# CVEs published 2023-01-05 84 CVEs were published on January 5, 2023: 4 critical, 30 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2022-3929](https://cve.now/CVE-2022-3929.md): Communication between the client and server partially using CORBA over TCP/IP (CVSS 8.3, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM) - [CVE-2022-3928](https://cve.now/CVE-2022-3928.md): Hardcoded credential is found in the message queue (CVSS 7.1, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM) - [CVE-2022-3927](https://cve.now/CVE-2022-3927.md): The affected products store public and private key that are used to sign and protect custom parameter set files from modification. (CVSS 8.0, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM) - [CVE-2021-40342](https://cve.now/CVE-2021-40342.md): Use of default key for encryption (CVSS 7.1, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM) - [CVE-2021-40341](https://cve.now/CVE-2021-40341.md): Weak DES encryption (CVSS 7.1, Hitachi Energy FOXMAN-UN · Hitachi Energy UNEM) - [CVE-2014-125045](https://cve.now/CVE-2014-125045.md): meol1 index.php GetAnimal sql injection (CVSS 5.5, meol1) - [CVE-2023-22455](https://cve.now/CVE-2023-22455.md): Discourse vulnerable to Cross-site Scripting through tag descriptions (CVSS 6.8, discourse) - [CVE-2023-22454](https://cve.now/CVE-2023-22454.md): Discourse vulnerable to Cross-site Scripting through pending post titles descriptions (CVSS 8.0, discourse) - [CVE-2023-22453](https://cve.now/CVE-2023-22453.md): Discourse vulnerable to exposure of user post counts per topic to unauthorized users (CVSS 5.3, discourse) - [CVE-2022-46177](https://cve.now/CVE-2022-46177.md): Discourse password reset link can lead to in account takeover if user changes to a new email (CVSS 5.7, discourse) - [CVE-2017-20163](https://cve.now/CVE-2017-20163.md): Red Snapper NView Session.php mutate sql injection (CVSS 5.5, Red Snapper NView) - [CVE-2014-125044](https://cve.now/CVE-2014-125044.md): soshtolsus wing-tight index.php file inclusion (CVSS 6.3, soshtolsus wing-tight) - [CVE-2023-0088](https://cve.now/CVE-2023-0088.md): Swifty Page Manager \<= 3.0.1 - Cross-Site Request Forgery (CVSS 8.8, swiftylife Swifty Page Manager) - [CVE-2023-0087](https://cve.now/CVE-2023-0087.md): Swifty Page Manager \<= 3.0.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, swiftylife Swifty Page Manager) - [CVE-2022-23546](https://cve.now/CVE-2022-23546.md): Discourse vulnerable to private topic leak via email#send\_digest (CVSS 5.5, discourse) - [CVE-2022-43573](https://cve.now/CVE-2022-43573.md): IBM Robotic Process Automation information disclosure (CVSS 3.1, IBM Robotic Process Automation) - [CVE-2022-4435](https://cve.now/CVE-2022-4435.md): A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoRemoteConfigUpdateDxe driver that could allow a local attacker (CVSS 6.7, Lenovo ThinkPad X13s) - [CVE-2022-4434](https://cve.now/CVE-2022-4434.md): A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS driver that could allow a local attacker with elevated privileges to (CVSS 6.7, Lenovo ThinkPad X13s) - [CVE-2022-4433](https://cve.now/CVE-2022-4433.md): A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS LenovoSetupConfigDxe driver that could allow a local attacker with el (CVSS 6.7, Lenovo ThinkPad X13s) - [CVE-2022-4432](https://cve.now/CVE-2022-4432.md): A buffer over-read vulnerability was reported in the ThinkPadX13s BIOS PersistenceConfigDxe driver that could allow a local attacker with el (CVSS 6.7, Lenovo ThinkPad X13s) - [CVE-2022-41740](https://cve.now/CVE-2022-41740.md): IBM Robotic Process Automation information disclosure (CVSS 4.6, IBM Robotic Process Automation) - [CVE-2022-43844](https://cve.now/CVE-2022-43844.md): IBM Robotic Process Automation for Cloud Pak session fixation (CVSS 8.8, IBM Robotic Process Automation for Cloud Pak) - [CVE-2022-46168](https://cve.now/CVE-2022-46168.md): Group SMTP user emails are exposed in CC email header (CVSS 3.5, discourse) - [CVE-2023-0086](https://cve.now/CVE-2023-0086.md): JetWidgets for Elementor \<= 1.0.12 - Cross-Site Request Forgery to Settings Update (CVSS 5.4, jetmonsters JetWidgets For Elementor) - [CVE-2015-10015](https://cve.now/CVE-2015-10015.md): glidernet ogn-live sql injection (CVSS 5.5, glidernet ogn-live) - [CVE-2014-125041](https://cve.now/CVE-2014-125041.md): Miccighel PR-CWT sql injection (CVSS 5.5, Miccighel PR-CWT) - [CVE-2015-10014](https://cve.now/CVE-2015-10014.md): arekk uke finder.rb sql injection (CVSS 5.5, arekk uke) - [CVE-2014-125040](https://cve.now/CVE-2014-125040.md): stevejagodzinski DevNewsAggregator RemoteHtmlContentDataAccess.php getByName sql injection (CVSS 5.5, stevejagodzinski DevNewsAggregator) - [CVE-2017-20162](https://cve.now/CVE-2017-20162.md): vercel ms index.js parse redos (CVSS 4.3, vercel ms · ms) - [CVE-2020-36641](https://cve.now/CVE-2020-36641.md): gturri aXMLRPC ResponseParser.java ResponseParser xml external entity reference (CVSS 5.5, gturri aXMLRPC · fr.turri:aXMLRPC) - [CVE-2007-10001](https://cve.now/CVE-2007-10001.md): web-cyradm search.php sql injection (CVSS 3.5, web-cyradm) - [CVE-2021-4305](https://cve.now/CVE-2021-4305.md): Woorank robots-txt-guard patterns.js makePathPattern redos (CVSS 3.5, Woorank robots-txt-guard · robots-txt-guard) - [CVE-2021-4304](https://cve.now/CVE-2021-4304.md): eprintsug ulcc-core toolbox command injection (CVSS 6.3, eprintsug ulcc-core) - [CVE-2015-10013](https://cve.now/CVE-2015-10013.md): WebDevStudios taxonomy-switcher Plugin taxonomy-switcher.php taxonomy\_switcher\_init cross site scripting (CVSS 3.5, WebDevStudios taxonomy-switcher Plugin) - [CVE-2018-25065](https://cve.now/CVE-2018-25065.md): Wikimedia mediawiki-extensions-I18nTags Unlike Parser I18nTags\_body.php cross site scripting (CVSS 3.5, Wikimedia mediawiki-extensions-I18nTags) - [CVE-2022-4877](https://cve.now/CVE-2022-4877.md): snoyberg keter Proxy.hs cross site scripting (CVSS 3.5, snoyberg keter) - [CVE-2020-36640](https://cve.now/CVE-2020-36640.md): bonitasoft bonita-connector-webservice SecureWSConnector.java TransformerConfigurationException xml external entity reference (CVSS 5.5, bonitasoft bonita-connector-webservice · org.bonitasoft.con…) - [CVE-2023-0077](https://cve.now/CVE-2023-0077.md): Integer overflow or wraparound vulnerability in CGI component in Synology Router Manager (SRM) before 1.2.5-8227-6 and 1.3.1-9346-3 allows r (CVSS 6.5, Synology Router Manager) - [CVE-2022-43932](https://cve.now/CVE-2022-43932.md): Improper neutralization of special elements in output used by a downstream component ('Injection') vulnerability in CGI component in Synolog (CVSS 7.5, Synology Router Manager) - [CVE-2021-4303](https://cve.now/CVE-2021-4303.md): shannah Xataface Installer install\_form.js.php testftp cross site scripting (CVSS 2.0, shannah Xataface · xataface/xataface) - [CVE-2016-15010](https://cve.now/CVE-2016-15010.md): University of Cambridge django-ucamlookup Lookup cross site scripting (CVSS 3.5, University of Cambridge django-ucamlookup · django-ucamlook…) - [CVE-2016-15009](https://cve.now/CVE-2016-15009.md): OpenACS bug-tracker Search nav-bar.adp cross-site request forgery (CVSS 3.5, OpenACS bug-tracker) - [CVE-2018-25064](https://cve.now/CVE-2018-25064.md): OSM Lab show-me-the-way site.js cross site scripting (CVSS 3.5, OSM Lab show-me-the-way) - [CVE-2022-4869](https://cve.now/CVE-2022-4869.md): Evolution Events Artaxerxes POST Parameter middleware.py information disclosure (CVSS 3.5, Evolution Events Artaxerxes) - [CVE-2019-25098](https://cve.now/CVE-2019-25098.md): soerennb eXtplorer Archive archive.php path traversal (CVSS 5.5, soerennb eXtplorer) - [CVE-2019-25097](https://cve.now/CVE-2019-25097.md): soerennb eXtplorer Directory Content path traversal (CVSS 5.5, soerennb eXtplorer) - [CVE-2019-25096](https://cve.now/CVE-2019-25096.md): soerennb eXtplorer cross site scripting (CVSS 3.5, soerennb eXtplorer) - [CVE-2019-25095](https://cve.now/CVE-2019-25095.md): kakwa LdapCherry URL cross site scripting (CVSS 3.5, kakwa LdapCherry · ldapcherry) - [CVE-2022-45857](https://cve.now/CVE-2022-45857.md): An incorrect user management vulnerability \[CWE-286\] in the FortiManager version 6.4.6 and below VDOM creation component may allow an attack (CVSS 6.0, Fortinet FortiManager) - [CVE-2021-32828](https://cve.now/CVE-2021-32828.md): Regular expression Denial of Service in MooTools (CVSS 5.4, Hyland Nuxeo · org.nuxeo.ecm.platform:nuxeo-platform-oauth) - [CVE-2022-23548](https://cve.now/CVE-2022-23548.md): Discourse is an option source discussion platform. (CVSS 6.5, discourse) - [CVE-2022-23549](https://cve.now/CVE-2022-23549.md): Discourse vulnerable to bypass of post max\_length using HTML comments (CVSS 5.7, discourse) - [CVE-2022-3715](https://cve.now/CVE-2022-3715.md): A flaw was found in the bash package, where a heap-buffer overflow can occur in valid parameter\_transform. (CVSS 7.8, bash) - [CVE-2022-4378](https://cve.now/CVE-2022-4378.md): A stack overflow flaw was found in the Linux kernel's SYSCTL subsystem in how a user changes certain kernel parameters and variables. (CVSS 7.8, kernel) - [CVE-2022-44877](https://cve.now/CVE-2022-44877.md): login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS comma (CVSS 9.8, KEV) - [CVE-2022-45995](https://cve.now/CVE-2022-45995.md): There is an unauthorized buffer overflow vulnerability in Tenda AX12 v22.03.01.21 \_ cn. (CVSS 9.8) - [CVE-2022-46489](https://cve.now/CVE-2022-46489.md): GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the gf\_isom\_box\_parse\_ex function at box\_funcs.c. (CVSS 5.5) - [CVE-2022-46490](https://cve.now/CVE-2022-46490.md): GPAC version 2.1-DEV-rev505-gb9577e6ad-master was discovered to contain a memory leak via the afrt\_box\_read function at box\_code\_adobe.c. (CVSS 5.5) - [CVE-2022-47086](https://cve.now/CVE-2022-47086.md): GPAC MP4Box v2.1-DEV-rev574-g9d5bb184b contains a segmentation violation via the function gf\_sm\_load\_init\_swf at scene\_manager/swf\_parse.c (CVSS 5.5) - [CVE-2022-47087](https://cve.now/CVE-2022-47087.md): GPAC MP4box 2.1-DEV-rev574-g9d5bb184b has a Buffer overflow in gf\_vvc\_read\_pps\_bs\_internal function of media\_tools/av\_parsers.c (CVSS 7.8) - [CVE-2022-47088](https://cve.now/CVE-2022-47088.md): GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow. (CVSS 7.8) - [CVE-2022-47089](https://cve.now/CVE-2022-47089.md): GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow via gf\_vvc\_read\_sps\_bs\_internal function of media\_tools/av\_parsers.c (CVSS 7.8) - [CVE-2022-47091](https://cve.now/CVE-2022-47091.md): GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer Overflow in gf\_text\_process\_sub function of filters/load\_text.c (CVSS 7.8) - [CVE-2022-47092](https://cve.now/CVE-2022-47092.md): GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is contains an Integer overflow vulnerability in gf\_hevc\_read\_sps\_bs\_internal function of media\_tools/ (CVSS 7.1) - [CVE-2022-47093](https://cve.now/CVE-2022-47093.md): GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to heap use-after-free via filters/dmx\_m2ts.c:470 in m2tsdmx\_declare\_pid (CVSS 7.8) - [CVE-2022-47094](https://cve.now/CVE-2022-47094.md): GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Null pointer dereference via filters/dmx\_m2ts.c:343 in m2tsdmx\_declare\_pid (CVSS 7.8) - [CVE-2022-47095](https://cve.now/CVE-2022-47095.md): GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffer overflow in hevc\_parse\_vps\_extension function of media\_tools/av\_parsers.c (CVSS 7.8) - [CVE-2022-47523](https://cve.now/CVE-2022-47523.md): Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection (CVSS 9.8) - [CVE-2022-47543](https://cve.now/CVE-2022-47543.md): An issue was discovered in Siren Investigate before 12.1.7. (CVSS 5.3) - [CVE-2022-47544](https://cve.now/CVE-2022-47544.md): An issue was discovered in Siren Investigate before 12.1.7. (CVSS 9.8) - [CVE-2022-47653](https://cve.now/CVE-2022-47653.md): GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in eac3\_update\_channels function of media\_tools/av\_parsers.c:9113 (CVSS 7.8) - [CVE-2022-47654](https://cve.now/CVE-2022-47654.md): GPAC MP4box 2.1-DEV-rev593-g007bf61a0 is vulnerable to Buffer Overflow in gf\_hevc\_read\_sps\_bs\_internal function of media\_tools/av\_parsers.c: (CVSS 7.8) - [CVE-2022-47655](https://cve.now/CVE-2022-47655.md): Libde265 1.0.9 is vulnerable to Buffer Overflow in function void put\_qpel\_fallback\ (CVSS 7.8) - [CVE-2022-47656](https://cve.now/CVE-2022-47656.md): GPAC MP4box 2.1-DEV-rev617-g85ce76efd is vulnerable to Buffer Overflow in gf\_hevc\_read\_sps\_bs\_internal function of media\_tools/av\_parsers.c: (CVSS 7.8) - [CVE-2022-47657](https://cve.now/CVE-2022-47657.md): GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function hevc\_parse\_vps\_extension of media\_tools/av\_parsers.c:7662 (CVSS 7.8) - [CVE-2022-47658](https://cve.now/CVE-2022-47658.md): GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to buffer overflow in function gf\_hevc\_read\_vps\_bs\_internal of media\_tools/av\_parsers.c: (CVSS 7.8) - [CVE-2022-47659](https://cve.now/CVE-2022-47659.md): GPAC MP4box 2.1-DEV-rev644-g5c4df2a67 is vulnerable to Buffer Overflow in gf\_bs\_read\_data (CVSS 7.8) - [CVE-2022-47660](https://cve.now/CVE-2022-47660.md): GPAC MP4Box 2.1-DEV-rev644-g5c4df2a67 is has an integer overflow in isomedia/isom\_write.c (CVSS 7.8) - [CVE-2022-47661](https://cve.now/CVE-2022-47661.md): GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 is vulnerable to Buffer Overflow via media\_tools/av\_parsers.c:4988 in gf\_media\_nalu\_add\_emulation\_byte (CVSS 7.8) - [CVE-2022-47662](https://cve.now/CVE-2022-47662.md): GPAC MP4Box 2.1-DEV-rev649-ga8f438d20 has a segment fault (/stack overflow) due to infinite recursion in Media\_GetSample isomedia/media.c:66 (CVSS 5.5) - [CVE-2022-47663](https://cve.now/CVE-2022-47663.md): GPAC MP4box 2.1-DEV-rev649-ga8f438d20 is vulnerable to buffer overflow in h263dmx\_process filters/reframe\_h263.c:609 (CVSS 7.8) - [CVE-2023-0057](https://cve.now/CVE-2023-0057.md): Improper Restriction of Rendered UI Layers or Frames in pyload/pyload (CVSS 3.1, pyload/pyload · pyload-ng) - [CVE-2023-22622](https://cve.now/CVE-2023-22622.md): WordPress through 6.1.1 depends on unpredictable client visits to cause wp-cron.php execution and the resulting security updates, and the so (CVSS 5.3) - [CVE-2023-22626](https://cve.now/CVE-2023-22626.md): PgHero before 3.1.0 allows Information Disclosure via EXPLAIN because query results may be present in an error message. (CVSS 7.5, pghero) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2023-01-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.