# CVEs published 2023-04-20

54 CVEs were published on April 20, 2023: 9 critical, 15 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2023-2131](https://cve.now/CVE-2023-2131.md): CVE-2023-2131 (CVSS 10.0, INEA ME RTU)
- [CVE-2023-23579](https://cve.now/CVE-2023-23579.md): Datakit CrossCAD/Ware (CVSS 7.8, Datakit CrossCAD/Ware\_x64 library)
- [CVE-2023-22846](https://cve.now/CVE-2023-22846.md): Datakit CrossCAD/Ware (CVSS 3.3, Datakit CrossCAD/Ware\_x64 library)
- [CVE-2023-22354](https://cve.now/CVE-2023-22354.md): Datakit CrossCAD/Ware (CVSS 3.3, Datakit CrossCAD/Ware\_x64 library)
- [CVE-2023-22321](https://cve.now/CVE-2023-22321.md): Datakit CrossCAD/Ware (CVSS 3.3, Datakit CrossCAD/Ware\_x64 library)
- [CVE-2023-22295](https://cve.now/CVE-2023-22295.md): CVE-2023-22295 (CVSS 3.3, Datakit CrossCAD/Ware\_x64 library)
- [CVE-2023-30616](https://cve.now/CVE-2023-30616.md): Cross Site Request Forgery due to missing nonce verification in form block (CVSS 6.5, epiphyt form-block)
- [CVE-2023-29528](https://cve.now/CVE-2023-29528.md): Cross-site Scripting in org.xwiki.commons:xwiki-commons-xml (CVSS 9.1, xwiki-commons · org.xwiki.commons:xwiki-commons-xml)
- [CVE-2023-27495](https://cve.now/CVE-2023-27495.md): Bypass of CSRF protection in the presence of predictable userInfo in @fastify/csrf-protection (CVSS 5.3, fastify csrf-protection · @fastify/csrf-protection)
- [CVE-2023-23938](https://cve.now/CVE-2023-23938.md): Cross-site Scripting (XSS) through the name of a color of select box values in tuleap (CVSS 5.9, Enalean tuleap)
- [CVE-2023-1255](https://cve.now/CVE-2023-1255.md): Input buffer over-read in AES-XTS implementation on 64 bit ARM (CVSS 5.9, OpenSSL)
- [CVE-2022-36788](https://cve.now/CVE-2022-36788.md): A heap-based buffer overflow vulnerability exists in the TriangleMesh clone functionality of Slic3r libslic3r 1.3.0 and Master Commit b1a550 (CVSS 8.1, libslic3r)
- [CVE-2023-25601](https://cve.now/CVE-2023-25601.md): Apache DolphinScheduler 3.0.0 to 3.1.1 python gateway has improper authentication (no CVSS, Apache Software Foundation Apache DolphinScheduler · org.ap…)
- [CVE-2022-46302](https://cve.now/CVE-2022-46302.md): Remote Code Execution with Root Privileges via Broad Apache Permissions (CVSS 8.8, Tribe29 Checkmk)
- [CVE-2023-22309](https://cve.now/CVE-2023-22309.md): Reflected Cross Site Scripting (XSS) (CVSS 6.1, Tribe29 Checkmk Appliance)
- [CVE-2023-1767](https://cve.now/CVE-2023-1767.md): The Snyk Advisor website (https://snyk.io/advisor/) was vulnerable to a stored XSS prior to 28th March 2023. (CVSS 4.3, Snyk Advisor)
- [CVE-2023-2193](https://cve.now/CVE-2023-2193.md): Oauth authorization codes do not expire when deauthorizing an oauth2 app (CVSS 6.5, Mattermost)
- [CVE-2023-2112](https://cve.now/CVE-2023-2112.md): Desktop component allows lateral movement between sessions (CVSS 3.6, M-Files Desktop)
- [CVE-2023-0384](https://cve.now/CVE-2023-0384.md): Uncontrolled Resource Consuption in M-Files Server (CVSS 6.5, M-Files Server)
- [CVE-2023-0383](https://cve.now/CVE-2023-0383.md): Uncontrolled Resource Consuption in M-Files Server (CVSS 7.5, M-Files Server)
- [CVE-2023-28047](https://cve.now/CVE-2023-28047.md): Dell Display Manager, versions 2.1.0 and prior, contains an arbitrary file or folder creation vulnerability during installation. (CVSS 7.3, Dell Display Manager)
- [CVE-2022-4942](https://cve.now/CVE-2022-4942.md): mportuga eslint-detailed-reporter template-generator.js renderIssue cross site scripting (CVSS 3.5, mportuga eslint-detailed-reporter · eslint-detailed-reporter)
- [CVE-2014-125099](https://cve.now/CVE-2014-125099.md): I Recommend This Plugin dot-irecommendthis.php sql injection (CVSS 6.3, I Recommend This Plugin)
- [CVE-2021-36436](https://cve.now/CVE-2021-36436.md): An issue in Mobicint Backend for Credit Unions v3 allows attackers to retrieve partial email addresses and user entered information via subm (CVSS 5.3)
- [CVE-2021-38363](https://cve.now/CVE-2021-38363.md): An issue was discovered in ONOS 2.5.1. (CVSS 7.5)
- [CVE-2021-38364](https://cve.now/CVE-2021-38364.md): An issue was discovered in ONOS 2.5.1. (CVSS 6.5)
- [CVE-2022-24035](https://cve.now/CVE-2022-24035.md): An issue was discovered in ONOS 2.5.1. (CVSS 7.5)
- [CVE-2022-24109](https://cve.now/CVE-2022-24109.md): An issue was discovered in ONOS 2.5.1. (CVSS 6.5)
- [CVE-2022-29604](https://cve.now/CVE-2022-29604.md): An issue was discovered in ONOS 2.5.1. (CVSS 9.8)
- [CVE-2022-29605](https://cve.now/CVE-2022-29605.md): An issue was discovered in ONOS 2.5.1. (CVSS 7.5)
- [CVE-2022-29606](https://cve.now/CVE-2022-29606.md): An issue was discovered in ONOS 2.5.1. (CVSS 9.8)
- [CVE-2022-29607](https://cve.now/CVE-2022-29607.md): An issue was discovered in ONOS 2.5.1. (CVSS 7.5)
- [CVE-2022-29608](https://cve.now/CVE-2022-29608.md): An issue was discovered in ONOS 2.5.1. (CVSS 7.5)
- [CVE-2022-29609](https://cve.now/CVE-2022-29609.md): An issue was discovered in ONOS 2.5.1. (CVSS 5.3)
- [CVE-2022-29944](https://cve.now/CVE-2022-29944.md): An issue was discovered in ONOS 2.5.1. (CVSS 5.3)
- [CVE-2023-20864](https://cve.now/CVE-2023-20864.md): VMware Aria Operations for Logs contains a deserialization vulnerability. (CVSS 9.8, VMware Aria Operations for Logs)
- [CVE-2023-20865](https://cve.now/CVE-2023-20865.md): VMware Aria Operations for Logs contains a command injection vulnerability. (CVSS 7.2, VMware Aria Operations for Logs)
- [CVE-2023-20873](https://cve.now/CVE-2023-20873.md): In Spring Boot versions 3.0.0 - 3.0.5, 2.7.0 - 2.7.10, and older unsupported versions, an application that is deployed to Cloud Foundry coul (CVSS 9.8, Spring Boot · org.springframework.boot:spring-boot-actuator…)
- [CVE-2023-2176](https://cve.now/CVE-2023-2176.md): A vulnerability was found in compare\_netdev\_and\_ip in drivers/infiniband/core/cma.c in RDMA in the Linux Kernel. (CVSS 7.8, Kernel)
- [CVE-2023-2177](https://cve.now/CVE-2023-2177.md): A null pointer dereference issue was found in the sctp network protocol in net/sctp/stream\_sched.c in Linux Kernel. (CVSS 5.5, Linux)
- [CVE-2023-2191](https://cve.now/CVE-2023-2191.md): Cross-site Scripting (XSS) - Stored in azuracast/azuracast (CVSS 3.5, azuracast/azuracast)
- [CVE-2023-2194](https://cve.now/CVE-2023-2194.md): An out-of-bounds write vulnerability was found in the Linux kernel's SLIMpro I2C device driver. (CVSS 6.7, Linux kernel: i2c: xgene-slimpro)
- [CVE-2023-27090](https://cve.now/CVE-2023-27090.md): Cross Site Scripting vulnerability found in TeaCMS storage allows attacker to cause a leak of sensitive information via the article title pa (CVSS 5.4)
- [CVE-2023-27350](https://cve.now/CVE-2023-27350.md): This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). (CVSS 9.8, KEV, PaperCut NG)
- [CVE-2023-27351](https://cve.now/CVE-2023-27351.md): This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). (CVSS 8.2, KEV, PaperCut NG)
- [CVE-2023-27352](https://cve.now/CVE-2023-27352.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220. (CVSS 8.8, Sonos One Speaker)
- [CVE-2023-27353](https://cve.now/CVE-2023-27353.md): This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-3 (CVSS 5.4, Sonos One Speaker)
- [CVE-2023-27354](https://cve.now/CVE-2023-27354.md): This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Sonos One Speaker 70.3-3 (CVSS 5.4, Sonos One Speaker)
- [CVE-2023-27355](https://cve.now/CVE-2023-27355.md): This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Sonos One Speaker 70.3-35220. (CVSS 8.8, Sonos One Speaker)
- [CVE-2023-27652](https://cve.now/CVE-2023-27652.md): An issue found in Ego Studio SuperClean v.1.1.9 and v.1.1.5 allows an attacker to gain privileges cause a denial of service via the update\_i (CVSS 5.5)
- [CVE-2023-28458](https://cve.now/CVE-2023-28458.md): pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). (CVSS 4.3, pretalx)
- [CVE-2023-28459](https://cve.now/CVE-2023-28459.md): pretalx 2.3.1 before 2.3.2 allows path traversal in HTML export (a non-default feature). (CVSS 6.5, pretalx)
- [CVE-2023-29926](https://cve.now/CVE-2023-29926.md): PowerJob V4.3.2 has unauthorized interface that causes remote code execution. (CVSS 9.8, tech.powerjob:powerjob)
- [CVE-2023-30076](https://cve.now/CVE-2023-30076.md): Sourcecodester Judging Management System v1.0 is vulnerable to SQL Injection via /php-jms/print\_judges.php?print\_judges.php=&se\_name=&sub\_ev (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.