CVEs published April 26, 2023
56 CVEs were published on April 26, 2023: 10 critical, 20 high.
- Published
- 56
- Critical
- 10
- High
- 20
- Medium
- 23
- Low
- 2
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- Drupal Core · drupal/core
- 7
- HCL Software Workload Automation
- 2
- IBM Db2 for Linux, UNIX and Windows
- 2
- silverstripe-framework · silverstripe/framework
- 2
- Acronis Agent
- 1
- builderio/qwik · @builder.io/qwik-city
- 1
- Canonical cloud-init
- 1
- contiki-ng
- 1
- cozmoslabs User Profile Builder – Beautiful User Registrati…
- 1
- GoogleCloudPlatform esp-v2
- 1
Critical 10
- CVE-2023-2297Profile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanismcozmoslabs User Profile Builder – Beautiful User Registrati…
- CVE-2023-30846typed-rest-client vulnerable to potential leak of authentication data to 3rd partiesmicrosoft typed-rest-client · typed-rest-client
- CVE-2023-30546Contiki-NG has off-by-one error in Antelope DBMScontiki-ng
- CVE-2023-29268TIBCO Spotfire Statistics Services Unrestricted File Upload VulnerabilityTIBCO Software TIBCO Spotfire Statistics Services
- CVE-2020-36070Insecure Permission vulnerability found in Yoyager v.1.4 and before allows a remote attacker to execute arbitrary code via a crafted .php fitcg/voyager
- CVE-2022-39989An issue was discovered in Fighting Cock Information System 1.0, which uses default credentials, but does not force nor prompt the administr
- CVE-2023-24796Password vulnerability found in Vinga WR-AC1200 81.102.1.4370 and before allows a remote attacker to execute arbitrary code via the password
- CVE-2023-30211OURPHP <= 7.2.0 is vulnerable to SQL Injection.
- CVE-2023-30280Buffer Overflow vulnerability found in Netgear R6900 v.1.0.2.26, R6700v3 v.1.0.4.128, R6700 v.1.0.0.26 allows a remote attacker to execute a
- CVE-2023-30363vConsole v3.15.0 was discovered to contain a prototype pollution due to incorrect key and value resolution in setOptions in core.ts.vconsole
High 20
- CVE-2023-30845ESPv2 vulnerable to JWT authentication bypass via `X-HTTP-Method-Override` headerGoogleCloudPlatform esp-v2
- CVE-2023-30843Payload's hidden fields can be leaked on readable collectionspayloadcms payload · payload
- CVE-2023-28008HCL Workload Automation is vulnerable to XML External Entity (XXE) InjectionHCL Software Workload Automation
- CVE-2023-29257IBM Db2 code executionIBM Db2 for Linux, UNIX and Windows
- CVE-2023-26286IBM AIX privilege escalationIBM AIX
- CVE-2022-36769IBM Cloud Pak for Data file uploadIBM Cloud Pak for Data
- CVE-2022-41739IBM Spectrum Scale privilege escalationIBM Spectrum Scale Container Native Storage Access
- CVE-2022-25273Drupal core's form API has a vulnerability where certain contributed or custom modules' forms may be vulnerable to improper input validationDrupal Core · drupal/core
- CVE-2022-25275In some situations, the Image module does not correctly check access to image files not stored in the standard public files directory when gDrupal Core · drupal/core
- CVE-2022-25277Drupal core sanitizes filenames with dangerous extensions upon upload (reference: SA-CORE-2020-012) and strips leading and trailing dots froDrupal Core · drupal/core
- CVE-2022-27978Tooljet v1.6 does not properly handle missing values in the API, allowing attackers to arbitrarily reset passwords via a crafted HTTP reques
- CVE-2022-44232libming 0.4.8 0.4.8 is vulnerable to Buffer Overflow.
- CVE-2023-2291Static credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP) build 4309, ManageEngine Password Manager ProZoho ManageEngine Multiple Products
- CVE-2023-26567Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS, AMPMGRUSER, and AMPMGRPASS in the list of glo
- CVE-2023-27107Incorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch 32 and Central Server before 8.2 Patch 22 a
- CVE-2023-29596Buffer Overflow vulnerability found in ByronKnoll Cmix v.19 allows an attacker to execute arbitrary code and cause a denial of service via t
- CVE-2023-29835Insecure Permission vulnerability found in Wondershare Dr.Fone v.12.9.6 allows a remote attacker to escalate privileges via the service perm
- CVE-2023-30112Medicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection.
- CVE-2023-30266CLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type.
- CVE-2023-30269CLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template.php.
Medium, low and unrated 26
- CVE-2023-1786sensitive data exposure in cloud-init logsCanonical cloud-init
- CVE-2022-45876CVE-2022-45876VISAM VBASE
- CVE-2022-45456Denial of service due to unauthenticated API endpoint.Acronis Agent
- CVE-2023-28009HCL Workload Automation is vulnerable to XML External Entity (XXE) InjectionHCL Software Workload Automation
- CVE-2023-27559IBM Db2 denial of serviceIBM Db2 for Linux, UNIX and Windows
- CVE-2023-30841Ironic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMapsmetal3-io baremetal-operator · github.com/metal3-io/baremet…
- CVE-2023-0458Spectre V1 Gadget in do_prlimit in the Linux KernelLinux Kernel
- CVE-2023-22729Silverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen silverstripe-framework · silverstripe/framework
- CVE-2023-22728Silverstripe Framework has missing permission check of canView in GridFieldPrintButtonsilverstripe-framework · silverstripe/framework
- CVE-2023-1387Grafana is an open-source platform for monitoring and observability.Grafana
- CVE-2023-2273Rapid7 Insight Agent Directory TraversalRapid7 Insight Agent
- CVE-2023-2294UCMS Column Configuration saddpost.php cross site scriptingUCMS
- CVE-2022-25274Drupal 9.3 implemented a generic entity access API for entity revisions.Drupal Core · drupal/core
- CVE-2022-25276The Media oEmbed iframe route does not properly validate the iframe domain setting, which allows embeds to be displayed in the context of thDrupal Core · drupal/core
- CVE-2022-25278Under certain circumstances, the Drupal core form API evaluates form element access incorrectly.Drupal Core · drupal/core
- CVE-2022-27979A cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload
- CVE-2023-2307Cross-Site Request Forgery (CSRF) in builderio/qwikbuilderio/qwik · @builder.io/qwik-city
- CVE-2023-26930Buffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of Service via the PDFDoc malloc in the pdftotext.cc
- CVE-2023-29442Zoho ManageEngine Applications Manager before 16400 allows proxy.html DOM XSS.
- CVE-2023-29443Zoho ManageEngine ServiceDesk Plus before 14105, ServiceDesk Plus MSP before 14200, SupportCenter Plus before 14200, and AssetExplorer befor
- CVE-2023-29836Cross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0 allows a remote attacker to execute arbitr
- CVE-2023-30210OURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.
- CVE-2023-30212OURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.
- CVE-2023-30265CLTPHP <=6.0 is vulnerable to Directory Traversal.
- CVE-2023-30267CLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan.php.
- CVE-2023-31250Drupal core - Moderately critical - Access bypass - SA-CORE-2023-005Drupal Core · drupal/core