CVEs published April 19, 2023
94 CVEs were published on April 19, 2023: 7 critical, 46 high. 2 are now in CISA KEV.
- Published
- 94
- Critical
- 7
- High
- 46
- Medium
- 40
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 23
Most affected products
- Android
- 38
- Google Chrome
- 5
- Avast Antivirus · AVG Antivirus
- 3
- Linux
- 3
- stevejburge Tag, Category, and Taxonomy Manager – AI Autota…
- 3
- tech.powerjob:powerjob
- 3
- UI Desktop for Windows
- 3
- Canonical cloud-init
- 2
- Kernel
- 2
- Schneider Electric Modicon M340 CPU · Schneider Electric… +4
- 2
Critical 7
- CVE-2023-2136Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to poteGoogle Chrome
- CVE-2021-33970Buffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges.
- CVE-2021-33972Buffer Overflow vulnerability in Qihoo 360 Safe Browser v13.0.2170.0 allows attacker to escalate priveleges.
- CVE-2021-33975Buffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows attacker to escalate privileges.
- CVE-2023-21096In OnWakelockReleased of attribution_processor.cc, there is a use after free that could lead to remote code execution with no additional exeAndroid
- CVE-2023-22621Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the serve@strapi/plugin-users-permissions · @strapi/plugin-email
- CVE-2023-23451The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW.SICK FX0-GENT00000, SICK FX0-GENT00030, SICK FX0-GMOD00000,…
High 46
- CVE-2023-30797Insecure Random Generation in Netflix LemurNetflix Lemur · lemur
- CVE-2023-1900A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow.Avira Antivirus
- CVE-2023-30614Improper Neutralization of Script-Related HTML Tags in a Web Page in paypay-rails pay · pay
- CVE-2021-43819Stargate-Bukkit improperly handles vehicles causing data duplication.Stargate-Bukkit
- CVE-2023-25619 A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller wSchneider Electric Modicon M340 CPU · Schneider Electric… +4
- CVE-2023-2137Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2023-2135Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific preconGoogle Chrome
- CVE-2023-2134Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit Google Chrome
- CVE-2023-2133Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit Google Chrome
- CVE-2021-0872In PVRSRVBridgeRGXKickVRDM of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow ouAndroid
- CVE-2021-0873In PVRSRVBridgeRGXKickRS of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out-Android
- CVE-2021-0874In PVRSRVBridgeDevicememHistorySparseChange of the PowerVR kernel driver, a missing size check means there is a possible integer overflow thAndroid
- CVE-2021-0875In PVRSRVBridgeChangeSparseMem of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could alloAndroid
- CVE-2021-0876In PVRSRVBridgePhysmemNewRamBackedLockedPMR of the PowerVR kernel driver, a missing size check means there is a possible integer overflow thAndroid
- CVE-2021-0878In PVRSRVBridgeServerSyncGetStatus of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could Android
- CVE-2021-0879In PVRSRVBridgeRGXTDMSubmitTransfer of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that couldAndroid
- CVE-2021-0880In PVRSRVBridgeRGXKickTA3D of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow ouAndroid
- CVE-2021-0881In PVRSRVBridgeRGXKickCDM of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow outAndroid
- CVE-2021-0882In PVRSRVBridgeRGXKickSync of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow ouAndroid
- CVE-2021-0883In PVRSRVBridgeCacheOpQueue of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow oAndroid
- CVE-2021-0884In PVRSRVBridgePhysmemImportSparseDmaBuf of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that Android
- CVE-2021-0885In PVRSRVBridgeSyncPrimOpTake of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allowAndroid
- CVE-2021-33971Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Total Security (http://www.360totalsecurity.com/) is aff
- CVE-2021-33973Buffer Overflow vulnerability in Qihoo 360 Safe guard v12.1.0.1004, v12.1.0.1005, v13.1.0.1001 allows attacker to escalate priveleges.
- CVE-2021-33974Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Chrome (https://browser.360.cn/ee/) is affected by: Buff
- CVE-2023-20950In AlarmManagerActivity of AlarmManagerActivity.java, there is a possible way to bypass background activity launch restrictions via a pendinAndroid
- CVE-2023-20967In avdt_scb_hdl_pkt_no_frag of avdt_scb_act.cc, there is a possible out of bounds write due to an incorrect bounds check.Android
- CVE-2023-21081In multiple functions of PackageInstallerService.java and related files, there is a possible way to bypass background activity launch restriAndroid
- CVE-2023-21083In onNullBinding of CallScreeningServiceHelper.java, there is a possible way to record audio without showing a privacy indicator due to a peAndroid
- CVE-2023-21085In nci_snd_set_routing_cmd of nci_hmsgs.cc, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2023-21086In isToggleable of SecureNfcEnabler.java and SecureNfcPreferenceController.java, there is a possible way to enable NFC from a secondary accoAndroid
- CVE-2023-21088In deliverOnFlushComplete of LocationProviderManager.java, there is a possible way to bypass background activity launch restrictions due to Android
- CVE-2023-21089In startInstrumentation of ActivityManagerService.java, there is a possible way to keep the foreground service alive while the app is in theAndroid
- CVE-2023-21092In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of SyAndroid
- CVE-2023-21093In extractRelativePath of FileUtils.java, there is a possible way to access files in a directory belonging to other applications due to a paAndroid
- CVE-2023-21094In sanitize of LayerState.cpp, there is a possible way to take over the screen display and swap the display content due to a missing permissAndroid
- CVE-2023-21097In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due to a confused deputy.Android
- CVE-2023-21098In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Settings app due to a conAndroid
- CVE-2023-21099In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the background due to a logicAndroid
- CVE-2023-21100In inflate of inflate.c, there is a possible out of bounds write due to a heap buffer overflow.Android
- CVE-2023-22645kubewarden: Excessive permissions for kubewarden-controller-manager-cluster-roleSUSE kubewarden
- CVE-2023-22893Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for au@strapi/plugin-users-permissions
- CVE-2023-22894Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter.@strapi/strapi
- CVE-2023-25760Incorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated user to modify other users passwords vi
- CVE-2023-28122A local privilege escalation (LPE) vulnerability in UI Desktop for Windows (Version 0.59.1.71 and earlier) allows a malicious actor with locUI Desktop for Windows
- CVE-2023-30463Altran picoTCP through 1.7.0 allows memory corruption (and subsequent denial of service) because of an integer overflow in pico_ipv6_alloc w
Medium, low and unrated 41
- CVE-2022-2084sensitive data exposure in cloud-init logsCanonical cloud-init
- CVE-2021-3429sensitive data exposure in cloud-init logsCanonical cloud-init
- CVE-2023-1587Avast and AVG Antivirus for Windows were susceptible to a NULL pointer dereference issue via RPC-interface.Avast Antivirus · AVG Antivirus
- CVE-2023-1586Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the restore process leading tAvast Antivirus · AVG Antivirus
- CVE-2023-1585Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, leadiAvast Antivirus · AVG Antivirus
- CVE-2023-30612Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisorcloud-hypervisor
- CVE-2023-30611Reaction metadata exposed in private topics in Discourse-reactionsdiscourse-reactions
- CVE-2023-30610AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sendingawslabs aws-sdk-rust · aws-sigv4
- CVE-2022-38125FTP Agent forwards traffic on inactive ports to LinkManagerSecomea SiteManager
- CVE-2023-0317GateManager debug interface is included in non-debug buildsSecomea GateManager
- CVE-2022-4308Clear-text passwords in configuration filesSecomea GateManager
- CVE-2023-2170TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scriptingstevejburge Tag, Category, and Taxonomy Manager – AI Autota…
- CVE-2023-2169TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scriptingstevejburge Tag, Category, and Taxonomy Manager – AI Autota…
- CVE-2023-2168TaxoPress <= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scriptingstevejburge Tag, Category, and Taxonomy Manager – AI Autota…
- CVE-2023-25620 A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controllerSchneider Electric Modicon M340 CPU · Schneider Electric… +4
- CVE-2022-2507In affected versions of Octopus Deploy it is possible to render user supplied input into the webpageOctopus Deploy Octopus Server
- CVE-2023-1382A data race flaw was found in the Linux kernel, between where con is allocated and con->sock is set.Kernel
- CVE-2023-20862In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support doesSpring Security · org.springframework.security:spring-secur…
- CVE-2023-20909In multiple functions of RunningTasks.java, there is a possible privilege escalation due to a missing privilege check.Android
- CVE-2023-20935In deserialize of multiple files, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2023-20941In acc_ctrlrequest_composite of f_accessory.c, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2023-21080In register_notification_rsp of btif_rc.cc, there is a possible out of bounds read due to a missing bounds check.Android
- CVE-2023-21082In getNumberFromCallIntent of NewOutgoingCallIntentBroadcaster.java, there is a possible way to enumerate other user's contact phone number Android
- CVE-2023-21084In buildPropFile of filesystem.go, there is a possible insecure hash due to an improperly used crypto.Android
- CVE-2023-21087In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop.Android
- CVE-2023-21090In parseUsesPermission of ParsingPackageUtils.java, there is a possible boot loop due to resource exhaustion.Android
- CVE-2023-21091In canDisplayLocalUi of AppLocalePickerActivity.java, there is a possible way to change system app locales due to a missing permission checkAndroid
- CVE-2023-2162A use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp.c in SCSI sub-component in the Linux KerneKernel
- CVE-2023-2166A null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux before Linux.Linux
- CVE-2023-25759OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run
- CVE-2023-26599XSS vulnerability in TripleSign in Tripleplay Platform releases prior to Caveman 3.4.0 allows attackers to inject client-side code to run as
- CVE-2023-27776A stored cross-site scripting (XSS) vulnerability in /index.php?page=category_list of Online Jewelry Shop v1.0 allows attackers to execute a
- CVE-2023-27777Cross-site scripting (XSS) vulnerability was discovered in Online Jewelry Shop v1.0 that allows attackers to execute arbitrary script via a
- CVE-2023-28123A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while UI Desktop for Windows
- CVE-2023-28124Improper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with access to UI DesktopUI Desktop for Windows
- CVE-2023-28327A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel.Linux
- CVE-2023-28328A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel.Linux
- CVE-2023-29586Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation.
- CVE-2023-29921PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface.tech.powerjob:powerjob
- CVE-2023-29922PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface.tech.powerjob:powerjob
- CVE-2023-29923PowerJob V4.3.1 is vulnerable to Insecure Permissions.tech.powerjob:powerjob