CVEs published January 9, 2023
64 CVEs were published on January 9, 2023: 1 critical, 15 high.
- Published
- 64
- Critical
- 1
- High
- 15
- Medium
- 36
- Low
- 11
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 40
Most affected products
- OpenHarmony
- 4
- Linksys WRT54GL Wireless-G Broadband Router
- 3
- Zoom Video Communications Zoom Rooms for macOS
- 3
- nextcloud security-advisories
- 2
- Royal Elementor Addons
- 2
- weaveworks weave-gitops · github.com/weaveworks/weave-gitops
- 2
- WPtouch
- 2
- Zoom Video Communications Zoom Rooms for Windows
- 2
- 01-Scripts 01-Artikelsystem
- 1
- 404 to Start
- 1
Critical 1
High 15
- CVE-2022-3679Starter Templates by Kadence WP < 1.2.17 - Admin+ PHP Object InjectionStarter Templates by Kadence WP
- CVE-2022-3417WPtouch < 4.3.45 - Admin+ PHP Object InjectionWPtouch
- CVE-2022-4043WP Custom Admin Interface < 7.29 - Admin+ PHP Object InjectionWP Custom Admin Interface
- CVE-2022-3416WPtouch < 4.3.45 - Admin+ Arbitrary File UploadWPtouch
- CVE-2022-23509Weave Gitops Run vulnerable to insecure communicationweaveworks weave-gitops · github.com/weaveworks/weave-gitops
- CVE-2022-23508GitOps Run allows for Kubernetes workload injectionweaveworks weave-gitops · github.com/weaveworks/weave-gitops
- CVE-2022-25890All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization.wifey
- CVE-2022-36926Local Privilege Escalation in Zoom Rooms for macOS ClientsZoom Video Communications Zoom Rooms for macOS
- CVE-2022-36927Local Privilege Escalation in Zoom Rooms for macOS ClientsZoom Video Communications Zoom Rooms for macOS
- CVE-2022-36929Local Privilege Escalation in Zoom Rooms for Windows ClientsZoom Video Communications Zoom Rooms for Windows
- CVE-2022-36930Local Privilege Escalation in Zoom Rooms for Windows InstallersZoom Video Communications Zoom Rooms for Windows
- CVE-2022-43970Buffer overflow in Linksys WRT54GLLinksys WRT54GL Wireless-G Broadband Router
- CVE-2022-43971Arbitrary code execution in Linksys WUMC710Linksys WUMC710 Wireless-AC Universal Media Connector
- CVE-2022-43973Arbitrary code execution in Linksys WRT54GLLinksys WRT54GL Wireless-G Broadband Router
- CVE-2022-43974MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in matrixSslDecodeTls13.
Medium, low and unrated 48
- CVE-2022-4325Post Status Notifier Lite < 1.10.1 - Reflected XSSPost Status Notifier Lite
- CVE-2022-4391Vision Interactive For WordPress <= 1.5.3 - Contributor+ Stored XSSVision Interactive For WordPress
- CVE-2022-4368WP CSV <= 1.8.0.0 - Reflected XSS via CSV ImportWP CSV
- CVE-2022-3855404 to Start <= 1.6.1 - Admin+ Stored XSS404 to Start
- CVE-2022-4426Mautic Integration For WooCommerce < 1.0.3 - Arbitrary Options Update via CSRFMautic Integration for WooCommerce
- CVE-2022-4102Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post DeletionRoyal Elementor Addons
- CVE-2022-4196Multi Step Form < 1.7.8 - Admin+ Stored XSSMulti Step Form
- CVE-2022-4374Bg Bible References <= 3.8.14 - Reflected XSSBg Bible References
- CVE-2022-4103Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post CreationRoyal Elementor Addons
- CVE-2022-4301Sunshine Photo Cart < 2.9.15 - Reflected XSSSunshine Photo Cart
- CVE-2022-4497Jetpack CRM < 5.5 - Contributor+ Stored XSSJetpack CRM
- CVE-2022-3923ActiveCampaign for WooCommerce < 1.9.8 - Subscriber+ Error Log CleanupActiveCampaign for WooCommerce
- CVE-2022-4394iPages Flipbook For WordPress <= 1.4.6 - Contributor+ Stored XSSiPages Flipbook For WordPress
- CVE-2022-4479Table of Contents Plus < 2212 - Contributor+ Stored XSSTable of Contents Plus
- CVE-2022-4491WP Table Reloaded <= 1.9.4 - Contributor+ Stored XSSWP-Table Reloaded
- CVE-2022-4468WP Recipe Maker < 8.6.1 - Contributor+ Stored XSSWP Recipe Maker
- CVE-2022-4393ImageLinks Interactive Image Builder for WordPress <= 1.5.3 - Contributor+ Stored XSSImageLinks Interactive Image Builder for WordPress
- CVE-2022-4392iPanorama 360 WordPress Virtual Tour Builder <= 1.6.29 - Contributor+ Stored XSSiPanorama 360 WordPress Virtual Tour Builder
- CVE-2022-3343WPQA < 5.9.3 - Missing validation lead to functionality abuseWPQA Builder · Discy +1
- CVE-2022-4310Slimstat Analytics < 4.9.3 - Unauthenticated Stored XSSSlimstat Analytics
- CVE-2014-125072CherishSin klattr sql injectionCherishSin klattr
- CVE-2023-0125Control iD Gerencia Web Web Interface cross site scriptingControl iD Gerencia Web
- CVE-2014-125071lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websocketslukehutch Gribbit
- CVE-2015-10035gperson angular-test-reporter data-server.js addTest sql injectiongperson angular-test-reporter
- CVE-2015-10034j-nowak workout-organizer sql injectionj-nowak workout-organizer
- CVE-2015-10033jvvlee MerlinsBoard Grade improper authorizationjvvlee MerlinsBoard
- CVE-2022-4884Path-Traversal in MKP storingTribe29 Checkmk
- CVE-2023-22477Mercurius is vulnerable to denial of service (DoS) when using subscriptionsmercurius-js mercurius · mercurius
- CVE-2023-22473Passcode bypass on Talk-Android appnextcloud security-advisories
- CVE-2023-22472Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious linknextcloud security-advisories
- CVE-2021-4311Talend Open Studio for MDM XML xml external entity referenceTalend Open Studio for MDM
- CVE-2022-2196Speculative execution attacks in KVM VMXLinux Kernel
- CVE-2022-46769Apache Sling App CMS: XSS in CMS Site Group DetailApache Software Foundation Apache Sling App CMS · org.apach…
- CVE-2017-20165debug-js debug node.js useColors redosdebug-js debug · debug
- CVE-2022-4882kaltura mwEmbed Share Plugin share.js cross site scriptingkaltura mwEmbed
- CVE-2015-10032HealthMateWeb createaccount.php cross site scriptingHealthMateWeb
- CVE-2021-431001-Scripts 01-Artikelsystem 01article.php cross site scripting01-Scripts 01-Artikelsystem
- CVE-2010-10004Information Cards Module cross site scriptingInformation Cards Module · simplesamlphp/simplesamlphp-modu…
- CVE-2023-0036platform_callback_stub in misc subsystem has an authentication bypass vulnerability which allows an "SA relay attack".OpenHarmony
- CVE-2023-0035softbus_client_stub in communication subsystem has an authentication bypass vulnerability which allows an "SA relay attack".OpenHarmony
- CVE-2022-43662Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysTimerGettime.OpenHarmony
- CVE-2022-45126Kernel subsystem in kernel_liteos_a has a kernel stack overflow vulnerability when call SysClockGettime.OpenHarmony
- CVE-2021-36603Cross Site Scripting (XSS) in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "Fr
- CVE-2022-36925Insecure key generation for Zoom Rooms for macOS ClientsZoom Video Communications Zoom Rooms for macOS
- CVE-2022-36928Path Traversal in Zoom for Android ClientsZoom Video Communications Zoom for Android
- CVE-2022-43972Null pointer dereference in Linksys WRT54GLLinksys WRT54GL Wireless-G Broadband Router
- CVE-2022-46258Incorrect Authorization in GitHub Enterprise Server leads to Action Workflow modifications without Workflow ScopeGitHub Enterprise Server
- CVE-2022-46603An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file.