CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- prestashopPrestaShop arbitrary file read vulnerability7.7 High
- contaocontao/core-bundle has path traversal vulnerability in the file manager4.3 Medium
- git, fedoraproject fedora +1 moreArbitrary configuration injection via `git submodule deinit`7.0 High
- git-for-windows git, git for windows project for windows, fedoraproject fedora +2 moreGit looks for localized messages in the wrong place3.3 Low
- git, fedoraproject fedora +1 more"git apply --reject" partially-controlled arbitrary file write7.5 High
- fullworks quick contact formWordPress Quick Contact Form Plugin <= 8.0.3.1 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- oliver schlöbe simple yearly archive, simple yearly archive project yearly archive +1 moreWordPress Simple Yearly Archive Plugin <= 2.1.8 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- nextcloud server, kiteworks security-advisories +1 moreNextcloud Server missing brute force protection for passwords of password protected share links3.1 Low
fwupdSUSESecurity update for fwupdNo scorefwupdopenSUSESecurity update for fwupdNo scorecpython3OSS-FuzzHeap-buffer-overflow in tok_get_normal_modeNo scorelibssh2OSS-FuzzHeap-buffer-overflow in _libssh2_ntohu32No score- mattermost, mattermost server +1 moreArchiving a team broadcasts unsanitized data over WebSockets3.1 Low
- alexander lueken podlove subscribe button, podlove subscribe button +1 moreWordPress Podlove Subscribe button Plugin <= 1.3.7 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- eric teubert archivist – custom archive templates, archivist - custom archive templates project - custom archive templates +1 moreWordPress Archivist – Custom Archive Templates Plugin <= 1.7.4 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- macho themes regina liteWordPress Regina Lite Theme <= 2.0.7 is vulnerable to Cross Site Scripting (XSS)5.4 Medium
- digitalblue click to call or chat buttonsWordPress Click to Call or Chat Buttons Plugin <= 1.4.0 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- denis 微信机器人高级版, wpjam wechat robot +1 moreWordPress 微信机器人高级版 Plugin <= 6.0.1 is vulnerable to Cross Site Scripting (XSS)7.1 High
- apache jenaApache Jena: Exposure of arbitrary execution in script engine expressions.5.4 Medium
- dradisframework dradisDradis before 4.8.0 allows persistent XSS by authenticated author users, related to avatars.8.7 High
- apptainer, redhat enterprise linux, sylabs singularity +2 moreUnpatched extfs vulnerabilities are exploitable through suid-mode Apptainer7.1 High
- pearadmin pear admin bootA cross-site scripting (XSS) vulnerability in Pear-Admin-Boot up to v2.0.2 allows attackers to...5.4 Medium
- aigital wireless-n repeater mini router firmwareAigital Wireless-N Repeater Mini_Router v0.131229 was discovered to contain a remote code...9.8 Critical
- yasm project yasmYASM v1.3.0 was discovered to contain a heap overflow via the function handle_dot_label at /nasm...5.5 Medium
- craftcms craft cmsCross Site Scripting in CraftCMS6.1 Medium
- medicine tracker system project tracker systemMedicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS).6.1 Medium
- medicine tracker system project tracker systemSourcecodester Medicine Tracker System in PHP 1.0.0 is vulnerable to Cross Site Scripting (XSS)...6.1 Medium
- sengled e1e-g7f firmwareSengled Dimmer Switch V0.0.9 contains a denial of service (DOS) vulnerability, which allows a...7.5 High
- zyxel atp series firmware, usg flex series firmware, vpn series firmware +21 more +23 moreImproper error message handling in Zyxel ZyWALL/USG series firmware versions 4.60 through 4.73,...9.8 Critical
- ask for a quote project for a quoteSQL injection vulnerability found in PrestaShop askforaquote v.5.4.2 and before allow a remote...9.8 Critical
- shanling mtouch os, eddict player +1 moreA vulnerability in the Wi-Fi file transfer module of Shanling M5S Portable Music Player with...9.8 Critical
- churchcrmA stored Cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers to...5.4 Medium
- churchcrmA cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to change...6.5 Medium
- churchcrmA cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to set a...5.3 Medium
- churchcrmA cross-site request forgery (CSRF) vulnerability in ChurchCRM v4.5.3 allows attackers to edit...4.3 Medium
- prometheus blackbox exporterWithdrawn Advisory: Access control issues in blackbox_exporter7.5 High
- northern.tech cfengineNorthern.tech CFEngine Enterprise before 3.21.1 allows a subset of authenticated users to...6.5 Medium
- telindus apsalAn issue was discovered in the Open Document feature in Telindus Apsal 3.14.2022.235 b. An...8.2 High
- nokia netactAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to a Performance...6.5 Medium
- nokia netactAn XXE issue was discovered in Nokia NetAct before 22 FP2211 via an XML document to the...6.5 Medium
- churchcrmChurchCRM 4.5.3 was discovered to contain a CSV injection vulnerability via the Last Name and...7.8 High
- churchcrmA stored cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3, allows remote attackers to...5.4 Medium
- churchcrmA reflected cross-site scripting (XSS) vulnerability in ChurchCRM 4.5.3 allows remote attackers...6.1 Medium
- wwbn avideoCross Site Scripting (XSS) vulnerability in World Wide Broadcast Network AVideo before 12.4,...6.1 Medium
- arista eos, arista networks terminattr, arista ceos-lab +2 more +4 moreOn affected platforms running Arista EOS, an authorized attacker with permissions to perform gNMI requests could craft a request allowing it to update arbitrary configurations in the switch.8.8 High
- solarwinds platformSolarWinds Platform Exposure of Sensitive Information Vulnerability6.5 Medium
- solarwinds database performance analyzerDirectory traversal and file enumeration vulnerability: Database Performance Analyzer (DPA) 2023.16.5 Medium
- solarwinds database performance analyzerNo Exception Handling Vulnerability: Database Performance Analyzer (DPA) 2023.17.5 High
- debian linux, linux kernel, fedoraproject fedora +5 more +7 moreA denial of service problem was found, due to a possible recursive locking scenario, resulting in...4.4 Medium
- vmware fusion, workstation +1 moreVMware Workstation and Fusion contain an out-of-bounds read/write vulnerability in SCSI CD/DVD...8.8 High
- Show moreLoading…