# CVEs published 2023-01-04

80 CVEs were published on January 4, 2023: 3 critical, 15 high. Days are UTC.

- [CVE-2022-4876](https://cve.now/CVE-2022-4876.md): Kaltura mwEmbed DefaultSettings.php cross site scripting (CVSS 3.5, Kaltura mwEmbed)
- [CVE-2023-22467](https://cve.now/CVE-2023-22467.md): luxon.js inefficient regular expression complexity vulnerability (CVSS 7.5, moment luxon · luxon)
- [CVE-2023-22466](https://cve.now/CVE-2023-22466.md): Tokio's reject\_remote\_clients configuration may get dropped when creating a Windows named pipe (CVSS 5.4, tokio-rs tokio · tokio)
- [CVE-2022-4875](https://cve.now/CVE-2022-4875.md): fossology cross site scripting (CVSS 2.4, fossology)
- [CVE-2021-4302](https://cve.now/CVE-2021-4302.md): slackero phpwcms SVG File cross site scripting (CVSS 3.5, slackero phpwcms)
- [CVE-2021-4300](https://cve.now/CVE-2021-4300.md): ghostlander Halcyon Block Verification main.cpp AddToBlockIndex access control (CVSS 6.3, ghostlander Halcyon)
- [CVE-2022-45051](https://cve.now/CVE-2022-45051.md): Reflected POST XSS in Axiell Iguana CMS (CVSS 6.1, Axiell Iguana)
- [CVE-2022-45049](https://cve.now/CVE-2022-45049.md): Reflected XSS in Axiell Iguana CMS (CVSS 6.1, Axiell Iguana)
- [CVE-2022-45052](https://cve.now/CVE-2022-45052.md): Local File Inclusion in Axiell Iguana CMS (CVSS 8.8, Axiell Iguana)
- [CVE-2022-22337](https://cve.now/CVE-2022-22337.md): IBM Sterling B2B Integrator Standard Edition information disclosure (CVSS 4.3, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2022-22338](https://cve.now/CVE-2022-22338.md): IBM Sterling B2B Integrator Standard Edition SQL injection (CVSS 6.3, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2022-22371](https://cve.now/CVE-2022-22371.md): IBM Sterling B2B Integrator Standard Edition session fixation (CVSS 5.5, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2021-38928](https://cve.now/CVE-2021-38928.md): IBM Sterling B2B Integrator Standard Edition cross-origin resource sharing (CVSS 5.4, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2022-43920](https://cve.now/CVE-2022-43920.md): IBM Sterling B2B Integrator Standard Edition privilege escalation (CVSS 6.3, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2022-34330](https://cve.now/CVE-2022-34330.md): IBM Sterling B2B Integrator cross-site scripting (CVSS 6.1, IBM Sterling B2B Integrator)
- [CVE-2022-25926](https://cve.now/CVE-2022-25926.md): Versions of the package window-control before 1.4.5 are vulnerable to Command Injection via the sendKeys function, due to improper input san (CVSS 7.4, window-control)
- [CVE-2022-22352](https://cve.now/CVE-2022-22352.md): IBM Sterling B2B Integrator Standard Edition cross-site scripting (CVSS 5.4, IBM Sterling B2B Integrator Standard Edition)
- [CVE-2022-46180](https://cve.now/CVE-2022-46180.md): Arbitrary HTML injection in discourse-mermaid-theme-component (CVSS 5.0, discourse-mermaid-theme-component)
- [CVE-2023-22465](https://cve.now/CVE-2023-22465.md): Http4s has fatal error parsing User-Agent and Server headers (CVSS 7.5, http4s · org.http4s:http4s-core\_2.13 +4)
- [CVE-2023-22464](https://cve.now/CVE-2023-22464.md): ViewVC XSS vulnerability in revision view changed path "copyfrom" locations (CVSS 5.4, viewvc)
- [CVE-2023-22463](https://cve.now/CVE-2023-22463.md): KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token (CVSS 9.8, KubeOperator KubePi · github.com/KubeOperator/kubepi)
- [CVE-2022-45875](https://cve.now/CVE-2022-45875.md): Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin (CVSS 9.8, Apache Software Foundation Apache DolphinScheduler · apa… +1)
- [CVE-2023-22461](https://cve.now/CVE-2023-22461.md): sanitize-svg Filter Bypass Allows Cross-Site Scripting (XSS) (CVSS 7.6, mattkrick sanitize-svg · @mattkrick/sanitize-svg)
- [CVE-2023-22460](https://cve.now/CVE-2023-22460.md): go-ipld-prime json codec may panic if asked to encode bytes (CVSS 7.5, go-ipld-prime · github.com/ipld/go-ipld-prime)
- [CVE-2023-22457](https://cve.now/CVE-2023-22457.md): org.xwiki.contrib:application-ckeditor-ui vulnerable to Remote Code Execution via Cross-Site Request Forgery (CVSS 9.1, xwiki-contrib application-ckeditor · org.xwiki.contrib:appl…)
- [CVE-2016-15008](https://cve.now/CVE-2016-15008.md): oxguy3 coebot-www channel.js showChannelBoir cross site scripting (CVSS 3.5, oxguy3 coebot-www)
- [CVE-2020-36639](https://cve.now/CVE-2020-36639.md): AlliedModders AMX Mod X Console Command adminvote.sma cmdVoteMap path traversal (CVSS 4.3, AlliedModders AMX Mod X)
- [CVE-2019-25094](https://cve.now/CVE-2019-25094.md): innologi appointments Extension Appointment cross site scripting (CVSS 3.5, innologi appointments Extension · innologi/typo3-appointmen…)
- [CVE-2014-125039](https://cve.now/CVE-2014-125039.md): kkokko NeoXplora Trainer cross site scripting (CVSS 3.5, kkokko NeoXplora)
- [CVE-2010-10003](https://cve.now/CVE-2010-10003.md): gesellix titlelink plugin\_content\_title.php sql injection (CVSS 5.5, gesellix titlelink)
- [CVE-2022-38678](https://cve.now/CVE-2022-38678.md): In contacts service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38682](https://cve.now/CVE-2022-38682.md): In contacts service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38683](https://cve.now/CVE-2022-38683.md): In contacts service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-38684](https://cve.now/CVE-2022-38684.md): In contacts service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39081](https://cve.now/CVE-2022-39081.md): In network service, there is a missing permission check. (CVSS 6.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39082](https://cve.now/CVE-2022-39082.md): In network service, there is a missing permission check. (CVSS 6.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39083](https://cve.now/CVE-2022-39083.md): In network service, there is a missing permission check. (CVSS 6.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39084](https://cve.now/CVE-2022-39084.md): In network service, there is a missing permission check. (CVSS 6.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39085](https://cve.now/CVE-2022-39085.md): In network service, there is a missing permission check. (CVSS 6.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39086](https://cve.now/CVE-2022-39086.md): In network service, there is a missing permission check. (CVSS 6.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39087](https://cve.now/CVE-2022-39087.md): In network service, there is a missing permission check. (CVSS 6.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39088](https://cve.now/CVE-2022-39088.md): In network service, there is a missing permission check. (CVSS 6.7, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39104](https://cve.now/CVE-2022-39104.md): In contacts service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39116](https://cve.now/CVE-2022-39116.md): In sprd\_sysdump driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-39118](https://cve.now/CVE-2022-39118.md): In sprd\_sysdump driver, there is a possible out of bounds write due to a missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44422](https://cve.now/CVE-2022-44422.md): In music service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44423](https://cve.now/CVE-2022-44423.md): In music service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44424](https://cve.now/CVE-2022-44424.md): In music service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44425](https://cve.now/CVE-2022-44425.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44426](https://cve.now/CVE-2022-44426.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44427](https://cve.now/CVE-2022-44427.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44428](https://cve.now/CVE-2022-44428.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44429](https://cve.now/CVE-2022-44429.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44430](https://cve.now/CVE-2022-44430.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44431](https://cve.now/CVE-2022-44431.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44432](https://cve.now/CVE-2022-44432.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44434](https://cve.now/CVE-2022-44434.md): In messaging service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44435](https://cve.now/CVE-2022-44435.md): In messaging service, there is a missing permission check. (no CVSS, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44436](https://cve.now/CVE-2022-44436.md): In messaging service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44437](https://cve.now/CVE-2022-44437.md): In messaging service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44438](https://cve.now/CVE-2022-44438.md): In messaging service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44439](https://cve.now/CVE-2022-44439.md): In messaging service, there is a missing permission check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44440](https://cve.now/CVE-2022-44440.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44441](https://cve.now/CVE-2022-44441.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44442](https://cve.now/CVE-2022-44442.md): In wlan driver, there is a possible missing bounds check, This could lead to local denial of service in wlan services. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44443](https://cve.now/CVE-2022-44443.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44444](https://cve.now/CVE-2022-44444.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44445](https://cve.now/CVE-2022-44445.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-44446](https://cve.now/CVE-2022-44446.md): In wlan driver, there is a possible missing bounds check. (CVSS 5.5, Unisoc (Shanghai) Technologies Co. SC9863A/SC9832E/SC7731E/…)
- [CVE-2022-46081](https://cve.now/CVE-2022-46081.md): In Garmin Connect 4.61, terminating a LiveTrack session wouldn't prevent the LiveTrack API from continued exposure of private personal infor (CVSS 7.5)
- [CVE-2022-46456](https://cve.now/CVE-2022-46456.md): NASM v2.16 was discovered to contain a global buffer overflow in the component dbgdbg\_typevalue at /output/outdbg.c. (CVSS 7.8)
- [CVE-2022-46457](https://cve.now/CVE-2022-46457.md): NASM v2.16 was discovered to contain a segmentation violation in the component ieee\_write\_file at /output/outieee.c. (CVSS 5.5)
- [CVE-2022-48216](https://cve.now/CVE-2022-48216.md): Uniswap Universal Router before 1.1.0 mishandles reentrancy. (CVSS 7.5, @uniswap/universal-router)
- [CVE-2022-48217](https://cve.now/CVE-2022-48217.md): The tf\_remapper\_node component 1.1.1 for Robot Operating System (ROS) allows attackers, who control the source code of a different node in t (CVSS 8.1)
- [CVE-2023-0046](https://cve.now/CVE-2023-0046.md): Improper Restriction of Names for Files and Other Resources in lirantal/daloradius (CVSS 7.2, lirantal/daloradius)
- [CVE-2023-0048](https://cve.now/CVE-2023-0048.md): Code Injection in lirantal/daloradius (CVSS 7.2, lirantal/daloradius)
- [CVE-2023-0049](https://cve.now/CVE-2023-0049.md): Out-of-bounds Read in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2023-0051](https://cve.now/CVE-2023-0051.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2023-0054](https://cve.now/CVE-2023-0054.md): Out-of-bounds Write in vim/vim (CVSS 7.3, vim/vim)
- [CVE-2023-0055](https://cve.now/CVE-2023-0055.md): Sensitive Cookie in HTTPS Session Without 'Secure' Attribute in pyload/pyload (CVSS 3.1, pyload/pyload · pyload-ng)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.