# CVEs published 2023-01-01

23 CVEs were published on January 1, 2023: 2 critical, 4 high. Days are UTC.

- [CVE-2021-4297](https://cve.now/CVE-2021-4297.md): trampgeek jobe Restapi.php runs\_post Privilege Escalation (CVSS 5.5, trampgeek jobe)
- [CVE-2015-10006](https://cve.now/CVE-2015-10006.md): admont28 Ingnovarq insertarSliderAjax.php cross site scripting (CVSS 3.5, admont28 Ingnovarq)
- [CVE-2013-10006](https://cve.now/CVE-2013-10006.md): Ziftr primecoin bitcoinrpc.cpp HTTPAuthorized timing discrepancy (CVSS 2.6, Ziftr primecoin)
- [CVE-2010-10002](https://cve.now/CVE-2010-10002.md): SimpleSAMLphp simplesamlphp-module-openid OpenID consumer.php cross site scripting (CVSS 3.1, simplesamlphp-module-openid · simplesamlphp/simplesamlphp-m…)
- [CVE-2023-0029](https://cve.now/CVE-2023-0029.md): Multilaser RE708 Telnet Service denial of service (CVSS 5.3, Multilaser RE708)
- [CVE-2014-125030](https://cve.now/CVE-2014-125030.md): taoeffect Empress hard-coded password (CVSS 6.3, taoeffect Empress)
- [CVE-2018-25063](https://cve.now/CVE-2018-25063.md): Zenoss Dashboard defaultportlets.js cross site scripting (CVSS 3.5, Zenoss Dashboard)
- [CVE-2018-25062](https://cve.now/CVE-2018-25062.md): flar2 ElementalX ipsec xfrm\_user.c xfrm\_dump\_policy\_done denial of service (CVSS 3.5, flar2 ElementalX)
- [CVE-2021-41823](https://cve.now/CVE-2021-41823.md): The Web Application Firewall (WAF) in Kemp LoadMaster 7.2.54.1 allows certain uses of onmouseover to bypass an XSS protection mechanism. (CVSS 6.1)
- [CVE-2022-34322](https://cve.now/CVE-2022-34322.md): Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the conte (CVSS 9.0)
- [CVE-2022-34323](https://cve.now/CVE-2022-34323.md): Multiple XSS issues were discovered in Sage XRT Business Exchange 12.4.302 that allow an attacker to execute JavaScript code in the context (CVSS 5.4)
- [CVE-2022-34324](https://cve.now/CVE-2022-34324.md): Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add (CVSS 8.8)
- [CVE-2022-37785](https://cve.now/CVE-2022-37785.md): An issue was discovered in WeCube Platform 3.2.2. (CVSS 7.5)
- [CVE-2022-37786](https://cve.now/CVE-2022-37786.md): An issue was discovered in WeCube Platform 3.2.2. (CVSS 6.3)
- [CVE-2022-37787](https://cve.now/CVE-2022-37787.md): An issue was discovered in WeCube platform 3.2.2. (CVSS 6.1)
- [CVE-2022-40711](https://cve.now/CVE-2022-40711.md): PrimeKey EJBCA 7.9.0.2 Community allows stored XSS in the End Entity section. (CVSS 4.8)
- [CVE-2022-45027](https://cve.now/CVE-2022-45027.md): perfSONAR before 4.4.6, when performing participant discovery, incorrectly uses an HTTP request header value to determine a local address. (CVSS 5.3)
- [CVE-2022-45213](https://cve.now/CVE-2022-45213.md): perfSONAR before 4.4.6 inadvertently supports the parse option for a file:// URL. (CVSS 5.3)
- [CVE-2022-47634](https://cve.now/CVE-2022-47634.md): M-Link Archive Server in Isode M-Link R16.2v1 through R17.0 before R17.0v24 allows non-administrative users to access and manipulate archive (CVSS 8.1)
- [CVE-2022-47952](https://cve.now/CVE-2022-47952.md): lxc-user-nic in lxc through 5.0.1 is installed setuid root, and may allow local users to infer whether any file exists, even within a protec (CVSS 3.3)
- [CVE-2022-48198](https://cve.now/CVE-2022-48198.md): The ntpd\_driver component before 1.3.0 and 2.x before 2.2.0 for Robot Operating System (ROS) allows attackers, who control the source code o (CVSS 9.8)
- [CVE-2023-0028](https://cve.now/CVE-2023-0028.md): Cross-site Scripting (XSS) - Stored in linagora/twake (CVSS 5.7, linagora/twake)
- [CVE-2023-22551](https://cve.now/CVE-2023-22551.md): The FTP (aka "Implementation of a simple FTP client and server") project through 96c1a35 allows remote attackers to cause a denial of servic (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.