CVEs published January 3, 2023
94 CVEs were published on January 3, 2023: 8 critical, 40 high.
- Published
- 94
- Critical
- 8
- High
- 40
- Medium
- 42
- Low
- 4
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 13
Most affected products
- Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- 13
- Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- 11
- aEnrich a+HRD
- 4
- ChangingTec ServiSign
- 3
- FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server
- 3
- HWA JIUH DIGITAL TECHNOLOGY EasyTest
- 3
- MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- 3
- MediaTek MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT…
- 3
- ahmyi RivetTracker
- 2
- FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-SFT and…
- 2
Critical 8
- CVE-2022-43931Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remoteSynology VPN Plus Server
- CVE-2021-32824Regular expression Denial of Service in MooToolsApache Dubbo · org.apache.dubbo:dubbo-parent
- CVE-2022-32665In Boa, there is a possible command injection due to improper input validation.MediaTek EN7528, EN7580
- CVE-2022-38627Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL inj
- CVE-2022-39039aEnrich a+HRD - Server-Side Request Forgery (SSRF)aEnrich a+HRD
- CVE-2022-39041aEnrich a+HRD - SQL InjectionaEnrich a+HRD
- CVE-2022-39042aEnrich a+HRD - Improper AuthenticationaEnrich a+HRD
- CVE-2022-47618Merit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded CredentialsMerit Lilin Ent. Co. AH55B04 DVR firmware · Merit Lilin Ent…
High 40
- CVE-2022-43538Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2022-43537Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2022-43536Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands onHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2022-43535A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges.Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2022-43534A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges.Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2022-43533 A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges.Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2022-43532 A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct aHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2022-43531 Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2022-43530Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2022-44535A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote low-privileged authenticated uHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-44534A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote authenticated users to run arbHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43524A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attacHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43523Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43522Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43521Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43520Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43519Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-37933A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers.Hewlett Packard Enterprise (HPE) HPE Superdome Flex Server;…
- CVE-2022-39947A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.Fortinet FortiADC
- CVE-2022-35845Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities [CWE-78] in FortiTester Fortinet FortiTester
- CVE-2023-0038Survey Maker – Best WordPress Survey Plugin <= 3.1.3 - Unauthenticated Stored Cross-Site Scriptingays-pro Survey Maker
- CVE-2022-32635In gps, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6735, MT6739, MT6753, MT6757, MT6761, MT…
- CVE-2022-32664In Config Manager, there is a possible command injection due to improper input validation.MediaTek EN7516, EN7528, EN7529, EN7561, EN7562, EN7580
- CVE-2022-36943SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks.SSZipArchive
- CVE-2022-38723Gravitee API Management before 3.15.13 allows path traversal through HTML injection.io.gravitee.apim:gravitee-api-management
- CVE-2022-38766The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open reques
- CVE-2022-39040aEnrich a+HRD - Path TraversalaEnrich a+HRD
- CVE-2022-40740Realtek GPON router - Command InjectionRealtek GPON router
- CVE-2022-41645Out-of-bounds read vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrarFUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server
- CVE-2022-43436HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Arbitrary File UploadHWA JIUH DIGITAL TECHNOLOGY EasyTest
- CVE-2022-43437HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - SQL InjectionHWA JIUH DIGITAL TECHNOLOGY EasyTest
- CVE-2022-43438HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Incorrect AuthorizationHWA JIUH DIGITAL TECHNOLOGY EasyTest
- CVE-2022-43448Out-of-bounds write vulnerability in V-SFT v6.1.7.0 and earlier and TELLUS v4.0.12.0 and earlier allows a local attacker to obtain the inforFUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-SFT and…
- CVE-2022-44036In b2evolution 7.2.5, if configured with admins_can_manipulate_sensitive_files, arbitrary file upload is allowed for admins, leading to comm
- CVE-2022-45867MyBB before 1.8.33 allows Directory Traversal.
- CVE-2022-46304ChangingTec ServiSign - Command InjectionChangingTec ServiSign
- CVE-2022-46306ChangingTec ServiSign - Path TraversalChangingTec ServiSign
- CVE-2022-46360Out-of-bounds read vulnerability in V-SFT v6.1.7.0 and earlier and TELLUS v4.0.12.0 and earlier allows a local attacker to obtain the informFUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-SFT and…
- CVE-2022-47317Out-of-bounds write vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitraFUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server
- CVE-2022-47908Stack-based buffer overflow vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or executeFUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server
Medium, low and unrated 46
- CVE-2022-42435IBM Business Automation Workflow cross-site request forgeryIBM Business Automation Workflow
- CVE-2022-2967Prosys OPC UA Simulation Server version prior to v5.3.0-64 and UA Modbus Server versions 1.4.18-5 and prior do not sufficiently protect credProsys OPC UA Simulation Server · Prosys OPC UA Modbus Serv…
- CVE-2022-43540A vulnerability exists in the ClearPass OnGuard macOS agent that allows for an attacker with local macOS instance access to potentially obtaHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2022-43539 A vulnerability exists in the ClearPass Policy Manager cluster communications that allow for an attacker in a privileged network position tHewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…
- CVE-2022-23506Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer buildsspinnaker
- CVE-2022-43529A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persistHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43528Under certain configurations, an attacker can login to Aruba EdgeConnect Enterprise Orchestrator without supplying a multi-factor authenticaHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43527Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attackeHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43526Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attackeHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-43525Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attackeHewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…
- CVE-2022-37934A potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series.Hewlett Packard Enterprise (HPE) HPE OfficeConnect 1820 and…
- CVE-2023-22456ViewVC XSS vulnerability in revision view changed pathsviewvc
- CVE-2022-45143Apache Tomcat: JsonErrorReportValve escapingApache Software Foundation Apache Tomcat · org.apache.to… +2
- CVE-2022-42471An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability [CWE-113] In FortiWeb version 7.0.0 tFortinet FortiWeb
- CVE-2022-41336An improper neutralization of input during web page generation vulnerability [CWE-79] in FortiPortal versions 6.0.0 through 6.0.11 and all vFortinet FortiPortal
- CVE-2022-4663Members Import <= 1.4.2 - Self Cross-Site Scriptingmanishkrag Members Import
- CVE-2012-10003ahmyi RivetTracker cross site scriptingahmyi RivetTracker
- CVE-2022-4871ummmmm nflpick-em.com LoadUsers.php _Load_Users sql injectionummmmm nflpick-em.com
- CVE-2013-10007ethitter WP-Print-Friendly wp-print-friendly.php information disclosureethitter WP-Print-Friendly
- CVE-2015-10012sumocoders FrameworkUserBundle login.html.twig information exposuresumocoders FrameworkUserBundle · sumocoders/framework-user-…
- CVE-2012-10002ahmyi RivetTracker css.php changeColor cross site scriptingahmyi RivetTracker
- CVE-2021-32821Regular expression Denial of Service in MooToolsmootools-core · mootools
- CVE-2022-32623In mdp, there is a possible out of bounds write due to incorrect error handling.MediaTek MT6789, MT6855, MT6879, MT6895, MT6983, MT8168, MT…
- CVE-2022-32636In keyinstall, there is a possible out of bounds write due to an integer overflow.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2022-32637In hevc decoder, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…
- CVE-2022-32638In isp, there is a possible out of bounds write due to a race condition.MediaTek MT6781, MT6833, MT6853, MT6855, MT6873, MT6877, MT…
- CVE-2022-32639In watchdog, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6739, MT6768, MT6771, MT6781, MT6785, MT6833, MT…
- CVE-2022-32640In meta wifi, there is a possible out of bounds write due to a missing bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2022-32641In meta wifi, there is a possible out of bounds read due to a missing bounds check.MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…
- CVE-2022-32644In vow, there is a possible use after free due to a race condition.MediaTek MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT…
- CVE-2022-32645In vow, there is a possible information disclosure due to a race condition.MediaTek MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT…
- CVE-2022-32646In gpu drm, there is a possible stack overflow due to a missing bounds check.MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…
- CVE-2022-32647In ccu, there is a possible out of bounds write due to improper input validation.MediaTek MT6879, MT6895, MT6983
- CVE-2022-32648In disp, there is a possible use after free due to a race condition.MediaTek MT6735, MT6737, MT6739, MT6753, MT6757, MT6761, MT…
- CVE-2022-32649In jpeg, there is a possible use after free due to a logic error.MediaTek MT6895, MT6983
- CVE-2022-32650In mtk-isp, there is a possible use after free due to a logic error.MediaTek MT6879, MT6895, MT6983
- CVE-2022-32651In mtk-aie, there is a possible use after free due to a logic error.MediaTek MT6879, MT6983
- CVE-2022-32652In mtk-aie, there is a possible use after free due to a logic error.MediaTek MT6833, MT6853, MT6877, MT6893, MT8791
- CVE-2022-32653In mtk-aie, there is a possible use after free due to a logic error.MediaTek MT6789, MT6855, MT6879, MT6983, MT8781
- CVE-2022-32657In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling.MediaTek MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT…
- CVE-2022-32658In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling.MediaTek MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT…
- CVE-2022-32659In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling.MediaTek MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT…
- CVE-2022-3614In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication chOctopus Deploy Octopus Server
- CVE-2022-42710Nice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e devices are vulnerab
- CVE-2022-46305ChangingTec ServiSign - Path TraversalChangingTec ServiSign
- CVE-2022-46309Galaxy Software Services Corporation. Vitals ESP - Arbitrary Path File ReadingGalaxy Software Services Corporation. Vitals ESP