# CVEs published 2023-01-10

214 CVEs were published on January 10, 2023: 13 critical, 121 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2023-20532](https://cve.now/CVE-2023-20532.md): Insufficient input validation in the SMU may allow an attacker to improperly lock resources, potentially resulting in a denial of service. (CVSS 5.3, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC)
- [CVE-2023-20531](https://cve.now/CVE-2023-20531.md): Insufficient bound checks in the SMU may allow an attacker to update the SRAM from/to address space to an invalid value potentially resultin (CVSS 7.5, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC)
- [CVE-2023-20530](https://cve.now/CVE-2023-20530.md): Insufficient input validation of BIOS mailbox messages in SMU may result in out-of-bounds memory reads potentially resulting in a denial of (CVSS 7.5, AMD 3rd Gen EPYC)
- [CVE-2023-20529](https://cve.now/CVE-2023-20529.md): Insufficient bound checks in the SMU may allow an attacker to update the from/to address space to an invalid value potentially resulting in (CVSS 7.5, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC)
- [CVE-2023-20528](https://cve.now/CVE-2023-20528.md): Insufficient input validation in the SMU may allow a physical attacker to exfiltrate SMU memory contents over the I2C bus potentially leadin (CVSS 2.4, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC)
- [CVE-2023-20527](https://cve.now/CVE-2023-20527.md): Improper syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory out-of-bounds, potentially leading to (CVSS 6.5, AMD 1st Gen EPYC · AMD 2nd Gen EPYC +1)
- [CVE-2023-20525](https://cve.now/CVE-2023-20525.md): Insufficient syscall input validation in the ASP Bootloader may allow a privileged attacker to read memory outside the bounds of a mapped re (CVSS 6.5, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC)
- [CVE-2023-20523](https://cve.now/CVE-2023-20523.md): TOCTOU in the ASP may allow a physical attacker to write beyond the buffer bounds, potentially leading to a loss of integrity or denial of s (CVSS 5.7, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC)
- [CVE-2023-20522](https://cve.now/CVE-2023-20522.md): Insufficient input validation in ASP may allow an attacker with a malicious BIOS to potentially cause a denial of service. (CVSS 7.5, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC)
- [CVE-2022-23814](https://cve.now/CVE-2022-23814.md): Failure to validate addresses provided by software to BIOS commands may result in a potential loss of integrity of guest memory in a confide (CVSS 5.3, AMD 3rd Gen EPYC)
- [CVE-2022-23813](https://cve.now/CVE-2022-23813.md): The software interfaces to ASP and SMU may not enforce the SNP memory security policy resulting in a potential loss of integrity of guest me (CVSS 5.3, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC)
- [CVE-2021-46791](https://cve.now/CVE-2021-46791.md): Insufficient input validation during parsing of the System Management Mode (SMM) binary may allow a maliciously crafted SMM executable binar (CVSS 5.5, AMD 3rd Gen EPYC)
- [CVE-2021-46779](https://cve.now/CVE-2021-46779.md): Insufficient input validation in SVC\_ECC\_PRIMITIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (CVSS 7.1, AMD 1st Gen EPYC · AMD 2nd Gen EPYC +1)
- [CVE-2021-46768](https://cve.now/CVE-2021-46768.md): Insufficient input validation in SEV firmware may allow an attacker to perform out-of-bounds memory reads within the ASP boot loader, potent (CVSS 5.5, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC)
- [CVE-2021-46767](https://cve.now/CVE-2021-46767.md): Insufficient input validation in the ASP may allow an attacker with physical access, unauthorized write access to memory potentially leading (CVSS 6.1, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC)
- [CVE-2021-26409](https://cve.now/CVE-2021-26409.md): Insufficient bounds checking in SEV-ES may allow an attacker to corrupt Reverse Map table (RMP) memory, potentially resulting in a loss of S (CVSS 7.8, AMD 3rd Gen EPYC)
- [CVE-2021-26407](https://cve.now/CVE-2021-26407.md): A randomly generated Initialization Vector (IV) may lead to a collision of IVs with the same key potentially resulting in information disclo (CVSS 5.5, AMD 2nd Gen EPYC)
- [CVE-2021-26404](https://cve.now/CVE-2021-26404.md): Improper input validation and bounds checking in SEV firmware may leak scratch buffer bytes leading to potential information disclosure. (CVSS 5.5, AMD 3rd Gen EPYC)
- [CVE-2021-26403](https://cve.now/CVE-2021-26403.md): Insufficient checks in SEV may lead to a malicious hypervisor disclosing the launch secret potentially resulting in compromise of VM confide (CVSS 6.5, AMD 1st Gen EPYC · AMD 2nd Gen EPYC)
- [CVE-2021-26402](https://cve.now/CVE-2021-26402.md): Insufficient bounds checking in ASP (AMD Secure Processor) firmware while handling BIOS mailbox commands, may allow an attacker to write par (CVSS 7.1, AMD 2nd Gen EPYC · AMD 3rd Gen EPYC)
- [CVE-2021-26398](https://cve.now/CVE-2021-26398.md): Insufficient input validation in SYS\_KEY\_DERIVE system call in a compromised user application or ABL may allow an attacker to corrupt ASP (A (CVSS 7.8, AMD 1st Gen EPYC · AMD 2nd Gen EPYC +1)
- [CVE-2021-26396](https://cve.now/CVE-2021-26396.md): Insufficient validation of address mapping to IO in ASP (AMD Secure Processor) may result in a loss of memory integrity in the SNP guest. (CVSS 4.4, AMD 3rd Gen EPYC)
- [CVE-2021-26355](https://cve.now/CVE-2021-26355.md): Insufficient fencing and checks in System Management Unit (SMU) may result in access to invalid message port registers that could result in (CVSS 5.5, AMD 3rd Gen EPYC)
- [CVE-2021-26343](https://cve.now/CVE-2021-26343.md): Insufficient validation in ASP BIOS and DRTM commands may allow malicious supervisor x86 software to disclose the contents of sensitive memo (CVSS 5.5, AMD 3rd Gen EPYC)
- [CVE-2021-26328](https://cve.now/CVE-2021-26328.md): Failure to verify the mode of CPU execution at the time of SNP\_INIT may lead to a potential loss of memory integrity for SNP guests. (CVSS 4.4, AMD 3rd Gen EPYC)
- [CVE-2021-46795](https://cve.now/CVE-2021-46795.md): A TOCTOU (time-of-check to time-of-use) vulnerability exists where an attacker may use a compromised BIOS to cause the TEE OS to read memory (CVSS 4.7, AMD Ryzen 5000 Series · AMD Ryzen 3000 Series)
- [CVE-2022-35401](https://cve.now/CVE-2022-35401.md): An authentication bypass vulnerability exists in the get\_IFTTTTtoken.cgi functionality of Asus RT-AX82U 3.0.0.4.386\_49674-ge182230. (CVSS 9.0, Asus RT-AX82U)
- [CVE-2022-38105](https://cve.now/CVE-2022-38105.md): An information disclosure vulnerability exists in the cm\_processREQ\_NC opcode of Asus RT-AX82U 3.0.0.4.386\_49674-ge182230 router's configura (CVSS 7.5, Asus RT-AX82U)
- [CVE-2022-38393](https://cve.now/CVE-2022-38393.md): A denial of service vulnerability exists in the cfg\_server cm\_processConnDiagPktList opcode of Asus RT-AX82U 3.0.0.4.386\_49674-ge182230 rout (CVSS 7.5, Asus RT-AX82U)
- [CVE-2023-22479](https://cve.now/CVE-2023-22479.md): KubePi vulnerable to session fixation attack (CVSS 7.5, KubeOperator KubePi · github.com/KubeOperator/kubepi)
- [CVE-2023-22469](https://cve.now/CVE-2023-22469.md): Nextcloud Deck card vulnerable to data leak to unauthorized users via reference preview cache (CVSS 5.8, nextcloud security-advisories)
- [CVE-2022-46163](https://cve.now/CVE-2022-46163.md): travel-support-program vulnerable to data exfiltration via Ransack query injection (CVSS 7.5, openSUSE travel-support-program)
- [CVE-2022-4636](https://cve.now/CVE-2022-4636.md): Black Box KVM Firmware version 3.4.31307 on models ACR1000A-R-R2, ACR1000A-T-R2, ACR1002A-T, ACR1002A-R, and ACR1020A-T is vulnerable to pat (CVSS 7.5, Black Box KVM ACR1020A-T · Black Box KVM ACR1002A-R +3)
- [CVE-2021-26346](https://cve.now/CVE-2021-26346.md): Failure to validate the integer operand in ASP (AMD Secure Processor) bootloader may allow an attacker to introduce an integer overflow in t (CVSS 5.5, AMD Ryzen 5000 Series)
- [CVE-2021-26316](https://cve.now/CVE-2021-26316.md): Failure to validate the communication buffer and communication service in the BIOS may allow an attacker to tamper with the buffer resulting (CVSS 7.8, AMD Ryzen 5000 Series · AMD Ryzen 2000 Series +4)
- [CVE-2023-0162](https://cve.now/CVE-2023-0162.md): CPO Companion \<= 1.0.4 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, wpchill CPO Companion)
- [CVE-2022-4707](https://cve.now/CVE-2022-4707.md): Royal Elementor Addons \<= 1.3.59 - Cross-Site Request Forgery to Menu Template creation (CVSS 4.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2022-4701](https://cve.now/CVE-2022-4701.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Plugin Activation (CVSS 4.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2022-4703](https://cve.now/CVE-2022-4703.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Import Deletion (CVSS 4.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2022-4705](https://cve.now/CVE-2022-4705.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Template Activation (CVSS 4.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2022-4704](https://cve.now/CVE-2022-4704.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Template Import (CVSS 5.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2022-4710](https://cve.now/CVE-2022-4710.md): Royal Elementor Addons \<= 1.3.59 - Reflected Cross-Site Scripting (CVSS 6.1, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2022-4708](https://cve.now/CVE-2022-4708.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Template Conditions Modification (CVSS 4.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2022-4711](https://cve.now/CVE-2022-4711.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Menu Settings Update (CVSS 4.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2022-4702](https://cve.now/CVE-2022-4702.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Plugin Deactivation (CVSS 5.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2022-4700](https://cve.now/CVE-2022-4700.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Theme Activation (CVSS 5.4, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2022-4709](https://cve.now/CVE-2022-4709.md): Royal Elementor Addons \<= 1.3.59 - Insufficient Access Control to Template Kit Import (CVSS 4.3, wproyal Royal Addons for Elementor – Addons and Templates K…)
- [CVE-2014-125073](https://cve.now/CVE-2014-125073.md): mapoor voteapp app.py show\_refresh sql injection (CVSS 5.5, mapoor voteapp)
- [CVE-2016-15017](https://cve.now/CVE-2016-15017.md): fabarea media\_upload UploadFileService.php getUploadedFileList pathname traversal (CVSS 5.5, fabarea media\_upload)
- [CVE-2022-47967](https://cve.now/CVE-2022-47967.md): A vulnerability has been identified in Solid Edge (All versions \< V2023 MP1). (CVSS 7.8, Siemens Solid Edge)
- [CVE-2022-47935](https://cve.now/CVE-2022-47935.md): A vulnerability has been identified in JT Open (All versions \< V11.1.1.0), JT Utilities (All versions \< V13.1.1.0), Solid Edge (All versions (CVSS 7.8, Siemens JT Open · Siemens JT Utilities +1)
- [CVE-2022-46823](https://cve.now/CVE-2022-46823.md): A vulnerability has been identified in Mendix SAML (Mendix 8 compatible) (All versions \>= V2.3.0 \< V2.3.4), Mendix SAML (Mendix 9 compatible (CVSS 9.3, Siemens Mendix SAML)
- [CVE-2022-45094](https://cve.now/CVE-2022-45094.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 1). (CVSS 8.4, Siemens SINEC INS)
- [CVE-2022-45093](https://cve.now/CVE-2022-45093.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 1). (CVSS 8.5, Siemens SINEC INS)
- [CVE-2022-45092](https://cve.now/CVE-2022-45092.md): A vulnerability has been identified in SINEC INS (All versions \< V1.0 SP2 Update 1). (CVSS 9.9, Siemens SINEC INS)
- [CVE-2022-43514](https://cve.now/CVE-2022-43514.md): A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions \< V6.0 SP9 (CVSS 7.7, Siemens Automation License Manager · Siemens TeleControl Se…)
- [CVE-2022-43513](https://cve.now/CVE-2022-43513.md): A vulnerability has been identified in Automation License Manager V5 (All versions), Automation License Manager V6 (All versions \< V6.0 SP9 (CVSS 8.2, Siemens Automation License Manager · Siemens TeleControl Se…)
- [CVE-2022-38773](https://cve.now/CVE-2022-38773.md): Affected devices do not contain an Immutable Root of Trust in Hardware. (CVSS 4.6, Siemens SIMATIC Drive Controller CPU 1504D TF · Siemens… +54)
- [CVE-2022-4429](https://cve.now/CVE-2022-4429.md): Avira Security for Windows - Denial of Service (CVSS 5.3, NortonLifelock (GenDigital) Avira Security for Windows)
- [CVE-2022-4294](https://cve.now/CVE-2022-4294.md): Norton, Avira, Avast and AVG Antivirus for Windows Privilege Escalation (CVSS 7.1, NortonLifelock (GenDigital) Norton Antivirus Windows Era… +2)
- [CVE-2023-0023](https://cve.now/CVE-2023-0023.md): Information Disclosure in SAP Bank Account Management (Manage Banks) (CVSS 4.5, SAP Bank Account Management)
- [CVE-2023-0022](https://cve.now/CVE-2023-0022.md): Code Injection vulnerability in SAP BusinessObjects Business Intelligence platform (Analysis edition for OLAP) (CVSS 9.9, SAP BusinessObjects Business Intelligence platform)
- [CVE-2023-0018](https://cve.now/CVE-2023-0018.md): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Central management console) (CVSS 10.0, SAP BusinessObjects Business Intelligence Platform)
- [CVE-2023-0017](https://cve.now/CVE-2023-0017.md): Improper access control in SAP NetWeaver AS for Java (CVSS 9.4, SAP NetWeaver AS for Java)
- [CVE-2023-0016](https://cve.now/CVE-2023-0016.md): SQL Injection vulnerability in SAP Business Planning and Consolidation MS (CVSS 9.9, SAP BPC MS)
- [CVE-2023-0015](https://cve.now/CVE-2023-0015.md): Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence (Web Intelligence) (CVSS 4.6, SAP BusinessObjects Business Intelligence Platform)
- [CVE-2023-0014](https://cve.now/CVE-2023-0014.md): Capture-replay vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (CVSS 9.0, SAP NetWeaver ABAP Server and ABAP Platform)
- [CVE-2023-0013](https://cve.now/CVE-2023-0013.md): Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS for ABAP and ABAP Platform (CVSS 6.1, SAP NetWeaver AS for ABAP and ABAP Platform)
- [CVE-2023-0012](https://cve.now/CVE-2023-0012.md): Local Privilege Escalation in SAP Host Agent (Windows) (CVSS 6.4, SAP Host Agent)
- [CVE-2017-20166](https://cve.now/CVE-2017-20166.md): Ecto 2.2.0 lacks a certain protection mechanism associated with the interaction between is\_nil and raise. (CVSS 9.8)
- [CVE-2021-46871](https://cve.now/CVE-2021-46871.md): tag.ex in Phoenix Phoenix.HTML (aka phoenix\_html) before 3.0.4 allows XSS in HEEx class attributes. (CVSS 6.1, phoenix\_html)
- [CVE-2022-30332](https://cve.now/CVE-2022-30332.md): In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid r (CVSS 5.3)
- [CVE-2022-36441](https://cve.now/CVE-2022-36441.md): An issue was discovered in Zebra Enterprise Home Screen 4.1.19. (CVSS 7.1)
- [CVE-2022-36442](https://cve.now/CVE-2022-36442.md): An issue was discovered in Zebra Enterprise Home Screen 4.1.19. (CVSS 5.5)
- [CVE-2022-36443](https://cve.now/CVE-2022-36443.md): An issue was discovered in Zebra Enterprise Home Screen 4.1.19. (CVSS 7.8)
- [CVE-2022-3792](https://cve.now/CVE-2022-3792.md): SQL Injection in GullsEye Terminal Operating System (CVSS 9.8, GullsEye terminal operating system)
- [CVE-2022-38481](https://cve.now/CVE-2022-38481.md): An issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP2. (CVSS 6.1)
- [CVE-2022-38482](https://cve.now/CVE-2022-38482.md): A link-manipulation issue was discovered in Mega HOPEX 15.2.0.6110 before V5CP4. (CVSS 4.3)
- [CVE-2022-38489](https://cve.now/CVE-2022-38489.md): An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03 It is prone to stored Cross-site Scripting (XSS). (CVSS 4.8)
- [CVE-2022-38490](https://cve.now/CVE-2022-38490.md): An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. (CVSS 9.6)
- [CVE-2022-38491](https://cve.now/CVE-2022-38491.md): An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. (CVSS 8.2)
- [CVE-2022-38492](https://cve.now/CVE-2022-38492.md): An issue was discovered in EasyVista 2020.2.125.3 and 2022.1.109.0.03. (CVSS 7.7)
- [CVE-2022-4337](https://cve.now/CVE-2022-4337.md): An out-of-bounds read in Organization Specific TLV was found in various versions of OpenvSwitch. (no CVSS, openvswitch)
- [CVE-2022-4338](https://cve.now/CVE-2022-4338.md): An integer underflow in Organization Specific TLV was found in various versions of OpenvSwitch. (no CVSS, openvswitch)
- [CVE-2022-4379](https://cve.now/CVE-2022-4379.md): A use-after-free vulnerability was found in \_\_nfs42\_ssc\_open() in fs/nfs/nfs4file.c in the Linux kernel. (CVSS 7.5, Linux kernel)
- [CVE-2022-4382](https://cve.now/CVE-2022-4382.md): A use-after-free flaw caused by a race among the superblock operations in the gadgetfs Linux driver was found. (CVSS 6.4, Linux kernel)
- [CVE-2022-4422](https://cve.now/CVE-2022-4422.md): SQLi in Bulutdesk Callcenter (CVSS 9.8, Bulutses Information Technologies Bulutdesk Callcenter)
- [CVE-2022-45164](https://cve.now/CVE-2022-45164.md): An issue was discovered in Archibus Web Central 2022.03.01.107. (CVSS 4.3)
- [CVE-2022-45165](https://cve.now/CVE-2022-45165.md): An issue was discovered in Archibus Web Central 2022.03.01.107. (CVSS 6.5)
- [CVE-2022-45166](https://cve.now/CVE-2022-45166.md): An issue was discovered in Archibus Web Central 2022.03.01.107. (CVSS 6.5)
- [CVE-2022-45167](https://cve.now/CVE-2022-45167.md): An issue was discovered in Archibus Web Central 2022.03.01.107. (CVSS 4.3)
- [CVE-2022-46449](https://cve.now/CVE-2022-46449.md): An issue in MPD (Music Player Daemon) v0.23.10 allows attackers to cause a Denial of Service (DoS) via a crafted input. (CVSS 7.5)
- [CVE-2022-46610](https://cve.now/CVE-2022-46610.md): 72crm v9 was discovered to contain an arbitrary file upload vulnerability via the avatar upload function. (CVSS 8.8)
- [CVE-2022-47083](https://cve.now/CVE-2022-47083.md): A PHP Object Injection vulnerability in the unserialize() function Spitfire CMS v1.0.475 allows authenticated attackers to execute arbitrary (no CVSS)
- [CVE-2022-48251](https://cve.now/CVE-2022-48251.md): The AES instructions on the ARMv8 platform do not have an algorithm that is "intrinsically resistant" to side-channel attacks. (no CVSS)
- [CVE-2023-0128](https://cve.now/CVE-2023-0128.md): Use after free in Overview Mode in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed a remote attacker who convinced a user to engag (CVSS 8.8, Google Chrome)
- [CVE-2023-0129](https://cve.now/CVE-2023-0129.md): Heap buffer overflow in Network Service in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malici (CVSS 8.8, Google Chrome)
- [CVE-2023-0130](https://cve.now/CVE-2023-0130.md): Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to spoof the (CVSS 6.5, Google Chrome)
- [CVE-2023-0131](https://cve.now/CVE-2023-0131.md): Inappropriate implementation in in iframe Sandbox in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to bypass file download (CVSS 6.5, Google Chrome)
- [CVE-2023-0132](https://cve.now/CVE-2023-0132.md): Inappropriate implementation in in Permission prompts in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to force (CVSS 6.5, Google Chrome)
- [CVE-2023-0133](https://cve.now/CVE-2023-0133.md): Inappropriate implementation in in Permission prompts in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to bypass (CVSS 6.5, Google Chrome)
- [CVE-2023-0134](https://cve.now/CVE-2023-0134.md): Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to (CVSS 8.8, Google Chrome)
- [CVE-2023-0135](https://cve.now/CVE-2023-0135.md): Use after free in Cart in Google Chrome prior to 109.0.5414.74 allowed an attacker who convinced a user to install a malicious extension to (CVSS 8.8, Google Chrome)
- [CVE-2023-0136](https://cve.now/CVE-2023-0136.md): Inappropriate implementation in in Fullscreen API in Google Chrome on Android prior to 109.0.5414.74 allowed a remote attacker to execute in (CVSS 8.8, Google Chrome)
- [CVE-2023-0137](https://cve.now/CVE-2023-0137.md): Heap buffer overflow in Platform Apps in Google Chrome on Chrome OS prior to 109.0.5414.74 allowed an attacker who convinced a user to insta (CVSS 8.8, Google Chrome)
- [CVE-2023-0138](https://cve.now/CVE-2023-0138.md): Heap buffer overflow in libphonenumber in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to potentially exploit heap corrupt (CVSS 8.8, Google Chrome)
- [CVE-2023-0139](https://cve.now/CVE-2023-0139.md): Insufficient validation of untrusted input in Downloads in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypa (no CVSS, Google Chrome)
- [CVE-2023-0140](https://cve.now/CVE-2023-0140.md): Inappropriate implementation in in File System API in Google Chrome on Windows prior to 109.0.5414.74 allowed a remote attacker to bypass fi (no CVSS, Google Chrome)
- [CVE-2023-0141](https://cve.now/CVE-2023-0141.md): Insufficient policy enforcement in CORS in Google Chrome prior to 109.0.5414.74 allowed a remote attacker to leak cross-origin data via a cr (CVSS 4.3, Google Chrome)
- [CVE-2023-21524](https://cve.now/CVE-2023-21524.md): Windows Local Security Authority (LSA) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21525](https://cve.now/CVE-2023-21525.md): Remote Procedure Call Runtime Denial of Service Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2023-21527](https://cve.now/CVE-2023-21527.md): Windows iSCSI Service Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-21531](https://cve.now/CVE-2023-21531.md): Azure Service Fabric Container Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Azure Service Fabric)
- [CVE-2023-21532](https://cve.now/CVE-2023-21532.md): Windows GDI Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-21535](https://cve.now/CVE-2023-21535.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-21536](https://cve.now/CVE-2023-21536.md): Event Tracing for Windows Information Disclosure Vulnerability (CVSS 4.7, Microsoft Windows)
- [CVE-2023-21537](https://cve.now/CVE-2023-21537.md): Microsoft Message Queuing (MSMQ) Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21538](https://cve.now/CVE-2023-21538.md): .NET Denial of Service Vulnerability (CVSS 7.5, Microsoft .NET · Microsoft PowerShell +12)
- [CVE-2023-21539](https://cve.now/CVE-2023-21539.md): Windows Authentication Remote Code Execution Vulnerability (CVSS 7.5, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-21540](https://cve.now/CVE-2023-21540.md): Windows Cryptographic Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-21541](https://cve.now/CVE-2023-21541.md): Windows Task Scheduler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21542](https://cve.now/CVE-2023-21542.md): Windows Installer Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-21543](https://cve.now/CVE-2023-21543.md): Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-21546](https://cve.now/CVE-2023-21546.md): Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-21547](https://cve.now/CVE-2023-21547.md): Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-21548](https://cve.now/CVE-2023-21548.md): Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-21549](https://cve.now/CVE-2023-21549.md): Windows SMB Witness Service Elevation of Privilege Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-21550](https://cve.now/CVE-2023-21550.md): Windows Cryptographic Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-21551](https://cve.now/CVE-2023-21551.md): Microsoft Cryptographic Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21552](https://cve.now/CVE-2023-21552.md): Windows GDI Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21555](https://cve.now/CVE-2023-21555.md): Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-21556](https://cve.now/CVE-2023-21556.md): Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-21557](https://cve.now/CVE-2023-21557.md): Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-21558](https://cve.now/CVE-2023-21558.md): Windows Error Reporting Service Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21559](https://cve.now/CVE-2023-21559.md): Windows Cryptographic Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-21560](https://cve.now/CVE-2023-21560.md): Windows Boot Manager Security Feature Bypass Vulnerability (CVSS 6.6, Microsoft Windows)
- [CVE-2023-21561](https://cve.now/CVE-2023-21561.md): Microsoft Cryptographic Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21563](https://cve.now/CVE-2023-21563.md): BitLocker Security Feature Bypass Vulnerability (CVSS 6.8, Microsoft Windows)
- [CVE-2023-21674](https://cve.now/CVE-2023-21674.md): Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability (CVSS 8.8, KEV, Microsoft Windows)
- [CVE-2023-21675](https://cve.now/CVE-2023-21675.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21676](https://cve.now/CVE-2023-21676.md): Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-21677](https://cve.now/CVE-2023-21677.md): Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-21678](https://cve.now/CVE-2023-21678.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21679](https://cve.now/CVE-2023-21679.md): Windows Layer 2 Tunneling Protocol (L2TP) Remote Code Execution Vulnerability (CVSS 8.1, Microsoft Windows)
- [CVE-2023-21680](https://cve.now/CVE-2023-21680.md): Windows Win32k Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21681](https://cve.now/CVE-2023-21681.md): Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-21682](https://cve.now/CVE-2023-21682.md): Windows Point-to-Point Protocol (PPP) Information Disclosure Vulnerability (CVSS 5.3, Microsoft Windows)
- [CVE-2023-21683](https://cve.now/CVE-2023-21683.md): Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-21724](https://cve.now/CVE-2023-21724.md): Microsoft DWM Core Library Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-21725](https://cve.now/CVE-2023-21725.md): Windows Malicious Software Removal Tool Elevation of Privilege Vulnerability (CVSS 6.3, Microsoft Windows Malicious Software Removal Tool)
- [CVE-2023-21726](https://cve.now/CVE-2023-21726.md): Windows Credential Manager User Interface Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21728](https://cve.now/CVE-2023-21728.md): Windows Netlogon Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-21730](https://cve.now/CVE-2023-21730.md): Microsoft Cryptographic Services Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21732](https://cve.now/CVE-2023-21732.md): Microsoft ODBC Driver Remote Code Execution Vulnerability (CVSS 8.8, Microsoft Windows)
- [CVE-2023-21733](https://cve.now/CVE-2023-21733.md): Windows Bind Filter Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-21734](https://cve.now/CVE-2023-21734.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2019 for Mac · Microsoft 365 Apps for E… +1)
- [CVE-2023-21735](https://cve.now/CVE-2023-21735.md): Microsoft Office Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office 2019 for Mac · Microsoft 365 Apps for E… +1)
- [CVE-2023-21736](https://cve.now/CVE-2023-21736.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +2)
- [CVE-2023-21737](https://cve.now/CVE-2023-21737.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise +2)
- [CVE-2023-21738](https://cve.now/CVE-2023-21738.md): Microsoft Office Visio Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Office · Microsoft 365 Apps for Enterprise)
- [CVE-2023-21739](https://cve.now/CVE-2023-21739.md): Windows Bluetooth Driver Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows)
- [CVE-2023-21741](https://cve.now/CVE-2023-21741.md): Microsoft Office Visio Information Disclosure Vulnerability (CVSS 7.1, Microsoft Office LTSC · Microsoft Visio 2013 Service Pack +3)
- [CVE-2023-21742](https://cve.now/CVE-2023-21742.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2023-21743](https://cve.now/CVE-2023-21743.md): Microsoft SharePoint Server Security Feature Bypass Vulnerability (CVSS 5.3, Microsoft SharePoint Enterprise Server · Microsoft SharePoi…)
- [CVE-2023-21744](https://cve.now/CVE-2023-21744.md): Microsoft SharePoint Server Remote Code Execution Vulnerability (CVSS 8.8, Microsoft SharePoint Enterprise Server · Microsoft Share… +1)
- [CVE-2023-21745](https://cve.now/CVE-2023-21745.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2023-21746](https://cve.now/CVE-2023-21746.md): Windows NTLM Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21747](https://cve.now/CVE-2023-21747.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21748](https://cve.now/CVE-2023-21748.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21749](https://cve.now/CVE-2023-21749.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21750](https://cve.now/CVE-2023-21750.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2023-21752](https://cve.now/CVE-2023-21752.md): Windows Backup Service Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2023-21753](https://cve.now/CVE-2023-21753.md): Event Tracing for Windows Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-21754](https://cve.now/CVE-2023-21754.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21755](https://cve.now/CVE-2023-21755.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21757](https://cve.now/CVE-2023-21757.md): Windows Layer 2 Tunneling Protocol (L2TP) Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-21758](https://cve.now/CVE-2023-21758.md): Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability (CVSS 7.5, Microsoft Windows)
- [CVE-2023-21759](https://cve.now/CVE-2023-21759.md): Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability (CVSS 3.3, Microsoft Windows)
- [CVE-2023-21760](https://cve.now/CVE-2023-21760.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.1, Microsoft Windows)
- [CVE-2023-21761](https://cve.now/CVE-2023-21761.md): Microsoft Exchange Server Information Disclosure Vulnerability (CVSS 7.5, Microsoft Exchange Server 2016 Cumulative Update · Microsof…)
- [CVE-2023-21762](https://cve.now/CVE-2023-21762.md): Microsoft Exchange Server Spoofing Vulnerability (CVSS 8.0, Microsoft Exchange Server 2016 Cumulative Update · Micro… +1)
- [CVE-2023-21763](https://cve.now/CVE-2023-21763.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2023-21764](https://cve.now/CVE-2023-21764.md): Microsoft Exchange Server Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Exchange Server 2019 Cumulative Update · Microsof…)
- [CVE-2023-21765](https://cve.now/CVE-2023-21765.md): Windows Print Spooler Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21766](https://cve.now/CVE-2023-21766.md): Windows Overlay Filter Information Disclosure Vulnerability (CVSS 4.7, Microsoft Windows)
- [CVE-2023-21767](https://cve.now/CVE-2023-21767.md): Windows Overlay Filter Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21768](https://cve.now/CVE-2023-21768.md): Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-21771](https://cve.now/CVE-2023-21771.md): Windows Local Session Manager (LSM) Elevation of Privilege Vulnerability (CVSS 7.0, Microsoft Windows Server · Microsoft Windows)
- [CVE-2023-21772](https://cve.now/CVE-2023-21772.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21773](https://cve.now/CVE-2023-21773.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21774](https://cve.now/CVE-2023-21774.md): Windows Kernel Elevation of Privilege Vulnerability (CVSS 7.8, Microsoft Windows)
- [CVE-2023-21776](https://cve.now/CVE-2023-21776.md): Windows Kernel Information Disclosure Vulnerability (CVSS 5.5, Microsoft Windows)
- [CVE-2023-21779](https://cve.now/CVE-2023-21779.md): Visual Studio Code Remote Code Execution Vulnerability (CVSS 7.8, Microsoft Visual Studio Code)
- [CVE-2023-21780](https://cve.now/CVE-2023-21780.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21781](https://cve.now/CVE-2023-21781.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21782](https://cve.now/CVE-2023-21782.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21783](https://cve.now/CVE-2023-21783.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21784](https://cve.now/CVE-2023-21784.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21785](https://cve.now/CVE-2023-21785.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21786](https://cve.now/CVE-2023-21786.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21787](https://cve.now/CVE-2023-21787.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21788](https://cve.now/CVE-2023-21788.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21789](https://cve.now/CVE-2023-21789.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21790](https://cve.now/CVE-2023-21790.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21791](https://cve.now/CVE-2023-21791.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21792](https://cve.now/CVE-2023-21792.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-21793](https://cve.now/CVE-2023-21793.md): 3D Builder Remote Code Execution Vulnerability (CVSS 7.8, Microsoft 3D Builder)
- [CVE-2023-22320](https://cve.now/CVE-2023-22320.md): OpenAM Web Policy Agent (OpenAM Consortium Edition) provided by OpenAM Consortium parses URLs improperly, leading to a path traversal vulner (CVSS 7.5, OpenAM Web Policy Agent)
- [CVE-2023-22895](https://cve.now/CVE-2023-22895.md): The bzip2 crate before 0.4.4 for Rust allow attackers to cause a denial of service via a large file that triggers an integer overflow in mem (CVSS 7.5, bzip2)
- [CVE-2023-22898](https://cve.now/CVE-2023-22898.md): workers/extractor.py in Pandora (aka pandora-analysis/pandora) 1.3.0 allows a denial of service when an attacker submits a deeply nested ZIP (CVSS 6.5)
- [CVE-2023-22899](https://cve.now/CVE-2023-22899.md): Zip4j through 2.11.2, as used in Threema and other products, does not always check the MAC when decrypting a ZIP archive. (CVSS 5.9, net.lingala.zip4j:zip4j)
- [CVE-2023-22903](https://cve.now/CVE-2023-22903.md): api/views/user.py in LibrePhotos before e19e539 has incorrect access control. (CVSS 9.8)
- [CVE-2023-22909](https://cve.now/CVE-2023-22909.md): An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. (CVSS 5.3)
- [CVE-2023-22911](https://cve.now/CVE-2023-22911.md): An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. (CVSS 6.1)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-10
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.