CVEs published January 14, 2023
28 CVEs were published on January 14, 2023: 2 critical, 10 high.
- Published
- 28
- Critical
- 2
- High
- 10
- Medium
- 11
- Low
- 4
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 18
Most affected products
- publify/publify · publify_core
- 3
- alfio-event/alf.io
- 2
- Autolab
- 2
- netdata
- 2
- nextcloud security-advisories
- 2
- abreen Apollo
- 1
- Apache Software Foundation Apache Shiro · org.apache.shiro:…
- 1
- CRM Perks Forms – WordPress Form Builder
- 1
- firefly-iii/firefly-iii · grumpydictator/firefly-iii
- 1
- KubeOperator · github.com/KubeOperator/KubeOperator
- 1
Critical 2
High 10
- CVE-2023-22496Netdata vulnerable to command injection netdata
- CVE-2022-23532neo4j-apoc-procedures is vulnerable to path traversalneo4j-contrib neo4j-apoc-procedures · org.neo4j.procedure:a…
- CVE-2023-22478KubePi is vulnerable to missing authorizationKubeOperator KubePi · github.com/KubeOperator/kubepi
- CVE-2022-41955Autolab is vulnerable to remote code execution (RCE) via MOSS functionalityAutolab
- CVE-2023-22480KubeOperator is vulnerable to unauthorized access to system APIKubeOperator · github.com/KubeOperator/KubeOperator
- CVE-2022-1812Integer Overflow or Wraparound in publify/publifypublify/publify · publify_core
- CVE-2023-0299Improper Input Validation in publify/publifypublify/publify · publify_core
- CVE-2023-22850Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call.
- CVE-2023-22851Tiki before 24.2 allows lib/importer/tikiimporter_blog_wordpress.php PHP Object Injection by an admin because of an unserialize call.
- CVE-2023-22853Tiki before 24.1, when feature_create_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval.
Medium, low and unrated 16
- CVE-2015-10043abreen Apollo path traversalabreen Apollo
- CVE-2015-10020ssn2013 cis450Project AddAppUser.java addUser sql injectionssn2013 cis450Project
- CVE-2017-20167Minichan reports.php cross site scriptingMinichan
- CVE-2022-45353WordPress Betheme theme <= 26.6.1 is vulnerable to Broken Access ControlMuffingroup Betheme
- CVE-2022-38467WordPress CRM Perks Forms Plugin <= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerabilityCRM Perks Forms – WordPress Form Builder
- CVE-2023-22602Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP requestApache Software Foundation Apache Shiro · org.apache.shiro:…
- CVE-2023-22497Netdata is vulnerable to improper authenticationnetdata
- CVE-2022-41956Autolab is vulnerable to file disclosure via remote handin featureAutolab
- CVE-2023-22471Nextcloud Deck vulnerable to authorization bypassnextcloud security-advisories
- CVE-2023-22470Nextcloud Deck vulnerable to uncontrolled resource consumption nextcloud security-advisories
- CVE-2022-2815Insecure Storage of Sensitive Information in publify/publifypublify/publify · publify_core
- CVE-2023-0298Incorrect Authorization in firefly-iii/firefly-iiifirefly-iii/firefly-iii · grumpydictator/firefly-iii
- CVE-2023-0300Cross-site Scripting (XSS) - Reflected in alfio-event/alf.ioalfio-event/alf.io
- CVE-2023-0301Cross-site Scripting (XSS) - Stored in alfio-event/alf.ioalfio-event/alf.io
- CVE-2023-22852Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import_sheet.php.
- CVE-2023-23589The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a proto