# CVEs published 2023-04-27

71 CVEs were published on April 27, 2023: 9 critical, 27 high. Days are UTC.

- [CVE-2023-28400](https://cve.now/CVE-2023-28400.md): CVE-2023-28400 (CVSS 8.8, mySCADA Technologies mySCADA myPRO)
- [CVE-2023-28716](https://cve.now/CVE-2023-28716.md): CVE-2023-28716 (CVSS 8.8, mySCADA Technologies mySCADA myPRO)
- [CVE-2023-28384](https://cve.now/CVE-2023-28384.md): CVE-2023-28384 (CVSS 8.8, mySCADA Technologies mySCADA myPRO)
- [CVE-2023-29169](https://cve.now/CVE-2023-29169.md): CVE-2023-29169 (CVSS 8.8, mySCADA Technologies mySCADA myPRO)
- [CVE-2023-29150](https://cve.now/CVE-2023-29150.md): CVE-2023-29150 (CVSS 8.8, mySCADA Technologies mySCADA myPRO)
- [CVE-2023-1967](https://cve.now/CVE-2023-1967.md): CVE-2023-1967 (CVSS 9.8, Keysight N8844A Data Analytics Web Service)
- [CVE-2023-27860](https://cve.now/CVE-2023-27860.md): IBM Maximo Asset Management information disclosure (CVSS 5.3, IBM Maximo Asset Management)
- [CVE-2023-21712](https://cve.now/CVE-2023-21712.md): Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-2355](https://cve.now/CVE-2023-2355.md): Local privilege escalation due to a DLL hijacking vulnerability. (CVSS 6.7, Acronis Snap Deploy)
- [CVE-2023-28286](https://cve.now/CVE-2023-28286.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 6.1, Microsoft Edge)
- [CVE-2023-28261](https://cve.now/CVE-2023-28261.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 5.7, Microsoft Edge (Chromium-based) Extended Stable · Microsoft…)
- [CVE-2023-2335](https://cve.now/CVE-2023-2335.md): Plaintext Password in Registry (CVSS 6.5, 42gears surelock windows)
- [CVE-2023-2158](https://cve.now/CVE-2023-2158.md): Impersonation through User-Controlled Token (CVSS 9.8, Synopsys Code Dx)
- [CVE-2023-30624](https://cve.now/CVE-2023-30624.md): Wasmtime has Undefined Behavior in Rust runtime functions (CVSS 3.9, bytecodealliance wasmtime · wasmtime)
- [CVE-2023-30852](https://cve.now/CVE-2023-30852.md): Pimcore Arbitrary File Read in Admin JS CSS files (CVSS 4.4, pimcore · pimcore/pimcore)
- [CVE-2023-30850](https://cve.now/CVE-2023-30850.md): Pimcore SQL Injection Vulnerability in Admin Translations API (CVSS 8.8, pimcore · pimcore/pimcore)
- [CVE-2023-30849](https://cve.now/CVE-2023-30849.md): Pimcore vulnerable to SQL Injection in Translation Export API (CVSS 8.8, pimcore · pimcore/pimcore)
- [CVE-2023-2350](https://cve.now/CVE-2023-2350.md): SourceCodester Service Provider Management System Users.php cross site scripting (CVSS 3.5, SourceCodester Service Provider Management System)
- [CVE-2023-30848](https://cve.now/CVE-2023-30848.md): Pimcore SQL Injection Vulnerability in Admin Search Find API (CVSS 8.8, pimcore · pimcore/pimcore)
- [CVE-2023-2349](https://cve.now/CVE-2023-2349.md): SourceCodester Service Provider Management System index.php cross site scripting (CVSS 3.5, SourceCodester Service Provider Management System)
- [CVE-2023-2348](https://cve.now/CVE-2023-2348.md): SourceCodester Service Provider Management System manage\_user.php sql injection (CVSS 6.3, SourceCodester Service Provider Management System)
- [CVE-2023-2347](https://cve.now/CVE-2023-2347.md): SourceCodester Service Provider Management System manage\_service.php sql injection (CVSS 6.3, SourceCodester Service Provider Management System)
- [CVE-2023-2346](https://cve.now/CVE-2023-2346.md): SourceCodester Service Provider Management System view\_inquiry.php sql injection (CVSS 6.3, SourceCodester Service Provider Management System)
- [CVE-2023-30847](https://cve.now/CVE-2023-30847.md): H2O vulnerable to read from uninitialized pointer in the reverse proxy handler (CVSS 8.2, h2o)
- [CVE-2023-2345](https://cve.now/CVE-2023-2345.md): SourceCodester Service Provider Management System improper authorization (CVSS 6.3, SourceCodester Service Provider Management System)
- [CVE-2023-2344](https://cve.now/CVE-2023-2344.md): SourceCodester Service Provider Management System HTTP POST Request sql injection (CVSS 6.3, SourceCodester Service Provider Management System)
- [CVE-2023-24966](https://cve.now/CVE-2023-24966.md): IBM WebSphere Application Server cross-site scripting (CVSS 6.1, IBM WebSphere Application Server)
- [CVE-2023-30444](https://cve.now/CVE-2023-30444.md): IBM Watson Machine Learning on Cloud Pak for Data server-side request forgery (CVSS 7.1, IBM Watson Machine Learning on Cloud Pak for Data)
- [CVE-2023-29255](https://cve.now/CVE-2023-29255.md): IBM DB2 for Linux, UNIX and Windows denial of service (CVSS 7.5, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2023-2331](https://cve.now/CVE-2023-2331.md): Bypassing hardening via Unquoted Service path vulnerability (CVSS 7.8, 42Gears Surelock Windows)
- [CVE-2023-1778](https://cve.now/CVE-2023-1778.md): Default Credential Vulnerability in GajShield Data Security Firewall (CVSS 10.0, GajShield Data Security Firewall)
- [CVE-2022-25091](https://cve.now/CVE-2022-25091.md): Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenti (CVSS 5.3)
- [CVE-2022-31647](https://cve.now/CVE-2022-31647.md): Docker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv/destroy dockerBackendV2 API via a symlink in t (CVSS 7.1)
- [CVE-2022-34292](https://cve.now/CVE-2022-34292.md): Docker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink attack on the hyperv/create dockerBackendV2 (CVSS 7.1)
- [CVE-2022-37326](https://cve.now/CVE-2022-37326.md): Docker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through the dockerBackendV2 windowscontainers/start (CVSS 7.8)
- [CVE-2022-38730](https://cve.now/CVE-2022-38730.md): Docker Desktop for Windows before 4.6 allows attackers to overwrite any file through the windowscontainers/start dockerBackendV2 API by cont (CVSS 6.3)
- [CVE-2022-47758](https://cve.now/CVE-2022-47758.md): Nanoleaf firmware v7.1.1 and below is missing TLS verification, allowing attackers to execute arbitrary code via a DNS hijacking attack. (CVSS 9.8)
- [CVE-2023-20852](https://cve.now/CVE-2023-20852.md): aEnrich a+HRD - Deserialization of Untrusted Data (CVSS 9.8, aEnrich a+HRD)
- [CVE-2023-20853](https://cve.now/CVE-2023-20853.md): aEnrich a+HRD - Deserialization of Untrusted Data (CVSS 9.8, aEnrich a+HRD)
- [CVE-2023-22901](https://cve.now/CVE-2023-22901.md): ChangingTec MOTP - Path Traversal (CVSS 4.9, ChangingTec MOTP)
- [CVE-2023-2322](https://cve.now/CVE-2023-2322.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 5.2, pimcore/pimcore)
- [CVE-2023-2323](https://cve.now/CVE-2023-2323.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.8, pimcore/pimcore)
- [CVE-2023-2327](https://cve.now/CVE-2023-2327.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 4.0, pimcore/pimcore)
- [CVE-2023-2328](https://cve.now/CVE-2023-2328.md): Cross-site Scripting (XSS) - Generic in pimcore/pimcore (CVSS 5.2, pimcore/pimcore)
- [CVE-2023-2336](https://cve.now/CVE-2023-2336.md): Path Traversal in pimcore/pimcore (CVSS 5.5, pimcore/pimcore)
- [CVE-2023-2338](https://cve.now/CVE-2023-2338.md): SQL Injection in pimcore/pimcore (CVSS 7.2, pimcore/pimcore)
- [CVE-2023-2339](https://cve.now/CVE-2023-2339.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 6.1, pimcore/pimcore)
- [CVE-2023-2340](https://cve.now/CVE-2023-2340.md): Cross-site Scripting (XSS) - Stored in pimcore/pimcore (CVSS 6.1, pimcore/pimcore)
- [CVE-2023-2341](https://cve.now/CVE-2023-2341.md): Cross-site Scripting (XSS) - Generic in pimcore/pimcore (CVSS 7.3, pimcore/pimcore)
- [CVE-2023-2342](https://cve.now/CVE-2023-2342.md): Cross-site Scripting (XSS) - Reflected in pimcore/pimcore (CVSS 4.0, pimcore/pimcore)
- [CVE-2023-2343](https://cve.now/CVE-2023-2343.md): Cross-site Scripting (XSS) - DOM in pimcore/pimcore (CVSS 5.2, pimcore/pimcore)
- [CVE-2023-24836](https://cve.now/CVE-2023-24836.md): SUNNET CTMS - Path Traversal (CVSS 8.8, SUNNET CTMS)
- [CVE-2023-25292](https://cve.now/CVE-2023-25292.md): Reflected Cross Site Scripting (XSS) in Intermesh BV Group-Office version 6.6.145, allows attackers to gain escalated privileges and gain se (CVSS 6.1)
- [CVE-2023-25437](https://cve.now/CVE-2023-25437.md): An issue was discovered in vTech VCS754 version 1.1.1.A before 1.1.1.H, allows attackers to gain escalated privileges and gain sensitive inf (CVSS 8.8)
- [CVE-2023-26243](https://cve.now/CVE-2023-26243.md): An issue was discovered in the Hyundai Gen5W\_L in-vehicle infotainment system AE\_E\_PE\_EUR.S5W\_L001.001.211214. (CVSS 7.8)
- [CVE-2023-26244](https://cve.now/CVE-2023-26244.md): An issue was discovered in the Hyundai Gen5W\_L in-vehicle infotainment system AE\_E\_PE\_EUR.S5W\_L001.001.211214. (CVSS 7.8)
- [CVE-2023-26245](https://cve.now/CVE-2023-26245.md): An issue was discovered in the Hyundai Gen5W\_L in-vehicle infotainment system AE\_E\_PE\_EUR.S5W\_L001.001.211214. (CVSS 7.8)
- [CVE-2023-26246](https://cve.now/CVE-2023-26246.md): An issue was discovered in the Hyundai Gen5W\_L in-vehicle infotainment system AE\_E\_PE\_EUR.S5W\_L001.001.211214. (CVSS 7.8)
- [CVE-2023-28697](https://cve.now/CVE-2023-28697.md): Moxa MiiNePort E1 - Broken Access Control (CVSS 9.8, Moxa MiiNePort E1)
- [CVE-2023-28769](https://cve.now/CVE-2023-28769.md): The buffer overflow vulnerability in the library “libclinkc.so” of the web server “zhttpd” in Zyxel DX5401-B0 firmware versions prior to V5. (CVSS 9.8, Zyxel DX5401-B0 firmware)
- [CVE-2023-28770](https://cve.now/CVE-2023-28770.md): The sensitive information exposure vulnerability in the CGI “Export\_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to (CVSS 7.5, Zyxel DX5401-B0 firmware)
- [CVE-2023-29471](https://cve.now/CVE-2023-29471.md): Lightbend Alpakka Kafka before 5.0.0 logs its configuration as debug information, and thus log files may contain credentials (if plain clear (CVSS 5.5, com.typesafe.akka:akka-stream-kafka\_3 · com.typesafe.akk… +2)
- [CVE-2023-29489](https://cve.now/CVE-2023-29489.md): An issue was discovered in cPanel before 11.109.9999.116. (CVSS 5.3)
- [CVE-2023-29950](https://cve.now/CVE-2023-29950.md): swfrender v0.9.2 was discovered to contain a heap buffer overflow in the function enumerateUsedIDs\_fillstyle at modules/swftools.c (CVSS 5.5)
- [CVE-2023-30338](https://cve.now/CVE-2023-30338.md): Multiple stored cross-site scripting (XSS) vulnerabilities in Emlog Pro v2.0.3 allows attackers to execute arbitrary web scripts or HTML via (CVSS 5.4)
- [CVE-2023-30349](https://cve.now/CVE-2023-30349.md): JFinal CMS v5.1.0 was discovered to contain a remote code execution (RCE) vulnerability via the ActionEnter function. (CVSS 9.8, com.jflyfox:jflyfox\_jfinal)
- [CVE-2023-30380](https://cve.now/CVE-2023-30380.md): An issue in the component /dialog/select\_media.php of DedeCMS v5.7.107 allows attackers to execute a directory traversal. (CVSS 7.5)
- [CVE-2023-31285](https://cve.now/CVE-2023-31285.md): An XSS issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. (CVSS 6.1, Serenity.Net.Core · Serenity.Net.Services)
- [CVE-2023-31286](https://cve.now/CVE-2023-31286.md): An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. (CVSS 5.3, Serenity.Net.Core · Serenity.Net.Web)
- [CVE-2023-31287](https://cve.now/CVE-2023-31287.md): An issue was discovered in Serenity Serene (and StartSharp) before 6.7.0. (CVSS 7.8, Serenity.Net.Core · Serenity.Net.Web)
- [CVE-2023-31290](https://cve.now/CVE-2023-31290.md): Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 3 (CVSS 5.9)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-04-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.