# CVEs published 2023-01-03

94 CVEs were published on January 3, 2023: 8 critical, 40 high. Days are UTC.

- [CVE-2022-42435](https://cve.now/CVE-2022-42435.md): IBM Business Automation Workflow cross-site request forgery (CVSS 4.3, IBM Business Automation Workflow)
- [CVE-2022-2967](https://cve.now/CVE-2022-2967.md): Prosys OPC UA Simulation Server version prior to v5.3.0-64 and UA Modbus Server versions 1.4.18-5 and prior do not sufficiently protect cred (CVSS 6.5, Prosys OPC UA Simulation Server · Prosys OPC UA Modbus Serv…)
- [CVE-2022-43540](https://cve.now/CVE-2022-43540.md): A vulnerability exists in the ClearPass OnGuard macOS agent that allows for an attacker with local macOS instance access to potentially obta (CVSS 5.5, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43539](https://cve.now/CVE-2022-43539.md): A vulnerability exists in the ClearPass Policy Manager cluster communications that allow for an attacker in a privileged network position t (CVSS 5.7, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43538](https://cve.now/CVE-2022-43538.md): Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43537](https://cve.now/CVE-2022-43537.md): Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-23506](https://cve.now/CVE-2022-23506.md): Spinnaker's Rosco microservice vulnerable to improper log masking on AWS Packer builds (CVSS 4.3, spinnaker)
- [CVE-2022-43536](https://cve.now/CVE-2022-43536.md): Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43535](https://cve.now/CVE-2022-43535.md): A vulnerability in the ClearPass OnGuard Windows agent could allow malicious users on a Windows instance to elevate their user privileges. (CVSS 7.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43534](https://cve.now/CVE-2022-43534.md): A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges. (CVSS 7.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43533](https://cve.now/CVE-2022-43533.md): A vulnerability in the ClearPass OnGuard macOS agent could allow malicious users on a macOS instance to elevate their user privileges. (CVSS 7.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43532](https://cve.now/CVE-2022-43532.md): A vulnerability in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct a (CVSS 8.0, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43531](https://cve.now/CVE-2022-43531.md): Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct S (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-43530](https://cve.now/CVE-2022-43530.md): Vulnerabilities in the web-based management interface of ClearPass Policy Manager could allow an authenticated remote attacker to conduct SQ (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba ClearPass Policy Man…)
- [CVE-2022-44535](https://cve.now/CVE-2022-44535.md): A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote low-privileged authenticated u (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-44534](https://cve.now/CVE-2022-44534.md): A vulnerability in the Aruba EdgeConnect Enterprise Orchestrator web-based management interface allows remote authenticated users to run arb (CVSS 7.2, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43529](https://cve.now/CVE-2022-43529.md): A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an remote attacker to persist (CVSS 4.6, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43528](https://cve.now/CVE-2022-43528.md): Under certain configurations, an attacker can login to Aruba EdgeConnect Enterprise Orchestrator without supplying a multi-factor authentica (CVSS 4.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43527](https://cve.now/CVE-2022-43527.md): Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attacke (CVSS 6.1, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43526](https://cve.now/CVE-2022-43526.md): Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attacke (CVSS 6.1, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43525](https://cve.now/CVE-2022-43525.md): Multiple vulnerabilities within the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow a remote attacke (CVSS 6.1, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43524](https://cve.now/CVE-2022-43524.md): A vulnerability in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated remote attac (CVSS 8.7, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43523](https://cve.now/CVE-2022-43523.md): Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated rem (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43522](https://cve.now/CVE-2022-43522.md): Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated rem (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43521](https://cve.now/CVE-2022-43521.md): Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated rem (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43520](https://cve.now/CVE-2022-43520.md): Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated rem (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-43519](https://cve.now/CVE-2022-43519.md): Multiple vulnerabilities in the web-based management interface of Aruba EdgeConnect Enterprise Orchestrator could allow an authenticated rem (CVSS 8.8, Hewlett Packard Enterprise (HPE) Aruba EdgeConnect Enterpri…)
- [CVE-2022-37934](https://cve.now/CVE-2022-37934.md): A potential security vulnerability has been identified in HPE OfficeConnect 1820, and 1850 switch series. (CVSS 6.8, Hewlett Packard Enterprise (HPE) HPE OfficeConnect 1820 and…)
- [CVE-2022-37933](https://cve.now/CVE-2022-37933.md): A potential security vulnerability has been identified in HPE Superdome Flex and Superdome Flex 280 servers. (CVSS 7.3, Hewlett Packard Enterprise (HPE) HPE Superdome Flex Server;…)
- [CVE-2023-22456](https://cve.now/CVE-2023-22456.md): ViewVC XSS vulnerability in revision view changed paths (CVSS 6.1, viewvc)
- [CVE-2022-45143](https://cve.now/CVE-2022-45143.md): Apache Tomcat: JsonErrorReportValve escaping (low (no CVSS), Apache Software Foundation Apache Tomcat · org.apache.to… +2)
- [CVE-2022-39947](https://cve.now/CVE-2022-39947.md): A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0. (CVSS 8.6, Fortinet FortiADC)
- [CVE-2022-42471](https://cve.now/CVE-2022-42471.md): An improper neutralization of CRLF sequences in HTTP headers ('HTTP Response Splitting') vulnerability \[CWE-113\] In FortiWeb version 7.0.0 t (CVSS 5.3, Fortinet FortiWeb)
- [CVE-2022-41336](https://cve.now/CVE-2022-41336.md): An improper neutralization of input during web page generation vulnerability \[CWE-79\] in FortiPortal versions 6.0.0 through 6.0.11 and all v (CVSS 6.6, Fortinet FortiPortal)
- [CVE-2022-35845](https://cve.now/CVE-2022-35845.md): Multiple improper neutralization of special elements used in an OS Command ('OS Command Injection') vulnerabilities \[CWE-78\] in FortiTester (CVSS 7.6, Fortinet FortiTester)
- [CVE-2023-0038](https://cve.now/CVE-2023-0038.md): Survey Maker – Best WordPress Survey Plugin \<= 3.1.3 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2, ays-pro Survey Maker)
- [CVE-2022-4663](https://cve.now/CVE-2022-4663.md): Members Import \<= 1.4.2 - Self Cross-Site Scripting (CVSS 5.5, manishkrag Members Import)
- [CVE-2012-10003](https://cve.now/CVE-2012-10003.md): ahmyi RivetTracker cross site scripting (CVSS 3.5, ahmyi RivetTracker)
- [CVE-2022-4871](https://cve.now/CVE-2022-4871.md): ummmmm nflpick-em.com LoadUsers.php \_Load\_Users sql injection (CVSS 4.7, ummmmm nflpick-em.com)
- [CVE-2013-10007](https://cve.now/CVE-2013-10007.md): ethitter WP-Print-Friendly wp-print-friendly.php information disclosure (CVSS 5.3, ethitter WP-Print-Friendly)
- [CVE-2015-10012](https://cve.now/CVE-2015-10012.md): sumocoders FrameworkUserBundle login.html.twig information exposure (CVSS 3.5, sumocoders FrameworkUserBundle · sumocoders/framework-user-…)
- [CVE-2012-10002](https://cve.now/CVE-2012-10002.md): ahmyi RivetTracker css.php changeColor cross site scripting (CVSS 3.5, ahmyi RivetTracker)
- [CVE-2022-43931](https://cve.now/CVE-2022-43931.md): Out-of-bounds write vulnerability in Remote Desktop Functionality in Synology VPN Plus Server before 1.4.3-0534 and 1.4.4-0635 allows remote (CVSS 10.0, Synology VPN Plus Server)
- [CVE-2021-32821](https://cve.now/CVE-2021-32821.md): Regular expression Denial of Service in MooTools (CVSS 6.2, mootools-core · mootools)
- [CVE-2021-32824](https://cve.now/CVE-2021-32824.md): Regular expression Denial of Service in MooTools (CVSS 9.8, Apache Dubbo · org.apache.dubbo:dubbo-parent)
- [CVE-2022-32623](https://cve.now/CVE-2022-32623.md): In mdp, there is a possible out of bounds write due to incorrect error handling. (CVSS 6.7, MediaTek MT6789, MT6855, MT6879, MT6895, MT6983, MT8168, MT…)
- [CVE-2022-32635](https://cve.now/CVE-2022-32635.md): In gps, there is a possible out of bounds write due to a missing bounds check. (CVSS 7.8, MediaTek MT6580, MT6735, MT6739, MT6753, MT6757, MT6761, MT…)
- [CVE-2022-32636](https://cve.now/CVE-2022-32636.md): In keyinstall, there is a possible out of bounds write due to an integer overflow. (CVSS 6.7, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2022-32637](https://cve.now/CVE-2022-32637.md): In hevc decoder, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6781, MT6785, MT6833, MT6853, MT6853T, MT6873, M…)
- [CVE-2022-32638](https://cve.now/CVE-2022-32638.md): In isp, there is a possible out of bounds write due to a race condition. (CVSS 6.4, MediaTek MT6781, MT6833, MT6853, MT6855, MT6873, MT6877, MT…)
- [CVE-2022-32639](https://cve.now/CVE-2022-32639.md): In watchdog, there is a possible out of bounds read due to a missing bounds check. (CVSS 4.4, MediaTek MT6739, MT6768, MT6771, MT6781, MT6785, MT6833, MT…)
- [CVE-2022-32640](https://cve.now/CVE-2022-32640.md): In meta wifi, there is a possible out of bounds write due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2022-32641](https://cve.now/CVE-2022-32641.md): In meta wifi, there is a possible out of bounds read due to a missing bounds check. (CVSS 6.7, MediaTek MT6580, MT6731, MT6735, MT6737, MT6739, MT6753, MT…)
- [CVE-2022-32644](https://cve.now/CVE-2022-32644.md): In vow, there is a possible use after free due to a race condition. (CVSS 6.4, MediaTek MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT…)
- [CVE-2022-32645](https://cve.now/CVE-2022-32645.md): In vow, there is a possible information disclosure due to a race condition. (CVSS 4.1, MediaTek MT6789, MT6833, MT6853, MT6855, MT6873, MT6875, MT…)
- [CVE-2022-32646](https://cve.now/CVE-2022-32646.md): In gpu drm, there is a possible stack overflow due to a missing bounds check. (CVSS 6.7, MediaTek MT6761, MT6765, MT6768, MT6779, MT6781, MT6785, MT…)
- [CVE-2022-32647](https://cve.now/CVE-2022-32647.md): In ccu, there is a possible out of bounds write due to improper input validation. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983)
- [CVE-2022-32648](https://cve.now/CVE-2022-32648.md): In disp, there is a possible use after free due to a race condition. (CVSS 6.4, MediaTek MT6735, MT6737, MT6739, MT6753, MT6757, MT6761, MT…)
- [CVE-2022-32649](https://cve.now/CVE-2022-32649.md): In jpeg, there is a possible use after free due to a logic error. (CVSS 6.7, MediaTek MT6895, MT6983)
- [CVE-2022-32650](https://cve.now/CVE-2022-32650.md): In mtk-isp, there is a possible use after free due to a logic error. (CVSS 6.7, MediaTek MT6879, MT6895, MT6983)
- [CVE-2022-32651](https://cve.now/CVE-2022-32651.md): In mtk-aie, there is a possible use after free due to a logic error. (CVSS 6.7, MediaTek MT6879, MT6983)
- [CVE-2022-32652](https://cve.now/CVE-2022-32652.md): In mtk-aie, there is a possible use after free due to a logic error. (CVSS 6.7, MediaTek MT6833, MT6853, MT6877, MT6893, MT8791)
- [CVE-2022-32653](https://cve.now/CVE-2022-32653.md): In mtk-aie, there is a possible use after free due to a logic error. (CVSS 6.7, MediaTek MT6789, MT6855, MT6879, MT6983, MT8781)
- [CVE-2022-32657](https://cve.now/CVE-2022-32657.md): In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. (CVSS 6.7, MediaTek MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT…)
- [CVE-2022-32658](https://cve.now/CVE-2022-32658.md): In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. (CVSS 6.7, MediaTek MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT…)
- [CVE-2022-32659](https://cve.now/CVE-2022-32659.md): In Wi-Fi driver, there is a possible undefined behavior due to incorrect error handling. (CVSS 6.7, MediaTek MT7603, MT7613, MT7615, MT7622, MT7628, MT7629, MT…)
- [CVE-2022-32664](https://cve.now/CVE-2022-32664.md): In Config Manager, there is a possible command injection due to improper input validation. (CVSS 8.8, MediaTek EN7516, EN7528, EN7529, EN7561, EN7562, EN7580)
- [CVE-2022-32665](https://cve.now/CVE-2022-32665.md): In Boa, there is a possible command injection due to improper input validation. (CVSS 9.8, MediaTek EN7528, EN7580)
- [CVE-2022-3614](https://cve.now/CVE-2022-3614.md): In affected versions of Octopus Deploy users of certain browsers using AD to sign-in to Octopus Server were able to bypass authentication ch (CVSS 6.1, Octopus Deploy Octopus Server)
- [CVE-2022-36943](https://cve.now/CVE-2022-36943.md): SSZipArchive versions 2.5.3 and older contain an arbitrary file write vulnerability due to lack of sanitization on paths which are symlinks. (CVSS 8.1, SSZipArchive)
- [CVE-2022-38627](https://cve.now/CVE-2022-38627.md): Nortek Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e were discovered to contain a SQL inj (CVSS 9.8)
- [CVE-2022-38723](https://cve.now/CVE-2022-38723.md): Gravitee API Management before 3.15.13 allows path traversal through HTML injection. (CVSS 8.6, io.gravitee.apim:gravitee-api-management)
- [CVE-2022-38766](https://cve.now/CVE-2022-38766.md): The remote keyless system on Renault ZOE 2021 vehicles sends 433.92 MHz RF signals from the same Rolling Codes set for each door-open reques (CVSS 8.1)
- [CVE-2022-39039](https://cve.now/CVE-2022-39039.md): aEnrich a+HRD - Server-Side Request Forgery (SSRF) (CVSS 9.8, aEnrich a+HRD)
- [CVE-2022-39040](https://cve.now/CVE-2022-39040.md): aEnrich a+HRD - Path Traversal (CVSS 7.5, aEnrich a+HRD)
- [CVE-2022-39041](https://cve.now/CVE-2022-39041.md): aEnrich a+HRD - SQL Injection (CVSS 9.8, aEnrich a+HRD)
- [CVE-2022-39042](https://cve.now/CVE-2022-39042.md): aEnrich a+HRD - Improper Authentication (CVSS 9.8, aEnrich a+HRD)
- [CVE-2022-40740](https://cve.now/CVE-2022-40740.md): Realtek GPON router - Command Injection (CVSS 7.2, Realtek GPON router)
- [CVE-2022-41645](https://cve.now/CVE-2022-41645.md): Out-of-bounds read vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitrar (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server)
- [CVE-2022-42710](https://cve.now/CVE-2022-42710.md): Nice (formerly Nortek) Linear eMerge E3-Series 0.32-08f, 0.32-07p, 0.32-07e, 0.32-09c, 0.32-09b, 0.32-09a, and 0.32-08e devices are vulnerab (CVSS 5.4)
- [CVE-2022-43436](https://cve.now/CVE-2022-43436.md): HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Arbitrary File Upload (CVSS 8.8, HWA JIUH DIGITAL TECHNOLOGY EasyTest)
- [CVE-2022-43437](https://cve.now/CVE-2022-43437.md): HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - SQL Injection (CVSS 8.8, HWA JIUH DIGITAL TECHNOLOGY EasyTest)
- [CVE-2022-43438](https://cve.now/CVE-2022-43438.md): HWA JIUH DIGITAL TECHNOLOGY LTD. EasyTest - Incorrect Authorization (CVSS 8.8, HWA JIUH DIGITAL TECHNOLOGY EasyTest)
- [CVE-2022-43448](https://cve.now/CVE-2022-43448.md): Out-of-bounds write vulnerability in V-SFT v6.1.7.0 and earlier and TELLUS v4.0.12.0 and earlier allows a local attacker to obtain the infor (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-SFT and…)
- [CVE-2022-44036](https://cve.now/CVE-2022-44036.md): In b2evolution 7.2.5, if configured with admins\_can\_manipulate\_sensitive\_files, arbitrary file upload is allowed for admins, leading to comm (CVSS 7.2)
- [CVE-2022-45867](https://cve.now/CVE-2022-45867.md): MyBB before 1.8.33 allows Directory Traversal. (CVSS 7.2)
- [CVE-2022-46304](https://cve.now/CVE-2022-46304.md): ChangingTec ServiSign - Command Injection (CVSS 8.8, ChangingTec ServiSign)
- [CVE-2022-46305](https://cve.now/CVE-2022-46305.md): ChangingTec ServiSign - Path Traversal (CVSS 6.5, ChangingTec ServiSign)
- [CVE-2022-46306](https://cve.now/CVE-2022-46306.md): ChangingTec ServiSign - Path Traversal (CVSS 8.8, ChangingTec ServiSign)
- [CVE-2022-46309](https://cve.now/CVE-2022-46309.md): Galaxy Software Services Corporation. Vitals ESP - Arbitrary Path File Reading (CVSS 6.5, Galaxy Software Services Corporation. Vitals ESP)
- [CVE-2022-46360](https://cve.now/CVE-2022-46360.md): Out-of-bounds read vulnerability in V-SFT v6.1.7.0 and earlier and TELLUS v4.0.12.0 and earlier allows a local attacker to obtain the inform (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-SFT and…)
- [CVE-2022-47317](https://cve.now/CVE-2022-47317.md): Out-of-bounds write vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute arbitra (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server)
- [CVE-2022-47618](https://cve.now/CVE-2022-47618.md): Merit Lilin Ent. Co., Ltd. AH55B04 & AH55B08 DVR - Hard-coded Credentials (CVSS 9.8, Merit Lilin Ent. Co. AH55B04 DVR firmware · Merit Lilin Ent…)
- [CVE-2022-47908](https://cve.now/CVE-2022-47908.md): Stack-based buffer overflow vulnerability in V-Server v4.0.12.0 and earlier allows a local attacker to obtain the information and/or execute (CVSS 7.8, FUJI ELECTRIC CO., LTD. and Hakko Electronics Co. V-Server)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.