CVEs published January 12, 2023
103 CVEs were published on January 12, 2023: 6 critical, 37 high.
- Published
- 103
- Critical
- 6
- High
- 37
- Medium
- 57
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 49
Most affected products
- Juniper Networks Junos OS
- 23
- GitLab
- 10
- InHand Networks InRouter
- 5
- Rumpus FTP server
- 5
- EXFO BV-10 Performance Endpoint Unit
- 3
- Juniper Networks Junos OS Evolved
- 3
- Kernel
- 3
- SourceCodester Online Food Ordering System
- 3
- Alotcer AR7088H-A
- 2
- NVIDIA DGX servers
- 2
Critical 6
- CVE-2022-41778 Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataCollDelta Electronics InfraSuite Device Master
- CVE-2023-22601 InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerInHand Networks InRouter
- CVE-2023-22600 InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerInHand Networks InRouter
- CVE-2022-3515A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser.libksba
- CVE-2022-39184EXFO - BV-10 Performance Endpoint Unit Authentication bypassEXFO BV-10 Performance Endpoint Unit
- CVE-2022-39185EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user.EXFO BV-10 Performance Endpoint Unit
High 37
- CVE-2022-4616The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page.Delta Industrial Automation 4G Router DX-3021
- CVE-2023-22599 InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerInHand Networks InRouter
- CVE-2023-22598 InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerInHand Networks InRouter
- CVE-2022-42273NVIDIA BMC contains a vulnerability in libwebsocket, where an authorized attacker can cause a buffer overflow and cause a denial of service NVIDIA DGX servers
- CVE-2022-42272NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code executNVIDIA DGX servers
- CVE-2022-42268 Omniverse Kit contains a vulnerability in the reference applications Create, Audio2Face, Isaac Sim, View, Code, and Machinima.NVIDIA Omniverse Audio2Face · NVIDIA Omniverse Create +4
- CVE-2023-0254Simple Membership WP user Import <= 1.7 - Authenticated (Admin+) SQL Injectionwpinsider-1 Simple Membership WP user Import
- CVE-2022-40983An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2.Qt Project Qt
- CVE-2022-43591A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2.Qt Project Qt
- CVE-2017-5242Rapid7 Nexpose Virtual Appliance Duplicate SSH Host KeyRapid7 Nexpose Virtual Appliance · Rapid7 InsightVM Virtual…
- CVE-2022-25026A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on th
- CVE-2022-25027The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restric
- CVE-2022-3977A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality.Kernel
- CVE-2022-46370Rumpus - FTP server Improper Token Verification Rumpus FTP server
- CVE-2022-46372Alotcer - AR7088H-A Authenticated Command executionAlotcer AR7088H-A
- CVE-2022-46463An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication.
- CVE-2022-46472Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/classes/Users.php?f=del
- CVE-2022-46623Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter.
- CVE-2022-4743A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c.SDL2
- CVE-2023-0227Insufficient Session Expiration in pyload/pyloadpyload/pyload · pyload-ng
- CVE-2023-0247Uncontrolled Search Path Element in bits-and-blooms/bloombits-and-blooms/bloom · github.com/bits-and-blooms/bloom
- CVE-2023-22391Junos OS: ACX2K Series: Receipt of a high rate of specific traffic will lead to a Denial of Service (DoS)Juniper Networks Junos OS
- CVE-2023-22393Junos OS and Junos OS Evolved: RPD crash upon receipt of BGP route with invalid next-hop Juniper Networks Junos OS
- CVE-2023-22394Junos OS: SRX Series and MX Series: Memory leak due to receipt of specially crafted SIP calls Juniper Networks Junos OS
- CVE-2023-22396Junos OS: Receipt of crafted TCP packets destined to the device results in MBUF leak leading to a Denial of Service (DoS)Juniper Networks Junos OS
- CVE-2023-22399Junos OS: QFX10K Series: PFE crash upon receipt of specific genuine packets when sFlow is enabledJuniper Networks Junos OS
- CVE-2023-22400Junos OS Evolved: A specific SNMP GET operation and a specific CLI commands cause resources to leak and eventually the evo-pfemand process will crashJuniper Networks Junos OS Evolved
- CVE-2023-22401Junos OS and Junos OS Evolved: PTX10008, PTX10016: When a specific SNMP MIB is queried the FPC will crashJuniper Networks Junos OS
- CVE-2023-22403Junos OS: QFX10K Series: An ICCP flap will be observed due to excessive specific trafficJuniper Networks Junos OS
- CVE-2023-22408Junos OS: SRX 5000 Series: Upon processing of a specific SIP packet an FPC can crashJuniper Networks Junos OS
- CVE-2023-22410Junos OS: MX Series with MPC10/MPC11: When Suspicious Control Flow Detection (scfd) is enabled and an attacker is sending specific traffic, this causes a memory leak.Juniper Networks Junos OS
- CVE-2023-22411Junos OS: SRX Series: The flow processing daemon (flowd) will crash when Unified Policies are used with IPv6 and certain dynamic applications are rejected by the deviceJuniper Networks Junos OS
- CVE-2023-22412Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if the SIP ALG is enabled and specific SIP messages are processedJuniper Networks Junos OS
- CVE-2023-22413Junos OS: MX Series: The Multiservices PIC Management Daemon (mspmand) will crash when an IPsec6 tunnel processes specific IPv4 packetsJuniper Networks Junos OS
- CVE-2023-22415Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash when specific H.323 packets are receivedJuniper Networks Junos OS
- CVE-2023-22416Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if SIP ALG is enabled and a malformed SIP packet is receivedJuniper Networks Junos OS
- CVE-2023-22417Junos OS: SRX Series: A memory leak might be observed in IPsec VPN scenario leading to an FPC crashJuniper Networks Junos OS
Medium, low and unrated 60
- CVE-2023-22597 InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulnerInHand Networks InRouter
- CVE-2023-0258SourceCodester Online Food Ordering System Category List cross site scriptingSourceCodester Online Food Ordering System
- CVE-2023-0257SourceCodester Online Food Ordering System Menu Form unrestricted uploadSourceCodester Online Food Ordering System
- CVE-2023-0256SourceCodester Online Food Ordering System Login Page sql injectionSourceCodester Online Food Ordering System
- CVE-2023-22488Missing authorization in Flarumflarum framework · flarum/core
- CVE-2013-10011aeharding classroom-engagement-system sql injectionaeharding classroom-engagement-system
- CVE-2012-10005manikandan170890 php-form-builder-class Textarea Textarea.php cross site scriptingmanikandan170890 php-form-builder-class
- CVE-2023-0246earclink ESPCMS Content cross site scriptingearclink ESPCMS
- CVE-2023-0245SourceCodester Online Flight Booking Management System add_contestant.php sql injectionSourceCodester Online Flight Booking Management System
- CVE-2023-0244TuziCMS KefuController.class.php delall sql injectionTuziCMS
- CVE-2023-0243TuziCMS Article Module ArticleController.class.php index sql injectionTuziCMS
- CVE-2022-2155A vulnerability exists in the Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role. Hitachi Energy Lumada APM
- CVE-2022-24913Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvidercom.fasterxml.util:java-merge-sort
- CVE-2022-3145An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitraryOkta OIDC Middleware · @okta/oidc-middleware
- CVE-2022-3341A null pointer dereference issue was discovered in 'FFmpeg' in decode_main_header() function of libavformat/nutdec.c file.FFmpeg
- CVE-2022-3437A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal.samba
- CVE-2022-3514An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before GitLab
- CVE-2022-3573An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 beforeGitLab
- CVE-2022-3592A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured shsamba
- CVE-2022-3613An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versioGitLab
- CVE-2022-3628A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver.Kernel
- CVE-2022-3870An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 beforeGitLab
- CVE-2022-39182H C Mingham-Smith Ltd - Tardis 2000 Privilege escalationH C Mingham-Smith Tardis
- CVE-2022-39183Moodle Plugin - SAML Auth Open RedirectMoodle Plugin - SAML Auth
- CVE-2022-39186EXFO - BV-10 Performance Endpoint Unit Misconfiguration EXFO BV-10 Performance Endpoint Unit
- CVE-2022-39187Rumpus - FTP server Reflected cross-site scripting (RXSS)Rumpus FTP server
- CVE-2022-4037An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versioGitLab
- CVE-2022-4131An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 beforeGitLab
- CVE-2022-4167Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2GitLab
- CVE-2022-42704A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Dieg
- CVE-2022-4342An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 beforeGitLab
- CVE-2022-4345Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service Wireshark Foundation Wireshark
- CVE-2022-4365An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 beforeGitLab
- CVE-2022-45728Doctor Appointment Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability.
- CVE-2022-45729A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts
- CVE-2022-46367Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalationRumpus FTP server
- CVE-2022-46368Rumpus - FTP server Cross-site request forgery (CSRF) – Create userRumpus FTP server
- CVE-2022-46369Rumpus - FTP server Persistent cross-site scripting (PXSS) – Unspecified vectorRumpus FTP server
- CVE-2022-46371Alotcer - AR7088H-A Information disclosureAlotcer AR7088H-A
- CVE-2022-46438A cross-site scripting (XSS) vulnerability in the /admin/article_category.php component of DouPHP v1.7 20221118 allows attackers to execute
- CVE-2022-46503A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to
- CVE-2022-46622A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a
- CVE-2022-47102A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute arbitrary web scripts
- CVE-2022-47927An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1.
- CVE-2022-4842A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr_punch_hole() was found.Kernel
- CVE-2023-0042An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 priorGitLab
- CVE-2023-22395Junos OS: In an MPLS scenario the processing of specific packets to the device causes a buffer leak and ultimately a loss of connectivityJuniper Networks Junos OS
- CVE-2023-22397Junos OS Evolved: PTX10003: An attacker sending specific genuine packets will cause a memory leak in the PFE leading to a Denial of ServiceJuniper Networks Junos OS Evolved
- CVE-2023-22398Junos OS and Junos OS Evolved: RPD might crash when MPLS ping is performed on BGP LSPsJuniper Networks Junos OS
- CVE-2023-22402Junos OS Evolved: The kernel might restart in a BGP scenario where "bgp auto-discovery" is enabled and such a neighbor flapsJuniper Networks Junos OS Evolved
- CVE-2023-22404Junos OS: SRX Series and MX Series with SPC3: When IPsec VPN is configured iked will core when a specifically formatted payload is receivedJuniper Networks Junos OS
- CVE-2023-22405Junos OS: QFX5k Series, EX46xx Series: MAC limiting feature stops working after PFE restart or device rebootJuniper Networks Junos OS
- CVE-2023-22406Junos OS and Junos OS Evolved: A memory leak which will ultimately lead to an rpd crash will be observed when a peer interface flaps continuously in a Segment Routing scenario using OSPFJuniper Networks Junos OS
- CVE-2023-22407Junos OS and Junos OS Evolved: An RPD crash can happen due to an MPLS TE tunnel configuration change on a directly connected routerJuniper Networks Junos OS
- CVE-2023-22409Junos OS: SRX Series, MX Series with SPC3: When an inconsistent NAT configuration exists and a specific CLI command is issued the SPC will rebootJuniper Networks Junos OS
- CVE-2023-22414Junos OS: PTX Series and QFX10000 Series: An FPC memory leak is observed when specific EVPN VXLAN Multicast packets are processedJuniper Networks Junos OS
- CVE-2023-23454cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read
- CVE-2023-23455atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confus
- CVE-2023-23456Upx: heap-buffer-overflow in packtmt::pack()upx
- CVE-2023-23457Upx: segv on packlinuxelf64::invert_pt_dynamic() in p_lx_elf.cppupx