CVEs published January 5, 2023
84 CVEs were published on January 5, 2023: 4 critical, 30 high. 1 is now in CISA KEV.
- Published
- 84
- Critical
- 4
- High
- 30
- Medium
- 35
- Low
- 15
- Unrated
- 0
- Now in CISA KEV
- 1
- Fix available
- 39
Most affected products
- discourse
- 8
- Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- 5
- Lenovo ThinkPad X13s
- 4
- soerennb eXtplorer
- 3
- IBM Robotic Process Automation
- 2
- swiftylife Swifty Page Manager
- 2
- Synology Router Manager
- 2
- arekk uke
- 1
- bash
- 1
- bonitasoft bonita-connector-webservice · org.bonitasoft.con…
- 1
Critical 4
- CVE-2022-44877login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS comma
- CVE-2022-45995There is an unauthorized buffer overflow vulnerability in Tenda AX12 v22.03.01.21 _ cn.
- CVE-2022-47523Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection
- CVE-2022-47544An issue was discovered in Siren Investigate before 12.1.7.
High 30
- CVE-2022-3929Communication between the client and server partially using CORBA over TCP/IPHitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2022-3928Hardcoded credential is found in the message queueHitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2022-3927The affected products store public and private key that are used to sign and protect custom parameter set files from modification.Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2021-40342Use of default key for encryptionHitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2021-40341Weak DES encryptionHitachi Energy FOXMAN-UN · Hitachi Energy UNEM
- CVE-2023-22454Discourse vulnerable to Cross-site Scripting through pending post titles descriptionsdiscourse
- CVE-2023-0088Swifty Page Manager <= 3.0.1 - Cross-Site Request Forgeryswiftylife Swifty Page Manager
- CVE-2022-43844IBM Robotic Process Automation for Cloud Pak session fixationIBM Robotic Process Automation for Cloud Pak
- CVE-2022-43932Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in SynologSynology Router Manager
- CVE-2022-3715A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter_transform.bash
- CVE-2022-4378A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables.kernel
- CVE-2022-47087GPAC MP4box 2.1-DEV-rev574-g9d5bb184b has a Buffer overflow in gf_vvc_read_pps_bs_internal function of media_tools/av_parsers.c
- CVE-2022-47088GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow.
- CVE-2022-47089GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow via gf_vvc_read_sps_bs_internal function of media_tools/av_parsers.c
- CVE-2022-47091GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow in gf_text_process_sub function of filters/load_text.c
- CVE-2022-47092GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is contains an Integer overflow vulnerability in gf_hevc_read_sps_bs_internal function of media_tools/
- CVE-2022-47093GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to heap use-after-free via filters/dmx_m2ts.c:470 in m2tsdmx_declare_pid
- CVE-2022-47094GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Null pointer dereference via filters/dmx_m2ts.c:343 in m2tsdmx_declare_pid
- CVE-2022-47095GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer overflow in hevc_parse_vps_extension function of media_tools/av_parsers.c
- CVE-2022-47653GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in eac3_update_channels function of media_tools/av_parsers.c:9113
- CVE-2022-47654GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:
- CVE-2022-47655Libde265 1.0.9 is vulnerable to Buffer Overflow in function void put_qpel_fallback<unsigned short>
- CVE-2022-47656GPAC MP4box 2.1-DEV-rev617-g85ce76efd is vulnerable to Buffer Overflow in gf_hevc_read_sps_bs_internal function of media_tools/av_parsers.c:
- CVE-2022-47657GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function hevc_parse_vps_extension of media_tools/av_parsers.c:7662
- CVE-2022-47658GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function gf_hevc_read_vps_bs_internal of media_tools/av_parsers.c:
- CVE-2022-47659GPAC MP4box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to Buffer Overflow in gf_bs_read_data
- CVE-2022-47660GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is has an integer overflow in isomedia/isom_write.c
- CVE-2022-47661GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 is vulnerable to Buffer Overflow via media_tools/av_parsers.c:4988 in gf_media_nalu_add_emulation_byte
- CVE-2022-47663GPAC MP4box 2.1-DEV-rev649-ga8f438d20 is vulnerable to buffer overflow in h263dmx_process filters/reframe_h263.c:609
- CVE-2023-22626PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message.pghero
Medium, low and unrated 50
- CVE-2014-125045meol1 index.php GetAnimal sql injectionmeol1
- CVE-2023-22455Discourse vulnerable to Cross-site Scripting through tag descriptionsdiscourse
- CVE-2023-22453Discourse vulnerable to exposure of user post counts per topic to unauthorized usersdiscourse
- CVE-2022-46177Discourse password reset link can lead to in account takeover if user changes to a new emaildiscourse
- CVE-2017-20163Red Snapper NView Session.php mutate sql injectionRed Snapper NView
- CVE-2014-125044soshtolsus wing-tight index.php file inclusionsoshtolsus wing-tight
- CVE-2023-0087Swifty Page Manager <= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scriptingswiftylife Swifty Page Manager
- CVE-2022-23546Discourse vulnerable to private topic leak via email#send_digestdiscourse
- CVE-2022-43573IBM Robotic Process Automation information disclosureIBM Robotic Process Automation
- CVE-2022-4435A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoRemoteConfigUpdateDxe driver that could allow a local attacker Lenovo ThinkPad X13s
- CVE-2022-4434A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS driver that could allow a local attacker with elevated privileges to Lenovo ThinkPad X13s
- CVE-2022-4433A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with elLenovo ThinkPad X13s
- CVE-2022-4432A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with elLenovo ThinkPad X13s
- CVE-2022-41740IBM Robotic Process Automation information disclosureIBM Robotic Process Automation
- CVE-2022-46168Group SMTP user emails are exposed in CC email headerdiscourse
- CVE-2023-0086JetWidgets for Elementor <= 1.0.12 - Cross-Site Request Forgery to Settings Updatejetmonsters JetWidgets For Elementor
- CVE-2015-10015glidernet ogn-live sql injectionglidernet ogn-live
- CVE-2014-125041Miccighel PR-CWT sql injectionMiccighel PR-CWT
- CVE-2015-10014arekk uke finder.rb sql injectionarekk uke
- CVE-2014-125040stevejagodzinski DevNewsAggregator RemoteHtmlContentDataAccess.php getByName sql injectionstevejagodzinski DevNewsAggregator
- CVE-2017-20162vercel ms index.js parse redosvercel ms · ms
- CVE-2020-36641gturri aXMLRPC ResponseParser.java ResponseParser xml external entity referencegturri aXMLRPC · fr.turri:aXMLRPC
- CVE-2007-10001web-cyradm search.php sql injectionweb-cyradm
- CVE-2021-4305Woorank robots-txt-guard patterns.js makePathPattern redosWoorank robots-txt-guard · robots-txt-guard
- CVE-2021-4304eprintsug ulcc-core toolbox command injectioneprintsug ulcc-core
- CVE-2015-10013WebDevStudios taxonomy-switcher Plugin taxonomy-switcher.php taxonomy_switcher_init cross site scriptingWebDevStudios taxonomy-switcher Plugin
- CVE-2018-25065Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags_body.php cross site scriptingWikimedia mediawiki-extensions-I18nTags
- CVE-2022-4877snoyberg keter Proxy.hs cross site scriptingsnoyberg keter
- CVE-2020-36640bonitasoft bonita-connector-webservice SecureWSConnector.java TransformerConfigurationException xml external entity referencebonitasoft bonita-connector-webservice · org.bonitasoft.con…
- CVE-2023-0077Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows rSynology Router Manager
- CVE-2021-4303shannah Xataface Installer install_form.js.php testftp cross site scriptingshannah Xataface · xataface/xataface
- CVE-2016-15010University of Cambridge django-ucamlookup Lookup cross site scriptingUniversity of Cambridge django-ucamlookup · django-ucamlook…
- CVE-2016-15009OpenACS bug-tracker Search nav-bar.adp cross-site request forgeryOpenACS bug-tracker
- CVE-2018-25064OSM Lab show-me-the-way site.js cross site scriptingOSM Lab show-me-the-way
- CVE-2022-4869Evolution Events Artaxerxes POST Parameter middleware.py information disclosureEvolution Events Artaxerxes
- CVE-2019-25098soerennb eXtplorer Archive archive.php path traversalsoerennb eXtplorer
- CVE-2019-25097soerennb eXtplorer Directory Content path traversalsoerennb eXtplorer
- CVE-2019-25096soerennb eXtplorer cross site scriptingsoerennb eXtplorer
- CVE-2019-25095kakwa LdapCherry URL cross site scriptingkakwa LdapCherry · ldapcherry
- CVE-2022-45857An incorrect user management vulnerability [CWE-286] in the FortiManager version 6.4.6 and below VDOM creation component may allow an attackFortinet FortiManager
- CVE-2021-32828Regular expression Denial of Service in MooToolsHyland Nuxeo · org.nuxeo.ecm.platform:nuxeo-platform-oauth
- CVE-2022-23548Discourse is an option source discussion platform.discourse
- CVE-2022-23549Discourse vulnerable to bypass of post max_length using HTML commentsdiscourse
- CVE-2022-46489GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the gf_isom_box_parse_ex function at box_funcs.c.
- CVE-2022-46490GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the afrt_box_read function at box_code_adobe.c.
- CVE-2022-47086GPAC MP4Box v2.1-DEV-rev574-g9d5bb184b contains a segmentation violation via the function gf_sm_load_init_swf at scene_manager/swf_parse.c
- CVE-2022-47543An issue was discovered in Siren Investigate before 12.1.7.
- CVE-2022-47662GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault (/stack overflow) due to infinite recursion in Media_GetSample isomedia/media.c:66
- CVE-2023-0057Improper Restriction of Rendered UI Layers or Frames in pyload/pyloadpyload/pyload · pyload-ng
- CVE-2023-22622WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the so