devices are insertedJuniper Networks Junos OS
- CVE-2023-28978Junos OS Evolved: Read access to some confidential user information is possibleJuniper Networks Junos OS Evolved
- CVE-2023-28979Junos OS: In a 6PE scenario upon receipt of a specific IPv6 packet an integrity check failsJuniper Networks Junos OS
- CVE-2023-28980Junos OS and Junos OS Evolved: In a BGP rib sharding scenario an rpd crash will happen shortly after a specific CLI command is issuedJuniper Networks Junos OS
- CVE-2023-28981Junos OS and Junos OS Evolved: If malformed IPv6 router advertisements are received, memory corruption will occur which causes an rpd crashJuniper Networks Junos OS
- CVE-2023-28984Junos OS: QFX Series: The PFE may crash when a lot of MAC addresses are being learned and agedJuniper Networks Junos OS