CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- dircms project dircmsDirCMS 6.0.0 has a Cross Site Scripting (XSS) vulnerability in the foreground.6.1 Medium
- iteachyou dreamer cmsDreamer CMS 3.0.1 is vulnerable to stored Cross Site Scripting (XSS).5.4 Medium
- ami megarac sp-xAMI MegaRAC SPx12 and SPx13 devices have Insufficient Verification of Data Authenticity.9.1 Critical
- jbootfly project jbootflyCross Site Scripting vulnerability found in Jbootfly allows attackers to obtain sensitive...6.1 Medium
- python, fedoraproject fedora, netapp active iq unified manager +12 more +14 moreThe e-mail module of Python 0 - 2.7.18, 3.x - 3.11 incorrectly parses e-mail addresses which...5.3 Medium
- modoboa, modoboa modoboa/modoboa +1 moreWeak Password Requirements in modoboa/modoboa6.3 Medium
- nuxtlabs nuxt, nuxtlabs/github-module +1 moreUse of Hard-coded Credentials in nuxtlabs/github-module10.0 Critical
- nanoleaf desktopNanoleaf Desktop App before v1.3.1 was discovered to contain a command injection vulnerability...9.8 Critical
- openrisc mor1kx firmwareAn issue was discovered in the controller unit of the OpenRISC mor1kx processor. The read/write...7.8 High
- openrisc mor1kx firmwareAn issue was discovered in the controller unit of the OpenRISC mor1kx processor. The write logic...4.3 Medium
- openrisc mor1kx firmwareAn issue was discovered in the ALU unit of the OpenRISC mor1kx processor. The carry flag is not...8.8 High
- openrisc or1200 firmwareAn issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10...9.8 Critical
- openrisc or1200 firmwareAn issue was discovered in the ALU unit of the OR1200 (aka OpenRISC 1200) processor 2011-09-10...9.8 Critical
- laravelA deserialization vulnerability in the destruct() function of Laravel v8.5.9 allows attackers to...9.8 Critical
- patriksimek vm2Sandbox Escape in vm29.8 Critical
- nextcloud talk, kiteworks security-advisories +1 moreChat poll data can still be queried from API after purging history in Nextcloud talk3.5 Low
- nextcloud files automated tagging, server, kiteworks security-advisories +2 moreUsers can set up workflows using restricted and invisible system tags in Nextcloud6.5 Medium
- slimframework slim psr-7, slimphp slim-psr7 +1 moreInsecure header validation in slim/psr76.5 Medium
- guzzle psr7, guzzlephp psr-7, fedoraproject fedora +2 moreImproper header name validation in guzzlehttp/psr75.3 Medium
- uniswap web3-react, web3-react coinbase-wallet, web3-react eip1193 +2 more +4 more`chainId` may be outdated if user changes chains as part of connection in @web3-react5.2 Medium
- gatsbyjs gatsby, gatsby-plugin-sharp +1 morePath traversal vulnerability in gatsby-plugin-sharp4.3 Medium
- purchase order management system project order management system, sourcecodester purchase order management system +1 moreSourceCodester Purchase Order Management System GET Parameter view_details.php sql injection6.3 Medium
- forget it project it, internalerror503 forget it +1 moreInternalError503 Forget It settings.js infinite loop2.8 Low
- hap-wi roxy-wiPath Traversal Vulnerability in hap-wi/roxy-wi6.5 Medium
- freshworks freshdeskFreshdesk Plugin redirect6.3 Medium
- openzeppelin contracts, contracts upgradeable, openzeppelin-contracts +2 moreTransparentUpgradeableProxy clashing selector calls may not be delegated in @openzeppelin/contracts5.3 Medium
- apache supersetApache Superset: Possible SSRF on import datasets4.9 Medium
- apache supersetApache Superset: Incorrect default permissions for Gamma role3.1 Low
- mattermost, mattermost server +1 moreUser password logged in audit logs7.2 High
harfbuzzOSS-FuzzHeap-buffer-overflow in OT::glyf_impl::SubsetGlyph::serializeNo scorerubyOSS-FuzzUse-after-poison in str_new_frozen_bufferNo scorelibuclOSS-FuzzHeap-use-after-free in ucl_hash_funcNo score- faturamatik bircardSQLi in Bircard9.8 Critical
- unknown slider, gallery, and carousel by metaslider, metaslider slider\, gallery\, and carousel +1 moreResponsive WordPress Slideshows 3.29.0 - Reflected XSS6.1 Medium
- rextheme wp vrWP VR < 8.2.9 - Reflected XSS6.1 Medium
- shazzad hossain khan w4 post list, w4 post list project post list +1 moreW4 Post List < 2.4.6 - Subscriber+ Password Protected Post Content Disclosure6.5 Medium
- pricing tables for wpbakery page builder project tables for wpbakery page builder, unknown pricing tables for wpbakery page builder (formerly visual composer) +1 morePricing Tables For WPBakery Page Builder < 3.0 - Subscriber+ LFI6.5 Medium
- inisev redirectionRedirection < 1.1.5 - Plugin Reset via CSRF6.5 Medium
- pricing tables for wpbakery page builder project tables for wpbakery page builder, unknown pricing tables for wpbakery page builder (formerly visual composer) +1 morePricing Tables For WPBakery Page Builder < 3.0 - Contributor+ Stored XSS5.4 Medium
- shazzad hossain khan w4 post list, w4 post list project post list +1 moreW4 Post List < 2.4.6 - Reflected XSS6.1 Medium
- metagauss themeflection numbersTF Random Numbers < 2.0.1 - Subscriber+ Arbitrary Option Update6.5 Medium
- unknown drag and drop multiple file upload pro - contact form 7 standard, drag and drop multiple file upload pro - contact form 7 with remote storage integrations, codedropz drag and drop multiple file upload - contact form 7 +2 moreDrag and Drop Multiple File Upload PRO - Reflected Cross-Site Scripting6.1 Medium
- 10web photo gallery by 10web, photo gallery +1 morePhoto Gallery by 10Web < 1.8.15 - Admin+ Path Traversal4.9 Medium
- unknown wc fields factory, wc fields factory project fields factory +1 moreWC Fields Factory <= 4.1.5 - ShopManager+ SQLi7.2 High
- unknown easy forms for mailchimpEasy Forms for MailChimp < 6.8.7 - Contributor+ Stored XSS5.4 Medium
- bestwebsoft gallery, unknown gallery by bestwebsoft +1 moreGallery by BestWebSoft < 4.7.0 - Author+ SQL Injection8.8 High
- shazzad hossain khan w4 post list, w4 post list project post list +1 moreW4 Post List < 2.4.6 - Contributor+ Stored XSS5.4 Medium
- bestwebsoft gallery, unknown gallery by bestwebsoft +1 moreGallery by BestWebSoft < 4.7.0 - Author+ Stored Cross-Site Scripting5.4 Medium
enumflags2crates.ioAdverserial use of `make_bitflags!` macro can cause undefined behaviorNo score- vegayazilim mobile assistantSQLi in Veragroup Mobile Assistant9.8 Critical
- Show moreLoading…