CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-wiki-ui-mainwiki Eval Injection vulnerability10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-notifications-ui Eval Injection vulnerability10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreorg.xwiki.platform:xwiki-platform-legacy-notification-activitymacro Eval Injection vulnerability10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreData leak through deleted documents7.5 High
- jenkins turboscript, jenkins project turboscript plugin +1 moreLack of authentication mechanism in Jenkins TurboScript Plugin webhook6.5 Medium
- jenkins consul kv builder, jenkins project consul kv builder plugin +1 moreJenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted6.5 Medium
- jenkins consul kv builder, jenkins project consul kv builder plugin +1 moreJenkins Consul KV Builder Plugin stores HashiCorp Consul ACL Token unencrypted4.3 Medium
- jenkins lucene-search, jenkins project lucene-search plugin +1 moreJenkins Lucene-Search Plugin vulnerable to Cross-Site Request Forgery4.3 Medium
- jenkins wso2 oauth, jenkins project wso2 oauth plugin +1 moreJenkins WSO2 Oauth Plugin does not mask the WSO2 Oauth client secret on the global configuration form6.5 Medium
- jenkins wso2 oauth, jenkins project wso2 oauth plugin +1 moreJenkins WSO2 Oauth Plugin stores WSO2 Oauth client secret unencrypted in global config.xml file on Jenkins controller4.3 Medium
- jenkins report portal, jenkins project report portal plugin +1 moreJenkins Report Portal Plugin missing permissions check6.5 Medium
- jenkins report portal, jenkins project report portal plugin +1 moreJenkins Report Portal Plugin Cross-Site Request Forgery vulnerability8.8 High
- jenkins report portal, jenkins project report portal plugin +1 moreJenkins Report Portal Plugin configuration form does not mask tokens4.3 Medium
- jenkins report portal, jenkins project report portal plugin +1 moreJenkins Report Portal Plugin allows users with Item/Extended Read permission to view tokens on Jenkins controller4.3 Medium
- jenkins fogbugz, jenkins project fogbugz plugin +1 moreJenkins Fogbugz Plugin has missing permissions check4.3 Medium
- jenkins assembla merge request builder, jenkins project assembla merge request builder plugin +1 moreJenkins Assembla merge request builder Plugin missing authentication to access endpoint5.3 Medium
- jenkins quay.io trigger, jenkins project quay.io trigger plugin +1 moreJenkins Quay.io trigger Plugin Cross-site Scripting vulnerability5.4 Medium
- jenkins quay.io trigger, jenkins project quay.io trigger plugin +1 moreJenkins Quay.io trigger Plugin webhook endpoint can be accessed without authentication5.3 Medium
- jenkins thycotic secret server, jenkins project thycotic secret server plugin +1 moreJenkins Thycotic Secret Server Plugin missing permissions check4.3 Medium
- jenkins neuvector vulnerability scanner, jenkins project neuvector vulnerability scanner plugin +1 moreJenkins NeuVector Vulnerability Scanner Plugin disables SSL/TLS certificate and hostname validation5.3 Medium
- jenkins image tag parameter, jenkins project image tag parameter plugin +1 moreJenkins Image Tag Parameter Plugin improperly introduces option to opt out of SSL/TLS certificate validation6.5 Medium
- jenkins thycotic devops secrets vault, jenkins project thycotic devops secrets vault plugin +1 moreJenkins Thycotic DevOps Secrets Vault Plugin does not properly mask credentials7.5 High
- jenkins azure key vault, jenkins project azure key vault plugin +1 moreJenkins Azure Key Vault Plugin does not properly mask credentials7.5 High
- jenkins kubernetes, jenkins project kubernetes plugin +1 moreJenkins Kubernetes Plugin does not properly mask credentials7.5 High
- palo alto networks globalprotect app, paloaltonetworks globalprotect +1 moreGlobalProtect App: Local File Deletion Vulnerability6.3 Medium
- palo alto networks pan-os, cloud ngfw, prisma access +2 morePAN-OS: Exposure of Sensitive Information Vulnerability4.1 Medium
- palo alto networks pan-os, fedoraproject fedora, palo alto networks cloud ngfw +1 more +3 morePAN-OS: Local File Deletion Vulnerability6.5 Medium
drupal/protected_pagesPackagistThis module enables you to secure any page with a password. The module does not sufficiently restrict access to the page content.No score- debian linux, linux kernel +1 moreUse-after-free in Linux kernel's io_uring subsystem7.8 High
- kunal nagar custom 404 proWordPress Custom 404 Pro Plugin <= 3.7.0 is vulnerable to SQL Injection (SQLi)8.3 High
cairoOSS-FuzzUNKNOWN READ in active_edgesNo scoreghostscriptOSS-FuzzUNKNOWN READ in pdfi_read_cff_fontNo score- wpdataaccess wp data access, peterschulznl wp data access – app builder for tables, forms, charts, maps & dashboards +1 moreWP Data Access <= 5.3.7 - Authenticated (Subscriber+) Privilege Escalation7.5 High
borshcrates.ioParsing borsh messages with ZST which are not-copy/clone is unsoundNo scoremicrocode_ctlTuxCareUpdate of microcode_ctlNo scoremicrocode_ctlTuxCareUpdate of microcode_ctlNo scoremicrocode_ctlTuxCareUpdate of microcode_ctlNo score- linuxfoundation cubefsCubeFS allows Kubernetes cluster-level privilege escalation6.5 Medium
- yasm project yasmyasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the function...5.5 Medium
- yasm project yasmyasm 1.3.0.55.g101bc was discovered to contain a segmentation violation via the component...5.5 Medium
- axiosys bento4Bento4 v1.6.0-639 was discovered to contain an out-of-memory bug in the mp42avc component.5.5 Medium
- cesanta mjsCesanta MJS v2.20.0 was discovered to contain a SEGV vulnerability via gc_sweep at src/mjs_gc.c....5.5 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreMozilla developers Randell Jesup, Andrew McCreight, Gabriele Svelto, and the Mozilla Fuzzing Team...8.8 High
- mozilla firefox, firefox for android, focus +2 more +4 moreUnder certain circumstances, a call to the <code>bind</code> function may have resulted in the...6.5 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreWhen a secure cookie existed in the Firefox cookie jar an insecure cookie for the same domain...6.5 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreIf multiple instances of resource exhaustion occurred at the incorrect time, the garbage...6.5 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreAn attacker could have caused memory corruption and a potentially exploitable use-after-free of a...8.8 High
- mozilla firefox, firefox for android, focus +2 more +4 moreUsing a redirect embedded into <code>sourceMappingUrls</code> could allow for navigation to...6.1 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreUnder specific circumstances a WebExtension may have received a <code>jar:file:///</code> URI...4.3 Medium
- mozilla firefox, firefox for android, focus +2 more +4 moreMultiple race conditions in the font initialization could have led to memory corruption and...7.5 High
- Show moreLoading…