# CVEs published 2023-01-12

103 CVEs were published on January 12, 2023: 6 critical, 37 high. Days are UTC.

- [CVE-2022-4616](https://cve.now/CVE-2022-4616.md): The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. (CVSS 7.2, Delta Industrial Automation 4G Router DX-3021)
- [CVE-2022-41778](https://cve.now/CVE-2022-41778.md): Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-DataColl (CVSS 9.8, Delta Electronics InfraSuite Device Master)
- [CVE-2023-22601](https://cve.now/CVE-2023-22601.md): InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulner (CVSS 10.0, InHand Networks InRouter)
- [CVE-2023-22600](https://cve.now/CVE-2023-22600.md): InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulner (CVSS 10.0, InHand Networks InRouter)
- [CVE-2023-22599](https://cve.now/CVE-2023-22599.md): InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulner (CVSS 7.0, InHand Networks InRouter)
- [CVE-2023-22598](https://cve.now/CVE-2023-22598.md): InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulner (CVSS 7.2, InHand Networks InRouter)
- [CVE-2023-22597](https://cve.now/CVE-2023-22597.md): InHand Networks InRouter 302, prior to version IR302 V3.5.56, and InRouter 615, prior to version InRouter6XX-S-V2.3.0.r5542, contain vulner (CVSS 6.5, InHand Networks InRouter)
- [CVE-2022-42273](https://cve.now/CVE-2022-42273.md): NVIDIA BMC contains a vulnerability in libwebsocket, where an authorized attacker can cause a buffer overflow and cause a denial of service (CVSS 8.1, NVIDIA DGX servers)
- [CVE-2022-42272](https://cve.now/CVE-2022-42272.md): NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow, which may lead to code execut (CVSS 8.1, NVIDIA DGX servers)
- [CVE-2023-0258](https://cve.now/CVE-2023-0258.md): SourceCodester Online Food Ordering System Category List cross site scripting (CVSS 2.4, SourceCodester Online Food Ordering System)
- [CVE-2023-0257](https://cve.now/CVE-2023-0257.md): SourceCodester Online Food Ordering System Menu Form unrestricted upload (CVSS 4.7, SourceCodester Online Food Ordering System)
- [CVE-2023-0256](https://cve.now/CVE-2023-0256.md): SourceCodester Online Food Ordering System Login Page sql injection (CVSS 6.3, SourceCodester Online Food Ordering System)
- [CVE-2022-42268](https://cve.now/CVE-2022-42268.md): Omniverse Kit contains a vulnerability in the reference applications Create, Audio2Face, Isaac Sim, View, Code, and Machinima. (CVSS 7.8, NVIDIA Omniverse Audio2Face · NVIDIA Omniverse Create +4)
- [CVE-2023-22488](https://cve.now/CVE-2023-22488.md): Missing authorization in Flarum (CVSS 6.8, flarum framework · flarum/core)
- [CVE-2023-0254](https://cve.now/CVE-2023-0254.md): Simple Membership WP user Import \<= 1.7 - Authenticated (Admin+) SQL Injection (CVSS 7.2, wpinsider-1 Simple Membership WP user Import)
- [CVE-2022-40983](https://cve.now/CVE-2022-40983.md): An integer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. (CVSS 8.8, Qt Project Qt)
- [CVE-2022-43591](https://cve.now/CVE-2022-43591.md): A buffer overflow vulnerability exists in the QML QtScript Reflect API of Qt Project Qt 6.3.2. (CVSS 8.8, Qt Project Qt)
- [CVE-2013-10011](https://cve.now/CVE-2013-10011.md): aeharding classroom-engagement-system sql injection (CVSS 6.3, aeharding classroom-engagement-system)
- [CVE-2012-10005](https://cve.now/CVE-2012-10005.md): manikandan170890 php-form-builder-class Textarea Textarea.php cross site scripting (CVSS 3.5, manikandan170890 php-form-builder-class)
- [CVE-2023-0246](https://cve.now/CVE-2023-0246.md): earclink ESPCMS Content cross site scripting (CVSS 3.5, earclink ESPCMS)
- [CVE-2023-0245](https://cve.now/CVE-2023-0245.md): SourceCodester Online Flight Booking Management System add\_contestant.php sql injection (CVSS 6.3, SourceCodester Online Flight Booking Management System)
- [CVE-2023-0244](https://cve.now/CVE-2023-0244.md): TuziCMS KefuController.class.php delall sql injection (CVSS 6.3, TuziCMS)
- [CVE-2023-0243](https://cve.now/CVE-2023-0243.md): TuziCMS Article Module ArticleController.class.php index sql injection (CVSS 6.3, TuziCMS)
- [CVE-2022-2155](https://cve.now/CVE-2022-2155.md): A vulnerability exists in the Lumada APM’s User Asset Group feature due to a flaw in access control mechanism implementation on the “Limited Engineer” role. (CVSS 5.7, Hitachi Energy Lumada APM)
- [CVE-2022-24913](https://cve.now/CVE-2022-24913.md): Versions of the package com.fasterxml.util:java-merge-sort before 1.1.0 are vulnerable to Insecure Temporary File in the StdTempFileProvider (CVSS 5.5, com.fasterxml.util:java-merge-sort)
- [CVE-2017-5242](https://cve.now/CVE-2017-5242.md): Rapid7 Nexpose Virtual Appliance Duplicate SSH Host Key (CVSS 7.7, Rapid7 Nexpose Virtual Appliance · Rapid7 InsightVM Virtual…)
- [CVE-2022-25026](https://cve.now/CVE-2022-25026.md): A Server-Side Request Forgery (SSRF) in Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to gain access to sensitive resources on th (CVSS 7.5)
- [CVE-2022-25027](https://cve.now/CVE-2022-25027.md): The Forgotten Password functionality of Rocket TRUfusion Portal v7.9.2.1 allows remote attackers to bypass authentication and access restric (CVSS 7.5)
- [CVE-2022-3145](https://cve.now/CVE-2022-3145.md): An open redirect vulnerability exists in Okta OIDC Middleware prior to version 5.0.0 allowing an attacker to redirect a user to an arbitrary (CVSS 4.7, Okta OIDC Middleware · @okta/oidc-middleware)
- [CVE-2022-3341](https://cve.now/CVE-2022-3341.md): A null pointer dereference issue was discovered in 'FFmpeg' in decode\_main\_header() function of libavformat/nutdec.c file. (CVSS 5.3, FFmpeg)
- [CVE-2022-3437](https://cve.now/CVE-2022-3437.md): A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap\_des() and unwrap\_des3() routines of Heimdal. (CVSS 4.3, samba)
- [CVE-2022-3514](https://cve.now/CVE-2022-3514.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 6.6 before 15.5.7, all versions starting from 15.6 before (CVSS 4.3, GitLab)
- [CVE-2022-3515](https://cve.now/CVE-2022-3515.md): A vulnerability was found in the Libksba library due to an integer overflow within the CRL parser. (CVSS 9.8, libksba)
- [CVE-2022-3573](https://cve.now/CVE-2022-3573.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.4 before 15.5.7, all versions starting from 15.6 before (CVSS 5.4, GitLab)
- [CVE-2022-3592](https://cve.now/CVE-2022-3592.md): A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured sh (CVSS 6.5, samba)
- [CVE-2022-3613](https://cve.now/CVE-2022-3613.md): An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio (CVSS 5.8, GitLab)
- [CVE-2022-3628](https://cve.now/CVE-2022-3628.md): A buffer overflow flaw was found in the Linux kernel Broadcom Full MAC Wi-Fi driver. (CVSS 6.6, Kernel)
- [CVE-2022-3870](https://cve.now/CVE-2022-3870.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.0 before 15.5.7, all versions starting from 15.6 before (CVSS 5.3, GitLab)
- [CVE-2022-39182](https://cve.now/CVE-2022-39182.md): H C Mingham-Smith Ltd - Tardis 2000 Privilege escalation (CVSS 4.9, H C Mingham-Smith Tardis)
- [CVE-2022-39183](https://cve.now/CVE-2022-39183.md): Moodle Plugin - SAML Auth Open Redirect (CVSS 6.5, Moodle Plugin - SAML Auth)
- [CVE-2022-39184](https://cve.now/CVE-2022-39184.md): EXFO - BV-10 Performance Endpoint Unit Authentication bypass (CVSS 9.8, EXFO BV-10 Performance Endpoint Unit)
- [CVE-2022-39185](https://cve.now/CVE-2022-39185.md): EXFO - BV-10 Performance Endpoint Unit Undocumented privileged user. (CVSS 9.8, EXFO BV-10 Performance Endpoint Unit)
- [CVE-2022-39186](https://cve.now/CVE-2022-39186.md): EXFO - BV-10 Performance Endpoint Unit Misconfiguration (CVSS 6.2, EXFO BV-10 Performance Endpoint Unit)
- [CVE-2022-39187](https://cve.now/CVE-2022-39187.md): Rumpus - FTP server Reflected cross-site scripting (RXSS) (CVSS 6.8, Rumpus FTP server)
- [CVE-2022-3977](https://cve.now/CVE-2022-3977.md): A use-after-free flaw was found in the Linux kernel MCTP (Management Component Transport Protocol) functionality. (CVSS 7.8, Kernel)
- [CVE-2022-4037](https://cve.now/CVE-2022-4037.md): An issue has been discovered in GitLab CE/EE affecting all versions before 15.5.7, all versions starting from 15.6 before 15.6.4, all versio (CVSS 6.4, GitLab)
- [CVE-2022-4131](https://cve.now/CVE-2022-4131.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.8 before 15.5.7, all versions starting from 15.6 before (CVSS 4.3, GitLab)
- [CVE-2022-4167](https://cve.now/CVE-2022-4167.md): Incorrect Authorization check affecting all versions of GitLab EE from 13.11 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior to 15.7.2 (CVSS 5.3, GitLab)
- [CVE-2022-42704](https://cve.now/CVE-2022-42704.md): A cross-site scripting (XSS) vulnerability in Employee Service Center (esc) and Service Portal (sp) in ServiceNow Quebec, Rome, and San Dieg (CVSS 5.4)
- [CVE-2022-4342](https://cve.now/CVE-2022-4342.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 15.1 before 15.5.7, all versions starting from 15.6 before (CVSS 5.5, GitLab)
- [CVE-2022-4345](https://cve.now/CVE-2022-4345.md): Infinite loops in the BPv6, OpenFlow, and Kafka protocol dissectors in Wireshark 4.0.0 to 4.0.1 and 3.6.0 to 3.6.9 allows denial of service (CVSS 6.3, Wireshark Foundation Wireshark)
- [CVE-2022-4365](https://cve.now/CVE-2022-4365.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.8 before 15.5.7, all versions starting from 15.6 before (CVSS 5.5, GitLab)
- [CVE-2022-45728](https://cve.now/CVE-2022-45728.md): Doctor Appointment Management System v1.0.0 was discovered to contain a cross-site scripting (XSS) vulnerability. (CVSS 6.1)
- [CVE-2022-45729](https://cve.now/CVE-2022-45729.md): A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts (CVSS 6.1)
- [CVE-2022-46367](https://cve.now/CVE-2022-46367.md): Rumpus - FTP server Cross-site request forgery (CSRF) – Privilege escalation (CVSS 6.8, Rumpus FTP server)
- [CVE-2022-46368](https://cve.now/CVE-2022-46368.md): Rumpus - FTP server Cross-site request forgery (CSRF) – Create user (CVSS 6.8, Rumpus FTP server)
- [CVE-2022-46369](https://cve.now/CVE-2022-46369.md): Rumpus - FTP server Persistent cross-site scripting (PXSS) – Unspecified vector (CVSS 6.8, Rumpus FTP server)
- [CVE-2022-46370](https://cve.now/CVE-2022-46370.md): Rumpus - FTP server Improper Token Verification (CVSS 7.3, Rumpus FTP server)
- [CVE-2022-46371](https://cve.now/CVE-2022-46371.md): Alotcer - AR7088H-A Information disclosure (CVSS 5.3, Alotcer AR7088H-A)
- [CVE-2022-46372](https://cve.now/CVE-2022-46372.md): Alotcer - AR7088H-A Authenticated Command execution (CVSS 7.2, Alotcer AR7088H-A)
- [CVE-2022-46438](https://cve.now/CVE-2022-46438.md): A cross-site scripting (XSS) vulnerability in the /admin/article\_category.php component of DouPHP v1.7 20221118 allows attackers to execute (CVSS 5.4)
- [CVE-2022-46463](https://cve.now/CVE-2022-46463.md): An access control issue in Harbor v1.X.X to v2.5.3 allows attackers to access public and private image repositories without authentication. (CVSS 7.5)
- [CVE-2022-46472](https://cve.now/CVE-2022-46472.md): Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /hss/classes/Users.php?f=del (CVSS 7.2)
- [CVE-2022-46503](https://cve.now/CVE-2022-46503.md): A cross-site scripting (XSS) vulnerability in the component /admin/register.php of Online Student Enrollment System v1.0 allows attackers to (CVSS 5.4)
- [CVE-2022-46622](https://cve.now/CVE-2022-46622.md): A cross-site scripting (XSS) vulnerability in Judging Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a (CVSS 6.1)
- [CVE-2022-46623](https://cve.now/CVE-2022-46623.md): Judging Management System v1.0.0 was discovered to contain a SQL injection vulnerability via the username parameter. (CVSS 7.8)
- [CVE-2022-47102](https://cve.now/CVE-2022-47102.md): A cross-site scripting (XSS) vulnerability in Student Study Center Management System V 1.0 allows attackers to execute arbitrary web scripts (CVSS 5.4)
- [CVE-2022-4743](https://cve.now/CVE-2022-4743.md): A potential memory leak issue was discovered in SDL2 in GLES\_CreateTexture() function in SDL\_render\_gles.c. (CVSS 7.5, SDL2)
- [CVE-2022-47927](https://cve.now/CVE-2022-47927.md): An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. (CVSS 5.5)
- [CVE-2022-4842](https://cve.now/CVE-2022-4842.md): A flaw NULL Pointer Dereference in the Linux kernel NTFS3 driver function attr\_punch\_hole() was found. (CVSS 5.5, Kernel)
- [CVE-2023-0042](https://cve.now/CVE-2023-0042.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 prior to 15.5.7, 15.6 prior to 15.6.4, and 15.7 prior (CVSS 6.1, GitLab)
- [CVE-2023-0227](https://cve.now/CVE-2023-0227.md): Insufficient Session Expiration in pyload/pyload (CVSS 8.3, pyload/pyload · pyload-ng)
- [CVE-2023-0247](https://cve.now/CVE-2023-0247.md): Uncontrolled Search Path Element in bits-and-blooms/bloom (CVSS 7.8, bits-and-blooms/bloom · github.com/bits-and-blooms/bloom)
- [CVE-2023-22391](https://cve.now/CVE-2023-22391.md): Junos OS: ACX2K Series: Receipt of a high rate of specific traffic will lead to a Denial of Service (DoS) (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22393](https://cve.now/CVE-2023-22393.md): Junos OS and Junos OS Evolved: RPD crash upon receipt of BGP route with invalid next-hop (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22394](https://cve.now/CVE-2023-22394.md): Junos OS: SRX Series and MX Series: Memory leak due to receipt of specially crafted SIP calls (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22395](https://cve.now/CVE-2023-22395.md): Junos OS: In an MPLS scenario the processing of specific packets to the device causes a buffer leak and ultimately a loss of connectivity (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-22396](https://cve.now/CVE-2023-22396.md): Junos OS: Receipt of crafted TCP packets destined to the device results in MBUF leak leading to a Denial of Service (DoS) (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22397](https://cve.now/CVE-2023-22397.md): Junos OS Evolved: PTX10003: An attacker sending specific genuine packets will cause a memory leak in the PFE leading to a Denial of Service (CVSS 6.1, Juniper Networks Junos OS Evolved)
- [CVE-2023-22398](https://cve.now/CVE-2023-22398.md): Junos OS and Junos OS Evolved: RPD might crash when MPLS ping is performed on BGP LSPs (CVSS 5.3, Juniper Networks Junos OS)
- [CVE-2023-22399](https://cve.now/CVE-2023-22399.md): Junos OS: QFX10K Series: PFE crash upon receipt of specific genuine packets when sFlow is enabled (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22400](https://cve.now/CVE-2023-22400.md): Junos OS Evolved: A specific SNMP GET operation and a specific CLI commands cause resources to leak and eventually the evo-pfemand process will crash (CVSS 7.5, Juniper Networks Junos OS Evolved)
- [CVE-2023-22401](https://cve.now/CVE-2023-22401.md): Junos OS and Junos OS Evolved: PTX10008, PTX10016: When a specific SNMP MIB is queried the FPC will crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22402](https://cve.now/CVE-2023-22402.md): Junos OS Evolved: The kernel might restart in a BGP scenario where "bgp auto-discovery" is enabled and such a neighbor flaps (CVSS 5.9, Juniper Networks Junos OS Evolved)
- [CVE-2023-22403](https://cve.now/CVE-2023-22403.md): Junos OS: QFX10K Series: An ICCP flap will be observed due to excessive specific traffic (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22404](https://cve.now/CVE-2023-22404.md): Junos OS: SRX Series and MX Series with SPC3: When IPsec VPN is configured iked will core when a specifically formatted payload is received (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-22405](https://cve.now/CVE-2023-22405.md): Junos OS: QFX5k Series, EX46xx Series: MAC limiting feature stops working after PFE restart or device reboot (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-22406](https://cve.now/CVE-2023-22406.md): Junos OS and Junos OS Evolved: A memory leak which will ultimately lead to an rpd crash will be observed when a peer interface flaps continuously in a Segment Routing scenario using OSPF (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-22407](https://cve.now/CVE-2023-22407.md): Junos OS and Junos OS Evolved: An RPD crash can happen due to an MPLS TE tunnel configuration change on a directly connected router (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-22408](https://cve.now/CVE-2023-22408.md): Junos OS: SRX 5000 Series: Upon processing of a specific SIP packet an FPC can crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22409](https://cve.now/CVE-2023-22409.md): Junos OS: SRX Series, MX Series with SPC3: When an inconsistent NAT configuration exists and a specific CLI command is issued the SPC will reboot (CVSS 5.5, Juniper Networks Junos OS)
- [CVE-2023-22410](https://cve.now/CVE-2023-22410.md): Junos OS: MX Series with MPC10/MPC11: When Suspicious Control Flow Detection (scfd) is enabled and an attacker is sending specific traffic, this causes a memory leak. (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22411](https://cve.now/CVE-2023-22411.md): Junos OS: SRX Series: The flow processing daemon (flowd) will crash when Unified Policies are used with IPv6 and certain dynamic applications are rejected by the device (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22412](https://cve.now/CVE-2023-22412.md): Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if the SIP ALG is enabled and specific SIP messages are processed (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22413](https://cve.now/CVE-2023-22413.md): Junos OS: MX Series: The Multiservices PIC Management Daemon (mspmand) will crash when an IPsec6 tunnel processes specific IPv4 packets (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22414](https://cve.now/CVE-2023-22414.md): Junos OS: PTX Series and QFX10000 Series: An FPC memory leak is observed when specific EVPN VXLAN Multicast packets are processed (CVSS 6.5, Juniper Networks Junos OS)
- [CVE-2023-22415](https://cve.now/CVE-2023-22415.md): Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash when specific H.323 packets are received (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22416](https://cve.now/CVE-2023-22416.md): Junos OS: MX Series and SRX Series: The flow processing daemon (flowd) will crash if SIP ALG is enabled and a malformed SIP packet is received (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-22417](https://cve.now/CVE-2023-22417.md): Junos OS: SRX Series: A memory leak might be observed in IPsec VPN scenario leading to an FPC crash (CVSS 7.5, Juniper Networks Junos OS)
- [CVE-2023-23454](https://cve.now/CVE-2023-23454.md): cbq\_classify in net/sched/sch\_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read (CVSS 5.5)
- [CVE-2023-23455](https://cve.now/CVE-2023-23455.md): atm\_tc\_enqueue in net/sched/sch\_atm.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service because of type confus (CVSS 5.5)
- [CVE-2023-23456](https://cve.now/CVE-2023-23456.md): Upx: heap-buffer-overflow in packtmt::pack() (CVSS 5.3, upx)
- [CVE-2023-23457](https://cve.now/CVE-2023-23457.md): Upx: segv on packlinuxelf64::invert\_pt\_dynamic() in p\_lx\_elf.cpp (CVSS 5.3, upx)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-12
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.