# CVEs published 2023-04-21

59 CVEs were published on April 21, 2023: 5 critical, 11 high. Days are UTC.

- [CVE-2023-29020](https://cve.now/CVE-2023-29020.md): Cross site request forgery token fixation in fastify-passport (CVSS 6.5, fastify-passport · @fastify/passport)
- [CVE-2023-29019](https://cve.now/CVE-2023-29019.md): Session fixation in fastify-passport (CVSS 8.1, fastify-passport · @fastify/passport)
- [CVE-2023-2118](https://cve.now/CVE-2023-2118.md): Insufficient access control in support ticket feature in Devolutions Server 2023.1.5.0 and below allows an authenticated attacker to send su (CVSS 4.3, Devolutions Server)
- [CVE-2023-30621](https://cve.now/CVE-2023-30621.md): OS command injection in Gipsy (CVSS 9.8, Curiosity-org Gipsy)
- [CVE-2023-30620](https://cve.now/CVE-2023-30620.md): Arbitrary File Write when Extracting a Remotely retrieved Tarball in mindsdb/mindsdb (CVSS 7.5, mindsdb)
- [CVE-2023-30618](https://cve.now/CVE-2023-30618.md): Sensitive Terraform Output Values Printed At Info Logging Level In Kitchen-Terraform (CVSS 3.2, newcontext-oss kitchen-terraform · kitchen-terraform)
- [CVE-2023-2141](https://cve.now/CVE-2023-2141.md): Unsafe .NET object deserialization affecting DELMIA Apriso Release 2017 through Release 2022 (CVSS 8.5, Dassault Systèmes DELMIA Apriso)
- [CVE-2023-2140](https://cve.now/CVE-2023-2140.md): Server-Side Request Forgery vulnerability affecting DELMIA Apriso Release 2017 through Release 2022 (CVSS 7.5, Dassault Systèmes DELMIA Apriso)
- [CVE-2023-2139](https://cve.now/CVE-2023-2139.md): Reflected Cross-site Scripting vulnerability affecting DELMIA Apriso Release 2017 through Release 2022 (CVSS 5.4, Dassault Systèmes DELMIA Apriso)
- [CVE-2023-30798](https://cve.now/CVE-2023-30798.md): MultipartParser DOS with too many fields or files in Starlette Framework (CVSS 7.5, Encode Starlette · starlette)
- [CVE-2023-1998](https://cve.now/CVE-2023-1998.md): Spectre v2 SMT mitigations problem in Linux kernel (CVSS 5.6, Linux Kernel)
- [CVE-2023-2231](https://cve.now/CVE-2023-2231.md): MAXTECH MAX-G866ac Remote Management missing authentication (CVSS 9.8, MAXTECH MAX-G866ac)
- [CVE-2023-2226](https://cve.now/CVE-2023-2226.md): Velociraptor crashes while parsing some malformed PE or OLE files. (CVSS 3.3, Rapid7 Velociraptor)
- [CVE-2023-2220](https://cve.now/CVE-2023-2220.md): Dream Technology mica Form Object cross site scripting (CVSS 3.5, Dream Technology mica)
- [CVE-2023-2219](https://cve.now/CVE-2023-2219.md): SourceCodester Task Reminder System Users.php cross site scripting (CVSS 3.5, SourceCodester Task Reminder System)
- [CVE-2023-2218](https://cve.now/CVE-2023-2218.md): SourceCodester Task Reminder System manage\_user.php sql injection (CVSS 6.3, SourceCodester Task Reminder System)
- [CVE-2023-2217](https://cve.now/CVE-2023-2217.md): SourceCodester Task Reminder System manage\_reminder.php sql injection (CVSS 6.3, SourceCodester Task Reminder System)
- [CVE-2023-2216](https://cve.now/CVE-2023-2216.md): Campcodes Coffee Shop POS System Users.php cross site scripting (CVSS 3.5, Campcodes Coffee Shop POS System)
- [CVE-2023-2215](https://cve.now/CVE-2023-2215.md): Campcodes Coffee Shop POS System manage\_user.php sql injection (CVSS 6.3, Campcodes Coffee Shop POS System)
- [CVE-2023-2214](https://cve.now/CVE-2023-2214.md): Campcodes Coffee Shop POS System manage\_sale.php sql injection (CVSS 6.3, Campcodes Coffee Shop POS System)
- [CVE-2023-2213](https://cve.now/CVE-2023-2213.md): Campcodes Coffee Shop POS System manage\_product.php sql injection (CVSS 6.3, Campcodes Coffee Shop POS System)
- [CVE-2023-2212](https://cve.now/CVE-2023-2212.md): Campcodes Coffee Shop POS System view\_product.php sql injection (CVSS 6.3, Campcodes Coffee Shop POS System)
- [CVE-2023-2211](https://cve.now/CVE-2023-2211.md): Campcodes Coffee Shop POS System manage\_category.php sql injection (CVSS 6.3, Campcodes Coffee Shop POS System)
- [CVE-2023-2210](https://cve.now/CVE-2023-2210.md): Campcodes Coffee Shop POS System view\_category.php sql injection (CVSS 6.3, Campcodes Coffee Shop POS System)
- [CVE-2023-2209](https://cve.now/CVE-2023-2209.md): Campcodes Coffee Shop POS System view\_details.php sql injection (CVSS 6.3, Campcodes Coffee Shop POS System)
- [CVE-2023-2208](https://cve.now/CVE-2023-2208.md): Campcodes Retro Basketball Shoes Online Store details.php sql injection (CVSS 6.3, Campcodes Retro Basketball Shoes Online Store)
- [CVE-2023-2207](https://cve.now/CVE-2023-2207.md): Campcodes Retro Basketball Shoes Online Store contactus1.php sql injection (CVSS 6.3, Campcodes Retro Basketball Shoes Online Store)
- [CVE-2023-2206](https://cve.now/CVE-2023-2206.md): Campcodes Retro Basketball Shoes Online Store contactus.php sql injection (CVSS 6.3, Campcodes Retro Basketball Shoes Online Store)
- [CVE-2023-2205](https://cve.now/CVE-2023-2205.md): Campcodes Retro Basketball Shoes Online Store login.php sql injection (CVSS 6.3, Campcodes Retro Basketball Shoes Online Store)
- [CVE-2023-2204](https://cve.now/CVE-2023-2204.md): Campcodes Retro Basketball Shoes Online Store faqs.php sql injection (CVSS 6.3, Campcodes Retro Basketball Shoes Online Store)
- [CVE-2021-33589](https://cve.now/CVE-2021-33589.md): Ribose RNP before 0.15.1 does not implement a required step in a cryptographic algorithm, resulting in weaker encryption than on the tin of (CVSS 7.5)
- [CVE-2022-36963](https://cve.now/CVE-2022-36963.md): SolarWinds Platform Deserialization of Untrusted Data Vulnerability (CVSS 7.2, SolarWinds Platform Command Injection Vulnerability SolarWi…)
- [CVE-2022-47505](https://cve.now/CVE-2022-47505.md): SolarWinds Platform Local Privilege Escalation Vulnerability (CVSS 7.8, SolarWinds Platform)
- [CVE-2022-47509](https://cve.now/CVE-2022-47509.md): SolarWinds Platform Incorrect Input Neutralization Vulnerability (CVSS 6.1, SolarWinds Platform)
- [CVE-2022-47930](https://cve.now/CVE-2022-47930.md): An issue was discovered in IO FinNet tss-lib before 2.0.0. (CVSS 6.8, github.com/bnb-chain/tss-lib · github.com/binance-chain/tss…)
- [CVE-2022-48150](https://cve.now/CVE-2022-48150.md): Shopware v5.5.10 was discovered to contain a cross-site scripting (XSS) vulnerability via the recovery/install/ URI. (CVSS 6.1, shopware/shopware)
- [CVE-2023-2202](https://cve.now/CVE-2023-2202.md): Improper Access Control in francoisjacquet/rosariosis (CVSS 4.6, francoisjacquet/rosariosis)
- [CVE-2023-2227](https://cve.now/CVE-2023-2227.md): Improper Authorization in modoboa/modoboa (CVSS 9.1, modoboa/modoboa · modoboa)
- [CVE-2023-2228](https://cve.now/CVE-2023-2228.md): Cross-Site Request Forgery (CSRF) in modoboa/modoboa (CVSS 6.8, modoboa/modoboa · modoboa)
- [CVE-2023-26100](https://cve.now/CVE-2023-26100.md): In Progress Flowmon before 12.2.0, an application endpoint failed to sanitize user-supplied input. (CVSS 6.1)
- [CVE-2023-26101](https://cve.now/CVE-2023-26101.md): In Progress Flowmon Packet Investigator before 12.1.0, a Flowmon user with access to Flowmon Packet Investigator could leverage a path-trave (CVSS 7.5)
- [CVE-2023-26556](https://cve.now/CVE-2023-26556.md): io.finnet tss-lib before 2.0.0 can leak a secret key via a timing side-channel attack because it relies on the scalar-multiplication impleme (CVSS 9.1, github.com/bnb-chain/tss-lib · github.com/binance-chain/tss…)
- [CVE-2023-26557](https://cve.now/CVE-2023-26557.md): io.finnet tss-lib before 2.0.0 can leak the lambda value of a private key via a timing side-channel attack because it relies on Go big.Int, (CVSS 7.5, github.com/bnb-chain/tss-lib · github.com/binance-chain/tss…)
- [CVE-2023-26876](https://cve.now/CVE-2023-26876.md): SQL injection vulnerability found in Piwigo v.13.5.0 and before allows a remote attacker to execute arbitrary code via the filter\_user\_id pa (CVSS 8.8)
- [CVE-2023-29575](https://cve.now/CVE-2023-29575.md): Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42aac component. (CVSS 5.5)
- [CVE-2023-29905](https://cve.now/CVE-2023-29905.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateSnat interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29906](https://cve.now/CVE-2023-29906.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit\_BasicSSID interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29907](https://cve.now/CVE-2023-29907.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the Edit\_BasicSSID\_5G interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29908](https://cve.now/CVE-2023-29908.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetMobileAPInfoById interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29909](https://cve.now/CVE-2023-29909.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddWlanMacList interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29910](https://cve.now/CVE-2023-29910.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateMacClone interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29911](https://cve.now/CVE-2023-29911.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the AddMacList interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29912](https://cve.now/CVE-2023-29912.md): H3C Magic R200 R200V100R004 was discovered to contain a stack overflow via the DelvsList interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29913](https://cve.now/CVE-2023-29913.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the SetAPWifiorLedInfoById interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29914](https://cve.now/CVE-2023-29914.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the DeltriggerList interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29915](https://cve.now/CVE-2023-29915.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via CMD parameter at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29916](https://cve.now/CVE-2023-29916.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via the UpdateWanParams interface at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29917](https://cve.now/CVE-2023-29917.md): H3C Magic R200 version R200V100R004 was discovered to contain a stack overflow via go parameter at /goform/aspForm. (CVSS 4.9)
- [CVE-2023-29924](https://cve.now/CVE-2023-29924.md): PowerJob V4.3.1 is vulnerable to Incorrect Access Control that allows for remote code execution. (CVSS 9.8, tech.powerjob:powerjob)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.