CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- unknown wordpress amazon s3 plugin, wordpress amazon s3 project amazon s3 +1 moreWordPress Amazon S3 Plugin < 1.6 - Reflected XSS4.8 Medium
- article directory project directory, unknown article directory +1 moreArticle Directory <= 1.3 - Admin+ Stored XSS4.8 Medium
- ibenic simple giveawaysSimple Giveaways < 2.45.1 - Admin+ Stored XSS4.8 Medium
- incsub hummingbirdHummingbird < 3.4.2 - Unauthenticated Path Traversal9.8 Critical
- unknown all-in-one security (aios), updraftplus all-in-one security +1 moreAll-In-One Security (AIOS) < 5.1.5 - Admin+ Arbitrary File/Folder Access via Traversal4.9 Medium
- stylishcostcalculator stylish cost calculator, unknown stylish cost calculator premium +1 moreStylish Cost Calculator Premium < 7.9.0 - Unauthenticated Stored XSS6.1 Medium
- auto rename media on upload project rename media on upload, unknown auto rename media on upload +1 moreAuto Rename Media On Upload < 1.1.0 - Admin+ Stored XSS4.8 Medium
- groundhogg, trainingbusinesspros wordpress crm, email & marketing automation for wordpress | award winner — groundhogg +1 moreGroundhogg Contacts < 2.7.9.4 - Admin+ SQLi7.2 High
- keetrax wp tilesWP Tiles <= 1.1.2 - Subscriber+ Draft/Private Post Title Disclosure6.5 Medium
- crocoblock jetengine, jetengine for elementor +1 moreJetEngine < 3.1.3.1 - Author+ Remote Code Execution8.8 High
- ibenic simple giveawaysSimple Giveaways < 2.45.1 - Editor+ Stored Cross-Site Scripting4.8 Medium
- dcac time sheetsTime Sheets < 1.29.3 - Admin+ Stored XSS4.8 Medium
- nlb-creations scheduled announcements widgetScheduled Announcements Widget < 1.0 - Contributor+ Stored XSS5.4 Medium
- codepeople cp appointment calendarCP Appointment Calendar Plugin dex_appointments.php dex_process_ready_to_go_appointment sql injection6.3 Medium
- linux, linux kernel, redhat enterprise linux +2 moreA NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In...5.5 Medium
- apache linkisApache Linkis DatasourceManager module has a deserialization command execution9.8 Critical
- apache linkisApache Linkis gateway module token authentication bypass9.1 Critical
- apache linkisApache Linkis Mangaer module engineConn material upload exists Zip Slip issue9.8 Critical
- apache linkisApache Linkis publicsercice module unrestricted upload of file9.8 Critical
- apache linkisApache Linkis JDBC EngineCon has a deserialization command execution9.8 Critical
- xuxueli xxl-jobXXL-JOB vulnerable to Cross-site Scripting5.4 Medium
- dart http serverDart http_server Directory Listing virtual_directory.dart VirtualDirectory cross site scripting4.3 Medium
- bestwebsoft facebook like button, facebook button +1 moreBestWebSoft Facebook Like Button facebook-button-plugin.php fcbkbttn_settings_page cross site scripting3.5 Low
- fancy gallery project galleryFancy Gallery Plugin Options Page class.options.php cross site scripting3.5 Low
udisks2Debianudisks2 - regression updateNo score- linux kernelAn issue was discovered in arch/x86/kvm/vmx/nested.c in the Linux kernel before 6.2.8. nVMX on...6.5 Medium
- progress sitefinityAn issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1...5.4 Medium
- progress sitefinityAn issue was discovered in Progress Sitefinity 13.3 before 13.3.7647, 14.0 before 14.0.7736, 14.1...9.8 Critical
- apple ios, ipados, and macos, ipados, macos +2 more +4 moreApple iOS, iPadOS, and macOS IOSurfaceAccelerator Out-of-Bounds Write Vulnerability8.6 High
- apple ipados, macos, safari +3 more +5 moreA use after free issue was addressed with improved memory management. This issue is fixed in iOS...8.8 High
- pega synchronization engine, pegasystems rpa: synchronization engine +1 moreA user with a compromised configuration can start an unsigned binary as a service.7.5 High
- apusapps launcherAn issue found in APUS Group Launcher v.3.10.73 and v.3.10.88 allows a remote attacker to execute...9.8 Critical
- gdidees cmsAn arbitrary file upload vulnerability in the upload function of GDidees CMS 3.9.1 allows...9.8 Critical
- tenda g103 firmwareCommand injection vulnerability found in Tenda G103 v.1.0.0.5 allows attacker to execute...9.8 Critical
- chinamobileltd oa mailbox pcAn issue in China Mobile OA Mailbox PC v2.9.23 allows remote attackers to execute arbitrary...7.8 High
- javadelight nashorn sandboxdelight-nashorn-sandbox 0.2.4 and 0.2.5 is vulnerable to sandbox escape. When allowExitFunctions...7.2 High
- save your carts and buy later or send it project your carts and buy later or send itSQL injection vulnerability found in PrestaShop Igbudget v.1.0.3 and before allow a remote...8.8 High
- veritas netbackup appliance firmwareVeritas Appliance v4.1.0.1 is affected by Host Header Injection attacks. HTTP host header can be...6.1 Medium
- sales tracker management system project tracker management systemAn issue found in Sales Tracker Management System v.1.0 allows a remote attacker to access...7.5 High
- sales tracker management system project tracker management systemCross Site Scripting vulnerability found in Sales Tracker Management System v.1.0 allows a remote...6.1 Medium
- opendesign drawings sdkAn issue was discovered in Open Design Alliance Drawings SDK before 2024.1. A crafted DWG file...7.8 High
- pega synchronization engine, pegasystems rpa: synchronization engine +1 moreA man in the middle can redirect traffic to a malicious server in a compromised configuration.8.1 High
- pega synchronization engine, pegasystems rpa: synchronization engine +1 moreA user with non-Admin access can change a configuration file on the client to modify the Server URL.7.8 High
- lexmark cslbl firmware, cslbn firmware, csnzj firmware +23 more +25 moreCertain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 4 of 4).9.8 Critical
- lexmark cslbl firmware, cslbn firmware, csnzj firmware +23 more +25 moreCertain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 3 of 4).9.8 Critical
- lexmark cslbl firmware, cslbn firmware, csnzj firmware +23 more +25 moreCertain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 2 of 4).9.8 Critical
- lexmark cslbl firmware, cslbn firmware, csnzj firmware +23 more +25 moreCertain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).8.1 High
- lexmark cslbl firmware, cslbn firmware, csnzj firmware +23 more +25 moreCertain Lexmark devices through 2023-02-19 have Improper Validation of an Array Index.9.8 Critical
- lexmark cslbl firmware, cslbn firmware, csnzj firmware +23 more +25 moreCertain Lexmark devices through 2023-02-19 have an Integer Overflow.9.8 Critical
- lexmark cslbl firmware, cslbn firmware, csnzj firmware +23 more +25 moreCertain Lexmark devices through 2023-02-19 have an Out-of-bounds Write.9.8 Critical
- Show moreLoading…