CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- vmware fusionVMware Fusion contains a local privilege escalation vulnerability. A malicious actor with read...7.8 High
- vmware fusion, workstation +1 moreVMware Workstation and Fusion contain an out-of-bounds read vulnerability that exists in the...6.0 Medium
- vmware fusion, workstation +1 moreVMware Workstation (17.x) and VMware Fusion (13.x) contain a stack-based buffer-overflow...8.2 High
- pwsdashboard personal weather station dashboardPWS Personal Weather Station Dashboard (PWS_Dashboard) LTS December 2020 (2012_lts) allows remote...7.2 High
- xen, fedoraproject fedora +1 morex86 shadow paging arbitrary pointer dereference In environments where host assisted address...7.8 High
- pingidentity desktop, ping identity pingid desktop for macos, pingid desktop for windows +2 morePingID Desktop PIN attempt lockout bypass.7.3 High
- ping identity pingfederateCross-Site Request Forgery on PingFederate Local Identity Profiles Endpoint.6.4 Medium
- ping identity pingid radius pcv, pingidentity pingfederate, radius pcv +3 more +5 moreConfiguration-based MFA Bypass in PingID RADIUS PCV.6.5 Medium
- ping identity pingid adapter for pingfederate, pingidentity pingfederate, ping identity pingfederate (includes pingid adapter) +2 more +4 moreMisconfiguration of RSA padding for offline MFA in the PingID Adapter for PingFederate.7.7 High
- laravel frameworkThe authentication method in Laravel 8.x through 9.x before 9.32.0 was discovered to be...5.3 Medium
- nokia one-network directory serverNokia OneNDS 17r2 has Insecure Permissions vulnerability that allows for privilege escalation.7.8 High
- pingidentity pingid integration for windows login, ping identity unspecified +1 morePingID integration for Windows login duplicate username collision.3.8 Low
- arc2 project arc2ARC (aka ARC2) through 2011-12-01 allows reflected XSS via the end_point.php query parameter in...5.3 Medium
- arc2 project arc2ARC (aka ARC2) through 2011-12-01 allows blind SQL Injection in getTriplePatternSQL in...9.8 Critical
- suse rancherRancher Webhook is misconfigured during upgrade process9.9 Critical
- vyperlang vyperVyper's raw_call with outsize=0 and revert_on_failure=False returns incorrect success value7.5 High
- kiwitcms kiwi, kiwi tcms +1 moreKiwi TCMS has command injection vulnerability in changelog.yml CI workflow8.8 High
- embano1 wipArbitrary command injection in embano1/wip8.8 High
- jellyfin, jellyfin jellyfin-web +1 morejellyfin-web has a stored cross-site scripting vulnerability in devices.js9.1 Critical
- jellyfinJellyfin vulnerable to directory traversal and file write causing arbitrary code execution8.8 High
- getlaminas laminas-diactoros, fedoraproject fedora, guzzlephp psr-7 +2 moreLaminas Diactoros vulnerable to HTTP Multiline Header Termination7.5 High
- devolutions workspace, workspace desktop +1 moreAuthentication Bypass in Hub Business integration in Devolutions Workspace Desktop 2023.1.1.3 and...7.8 High
- rextheme wp vrWP VR < 8.3.0 - Subscriber+ Arbitrary Tour Update4.3 Medium
- unknown custom post type uiCustom Post Type UI < 1.13.5 - Debug Info Sending via CSRF6.5 Medium
- unknown video central for wordpress, video central project central +1 moreVideo Central for WordPress <= 1.3.0 - Contributor+ Stored XSS5.4 Medium
- unknown ajax search pro, wp-dreams ajax search +1 moreAjax Search Lite Pro < 4.26.2 - Multiple Reflected Cross-Site Scripting6.1 Medium
- ms-reviews project ms-reviewsMS-Reviews <= 1.5 - Subscriber+ Stored XSS5.4 Medium
- unknown wpcodeWPCode Lite < 2.0.9 - Arbitrary Log File Deletion via CSRF6.5 Medium
- unknown wp fevents book, wp fevents book project fevents book +1 moreWP FEvents Book <= 0.46 - Subscriber+ Stored XSS5.4 Medium
- random text project text, unknown random text +1 moreRandom Text <= 0.3.0 - Subscriber+ SQLi8.8 High
- unknown easy forms for mailchimpEasy Forms for MailChimp < 6.8.8 - Reflected XSS6.1 Medium
- unknown weaver xtreme theme supportWeaver Xtreme Theme Support < 6.2.7 - Contributor+ Stored XSS5.4 Medium
- unknown wp fevents book, wp fevents book project fevents book +1 moreWP FEvents Book <= 0.46 - Subscriber+ Arbitrary Booking Manipulation via IDOR6.5 Medium
- unknown steveas wp live chat shoutbox, wp live chat shoutbox project live chat shoutbox +1 moreSteveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi9.8 Critical
- unknown steveas wp live chat shoutbox, wp live chat shoutbox project live chat shoutbox +1 moreSteveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated Stored XSS6.1 Medium
- unknown ajax search lite, ajax search pro, wp-dreams ajax search +2 moreAjax Search Lite < 4.11.1, Pro < 4.26.2 - Reflected Cross-Site Scripting6.1 Medium
- custom post type and taxonomy gui manager project post type and taxonomy gui manager, unknown custom post type and taxonomy gui manager +1 moreCustom Post Type and Taxonomy GUI Manager <= 1.1 - Stored XSS via CSRF4.8 Medium
- kau-boy backend localization plugin, kau-boys backend localization +1 moreKau-Boy Backend Localization Plugin backend_localization.php localize_backend cross site scripting3.5 Low
- kau-boy backend localization plugin, kau-boys backend localization +1 moreKau-Boy Backend Localization Plugin backend_localization.php cross site scripting3.5 Low
- shareaholic similar postsWordPress Similar Posts Plugin <= 3.1.6 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- kiwitcms kiwi, kiwi tcms +1 moreKiwi TCMS unrestricted file upload vulnerability8.1 High
- kiwitcms kiwi, kiwi tcms +1 moreKiwi TCMS may allow user to update email address to unverified one3.9 Low
- thethingsnetwork lorawan-stacklorawan-stack has open redirect vulnerability6.1 Medium
- apache supersetApache Superset: Database connection password leak4.9 Medium
- apache supersetApache Superset: Session validation vulnerability when using provided default SECRET_KEY8.9 High
- riot-os riotRIOT-OS vulnerable to Packet Type Confusion during IPHC send9.8 Critical
- riot-os riotRIOT-OS vulnerable to Null Pointer dereference during IPHC encoding7.5 High
- riot-os riotRIOT-OS vulnerable to Integer Underflow during defragmentation7.5 High
- riot-os riotRIOT-OS vulnerable to Integer Underflow during IPHC receive7.5 High
- riot-os riotRIOT-OS vulnerable to Buffer Overflow during IPHC receive9.8 Critical
- Show moreLoading…