CVEs published in April 2023
2,411 vulnerabilities, 280 critical, 18 exploited.
- ebankitAn issue was discovered in ebankIT before 7. A Denial-of-Service attack is possible through the...7.5 High
- ebankitAn issue was discovered in ebankIT before 7. Document Object Model based XSS exists within the ...6.1 Medium
- aigital wireless-n repeater mini router firmwareA cross-site scripting (XSS) vulnerability in Aigital Wireless-N Repeater Mini_Router v0.131229...5.4 Medium
- eyoucmsEyouCms V1.6.1-UTF8-sp1 is vulnerable to Cross Site Scripting (XSS).6.1 Medium
- wuzhicmswuzhicms v4.1.0 is vulnerable to Cross Site Scripting (XSS) in the Member Center, Account Settings.5.4 Medium
- magicjack a921 firmwareInsecure Permissions vulnerability found in MagicJack A921 USB Phone Jack Rev 3.0 v.1.4 allows a...6.6 Medium
- chshcms mccmsmccms v2.6.3 is vulnerable to Cross Site Request Forgery (CSRF).8.8 High
- owasp modsecurityTrustwave ModSecurity 3.0.5 through 3.0.8 before 3.0.9 allows a denial of service (worker crash...7.5 High
- concretecms concrete cmsMissing rate limit for password resets5.3 Medium
- concretecms concrete cmsStored cross site scripting in RSS displayer2.0 Low
- concretecms concrete cmsConcrete CMS (previously concrete5) is vulnerable to stored XSS in uploaded file and folder names3.5 Low
- concretecms concrete cmsStored cross site scripting on API integration5.5 Medium
- concretecms concrete cmsStored cross site scripting on tags5.4 Medium
- concretecms concrete cmsReflected cross site scripting6.1 Medium
- concretecms concrete cmsStored cross site scripting on saved presets5.4 Medium
- concretecms concrete cmsConcrete CMS (previously concrete5) is vulnerable to possible auth bypass in the jobs section3.3 Low
- concretecms concrete cmsConcrete CMS missing secure cookie parameters5.3 Medium
- concretecms concrete cmsStored cross site scripting via container name5.4 Medium
- wang.market wangmarketSQL injection vulnerability in com.xnx3.wangmarket.plugin.dataDictionary.controller...9.8 Critical
- chshcms mccmsAn issue discovered in mccms 2.6.1 allows remote attackers to cause a denial of service via...6.5 Medium
- chshcms mccmsSQL injection vulnerability in mccms 2.6 allows remote attackers to run arbitrary SQL commands...9.8 Critical
- textpatternAn arbitrary file upload vulnerability in the plugin upload function of Textpattern v4.8.8 allows...8.8 High
- pimcore, pimcore pimcore/pimcore +1 moreCross-site Scripting (XSS) - Stored in pimcore/pimcore6.3 Medium
- lfprojects mlflow, mlflow mlflow/mlflow +1 moreRelative Path Traversal in mlflow/mlflow10.0 Critical
- sage 300Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user...9.8 Critical
- sage 300The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte...7.5 High
- sage 300The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded...7.5 High
- sage 300The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard...9.8 Critical
- sage 300On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer...7.8 High
- boxbillingCross Site Scripting (XSS) vulnerability in BoxBilling 4.19, 4.19.1, 4.20, and 4.21 allows remote...6.1 Medium
- hongcms project hongcmsCross Site Scripting (XSS) vulnerability in HongCMS 3.0 allows attackers to run arbitrary code...6.1 Medium
- wwbn avideoWWBN AVideo vulnerable to OS Command Injection8.8 High
org.bitbucket.b_c:jose4jMavenChosen Ciphertext Attack in Jose4jNo score- pimcore, pimcore pimcore/pimcore +1 moreStored Cross-site Scripting (XSS) in pimcore/pimcore4.0 Medium
- myscada myproCVE-2023-284008.8 High
- myscada myproCVE-2023-287168.8 High
- myscada myproCVE-2023-283848.8 High
- myscada myproCVE-2023-291698.8 High
- myscada myproCVE-2023-291508.8 High
- keysight n8844a, n8844a data analytics web service +1 moreCVE-2023-19679.8 Critical
- ibm maximo asset managementIBM Maximo Asset Management information disclosure5.3 Medium
- microsoft windows 10 version 1507, windows 10 version 1607, windows 10 version 1809 +26 more +28 moreWindows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability8.1 High
- acronis snap deployLocal privilege escalation due to a DLL hijacking vulnerability. The following products are...6.7 Medium
- microsoft edge (chromium-based), edge chromium, edge (chromium-based) extended stable +2 moreMicrosoft Edge (Chromium-based) Security Feature Bypass Vulnerability6.1 Medium
- microsoft edge (chromium-based), edge chromium, edge (chromium-based) extended stable +2 moreMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability5.7 Medium
- 42gears surelock, surelock windows +1 morePlaintext Password in Registry6.5 Medium
- synopsys code dxImpersonation through User-Controlled Token9.8 Critical
- pimcorePimcore Arbitrary File Read in Admin JS CSS files4.4 Medium
- pimcorePimcore SQL Injection Vulnerability in Admin Translations API8.8 High
- pimcorePimcore vulnerable to SQL Injection in Translation Export API8.8 High
- Show moreLoading…