CVEs published February 13, 2023
119 CVEs were published on February 13, 2023: 11 critical, 27 high. 1 is now in CISA KEV.
- Published
- 119
- Critical
- 11
- High
- 27
- Medium
- 71
- Low
- 6
- Unrated
- 4
- Now in CISA KEV
- 1
- Fix available
- 66
Most affected products
- libtiff
- 10
- JTEKT ELECTRONICS Screen Creator Advance
- 7
- GitLab
- 4
- nextcloud security-advisories
- 4
- gpac/gpac
- 3
- ownCloud Android
- 2
- Simple URLs
- 2
- TemplatesNext ToolKit
- 2
- Acronis Agent · Acronis Cyber Protect
- 1
- Acronis Cyber Protect Home Office · Acronis Agent +1
- 1
Critical 11
- CVE-2023-23551X-600M Code InjectionControl By Web X-600M devices
- CVE-2022-4445FL3R FeelBox <= 8.1 - Unauthenticated SQLiFL3R FeelBox
- CVE-2022-40022Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
- CVE-2022-47034A type juggling vulnerability in the component /auth/fn.php of PlaySMS v1.4.5 and earlier allows attackers to bypass authentication.
- CVE-2022-48322NETGEAR Nighthawk WiFi Mesh systems and routers are affected by a stack-based buffer overflow vulnerability.
- CVE-2022-48323Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue.
- CVE-2023-22854The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download…
- CVE-2023-24084ChiKoi v1.0 was discovered to contain a SQL injection vulnerability via the load_file function.
- CVE-2023-24188ureport v2.2.9 was discovered to contain a directory traversal vulnerability via the deletion function which allows for arbitrary files to…com.bstek.ureport:ureport2-core
- CVE-2023-24646An arbitrary file upload vulnerability in the component /fos/admin/ajax.php of Food Ordering System v2.0 allows attackers to execute…
- CVE-2023-25717Ruckus Wireless Admin through 10.4 allows Remote Code Execution via an unauthenticated HTTP GET Request, as demonstrated by a /forms/doLogin
High 27
- CVE-2023-0262WP Airbnb Review Slider < 3.3 - Subscriber+ SQLiWP Airbnb Review Slider
- CVE-2023-0080Customer Reviews for WooCommerce < 5.16.0 - Contributor+ LFICustomer Reviews for WooCommerce
- CVE-2023-0255Enable Media Replace < 4.0.2 - Author+ Arbitrary File UploadEnable Media Replace
- CVE-2023-0259WP Google Review Slider < 11.8 - Subscriber+ SQLiWP Google Review Slider
- CVE-2023-0098Simple URLs < 115 - Subscriber+ SQLiSimple URLs
- CVE-2022-4546Mapwiz <= 1.0.1 - Admin+ SQLiMapwiz
- CVE-2023-0260WP Review Slider < 12.2 - Subscriber+ SQLiWP Review Slider
- CVE-2023-0261WP TripAdvisor Review Slider < 10.8 - Subscriber+ SQLiWP TripAdvisor Review Slider
- CVE-2023-0220Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLiPinpoint Booking System
- CVE-2022-43460Driver Distributor v2.2.3.1 and earlier contains a vulnerability where passwords are stored in a recoverable format.FUJIFILM Business Innovation Driver Distributor
- CVE-2022-45725Improper Input Validation in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to execute arbitrary code on…
- CVE-2022-48077Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute…
- CVE-2023-0810Cross-site Scripting (XSS) - Stored in btcpayserver/btcpayserverbtcpayserver/btcpayserver
- CVE-2023-0817Buffer Over-read in gpac/gpacgpac/gpac
- CVE-2023-0818Off-by-one Error in gpac/gpacgpac/gpac
- CVE-2023-0819Heap-based Buffer Overflow in gpac/gpacgpac/gpac
- CVE-2023-22345Out-of-bound write vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process…JTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22346Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be…JTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22347Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be…JTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22349Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be…JTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22350Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be…JTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22353Out-of-bound read vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier because the end of data cannot be…JTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22360Use-after free vulnerability exists in Screen Creator Advance 2 Ver.0.1.1.4 Build01 and earlier due to lack of error handling process even…JTEKT ELECTRONICS Screen Creator Advance
- CVE-2023-22362SUSHIRO App for Android outputs sensitive information to the log file, which may result in an attacker obtaining a credential information…AKINDO SUSHIRO CO. SUSHIRO App for Android
- CVE-2023-24647Food Ordering System v2.0 was discovered to contain a SQL injection vulnerability via the email parameter.
Show all 27 entriesShow fewer entries
Medium, low and unrated 81
- CVE-2015-10079juju2143 WalrusIRC parser.js parseLinks cross site scriptingjuju2143 WalrusIRC
- CVE-2022-4905UDX Stateless Media Plugin class-settings.php setup_wizard_interface cross site scriptingUDX Stateless Media Plugin · wpcloud/wp-stateless
- CVE-2023-25572React-Admin vulnerable to Cross-Site-Scripting attack on `<RichTextField>`marmelab react-admin · react-admin +1
- CVE-2023-25162Nextcloud Server vulnerable to SSRF via filter bypass due to lax checking on IPsnextcloud security-advisories
- CVE-2023-25161Nextcloud Server's missing rate limiting on password reset functionality allows sending lots of emailsnextcloud security-advisories
- CVE-2023-25160IDOR Vulnerability in Nextcloud Mailnextcloud security-advisories
- CVE-2023-23553X-400 Cross-Site ScriptingControl By Web X-400 devices
- CVE-2022-41134WordPress Optinly Plugin <= 1.0.15 is vulnerable to Cross Site Request Forgery (CSRF)OptinlyHQ Optinly – Exit Intent, Newsletter Popups, Gamific…
- CVE-2023-25159Nextcloud Server previews are accessible without a watermarknextcloud security-advisories
- CVE-2023-23948ownCloud Android app vulnerable to SQL InjectionownCloud Android
- CVE-2022-3089EnOcean SmartServer Hard-coded credentialsEnOcean Smartserver
- CVE-2023-24804ownCloud Android app vulnerable to Path TraversalownCloud Android
- CVE-2022-4759GigPress < 2.3.28 - Contributor+ Stored XSS via ShortcodeGigPress
- CVE-2022-4562Meks Flexible Shortcodes < 1.3.5 - Contributor+ Stored XSSMeks Flexible Shortcodes
- CVE-2023-0360Location Weather < 1.3.4 - Contributor+ Stored XSSLocation Weather
- CVE-2023-0177Social Like Box and Page by WpDevArt < 0.8.41 - Contributor+ Stored XSSSocial Like Box and Page by WpDevArt
- CVE-2022-4580Twenty20 Image Before-After <= 1.5.9 - Contributor+ Stored XSSTwenty20 Image Before-After
- CVE-2022-4830Paid Memberships Pro < 2.9.9 - Contributor+ Stored XSS via ShortcodePaid Memberships Pro
- CVE-2022-4471YARPP - Yet Another Related Posts Plugin < 5.30.3 - Contributor+ Stored XSSYARPP
- CVE-2022-4488Widgets on Pages < 1.8.0 - Contributor+ Stored XSSWidgets on Pages
- CVE-2022-4682Lightbox Gallery < 0.9.5 - Contributor+ Stored XSS via ShortcodeLightbox Gallery
- CVE-2022-3891WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post AccessWP FullCalendar
- CVE-2022-4745WP Customer Area < 8.1.4 - Unauthorised Actions via CSRFWP Customer Area
- CVE-2023-0034JetWidgets For Elementor < 1.0.14 - Contributor+ Stored XSS via ShortcodeJetWidgets For Elementor
- CVE-2023-0075Amazon JS <= 0.10 - Contributor+ Stored XSSAmazon JS
Show all 81 entriesShow fewer entries
- CVE-2023-0405GPT3 AI Content Writer < 1.4.38 - Subscriber+ Arbitrary Post Content UpdateGPT AI Power: Content Writer & ChatGPT & Image Generator &…
- CVE-2023-0151uTubeVideo Gallery < 2.0.8 - Contributor+ Stored XSSuTubeVideo Gallery
- CVE-2023-0166PickPlugins Product Slider for WooCommerce < 1.13.42 - Contributor+ Stored XSSProduct Slider for WooCommerce by PickPlugins
- CVE-2022-4656WP Visitor Statistics (Real Time Traffic) < 6.5 - Contributor+ Stored XSS via ShortcodeWP Visitor Statistics
- CVE-2023-0275Easy Accept Payments for PayPal < 4.9.10 - Contributor+ Stored XSSEasy Accept Payments for PayPal
- CVE-2023-0263WP Yelp Review Slider < 7.1 - Subscriber+ SQLiWP Yelp Review Slider
- CVE-2022-4512Better Font Awesome < 2.0.4 - Contributor+ Stored XSSBetter Font Awesome
- CVE-2023-0061Judge.me Product Reviews for WooCommerce < 1.3.21 - Contributor+ Stored XSSJudge.me Product Reviews for WooCommerce
- CVE-2023-0333TemplatesNext ToolKit < 3.2.9 - Contributor+ Stored XSSTemplatesNext ToolKit
- CVE-2023-0169Zoho Forms < 3.0.1 - Contributor+ Stored XSSForm plugin for WordPress
- CVE-2022-4458Amr Shortcode Any Widget <= 4.0 - Contributor+ Stored XSSamr shortcode any widget
- CVE-2023-0373Lightweight Accordion < 1.5.15 - Contributor+ Stored XSSLightweight Accordion
- CVE-2022-4551Rich Table of Contents < 1.3.9 - Contributor+ Stored XSSRich Table of Contents
- CVE-2022-4678TemplatesNext ToolKit < 3.2.8 - Contributor+ Stored XSS via ShortcodeTemplatesNext ToolKit
- CVE-2023-0060Responsive Gallery Grid < 2.3.9 - Contributor+ Stored XSSResponsive Gallery Grid
- CVE-2023-0099Simple URLs < 115 - Multiple Reflected XSSSimple URLs
- CVE-2022-4448GiveWP < 2.24.0 - Contributor+ Stored XSSGiveWP
- CVE-2022-4628Easy PayPal Buy Now Button < 1.7.4 - Contributor+ Stored XSS in ShortcodeEasy PayPal Buy Now Button
- CVE-2023-0159Extensive VC Addons for WPBakery page builder < 1.9.1 - Unauthenticated RCEExtensive VC Addons for WPBakery page builder
- CVE-2023-0270YaMaps for WordPress Plugin < 0.6.26 - Contributor+ Stored XSSYaMaps for WordPress Plugin
- CVE-2023-0362Themify Portfolio Post < 1.2.2 - Contributor+ Stored XSSThemify Portfolio Post
- CVE-2022-4783Youtube Channel Gallery <= 2.4 - Contributor+ Stored XSS via ShortcodeYoutube Channel Gallery
- CVE-2023-0379Spotlight Social Feeds < 1.4.3 - Contributor+ Stored XSSSpotlight Social Feeds [Block, Shortcode, and Widget]
- CVE-2022-4473Widget Shortcode <= 0.3.5 - Contributor+ Stored XSSWidget Shortcode
- CVE-2023-0808Deye/Revolt/Bosswerk Inverter Access Point Setting hard-coded passwordDeye Inverter · Revolt Inverter +1
- CVE-2022-45455Local privilege escalation due to incomplete uninstallation cleanup.Acronis Cyber Protect Home Office · Acronis Agent +1
- CVE-2022-45454Sensitive information disclosure due to insecure folder permissions.Acronis Agent · Acronis Cyber Protect
- CVE-2022-34397Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 10.0.0.5 and below contains an authorization…Dell Unisphere for PowerMax
- CVE-2023-23697Dell Command | Intel vPro Out of Band, versions before 4.4.0, contain an arbitrary folder delete vulnerability during uninstallation.Dell Command Update
- CVE-2023-24572Dell Command | Integration Suite for System Center, versions before 6.4.0 contain an arbitrary folder delete vulnerability during…Dell Command Integration Suite for System Center
- CVE-2022-25937Versions of the package glance before 3.0.9 are vulnerable to Directory Traversal that allows users to read files outside the public root…glance
- CVE-2022-3411A lack of length validation in GitLab CE/EE affecting all versions from 12.4 before 15.6.7, 15.7 before 15.7.6, and 15.8 before 15.8.1…GitLab
- CVE-2022-3759An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.3 before 15.6.7, all versions starting from 15.7…GitLab
- CVE-2022-4138A Cross Site Request Forgery issue has been discovered in GitLab CE/EE affecting all versions before 15.6.7, all versions starting from…GitLab
- CVE-2022-45285Vsourz Digital Advanced Contact form 7 DB Versions 1.7.2 and 1.9.1 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-45724Incorrect Access Control in Comfast router CF-WR6110N V2.3.1 allows a remote attacker on the same network to perform any HTTP request to…
- CVE-2022-45962Open Solutions for Education, Inc openSIS Community Edition v8.0 and earlier is vulnerable to SQL Injection via CalendarModal.php.
- CVE-2022-48110CKSource CKEditor 5 35.4.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Full Featured CKEditor5 widget.
- CVE-2023-0518An issue has been discovered in GitLab CE/EE affecting all versions starting from 14.0 before 15.6.7, all versions starting from 15.7…GitLab
- CVE-2023-0795LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3488, allowing attackers to cause a denial-of-service via a…libtiff
- CVE-2023-0796LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3592, allowing attackers to cause a denial-of-service via a…libtiff
- CVE-2023-0797LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and tools/tiffcrop.c:6921…libtiff
- CVE-2023-0798LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3400, allowing attackers to cause a denial-of-service via a…libtiff
- CVE-2023-0799LibTIFF 4.4.0 has an out-of-bounds read in tiffcrop in tools/tiffcrop.c:3701, allowing attackers to cause a denial-of-service via a…libtiff
- CVE-2023-0800LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3502, allowing attackers to cause a denial-of-service via a…libtiff
- CVE-2023-0801LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in libtiff/tif_unix.c:368, invoked by tools/tiffcrop.c:2903 and…libtiff
- CVE-2023-0802LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3724, allowing attackers to cause a denial-of-service via a…libtiff
- CVE-2023-0803LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3516, allowing attackers to cause a denial-of-service via a…libtiff
- CVE-2023-0804LibTIFF 4.4.0 has an out-of-bounds write in tiffcrop in tools/tiffcrop.c:3609, allowing attackers to cause a denial-of-service via a…libtiff
- CVE-2023-22367Ichiran App for iOS versions prior to 3.1.0 and Ichiran App for Android versions prior to 3.1.0 improperly verify server certificates…Betrend Corporation and ICHIRAN Ichiran App for iOS and Ich…
- CVE-2023-24086SLIMS v9.5.2 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component…
- CVE-2023-24619Redpanda before 22.3.12 discloses cleartext AWS credentials.
- CVE-2023-24648Zstore v6.6.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the component /index.php.
- CVE-2023-25241bgERP v22.31 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the Search parameter.
- CVE-2023-25718In ConnectWise Control through 22.9.10032 (formerly known as ScreenConnect), after an executable file is signed, additional instructions…
- CVE-2023-25727In phpMyAdmin before 4.9.11 and 5.x before 5.2.1, an authenticated user can trigger XSS by uploading a crafted .sql file through the…phpmyadmin/phpmyadmin