CVEs published April 20, 2023
54 CVEs were published on April 20, 2023: 9 critical, 15 high. 2 are now in CISA KEV.
- Published
- 54
- Critical
- 9
- High
- 15
- Medium
- 22
- Low
- 7
- Unrated
- 1
- Now in CISA KEV
- 2
- Fix available
- 23
Most affected products
- Datakit CrossCAD/Ware_x64 library
- 5
- Sonos One Speaker
- 4
- M-Files Server
- 2
- PaperCut NG
- 2
- pretalx
- 2
- VMware Aria Operations for Logs
- 2
- Apache Software Foundation Apache DolphinScheduler · org.ap…
- 1
- azuracast/azuracast
- 1
- Dell Display Manager
- 1
- Enalean tuleap
- 1
Critical 9
- CVE-2023-2131CVE-2023-2131INEA ME RTU
- CVE-2023-29528Cross-site Scripting in org.xwiki.commons:xwiki-commons-xmlxwiki-commons · org.xwiki.commons:xwiki-commons-xml
- CVE-2022-29604An issue was discovered in ONOS 2.5.1.
- CVE-2022-29606An issue was discovered in ONOS 2.5.1.
- CVE-2023-20864VMware Aria Operations for Logs contains a deserialization vulnerability.VMware Aria Operations for Logs
- CVE-2023-20873In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry coulSpring Boot · org.springframework.boot:spring-boot-actuator…
- CVE-2023-27350This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).PaperCut NG
- CVE-2023-29926PowerJob V4.3.2 has unauthorized interface that causes remote code execution.tech.powerjob:powerjob
- CVE-2023-30076Sourcecodester Judging Management System v1.0 is vulnerable to SQL Injection via /php-jms/print_judges.php?print_judges.php=&se_name=&sub_ev
High 15
- CVE-2023-23579Datakit CrossCAD/WareDatakit CrossCAD/Ware_x64 library
- CVE-2022-36788A heap-based buffer overflow vulnerability exists in the TriangleMesh clone functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a550libslic3r
- CVE-2022-46302Remote Code Execution with Root Privileges via Broad Apache PermissionsTribe29 Checkmk
- CVE-2023-0383Uncontrolled Resource Consuption in M-Files ServerM-Files Server
- CVE-2023-28047 Dell Display Manager, versions 2.1.0 and prior, contains an arbitrary file or folder creation vulnerability during installation.Dell Display Manager
- CVE-2021-38363An issue was discovered in ONOS 2.5.1.
- CVE-2022-24035An issue was discovered in ONOS 2.5.1.
- CVE-2022-29605An issue was discovered in ONOS 2.5.1.
- CVE-2022-29607An issue was discovered in ONOS 2.5.1.
- CVE-2022-29608An issue was discovered in ONOS 2.5.1.
- CVE-2023-20865VMware Aria Operations for Logs contains a command injection vulnerability.VMware Aria Operations for Logs
- CVE-2023-2176A vulnerability was found in compare_netdev_and_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel.Kernel
- CVE-2023-27351This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914).PaperCut NG
- CVE-2023-27352This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220.Sonos One Speaker
- CVE-2023-27355This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220.Sonos One Speaker
Medium, low and unrated 30
- CVE-2023-22846Datakit CrossCAD/WareDatakit CrossCAD/Ware_x64 library
- CVE-2023-22354Datakit CrossCAD/WareDatakit CrossCAD/Ware_x64 library
- CVE-2023-22321Datakit CrossCAD/WareDatakit CrossCAD/Ware_x64 library
- CVE-2023-22295CVE-2023-22295Datakit CrossCAD/Ware_x64 library
- CVE-2023-30616Cross Site Request Forgery due to missing nonce verification in form blockepiphyt form-block
- CVE-2023-27495Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protectionfastify csrf-protection · @fastify/csrf-protection
- CVE-2023-23938Cross-site Scripting (XSS) through the name of a color of select box values in tuleapEnalean tuleap
- CVE-2023-1255Input buffer over-read in AES-XTS implementation on 64 bit ARMOpenSSL
- CVE-2023-25601Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authenticationApache Software Foundation Apache DolphinScheduler · org.ap…
- CVE-2023-22309Reflected Cross Site Scripting (XSS)Tribe29 Checkmk Appliance
- CVE-2023-1767The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023.Snyk Advisor
- CVE-2023-2193Oauth authorization codes do not expire when deauthorizing an oauth2 appMattermost
- CVE-2023-2112Desktop component allows lateral movement between sessionsM-Files Desktop
- CVE-2023-0384Uncontrolled Resource Consuption in M-Files ServerM-Files Server
- CVE-2022-4942mportuga eslint-detailed-reporter template-generator.js renderIssue cross site scriptingmportuga eslint-detailed-reporter · eslint-detailed-reporter
- CVE-2014-125099I Recommend This Plugin dot-irecommendthis.php sql injectionI Recommend This Plugin
- CVE-2021-36436An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via subm
- CVE-2021-38364An issue was discovered in ONOS 2.5.1.
- CVE-2022-24109An issue was discovered in ONOS 2.5.1.
- CVE-2022-29609An issue was discovered in ONOS 2.5.1.
- CVE-2022-29944An issue was discovered in ONOS 2.5.1.
- CVE-2023-2177A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream_sched.c in Linux Kernel.Linux
- CVE-2023-2191Cross-site Scripting (XSS) - Stored in azuracast/azuracastazuracast/azuracast
- CVE-2023-2194An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver.Linux kernel: i2c: xgene-slimpro
- CVE-2023-27090Cross Site Scripting vulnerability found in TeaCMS storage allows attacker to cause a leak of sensitive information via the article title pa
- CVE-2023-27353This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-3Sonos One Speaker
- CVE-2023-27354This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-3Sonos One Speaker
- CVE-2023-27652An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update_i
- CVE-2023-28458pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature).pretalx
- CVE-2023-28459pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature).pretalx