# CVEs published 2023-04-19

94 CVEs were published on April 19, 2023: 7 critical, 46 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-2084](https://cve.now/CVE-2022-2084.md): sensitive data exposure in cloud-init logs (CVSS 5.5, Canonical cloud-init)
- [CVE-2021-3429](https://cve.now/CVE-2021-3429.md): sensitive data exposure in cloud-init logs (CVSS 5.5, Canonical cloud-init)
- [CVE-2023-30797](https://cve.now/CVE-2023-30797.md): Insecure Random Generation in Netflix Lemur (CVSS 7.5, Netflix Lemur · lemur)
- [CVE-2023-1900](https://cve.now/CVE-2023-1900.md): A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow. (CVSS 7.8, Avira Antivirus)
- [CVE-2023-1587](https://cve.now/CVE-2023-1587.md): Avast and AVG Antivirus for Windows were susceptible to a NULL pointer dereference issue via RPC-interface. (CVSS 5.8, Avast Antivirus · AVG Antivirus)
- [CVE-2023-1586](https://cve.now/CVE-2023-1586.md): Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the restore process leading t (CVSS 6.5, Avast Antivirus · AVG Antivirus)
- [CVE-2023-1585](https://cve.now/CVE-2023-1585.md): Avast and AVG Antivirus for Windows were susceptible to a Time-of-check/Time-of-use (TOCTOU) vulnerability in the Quarantine process, leadi (CVSS 6.5, Avast Antivirus · AVG Antivirus)
- [CVE-2023-30614](https://cve.now/CVE-2023-30614.md): Improper Neutralization of Script-Related HTML Tags in a Web Page in pay (CVSS 7.1, pay-rails pay · pay)
- [CVE-2023-30612](https://cve.now/CVE-2023-30612.md): Malicious HTTP requests could close arbitrary opening file descriptors in cloud-hypervisor (CVSS 4.0, cloud-hypervisor)
- [CVE-2023-30611](https://cve.now/CVE-2023-30611.md): Reaction metadata exposed in private topics in Discourse-reactions (CVSS 4.3, discourse-reactions)
- [CVE-2023-30610](https://cve.now/CVE-2023-30610.md): AWS SDK for Rust will log AWS credentials when TRACE-level logging is enabled for request sending (CVSS 5.5, awslabs aws-sdk-rust · aws-sigv4)
- [CVE-2021-43819](https://cve.now/CVE-2021-43819.md): Stargate-Bukkit improperly handles vehicles causing data duplication. (CVSS 7.5, Stargate-Bukkit)
- [CVE-2022-38125](https://cve.now/CVE-2022-38125.md): FTP Agent forwards traffic on inactive ports to LinkManager (CVSS 2.9, Secomea SiteManager)
- [CVE-2023-0317](https://cve.now/CVE-2023-0317.md): GateManager debug interface is included in non-debug builds (CVSS 4.9, Secomea GateManager)
- [CVE-2022-4308](https://cve.now/CVE-2022-4308.md): Clear-text passwords in configuration files (CVSS 6.1, Secomea GateManager)
- [CVE-2023-2170](https://cve.now/CVE-2023-2170.md): TaxoPress \<= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting (CVSS 5.5, stevejburge Tag, Category, and Taxonomy Manager – AI Autota…)
- [CVE-2023-2169](https://cve.now/CVE-2023-2169.md): TaxoPress \<= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting (CVSS 5.5, stevejburge Tag, Category, and Taxonomy Manager – AI Autota…)
- [CVE-2023-2168](https://cve.now/CVE-2023-2168.md): TaxoPress \<= 3.6.4 - Authenticated (Editor+) Stored Cross-Site Scripting (CVSS 5.5, stevejburge Tag, Category, and Taxonomy Manager – AI Autota…)
- [CVE-2023-25620](https://cve.now/CVE-2023-25620.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller (CVSS 6.5, Schneider Electric Modicon M340 CPU · Schneider Electric… +4)
- [CVE-2023-25619](https://cve.now/CVE-2023-25619.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists that could cause denial of service of the controller w (CVSS 7.5, Schneider Electric Modicon M340 CPU · Schneider Electric… +4)
- [CVE-2023-2137](https://cve.now/CVE-2023-2137.md): Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via (CVSS 8.8, Google Chrome)
- [CVE-2023-2136](https://cve.now/CVE-2023-2136.md): Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to pote (CVSS 9.6, KEV, Google Chrome)
- [CVE-2023-2135](https://cve.now/CVE-2023-2135.md): Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific precon (CVSS 7.5, Google Chrome)
- [CVE-2023-2134](https://cve.now/CVE-2023-2134.md): Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit (CVSS 8.8, Google Chrome)
- [CVE-2023-2133](https://cve.now/CVE-2023-2133.md): Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit (CVSS 8.8, Google Chrome)
- [CVE-2021-0872](https://cve.now/CVE-2021-0872.md): In PVRSRVBridgeRGXKickVRDM of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow ou (CVSS 7.8, Android)
- [CVE-2021-0873](https://cve.now/CVE-2021-0873.md): In PVRSRVBridgeRGXKickRS of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out- (CVSS 7.8, Android)
- [CVE-2021-0874](https://cve.now/CVE-2021-0874.md): In PVRSRVBridgeDevicememHistorySparseChange of the PowerVR kernel driver, a missing size check means there is a possible integer overflow th (CVSS 7.8, Android)
- [CVE-2021-0875](https://cve.now/CVE-2021-0875.md): In PVRSRVBridgeChangeSparseMem of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allo (CVSS 7.8, Android)
- [CVE-2021-0876](https://cve.now/CVE-2021-0876.md): In PVRSRVBridgePhysmemNewRamBackedLockedPMR of the PowerVR kernel driver, a missing size check means there is a possible integer overflow th (CVSS 7.8, Android)
- [CVE-2021-0878](https://cve.now/CVE-2021-0878.md): In PVRSRVBridgeServerSyncGetStatus of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could (CVSS 7.8, Android)
- [CVE-2021-0879](https://cve.now/CVE-2021-0879.md): In PVRSRVBridgeRGXTDMSubmitTransfer of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could (CVSS 7.8, Android)
- [CVE-2021-0880](https://cve.now/CVE-2021-0880.md): In PVRSRVBridgeRGXKickTA3D of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow ou (CVSS 7.8, Android)
- [CVE-2021-0881](https://cve.now/CVE-2021-0881.md): In PVRSRVBridgeRGXKickCDM of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow out (CVSS 7.8, Android)
- [CVE-2021-0882](https://cve.now/CVE-2021-0882.md): In PVRSRVBridgeRGXKickSync of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow ou (CVSS 7.8, Android)
- [CVE-2021-0883](https://cve.now/CVE-2021-0883.md): In PVRSRVBridgeCacheOpQueue of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow o (CVSS 7.8, Android)
- [CVE-2021-0884](https://cve.now/CVE-2021-0884.md): In PVRSRVBridgePhysmemImportSparseDmaBuf of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that (CVSS 7.8, Android)
- [CVE-2021-0885](https://cve.now/CVE-2021-0885.md): In PVRSRVBridgeSyncPrimOpTake of the PowerVR kernel driver, a missing size check means there is a possible integer overflow that could allow (CVSS 7.8, Android)
- [CVE-2021-33970](https://cve.now/CVE-2021-33970.md): Buffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate priveleges. (CVSS 10.0)
- [CVE-2021-33971](https://cve.now/CVE-2021-33971.md): Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Total Security (http://www.360totalsecurity.com/) is aff (CVSS 7.8)
- [CVE-2021-33972](https://cve.now/CVE-2021-33972.md): Buffer Overflow vulnerability in Qihoo 360 Safe Browser v13.0.2170.0 allows attacker to escalate priveleges. (CVSS 10.0)
- [CVE-2021-33973](https://cve.now/CVE-2021-33973.md): Buffer Overflow vulnerability in Qihoo 360 Safe guard v12.1.0.1004, v12.1.0.1005, v13.1.0.1001 allows attacker to escalate priveleges. (CVSS 7.8)
- [CVE-2021-33974](https://cve.now/CVE-2021-33974.md): Qihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Chrome (https://browser.360.cn/ee/) is affected by: Buff (CVSS 8.8)
- [CVE-2021-33975](https://cve.now/CVE-2021-33975.md): Buffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows attacker to escalate privileges. (CVSS 10.0)
- [CVE-2022-2507](https://cve.now/CVE-2022-2507.md): In affected versions of Octopus Deploy it is possible to render user supplied input into the webpage (CVSS 5.3, Octopus Deploy Octopus Server)
- [CVE-2023-1382](https://cve.now/CVE-2023-1382.md): A data race flaw was found in the Linux kernel, between where con is allocated and con-\>sock is set. (CVSS 4.7, Kernel)
- [CVE-2023-20862](https://cve.now/CVE-2023-20862.md): In Spring Security, versions 5.7.x prior to 5.7.8, versions 5.8.x prior to 5.8.3, and versions 6.0.x prior to 6.0.3, the logout support does (CVSS 6.3, Spring Security · org.springframework.security:spring-secur…)
- [CVE-2023-20909](https://cve.now/CVE-2023-20909.md): In multiple functions of RunningTasks.java, there is a possible privilege escalation due to a missing privilege check. (CVSS 5.5, Android)
- [CVE-2023-20935](https://cve.now/CVE-2023-20935.md): In deserialize of multiple files, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Android)
- [CVE-2023-20941](https://cve.now/CVE-2023-20941.md): In acc\_ctrlrequest\_composite of f\_accessory.c, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.6, Android)
- [CVE-2023-20950](https://cve.now/CVE-2023-20950.md): In AlarmManagerActivity of AlarmManagerActivity.java, there is a possible way to bypass background activity launch restrictions via a pendin (CVSS 7.8, Android)
- [CVE-2023-20967](https://cve.now/CVE-2023-20967.md): In avdt\_scb\_hdl\_pkt\_no\_frag of avdt\_scb\_act.cc, there is a possible out of bounds write due to an incorrect bounds check. (CVSS 7.8, Android)
- [CVE-2023-21080](https://cve.now/CVE-2023-21080.md): In register\_notification\_rsp of btif\_rc.cc, there is a possible out of bounds read due to a missing bounds check. (CVSS 5.5, Android)
- [CVE-2023-21081](https://cve.now/CVE-2023-21081.md): In multiple functions of PackageInstallerService.java and related files, there is a possible way to bypass background activity launch restri (CVSS 7.8, Android)
- [CVE-2023-21082](https://cve.now/CVE-2023-21082.md): In getNumberFromCallIntent of NewOutgoingCallIntentBroadcaster.java, there is a possible way to enumerate other user's contact phone number (CVSS 5.5, Android)
- [CVE-2023-21083](https://cve.now/CVE-2023-21083.md): In onNullBinding of CallScreeningServiceHelper.java, there is a possible way to record audio without showing a privacy indicator due to a pe (CVSS 7.8, Android)
- [CVE-2023-21084](https://cve.now/CVE-2023-21084.md): In buildPropFile of filesystem.go, there is a possible insecure hash due to an improperly used crypto. (CVSS 6.7, Android)
- [CVE-2023-21085](https://cve.now/CVE-2023-21085.md): In nci\_snd\_set\_routing\_cmd of nci\_hmsgs.cc, there is a possible out of bounds write due to a missing bounds check. (CVSS 8.8, Android)
- [CVE-2023-21086](https://cve.now/CVE-2023-21086.md): In isToggleable of SecureNfcEnabler.java and SecureNfcPreferenceController.java, there is a possible way to enable NFC from a secondary acco (CVSS 7.8, Android)
- [CVE-2023-21087](https://cve.now/CVE-2023-21087.md): In PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop. (CVSS 5.5, Android)
- [CVE-2023-21088](https://cve.now/CVE-2023-21088.md): In deliverOnFlushComplete of LocationProviderManager.java, there is a possible way to bypass background activity launch restrictions due to (CVSS 7.8, Android)
- [CVE-2023-21089](https://cve.now/CVE-2023-21089.md): In startInstrumentation of ActivityManagerService.java, there is a possible way to keep the foreground service alive while the app is in the (CVSS 7.8, Android)
- [CVE-2023-21090](https://cve.now/CVE-2023-21090.md): In parseUsesPermission of ParsingPackageUtils.java, there is a possible boot loop due to resource exhaustion. (CVSS 5.0, Android)
- [CVE-2023-21091](https://cve.now/CVE-2023-21091.md): In canDisplayLocalUi of AppLocalePickerActivity.java, there is a possible way to change system app locales due to a missing permission check (CVSS 5.5, Android)
- [CVE-2023-21092](https://cve.now/CVE-2023-21092.md): In retrieveServiceLocked of ActiveServices.java, there is a possible way to dynamically register a BroadcastReceiver using permissions of Sy (CVSS 7.8, Android)
- [CVE-2023-21093](https://cve.now/CVE-2023-21093.md): In extractRelativePath of FileUtils.java, there is a possible way to access files in a directory belonging to other applications due to a pa (CVSS 7.8, Android)
- [CVE-2023-21094](https://cve.now/CVE-2023-21094.md): In sanitize of LayerState.cpp, there is a possible way to take over the screen display and swap the display content due to a missing permiss (CVSS 7.8, Android)
- [CVE-2023-21096](https://cve.now/CVE-2023-21096.md): In OnWakelockReleased of attribution\_processor.cc, there is a use after free that could lead to remote code execution with no additional exe (CVSS 9.8, Android)
- [CVE-2023-21097](https://cve.now/CVE-2023-21097.md): In toUriInner of Intent.java, there is a possible way to launch an arbitrary activity due to a confused deputy. (CVSS 7.8, Android)
- [CVE-2023-21098](https://cve.now/CVE-2023-21098.md): In multiple functions of AccountManagerService.java, there is a possible loading of arbitrary code into the System Settings app due to a con (CVSS 7.8, Android)
- [CVE-2023-21099](https://cve.now/CVE-2023-21099.md): In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the background due to a logic (CVSS 7.8, Android)
- [CVE-2023-21100](https://cve.now/CVE-2023-21100.md): In inflate of inflate.c, there is a possible out of bounds write due to a heap buffer overflow. (CVSS 7.8, Android)
- [CVE-2023-2162](https://cve.now/CVE-2023-2162.md): A use-after-free vulnerability was found in iscsi\_sw\_tcp\_session\_create in drivers/scsi/iscsi\_tcp.c in SCSI sub-component in the Linux Kerne (CVSS 5.5, Kernel)
- [CVE-2023-2166](https://cve.now/CVE-2023-2166.md): A null pointer dereference issue was found in can protocol in net/can/af\_can.c in the Linux before Linux. (CVSS 5.5, Linux)
- [CVE-2023-22621](https://cve.now/CVE-2023-22621.md): Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the serve (CVSS 10.0, @strapi/plugin-users-permissions · @strapi/plugin-email)
- [CVE-2023-22645](https://cve.now/CVE-2023-22645.md): kubewarden: Excessive permissions for kubewarden-controller-manager-cluster-role (CVSS 8.0, SUSE kubewarden)
- [CVE-2023-22893](https://cve.now/CVE-2023-22893.md): Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for au (CVSS 8.2, @strapi/plugin-users-permissions)
- [CVE-2023-22894](https://cve.now/CVE-2023-22894.md): Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. (CVSS 7.2, KEV, @strapi/strapi)
- [CVE-2023-23451](https://cve.now/CVE-2023-23451.md): The Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW. (CVSS 9.8, SICK FX0-GENT00000, SICK FX0-GENT00030, SICK FX0-GMOD00000,…)
- [CVE-2023-25759](https://cve.now/CVE-2023-25759.md): OS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated users to run (CVSS 5.3)
- [CVE-2023-25760](https://cve.now/CVE-2023-25760.md): Incorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows authenticated user to modify other users passwords vi (CVSS 8.8)
- [CVE-2023-26599](https://cve.now/CVE-2023-26599.md): XSS vulnerability in TripleSign in Tripleplay Platform releases prior to Caveman 3.4.0 allows attackers to inject client-side code to run as (CVSS 6.1)
- [CVE-2023-27776](https://cve.now/CVE-2023-27776.md): A stored cross-site scripting (XSS) vulnerability in /index.php?page=category\_list of Online Jewelry Shop v1.0 allows attackers to execute a (CVSS 5.4)
- [CVE-2023-27777](https://cve.now/CVE-2023-27777.md): Cross-site scripting (XSS) vulnerability was discovered in Online Jewelry Shop v1.0 that allows attackers to execute arbitrary script via a (CVSS 5.4)
- [CVE-2023-28122](https://cve.now/CVE-2023-28122.md): A local privilege escalation (LPE) vulnerability in UI Desktop for Windows (Version 0.59.1.71 and earlier) allows a malicious actor with loc (CVSS 7.8, UI Desktop for Windows)
- [CVE-2023-28123](https://cve.now/CVE-2023-28123.md): A permission misconfiguration in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow an user to hijack VPN credentials while (CVSS 5.5, UI Desktop for Windows)
- [CVE-2023-28124](https://cve.now/CVE-2023-28124.md): Improper usage of symmetric encryption in UI Desktop for Windows (Version 0.59.1.71 and earlier) could allow users with access to UI Desktop (CVSS 5.5, UI Desktop for Windows)
- [CVE-2023-28327](https://cve.now/CVE-2023-28327.md): A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix\_diag\_get\_exact in the Linux Kernel. (CVSS 5.5, Linux)
- [CVE-2023-28328](https://cve.now/CVE-2023-28328.md): A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. (CVSS 5.5, Linux)
- [CVE-2023-29586](https://cve.now/CVE-2023-29586.md): Code Sector TeraCopy 3.9.7 does not perform proper access validation on the source folder during a copy operation. (CVSS 5.5)
- [CVE-2023-29921](https://cve.now/CVE-2023-29921.md): PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create app interface. (CVSS 5.3, tech.powerjob:powerjob)
- [CVE-2023-29922](https://cve.now/CVE-2023-29922.md): PowerJob V4.3.1 is vulnerable to Incorrect Access Control via the create user/save interface. (CVSS 5.3, tech.powerjob:powerjob)
- [CVE-2023-29923](https://cve.now/CVE-2023-29923.md): PowerJob V4.3.1 is vulnerable to Insecure Permissions. (CVSS 5.3, tech.powerjob:powerjob)
- [CVE-2023-30463](https://cve.now/CVE-2023-30463.md): Altran picoTCP through 1.7.0 allows memory corruption (and subsequent denial of service) because of an integer overflow in pico\_ipv6\_alloc w (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.