CVEs published April 24, 2023
113 CVEs were published on April 24, 2023: 26 critical, 33 high. 1 is now in CISA KEV.
- Published
- 113
- Critical
- 26
- High
- 33
- Medium
- 45
- Low
- 3
- Unrated
- 6
- Now in CISA KEV
- 1
- Fix available
- 39
Most affected products
- RIOT-OS RIOT
- 6
- Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +3
- 4
- alfio-event/alf.io
- 3
- CyberPower PowerPanel Business Local / Remote · CyberPower…
- 3
- kiwitcms Kiwi · kiwitcms
- 3
- CERN White Rabbit Switch
- 2
- Kau-Boy Backend Localization Plugin
- 2
- Steveas WP Live Chat Shoutbox
- 2
- WP FEvents Book
- 2
- Zyxel USG FLEX series firmware · Zyxel VPN series firmware
- 2
Critical 26
- CVE-2023-30627jellyfin-web has a stored cross-site scripting vulnerability in devices.jsjellyfin-web
- CVE-2023-1020Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLiSteveas WP Live Chat Shoutbox
- CVE-2023-24823RIOT-OS vulnerable to Packet Type Confusion during IPHC sendRIOT-OS RIOT
- CVE-2023-24819RIOT-OS vulnerable to Buffer Overflow during IPHC receiveRIOT-OS RIOT
- CVE-2023-22577White Rabbit Switch - Password Disclosure VulnerabilityCERN White Rabbit Switch
- CVE-2023-22581White Rabbit Switch - Unauthenticated remote code executionCERN White Rabbit Switch
- CVE-2023-2259Improper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.ioalfio-event/alf.io
- CVE-2023-25131Use of default password vulnerability in CyberPower PowerPanel BusinessCyberPower PowerPanel Business Local / Remote · CyberPower…
- CVE-2023-25132Unrestricted upload of file with dangerous type vulnerability in CyberPower PowerPanel BusinessCyberPower PowerPanel Business Local / Remote · CyberPower…
- CVE-2023-25133Improper privilege management vulnerability in CyberPower PowerPanel BusinessCyberPower PowerPanel Business Local / Remote · CyberPower…
- CVE-2023-26865SQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote attacker to gain privileges via the BdroppyCro
- CVE-2023-27848broccoli-compass v0.2.4 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.broccoli-compass
- CVE-2023-27849rails-routes-to-json v1.0.0 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
- CVE-2023-28131A vulnerability in the expo.io framework allows an attacker to take over accounts and steal credentials on an application/website that confiExpo.io Expo AuthSession module · expo
- CVE-2023-29566huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability vdawnsparks-node-tesseract
- CVE-2023-30368Tenda AC5 V15.03.06.28 is vulnerable to Buffer Overflow via the initWebs function.
- CVE-2023-30369Tenda AC15 V15.03.05.19 is vulnerable to Buffer Overflow.
- CVE-2023-30370In Tenda AC15 V15.03.05.19, the function GetValue contains a stack-based buffer overflow vulnerability.
- CVE-2023-30371In Tenda AC15 V15.03.05.19, the function "sub_ED14" contains a stack-based buffer overflow vulnerability.
- CVE-2023-30372In Tenda AC15 V15.03.05.19, The function "xkjs_ver32" contains a stack-based buffer overflow vulnerability.
- CVE-2023-30373In Tenda AC15 V15.03.05.19, the function "xian_pppoe_user" contains a stack-based buffer overflow vulnerability.
- CVE-2023-30375In Tenda AC15 V15.03.05.19, the function "getIfIp" contains a stack-based buffer overflow vulnerability.
- CVE-2023-30376In Tenda AC15 V15.03.05.19, the function "henan_pppoe_user" contains a stack-based buffer overflow vulnerability.
- CVE-2023-30378In Tenda AC15 V15.03.05.19, the function "sub_8EE8" contains a stack-based buffer overflow vulnerability.
- CVE-2023-31056CloverDX before 5.17.3 writes passwords to the audit log in certain situations, if the audit log is enabled and single sign-on is not employ
- CVE-2023-31060Repetier Server through 1.4.10 executes as SYSTEM.
High 33
- CVE-2023-30629Vyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success valuevyperlang vyper · vyper
- CVE-2023-30628Kiwi TCMS has command injection vulnerability in changelog.yml CI workflowkiwitcms Kiwi · kiwitcms
- CVE-2023-30623Arbitrary command injection in embano1/wip embano1 wip
- CVE-2023-30626Jellyfin vulnerable to directory traversal and file write causing arbitrary code executionjellyfin · Jellyfin.Controller
- CVE-2023-29530Laminas Diactoros vulnerable to HTTP Multiline Header Terminationlaminas-diactoros · laminas/laminas-diactoros
- CVE-2023-0388Random Text <= 0.3.0 - Subscriber+ SQLiRandom Text
- CVE-2023-30613Kiwi TCMS unrestricted file upload vulnerabilitykiwitcms Kiwi · kiwitcms
- CVE-2023-27524Apache Superset: Session validation vulnerability when using provided default SECRET_KEYApache Software Foundation Apache Superset · superset +1
- CVE-2023-24822RIOT-OS vulnerable to Null Pointer dereference during IPHC encodingRIOT-OS RIOT
- CVE-2023-24821RIOT-OS vulnerable to Integer Underflow during defragmentationRIOT-OS RIOT
- CVE-2023-24820RIOT-OS vulnerable to Integer Underflow during IPHC receiveRIOT-OS RIOT
- CVE-2023-24818RIOT-OS vulnerable to null pointer dereference during fragment forwardingRIOT-OS RIOT
- CVE-2022-45084WordPress Loginizer Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)Softaculous Loginizer
- CVE-2023-1731Improper Input Validation in Meinberg LTOSMeinberg LTOS
- CVE-2022-48476In JetBrains Ktor before 2.3.0 path traversal in the `resolveResource` method was possible JetBrains Ktor
- CVE-2023-2006A race condition was found in the Linux kernel's RxRPC network protocol, within the processing of RxRPC bundles.Linux kernel's RxRPC network protocol
- CVE-2023-2251Uncaught Exception in eemeli/yamleemeli/yaml · yaml
- CVE-2023-2258Improper Neutralization of Formula Elements in a CSV File in alfio-event/alf.ioalfio-event/alf.io
- CVE-2023-2260Authorization Bypass Through User-Controlled Key in alfio-event/alf.ioalfio-event/alf.io
- CVE-2023-22913A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4Zyxel USG FLEX series firmware · Zyxel VPN series firmware
- CVE-2023-22914A path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN Zyxel USG FLEX series firmware · Zyxel VPN series firmware
- CVE-2023-22915A buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, USG FLZyxel USG FLEX series firmware · Zyxel USG FLEX 50(W) fi… +2
- CVE-2023-22916The configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series firmware versions 5.00 through 5.35, USG FZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +3
- CVE-2023-22917A buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware versions 5.10 through 5.32, USG FLEX series firZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +3
- CVE-2023-26097An issue was discovered in Telindus Apsal 3.14.2022.235 b.
- CVE-2023-27991The post-authentication command injection vulnerability in the CLI command of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEXZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +3
- CVE-2023-29480Ribose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.
- CVE-2023-29578mp4v2 v2.0.0 was discovered to contain a heap buffer overflow via the mp4v2::impl::MP4StringProperty::~MP4StringProperty() function at src/m
- CVE-2023-29780Third Reality Smart Blind 1.00.54 contains a denial-of-service vulnerability, which allows a remote attacker to send malicious Zigbee messag
- CVE-2023-29849Bang Resto 1.0 was discovered to contain multiple SQL injection vulnerabilities via the btnMenuItemID, itemID, itemPrice, menuID, staffID, o
- CVE-2023-30533SheetJS Community Edition before 0.19.3 allows Prototype Pollution via a crafted file.xlsx
- CVE-2023-31059Repetier Server through 1.4.10 allows ..%5c directory traversal for reading files that contain credentials, as demonstrated by connectionLos
- CVE-2023-31061Repetier Server through 1.4.10 does not have CSRF protection.
Medium, low and unrated 54
- CVE-2023-2257Authentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and earlier on Windows and macOS allows an attDevolutions Workspace Desktop
- CVE-2023-1414WP VR < 8.3.0 - Subscriber+ Arbitrary Tour UpdateWP VR
- CVE-2023-1623Custom Post Type UI < 1.13.5 - Debug Info Sending via CSRFCustom Post Type UI
- CVE-2023-0418Video Central for WordPress <= 1.3.0 - Contributor+ Stored XSSVideo Central for WordPress
- CVE-2023-1435Ajax Search Lite Pro < 4.26.2 - Multiple Reflected Cross-Site ScriptingAjax Search Pro
- CVE-2023-0424MS-Reviews <= 1.5 - Subscriber+ Stored XSSMS-Reviews
- CVE-2023-1624WPCode Lite < 2.0.9 - Arbitrary Log File Deletion via CSRFWPCode
- CVE-2023-1126WP FEvents Book <= 0.46 - Subscriber+ Stored XSSWP FEvents Book
- CVE-2023-1324Easy Forms for MailChimp < 6.8.8 - Reflected XSSEasy Forms for Mailchimp
- CVE-2023-0276Weaver Xtreme Theme Support < 6.2.7 - Contributor+ Stored XSSWeaver Xtreme Theme Support
- CVE-2023-1129WP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDORWP FEvents Book
- CVE-2023-0899Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated Stored XSSSteveas WP Live Chat Shoutbox
- CVE-2023-1420Ajax Search Lite < 4.11.1, Pro < 4.26.2 - Reflected Cross-Site ScriptingAjax Search Lite · Ajax Search Pro
- CVE-2023-0420Custom Post Type and Taxonomy GUI Manager <= 1.1 - Stored XSS via CSRFCustom Post Type and Taxonomy GUI Manager
- CVE-2012-10014Kau-Boy Backend Localization Plugin backend_localization.php localize_backend cross site scriptingKau-Boy Backend Localization Plugin
- CVE-2012-10013Kau-Boy Backend Localization Plugin backend_localization.php cross site scriptingKau-Boy Backend Localization Plugin
- CVE-2022-41612WordPress Similar Posts Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)Shareaholic Similar Posts
- CVE-2023-30544Kiwi TCMS may allow user to update email address to unverified onekiwitcms Kiwi · kiwitcms
- CVE-2023-26494lorawan-stack has open redirect vulnerabilityTheThingsNetwork lorawan-stack · go.thethings.network/lo… +1
- CVE-2023-30622Clusternet has potential risk which can be leveraged to make a cluster-level privilege escalationclusternet · github.com/clusternet/clusternet
- CVE-2023-30776Apache Superset: Database connection password leakApache Software Foundation Apache Superset · apache-superset
- CVE-2022-47598WordPress WP Super Popup Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)WP Plugins Pro WP Super Popup
- CVE-2022-47158WordPress alfred24 Click & Collect Plugin <= 1.1.7 is vulnerable to Cross Site Scripting (XSS)Pakpobox alfred24 Click & Collect
- CVE-2023-23892WordPress M Chart Plugin <= 1.9.4 is vulnerable to Cross Site Scripting (XSS)Jamie Poitra M Chart
- CVE-2022-48477In JetBrains Hub before 2023.1.15725 SSRF protection in Auth Module integration was missing JetBrains Hub
- CVE-2022-28354In the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable to XSS when setting a time period.
- CVE-2023-2007The specific flaw exists within the DPT I2O Controller driver.Linux kernel's DPT I2O Controller driver
- CVE-2023-2019A flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events.Linux kernel's netdevsim device driver
- CVE-2023-2250A flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes which has the cluster-manager-registrationMCE
- CVE-2023-22918A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEZyxel ATP series firmware · Zyxel USG FLEX series firmwa… +6
- CVE-2023-26059An issue was discovered in Nokia NetAct before 22 SP1037.
- CVE-2023-26060An issue was discovered in Nokia NetAct before 22 FP2211.
- CVE-2023-26061An issue was discovered in Nokia NetAct before 22 FP2211.
- CVE-2023-26099An issue was discovered in Telindus Apsal 3.14.2022.235 b.
- CVE-2023-27990The cross-site scripting (XSS) vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series firmware versions 4.50Zyxel ATP series firmware · Zyxel USG FLEX series firmwa… +3
- CVE-2023-28484In libxml2 before 2.10.4, parsing of certain invalid XSD schemas can lead to a NULL pointer dereference and subsequently a segfault.
- CVE-2023-29469An issue was discovered in libxml2 before 2.10.4.
- CVE-2023-29479Ribose RNP before 0.16.3 may hang when the input is malformed.
- CVE-2023-29570Cesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via mjs_ffi_cb_free at src/mjs_ffi.c.
- CVE-2023-29579yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the component yasm/yasm+0x43b466 in vsprintf.
- CVE-2023-29582yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr1 at /nasm/nasm-parse.c.
- CVE-2023-29583yasm 1.3.0.55.g101bc was discovered to contain a stack overflow via the function parse_expr5 at /nasm/nasm-parse.c.
- CVE-2023-29848Bang Resto 1.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via the itemName parameter in the admin/menu.php
- CVE-2023-30406Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component ecma_find_named_property at /base/ecma-helpe
- CVE-2023-30408Jerryscript commit 1a2c047 was discovered to contain a segmentation violation via the component build/bin/jerry.
- CVE-2023-30410Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component ecma_op_function_construct at /operations/ecma-funct
- CVE-2023-30414Jerryscript commit 1a2c047 was discovered to contain a stack overflow via the component vm_loop at /jerry-core/vm/vm.c.
- CVE-2023-30458A username enumeration issue was discovered in Medicine Tracker System 1.0.
- CVE-2023-31045A stored Cross-site scripting (XSS) issue in Text Editors and Formats in Backdrop CMS before 1.24.2 allows remote attackers to inject arbitrbackdrop/backdrop
- CVE-2023-31081An issue was discovered in drivers/media/test-drivers/vidtv/vidtv_bridge.c in the Linux kernel 6.2.
- CVE-2023-31082An issue was discovered in drivers/tty/n_gsm.c in the Linux kernel 6.2.
- CVE-2023-31083An issue was discovered in drivers/bluetooth/hci_ldisc.c in the Linux kernel 6.2.
- CVE-2023-31084An issue was discovered in drivers/media/dvb-core/dvb_frontend.c in the Linux kernel 6.2.
- CVE-2023-31085An issue was discovered in drivers/mtd/ubi/cdev.c in the Linux kernel 6.2.