CVEs published January 13, 2023
79 CVEs were published on January 13, 2023: 7 critical, 41 high.
- Published
- 79
- Critical
- 7
- High
- 41
- Medium
- 26
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- NVIDIA DGX servers
- 17
- Adobe InCopy
- 6
- Adobe InDesign
- 6
- Siemens JT2Go · Siemens Teamcenter Visualization
- 3
- Dovgalyuk AIBattle
- 2
- plugincraft Mediamatic – Media Library Folders
- 2
- SourceCodester Online Flight Booking Management System
- 2
- craigk5n/webcalendar
- 1
- Deytek Informatics FileOrbis File Management System
- 1
- DIYgod RSSHub · rsshub
- 1
Critical 7
- CVE-2022-45299An issue in the IpFile argument of rust-lang webbrowser-rs v0.8.2 allows attackers to access arbitrary files via supplying a crafted URL.webbrowser
- CVE-2022-46471Online Health Care System v1.0 was discovered to contain a SQL injection vulnerability via the consulting_id parameter at /healthcare/Admin/
- CVE-2022-46478The RPC interface in datax-web v1.0.0 and v2.0.0 to v2.1.2 contains no permission checks by default which allows attackers to execute arbitr
- CVE-2022-46502Online Student Enrollment System v1.0 was discovered to contain a SQL injection vulnerability via the username parameter at /student_enrollm
- CVE-2022-46954Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?acti
- CVE-2022-46955Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?acti
- CVE-2023-23566A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to a
High 41
- CVE-2022-41721Request smuggling due to improper request handling in golang.org/x/net/http2/h2cgolang.org/x/net/http2/h2c · golang.org/x/net
- CVE-2023-0294Mediamatic – Media Library Folders <= 2.8.1 - Cross-Site Request Forgeryplugincraft Mediamatic – Media Library Folders
- CVE-2023-22491gatsby-transformer-remark vulnerable to unsanitized JavaScript code injection gatsbyjs gatsby · gatsby-transformer-remark
- CVE-2023-22493RSSHub is vulnerable to SSRF (Server-Side Request Forgery)DIYgod RSSHub · rsshub
- CVE-2022-21191Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checglobal-modules-path
- CVE-2022-42290NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to codNVIDIA DGX servers
- CVE-2022-42289NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to codNVIDIA DGX servers
- CVE-2022-42280NVIDIA BMC contains a vulnerability in SPX REST auth handler, where an un-authorized attacker can exploit a path traversal, which may lead tNVIDIA DGX servers
- CVE-2022-42279NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can inject arbitrary shell commands, which may lead to codNVIDIA DGX servers
- CVE-2022-42278NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can read and write to arbitrary locations within the memorNVIDIA DGX servers
- CVE-2022-42277NVIDIA DGX Station contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase NVIDIA DGX servers
- CVE-2022-42276NVIDIA DGX A100 contains a vulnerability in SBIOS in the SmiFlash, where a local user with elevated privileges can read, write and erase flaNVIDIA DGX servers
- CVE-2022-3161 The APDFL.dll contains a memory corruption vulnerability while parsing specially crafted PDF files.Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-3160 The APDFL.dll contains an out-of-bounds write past the fixed-length heap-based buffer while parsing specially crafted PDF files.Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-3159The APDFL.dll contains a stack-based buffer overflow vulnerability that could be triggered while parsing specially crafted PDF files.Siemens JT2Go · Siemens Teamcenter Visualization
- CVE-2022-42275NVIDIA BMC IPMI handler allows an unauthenticated host to write to a host SPI flash bypassing secureboot protections.NVIDIA DGX servers
- CVE-2022-42274NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service NVIDIA DGX servers
- CVE-2021-36204Insufficiently Protected Credentials in Metasys Johnson Controls Metasys ADS/ADX/OAS
- CVE-2022-3693Path traversal in FileOrbis File Management SystemDeytek Informatics FileOrbis File Management System
- CVE-2022-42136Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had pe
- CVE-2022-46093Hospital Management System v1.0 is vulnerable to SQL Injection.
- CVE-2022-46946Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete
- CVE-2022-46947Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete
- CVE-2022-46949Helmet Store Showroom Site v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /classes/Master.php?f=delete
- CVE-2022-46950Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?acti
- CVE-2022-46951Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?acti
- CVE-2022-46952Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?acti
- CVE-2022-46953Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/ajax.php?acti
- CVE-2022-46956Dynamic Transaction Queuing System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter at /admin/manage_user.p
- CVE-2022-48256Technitium DNS Server before 10.0 allows a self-CNAME denial-of-service attack in which a CNAME loop causes an answer to contain hundreds of
- CVE-2023-0288Heap-based Buffer Overflow in vim/vimvim/vim
- CVE-2023-0289Cross-site Scripting (XSS) - Stored in craigk5n/webcalendarcraigk5n/webcalendar
- CVE-2023-21587Adobe InDesign Font Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2023-21588Adobe InDesign Improper Input Validation Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2023-21589Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2023-21590Adobe InDesign Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InDesign
- CVE-2023-21594Adobe InCopy Font Parsing Heap-based Buffer Overflow Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2023-21595Adobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2023-21596Adobe InCopy Improper Input Validation Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2023-21597Adobe InCopy Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe InCopy
- CVE-2023-23559In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.
Medium, low and unrated 31
- CVE-2017-20169GGGGGGGG ToN-MasterServer svr_request_pub.php sql injectionGGGGGGGG ToN-MasterServer
- CVE-2015-10042Dovgalyuk AIBattle procedures.php registerUser sql injectionDovgalyuk AIBattle
- CVE-2023-0295Launchpad – Coming Soon & Maintenance Mode Plugin <= 1.0.13 - Authenticated (Administrator+) Cross-Site Scriptingobox Launchpad – Coming Soon & Maintenance Mode Plugin
- CVE-2023-0293Mediamatic – Media Library Folders <= 2.8.1 - Missing Authorizationplugincraft Mediamatic – Media Library Folders
- CVE-2015-10041Dovgalyuk AIBattle procedures.php sendComments sql injectionDovgalyuk AIBattle
- CVE-2015-10040gitlearn Escape Sequence config.sh getOutOf injectiongitlearn
- CVE-2023-22489Flarum is missing authorization in discussion repliesflarum framework · flarum/core
- CVE-2009-10002dpup fittr-flickr EXIF Preview easy-exif.js cross site scriptingdpup fittr-flickr
- CVE-2009-10001jianlinwei cool-php-captcha example-form.php cross site scriptingjianlinwei cool-php-captcha
- CVE-2021-4312Th3-822 Rapidleech zip.php zip_go cross site scriptingTh3-822 Rapidleech
- CVE-2023-0221Product security bypass vulnerability in ACC prior to version 8.3.4 allows a locally logged-in attacker with administrator privileges to bypTrellix Application and Change Control
- CVE-2023-0287ityouknow favorites-web Comment cross site scriptingityouknow favorites-web
- CVE-2023-0283SourceCodester Online Flight Booking Management System POST Parameter review_search.php sql injectionSourceCodester Online Flight Booking Management System
- CVE-2023-0281SourceCodester Online Flight Booking Management System judge_panel.php sql injectionSourceCodester Online Flight Booking Management System
- CVE-2022-42288NVIDIA BMC contains a vulnerability in IPMI handler, where an unauthorized attacker can use certain oracles to guess a valid BMC username, wNVIDIA DGX servers
- CVE-2022-42287NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can upload and download arbitrary files under certain circNVIDIA DGX servers
- CVE-2022-42286DGX A100 SBIOS contains a vulnerability in Bds, which may lead to code execution, denial of service, or escalation of privileges.NVIDIA DGX servers
- CVE-2022-42285DGX A100 SBIOS contains a vulnerability in the Pre-EFI Initialization (PEI)phase, where a privileged user can disable SPI flash protection, NVIDIA DGX servers
- CVE-2022-42284NVIDIA BMC stores user passwords in an obfuscated form in a database accessible by the host.NVIDIA DGX servers
- CVE-2022-42283NVIDIA BMC contains a vulnerability in IPMI handler, where an authorized attacker can cause a buffer overflow and cause a denial of service NVIDIA DGX servers
- CVE-2022-42282NVIDIA BMC contains a vulnerability in SPX REST API, where an authorized attacker can access arbitrary files, which may lead to information NVIDIA DGX servers
- CVE-2022-42281NVIDIA DGX A100 contains a vulnerability in SBIOS in the FsRecovery, which may allow a highly privileged local attacker to cause an out-of-bNVIDIA DGX servers
- CVE-2021-46872An issue was discovered in Nim before 1.6.2.
- CVE-2022-48090Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to SQL Injection via /app/dao/CustomerDAO.php.
- CVE-2022-48091Tramyardg hotel-mgmt-system version 2022.4 is vulnerable to Cross Site Scripting (XSS) via process_update_profile.php.
- CVE-2022-48257In Eternal Terminal 6.2.1, etserver and etclient have predictable logfile names in /tmp.
- CVE-2022-48258In Eternal Terminal 6.2.1, etserver and etclient have world-readable logfiles.
- CVE-2023-21591Adobe InDesign Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe InDesign
- CVE-2023-21592Adobe InDesign Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe InDesign
- CVE-2023-21598Adobe InCopy Font Parsing Use-After-Free Information Disclosure VulnerabilityAdobe InCopy
- CVE-2023-21599Adobe InCopy Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe InCopy