CVEs published April 28, 2023
111 CVEs were published on April 28, 2023: 11 critical, 30 high.
- Published
- 111
- Critical
- 11
- High
- 30
- Medium
- 44
- Low
- 20
- Unrated
- 6
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Netgear SRX5308
- 17
- concrete5/concrete5
- 10
- Ubiquiti EdgeRouter X
- 7
- SourceCodester AC Repair and Services System
- 5
- SourceCodester Faculty Evaluation System
- 5
- IBM DB2 for Linux, UNIX and Windows
- 4
- Lenovo XClarity Controller
- 4
- HP LaserJet Pro
- 3
- IBM Safer Payments
- 3
- SourceCodester Online DJ Management System
- 3
Critical 11
- CVE-2023-1968CVE-2023-1968Illumina iScan Control Software · Illumina MiniSeq Contr… +9
- CVE-2023-27973Certain HP LaserJet Pro print products are potentially vulnerable to Heap Overflow and/or Remote Code Execution.HP LaserJet Pro
- CVE-2023-27972Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Remote Code Execution.HP LaserJet Pro
- CVE-2023-27971Certain HP LaserJet Pro print products are potentially vulnerable to Buffer Overflow and/or Elevation of Privilege.HP LaserJet Pro
- CVE-2023-30466Authentication Bypass Vulnerability in Milesight Network Video Recorder (NVR)Milesight NVR MS-Nxxxx-xxG · Milesight NVR MS-Nxxxx-xxE +3
- CVE-2022-41397The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKe
- CVE-2022-41400Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM
- CVE-2023-2356Relative Path Traversal in mlflow/mlflowmlflow/mlflow · mlflow
- CVE-2023-26781SQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands via Author Center ->Reader Comments ->Search.
- CVE-2023-26813SQL injection vulnerability in com.xnx3.wangmarket.plugin.dataDictionary.controller.DataDictionaryPluginController.java in wangmarket CMS 4.
- CVE-2023-31470SmartDNS through 41 before 56d0332 allows an out-of-bounds write because of a stack-based buffer overflow in the _dns_encode_domain function
High 30
- CVE-2023-25496A privilege escalation vulnerability was reported in Lenovo Drivers Management Lenovo Driver Manager that could allow a local user to executLenovo Drivers Management
- CVE-2023-29057A valid XCC user's local account permissions overrides their active directory permissions under specific configurations.Lenovo XClarity Controller
- CVE-2023-26021IBM Db2 denial of serviceIBM DB2 for Linux, UNIX and Windows
- CVE-2023-1966CVE-2023-1966Illumina iScan Control Software · Illumina MiniSeq Contr… +9
- CVE-2023-2379Ubiquiti EdgeRouter X Web Service denial of serviceUbiquiti EdgeRouter X
- CVE-2023-2378Ubiquiti EdgeRouter X Web Management command injectionUbiquiti EdgeRouter X
- CVE-2023-30856eDEX-UI cross-site websocket hijacking vulnerability enables remote command executionGitSquared edex-ui
- CVE-2023-30854WWBN AVideo vulnerable to OS Command InjectionWWBN AVideo · wwbn/avideo
- CVE-2023-2377Ubiquiti EdgeRouter X Web Management command injectionUbiquiti EdgeRouter X
- CVE-2023-30853Gradle Build Action data written to GitHub Actions Cache may expose secretsgradle-build-action
- CVE-2023-2376Ubiquiti EdgeRouter X Web Management command injectionUbiquiti EdgeRouter X
- CVE-2023-2375Ubiquiti EdgeRouter X Web Management command injectionUbiquiti EdgeRouter X
- CVE-2023-1477Improper Authentication vulnerability in HYPR Keycloak Authenticator Extension allows Authentication Abuse.This issue affects HYPR Keycloak HYPR Keycloak Authenticator Extension
- CVE-2023-0834Incorrect Permission Assignment for Critical Resource vulnerability in HYPR Workforce Access on MacOS allows Privilege Escalation.This issueHYPR Workforce Access
- CVE-2023-2374Ubiquiti EdgeRouter X Web Management command injectionUbiquiti EdgeRouter X
- CVE-2023-2373Ubiquiti EdgeRouter X Web Management command injectionUbiquiti EdgeRouter X
- CVE-2023-30467Improper Authorization Vulnerability in Milesight Network Video Recorder (NVR)Milesight NVR MS-Nxxxx-xxG · Milesight NVR MS-Nxxxx-xxE +3
- CVE-2023-28528IBM AIX command executionIBM AIX
- CVE-2022-38583On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configura
- CVE-2022-41398The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr i
- CVE-2022-41399The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decryp
- CVE-2023-24269An arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows attackers to execute arbitrary code via a
- CVE-2023-28882Trustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash and unresponsiveness) because some inputs ca
- CVE-2023-29815mccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).
- CVE-2023-30455An issue was discovered in ebankIT before 7.
- CVE-2023-31436qfq_change_class in net/sched/sch_qfq.c in the Linux kernel before 6.2.13 allows an out-of-bounds write because lmax can exceed QFQ_MIN_LMAX
- CVE-2023-31444In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of
- CVE-2023-31483tar/TarFileReader.cpp in Cauldron cbang before bastet-v8.1.17 has a directory traversal during extraction that allows the attacker to create
- CVE-2023-31484CPAN.pm before 2.35 does not verify TLS certificates when downloading distributions over HTTPS.
- CVE-2023-31486HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS configuration where u
Medium, low and unrated 70
- CVE-2023-2412SourceCodester AC Repair and Services System manage_user.php sql injectionSourceCodester AC Repair and Services System
- CVE-2023-2411SourceCodester AC Repair and Services System view_inquiry.php sql injectionSourceCodester AC Repair and Services System
- CVE-2023-2410SourceCodester AC Repair and Services System view_booking.php sql injectionSourceCodester AC Repair and Services System
- CVE-2023-2409SourceCodester AC Repair and Services System view_service.php sql injectionSourceCodester AC Repair and Services System
- CVE-2023-2408SourceCodester AC Repair and Services System view.php sql injectionSourceCodester AC Repair and Services System
- CVE-2023-2397SourceCodester Simple Mobile Comparison Website cross site scriptingSourceCodester Simple Mobile Comparison Website
- CVE-2023-2396Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-2395Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-25495A valid, authenticated administrative user can query a web interface API to reveal the configured LDAP client password used by XCC to authenLenovo XClarity Controller
- CVE-2023-29056A valid LDAP user, under specific conditions, will default to read-only permissions when authenticating into XCC.Lenovo XClarity Controller
- CVE-2023-2394Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-2393Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-30858Denosaurs emoji has ReDoS vulnerability in `replace` function denosaurs emoji
- CVE-2023-29058A valid, authenticated XCC user with read-only permissions can modify custom user roles on other user accounts and the user trespass messageLenovo XClarity Controller
- CVE-2023-30857@aedart/support possibly vulnerable to prototype pollution in metadata record, when using meta decoratoraedart ion · @aedart/support
- CVE-2023-2392Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-2391Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-2390Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-2389Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-2388Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-2387Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-2386Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-26022IBM Db2 denial of serviceIBM DB2 for Linux, UNIX and Windows
- CVE-2023-2385Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-27555IBM Db2 denial of serviceIBM DB2 for Linux, UNIX and Windows
- CVE-2023-29334Microsoft Edge (Chromium-based) Spoofing VulnerabilityMicrosoft Edge
- CVE-2023-25930IBM Db2 denial of serviceIBM DB2 for Linux, UNIX and Windows
- CVE-2023-2384Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-2383Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-27864IBM Maximo Asset Management HTML injectionIBM Maximo Asset Management
- CVE-2023-2382Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-2381Netgear SRX5308 Web Management Interface cross site scriptingNetgear SRX5308
- CVE-2023-2380Netgear SRX5308 denial of serviceNetgear SRX5308
- CVE-2023-1526Certain DesignJet and PageWide XL TAA compliant models may have risk of potential information disclosure if the hard disk drive is physicallHP DesignJet and PageWide XL
- CVE-2022-31643A potential security vulnerability has been identified in the system BIOS for certain HP PC products which may allow loss of integrity.HP PC BIOS
- CVE-2023-2372SourceCodester Online DJ Management System cross site scriptingSourceCodester Online DJ Management System
- CVE-2023-2371SourceCodester Online DJ Management System GET Parameter view_details.php sql injectionSourceCodester Online DJ Management System
- CVE-2023-2370SourceCodester Online DJ Management System GET Parameter manage_event.php sql injectionSourceCodester Online DJ Management System
- CVE-2023-2369SourceCodester Faculty Evaluation System manage_restriction.php sql injectionSourceCodester Faculty Evaluation System
- CVE-2023-2368SourceCodester Faculty Evaluation System sql injectionSourceCodester Faculty Evaluation System
- CVE-2023-2367SourceCodester Faculty Evaluation System manage_academic.php sql injectionSourceCodester Faculty Evaluation System
- CVE-2023-2366SourceCodester Faculty Evaluation System sql injectionSourceCodester Faculty Evaluation System
- CVE-2023-2365SourceCodester Faculty Evaluation System sql injectionSourceCodester Faculty Evaluation System
- CVE-2023-2360Sensitive information disclosure due to CORS misconfiguration.Acronis Cyber Infrastructure
- CVE-2023-2364SourceCodester Resort Reservation System registration.php cross site scriptingSourceCodester Resort Reservation System
- CVE-2023-2363SourceCodester Resort Reservation System view_room.php sql injectionSourceCodester Resort Reservation System
- CVE-2022-48481In JetBrains Toolbox App before 1.28 a DYLIB injection on macOS was possibleJetBrains Toolbox App
- CVE-2023-27557IBM Safter Payments information disclosureIBM Safer Payments
- CVE-2020-4729IBM Safer Payments denial of serviceIBM Safer Payments
- CVE-2023-27556IBM Safer Payments denial of serviceIBM Safer Payments
- CVE-2020-21643Cross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code via the callback parameter to /ajax/myshop.
- CVE-2020-23647Cross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote attackers to run arbitrary code via the me
- CVE-2023-2361Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore
- CVE-2023-26782An issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via Backend management interface ->System Configurat
- CVE-2023-28471Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS via a container name.concrete5/concrete5
- CVE-2023-28472Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 does not have Secure and HTTP only attributes set for cconcrete5/concrete5
- CVE-2023-28473Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to possible Auth bypass in the jobs secticoncrete5/concrete5
- CVE-2023-28474Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Saved Presets on search.concrete5/concrete5
- CVE-2023-28475Concrete CMS (previously concrete5) versions 8.5.12 and below, and versions 9.0 through 9.1.3 is vulnerable to Reflected XSS on the Reply foconcrete5/concrete5
- CVE-2023-28476Concrete CMS (previously concrete5) in versions 9.0 through 9.1.3 is vulnerable to Stored XSS on Tags on uploaded files.concrete5/concrete5
- CVE-2023-28477Concrete CMS (previously concrete5) versions 8.5.12 and below, and 9.0 through 9.1.3 is vulnerable to stored XSS on API Integrations via theconcrete5/concrete5
- CVE-2023-28819Concrete CMS (previously concrete5) versions 8.5.12 and below, 9.0.0 through 9.0.2 is vulnerable to Stored XSS in uploaded file and folder nconcrete5/concrete5
- CVE-2023-28820Concrete CMS (previously concrete5) before 9.1 is vulnerable to stored XSS in RSS Displayer via the href attribute because the link element concrete5/concrete5
- CVE-2023-28821Concrete CMS (previously concrete5) before 9.1 did not have a rate limit for password resets.concrete5/concrete5
- CVE-2023-30024The MagicJack device, a VoIP solution for internet phone calls, contains a hidden NAND flash memory partition allowing unauthorized read/wri
- CVE-2023-30123wuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.
- CVE-2023-30125EyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS).
- CVE-2023-30405A cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229 allows attackers to execute arbitrary web sc
- CVE-2023-30454An issue was discovered in ebankIT before 7.
- CVE-2023-31485GitLab::API::v4 through 0.26 does not verify TLS certificates when connecting to a GitLab server, enabling machine-in-the-middle attacks.