CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- zohocorp manageengine servicedesk plus, manageengine assetexplorer, manageengine servicedesk plus msp +1 more +3 moreZoho ManageEngine ServiceDesk Plus through 14104 allows admin users to conduct an XXE attack.4.9 Medium
- zohocorp manageengine applications managerZoho ManageEngine Applications Manager through 16390 allows DOM XSS.6.1 Medium
- myq-solution central server, print server +1 moreIncorrect access control in the runReport function of MyQ Solution Print Server before 8.2 Patch...8.8 High
- xpdfreader xpdfBuffer Overflow vulnerability found in XPDF v.4.04 allows an attacker to cause a Denial of...5.5 Medium
- sangoma freepbx linux 7Sangoma FreePBX 1805 through 2302 (when obtained as a ,.ISO file) places AMPDBUSER, AMPDBPASS,...8.1 High
- vinga wr-ac1200 firmwarePassword vulnerability found in Vinga WR-AC1200 81.102.1.4370 and before allows a remote attacker...9.8 Critical
- builderio builderio/qwik, qwik +1 moreCross-Site Request Forgery (CSRF) in builderio/qwik4.7 Medium
- zohocorp manageengine access manager plus, manageengine pam360, manageengine password manager pro +2 moreStatic credentials exist in the PostgreSQL data used in ManageEngine Access Manager Plus (AMP)...7.8 High
- canonical cloud-init, ubuntu linux, fedoraproject fedora +2 moresensitive data exposure in cloud-init logs5.5 Medium
- libminglibming 0.4.8 0.4.8 is vulnerable to Buffer Overflow. In getInt() in decompile.c unknown type may...7.5 High
- fighting cock information system project cock information systemAn issue was discovered in Fighting Cock Information System 1.0, which uses default credentials,...9.8 Critical
- tooljetA cross-site scripting (XSS) vulnerability in ToolJet v1.6.0 allows attackers to execute...5.4 Medium
- tooljetTooljet v1.6 does not properly handle missing values in the API, allowing attackers to...7.5 High
- thecontrolgroup voyagerRemote code execution in Voyager9.8 Critical
- purchase order management system project order management system, sourcecodester purchase order management system +1 moreSourceCodester Purchase Order Management System cross site scripting2.4 Low
- git-for-windows git, git for windows project for windows +1 moreGit CMD erroneously executes `doskey.exe` in the current directory, if it exists7.3 High
- git-for-windows git, git for windows project for windows +1 moreGit for Windows's config file of `connect.exe` is susceptible to malicious placing7.6 High
- matrix-org matrix-react-sdkmatrix-react-sdk vulnerable to HTML injection in search results via plaintext message highlighting5.4 Medium
- winwar inline tweet sharer, winwar media inline tweet sharer – twitter sharing plugin +1 moreWordPress Inline Tweet Sharer – Twitter Sharing Plugin Plugin <= 2.5.3 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- miniorange wordpress social login and register (discord, google, twitter, linkedin), wordpress social login and register \(discord\, google\, twitter\, linkedin\) +1 moreWordPress WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin <= 7.5.14 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- carlos moreira interactive geo maps, interactive geo maps project geo maps +1 moreWordPress Interactive Geo Maps Plugin <= 1.5.8 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- fullworks quick paypal paymentsWordPress Quick Paypal Payments Plugin <= 5.7.25 is vulnerable to Cross Site Scripting (XSS)6.5 Medium
- tim reeves & david stöckl tinymce custom styles, tinymce custom styles project custom styles +1 moreWordPress TinyMCE Custom Styles Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- namithjawahar wp-insertWordPress Wp-Insert Plugin <= 2.5.0 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- hewlett packard enterprise hpe oneview, hpe oneview global dashboard, hp oneview +1 more +3 moreHPE OneView and HPE OneView Global Dashboard appliance dumps may expose authentication tokens5.5 Medium
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreAn HPE OneView appliance dump may expose SNMPv3 read credentials5.5 Medium
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreAn HPE OneView appliance dump may expose FTP credentials for c7000 Interconnect Modules7.1 High
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreAn HPE OneView appliance dump may expose SAN switch administrative credentials7.8 High
- prestashopPrestaShop vulnerable to SQL filter bypass leading to arbitrary write requests using "SQL Manager"10.0 Critical
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreAn HPE OneView appliance dump may expose OneView user accounts5.5 Medium
- george pattihis link juice keeper, link juice keeper project juice keeper +1 moreWordPress Link Juice Keeper Plugin <= 2.0.2 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- hewlett packard enterprise (hpe) hpe oneview, hp oneview +1 moreAn HPE OneView appliance dump may expose proxy credential settings5.5 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in reporting engine of Odoo Community 14.0 through 15.0, and Odoo...7.5 High
- bernhard kux json content importerWordPress JSON Content Importer Plugin <= 1.3.15 is vulnerable to Cross Site Scripting (XSS)5.9 Medium
- odoo, odoo community, enterprise +2 moreA sandboxing issue in Odoo Community 15.0 and Odoo Enterprise 15.0 allows authenticated...8.7 High
- odoo, odoo community, enterprise +2 moreCross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and...6.5 Medium
- odoo, odoo community, enterprise +2 moreCross-site scripting (XSS) issue in Discuss app of Odoo Community 14.0 through 15.0, and Odoo...7.5 High
- odoo, odoo community, enterprise +2 moreImproper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier...5.3 Medium
- odoo, odoo community, enterprise +2 moreCross-site scripting (XSS) issue in Website app of Odoo Community 15.0 and earlier and Odoo...6.5 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier...7.5 High
- odoo, odoo community, enterprise +2 moreA sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows...8.7 High
- odoo, odoo community, enterprise +2 moreA sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows...8.7 High
- odoo, odoo enterprise +1 moreCross-site scripting (XSS) issue in Accounting app of Odoo Enterprise 13.0 through 15.0, allows...6.5 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in Odoo Community 13.0 and earlier and Odoo Enterprise 13.0 and earlier...7.4 High
- odoo, odoo community, enterprise +2 moreA sandboxing issue in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier allows...6.8 Medium
- odoo, odoo community, enterprise +2 moreImproper access control in Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and earlier...7.1 High
- odoo, odoo community, enterprise +2 moreImproper access control in reporting engine of l10n_fr_fec module in Odoo Community 15.0 and...6.5 Medium
- odoo, odoo community, enterprise +2 moreCross-site scripting (XSS) issue Odoo Community 15.0 and earlier and Odoo Enterprise 15.0 and...5.3 Medium
- devolutions remote desktop managerImproper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22...6.5 Medium
- prestashopPrestaShop vulnerable to possible XSS injection through Validate::isCleanHTML method8.6 High
- Show moreLoading…