CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- aenrich a+hrd, a\+hrd +1 moreaEnrich a+HRD - Deserialization of Untrusted Data9.8 Critical
- aenrich a+hrd, a\+hrd +1 moreaEnrich a+HRD - Deserialization of Untrusted Data9.8 Critical
- nanoleaf firmwareNanoleaf firmware v7.1.1 and below is missing an SSL certificate, allowing attackers to execute...9.8 Critical
- docker desktopDocker Desktop for Windows before 4.6 allows attackers to overwrite any file through the...6.3 Medium
- docker desktopDocker Desktop for Windows before 4.6.0 allows attackers to delete (or create) any file through...7.8 High
- docker desktopDocker Desktop for Windows before 4.6.0 allows attackers to overwrite any file through a symlink...7.1 High
- docker desktopDocker Desktop before 4.6.0 on Windows allows attackers to delete any file through the hyperv...7.1 High
- infopop ultimate bulletin boardInfopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside...5.3 Medium
- cozmoslabs profile builder, user profile builder – beautiful user registration forms, user profiles & user role editor +1 moreProfile Builder – User Profile & User Registration Forms <= 3.9.0 - Insecure Password Reset Mechanism9.8 Critical
- visam vbaseCVE-2022-458765.5 Medium
- microsoft typed-rest-clienttyped-rest-client vulnerable to potential leak of authentication data to 3rd parties9.1 Critical
- google espv2, googlecloudplatform esp-v2 +1 moreESPv2 vulnerable to JWT authentication bypass via `X-HTTP-Method-Override` header8.2 High
- acronis agentDenial of service due to unauthenticated API endpoint. The following products are affected:...3.3 Low
- payloadcms payloadPayload's hidden fields can be leaked on readable collections7.4 High
github.com/ory/oathkeeperGoHop-by-hop abuse to malform header mutatorNo scorewwbn/avideoPackagistCross site scripting (XSS) in wwbn/avideoNo score- hcl software workload automationHCL Workload Automation is vulnerable to XML External Entity (XXE) Injection6.5 Medium
- hcl software workload automationHCL Workload Automation is vulnerable to XML External Entity (XXE) Injection7.1 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 denial of service5.3 Medium
- linuxfoundation baremetal operator, metal3-io baremetal-operator +1 moreIronic and ironic-inspector deployed within Baremetal Operator may expose as ConfigMaps6.0 Medium
- contiki-ngContiki-NG has off-by-one error in Antelope DBMS9.8 Critical
- debian linux, linux kernel +1 moreSpectre V1 Gadget in do_prlimit in the Linux Kernel5.3 Medium
- tibco spotfire statistics servicesTIBCO Spotfire Statistics Services Unrestricted File Upload Vulnerability9.8 Critical
silverstripe/adminPackagistCross-site scripting vulnerabilities in old version of bundled TinyMCE5.4 Mediumopenssl-ibmcaSUSESecurity update for openssl-ibmcaNo scoreopenssl-ibmcaopenSUSESecurity update for openssl-ibmcaNo scoremongooseOSS-FuzzHeap-buffer-overflow in mg_mqtt_parseNo score- silverstripe framework, silverstripe-framework +1 moreSilverstripe Framework has open redirect vulnerability on CMSSecurity relogin screen5.4 Medium
- silverstripe framework, silverstripe-framework +1 moreSilverstripe Framework has missing permission check of canView in GridFieldPrintButton4.3 Medium
- grafana, grafana enterprise +1 moreGrafana is an open-source platform for monitoring and observability. Starting with the 9.1...4.2 Medium
- ibm db2, db2 for linux, unix and windows +1 moreIBM Db2 code execution7.2 High
- ibm aix, vios +1 moreIBM AIX privilege escalation8.4 High
- rapid7 insight agentRapid7 Insight Agent Directory Traversal5.8 Medium
- ucms project ucmsUCMS Column Configuration saddpost.php cross site scripting3.5 Low
firefoxUbuntufirefox regressionsNo score- ibm cloud pak for dataIBM Cloud Pak for Data file upload7.2 High
- ibm spectrum scale container native storage accessIBM Spectrum Scale privilege escalation7.9 High
- tencent vconsolePrototype Pollution in vConsole9.8 Critical
- netgear r6700 firmware, r6900 firmware +1 moreBuffer Overflow vulnerability found in Netgear R6900 v.1.0.2.26, R6700v3 v.1.0.4.128, R6700 v.1.0...9.8 Critical
- cltphpCLTPHP <=6.0 is vulnerable to Improper Input Validation via application/admin/controller/Template...8.1 High
- cltphpCLTPHP <=6.0 is vulnerable to Cross Site Scripting (XSS) via application/home/controller/Changyan...6.1 Medium
- cltphpCLTPHP <=6.0 is vulnerable to Unrestricted Upload of File with Dangerous Type.8.8 High
- cltphpCLTPHP <=6.0 is vulnerable to Directory Traversal.6.5 Medium
- ourphpOURPHP <= 7.2.0 is vulnerale to Cross Site Scripting (XSS) via /client/manage/ourphp_out.php.6.1 Medium
- ourphpOURPHP <= 7.2.0 is vulnerable to SQL Injection.9.8 Critical
- ourphpOURPHP <= 7.2.0 is vulnerable to Cross Site Scripting (XSS) via ourphp_tz.php.6.1 Medium
- medicine tracker system project tracker systemMedicine Tracker System in PHP 1.0.0 is vulnerable to SQL Injection.7.5 High
- exelysis unified communications solutionCross Site Scripting vulnerability found in Exelysis Unified Communication Solutions (EUCS) v.1.0...6.1 Medium
- wondershare dr.foneInsecure Permission vulnerability found in Wondershare Dr.Fone v.12.9.6 allows a remote attacker...7.8 High
- cmix project cmixBuffer Overflow vulnerability found in ByronKnoll Cmix v.19 allows an attacker to execute...7.8 High
- Show moreLoading…