CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 13.6 before 15.8.5,...5.8 Medium
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.8.5,...6.1 Medium
- gitlabAn issue has been discovered in GitLab affecting all versions starting from 11.10 before 15.8.5,...3.1 Low
- enhancesoft audit logSQL Injection vulnerability in audit/class.audit.php in osTicket osTicket-plugins before commit...9.8 Critical
- enhancesoft audit logCross Site Scripting (XSS) vulnerability in audit/templates/auditlogs.tmpl.php in osTicket...6.1 Medium
- enhancesoft osticketSession Fixation vulnerability in in function login in class.auth.php in osTicket through 1.16.2.8.8 High
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in FedCM in Google Chrome prior to 112.0.5615.49 allowed a remote...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreIncorrect security UI in Navigation in Google Chrome prior to 112.0.5615.49 allowed a remote...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in WebShare in Google Chrome prior to 112.0.5615.49 allowed a remote...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreHeap buffer overflow in Browser History in Google Chrome prior to 112.0.5615.49 allowed a remote...8.8 High
- google chrome, debian linux, fedoraproject fedora +2 moreOut of bounds read in Accessibility in Google Chrome prior to 112.0.5615.49 allowed a remote...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreUse after free in Vulkan in Google Chrome prior to 112.0.5615.49 allowed a remote attacker to...8.8 High
- google chrome, debian linux, fedoraproject fedora +2 moreInsufficient policy enforcement in Intents in Google Chrome on Android prior to 112.0.5615.49...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreIncorrect security UI in Picture In Picture in Google Chrome prior to 112.0.5615.49 allowed a...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreUse after free in Networking APIs in Google Chrome prior to 112.0.5615.49 allowed a remote...8.8 High
- google chrome, debian linux, fedoraproject fedora +2 moreInsufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 112.0.5615...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreInappropriate implementation in Extensions in Google Chrome prior to 112.0.5615.49 allowed an...6.5 Medium
- google chrome, debian linux, fedoraproject fedora +2 moreOut of bounds memory access in DOM Bindings in Google Chrome prior to 112.0.5615.49 allowed a...8.8 High
- google chrome, debian linux, fedoraproject fedora +2 moreUse after free in Frames in Google Chrome prior to 112.0.5615.49 allowed a remote attacker who...8.8 High
- google chrome, debian linux, fedoraproject fedora +2 moreHeap buffer overflow in Visuals in Google Chrome prior to 112.0.5615.49 allowed a remote attacker...8.8 High
- svelte sveltekit, sveltejs kit +1 moreSvelteKit has Insufficient Cross-Site Request Forgery Protection8.8 High
- joinmastodon mastodonMastodon's blind LDAP injection in login allows the attacker to leak arbitrary attributes from LDAP database7.7 High
- mobymoby/moby's dockerd daemon encrypted overlay network may be unauthenticated7.5 High
- mobymoby/moby's dockerd daemon encrypted overlay network traffic may be unencrypted6.8 Medium
- mobymoby/moby's dockerd daemon encrypted overlay network with a single endpoint is unauthenticated6.8 Medium
- envoyproxy envoyEnvoy may crash when a redirect url without a state param is received in the oauth filter6.5 Medium
- envoyproxy envoyEnvoy doesn't escape HTTP header values8.1 High
- jonk @ follow me darling sp*tify play button for wordpress, followmedarling spotify-play-button-for-wordpress +1 moreSp*tify Play Button for WordPress <= 2.07 - Authenticated (Administrator+) Stored Cross-Site Scripting4.4 Medium
- envoyproxy envoyEnvoy may crash when a large request body is processed in Lua filter4.8 Medium
- envoyproxy envoyEnvoy forwards invalid Http2/Http3 downstream headers5.4 Medium
- envoyproxy envoyEnvoy gRPC client produces invalid protobuf when an HTTP header with non-UTF8 value is received.5.4 Medium
- getnexx nxal-100 firmware, nxg-100b firmware, nxg-200 firmware +4 more +6 moreCVE-2023-17489.3 Critical
- getnexx nxal-100 firmware, nxg-100b firmware, nxg-200 firmware +4 more +6 moreCVE-2023-17528.1 High
- getnexx nxal-100 firmware, nxg-100b firmware, nxg-200 firmware +4 more +6 moreCVE-2023-17496.5 Medium
- getnexx nxal-100 firmware, nxg-100b firmware, nxg-200 firmware +4 more +6 moreCVE-2023-17517.5 High
- getnexx nxal-100 firmware, nxg-100b firmware, nxg-200 firmware +4 more +6 moreCVE-2023-17507.1 High
- envoyproxy envoyEnvoy client may fake the header `x-envoy-original-path`8.2 High
- powerdns recursorDeterred spoofing attempts can lead to authoritative servers being marked unavailable3.4 Low
assimpOSS-FuzzHeap-use-after-free in aiScene::~aiSceneNo score- jetbrains phpstormIn JetBrains PhpStorm before 2023.1 source code could be logged in the local idea.log file3.3 Low
- heateor social comments, team heateor wordpress social comments plugin for vkontakte comments and disqus comments +1 moreWordPress Heateor Social Comments Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop client does not verify received singed certificate in end-to-end encryption5.4 Medium
- nextcloud desktop, nextcloud, kiteworks security-advisories +2 moreNextcloud: Lack of authenticity of metadata keys allows a malicious server to gain access to E2EE folders6.9 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop client misbehaves with E2EE when the server returns empty list of metadata keys6.7 Medium
- wpdevart responsive vertical icon menuWordPress Responsive Vertical Icon Menu Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- nextcloud desktop, kiteworks security-advisories +1 moreNextcloud Desktop: Initialization vector reuse in E2EE allows malicious server admin to break, manipulate, access files6.7 Medium
- kiteworks security-advisories, nextcloud user oidc +1 moreCSRF protection on user_oidc login returned the expected token in case of an error4.8 Medium
- flippercode wordpress plugin for google maps – wp maps, weplugins wp maps +1 moreWordPress WP Google Map Plugin Plugin <= 4.3.9 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
oracleasmopenSUSESecurity update for oracleasmNo scoredpdkopenSUSE,dpdk-thunderxopenSUSE +1 moreSecurity update for dpdkNo score- Show moreLoading…