CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- timesheets-for-jira timesheet trackingThe TouchDown Timesheet tracking component 4.1.4 for Jira allows XSS in the calendar view.5.4 Medium
- artifex mujsBuffer-overflow in jsdtoa.c in Artifex MuJS in versions 1.0.1 to 1.1.1. An integer overflow...9.8 Critical
c-blosc2OSS-FuzzHeap-buffer-overflow in ZSTD_decompressSequencesLong_bmi2No score- colorlib activello theme, silkalns activello +1 moreWordPress Activello Theme <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)5.4 Medium
- bestwebsoft car rental by bestwebsoft, car rental +1 moreWordPress Car Rental by BestWebSoft Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)4.8 Medium
- code tides advanced floating contentWordPress Advanced Floating Content Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)4.1 Medium
- magneticlab homepage pop-upWordPress Homepage Pop-up Plugin <= 1.2.5 is vulnerable to Cross Site Scripting (XSS)6.1 Medium
- jose mortellaro freesoul deactivate plugins – plugin manager and cleanup, freesoul deactivate plugins - plugin manager and cleanup project deactivate plugins - plugin manager and cleanup +1 moreWordPress Freesoul Deactivate Plugins – Plugin manager and cleanup Plugin <= 1.9.4.0 is vulnerable to Sensitive Data Exposure3.7 Low
- kilian evang ultimate noindex nofollow tool ii, ultimate noindex nofollow tool ii project noindex nofollow tool ii +1 moreWordPress Ultimate Noindex Nofollow Tool II Plugin <= 1.3 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- transbank webpay rest, transbankdevelopers transbank webpay rest +1 moreWordPress Transbank Webpay REST Plugin <= 1.6.6 is vulnerable to SQL Injection5.5 Medium
- judging management system project management system, sourcecodester judging management system +1 moreSourceCodester Judging Management System edit_contestant.php sql injection6.3 Medium
- huawei emui, harmonyos +1 moreThe Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing...6.5 Medium
- openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 moreGovernorCompatibilityBravo may trim proposal calldata6.8 Medium
- huawei emui, harmonyos +1 moreThe Bluetooth module has a vulnerability of bypassing the user confirmation in the pairing...6.5 Medium
- huawei emui, harmonyos +1 moreThe HwPCAssistant module has the out-of-bounds read/write vulnerability. Successful exploitation...9.1 Critical
- linux kernelThe Linux kernel before 6.2.9 has a race condition and resultant use-after-free in drivers/power...6.4 Medium
- dlink dir-819 firmwareOn D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a...7.5 High
- linksys e8450 firmwareLinksys AX3200 1.1.00 is vulnerable to OS command injection by authenticated users via shell...8.8 High
- guralp man-eam-0003cgi-bin/xmlstatus.cgi in Güralp MAN-EAM-0003 3.2.4 is vulnerable to an XML External Entity (XXE)...7.5 High
- open-xchange ox app suiteOX App Suite before 7.10.6-rev30 allows XSS via an upsell trigger.6.1 Medium
- tp-link tapo c310 firmwareTP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User ---...7.5 High
- glpi-project positionsThe Cartography (aka positions) plugin before 6.0.1 for GLPI allows remote code execution via PHP...9.8 Critical
- glpi-project manageentitiesThe Managentities plugin before 4.0.2 for GLPI allows reading local files via directory traversal...7.5 High
- glpi-project activityThe Activity plugin before 3.1.1 for GLPI allows reading local files via directory traversal in...7.5 High
- glpi-project cmdbfront/icon.send.php in the CMDB plugin before 3.0.3 for GLPI allows attackers to gain read access...6.5 Medium
- entab erpENTAB ERP 1.0 allows attackers to discover users' full names via a brute force attack with a...5.3 Medium
- external redirect warning project redirect warningIn the External Redirect Warning Plugin 1.3 for MyBB, the redirect URL (aka external.php?url=) is...6.1 Medium
- washington i-tech trainsmartA SQL injection vulnerability in I-Tech Trainsmart r1044 exists via a evaluation/assign...7.5 High
- liferay portalLiferay Portal 6.2.5 allows Command=FileUpload&Type=File&CurrentFolder=/ requests when frmfolders...9.8 Critical
- google analytics top content widget project analytics top content widgetGoogle Analytics Top Content Widget Plugin class-tgm-plugin-activation.php cross site scripting3.5 Low
python-flask-restxMageiaUpdated python-flask-restx packages fix security vulnerabilityNo scorelibredwgOSS-FuzzSegv on unknown address in dwg_ref_get_objectNo score- ibosIBOS del&op=recycle sql injection6.3 Medium
- moxi624 mogu blog v2, mogublog project mogublog +1 moremoxi624 Mogu Blog v2 uploadPicsByUrl uploadPictureByUrl absolute path traversal4.3 Medium
- oretnom23 vehicle service management systemSourceCodester Vehicle Service Management System index.php cross site scripting3.5 Low
- sourcecodester vehicle service management system, vehicle service management system project service management system +1 moreSourceCodester Vehicle Service Management System Users.php cross site scripting3.5 Low
- oretnom23 vehicle service management systemSourceCodester Vehicle Service Management System topBarNav.php cross site scripting3.5 Low
- sourcecodester vehicle service management system, vehicle service management system project service management system +1 moreSourceCodester Vehicle Service Management System Master.php sql injection6.3 Medium
- sourcecodester vehicle service management system, vehicle service management system project service management system +1 moreSourceCodester Vehicle Service Management System manage_inventory.php sql injection6.3 Medium
- sourcecodester vehicle service management system, vehicle service management system project service management system +1 moreSourceCodester Vehicle Service Management System manage_category.php sql injection6.3 Medium
- oretnom23 vehicle service management systemSourceCodester Vehicle Service Management System manage_mechanic.php sql injection6.3 Medium
- sourcecodester vehicle service management system, vehicle service management system project service management system +1 moreSourceCodester Vehicle Service Management System Login.php sql injection6.3 Medium
- sourcecodester vehicle service management system, vehicle service management system project service management system +1 moreSourceCodester Vehicle Service Management System view_service.php sql injection6.3 Medium
- employee and visitor gate pass logging system project and visitor gate pass logging system, oretnom23 employee and visitor gate pass logging system +1 moreSourceCodester Employee and Visitor Gate Pass Logging System GET Parameter view_designation.php sql injection6.3 Medium
- kylinos youker-assistantKylinSoft youker-assistant adjust_cpufreq_scaling_governer os command injection7.8 High
- zanematthew zm ajax login & register, zm ajax login \& register project ajax login \& register +1 moreZM Ajax Login & Register <= 2.0.2 - Authentication Bypass9.8 Critical
- complaint management system project management system, phpgurukul complaint management system +1 moreSourceCodester Complaint Management System GET Parameter userprofile.php sql injection6.3 Medium
- opendesign drawings sdkA heap-based buffer overflow exists in the DXF file reading procedure in Open Design Alliance...7.8 High
- opendesign drawings sdkParsing of DWG files in Open Design Alliance Drawings SDK before 2023.6 lacks proper validation...7.8 High
- janeczku calibre-web, janeczku/calibre-web +1 moreWeak Password Requirements in janeczku/calibre-web7.3 High
- Show moreLoading…