CVEs published April 27, 2023
71 CVEs were published on April 27, 2023: 9 critical, 27 high.
- Published
- 71
- Critical
- 9
- High
- 27
- Medium
- 32
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 27
Most affected products
- pimcore/pimcore
- 11
- SourceCodester Service Provider Management System
- 7
- mySCADA Technologies mySCADA myPRO
- 5
- pimcore · pimcore/pimcore
- 4
- aEnrich a+HRD
- 2
- Serenity.Net.Core · Serenity.Net.Web
- 2
- Zyxel DX5401-B0 firmware
- 2
- 42Gears Surelock Windows
- 1
- 42gears surelock windows
- 1
- Acronis Snap Deploy
- 1
Critical 9
- CVE-2023-1967CVE-2023-1967Keysight N8844A Data Analytics Web Service
- CVE-2023-2158Impersonation through User-Controlled TokenSynopsys Code Dx
- CVE-2023-1778Default Credential Vulnerability in GajShield Data Security FirewallGajShield Data Security Firewall
- CVE-2022-47758Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack.
- CVE-2023-20852aEnrich a+HRD - Deserialization of Untrusted DataaEnrich a+HRD
- CVE-2023-20853aEnrich a+HRD - Deserialization of Untrusted DataaEnrich a+HRD
- CVE-2023-28697Moxa MiiNePort E1 - Broken Access ControlMoxa MiiNePort E1
- CVE-2023-28769The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5.Zyxel DX5401-B0 firmware
- CVE-2023-30349JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function.com.jflyfox:jflyfox_jfinal
High 27
- CVE-2023-28400CVE-2023-28400mySCADA Technologies mySCADA myPRO
- CVE-2023-28716CVE-2023-28716mySCADA Technologies mySCADA myPRO
- CVE-2023-28384CVE-2023-28384mySCADA Technologies mySCADA myPRO
- CVE-2023-29169CVE-2023-29169mySCADA Technologies mySCADA myPRO
- CVE-2023-29150CVE-2023-29150mySCADA Technologies mySCADA myPRO
- CVE-2023-21712Windows Point-to-Point Tunneling Protocol Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2023-30850Pimcore SQL Injection Vulnerability in Admin Translations APIpimcore · pimcore/pimcore
- CVE-2023-30849Pimcore vulnerable to SQL Injection in Translation Export APIpimcore · pimcore/pimcore
- CVE-2023-30848Pimcore SQL Injection Vulnerability in Admin Search Find APIpimcore · pimcore/pimcore
- CVE-2023-30847H2O vulnerable to read from uninitialized pointer in the reverse proxy handlerh2o
- CVE-2023-30444IBM Watson Machine Learning on Cloud Pak for Data server-side request forgeryIBM Watson Machine Learning on Cloud Pak for Data
- CVE-2023-29255IBM DB2 for Linux, UNIX and Windows denial of serviceIBM DB2 for Linux, UNIX and Windows
- CVE-2023-2331Bypassing hardening via Unquoted Service path vulnerability42Gears Surelock Windows
- CVE-2022-31647Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in t
- CVE-2022-34292Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2
- CVE-2022-37326Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start
- CVE-2023-2338 SQL Injection in pimcore/pimcorepimcore/pimcore
- CVE-2023-2341Cross-site Scripting (XSS) - Generic in pimcore/pimcorepimcore/pimcore
- CVE-2023-24836SUNNET CTMS - Path TraversalSUNNET CTMS
- CVE-2023-25437An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive inf
- CVE-2023-26243An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214.
- CVE-2023-26244An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214.
- CVE-2023-26245An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214.
- CVE-2023-26246An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214.
- CVE-2023-28770The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior toZyxel DX5401-B0 firmware
- CVE-2023-30380An issue in the component /dialog/select_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal.
- CVE-2023-31287An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0.Serenity.Net.Core · Serenity.Net.Web
Medium, low and unrated 35
- CVE-2023-27860IBM Maximo Asset Management information disclosureIBM Maximo Asset Management
- CVE-2023-2355Local privilege escalation due to a DLL hijacking vulnerability.Acronis Snap Deploy
- CVE-2023-28286Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2023-28261Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge (Chromium-based) Extended Stable · Microsoft…
- CVE-2023-2335Plaintext Password in Registry42gears surelock windows
- CVE-2023-30624Wasmtime has Undefined Behavior in Rust runtime functionsbytecodealliance wasmtime · wasmtime
- CVE-2023-30852Pimcore Arbitrary File Read in Admin JS CSS filespimcore · pimcore/pimcore
- CVE-2023-2350SourceCodester Service Provider Management System Users.php cross site scriptingSourceCodester Service Provider Management System
- CVE-2023-2349SourceCodester Service Provider Management System index.php cross site scriptingSourceCodester Service Provider Management System
- CVE-2023-2348SourceCodester Service Provider Management System manage_user.php sql injectionSourceCodester Service Provider Management System
- CVE-2023-2347SourceCodester Service Provider Management System manage_service.php sql injectionSourceCodester Service Provider Management System
- CVE-2023-2346SourceCodester Service Provider Management System view_inquiry.php sql injectionSourceCodester Service Provider Management System
- CVE-2023-2345SourceCodester Service Provider Management System improper authorizationSourceCodester Service Provider Management System
- CVE-2023-2344SourceCodester Service Provider Management System HTTP POST Request sql injectionSourceCodester Service Provider Management System
- CVE-2023-24966IBM WebSphere Application Server cross-site scriptingIBM WebSphere Application Server
- CVE-2022-25091Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenti
- CVE-2022-38730Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by cont
- CVE-2023-22901ChangingTec MOTP - Path TraversalChangingTec MOTP
- CVE-2023-2322Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-2323Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-2327Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-2328Cross-site Scripting (XSS) - Generic in pimcore/pimcorepimcore/pimcore
- CVE-2023-2336Path Traversal in pimcore/pimcorepimcore/pimcore
- CVE-2023-2339Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore
- CVE-2023-2340Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-2342Cross-site Scripting (XSS) - Reflected in pimcore/pimcorepimcore/pimcore
- CVE-2023-2343Cross-site Scripting (XSS) - DOM in pimcore/pimcorepimcore/pimcore
- CVE-2023-25292Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain se
- CVE-2023-29471Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain clearcom.typesafe.akka:akka-stream-kafka_3 · com.typesafe.akk… +2
- CVE-2023-29489An issue was discovered in cPanel before 11.109.9999.116.
- CVE-2023-29950swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs_fillstyle at modules/swftools.c
- CVE-2023-30338Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via
- CVE-2023-31285An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0.Serenity.Net.Core · Serenity.Net.Services
- CVE-2023-31286An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0.Serenity.Net.Core · Serenity.Net.Web
- CVE-2023-31290Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 3