CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- online jewelry shop project jewelry shopCross-site scripting (XSS) vulnerability was discovered in Online Jewelry Shop v1.0 that allows...5.4 Medium
- online jewelry shop project jewelry shopA stored cross-site scripting (XSS) vulnerability in /index.php?page=category_list of Online...5.4 Medium
- uniguest tripleplayXSS vulnerability in TripleSign in Tripleplay Platform releases prior to Caveman 3.4.0 allows...6.1 Medium
- uniguest tripleplayIncorrect Access Control in Tripleplay Platform releases prior to Caveman 3.4.0 allows...8.8 High
- uniguest tripleplayOS Command Injection in TripleData Reporting Engine in Tripleplay Platform releases prior to...5.4 Medium
- sick fx0-gent00000 firmware, fx0-gent00030 firmware, fx0-gmod00000 firmware +7 more +9 moreThe Flexi Classic and Flexi Soft Gateways SICK UE410-EN3 FLEXI ETHERNET GATEW., SICK UE410-EN1...9.8 Critical
- strapiStrapi leaking sensitive user information by filtering on private fields4.9 Medium
- strapiStrapi does not verify the access or ID tokens issued during the OAuth flow7.5 High
- linuxfoundation kubewarden-controller, suse kubewarden +1 morekubewarden: Excessive permissions for kubewarden-controller-manager-cluster-role8.0 High
- strapiStrapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin7.2 High
- linux, linux kernel +1 moreA null pointer dereference issue was found in can protocol in net/can/af_can.c in the Linux...5.5 Medium
- linux kernelA use-after-free vulnerability was found in iscsi_sw_tcp_session_create in drivers/scsi/iscsi_tcp...5.5 Medium
- google androidIn PreferencesHelper.java, an uncaught exception may cause the device to get stuck in a boot loop...5.5 Medium
- spring security, vmware spring security, netapp active iq unified manager +2 moreSpring Security logout not clearing security context6.3 Medium
- octopus serverIn affected versions of Octopus Deploy it is possible to render user supplied input into the webpage5.3 Medium
- browser.360 safe browserBuffer Overflow vulnerability in Qihoo 360 Total Security v10.8.0.1060 and v10.8.0.1213 allows...10.0 Critical
- 360 total securityQihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Chrome (https...8.8 High
- 360totalsecurity 360 total securityBuffer Overflow vulnerability in Qihoo 360 Safe guard v12.1.0.1004, v12.1.0.1005, v13.1.0.1001...7.8 High
- browser.360 safe browserBuffer Overflow vulnerability in Qihoo 360 Safe Browser v13.0.2170.0 allows attacker to escalate...10.0 Critical
- 360 total securityQihoo 360 (https://www.360.cn/) Qihoo 360 Safeguard (https://www.360.cn/) Qihoo 360 Total...7.8 High
- browser.360 chromeBuffer Overflow vulnerability in Qihoo 360 Chrome v13.0.2170.0 allows attacker to escalate...10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreExposure of Sensitive Information to an Unauthorized Actor in org.xwiki.platform:xwiki-platform-office-viewer7.5 High
- xwiki, xwiki xwiki-platform +1 moreCode injection from view right on XWiki.AttachmentSelector in xwiki-platform9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreCross-site scripting (XSS) in xwiki-platform7.7 High
- xwiki, xwiki xwiki-platform +1 moreCode injection in template provider administration in xwiki-platform10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreUsers can be created even when registration is disabled without validation via the template macro in xwiki-platform5.0 Medium
- xwiki, xwiki xwiki-platform +1 moreCode injection in xwiki-platform-web-templates9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection via unescaped translations in xwiki-platform10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection from view right on XWiki.ClassSheet in xwiki-platform9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection from account/view through VFS Tree macro in xwiki-platform8.4 High
- xwiki, xwiki xwiki-platform +1 morePage render failure due to broken translations in xwiki-platform4.3 Medium
- xwiki, xwiki xwiki-platform +1 moreCode injection in org.xwiki.platform:xwiki-platform-attachment-ui9.1 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection from view right using Invitation.InvitationCommon in xwiki-platform9.9 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection in display method used in user profiles in xwiki-platform10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection from account through XWiki.SchedulerJobSheet in xwiki-platform10.0 Critical
- xwiki, xwiki xwiki-platform +1 morePrivilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration in xwiki-platform10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreAsync and display macro allow displaying and interacting with any document in restricted mode10.0 Critical
- xwiki, xwiki xwiki-platform +1 moreCode injection from account through AWM view sheet in xwiki platform10.0 Critical
- archerydms archeryMultiple SQL injections in sql/instance.py param_edit method in Archery - GHSL-2022-1046.5 Medium
- archerydms archeryMultiple SQL injections in sql/data_dictionary.py table_list method in Archery - GHSL-2022-1056.5 Medium
- archerydms archerySQL injection in data_dictionary.py table_info method in Archery - GHSL-2022-1066.5 Medium
- archerydms archerySQL injection in sql_optimize.py optimize_sqltuningadvisor method in Archery - GHSL-2022-1076.5 Medium
- archerydms archerySQL injection in sql_optimize.py explain method in Archery - GHSL-2022-1086.5 Medium
- archerydms archerySQL injection in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-1036.5 Medium
- archerydms archeryMultiple SQL injections in sql_api/api_workflow.py endpoint in Archery - GHSL-2022-1026.5 Medium
- archerydms archerySQL injection in sql/instance.py endpoint in Archery - GHSL-2022-1016.5 Medium
@strapi/plugin-users-permissionsnpmAuthentication Bypass in @strapi/plugin-users-permissions8.2 High- discourseMultisite denial of service through unsanitized dynamic dispatch to SiteSetting in Discourse4.2 Medium
- andialbrecht sqlparse, debian linux +1 moreParser contains an inefficient regular expression in sqlparse5.5 Medium
- discourseStored Cross-site Scripting via improper sanitization of svg files in Discourse5.4 Medium
- Show moreLoading…