CVEs published April 25, 2023
99 CVEs were published on April 25, 2023: 7 critical, 33 high. 2 are now in CISA KEV.
- Published
- 99
- Critical
- 7
- High
- 33
- Medium
- 49
- Low
- 6
- Unrated
- 4
- Now in CISA KEV
- 2
- Fix available
- 27
Most affected products
- Odoo Community · Odoo Enterprise
- 14
- Hewlett Packard Enterprise (HPE) HPE OneView
- 5
- git-for-windows git
- 3
- PrestaShop · prestashop/prestashop
- 3
- VMware Workstation Pro / Player (Workstation) and VMware Fu…
- 3
- git
- 2
- SolarWinds Database Performance Analyzer
- 2
- Apache Software Foundation Apache Jena · org.apache.jena:je…
- 1
- apptainer · github.com/apptainer/apptainer
- 1
- Arista Networks Terminattr
- 1
Critical 7
- CVE-2023-30839PrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager"PrestaShop · prestashop/prestashop
- CVE-2012-5872ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in ARC2_StoreSelectQueryHandler.php via comments in a SP
- CVE-2023-25313OS injection vulnerability in World Wide Broadcast Network AVideo version before 12.4, allows attackers to execute arbitrary code via the viwwbn/avideo
- CVE-2023-27105A vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with Shanling MTouch OS v4.3 and Shanling M2X Portab
- CVE-2023-27843SQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote attacker to gain privileges via the QuotesPro
- CVE-2023-28771Improper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73, VPN series firmware versions 4.60 through 5.Zyxel ZyWALL/USG series firmware · Zyxel VPN series firm… +2
- CVE-2023-30404Aigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code execution (RCE) vulnerability via the sysCmd param
High 33
- CVE-2023-29012Git CMD erroneously executes `doskey.exe` in the current directory, if it existsgit-for-windows git
- CVE-2023-29011Git for Windows's config file of `connect.exe` is susceptible to malicious placinggit-for-windows git
- CVE-2023-29007Arbitrary configuration injection via `git submodule deinit`git
- CVE-2023-25652"git apply --reject" partially-controlled arbitrary file writegit
- CVE-2023-28089An HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect ModulesHewlett Packard Enterprise (HPE) HPE OneView
- CVE-2023-28088An HPE OneView appliance dump may expose SAN switch administrative credentialsHewlett Packard Enterprise (HPE) HPE OneView
- CVE-2021-23203Improper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote attackOdoo Community · Odoo Enterprise
- CVE-2021-44547A sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated administrators to executed arbitrary code, leading tOdoo Community · Odoo Enterprise
- CVE-2021-26263Cross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo Enterprise 14.0 through 15.0, allows remote atOdoo Community · Odoo Enterprise
- CVE-2021-23178Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows attackers to validate online paymentsOdoo Community · Odoo Enterprise
- CVE-2021-23186A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to access andOdoo Community · Odoo Enterprise
- CVE-2021-23166A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read and wOdoo Community · Odoo Enterprise
- CVE-2021-44460Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows users with deactivated accounts to acOdoo Community · Odoo Enterprise
- CVE-2021-45111Improper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows remote authenticated users to triggerOdoo Community · Odoo Enterprise
- CVE-2023-30838PrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML methodPrestaShop · prestashop/prestashop
- CVE-2023-30545PrestaShop arbitrary file read vulnerabilityPrestaShop · prestashop/prestashop
- CVE-2022-45837WordPress 微信机器人高级版 Plugin <= 6.0.1 is vulnerable to Cross Site Scripting (XSS)Denis 微信机器人高级版
- CVE-2022-31244Nokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation.
- CVE-2022-40722Misconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.Ping Identity PingID Adapter for PingFederate · Ping Ide… +1
- CVE-2022-40725PingID Desktop PIN attempt lockout bypass.Ping Identity PingID Desktop for Windows · Ping Identity Pi…
- CVE-2022-45291PWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote code execution by injecting PHP code into
- CVE-2023-20869VMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow vulnerability that exists in the functionality for VMware Workstation Pro / Player (Workstation) and VMware Fu…
- CVE-2023-20871VMware Fusion contains a local privilege escalation vulnerability.VMware Fusion
- CVE-2023-20872VMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD device emulation.VMware Workstation Pro / Player (Workstation) and VMware Fu…
- CVE-2023-23837No Exception Handling Vulnerability: Database Performance Analyzer (DPA) 2023.1SolarWinds Database Performance Analyzer
- CVE-2023-24512On affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch. Arista Networks Terminattr
- CVE-2023-25348ChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and First Name input fields when creating a new pe
- CVE-2023-26098An issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b.
- CVE-2023-26735blackbox_exporter v0.23.0 was discovered to contain an access control issue in its probe interface.
- CVE-2023-29552The Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to register arbitrary services.
- CVE-2023-29779Sengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a remote attacker to send malicious Zigbee messa
- CVE-2023-30549Unpatched extfs vulnerabilities are exploitable through suid-mode Apptainerapptainer · github.com/apptainer/apptainer
- CVE-2023-31223Dradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.
Medium, low and unrated 59
- CVE-2023-0045Incorrect indirect branch prediction barrier in the Linux KernelLinux Kernel
- CVE-2023-2293SourceCodester Purchase Order Management System cross site scriptingSourceCodester Purchase Order Management System
- CVE-2023-30609matrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlightingmatrix-org matrix-react-sdk · matrix-react-sdk
- CVE-2023-25815Git looks for localized messages in the wrong placegit-for-windows git
- CVE-2023-24005WordPress Inline Tweet Sharer – Twitter Sharing Plugin Plugin <= 2.5.3 is vulnerable to Cross Site Scripting (XSS)Winwar Media Inline Tweet Sharer – Twitter Sharing Plugin
- CVE-2023-23710WordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 is vulnerable to Cross Site Scripting (XSS)miniOrange WordPress Social Login and Register
- CVE-2023-23866WordPress Interactive Geo Maps Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)Carlos Moreira Interactive Geo Maps
- CVE-2023-23889WordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS)Fullworks Quick Paypal Payments
- CVE-2023-23995WordPress TinyMCE Custom Styles Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)Tim Reeves & David Stöckl TinyMCE Custom Styles
- CVE-2023-25461WordPress Wp-Insert Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)namithjawahar Wp-Insert
- CVE-2023-28084HPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokensHewlett Packard Enterprise HPE OneView
- CVE-2023-28090An HPE OneView appliance dump may expose SNMPv3 read credentialsHewlett Packard Enterprise (HPE) HPE OneView
- CVE-2023-28087An HPE OneView appliance dump may expose OneView user accountsHewlett Packard Enterprise (HPE) HPE OneView
- CVE-2023-25793WordPress Link Juice Keeper Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)George Pattihis Link Juice Keeper
- CVE-2023-28086An HPE OneView appliance dump may expose proxy credential settingsHewlett Packard Enterprise (HPE) HPE OneView
- CVE-2023-25485WordPress JSON Content Importer Plugin <= 1.3.15 is vulnerable to Cross Site Scripting (XSS)Bernhard Kux JSON Content Importer
- CVE-2021-26947Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbOdoo Community · Odoo Enterprise
- CVE-2021-44465Improper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier allows authenticated attackers to subscribe Odoo Community · Odoo Enterprise
- CVE-2021-44775Cross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attacOdoo Community · Odoo Enterprise
- CVE-2021-44461Cross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows remote attackers who are able to control theOdoo Enterprise
- CVE-2021-44476A sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows authenticated administrators to read localOdoo Community · Odoo Enterprise
- CVE-2021-23176Improper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier alOdoo Community · Odoo Enterprise
- CVE-2021-45071Cross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier, allows remote attackers to inject arbOdoo Community · Odoo Enterprise
- CVE-2023-2282Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authenticDevolutions Remote Desktop Manager
- CVE-2023-29200contao/core-bundle has path traversal vulnerability in the file managercontao · contao/contao
- CVE-2022-47608WordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS)Fullworks Quick Contact Form
- CVE-2023-25484WordPress Simple Yearly Archive Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)Oliver Schlöbe Simple Yearly Archive
- CVE-2023-28847Nextcloud Server missing brute force protection for passwords of password protected share linksnextcloud security-advisories
- CVE-2023-2281Archiving a team broadcasts unsanitized data over WebSocketsMattermost
- CVE-2023-25479WordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)Podlove Subscribe button
- CVE-2023-25490WordPress Archivist – Custom Archive Templates Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)Eric Teubert Archivist – Custom Archive Templates
- CVE-2023-27619WordPress Regina Lite Theme <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)Macho Themes Regina Lite
- CVE-2023-25710WordPress Click to Call or Chat Buttons Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)DIGITALBLUE Click to Call or Chat Buttons
- CVE-2023-22665Apache Jena: Exposure of arbitrary execution in script engine expressions.Apache Software Foundation Apache Jena · org.apache.jena:je…
- CVE-2012-5873ARC (aka ARC2) through 2011-12-01 allows reflected XSS via the end_point.php query parameter in an output=htmltab action.
- CVE-2022-23721PingID integration for Windows login duplicate username collision.
- CVE-2022-40482The authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be vulnerable to user enumeration via timeless timing a
- CVE-2022-40723Configuration-based MFA Bypass in PingID RADIUS PCV.Ping Identity PingID Radius PCV · Ping Identity PingID I… +1
- CVE-2022-40724Cross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.Ping Identity PingFederate
- CVE-2022-42335x86 shadow paging arbitrary pointer dereference In environments where host assisted address translation is necessary but Hardware Assisted Pxen
- CVE-2023-20870VMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the functionality for sharing host Bluetooth deviceVMware Workstation Pro / Player (Workstation) and VMware Fu…
- CVE-2023-2269A denial of service problem was found, due to a possible recursive locking scenario, resulting in a deadlock in table_clear in drivers/md/dmKernel
- CVE-2023-23838Directory traversal and file enumeration vulnerability: Database Performance Analyzer (DPA) 2023.1SolarWinds Database Performance Analyzer
- CVE-2023-23839SolarWinds Platform Exposure of Sensitive Information VulnerabilitySolarWinds Platform
- CVE-2023-25314Cross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4, allows attackers to gain sensitive information
- CVE-2023-25346A reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via t
- CVE-2023-25347A stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to inject arbitrary web script or HTML via inp
- CVE-2023-26057An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the Configuration Dashboard page.
- CVE-2023-26058An XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance Manager page.
- CVE-2023-26560Northern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to leverage the Scheduled Reports feature to read arb
- CVE-2023-26839A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit information for existing people on the site.
- CVE-2023-26840A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a person to a user and set that user to be an
- CVE-2023-26841A cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change any user's password except for the user tha
- CVE-2023-26843A stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to inject arbitrary web script or HTML via the
- CVE-2023-30106Sourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS) via page=about.
- CVE-2023-30111Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-30177CraftCMS 3.7.59 is vulnerable Cross Site Scripting (XSS).craftcms/cms
- CVE-2023-30402YASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm/nasm-token.re.
- CVE-2023-30417A cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to execute arbitrary web scripts or HTML via a c