CVEs published January 16, 2023
67 CVEs were published on January 16, 2023: 3 critical, 7 high.
- Published
- 67
- Critical
- 3
- High
- 7
- Medium
- 54
- Low
- 2
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 56
Most affected products
- Apache Software Foundation Apache Superset · apache-superset
- 7
- froxlor/froxlor
- 2
- 2071174A vinylmap
- 1
- 3D FlipBook
- 1
- abhilash1985 PredictApp
- 1
- antonbolling clan7ups
- 1
- Carousel, Slider, Gallery by WP Carousel
- 1
- Click to Chat
- 1
- Conditional Payment Methods for WooCommerce
- 1
- ConvertKit
- 1
Critical 3
High 7
- CVE-2022-3087 Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to an out-of-bounds write which may allow an attacker to eFuji Electric Tellus Lite V-Simulator
- CVE-2022-4547Conditional Payment Methods for WooCommerce <= 1.0 - Admin+ SQLiConditional Payment Methods for WooCommerce
- CVE-2023-0324SourceCodester Online Tours & Travels Management System page-login.php sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2022-43719Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access APIApache Software Foundation Apache Superset · apache-superset
- CVE-2022-4258Hima: Unquoted path vulnerabilities in HIMA PC based SoftwareHIMA HOPCS · HIMA X-OPC DA +2
- CVE-2022-47630Trusted Firmware-A through 2.8 has an out-of-bounds read in the X.509 parser for parsing boot certificates.
- CVE-2023-0315Command Injection in froxlor/froxlorfroxlor/froxlor
Medium, low and unrated 57
- CVE-2015-10057Little Apps Little Software Stats Password Reset class.securelogin.php access controlLittle Apps Little Software Stats
- CVE-2015-100562071174A vinylmap views.py contact sql injection2071174A vinylmap
- CVE-2023-0327saemorris TheRadSystem users.php cross site scriptingsaemorris TheRadSystem
- CVE-2015-10055PictureThisWebServer user.js router.post sql injectionPictureThisWebServer
- CVE-2015-10054githuis P2Manage Database.cs Execute sql injectiongithuis P2Manage
- CVE-2014-125080frontaccounting faplanet path traversalfrontaccounting faplanet
- CVE-2022-2658WP Spell Check < 9.13 - Admin+ Stored Cross-Site ScriptingWP Spell Check
- CVE-2022-4299Metricool < 1.18 - Admin+ Stored XSSMetricool
- CVE-2022-4431WOOCS < 1.3.9.4 - Contributor+ Stored XSSWOOCS
- CVE-2022-4309Subscribe2 < 10.38 - User Deletion via CSRFSubscribe2
- CVE-2022-4295Show All Comments < 7.0.1 - Reflected XSSShow All Comments
- CVE-2022-4578Video Conferencing with Zoom < 4.0.10 - Contributor+ Stored XSSVideo Conferencing with Zoom
- CVE-2022-4484Super Socializer < 7.13.44 - Contributor+ Stored XSSSocial Share, Social Login and Social Comments Plugin
- CVE-2022-4451Sassy Social Share < 3.3.45 - Contributor+ Stored XSSSocial Sharing Plugin
- CVE-2022-4544MashShare < 3.8.7 - Contributor+ Stored XSSSocial Media Share Buttons | MashShare
- CVE-2022-4483Insert Pages < 3.7.5 - Contributor+ Stored XSSInsert Pages
- CVE-2022-4460Sidebar Widgets by CodeLights <= 1.4 - Contributor+ Stored XSSSidebar Widgets by CodeLights
- CVE-2022-4476Download Manager < 3.2.62 - Contributor+ Stored XSSDownload Manager
- CVE-2022-4477Smash Balloon Social Post Feed < 4.1.6 - Contributor+ Stored XSSSmash Balloon Social Post Feed
- CVE-2022-4508ConvertKit < 2.0.5 - Contributor+ Stored XSSConvertKit
- CVE-2022-4549Tickera < 3.5.1.0 - Plugin Data Deletion via CSRFTickera
- CVE-2022-4482Carousel, Slider, Gallery by WP Carousel < 2.5.3 - Contributor+ Stored XSSCarousel, Slider, Gallery by WP Carousel
- CVE-2022-4478Font Awesome < 4.3.2 - Contributor+ Stored XSSFont Awesome
- CVE-2022-4481Mesmerize Companion < 1.6.135 - Contributor+ Stored XSSMesmerize Companion
- CVE-2022-4655Welcart e-Commerce < 2.8.9 - Contributor+ Stored XSS via ShortcodeWelcart e-Commerce
- CVE-2022-4507Real Cookie Banner < 3.4.10 - Contributor+ Stored XSSReal Cookie Banner: GDPR (DSGVO) & ePrivacy Cookie Consent
- CVE-2022-4442WCK < 2.3.3 - Admin+ Stored XSSCustom Post Types and Custom Fields creator
- CVE-2022-4320WordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSSWordPress Events Calendar Plugin
- CVE-2022-4658RSSImport <= 4.6.1 - Contributor+ Stored XSS via ShortcodeRSSImport
- CVE-2022-4571Seriously Simple Podcasting < 2.19.1 - Contributor+ Stored XSSSeriously Simple Podcasting
- CVE-2022-4199Link Library < 7.4.1 - Admin+ Stored XSSLink Library
- CVE-2022-4480Click to Chat < 3.18.1 - Contributor+ Stored XSSClick to Chat
- CVE-2022-4464Themify Portfolio Post < 1.2.1 - Contributor+ Stored XSSThemify Portfolio Post
- CVE-2022-4487Easy Accordion < 2.2.0 - Contributor+ Stored XSSEasy Accordion
- CVE-2022-4653Greenshift – animation and page builder blocks < 4.8.9 - Contributor+ Stored XSS via ShortcodeGreenshift
- CVE-2022-44533D FlipBook <= 1.13.2 - Contributor+ Stored XSS3D FlipBook
- CVE-2022-3904MonsterInsights < 8.9.1 - Stored Cross-Site Scripting via Google AnalyticsMonsterInsights
- CVE-2022-4469Simple Membership < 4.2.2 - Contributor+ Stored XSSSimple Membership
- CVE-2022-4486Meteor Slides < 1.5.7 - Contributor+ Stored XSSMeteor Slides
- CVE-2022-4330WP Attachments < 5.0.6 - Admin+ Stored XSSWP Attachments
- CVE-2022-4449Page Scroll To ID < 1.7.6 - Contributor+ Stored XSSPage scroll to id
- CVE-2022-4465WP Video Lightbox < 1.9.7 - Contributor+ Stored XSSWP Video Lightbox
- CVE-2022-4648Real Testimonials < 2.6.0 - Contributor+ Stored XSSReal Testimonials
- CVE-2022-4890abhilash1985 PredictApp Cookie new_framework_defaults_7_0.rb deserializationabhilash1985 PredictApp
- CVE-2021-4313NethServer phonenehome index.php get_country_coor sql injectionNethServer phonenehome
- CVE-2018-25076Events Extension events.php searchResults sql injectionEvents Extension
- CVE-2015-10053prodigasistemas curupira passwords_controller.rb sql injectionprodigasistemas curupira · curupira
- CVE-2016-15020liftkit database Query.php processOrderBy sql injectionliftkit database · liftkit/database
- CVE-2013-10012antonbolling clan7ups Login/Session sql injectionantonbolling clan7ups
- CVE-2022-41703Apache Superset: SQL injection vulnerability in adhoc clausesApache Software Foundation Apache Superset · apache-superset
- CVE-2022-45438Apache Superset: Dashboard metadata information leakApache Software Foundation Apache Superset · apache-superset
- CVE-2022-43721Apache Superset: Open Redirect VulnerabilityApache Software Foundation Apache Superset · apache-superset
- CVE-2022-43720Apache Superset: Improper rendering of user inputApache Software Foundation Apache Superset · apache-superset
- CVE-2022-43718Apache Superset: Cross-Site Scripting vulnerability on upload formsApache Software Foundation Apache Superset · apache-superset
- CVE-2022-43717Apache Superset: Cross-Site Scripting on dashboardsApache Software Foundation Apache Superset · apache-superset
- CVE-2023-0316Path Traversal: '\..\filename' in froxlor/froxlorfroxlor/froxlor
- CVE-2023-0323Cross-site Scripting (XSS) - Stored in pimcore/pimcorepimcore/pimcore