# CVEs published 2023-01-03

94 CVEs were published on January 3, 2023: 8 critical, 40 high. Days are UTC.

- [CVE-2022-42435](https://cve.now/CVE-2022-42435.md): IBM Business Automation Workflow cross-site request forgery (CVSS 4.3, IBM Business Automation Workflow)
- [CVE-2022-2967](https://cve.now/CVE-2022-2967.md): Prosys OPC UA Simulation Server version prior to v5.3.0-64 and UA Modbus Server versions 1.4.18-5 and prior do not sufficiently protect… (CVSS 6.5, Prosys OPC UA Simulation Server · Prosys OPC UA Modbus Serv…)
- [CVE-2022-43540](https://cve.now/CVE-2022-43540.md): A vulnerability exists in the ClearPass OnGuard macOS agent that allows for an attacker with local macOS instance access to potentially… (CVSS 5.5, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43539](https://cve.now/CVE-2022-43539.md): A vulnerability exists in the ClearPass Policy Manager cluster communications that allow for an attacker in a privileged network position… (CVSS 5.7, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43538](https://cve.now/CVE-2022-43538.md): Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands… (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43537](https://cve.now/CVE-2022-43537.md): Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands… (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-23506](https://cve.now/CVE-2022-23506.md): Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds (CVSS 4.3, spinnaker)
- [CVE-2022-43536](https://cve.now/CVE-2022-43536.md): Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands… (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43535](https://cve.now/CVE-2022-43535.md): A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges. (CVSS 7.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43534](https://cve.now/CVE-2022-43534.md): A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges. (CVSS 7.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43533](https://cve.now/CVE-2022-43533.md): A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges. (CVSS 7.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43532](https://cve.now/CVE-2022-43532.md): A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct… (CVSS 8.0, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43531](https://cve.now/CVE-2022-43531.md): Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct… (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43530](https://cve.now/CVE-2022-43530.md): Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct… (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-44535](https://cve.now/CVE-2022-44535.md): A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote low-privileged authenticated… (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-44534](https://cve.now/CVE-2022-44534.md): A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote authenticated users to run… (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43529](https://cve.now/CVE-2022-43529.md): A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to… (CVSS 4.6, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43528](https://cve.now/CVE-2022-43528.md): Under certain configurations, an attacker can login to Aruba EdgeConnect Enterprise Orchestrator without supplying a multi-factor… (CVSS 4.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43527](https://cve.now/CVE-2022-43527.md): Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote… (CVSS 6.1, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43526](https://cve.now/CVE-2022-43526.md): Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote… (CVSS 6.1, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43525](https://cve.now/CVE-2022-43525.md): Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote… (CVSS 6.1, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43524](https://cve.now/CVE-2022-43524.md): A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote… (CVSS 8.7, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43523](https://cve.now/CVE-2022-43523.md): Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated… (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43522](https://cve.now/CVE-2022-43522.md): Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated… (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43521](https://cve.now/CVE-2022-43521.md): Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated… (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43520](https://cve.now/CVE-2022-43520.md): Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated… (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43519](https://cve.now/CVE-2022-43519.md): Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated… (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-37934](https://cve.now/CVE-2022-37934.md): A potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series. (CVSS 6.8, Hewlett Packard Enterprise (HPE) HPE OfficeConnect 1820 and…)
- [CVE-2022-37933](https://cve.now/CVE-2022-37933.md): A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. (CVSS 7.3, Hewlett Packard Enterprise (HPE) HPE Superdome Flex Server;…)
- [CVE-2023-22456](https://cve.now/CVE-2023-22456.md): ViewVC XSS vulnerability in revision view changed paths (CVSS 6.1, viewvc)
- [CVE-2022-45143](https://cve.now/CVE-2022-45143.md): Apache Tomcat: JsonErrorReportValve escaping (low (no CVSS), Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2022-39947](https://cve.now/CVE-2022-39947.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through… (CVSS 8.6, Fortinet FortiADC)
- [CVE-2022-42471](https://cve.now/CVE-2022-42471.md): An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability \[CWE-113\] In FortiWeb version 7.0.0… (CVSS 5.3, Fortinet FortiWeb)
- [CVE-2022-41336](https://cve.now/CVE-2022-41336.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] in FortiPortal versions 6.0.0 through 6.0.11 and all… (CVSS 6.6, Fortinet FortiPortal)
- [CVE-2022-35845](https://cve.now/CVE-2022-35845.md): Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities \[CWE-78\] in… (CVSS 7.6, Fortinet FortiTester)
- [CVE-2023-0038](https://cve.now/CVE-2023-0038.md): Survey Maker – Best WordPress Survey Plugin \<= 3.1.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, ays-pro Survey Maker)
- [CVE-2022-4663](https://cve.now/CVE-2022-4663.md): Members Import \<= 1.4.2 - Self Cross-Site Scripting (CVSS 5.5, manishkrag Members Import)
- [CVE-2012-10003](https://cve.now/CVE-2012-10003.md): ahmyi RivetTracker cross site scripting (CVSS 3.5, ahmyi RivetTracker)
- [CVE-2022-4871](https://cve.now/CVE-2022-4871.md): ummmmm nflpick-em.com LoadUsers.php \_Load\_Users sql injection (CVSS 4.7, ummmmm nflpick-em.com)
- [CVE-2013-10007](https://cve.now/CVE-2013-10007.md): ethitter WP-Print-Friendly wp-print-friendly.php information disclosure (CVSS 5.3, ethitter WP-Print-Friendly)
- [CVE-2015-10012](https://cve.now/CVE-2015-10012.md): sumocoders FrameworkUserBundle login.html.twig information exposure (CVSS 3.5, sumocoders FrameworkUserBundle · sumocoders/framework-user-…)
- [CVE-2012-10002](https://cve.now/CVE-2012-10002.md): ahmyi RivetTracker css.php changeColor cross site scripting (CVSS 3.5, ahmyi RivetTracker)
- [CVE-2022-43931](https://cve.now/CVE-2022-43931.md): Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows… (CVSS 10.0, Synology VPN Plus Server)
- [CVE-2021-32821](https://cve.now/CVE-2021-32821.md): Regular expression Denial of Service in MooTools (CVSS 6.2, mootools-core · mootools)
- [CVE-2021-32824](https://cve.now/CVE-2021-32824.md): Regular expression Denial of Service in MooTools (CVSS 9.8, Apache Dubbo · org.apache.dubbo:dubbo-parent)
- [CVE-2022-32623](https://cve.now/CVE-2022-32623.md): In mdp, there is a possible out of bounds write due to incorrect error handling. (CVSS 6.7, MediaTek MT6789, MT6855, MT6879, MT6895, MT6983, MT8168, MT…)
- [CVE-2022-32635](https://cve.now/CVE-2022-32635.md): In gps, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, MediaTek MT6580, MT6735, MT6739, MT6753, MT6757, MT6761, MT…)
- [CVE-2022-32636](https://cve.now/CVE-2022-32636.md): In keyinstall, there is a possible out of bounds write due to an integer overflow. (CVSS 6.7, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2022-32637](https://cve.now/CVE-2022-32637.md): In hevc decoder, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…)
- [CVE-2022-32638](https://cve.now/CVE-2022-32638.md): In isp, there is a possible out of bounds write due to a race condition. (CVSS 6.4, MediaTek MT6781, MT6833, MT6853, MT6855, MT6873, MT6877, MT…)
- [CVE-2022-32639](https://cve.now/CVE-2022-32639.md): In watchdog, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6739, MT6768, MT6771, MT6781, MT6785, MT6833, MT…)
- [CVE-2022-32640](https://cve.now/CVE-2022-32640.md): In meta wifi, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2022-32641](https://cve.now/CVE-2022-32641.md): In meta wifi, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2022-32644](https://cve.now/CVE-2022-32644.md): In vow, there is a possible use after free due to a race condition. (CVSS 6.4, MediaTek MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT…)
- [CVE-2022-32645](https://cve.now/CVE-2022-32645.md): In vow, there is a possible information disclosure due to a race condition. (CVSS 4.1, MediaTek MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT…)
- [CVE-2022-32646](https://cve.now/CVE-2022-32646.md): In gpu drm, there is a possible stack overflow due to a missing bounds check. (CVSS 6.7, MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…)
- [CVE-2022-32647](https://cve.now/CVE-2022-32647.md): In ccu, there is a possible out of bounds write due to improper input validation. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983)
- [CVE-2022-32648](https://cve.now/CVE-2022-32648.md): In disp, there is a possible use after free due to a race condition. (CVSS 6.4, MediaTek MT6735, MT6737, MT6739, MT6753, MT6757, MT6761, MT…)
- [CVE-2022-32649](https://cve.now/CVE-2022-32649.md): In jpeg, there is a possible use after free due to a logic error. (CVSS 6.7, MediaTek MT6895, MT6983)
- [CVE-2022-32650](https://cve.now/CVE-2022-32650.md): In mtk-isp, there is a possible use after free due to a logic error. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983)
- [CVE-2022-32651](https://cve.now/CVE-2022-32651.md): In mtk-aie, there is a possible use after free due to a logic error. (CVSS 6.7, MediaTek MT6879, MT6983)
- [CVE-2022-32652](https://cve.now/CVE-2022-32652.md): In mtk-aie, there is a possible use after free due to a logic error. (CVSS 6.7, MediaTek MT6833, MT6853, MT6877, MT6893, MT8791)
- [CVE-2022-32653](https://cve.now/CVE-2022-32653.md): In mtk-aie, there is a possible use after free due to a logic error. (CVSS 6.7, MediaTek MT6789, MT6855, MT6879, MT6983, MT8781)
- [CVE-2022-32657](https://cve.now/CVE-2022-32657.md): In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. (CVSS 6.7, MediaTek MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT…)
- [CVE-2022-32658](https://cve.now/CVE-2022-32658.md): In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. (CVSS 6.7, MediaTek MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT…)
- [CVE-2022-32659](https://cve.now/CVE-2022-32659.md): In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. (CVSS 6.7, MediaTek MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT…)
- [CVE-2022-32664](https://cve.now/CVE-2022-32664.md): In Config Manager, there is a possible command injection due to improper input validation. (CVSS 8.8, MediaTek EN7516, EN7528, EN7529, EN7561, EN7562, EN7580)
- [CVE-2022-32665](https://cve.now/CVE-2022-32665.md): In Boa, there is a possible command injection due to improper input validation. (CVSS 9.8, MediaTek EN7528, EN7580)
- [CVE-2022-3614](https://cve.now/CVE-2022-3614.md): In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication… (CVSS 6.1, Octopus Deploy Octopus Server)
- [CVE-2022-36943](https://cve.now/CVE-2022-36943.md): SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. (CVSS 8.1, SSZipArchive)
- [CVE-2022-38627](https://cve.now/CVE-2022-38627.md): Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL… (CVSS 9.8)
- [CVE-2022-38723](https://cve.now/CVE-2022-38723.md): Gravitee API Management before 3.15.13 allows path traversal through HTML injection. (CVSS 8.6, io.gravitee.apim:gravitee-api-management)
- [CVE-2022-38766](https://cve.now/CVE-2022-38766.md): The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open… (CVSS 8.1)
- [CVE-2022-39039](https://cve.now/CVE-2022-39039.md): aEnrich a+HRD - Server-Side Request Forgery (SSRF) (CVSS 9.8, aEnrich a+HRD)
- [CVE-2022-39040](https://cve.now/CVE-2022-39040.md): aEnrich a+HRD - Path Traversal (CVSS 7.5, aEnrich a+HRD)
- [CVE-2022-39041](https://cve.now/CVE-2022-39041.md): aEnrich a+HRD - SQL Injection (CVSS 9.8, aEnrich a+HRD)
- [CVE-2022-39042](https://cve.now/CVE-2022-39042.md): aEnrich a+HRD - Improper Authentication (CVSS 9.8, aEnrich a+HRD)
- [CVE-2022-40740](https://cve.now/CVE-2022-40740.md): Realtek GPON router - Command Injection (CVSS 7.2, Realtek GPON router)
- [CVE-2022-41645](https://cve.now/CVE-2022-41645.md): Out-of-bounds read vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute… (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server)
- [CVE-2022-42710](https://cve.now/CVE-2022-42710.md): Nice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e devices are… (CVSS 5.4)
- [CVE-2022-43436](https://cve.now/CVE-2022-43436.md): HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Arbitrary File Upload (CVSS 8.8, HWA JIUH DIGITAL TECHNOLOGY EasyTest)
- [CVE-2022-43437](https://cve.now/CVE-2022-43437.md): HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - SQL Injection (CVSS 8.8, HWA JIUH DIGITAL TECHNOLOGY EasyTest)
- [CVE-2022-43438](https://cve.now/CVE-2022-43438.md): HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Incorrect Authorization (CVSS 8.8, HWA JIUH DIGITAL TECHNOLOGY EasyTest)
- [CVE-2022-43448](https://cve.now/CVE-2022-43448.md): Out-of-bounds write vulnerability in V-SFT v6.1.7.0 and earlier and TELLUS v4.0.12.0 and earlier allows a local attacker to obtain the… (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-SFT and…)
- [CVE-2022-44036](https://cve.now/CVE-2022-44036.md): In b2evolution 7.2.5, if configured with admins\_can\_manipulate\_sensitive\_files, arbitrary file upload is allowed for admins, leading to… (CVSS 7.2)
- [CVE-2022-45867](https://cve.now/CVE-2022-45867.md): MyBB before 1.8.33 allows Directory Traversal. (CVSS 7.2)
- [CVE-2022-46304](https://cve.now/CVE-2022-46304.md): ChangingTec ServiSign - Command Injection (CVSS 8.8, ChangingTec ServiSign)
- [CVE-2022-46305](https://cve.now/CVE-2022-46305.md): ChangingTec ServiSign - Path Traversal (CVSS 6.5, ChangingTec ServiSign)
- [CVE-2022-46306](https://cve.now/CVE-2022-46306.md): ChangingTec ServiSign - Path Traversal (CVSS 8.8, ChangingTec ServiSign)
- [CVE-2022-46309](https://cve.now/CVE-2022-46309.md): Galaxy Software Services Corporation. Vitals ESP - Arbitrary Path File Reading (CVSS 6.5, Galaxy Software Services Corporation. Vitals ESP)
- [CVE-2022-46360](https://cve.now/CVE-2022-46360.md): Out-of-bounds read vulnerability in V-SFT v6.1.7.0 and earlier and TELLUS v4.0.12.0 and earlier allows a local attacker to obtain the… (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-SFT and…)
- [CVE-2022-47317](https://cve.now/CVE-2022-47317.md): Out-of-bounds write vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute… (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server)
- [CVE-2022-47618](https://cve.now/CVE-2022-47618.md): Merit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded Credentials (CVSS 9.8, Merit Lilin Ent. Co. AH55B04 DVR firmware · Merit Lilin Ent…)
- [CVE-2022-47908](https://cve.now/CVE-2022-47908.md): Stack-based buffer overflow vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or… (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2023-01-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.