# CVEs published 2023-01-14

28 CVEs were published on January 14, 2023: 2 critical, 10 high. Days are UTC.

- [CVE-2015-10043](https://cve.now/CVE-2015-10043.md): abreen Apollo path traversal (CVSS 5.5, abreen Apollo)
- [CVE-2015-10020](https://cve.now/CVE-2015-10020.md): ssn2013 cis450Project AddAppUser.java addUser sql injection (CVSS 5.5, ssn2013 cis450Project)
- [CVE-2017-20167](https://cve.now/CVE-2017-20167.md): Minichan reports.php cross site scripting (CVSS 3.5, Minichan)
- [CVE-2022-45353](https://cve.now/CVE-2022-45353.md): WordPress Betheme theme \<= 26.6.1 is vulnerable to Broken Access Control (CVSS 4.3, Muffingroup Betheme)
- [CVE-2022-38467](https://cve.now/CVE-2022-38467.md): WordPress CRM Perks Forms Plugin \<= 1.1.0 is vulnerable to Reflected Cross Site Scripting (XSS) vulnerability (CVSS 6.1, CRM Perks Forms – WordPress Form Builder)
- [CVE-2023-22602](https://cve.now/CVE-2023-22602.md): Apache Shiro before 1.11.0, when used with Spring Boot 2.6+, may allow authentication bypass through a specially crafted HTTP request (no CVSS, Apache Software Foundation Apache Shiro · org.apache.shiro:…)
- [CVE-2023-22497](https://cve.now/CVE-2023-22497.md): Netdata is vulnerable to improper authentication (CVSS 6.5, netdata)
- [CVE-2023-22496](https://cve.now/CVE-2023-22496.md): Netdata vulnerable to command injection (CVSS 8.1, netdata)
- [CVE-2023-22495](https://cve.now/CVE-2023-22495.md): Izanami is vulnerable to Authorization Bypass (CVSS 9.8, MAIF izanami)
- [CVE-2022-41956](https://cve.now/CVE-2022-41956.md): Autolab is vulnerable to file disclosure via remote handin feature (CVSS 6.5, Autolab)
- [CVE-2023-22471](https://cve.now/CVE-2023-22471.md): Nextcloud Deck vulnerable to authorization bypass (CVSS 3.5, nextcloud security-advisories)
- [CVE-2023-22470](https://cve.now/CVE-2023-22470.md): Nextcloud Deck vulnerable to uncontrolled resource consumption (CVSS 3.5, nextcloud security-advisories)
- [CVE-2022-23532](https://cve.now/CVE-2022-23532.md): neo4j-apoc-procedures is vulnerable to path traversal (CVSS 7.1, neo4j-contrib neo4j-apoc-procedures · org.neo4j.procedure:a…)
- [CVE-2023-22478](https://cve.now/CVE-2023-22478.md): KubePi is vulnerable to missing authorization (CVSS 7.3, KubeOperator KubePi · github.com/KubeOperator/kubepi)
- [CVE-2022-41955](https://cve.now/CVE-2022-41955.md): Autolab is vulnerable to remote code execution (RCE) via MOSS functionality (CVSS 8.8, Autolab)
- [CVE-2023-22480](https://cve.now/CVE-2023-22480.md): KubeOperator is vulnerable to unauthorized access to system API (CVSS 7.3, KubeOperator · github.com/KubeOperator/KubeOperator)
- [CVE-2022-1812](https://cve.now/CVE-2022-1812.md): Integer Overflow or Wraparound in publify/publify (CVSS 7.6, publify/publify · publify\_core)
- [CVE-2022-2815](https://cve.now/CVE-2022-2815.md): Insecure Storage of Sensitive Information in publify/publify (CVSS 4.6, publify/publify · publify\_core)
- [CVE-2023-0297](https://cve.now/CVE-2023-0297.md): Code Injection in pyload/pyload (CVSS 9.8, pyload/pyload · pyload-ng)
- [CVE-2023-0298](https://cve.now/CVE-2023-0298.md): Incorrect Authorization in firefly-iii/firefly-iii (CVSS 6.5, firefly-iii/firefly-iii · grumpydictator/firefly-iii)
- [CVE-2023-0299](https://cve.now/CVE-2023-0299.md): Improper Input Validation in publify/publify (CVSS 8.4, publify/publify · publify\_core)
- [CVE-2023-0300](https://cve.now/CVE-2023-0300.md): Cross-site Scripting (XSS) - Reflected in alfio-event/alf.io (CVSS 3.5, alfio-event/alf.io)
- [CVE-2023-0301](https://cve.now/CVE-2023-0301.md): Cross-site Scripting (XSS) - Stored in alfio-event/alf.io (CVSS 4.3, alfio-event/alf.io)
- [CVE-2023-22850](https://cve.now/CVE-2023-22850.md): Tiki before 24.1, when the Spreadsheets feature is enabled, allows lib/sheet/grid.php PHP Object Injection because of an unserialize call. (CVSS 8.8)
- [CVE-2023-22851](https://cve.now/CVE-2023-22851.md): Tiki before 24.2 allows lib/importer/tikiimporter\_blog\_wordpress.php PHP Object Injection by an admin because of an unserialize call. (CVSS 7.2)
- [CVE-2023-22852](https://cve.now/CVE-2023-22852.md): Tiki through 25.0 allows CSRF attacks that are related to tiki-importer.php and tiki-import\_sheet.php. (CVSS 6.5)
- [CVE-2023-22853](https://cve.now/CVE-2023-22853.md): Tiki before 24.1, when feature\_create\_webhelp is enabled, allows lib/structures/structlib.php PHP Object Injection because of an eval. (CVSS 8.8)
- [CVE-2023-23589](https://cve.now/CVE-2023-23589.md): The SafeSocks option in Tor before 0.4.7.13 has a logic error in which the unsafe SOCKS4 protocol can be used but not the safe SOCKS4a proto (CVSS 6.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-14
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.