CVEs published January 6, 2023
78 CVEs were published on January 6, 2023: 4 critical, 34 high.
- Published
- 78
- Critical
- 4
- High
- 34
- Medium
- 40
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 23
Most affected products
- Qualcomm Snapdragon
- 30
- Huawei HarmonyOS · Huawei EMUI
- 7
- Nokia ASIK AirScale
- 3
- Bentley Systems MicroStation Connect
- 2
- Apache Software Foundation Apache James MIME4J · org.apache…
- 1
- Apache Software Foundation Apache James server · org.apache…
- 1
- Arthmoor QSF-Portal
- 1
- DBRisinajumi d2files · dbrisinajumi/d2files
- 1
- devent globalpom-utils · com.anrisoftware.globalpom:globalp…
- 1
- e-Contract dssp · be.e_contract.dssp:dssp-client
- 1
Critical 4
- CVE-2022-33219Integer Overflow to Buffer Overflow in AutomotiveQualcomm Snapdragon
- CVE-2022-22088Integer Overflow to Buffer Overflow in Bluetooth HOSTQualcomm Snapdragon
- CVE-2022-39073There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the MF286R
- CVE-2023-22671Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injectio
High 34
- CVE-2022-41613Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to an Out-of-Bounds Read when when parsing DGN files, wBentley Systems MicroStation Connect
- CVE-2022-40201Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to a Stack-Based Buffer Overflow when a malformed desigBentley Systems MicroStation Connect
- CVE-2022-2484 The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified firNokia ASIK AirScale
- CVE-2022-2483 The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification Nokia ASIK AirScale
- CVE-2022-2482 A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place Nokia ASIK AirScale
- CVE-2022-40520Stack based buffer overflow in CoreQualcomm Snapdragon
- CVE-2022-40517Stack based buffer overflow in CoreQualcomm Snapdragon
- CVE-2022-40516Stack-based buffer overflow in CoreQualcomm Snapdragon
- CVE-2022-33300Improper input validation in Automotive Android OSQualcomm Snapdragon
- CVE-2022-33299Null pointer dereference in Bluetooth HOSTQualcomm Snapdragon
- CVE-2022-33290Null pointer dereference in Bluetooth HOSTQualcomm Snapdragon
- CVE-2022-33286Buffer over-read in WLANQualcomm Snapdragon
- CVE-2022-33285Buffer over-read in WLANQualcomm Snapdragon
- CVE-2022-33284Buffer over-read in WLANQualcomm Snapdragon
- CVE-2022-33283Buffer over-read in WLANQualcomm Snapdragon
- CVE-2022-33276Buffer copy without checking size of input in ModemQualcomm Snapdragon
- CVE-2022-33274Improper validation of array index in Android CoreQualcomm Snapdragon
- CVE-2022-33265Information exposure in Powerline Communication FirmwareQualcomm Snapdragon
- CVE-2022-33255Buffer over-read in Bluetooth HOSTQualcomm Snapdragon
- CVE-2022-33253Buffer over-read in WLANQualcomm Snapdragon
- CVE-2022-33252Buffer over-read in WLANQualcomm Snapdragon
- CVE-2022-33218Improper Input Validation in AutomotiveQualcomm Snapdragon
- CVE-2022-25746Buffer Copy Without Checking Size of Input in KernelQualcomm Snapdragon
- CVE-2022-25923Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper uexec-local-bin
- CVE-2021-46867The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory aHuawei HarmonyOS · Huawei EMUI
- CVE-2021-46868The HW_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory aHuawei HarmonyOS · Huawei EMUI
- CVE-2022-40049SQL injection vulnerability in sourcecodester Theme Park Ticketing System 1.0 allows remote attackers to view sensitive information via the
- CVE-2022-42979Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take ov
- CVE-2022-44149The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in
- CVE-2022-44939Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll.
- CVE-2022-46761The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may caHuawei HarmonyOS · Huawei EMUI
- CVE-2022-46762The memory management module has a logic bypass vulnerability.Successful exploitation of this vulnerability may affect data confidentiality.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-47975The DUBAI module has a double free vulnerability.Huawei HarmonyOS · Huawei EMUI
- CVE-2022-47976The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of thisHuawei HarmonyOS · Huawei EMUI
Medium, low and unrated 40
- CVE-2014-125053Piwigo-Guest-Book Navigation Bar guestbook.inc.php sql injectionPiwigo-Guest-Book
- CVE-2013-10008sheilazpy eShop sql injectionsheilazpy eShop
- CVE-2014-125052JervenBolleman sparql-identifiers RegistryDao.java sql injectionJervenBolleman sparql-identifiers
- CVE-2018-25068devent globalpom-utils FileResourceManagerProvider.java createTmpDir temp filedevent globalpom-utils · com.anrisoftware.globalpom:globalp…
- CVE-2018-25067JoomGallery Image Sort default.php sql injectionJoomGallery
- CVE-2022-35281IBM Maximo Application Suite command injectionIBM Maximo Asset Management · IBM Maximo Manage
- CVE-2022-22470IBM Security Verify Governance information disclosureIBM Security Verify Governance
- CVE-2014-125051himiklab yii2-jqgrid-widget JqGridAction.php addSearchOptionsRecursively sql injectionhimiklab yii2-jqgrid-widget · himiklab/yii2-jqgrid-widget
- CVE-2014-125050ScottTZhang voter-js main.js sql injectionScottTZhang voter-js
- CVE-2023-22475Cross-Site Scripting in Canarytoken historythinkst canarytokens
- CVE-2015-10018DBRisinajumi d2files D2filesController.php actionDownloadFile sql injectionDBRisinajumi d2files · dbrisinajumi/d2files
- CVE-2014-125049typcn Blogile server.js getNav sql injectiontypcn Blogile
- CVE-2014-125048kassi xingwall oauth.js session fixiationkassi xingwall
- CVE-2019-25099Arthmoor QSF-Portal index.php path traversalArthmoor QSF-Portal
- CVE-2014-125047tbezman school-store sql injectiontbezman school-store
- CVE-2022-4879Forged Alliance Forever Vote improper authorizationForged Alliance Forever
- CVE-2018-25066PeterMu nodebatis sql injectionPeterMu nodebatis · nodebatis
- CVE-2020-36642trampgeek jobe LanguageTask.php run_in_sandbox command injectiontrampgeek jobe
- CVE-2015-10017HPI-Information-Systems ProLOD sql injectionHPI-Information-Systems ProLOD
- CVE-2014-125046Seiji42 cub-scout-tracker databaseAccessFunctions.js sql injectionSeiji42 cub-scout-tracker
- CVE-2015-10016jeff-kelley opensim-utils regionscrits.php DatabaseForRegion sql injectionjeff-kelley opensim-utils
- CVE-2016-15011e-Contract dssp SignResponseVerifier.java checkSignResponse xml external entity referencee-Contract dssp · be.e_contract.dssp:dssp-client
- CVE-2022-45935Apache James server: Temporary File Information DisclosureApache Software Foundation Apache James server · org.apache…
- CVE-2022-45787Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProviderApache Software Foundation Apache James MIME4J · org.apache…
- CVE-2022-4878JATOS ZIP ZipUtil.java ZipUtil path traversalJATOS
- CVE-2022-40519Buffer over-read in CoreQualcomm Snapdragon
- CVE-2022-40518Buffer overread in CoreQualcomm Snapdragon
- CVE-2022-33266Integer overflow to buffer overflow in AudioQualcomm Snapdragon
- CVE-2022-25725Use-after-Free in MODEMQualcomm Snapdragon
- CVE-2022-25722Information Exposure in DSP ServicesQualcomm Snapdragon
- CVE-2022-25721Incorrect Type Conversion in Video driverQualcomm Snapdragon
- CVE-2022-25717Use-After-Free Issue in DisplayQualcomm Snapdragon
- CVE-2022-25716Time-of-check Time-of-use Race Condition in Multimedia FrameworkQualcomm Snapdragon
- CVE-2022-25715Incorrect type casting in Display driverQualcomm Snapdragon
- CVE-2022-22079Buffer Over-read in BOOTQualcomm Snapdragon
- CVE-2022-39072There is a SQL injection vulnerability in Some ZTE Mobile Internet products.MF286R,MF289D
- CVE-2022-44870A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML v
- CVE-2022-45911An issue was discovered in Zimbra Collaboration (ZCS) 9.0.
- CVE-2022-45913An issue was discovered in Zimbra Collaboration (ZCS) 9.0.
- CVE-2022-47974The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the BlueHuawei HarmonyOS · Huawei EMUI