CVEs published January 2, 2023
76 CVEs were published on January 2, 2023: 8 critical, 22 high. 1 is now in CISA KEV.
- Published
- 76
- Critical
- 8
- High
- 22
- Medium
- 31
- Low
- 10
- Unrated
- 5
- Now in CISA KEV
- 1
- Fix available
- 59
Most affected products
- Google Chrome
- 10
- LetsRecover
- 3
- Welcart e-Commerce
- 3
- WP RSS By Publishers
- 3
- 82Flex WEIPDCRM
- 2
- OpenDNS OpenResolve
- 2
- Popup Maker
- 2
- Qe SEO Handyman
- 2
- Web Invoice
- 2
- All-in-One Addons for Elementor
- 1
Critical 8
- CVE-2022-4099Joy Of Text Lite < 2.3.1 - Unauthenticated SQLiJoy Of Text Lite
- CVE-2022-4298Wholesale Market < 2.2.1 - Unauthenticated Arbitrary File DownloadWholesale Market
- CVE-2022-4049WP User <= 7.0 - Unauthenticated SQLiWP User
- CVE-2022-3241Build App Online < 1.0.19 - Unauthenticated SQL InjectionBuild App Online
- CVE-2022-4357LetsRecover < 1.2.0 - Unauthenticated SQLiLetsRecover
- CVE-2022-4059Cryptocurrency Widgets Pack < 2.0 - Unauthenticated SQLiCryptocurrency Widgets Pack
- CVE-2022-4297WP AutoComplete Search <= 1.0.4 - Unauthenticated SQLiWP AutoComplete Search
- CVE-2022-42475A heap-based buffer overflow vulnerability [CWE-122] in FortiOS SSL-VPN 7.2.0 through 7.2.2, 7.0.0 through 7.0.8, 6.4.0 through 6.4.10, 6.2.Fortinet FortiProxy · Fortinet FortiOS
High 22
- CVE-2022-3860Visual Email Designer for WooCommerce < 1.7.2 - Multiple Author+ SQLiVisual Email Designer for WooCommerce
- CVE-2022-4237Welcart e-Commerce < 2.8.6 - Subscriber+ PHAR DeserialisationWelcart e-Commerce
- CVE-2022-4372Web Invoice <= 2.1.3 - Authenticated SQLiWeb Invoice
- CVE-2022-3911iubenda < 3.3.3 - Subscriber+ Privileges Escalation to Adminiubenda | All-in-one Compliance for GDPR / CCPA Cookie Cons…
- CVE-2022-4352Qe SEO Handyman <= 1.0 - Admin+ SQLiQe SEO Handyman
- CVE-2022-4373Quote-O-Matic <= 1.0.5 - Admin+ SQLiQuote-O-Matic
- CVE-2022-4324Custom Field Template < 2.5.8 - Admin+ PHP Object InjectionCustom Field Template
- CVE-2022-4358WP RSS By Publishers <= 0.1 - Admin+ SQLiWP RSS By Publishers
- CVE-2022-4359WP RSS By Publishers <= 0.1 - Admin+ SQLiWP RSS By Publishers
- CVE-2022-4355LetsRecover < 1.2.0 - Admin+ SQLiLetsRecover
- CVE-2022-4302White Label CMS < 2.5 - Admin+ PHP Object InjectionWhite Label CMS
- CVE-2022-4356LetsRecover < 1.2.0 - Admin+ SQLiLetsRecover
- CVE-2022-4360WP RSS By Publishers <= 0.1 - Admin+ SQLiWP RSS By Publishers
- CVE-2022-4140Welcart e-Commerce < 2.8.5 - Unauthenticated Arbitrary File AccessWelcart e-Commerce
- CVE-2022-4370Multimedial Images <= 1.0b - Admin+ SQLimultimedial images
- CVE-2022-4351Qe SEO Handyman <= 1.0 - Admin+ SQLiQe SEO Handyman
- CVE-2022-4371Web Invoice <= 2.1.3 - Authenticated SQLiWeb Invoice
- CVE-2021-30558Insufficient policy enforcement in content security policy in Google Chrome prior to 91.0.4472.77 allowed a remote attacker to bypass contenGoogle Chrome
- CVE-2022-2742Use after free in Exosphere in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced a user tGoogle Chrome
- CVE-2022-2743Integer overflow in Window Manager in Google Chrome on Chrome OS and Lacros prior to 104.0.5112.79 allowed a remote attacker who convinced aGoogle Chrome
- CVE-2022-3460In affected versions of Octopus Deploy it is possible for certain types of sensitive variables to inadvertently become unmasked when viewed Octopus Deploy Octopus Server
- CVE-2022-3842Use after free in Passwords in Google Chrome prior to 105.0.5195.125 allowed a remote attacker who had compromised the renderer process to pGoogle Chrome
Medium, low and unrated 46
- CVE-2022-4260WP-Ban < 1.69.1 - Admin+ Stored XSSWP-Ban
- CVE-2022-4329Product list Widget for Woocommerce <= 1.0 - Reflected XSSProduct list Widget for Woocommerce
- CVE-2022-4057Autoptimize < 3.1.0 - Sensitive Data DisclosureAutoptimize
- CVE-2022-4256All-in-One Addons for Elementor - WidgetKit < 2.4.4 - Admin+ Stored XSSAll-in-One Addons for Elementor
- CVE-2022-4200Login with Cognito <= 1.4.8 - Admin+ Stored XSSLogin with Cognito
- CVE-2022-4369WP-Lister Lite for Amazon < 2.4.4 - Reflected XSSWP-Lister Lite for Amazon
- CVE-2022-4109Wholesale Market for WooCommerce < 2.0.0 - Admin+ Arbitrary Log DownloadWholesale Market for WooCommerce
- CVE-2022-4236Welcart e-Commerce < 2.8.5 - Subscriber+ Arbitrary File AccessWelcart e-Commerce
- CVE-2022-4114Superio - Job Board < 1.2.33 - Subscriber+ Stored Cross-Site ScriptingSuperio
- CVE-2022-4417WP Cerber < 9.3.3 - User Enumeration Bypass via Rest APIWP Cerber Security, Anti-spam & Malware Scan
- CVE-2022-4381Popup Maker < 1.16.9 - Contributor+ Stored XSS via Subscription FormPopup Maker
- CVE-2022-4362Popup Maker < 1.16.9 - Contributor+ Stored XSS via ShortcodePopup Maker
- CVE-2022-3936Team Members < 5.2.1 - Editor+ Stored XSSTeam Members
- CVE-2022-4119Image Optimizer, Resizer and CDN < 6.8.1 - Admin+ Stored XSSImage Optimizer, Resizer and CDN
- CVE-2022-3994Authenticator < 1.3.1 - Subscriber+ Denial of Service via Feed Token DisclosureAuthenticator
- CVE-2022-4142WordPress Filter Gallery Plugin < 0.1.6 - Admin+ Stored XSSWordPress Filter Gallery Plugin
- CVE-2022-4340BookingPress < 1.0.31 - Unauthenticated IDOR in appointment_idBookingPress
- CVE-2022-4198WP Social Sharing <= 2.2 - Admin+ Stored XSSWP Social Sharing
- CVE-2015-10011OpenDNS OpenResolve endpoints.py neutralization for logsOpenDNS OpenResolve
- CVE-2015-10010OpenDNS OpenResolve API endpoints.py get cross site scriptingOpenDNS OpenResolve
- CVE-2023-22452Improper Input Validation in kenny2automateKenny2github kenny2automate
- CVE-2016-15007Centralized-Salesforce-Dev-Framework SOQL SObjectService.cls SObjectService injectionCentralized-Salesforce-Dev-Framework
- CVE-2014-125038IS_Projecto2 NewsBean.java sql injectionIS_Projecto2
- CVE-2014-125037License to Kill injury.rb sql injectionLicense to Kill
- CVE-2014-125036drybjed ansible-ntp main.yml amplificationdrybjed ansible-ntp
- CVE-2014-125035Jobs-Plugin cross site scriptingJobs-Plugin
- CVE-2023-22451Weak password requirements in Kiwi TCMSkiwitcms Kiwi
- CVE-2017-20161rofl0r MacGeiger ESSID macgeiger.c dump_wlan_at injectionrofl0r MacGeiger
- CVE-2015-10009nterchange code_caller_controller.php getContent code injectionnterchange · nonfiction/nterchange
- CVE-2015-1000882Flex WEIPDCRM sql injection82Flex WEIPDCRM
- CVE-2015-1000782Flex WEIPDCRM cross site scripting82Flex WEIPDCRM
- CVE-2014-125034stiiv contact_app View.php render cross site scriptingstiiv contact_app
- CVE-2019-25093dragonexpert Recent Threads on Index Setting hooks.php recentthread_list_threads cross site scriptingdragonexpert Recent Threads on Index
- CVE-2016-15006enigmaX Scrambling Table main.c getSeed prng seedenigmaX
- CVE-2021-4299cronvel string-kit naturalSort.js naturalSort redoscronvel string-kit · string-kit
- CVE-2021-4298Hesburgh Libraries of Notre Dame Sipity search_criteria_for_works_parameter.rb SearchCriteriaForWorksParameter sql injectionHesburgh Libraries of Notre Dame Sipity
- CVE-2014-125033rails-cv-app uploaded_files_controller.rb path traversalrails-cv-app
- CVE-2014-125032porpeeranut go-with-me add.php sql injectionporpeeranut go-with-me
- CVE-2014-125031kirill2485 TekNet loggedin.php cross site scriptingkirill2485 TekNet
- CVE-2019-13768Use after free in FileAPI in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via a craGoogle Chrome
- CVE-2021-21200Out of bounds read in WebUI Settings in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to perform an out of bounds memory reaGoogle Chrome
- CVE-2022-0337Inappropriate implementation in File System API in Google Chrome on Windows prior to 97.0.4692.71 allowed a remote attacker to obtain potentGoogle Chrome
- CVE-2022-0801Inappropriate implementation in HTML parser in Google Chrome prior to 99.0.4844.51 allowed a remote attacker to bypass XSS preventions via aGoogle Chrome
- CVE-2022-3863Use after free in Browser History in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption vGoogle Chrome
- CVE-2022-4025Inappropriate implementation in Paint in Google Chrome prior to 98.0.4758.80 allowed a remote attacker to leak cross-origin data outside an Google Chrome
- CVE-2022-48197Reflected cross-site scripting (XSS) exists in Sandbox examples in the YUI2 repository.