# CVEs published 2023-04-18

190 CVEs were published on April 18, 2023: 22 critical, 36 high. Days are UTC.

- [CVE-2023-29517](https://cve.now/CVE-2023-29517.md): Exposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer (CVSS 7.5, xwiki-platform · org.xwiki.platform:xwiki-platform-office-v…)
- [CVE-2023-29516](https://cve.now/CVE-2023-29516.md): Code injection from view right on XWiki.AttachmentSelector in xwiki-platform (CVSS 9.9, xwiki-platform · org.xwiki.platform:xwiki-platform-attachme…)
- [CVE-2023-29515](https://cve.now/CVE-2023-29515.md): Cross-site scripting (XSS) in xwiki-platform (CVSS 7.7, xwiki-platform · org.xwiki.platform:xwiki-platform-appwi… +1)
- [CVE-2023-29514](https://cve.now/CVE-2023-29514.md): Code injection in template provider administration in xwiki-platform (CVSS 10.0, xwiki-platform · org.xwiki.platform.applications:xwiki-a… +2)
- [CVE-2023-29513](https://cve.now/CVE-2023-29513.md): Users can be created even when registration is disabled without validation via the template macro in xwiki-platform (CVSS 5.0, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2023-29512](https://cve.now/CVE-2023-29512.md): Code injection in xwiki-platform-web-templates (CVSS 9.9, xwiki-platform · org.xwiki.platform:xwiki-platform-web-temp…)
- [CVE-2023-29510](https://cve.now/CVE-2023-29510.md): Code injection via unescaped translations in xwiki-platform (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-administ…)
- [CVE-2023-29522](https://cve.now/CVE-2023-29522.md): Code injection from view right on XWiki.ClassSheet in xwiki-platform (CVSS 9.9, xwiki-platform · org.xwiki.platform:xwiki-platform-xclass-ui)
- [CVE-2023-29521](https://cve.now/CVE-2023-29521.md): Code injection from account/view through VFS Tree macro in xwiki-platform (CVSS 8.4, xwiki-platform · org.xwiki.platform:xwiki-platform-vfs-ui)
- [CVE-2023-29520](https://cve.now/CVE-2023-29520.md): Page render failure due to broken translations in xwiki-platform (CVSS 4.3, xwiki-platform · org.xwiki.platform:xwiki-platform-localiza…)
- [CVE-2023-29519](https://cve.now/CVE-2023-29519.md): Code injection in org.xwiki.platform:xwiki-platform-attachment-ui (CVSS 9.1, xwiki-platform · org.xwiki.platform:xwiki-platform-attachme…)
- [CVE-2023-29518](https://cve.now/CVE-2023-29518.md): Code injection from view right using Invitation.InvitationCommon in xwiki-platform (CVSS 9.9, xwiki-platform · org.xwiki.platform:xwiki-platform-invitati…)
- [CVE-2023-29523](https://cve.now/CVE-2023-29523.md): Code injection in display method used in user profiles in xwiki-platform (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-oldcore)
- [CVE-2023-29524](https://cve.now/CVE-2023-29524.md): Code injection from account through XWiki.SchedulerJobSheet in xwiki-platform (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-schedule…)
- [CVE-2023-29525](https://cve.now/CVE-2023-29525.md): Privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-distr… +1)
- [CVE-2023-29526](https://cve.now/CVE-2023-29526.md): Async and display macro allow displaying and interacting with any document in restricted mode (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-oldco… +1)
- [CVE-2023-29527](https://cve.now/CVE-2023-29527.md): Code injection from account through AWM view sheet in xwiki platform (CVSS 10.0, xwiki-platform · org.xwiki.platform:xwiki-platform-appwithi…)
- [CVE-2023-30605](https://cve.now/CVE-2023-30605.md): Multiple SQL injections in sql/instance.py param\_edit method in Archery - GHSL-2022-104 (CVSS 6.5, hhyo Archery)
- [CVE-2023-30558](https://cve.now/CVE-2023-30558.md): Multiple SQL injections in sql/data\_dictionary.py table\_list method in Archery - GHSL-2022-105 (CVSS 6.5, hhyo Archery)
- [CVE-2023-30557](https://cve.now/CVE-2023-30557.md): SQL injection in data\_dictionary.py table\_info method in Archery - GHSL-2022-106 (CVSS 6.5, hhyo Archery)
- [CVE-2023-30556](https://cve.now/CVE-2023-30556.md): SQL injection in sql\_optimize.py optimize\_sqltuningadvisor method in Archery - GHSL-2022-107 (CVSS 6.5, hhyo Archery)
- [CVE-2023-30555](https://cve.now/CVE-2023-30555.md): SQL injection in sql\_optimize.py explain method in Archery - GHSL-2022-108 (CVSS 6.5, hhyo Archery)
- [CVE-2023-30554](https://cve.now/CVE-2023-30554.md): SQL injection in sql\_api/api\_workflow.py endpoint in Archery - GHSL-2022-103 (CVSS 6.5, hhyo Archery)
- [CVE-2023-30553](https://cve.now/CVE-2023-30553.md): Multiple SQL injections in sql\_api/api\_workflow.py endpoint in Archery - GHSL-2022-102 (CVSS 6.5, hhyo Archery)
- [CVE-2023-30552](https://cve.now/CVE-2023-30552.md): SQL injection in sql/instance.py endpoint in Archery - GHSL-2022-101 (CVSS 6.5, hhyo Archery)
- [CVE-2023-30606](https://cve.now/CVE-2023-30606.md): Multisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse (CVSS 4.2, discourse)
- [CVE-2023-30608](https://cve.now/CVE-2023-30608.md): Parser contains an inefficient regular expression in sqlparse (CVSS 5.5, andialbrecht sqlparse · sqlparse)
- [CVE-2023-30538](https://cve.now/CVE-2023-30538.md): Stored Cross-site Scripting via improper sanitization of svg files in Discourse (CVSS 5.4, discourse)
- [CVE-2023-29196](https://cve.now/CVE-2023-29196.md): HTML injection via topic embedding in Discourse (CVSS 4.2, discourse)
- [CVE-2023-29002](https://cve.now/CVE-2023-29002.md): Debug mode leaks confidential data in Cilium (CVSS 7.2, cilium · github.com/cilium/cilium)
- [CVE-2023-28004](https://cve.now/CVE-2023-28004.md): A CWE-129: Improper validation of an array index vulnerability exists where a specially crafted Ethernet request could result in denial o (CVSS 9.8, Schneider Electric PowerLogic HDPM6000)
- [CVE-2023-29410](https://cve.now/CVE-2023-29410.md): A CWE-20: Improper Input Validation vulnerability exists that could allow an authenticated attacker to gain the same privilege as the appli (CVSS 7.2, Schneider Electric InsightHome · Schneider Electric Insi… +1)
- [CVE-2023-29413](https://cve.now/CVE-2023-29413.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause Denial-of-Service when accessed by an unauthe (CVSS 7.5, Schneider Electric APC Easy UPS Online Monitoring Software…)
- [CVE-2023-29412](https://cve.now/CVE-2023-29412.md): CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause rem (CVSS 9.8, Schneider Electric APC Easy UPS Online Monitoring Software…)
- [CVE-2023-28856](https://cve.now/CVE-2023-28856.md): \`HINCRBYFLOAT\` can be used to crash a redis-server process (CVSS 5.5, redis)
- [CVE-2023-29411](https://cve.now/CVE-2023-29411.md): A CWE-306: Missing Authentication for Critical Function vulnerability exists that could allow changes to administrative credentials, leadin (CVSS 9.8, Schneider Electric APC Easy UPS Online Monitoring Software…)
- [CVE-2023-28839](https://cve.now/CVE-2023-28839.md): Improper neutralization in an SQL query in Shoppingfeed (CVSS 9.4, shoppingflux module-prestashop)
- [CVE-2023-28003](https://cve.now/CVE-2023-28003.md): A CWE-613: Insufficient Session Expiration vulnerability exists that could allow an attacker to maintain unauthorized access over a hijac (CVSS 6.7, Schneider Electric EcoStruxure Power Monitoring Expert)
- [CVE-2023-28440](https://cve.now/CVE-2023-28440.md): Denial of service via admin theme import route in Discourse (CVSS 2.7, discourse)
- [CVE-2023-25555](https://cve.now/CVE-2023-25555.md): A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists tha (CVSS 5.6, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-25553](https://cve.now/CVE-2023-25553.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE en (CVSS 6.1, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-25551](https://cve.now/CVE-2023-25551.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists on a DCE file (CVSS 6.1, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-25550](https://cve.now/CVE-2023-25550.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows remote code execution via the (CVSS 7.2, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-25549](https://cve.now/CVE-2023-25549.md): A CWE-94: Improper Control of Generation of Code ('Code Injection') vulnerability exists that allows for remote code execution when u (CVSS 7.2, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-26049](https://cve.now/CVE-2023-26049.md): Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty (CVSS 2.4, eclipse jetty.project · org.eclipse.jetty:jetty-server)
- [CVE-2023-25554](https://cve.now/CVE-2023-25554.md): A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that allows a (CVSS 7.8, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-25552](https://cve.now/CVE-2023-25552.md): A CWE-862: Missing Authorization vulnerability exists that could allow viewing of unauthorized content, changes or deleting of content, o (CVSS 8.1, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-25548](https://cve.now/CVE-2023-25548.md): A CWE-863: Incorrect Authorization vulnerability exists that could allow access to device credentials on specific DCE endpoints not being p (CVSS 8.8, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-25547](https://cve.now/CVE-2023-25547.md): A CWE-863: Incorrect Authorization vulnerability exists that could allow remote code execution on upload and install packages when a hacker (CVSS 8.8, Schneider Electric StruxureWare Data Center Expert)
- [CVE-2023-26048](https://cve.now/CVE-2023-26048.md): OutOfMemoryError for large multipart without filename in Eclipse Jetty (CVSS 5.3, eclipse jetty.project · org.eclipse.jetty:jetty-server)
- [CVE-2022-43378](https://cve.now/CVE-2022-43378.md): A CWE-1021: Improper Restriction of Rendered UI Layers or Frames vulnerability exists that could cause the user to be tricked into pe (CVSS 6.5, Schneider Electric NetBotz 4 - 355/450/455/550/570)
- [CVE-2022-43377](https://cve.now/CVE-2022-43377.md): A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists that could cause account takeover when a brut (CVSS 7.5, Schneider Electric NetBotz 4 - 355/450/455/550/570)
- [CVE-2022-43376](https://cve.now/CVE-2022-43376.md): A CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability exists that could cause code (CVSS 7.6, Schneider Electric NetBotz 4 - 355/450/455/550/570)
- [CVE-2023-22003](https://cve.now/CVE-2023-22003.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). (CVSS 3.3, Oracle Solaris Operating System)
- [CVE-2023-22002](https://cve.now/CVE-2023-22002.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2023-22001](https://cve.now/CVE-2023-22001.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.6, Oracle VM VirtualBox)
- [CVE-2023-22000](https://cve.now/CVE-2023-22000.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.6, Oracle VM VirtualBox)
- [CVE-2023-21999](https://cve.now/CVE-2023-21999.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.6, Oracle VM VirtualBox)
- [CVE-2023-21998](https://cve.now/CVE-2023-21998.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.6, Oracle VM VirtualBox)
- [CVE-2023-21997](https://cve.now/CVE-2023-21997.md): Vulnerability in the Oracle User Management product of Oracle E-Business Suite (component: Proxy User Delegation). (CVSS 4.3, Oracle User Management)
- [CVE-2023-21996](https://cve.now/CVE-2023-21996.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Services). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2023-21993](https://cve.now/CVE-2023-21993.md): Vulnerability in the Oracle Clinical Remote Data Capture product of Oracle Health Sciences Applications (component: Forms). (CVSS 6.5, Oracle Clinical Remote Data Capture Option)
- [CVE-2023-21992](https://cve.now/CVE-2023-21992.md): Vulnerability in the PeopleSoft Enterprise HCM Human Resources product of Oracle PeopleSoft (component: Administer Workforce). (CVSS 5.4, Oracle PeopleSoft Enterprise HCM Human Resources)
- [CVE-2023-21991](https://cve.now/CVE-2023-21991.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.2, Oracle VM VirtualBox)
- [CVE-2023-21990](https://cve.now/CVE-2023-21990.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.2, Oracle VM VirtualBox)
- [CVE-2023-21989](https://cve.now/CVE-2023-21989.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 6.0, Oracle VM VirtualBox)
- [CVE-2023-21988](https://cve.now/CVE-2023-21988.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.8, Oracle VM VirtualBox)
- [CVE-2023-21987](https://cve.now/CVE-2023-21987.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 7.8, Oracle VM VirtualBox)
- [CVE-2023-21986](https://cve.now/CVE-2023-21986.md): Vulnerability in the Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Native Image). (CVSS 5.7, Oracle GraalVM Enterprise Edition)
- [CVE-2023-21985](https://cve.now/CVE-2023-21985.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Utility). (CVSS 7.7, Oracle Solaris Operating System)
- [CVE-2023-21984](https://cve.now/CVE-2023-21984.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Libraries). (CVSS 6.5, Oracle Solaris Operating System)
- [CVE-2023-21982](https://cve.now/CVE-2023-21982.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21981](https://cve.now/CVE-2023-21981.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). (CVSS 4.9, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2023-21980](https://cve.now/CVE-2023-21980.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Client programs). (CVSS 7.1, Oracle MySQL Server)
- [CVE-2023-21979](https://cve.now/CVE-2023-21979.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2023-21978](https://cve.now/CVE-2023-21978.md): Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: GUI). (CVSS 6.5, Oracle Application Object Library)
- [CVE-2023-21977](https://cve.now/CVE-2023-21977.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21976](https://cve.now/CVE-2023-21976.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21973](https://cve.now/CVE-2023-21973.md): Vulnerability in the Oracle iProcurement product of Oracle E-Business Suite (component: E-Content Manager Catalog). (CVSS 5.4, Oracle iProcurement)
- [CVE-2023-21972](https://cve.now/CVE-2023-21972.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21971](https://cve.now/CVE-2023-21971.md): Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). (CVSS 5.3, Oracle MySQL Connectors)
- [CVE-2023-21970](https://cve.now/CVE-2023-21970.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Security). (CVSS 5.7, Oracle BI Publisher)
- [CVE-2023-21969](https://cve.now/CVE-2023-21969.md): Vulnerability in Oracle SQL Developer (component: Installation). (CVSS 6.7, Oracle SQL Developer)
- [CVE-2023-21968](https://cve.now/CVE-2023-21968.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2023-21967](https://cve.now/CVE-2023-21967.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). (CVSS 5.9, Oracle Java SE JDK and JRE)
- [CVE-2023-21966](https://cve.now/CVE-2023-21966.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: JSON). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21965](https://cve.now/CVE-2023-21965.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 5.7, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-21964](https://cve.now/CVE-2023-21964.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2023-21963](https://cve.now/CVE-2023-21963.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Connection Handling). (CVSS 2.7, Oracle MySQL Server)
- [CVE-2023-21962](https://cve.now/CVE-2023-21962.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21960](https://cve.now/CVE-2023-21960.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 5.6, Oracle WebLogic Server)
- [CVE-2023-21959](https://cve.now/CVE-2023-21959.md): Vulnerability in the Oracle iReceivables product of Oracle E-Business Suite (component: Attachments). (CVSS 4.3, Oracle iReceivables)
- [CVE-2023-21956](https://cve.now/CVE-2023-21956.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). (CVSS 6.1, Oracle WebLogic Server)
- [CVE-2023-21955](https://cve.now/CVE-2023-21955.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21954](https://cve.now/CVE-2023-21954.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Hotspot). (CVSS 5.9, Oracle Java SE JDK and JRE)
- [CVE-2023-21953](https://cve.now/CVE-2023-21953.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Partition). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21952](https://cve.now/CVE-2023-21952.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server). (CVSS 5.7, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-21948](https://cve.now/CVE-2023-21948.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: Core). (CVSS 7.8, Oracle Solaris Operating System)
- [CVE-2023-21947](https://cve.now/CVE-2023-21947.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2023-21946](https://cve.now/CVE-2023-21946.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2023-21945](https://cve.now/CVE-2023-21945.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21944](https://cve.now/CVE-2023-21944.md): Vulnerability in Oracle Essbase (component: Security and Provisioning). (CVSS 5.3, Oracle Hyperion Essbase)
- [CVE-2023-21943](https://cve.now/CVE-2023-21943.md): Vulnerability in Oracle Essbase (component: Security and Provisioning). (CVSS 5.3, Oracle Hyperion Essbase)
- [CVE-2023-21942](https://cve.now/CVE-2023-21942.md): Vulnerability in Oracle Essbase (component: Security and Provisioning). (CVSS 5.3, Oracle Hyperion Essbase)
- [CVE-2023-21941](https://cve.now/CVE-2023-21941.md): Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Server). (CVSS 4.3, Oracle BI Publisher)
- [CVE-2023-21940](https://cve.now/CVE-2023-21940.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Components Services). (CVSS 4.4, Oracle MySQL Server)
- [CVE-2023-21939](https://cve.now/CVE-2023-21939.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2023-21938](https://cve.now/CVE-2023-21938.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2023-21937](https://cve.now/CVE-2023-21937.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Networking). (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2023-21936](https://cve.now/CVE-2023-21936.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). (CVSS 5.4, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2023-21935](https://cve.now/CVE-2023-21935.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21934](https://cve.now/CVE-2023-21934.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 6.8, Oracle Database - Enterprise Edition)
- [CVE-2023-21933](https://cve.now/CVE-2023-21933.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21932](https://cve.now/CVE-2023-21932.md): Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: OXI). (CVSS 7.2, Oracle Hospitality OPERA 5 Property Services)
- [CVE-2023-21931](https://cve.now/CVE-2023-21931.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2023-21930](https://cve.now/CVE-2023-21930.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). (CVSS 7.4, Oracle Java SE JDK and JRE)
- [CVE-2023-21929](https://cve.now/CVE-2023-21929.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2023-21928](https://cve.now/CVE-2023-21928.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: IPS repository daemon). (CVSS 1.8, Oracle Solaris Operating System)
- [CVE-2023-21927](https://cve.now/CVE-2023-21927.md): Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Interoperability SEC). (CVSS 4.3, Oracle JD Edwards EnterpriseOne Tools)
- [CVE-2023-21926](https://cve.now/CVE-2023-21926.md): Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). (CVSS 5.5, Oracle Health Sciences InForm)
- [CVE-2023-21925](https://cve.now/CVE-2023-21925.md): Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). (CVSS 5.3, Oracle Health Sciences InForm)
- [CVE-2023-21924](https://cve.now/CVE-2023-21924.md): Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). (CVSS 5.9, Oracle Health Sciences InForm)
- [CVE-2023-21923](https://cve.now/CVE-2023-21923.md): Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). (CVSS 8.3, Oracle Health Sciences InForm)
- [CVE-2023-21922](https://cve.now/CVE-2023-21922.md): Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). (CVSS 6.8, Oracle Health Sciences InForm)
- [CVE-2023-21921](https://cve.now/CVE-2023-21921.md): Vulnerability in the Oracle Health Sciences InForm product of Oracle Health Sciences Applications (component: Core). (CVSS 5.4, Oracle Health Sciences InForm)
- [CVE-2023-21920](https://cve.now/CVE-2023-21920.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21919](https://cve.now/CVE-2023-21919.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DDL). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21918](https://cve.now/CVE-2023-21918.md): Vulnerability in the Oracle Database Recovery Manager component of Oracle Database Server. (CVSS 6.8, Oracle Database - Enterprise Edition)
- [CVE-2023-21917](https://cve.now/CVE-2023-21917.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21916](https://cve.now/CVE-2023-21916.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Web Server). (CVSS 5.3, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2023-21915](https://cve.now/CVE-2023-21915.md): Vulnerability in the Oracle Banking Payments product of Oracle Financial Services Applications (component: Book/Internal Transfer). (CVSS 4.6, Oracle Banking Payments)
- [CVE-2023-21913](https://cve.now/CVE-2023-21913.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21912](https://cve.now/CVE-2023-21912.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). (CVSS 7.5, Oracle MySQL Server)
- [CVE-2023-21911](https://cve.now/CVE-2023-21911.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21910](https://cve.now/CVE-2023-21910.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web General). (CVSS 6.5, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-21909](https://cve.now/CVE-2023-21909.md): Vulnerability in the Siebel CRM product of Oracle Siebel CRM (component: UI Framework). (CVSS 6.5, Oracle Siebel UI Framework)
- [CVE-2023-21908](https://cve.now/CVE-2023-21908.md): Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: OBVAM Trn Journ (CVSS 6.0, Oracle Banking Virtual Account Management)
- [CVE-2023-21907](https://cve.now/CVE-2023-21907.md): Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: OBVAM Trn Journ (CVSS 6.0, Oracle Banking Virtual Account Management)
- [CVE-2023-21906](https://cve.now/CVE-2023-21906.md): Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: SMS Module). (CVSS 6.1, Oracle Banking Virtual Account Management)
- [CVE-2023-21905](https://cve.now/CVE-2023-21905.md): Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: Routing Hub). (CVSS 6.1, Oracle Banking Virtual Account Management)
- [CVE-2023-21904](https://cve.now/CVE-2023-21904.md): Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: OBVAM Trn Journ (CVSS 5.3, Oracle Banking Virtual Account Management)
- [CVE-2023-21903](https://cve.now/CVE-2023-21903.md): Vulnerability in the Oracle Banking Virtual Account Management product of Oracle Financial Services Applications (component: OBVAM Internal (CVSS 5.3, Oracle Banking Virtual Account Management)
- [CVE-2023-21902](https://cve.now/CVE-2023-21902.md): Vulnerability in the Oracle Financial Services Behavior Detection Platform product of Oracle Financial Services Applications (component: App (CVSS 4.3, Oracle Financial Services Behavior Detection Platform)
- [CVE-2023-21896](https://cve.now/CVE-2023-21896.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). (CVSS 7.0, Oracle Solaris Operating System)
- [CVE-2022-34755](https://cve.now/CVE-2022-34755.md): A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a s (CVSS 6.3, Schneider Electric Easergy Builder Installer)
- [CVE-2023-22294](https://cve.now/CVE-2023-22294.md): Privilege escalation in Checkmk Appliance (CVSS 8.8, Tribe29 Checkmk Appliance)
- [CVE-2023-22307](https://cve.now/CVE-2023-22307.md): Site-Passwords in GET parameters (CVSS 5.5, Tribe29 Checkmk Appliance)
- [CVE-2023-25556](https://cve.now/CVE-2023-25556.md): A CWE-287: Improper Authentication vulnerability exists that could allow a device to be compromised when a key of less than seven digits is (CVSS 8.3, Schneider Electric Merten INSTABUS Tastermodul 1fach Sys… +5)
- [CVE-2023-1548](https://cve.now/CVE-2023-1548.md): A CWE-269: Improper Privilege Management vulnerability exists that could cause a local user to perform a denial of service through the cons (CVSS 5.5, Schneider Electric EcoStruxure Control Expert)
- [CVE-2023-27976](https://cve.now/CVE-2023-27976.md): A CWE-668: Exposure of Resource to Wrong Sphere vulnerability exists that could cause remote code execution when a valid user visits a mali (CVSS 8.8, Schneider Electric EcoStruxure Control Expert)
- [CVE-2023-28143](https://cve.now/CVE-2023-28143.md): Local Privilege Escalation (CVSS 6.7, Qualys Cloud Agent)
- [CVE-2023-28142](https://cve.now/CVE-2023-28142.md): Race Condition (CVSS 6.7, Qualys Cloud Agent)
- [CVE-2023-28141](https://cve.now/CVE-2023-28141.md): NTFS Junction (CVSS 6.7, Qualys Cloud Agent)
- [CVE-2023-28140](https://cve.now/CVE-2023-28140.md): Executable Hijacking (CVSS 6.7, Qualys Cloud Agent)
- [CVE-2023-2155](https://cve.now/CVE-2023-2155.md): SourceCodester Air Cargo Management System cross site scripting (CVSS 2.4, SourceCodester Air Cargo Management System)
- [CVE-2023-2154](https://cve.now/CVE-2023-2154.md): SourceCodester Task Reminder System sql injection (CVSS 4.7, SourceCodester Task Reminder System)
- [CVE-2023-2153](https://cve.now/CVE-2023-2153.md): SourceCodester Complaint Management System POST Parameter editable\_ajax.php cross site scripting (CVSS 3.5, SourceCodester Complaint Management System)
- [CVE-2022-45836](https://cve.now/CVE-2022-45836.md): WordPress Download Manager Plugin \<= 3.2.59 is vulnerable to Cross Site Scripting (XSS) (CVSS 7.1, W3 Eden Download Manager)
- [CVE-2023-2152](https://cve.now/CVE-2023-2152.md): SourceCodester Student Study Center Desk Management System index.php file inclusion (CVSS 5.3, SourceCodester Student Study Center Desk Management System)
- [CVE-2022-44632](https://cve.now/CVE-2022-44632.md): WordPress Content Repeater – Custom Posts Simplified Plugin \<= 1.1.13 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, Denis Buka Content Repeater – Custom Posts Simplified)
- [CVE-2023-2151](https://cve.now/CVE-2023-2151.md): SourceCodester Student Study Center Desk Management System manage\_student.php sql injection (CVSS 6.3, SourceCodester Student Study Center Desk Management System)
- [CVE-2023-2150](https://cve.now/CVE-2023-2150.md): SourceCodester Task Reminder System Master.php sql injection (CVSS 4.7, SourceCodester Task Reminder System)
- [CVE-2022-44735](https://cve.now/CVE-2022-44735.md): WordPress WP Clictracker Plugin \<= 1.0.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, Gus Sevilla WP Clictracker)
- [CVE-2022-45839](https://cve.now/CVE-2022-45839.md): WordPress WHA Puzzle Plugin \<= 1.0.9 is vulnerable to Cross Site Scripting (XSS) (CVSS 5.3, WHA Puzzle)
- [CVE-2023-2149](https://cve.now/CVE-2023-2149.md): Campcodes Online Thesis Archiving System manage\_user.php sql injection (CVSS 6.3, Campcodes Online Thesis Archiving System)
- [CVE-2022-45838](https://cve.now/CVE-2022-45838.md): WordPress ARForms Form Builder Plugin \<= 1.5.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.1, Repute InfoSystems ARForms Form Builder)
- [CVE-2023-2148](https://cve.now/CVE-2023-2148.md): Campcodes Online Thesis Archiving System view\_curriculum.php sql injection (CVSS 6.3, Campcodes Online Thesis Archiving System)
- [CVE-2023-2147](https://cve.now/CVE-2023-2147.md): Campcodes Online Thesis Archiving System view\_details.php sql injection (CVSS 6.3, Campcodes Online Thesis Archiving System)
- [CVE-2023-2146](https://cve.now/CVE-2023-2146.md): Campcodes Online Thesis Archiving System Master.php sql injection (CVSS 6.3, Campcodes Online Thesis Archiving System)
- [CVE-2023-2020](https://cve.now/CVE-2023-2020.md): Unauthorized scheduling of downtimes via REST API (CVSS 4.3, Tribe29 Checkmk)
- [CVE-2023-2145](https://cve.now/CVE-2023-2145.md): Campcodes Online Thesis Archiving System projects\_per\_curriculum.php sql injection (CVSS 6.3, Campcodes Online Thesis Archiving System)
- [CVE-2023-2144](https://cve.now/CVE-2023-2144.md): Campcodes Online Thesis Archiving System view\_department.php sql injection (CVSS 6.3, Campcodes Online Thesis Archiving System)
- [CVE-2023-2120](https://cve.now/CVE-2023-2120.md): Thumbnail carousel slider \<= 1.1.9 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 Thumbnail carousel slider)
- [CVE-2023-2119](https://cve.now/CVE-2023-2119.md): Responsive Filterable Portfolio \<= 1.0.19 - Reflected Cross-Site Scripting (CVSS 6.1, nik00726 Responsive Filterable Portfolio)
- [CVE-2021-28254](https://cve.now/CVE-2021-28254.md): A deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to execute arbitrary commands. (CVSS 9.8)
- [CVE-2021-40506](https://cve.now/CVE-2021-40506.md): An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. (CVSS 9.8)
- [CVE-2021-40507](https://cve.now/CVE-2021-40507.md): An issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10 through 2015-11-11. (CVSS 9.8)
- [CVE-2021-41612](https://cve.now/CVE-2021-41612.md): An issue was discovered in the ALU unit of the OpenRISC mor1kx processor. (CVSS 8.8)
- [CVE-2021-41613](https://cve.now/CVE-2021-41613.md): An issue was discovered in the controller unit of the OpenRISC mor1kx processor. (CVSS 4.3)
- [CVE-2021-41614](https://cve.now/CVE-2021-41614.md): An issue was discovered in the controller unit of the OpenRISC mor1kx processor. (CVSS 7.8)
- [CVE-2022-46640](https://cve.now/CVE-2022-46640.md): Nanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability which is exploited via a crafted HTTP request (CVSS 9.8)
- [CVE-2023-2138](https://cve.now/CVE-2023-2138.md): Use of Hard-coded Credentials in nuxtlabs/github-module (CVSS 10.0, nuxtlabs/github-module · @nuxtlabs/github-module)
- [CVE-2023-2160](https://cve.now/CVE-2023-2160.md): Weak Password Requirements in modoboa/modoboa (CVSS 6.3, modoboa/modoboa · modoboa)
- [CVE-2023-27043](https://cve.now/CVE-2023-27043.md): The email module of Python through 3.11.3 incorrectly parses e-mail addresses that contain a special character. (CVSS 5.3)
- [CVE-2023-27092](https://cve.now/CVE-2023-27092.md): Cross Site Scripting vulnerability found in Jbootfly allows attackers to obtain sensitive information via the username parameter. (CVSS 6.1)
- [CVE-2023-28863](https://cve.now/CVE-2023-28863.md): AMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity. (CVSS 9.1)
- [CVE-2023-29774](https://cve.now/CVE-2023-29774.md): Dreamer CMS 3.0.1 is vulnerable to stored Cross Site Scripting (XSS). (CVSS 5.4)
- [CVE-2023-29854](https://cve.now/CVE-2023-29854.md): DirCMS 6.0.0 has a Cross Site Scripting (XSS) vulnerability in the foreground. (CVSS 6.1)
- [CVE-2023-29855](https://cve.now/CVE-2023-29855.md): WBCE CMS 1.5.3 has a command execution vulnerability via admin/languages/install.php. (CVSS 7.2)
- [CVE-2023-29887](https://cve.now/CVE-2023-29887.md): A Local File inclusion vulnerability in test.php in spreadsheet-reader 0.5.11 allows remote attackers to include arbitrary files via the Fil (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.