CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- service location protocol project location protocol, ietf service location protocol (slp), netapp smi-s provider +3 more +5 moreThe Service Location Protocol (SLP, RFC 2608) allows an unauthenticated, remote attacker to...7.5 High
- ribose rnpRibose RNP before 0.16.3 sometimes lets secret keys remain unlocked after use.7.5 High
- expo software development kit, expo.io expo authsession module +1 moreExpo SDK has an OAuth vulnerability9.6 Critical
- zyxel atp series firmware, usg flex 50(w) firmware, usg flex series firmware +21 more +23 moreThe post-authentication command injection vulnerability in the CLI command of Zyxel ATP series...8.8 High
- zyxel atp series firmware, usg flex 50(w) firmware, usg flex series firmware +21 more +23 moreThe XSS vulnerability in Zyxel ATP series firmware versions 4.32 through 5.35, USG FLEX series...4.8 Medium
- apple ipados, macos, safari +5 more +7 moreThe issue was addressed by removing origin information. This issue is fixed in macOS Ventura 13.3...6.5 Medium
- apple ipados, macos, safari +5 more +7 moreThis issue was addressed with improved state management. This issue is fixed in macOS Ventura 13...5.5 Medium
- rails-routes-to-json project rails-routes-to-jsonrails-routes-to-json v1.0.0 was discovered to contain a remote code execution (RCE) vulnerability...9.8 Critical
- broccoli-compass project broccoli-compassRemote code execution in broccoli-compass9.8 Critical
- brandsdistribution bdroppySQL injection vulnerability found in PrestaShop bdroppy v.2.2.12 and before allowing a remote...9.8 Critical
- telindus apsalAn issue was discovered in Telindus Apsal 3.14.2022.235 b. The consultation permission is insecure.4.4 Medium
- telindus apsalAn issue was discovered in Telindus Apsal 3.14.2022.235 b. Unauthorized actions that could modify...8.4 High
- nokia netactAn issue was discovered in Nokia NetAct before 22 FP2211. On the Scheduled Search tab under the...6.8 Medium
- nokia netactAn issue was discovered in Nokia NetAct before 22 FP2211. On the Working Set Manager page, users...6.8 Medium
- nokia netactAn issue was discovered in Nokia NetAct before 22 SP1037. On the Site Configuration Tool tab,...6.8 Medium
- cyberpower powerpanel, powerpanel business management, powerpanel business local / remote +2 moreImproper privilege management vulnerability in CyberPower PowerPanel Business9.1 Critical
- cyberpower powerpanel, powerpanel business management, powerpanel business local / remote +2 moreUnrestricted upload of file with dangerous type vulnerability in CyberPower PowerPanel Business9.1 Critical
- cyberpower powerpanel, powerpanel business management, powerpanel business local / remote +2 moreUse of default password vulnerability in CyberPower PowerPanel Business9.4 Critical
- zyxel atp series firmware, nwa110ax firmware, usg flex 50(w) firmware +53 more +55 moreA post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series...6.5 Medium
- zyxel atp series firmware, usg flex 50(w) firmware, usg flex series firmware +20 more +22 moreA buffer overflow vulnerability in the “sdwan_iface_ipc” binary of Zyxel ATP series firmware...7.5 High
- zyxel atp series firmware, usg flex 50(w) firmware, usg flex series firmware +20 more +22 moreThe configuration parser of Zyxel ATP series firmware versions 5.10 through 5.35, USG FLEX series...8.1 High
- zyxel usg flex 50(w) firmware, usg flex series firmware, usg20(w)-vpn firmware +13 more +15 moreA buffer overflow vulnerability in the “fbwifi_forward.cgi” CGI program of Zyxel USG FLEX series...7.5 High
- zyxel usg flex series firmware, vpn series firmware, usg flex 100 firmware +10 more +12 moreA path traversal vulnerability in the “account_print.cgi” CGI program of Zyxel USG FLEX series...7.2 High
- zyxel usg flex series firmware, vpn series firmware, usg flex 100 firmware +10 more +12 moreA post-authentication command injection vulnerability in the “account_operator.cgi” CGI program...8.1 High
- alf, alfio-event alfio-event/alf.io +1 moreAuthorization Bypass Through User-Controlled Key in alfio-event/alf.io8.8 High
- alf, alfio-event alfio-event/alf.io +1 moreImproper Neutralization of Special Elements Used in a Template Engine in alfio-event/alf.io9.1 Critical
- alf, alfio-event alfio-event/alf.io +1 moreImproper Neutralization of Formula Elements in a CSV File in alfio-event/alf.io8.8 High
- eemeli eemeli/yaml, yaml project yaml +1 moreUncaught Exception in eemeli/yaml7.5 High
- linuxfoundation open cluster managementA flaw was found in the Open Cluster Management (OCM) when a user have access to the worker nodes...6.7 Medium
- linux kernel, redhat enterprise linux +1 moreA flaw was found in the Linux kernel's netdevsim device driver, within the scheduling of events....4.4 Medium
- linux kernel, debian linux, netapp h300s firmware +5 more +7 moreThe specific flaw exists within the DPT I2O Controller driver. The issue results from the lack of...7.8 High
- linux kernel, netapp hci baseboard management controller +1 moreA race condition was found in the Linux kernel's RxRPC network protocol, within the processing of...7.0 High
- apple ipados, macos, safari +1 more +3 moreImportant: webkit2gtk3 security and bug fix update8.8 High
- mybb active threadsIn the Active Threads Plugin 1.3.0 for MyBB, the activethreads.php date parameter is vulnerable...6.1 Medium
- vi-solutions visforms, visforms base package for joomla 3 +1 moreExtension - vi-solutions - Visforms Base Package for Joomla 39.8 Critical
- online pizza ordering system project pizza ordering system, sourcecodester online pizza ordering system +1 moreSourceCodester Online Pizza Ordering System unrestricted upload6.3 Medium
- trinitronic nice paypal button liteWordPress Nice PayPal Button Lite Plugin <= 1.3.5 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- nicolas zeh php execution, php execution project execution +1 moreWordPress PHP Execution Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- krishaweb add multiple markerWordPress Add Multiple Marker Plugin <= 1.2 is vulnerable to Cross Site Request Forgery (CSRF)5.4 Medium
- arete-it activity reactions for buddypressWordPress Activity Reactions For Buddypress Plugin <= 1.0.22 is vulnerable to Cross Site Request Forgery (CSRF)4.3 Medium
- ian haycox motor racing league, motor racing league project racing league +1 moreWordPress Motor Racing League Plugin <= 1.9.9 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- electric studio client login project studio client login, james irving-swift electric studio client login +1 moreWordPress Electric Studio Client Login Plugin <= 0.8.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- wpchill cpo content typesWordPress CPO Content Types Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- davinder singh custom settingsWordPress WordPress Custom Settings Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- sitemap index project index, twardes sitemap index +1 moreWordPress Sitemap Index Plugin <= 1.2.3 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- simple pdf viewer project pdf viewer, webarea | vera nedvyzhenko simple pdf viewer +1 moreWordPress Simple PDF Viewer Plugin <= 1.9 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- google maps v3 shortcode maps v3 shortcodeWordPress Google Maps v3 Shortcode Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- george gecewicz portfolio slideshow, portfolio slideshow project slideshow +1 moreWordPress Portfolio Slideshow Plugin <= 1.13.0 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- tc ultimate wp query search filter, ultimate wp query search filter project wp query search filter +1 moreWordPress Ultimate WP Query Search Filter Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- blueglass jobs for wordpressWordPress Jobs for WordPress Plugin <= 2.5.11.2 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- Show moreLoading…