# CVEs published 2023-01-06

78 CVEs were published on January 6, 2023: 4 critical, 34 high. Days are UTC.

- [CVE-2014-125053](https://cve.now/CVE-2014-125053.md): Piwigo-Guest-Book Navigation Bar guestbook.inc.php sql injection (CVSS 5.5, Piwigo-Guest-Book)
- [CVE-2022-41613](https://cve.now/CVE-2022-41613.md): Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to an Out-of-Bounds Read when when parsing DGN files, w (CVSS 7.8, Bentley Systems MicroStation Connect)
- [CVE-2013-10008](https://cve.now/CVE-2013-10008.md): sheilazpy eShop sql injection (CVSS 5.5, sheilazpy eShop)
- [CVE-2022-40201](https://cve.now/CVE-2022-40201.md): Bentley Systems MicroStation Connect versions 10.17.0.209 and prior are vulnerable to a Stack-Based Buffer Overflow when a malformed desig (CVSS 7.8, Bentley Systems MicroStation Connect)
- [CVE-2022-2484](https://cve.now/CVE-2022-2484.md): The signature check in the Nokia ASIK AirScale system module version 474021A.101 can be bypassed allowing an attacker to run modified fir (CVSS 8.4, Nokia ASIK AirScale)
- [CVE-2022-2483](https://cve.now/CVE-2022-2483.md): The bootloader in the Nokia ASIK AirScale system module (versions 474021A.101 and 474021A.102) loads public keys for firmware verification (CVSS 8.4, Nokia ASIK AirScale)
- [CVE-2022-2482](https://cve.now/CVE-2022-2482.md): A vulnerability exists in Nokia’s ASIK AirScale system module (versions 474021A.101 and 474021A.102) that could allow an attacker to place (CVSS 8.4, Nokia ASIK AirScale)
- [CVE-2014-125052](https://cve.now/CVE-2014-125052.md): JervenBolleman sparql-identifiers RegistryDao.java sql injection (CVSS 5.5, JervenBolleman sparql-identifiers)
- [CVE-2018-25068](https://cve.now/CVE-2018-25068.md): devent globalpom-utils FileResourceManagerProvider.java createTmpDir temp file (CVSS 6.3, devent globalpom-utils · com.anrisoftware.globalpom:globalp…)
- [CVE-2018-25067](https://cve.now/CVE-2018-25067.md): JoomGallery Image Sort default.php sql injection (CVSS 5.5, JoomGallery)
- [CVE-2022-35281](https://cve.now/CVE-2022-35281.md): IBM Maximo Application Suite command injection (CVSS 5.5, IBM Maximo Asset Management · IBM Maximo Manage)
- [CVE-2022-22470](https://cve.now/CVE-2022-22470.md): IBM Security Verify Governance information disclosure (CVSS 4.1, IBM Security Verify Governance)
- [CVE-2014-125051](https://cve.now/CVE-2014-125051.md): himiklab yii2-jqgrid-widget JqGridAction.php addSearchOptionsRecursively sql injection (CVSS 5.5, himiklab yii2-jqgrid-widget · himiklab/yii2-jqgrid-widget)
- [CVE-2014-125050](https://cve.now/CVE-2014-125050.md): ScottTZhang voter-js main.js sql injection (CVSS 5.5, ScottTZhang voter-js)
- [CVE-2023-22475](https://cve.now/CVE-2023-22475.md): Cross-Site Scripting in Canarytoken history (CVSS 6.3, thinkst canarytokens)
- [CVE-2015-10018](https://cve.now/CVE-2015-10018.md): DBRisinajumi d2files D2filesController.php actionDownloadFile sql injection (CVSS 5.5, DBRisinajumi d2files · dbrisinajumi/d2files)
- [CVE-2014-125049](https://cve.now/CVE-2014-125049.md): typcn Blogile server.js getNav sql injection (CVSS 5.5, typcn Blogile)
- [CVE-2014-125048](https://cve.now/CVE-2014-125048.md): kassi xingwall oauth.js session fixiation (CVSS 6.3, kassi xingwall)
- [CVE-2019-25099](https://cve.now/CVE-2019-25099.md): Arthmoor QSF-Portal index.php path traversal (CVSS 5.5, Arthmoor QSF-Portal)
- [CVE-2014-125047](https://cve.now/CVE-2014-125047.md): tbezman school-store sql injection (CVSS 5.5, tbezman school-store)
- [CVE-2022-4879](https://cve.now/CVE-2022-4879.md): Forged Alliance Forever Vote improper authorization (CVSS 4.6, Forged Alliance Forever)
- [CVE-2018-25066](https://cve.now/CVE-2018-25066.md): PeterMu nodebatis sql injection (CVSS 5.5, PeterMu nodebatis · nodebatis)
- [CVE-2020-36642](https://cve.now/CVE-2020-36642.md): trampgeek jobe LanguageTask.php run\_in\_sandbox command injection (CVSS 5.5, trampgeek jobe)
- [CVE-2015-10017](https://cve.now/CVE-2015-10017.md): HPI-Information-Systems ProLOD sql injection (CVSS 5.5, HPI-Information-Systems ProLOD)
- [CVE-2014-125046](https://cve.now/CVE-2014-125046.md): Seiji42 cub-scout-tracker databaseAccessFunctions.js sql injection (CVSS 5.5, Seiji42 cub-scout-tracker)
- [CVE-2015-10016](https://cve.now/CVE-2015-10016.md): jeff-kelley opensim-utils regionscrits.php DatabaseForRegion sql injection (CVSS 5.5, jeff-kelley opensim-utils)
- [CVE-2016-15011](https://cve.now/CVE-2016-15011.md): e-Contract dssp SignResponseVerifier.java checkSignResponse xml external entity reference (CVSS 5.5, e-Contract dssp · be.e\_contract.dssp:dssp-client)
- [CVE-2022-45935](https://cve.now/CVE-2022-45935.md): Apache James server: Temporary File Information Disclosure (CVSS 5.5, Apache Software Foundation Apache James server · org.apache…)
- [CVE-2022-45787](https://cve.now/CVE-2022-45787.md): Apache James MIME4J: Temporary File Information Disclosure in MIME4J TempFileStorageProvider (CVSS 5.5, Apache Software Foundation Apache James MIME4J · org.apache…)
- [CVE-2022-4878](https://cve.now/CVE-2022-4878.md): JATOS ZIP ZipUtil.java ZipUtil path traversal (CVSS 5.5, JATOS)
- [CVE-2022-40520](https://cve.now/CVE-2022-40520.md): Stack based buffer overflow in Core (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-40519](https://cve.now/CVE-2022-40519.md): Buffer over-read in Core (CVSS 6.8, Qualcomm Snapdragon)
- [CVE-2022-40518](https://cve.now/CVE-2022-40518.md): Buffer overread in Core (CVSS 6.8, Qualcomm Snapdragon)
- [CVE-2022-40517](https://cve.now/CVE-2022-40517.md): Stack based buffer overflow in Core (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-40516](https://cve.now/CVE-2022-40516.md): Stack-based buffer overflow in Core (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-33300](https://cve.now/CVE-2022-33300.md): Improper input validation in Automotive Android OS (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-33299](https://cve.now/CVE-2022-33299.md): Null pointer dereference in Bluetooth HOST (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33290](https://cve.now/CVE-2022-33290.md): Null pointer dereference in Bluetooth HOST (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33286](https://cve.now/CVE-2022-33286.md): Buffer over-read in WLAN (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33285](https://cve.now/CVE-2022-33285.md): Buffer over-read in WLAN (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33284](https://cve.now/CVE-2022-33284.md): Buffer over-read in WLAN (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33283](https://cve.now/CVE-2022-33283.md): Buffer over-read in WLAN (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33276](https://cve.now/CVE-2022-33276.md): Buffer copy without checking size of input in Modem (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-33274](https://cve.now/CVE-2022-33274.md): Improper validation of array index in Android Core (CVSS 8.4, Qualcomm Snapdragon)
- [CVE-2022-33266](https://cve.now/CVE-2022-33266.md): Integer overflow to buffer overflow in Audio (CVSS 5.9, Qualcomm Snapdragon)
- [CVE-2022-33265](https://cve.now/CVE-2022-33265.md): Information exposure in Powerline Communication Firmware (CVSS 7.3, Qualcomm Snapdragon)
- [CVE-2022-33255](https://cve.now/CVE-2022-33255.md): Buffer over-read in Bluetooth HOST (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33253](https://cve.now/CVE-2022-33253.md): Buffer over-read in WLAN (CVSS 7.5, Qualcomm Snapdragon)
- [CVE-2022-33252](https://cve.now/CVE-2022-33252.md): Buffer over-read in WLAN (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-33219](https://cve.now/CVE-2022-33219.md): Integer Overflow to Buffer Overflow in Automotive (CVSS 9.3, Qualcomm Snapdragon)
- [CVE-2022-33218](https://cve.now/CVE-2022-33218.md): Improper Input Validation in Automotive (CVSS 8.2, Qualcomm Snapdragon)
- [CVE-2022-25746](https://cve.now/CVE-2022-25746.md): Buffer Copy Without Checking Size of Input in Kernel (CVSS 8.1, Qualcomm Snapdragon)
- [CVE-2022-25725](https://cve.now/CVE-2022-25725.md): Use-after-Free in MODEM (CVSS 6.2, Qualcomm Snapdragon)
- [CVE-2022-25722](https://cve.now/CVE-2022-25722.md): Information Exposure in DSP Services (CVSS 6.0, Qualcomm Snapdragon)
- [CVE-2022-25721](https://cve.now/CVE-2022-25721.md): Incorrect Type Conversion in Video driver (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-25923](https://cve.now/CVE-2022-25923.md): Versions of the package exec-local-bin before 1.2.0 are vulnerable to Command Injection via the theProcess() functionality due to improper u (CVSS 7.4, exec-local-bin)
- [CVE-2022-25717](https://cve.now/CVE-2022-25717.md): Use-After-Free Issue in Display (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-25716](https://cve.now/CVE-2022-25716.md): Time-of-check Time-of-use Race Condition in Multimedia Framework (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-25715](https://cve.now/CVE-2022-25715.md): Incorrect type casting in Display driver (CVSS 6.7, Qualcomm Snapdragon)
- [CVE-2022-22088](https://cve.now/CVE-2022-22088.md): Integer Overflow to Buffer Overflow in Bluetooth HOST (CVSS 9.8, Qualcomm Snapdragon)
- [CVE-2022-22079](https://cve.now/CVE-2022-22079.md): Buffer Over-read in BOOT (CVSS 4.6, Qualcomm Snapdragon)
- [CVE-2021-46867](https://cve.now/CVE-2021-46867.md): The HW\_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory a (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2021-46868](https://cve.now/CVE-2021-46868.md): The HW\_KEYMASTER module has a problem in releasing memory.Successful exploitation of this vulnerability may result in out-of-bounds memory a (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-39072](https://cve.now/CVE-2022-39072.md): There is a SQL injection vulnerability in Some ZTE Mobile Internet products. (CVSS 5.4, MF286R,MF289D)
- [CVE-2022-39073](https://cve.now/CVE-2022-39073.md): There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the (CVSS 9.8, MF286R)
- [CVE-2022-40049](https://cve.now/CVE-2022-40049.md): SQL injection vulnerability in sourcecodester Theme Park Ticketing System 1.0 allows remote attackers to view sensitive information via the (CVSS 7.5)
- [CVE-2022-42979](https://cve.now/CVE-2022-42979.md): Information disclosure due to an insecure hostname validation in the RYDE application 5.8.43 for Android and iOS allows attackers to take ov (CVSS 8.8)
- [CVE-2022-44149](https://cve.now/CVE-2022-44149.md): The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in (CVSS 8.8)
- [CVE-2022-44870](https://cve.now/CVE-2022-44870.md): A reflected cross-site scripting (XSS) vulnerability in maccms10 v2022.1000.3032 allows attackers to execute arbitrary web scripts or HTML v (CVSS 6.1)
- [CVE-2022-44939](https://cve.now/CVE-2022-44939.md): Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. (CVSS 7.8)
- [CVE-2022-45911](https://cve.now/CVE-2022-45911.md): An issue was discovered in Zimbra Collaboration (ZCS) 9.0. (CVSS 6.1)
- [CVE-2022-45913](https://cve.now/CVE-2022-45913.md): An issue was discovered in Zimbra Collaboration (ZCS) 9.0. (CVSS 6.1)
- [CVE-2022-46761](https://cve.now/CVE-2022-46761.md): The system has a vulnerability that may cause dynamic hiding and restoring of app icons.Successful exploitation of this vulnerability may ca (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-46762](https://cve.now/CVE-2022-46762.md): The memory management module has a logic bypass vulnerability.Successful exploitation of this vulnerability may affect data confidentiality. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-47974](https://cve.now/CVE-2022-47974.md): The Bluetooth AVRCP module has a vulnerability that can lead to DoS attacks.Successful exploitation of this vulnerability may cause the Blue (CVSS 6.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-47975](https://cve.now/CVE-2022-47975.md): The DUBAI module has a double free vulnerability. (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2022-47976](https://cve.now/CVE-2022-47976.md): The DMSDP module of the distributed hardware has a vulnerability that may cause imposter control connections.Successful exploitation of this (CVSS 7.5, Huawei HarmonyOS · Huawei EMUI)
- [CVE-2023-22671](https://cve.now/CVE-2023-22671.md): Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injectio (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.