# CVEs published 2023-01-09

64 CVEs were published on January 9, 2023: 1 critical, 15 high. Days are UTC.

- [CVE-2022-4325](https://cve.now/CVE-2022-4325.md): Post Status Notifier Lite \< 1.10.1 - Reflected XSS (CVSS 6.1, Post Status Notifier Lite)
- [CVE-2022-4391](https://cve.now/CVE-2022-4391.md): Vision Interactive For WordPress \<= 1.5.3 - Contributor+ Stored XSS (CVSS 5.4, Vision Interactive For WordPress)
- [CVE-2022-4368](https://cve.now/CVE-2022-4368.md): WP CSV \<= 1.8.0.0 - Reflected XSS via CSV Import (CVSS 6.1, WP CSV)
- [CVE-2022-3679](https://cve.now/CVE-2022-3679.md): Starter Templates by Kadence WP \< 1.2.17 - Admin+ PHP Object Injection (CVSS 8.8, Starter Templates by Kadence WP)
- [CVE-2022-3855](https://cve.now/CVE-2022-3855.md): 404 to Start \<= 1.6.1 - Admin+ Stored XSS (CVSS 4.8, 404 to Start)
- [CVE-2022-4426](https://cve.now/CVE-2022-4426.md): Mautic Integration For WooCommerce \< 1.0.3 - Arbitrary Options Update via CSRF (CVSS 4.3, Mautic Integration for WooCommerce)
- [CVE-2022-4102](https://cve.now/CVE-2022-4102.md): Royal Elementor Addons \< 1.3.56 - Subscriber+ Arbitrary Post Deletion (CVSS 3.1, Royal Elementor Addons)
- [CVE-2022-4196](https://cve.now/CVE-2022-4196.md): Multi Step Form \< 1.7.8 - Admin+ Stored XSS (CVSS 4.8, Multi Step Form)
- [CVE-2022-4374](https://cve.now/CVE-2022-4374.md): Bg Bible References \<= 3.8.14 - Reflected XSS (CVSS 6.1, Bg Bible References)
- [CVE-2022-4103](https://cve.now/CVE-2022-4103.md): Royal Elementor Addons \< 1.3.56 - Subscriber+ Arbitrary Post Creation (CVSS 4.3, Royal Elementor Addons)
- [CVE-2022-4301](https://cve.now/CVE-2022-4301.md): Sunshine Photo Cart \< 2.9.15 - Reflected XSS (CVSS 6.1, Sunshine Photo Cart)
- [CVE-2022-4497](https://cve.now/CVE-2022-4497.md): Jetpack CRM \< 5.5 - Contributor+ Stored XSS (CVSS 5.4, Jetpack CRM)
- [CVE-2022-3923](https://cve.now/CVE-2022-3923.md): ActiveCampaign for WooCommerce \< 1.9.8 - Subscriber+ Error Log Cleanup (CVSS 4.3, ActiveCampaign for WooCommerce)
- [CVE-2022-4394](https://cve.now/CVE-2022-4394.md): iPages Flipbook For WordPress \<= 1.4.6 - Contributor+ Stored XSS (CVSS 5.4, iPages Flipbook For WordPress)
- [CVE-2022-4479](https://cve.now/CVE-2022-4479.md): Table of Contents Plus \< 2212 - Contributor+ Stored XSS (CVSS 5.4, Table of Contents Plus)
- [CVE-2022-4491](https://cve.now/CVE-2022-4491.md): WP Table Reloaded \<= 1.9.4 - Contributor+ Stored XSS (CVSS 5.4, WP-Table Reloaded)
- [CVE-2022-4468](https://cve.now/CVE-2022-4468.md): WP Recipe Maker \< 8.6.1 - Contributor+ Stored XSS (CVSS 5.4, WP Recipe Maker)
- [CVE-2022-3417](https://cve.now/CVE-2022-3417.md): WPtouch \< 4.3.45 - Admin+ PHP Object Injection (CVSS 8.8, WPtouch)
- [CVE-2022-4043](https://cve.now/CVE-2022-4043.md): WP Custom Admin Interface \< 7.29 - Admin+ PHP Object Injection (CVSS 7.2, WP Custom Admin Interface)
- [CVE-2022-4393](https://cve.now/CVE-2022-4393.md): ImageLinks Interactive Image Builder for WordPress \<= 1.5.3 - Contributor+ Stored XSS (no CVSS, ImageLinks Interactive Image Builder for WordPress)
- [CVE-2022-4392](https://cve.now/CVE-2022-4392.md): iPanorama 360 WordPress Virtual Tour Builder \<= 1.6.29 - Contributor+ Stored XSS (CVSS 5.4, iPanorama 360 WordPress Virtual Tour Builder)
- [CVE-2022-3416](https://cve.now/CVE-2022-3416.md): WPtouch \< 4.3.45 - Admin+ Arbitrary File Upload (CVSS 7.2, WPtouch)
- [CVE-2022-3343](https://cve.now/CVE-2022-3343.md): WPQA \< 5.9.3 - Missing validation lead to functionality abuse (CVSS 3.5, WPQA Builder · Discy +1)
- [CVE-2022-4310](https://cve.now/CVE-2022-4310.md): Slimstat Analytics \< 4.9.3 - Unauthenticated Stored XSS (CVSS 6.1, Slimstat Analytics)
- [CVE-2014-125072](https://cve.now/CVE-2014-125072.md): CherishSin klattr sql injection (CVSS 5.5, CherishSin klattr)
- [CVE-2023-0125](https://cve.now/CVE-2023-0125.md): Control iD Gerencia Web Web Interface cross site scripting (CVSS 2.4, Control iD Gerencia Web)
- [CVE-2014-125071](https://cve.now/CVE-2014-125071.md): lukehutch Gribbit HttpRequestHandler.java messageReceived missing origin validation in websockets (CVSS 5.5, lukehutch Gribbit)
- [CVE-2015-10035](https://cve.now/CVE-2015-10035.md): gperson angular-test-reporter data-server.js addTest sql injection (CVSS 5.5, gperson angular-test-reporter)
- [CVE-2015-10034](https://cve.now/CVE-2015-10034.md): j-nowak workout-organizer sql injection (CVSS 5.5, j-nowak workout-organizer)
- [CVE-2015-10033](https://cve.now/CVE-2015-10033.md): jvvlee MerlinsBoard Grade improper authorization (CVSS 3.5, jvvlee MerlinsBoard)
- [CVE-2022-4884](https://cve.now/CVE-2022-4884.md): Path-Traversal in MKP storing (CVSS 3.5, Tribe29 Checkmk)
- [CVE-2023-22477](https://cve.now/CVE-2023-22477.md): Mercurius is vulnerable to denial of service (DoS) when using subscriptions (CVSS 5.3, mercurius-js mercurius · mercurius)
- [CVE-2023-22473](https://cve.now/CVE-2023-22473.md): Passcode bypass on Talk-Android app (CVSS 2.1, nextcloud security-advisories)
- [CVE-2023-22472](https://cve.now/CVE-2023-22472.md): Nextcloud Deck Desktop Client is vulnerable to Cross-Site Request Forgery (CSRF) via malicious link (CVSS 5.3, nextcloud security-advisories)
- [CVE-2022-23509](https://cve.now/CVE-2022-23509.md): Weave Gitops Run vulnerable to insecure communication (CVSS 7.4, weaveworks weave-gitops · github.com/weaveworks/weave-gitops)
- [CVE-2022-23508](https://cve.now/CVE-2022-23508.md): GitOps Run allows for Kubernetes workload injection (CVSS 8.9, weaveworks weave-gitops · github.com/weaveworks/weave-gitops)
- [CVE-2021-4311](https://cve.now/CVE-2021-4311.md): Talend Open Studio for MDM XML xml external entity reference (CVSS 5.5, Talend Open Studio for MDM)
- [CVE-2022-2196](https://cve.now/CVE-2022-2196.md): Speculative execution attacks in KVM VMX (CVSS 5.8, Linux Kernel)
- [CVE-2022-46769](https://cve.now/CVE-2022-46769.md): Apache Sling App CMS: XSS in CMS Site Group Detail (CVSS 5.4, Apache Software Foundation Apache Sling App CMS · org.apach…)
- [CVE-2017-20165](https://cve.now/CVE-2017-20165.md): debug-js debug node.js useColors redos (CVSS 3.5, debug-js debug · debug)
- [CVE-2022-4882](https://cve.now/CVE-2022-4882.md): kaltura mwEmbed Share Plugin share.js cross site scripting (CVSS 2.6, kaltura mwEmbed)
- [CVE-2015-10032](https://cve.now/CVE-2015-10032.md): HealthMateWeb createaccount.php cross site scripting (CVSS 3.5, HealthMateWeb)
- [CVE-2021-4310](https://cve.now/CVE-2021-4310.md): 01-Scripts 01-Artikelsystem 01article.php cross site scripting (CVSS 3.5, 01-Scripts 01-Artikelsystem)
- [CVE-2010-10004](https://cve.now/CVE-2010-10004.md): Information Cards Module cross site scripting (CVSS 3.5, Information Cards Module · simplesamlphp/simplesamlphp-modu…)
- [CVE-2022-25890](https://cve.now/CVE-2022-25890.md): All versions of the package wifey are vulnerable to Command Injection via the connect() function due to improper input sanitization. (CVSS 7.4, wifey)
- [CVE-2023-0036](https://cve.now/CVE-2023-0036.md): platform\_callback\_stub in misc subsystem has an authentication bypass vulnerability which allows an "SA relay attack". (CVSS 6.5, OpenHarmony)
- [CVE-2023-0035](https://cve.now/CVE-2023-0035.md): softbus\_client\_stub in communication subsystem has an authentication bypass vulnerability which allows an "SA relay attack". (CVSS 6.5, OpenHarmony)
- [CVE-2022-43662](https://cve.now/CVE-2022-43662.md): Kernel subsystem in kernel\_liteos\_a has a kernel stack overflow vulnerability when call SysTimerGettime. (CVSS 4.0, OpenHarmony)
- [CVE-2022-45126](https://cve.now/CVE-2022-45126.md): Kernel subsystem in kernel\_liteos\_a has a kernel stack overflow vulnerability when call SysClockGettime. (CVSS 4.0, OpenHarmony)
- [CVE-2021-36603](https://cve.now/CVE-2021-36603.md): Cross Site Scripting (XSS) in Tasmota firmware 6.5.0 allows remote attackers to inject JavaScript code via a crafted string in the field "Fr (CVSS 6.1)
- [CVE-2022-36925](https://cve.now/CVE-2022-36925.md): Insecure key generation for Zoom Rooms for macOS Clients (CVSS 4.4, Zoom Video Communications Zoom Rooms for macOS)
- [CVE-2022-36926](https://cve.now/CVE-2022-36926.md): Local Privilege Escalation in Zoom Rooms for macOS Clients (CVSS 8.8, Zoom Video Communications Zoom Rooms for macOS)
- [CVE-2022-36927](https://cve.now/CVE-2022-36927.md): Local Privilege Escalation in Zoom Rooms for macOS Clients (CVSS 8.8, Zoom Video Communications Zoom Rooms for macOS)
- [CVE-2022-36928](https://cve.now/CVE-2022-36928.md): Path Traversal in Zoom for Android Clients (CVSS 6.1, Zoom Video Communications Zoom for Android)
- [CVE-2022-36929](https://cve.now/CVE-2022-36929.md): Local Privilege Escalation in Zoom Rooms for Windows Clients (CVSS 7.8, Zoom Video Communications Zoom Rooms for Windows)
- [CVE-2022-36930](https://cve.now/CVE-2022-36930.md): Local Privilege Escalation in Zoom Rooms for Windows Installers (CVSS 8.8, Zoom Video Communications Zoom Rooms for Windows)
- [CVE-2022-43970](https://cve.now/CVE-2022-43970.md): Buffer overflow in Linksys WRT54GL (CVSS 7.2, Linksys WRT54GL Wireless-G Broadband Router)
- [CVE-2022-43971](https://cve.now/CVE-2022-43971.md): Arbitrary code execution in Linksys WUMC710 (CVSS 7.2, Linksys WUMC710 Wireless-AC Universal Media Connector)
- [CVE-2022-43972](https://cve.now/CVE-2022-43972.md): Null pointer dereference in Linksys WRT54GL (CVSS 6.5, Linksys WRT54GL Wireless-G Broadband Router)
- [CVE-2022-43973](https://cve.now/CVE-2022-43973.md): Arbitrary code execution in Linksys WRT54GL (CVSS 7.2, Linksys WRT54GL Wireless-G Broadband Router)
- [CVE-2022-43974](https://cve.now/CVE-2022-43974.md): MatrixSSL 4.0.4 through 4.5.1 has an integer overflow in matrixSslDecodeTls13. (CVSS 8.1)
- [CVE-2022-46258](https://cve.now/CVE-2022-46258.md): Incorrect Authorization in GitHub Enterprise Server leads to Action Workflow modifications without Workflow Scope (CVSS 6.5, GitHub Enterprise Server)
- [CVE-2022-46603](https://cve.now/CVE-2022-46603.md): An issue in Inkdrop v5.4.1 allows attackers to execute arbitrary commands via uploading a crafted markdown file. (CVSS 6.1)
- [CVE-2022-47790](https://cve.now/CVE-2022-47790.md): Sourcecodester Dynamic Transaction Queuing System v1.0 is vulnerable to SQL Injection via /queuing/index.php?page=display&id=. (CVSS 9.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.