CVEs published April 21, 2023
59 CVEs were published on April 21, 2023: 5 critical, 11 high.
- Published
- 59
- Critical
- 5
- High
- 11
- Medium
- 38
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Campcodes Coffee Shop POS System
- 8
- Campcodes Retro Basketball Shoes Online Store
- 5
- Dassault Systèmes DELMIA Apriso
- 3
- github.com/bnb-chain/tss-lib · github.com/binance-chain/tss…
- 3
- SourceCodester Task Reminder System
- 3
- fastify-passport · @fastify/passport
- 2
- modoboa/modoboa · modoboa
- 2
- SolarWinds Platform
- 2
- Curiosity-org Gipsy
- 1
- Devolutions Server
- 1
Critical 5
- CVE-2023-30621OS command injection in GipsyCuriosity-org Gipsy
- CVE-2023-2231MAXTECH MAX-G866ac Remote Management missing authenticationMAXTECH MAX-G866ac
- CVE-2023-2227Improper Authorization in modoboa/modoboamodoboa/modoboa · modoboa
- CVE-2023-26556io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication implemegithub.com/bnb-chain/tss-lib · github.com/binance-chain/tss…
- CVE-2023-29924PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution.tech.powerjob:powerjob
High 11
- CVE-2023-29019Session fixation in fastify-passportfastify-passport · @fastify/passport
- CVE-2023-30620Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdbmindsdb
- CVE-2023-2141Unsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022 Dassault Systèmes DELMIA Apriso
- CVE-2023-2140Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022 Dassault Systèmes DELMIA Apriso
- CVE-2023-30798MultipartParser DOS with too many fields or files in Starlette FrameworkEncode Starlette · starlette
- CVE-2021-33589Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of
- CVE-2022-36963SolarWinds Platform Deserialization of Untrusted Data VulnerabilitySolarWinds Platform Command Injection Vulnerability SolarWi…
- CVE-2022-47505SolarWinds Platform Local Privilege Escalation VulnerabilitySolarWinds Platform
- CVE-2023-26101In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-trave
- CVE-2023-26557io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, github.com/bnb-chain/tss-lib · github.com/binance-chain/tss…
- CVE-2023-26876SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter_user_id pa
Medium, low and unrated 43
- CVE-2023-29020Cross site request forgery token fixation in fastify-passportfastify-passport · @fastify/passport
- CVE-2023-2118Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send suDevolutions Server
- CVE-2023-30618Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraformnewcontext-oss kitchen-terraform · kitchen-terraform
- CVE-2023-2139Reflected Cross-site Scripting vulnerability affecting DELMIA Apriso Release 2017 through Release 2022 Dassault Systèmes DELMIA Apriso
- CVE-2023-1998Spectre v2 SMT mitigations problem in Linux kernelLinux Kernel
- CVE-2023-2226Velociraptor crashes while parsing some malformed PE or OLE files.Rapid7 Velociraptor
- CVE-2023-2220Dream Technology mica Form Object cross site scriptingDream Technology mica
- CVE-2023-2219SourceCodester Task Reminder System Users.php cross site scriptingSourceCodester Task Reminder System
- CVE-2023-2218SourceCodester Task Reminder System manage_user.php sql injectionSourceCodester Task Reminder System
- CVE-2023-2217SourceCodester Task Reminder System manage_reminder.php sql injectionSourceCodester Task Reminder System
- CVE-2023-2216Campcodes Coffee Shop POS System Users.php cross site scriptingCampcodes Coffee Shop POS System
- CVE-2023-2215Campcodes Coffee Shop POS System manage_user.php sql injectionCampcodes Coffee Shop POS System
- CVE-2023-2214Campcodes Coffee Shop POS System manage_sale.php sql injectionCampcodes Coffee Shop POS System
- CVE-2023-2213Campcodes Coffee Shop POS System manage_product.php sql injectionCampcodes Coffee Shop POS System
- CVE-2023-2212Campcodes Coffee Shop POS System view_product.php sql injectionCampcodes Coffee Shop POS System
- CVE-2023-2211Campcodes Coffee Shop POS System manage_category.php sql injectionCampcodes Coffee Shop POS System
- CVE-2023-2210Campcodes Coffee Shop POS System view_category.php sql injectionCampcodes Coffee Shop POS System
- CVE-2023-2209Campcodes Coffee Shop POS System view_details.php sql injectionCampcodes Coffee Shop POS System
- CVE-2023-2208Campcodes Retro Basketball Shoes Online Store details.php sql injectionCampcodes Retro Basketball Shoes Online Store
- CVE-2023-2207Campcodes Retro Basketball Shoes Online Store contactus1.php sql injectionCampcodes Retro Basketball Shoes Online Store
- CVE-2023-2206Campcodes Retro Basketball Shoes Online Store contactus.php sql injectionCampcodes Retro Basketball Shoes Online Store
- CVE-2023-2205Campcodes Retro Basketball Shoes Online Store login.php sql injectionCampcodes Retro Basketball Shoes Online Store
- CVE-2023-2204Campcodes Retro Basketball Shoes Online Store faqs.php sql injectionCampcodes Retro Basketball Shoes Online Store
- CVE-2022-47509SolarWinds Platform Incorrect Input Neutralization VulnerabilitySolarWinds Platform
- CVE-2022-47930An issue was discovered in IO FinNet tss-lib before 2.0.0.github.com/bnb-chain/tss-lib · github.com/binance-chain/tss…
- CVE-2022-48150Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI.shopware/shopware
- CVE-2023-2202Improper Access Control in francoisjacquet/rosariosisfrancoisjacquet/rosariosis
- CVE-2023-2228Cross-Site Request Forgery (CSRF) in modoboa/modoboamodoboa/modoboa · modoboa
- CVE-2023-26100In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input.
- CVE-2023-29575Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component.
- CVE-2023-29905H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm.
- CVE-2023-29906H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID interface at /goform/aspForm.
- CVE-2023-29907H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit_BasicSSID_5G interface at /goform/aspForm.
- CVE-2023-29908H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm.
- CVE-2023-29909H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm.
- CVE-2023-29910H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm.
- CVE-2023-29911H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm.
- CVE-2023-29912H3C Magic R200 R200V100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm.
- CVE-2023-29913H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm.
- CVE-2023-29914H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm.
- CVE-2023-29915H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm.
- CVE-2023-29916H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm.
- CVE-2023-29917H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via go parameter at /goform/aspForm.