# CVEs published 2023-01-17

164 CVEs were published on January 17, 2023: 16 critical, 53 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2015-10066](https://cve.now/CVE-2015-10066.md): tynx wuersch Store.class.php getByCustomQuery sql injection (CVSS 5.5, tynx wuersch)
- [CVE-2014-125082](https://cve.now/CVE-2014-125082.md): nivit redports model.py sql injection (CVSS 5.5, nivit redports)
- [CVE-2010-10006](https://cve.now/CVE-2010-10006.md): michaelliao jopenid OpenIdManager.java getAuthentication timing discrepancy (CVSS 2.6, michaelliao jopenid · org.expressme:JOpenId)
- [CVE-2022-38469](https://cve.now/CVE-2022-38469.md): An unauthorized user with network access and the decryption key could decrypt sensitive data, such as usernames and passwords. (CVSS 7.5, GE Digital Proficy Historian)
- [CVE-2022-46331](https://cve.now/CVE-2022-46331.md): An unauthorized user could possibly delete any file on the system. (CVSS 7.5, GE Digital Proficy Historian)
- [CVE-2022-43494](https://cve.now/CVE-2022-43494.md): An unauthorized user could be able to read any file on the system, potentially exposing sensitive information. (CVSS 7.5, GE Digital Proficy Historian)
- [CVE-2022-46660](https://cve.now/CVE-2022-46660.md): An unauthorized user could alter or write files with full control over the path and content of the file. (CVSS 7.5, GE Digital Proficy Historian)
- [CVE-2023-21900](https://cve.now/CVE-2023-21900.md): Vulnerability in the Oracle Solaris product of Oracle Systems (component: NSSwitch). (CVSS 4.0, Oracle Solaris Operating System)
- [CVE-2023-21899](https://cve.now/CVE-2023-21899.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 5.5, Oracle VM VirtualBox)
- [CVE-2023-21898](https://cve.now/CVE-2023-21898.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 5.5, Oracle VM VirtualBox)
- [CVE-2023-21894](https://cve.now/CVE-2023-21894.md): Vulnerability in the Oracle Global Lifecycle Management NextGen OUI Framework product of Oracle Fusion Middleware (component: NextGen Instal (CVSS 7.3, Oracle Global Lifecycle Management NextGen OUI Framework)
- [CVE-2023-21893](https://cve.now/CVE-2023-21893.md): Vulnerability in the Oracle Data Provider for .NET component of Oracle Database Server. (CVSS 7.5, Oracle Data Provider for .NET · Oracle.ManagedDataAccess +1)
- [CVE-2023-21892](https://cve.now/CVE-2023-21892.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). (CVSS 5.4, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-21891](https://cve.now/CVE-2023-21891.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). (CVSS 5.4, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-21890](https://cve.now/CVE-2023-21890.md): Vulnerability in the Oracle Communications Converged Application Server product of Oracle Communications (component: Core). (CVSS 9.8, Oracle Communications Converged Application Server)
- [CVE-2023-21889](https://cve.now/CVE-2023-21889.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.8, Oracle VM VirtualBox)
- [CVE-2023-21888](https://cve.now/CVE-2023-21888.md): Vulnerability in the Primavera Gateway product of Oracle Construction and Engineering (component: WebUI). (CVSS 5.4, Oracle Primavera Gateway)
- [CVE-2023-21887](https://cve.now/CVE-2023-21887.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21886](https://cve.now/CVE-2023-21886.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 8.1, Oracle VM VirtualBox)
- [CVE-2023-21885](https://cve.now/CVE-2023-21885.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 3.8, Oracle VM VirtualBox)
- [CVE-2023-21884](https://cve.now/CVE-2023-21884.md): Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). (CVSS 4.4, Oracle VM VirtualBox)
- [CVE-2023-21883](https://cve.now/CVE-2023-21883.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21882](https://cve.now/CVE-2023-21882.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 2.7, Oracle MySQL Server)
- [CVE-2023-21881](https://cve.now/CVE-2023-21881.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21880](https://cve.now/CVE-2023-21880.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2023-21879](https://cve.now/CVE-2023-21879.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21878](https://cve.now/CVE-2023-21878.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21877](https://cve.now/CVE-2023-21877.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2023-21876](https://cve.now/CVE-2023-21876.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21875](https://cve.now/CVE-2023-21875.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Encryption). (CVSS 5.9, Oracle MySQL Server)
- [CVE-2023-21874](https://cve.now/CVE-2023-21874.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Thread Pooling). (CVSS 2.7, Oracle MySQL Server)
- [CVE-2023-21873](https://cve.now/CVE-2023-21873.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21872](https://cve.now/CVE-2023-21872.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2023-21871](https://cve.now/CVE-2023-21871.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21870](https://cve.now/CVE-2023-21870.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21869](https://cve.now/CVE-2023-21869.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: InnoDB). (CVSS 5.5, Oracle MySQL Server)
- [CVE-2023-21868](https://cve.now/CVE-2023-21868.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 6.5, Oracle MySQL Server)
- [CVE-2023-21867](https://cve.now/CVE-2023-21867.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21866](https://cve.now/CVE-2023-21866.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21865](https://cve.now/CVE-2023-21865.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21864](https://cve.now/CVE-2023-21864.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21863](https://cve.now/CVE-2023-21863.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Optimizer). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21862](https://cve.now/CVE-2023-21862.md): Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: XML Security component). (CVSS 8.1, Oracle Web Services Manager)
- [CVE-2023-21861](https://cve.now/CVE-2023-21861.md): Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Visual Analyzer). (CVSS 5.4, Oracle Business Intelligence Enterprise Edition)
- [CVE-2023-21859](https://cve.now/CVE-2023-21859.md): Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine). (CVSS 4.4, Oracle Access Manager)
- [CVE-2023-21858](https://cve.now/CVE-2023-21858.md): Vulnerability in the Oracle Collaborative Planning product of Oracle E-Business Suite (component: Installation). (CVSS 7.5, Oracle Collaborative Planning)
- [CVE-2023-21857](https://cve.now/CVE-2023-21857.md): Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Auomated Test Suite). (CVSS 7.5, Oracle HCM Common Architecture)
- [CVE-2023-21856](https://cve.now/CVE-2023-21856.md): Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports). (CVSS 7.5, Oracle iSetup)
- [CVE-2023-21855](https://cve.now/CVE-2023-21855.md): Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Pocket Outlook Sync(PocketPC)). (CVSS 7.5, Oracle Sales for Handhelds)
- [CVE-2023-21854](https://cve.now/CVE-2023-21854.md): Vulnerability in the Oracle Sales Offline product of Oracle E-Business Suite (component: Core Components). (CVSS 7.5, Oracle Sales Offline)
- [CVE-2023-21853](https://cve.now/CVE-2023-21853.md): Vulnerability in the Oracle Mobile Field Service product of Oracle E-Business Suite (component: Synchronization). (CVSS 7.5, Oracle Mobile Field Service)
- [CVE-2023-21852](https://cve.now/CVE-2023-21852.md): Vulnerability in the Oracle Learning Management product of Oracle E-Business Suite (component: Setup). (CVSS 7.5, Oracle Learning Management)
- [CVE-2023-21851](https://cve.now/CVE-2023-21851.md): Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Marketing Administration). (CVSS 7.5, Oracle Marketing)
- [CVE-2023-21850](https://cve.now/CVE-2023-21850.md): Vulnerability in the Oracle Demantra Demand Management product of Oracle Supply Chain (component: E-Business Collections). (CVSS 7.5, Oracle Demantra Demand Management)
- [CVE-2023-21849](https://cve.now/CVE-2023-21849.md): Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Java utils). (CVSS 7.5, Oracle Applications DBA)
- [CVE-2023-21848](https://cve.now/CVE-2023-21848.md): Vulnerability in the Oracle Communications Convergence product of Oracle Communications Applications (component: Admin Configuration). (CVSS 8.8, Oracle Communications Convergence)
- [CVE-2023-21847](https://cve.now/CVE-2023-21847.md): Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Download). (CVSS 5.4, Oracle Web Applications Desktop Integrator)
- [CVE-2023-21846](https://cve.now/CVE-2023-21846.md): Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). (CVSS 8.8, Oracle BI Publisher)
- [CVE-2023-21845](https://cve.now/CVE-2023-21845.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Panel Processor). (CVSS 5.4, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2023-21844](https://cve.now/CVE-2023-21844.md): Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Elastic Search). (CVSS 5.4, Oracle PeopleSoft Enterprise PT PeopleTools)
- [CVE-2023-21843](https://cve.now/CVE-2023-21843.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Sound). (CVSS 3.7, Oracle Java SE JDK and JRE)
- [CVE-2023-21842](https://cve.now/CVE-2023-21842.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2023-21841](https://cve.now/CVE-2023-21841.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2023-21840](https://cve.now/CVE-2023-21840.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PS). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21839](https://cve.now/CVE-2023-21839.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, KEV, Oracle WebLogic Server)
- [CVE-2023-21838](https://cve.now/CVE-2023-21838.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2023-21837](https://cve.now/CVE-2023-21837.md): Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). (CVSS 7.5, Oracle WebLogic Server)
- [CVE-2023-21836](https://cve.now/CVE-2023-21836.md): Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: DML). (CVSS 4.9, Oracle MySQL Server)
- [CVE-2023-21835](https://cve.now/CVE-2023-21835.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2023-21834](https://cve.now/CVE-2023-21834.md): Vulnerability in the Oracle Self-Service Human Resources product of Oracle E-Business Suite (component: Workflow, Approval, Work Force Manag (CVSS 4.3, Oracle Self-Service Human Resources)
- [CVE-2023-21832](https://cve.now/CVE-2023-21832.md): Vulnerability in the Oracle BI Publisher product of Oracle Fusion Middleware (component: Security). (CVSS 8.8, Oracle BI Publisher)
- [CVE-2023-21831](https://cve.now/CVE-2023-21831.md): Vulnerability in the PeopleSoft Enterprise CS Academic Advisement product of Oracle PeopleSoft (component: Advising Notes). (CVSS 5.3, Oracle PeopleSoft Enterprise CS Academic Advisement)
- [CVE-2023-21830](https://cve.now/CVE-2023-21830.md): Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). (CVSS 5.3, Oracle Java SE JDK and JRE)
- [CVE-2023-21829](https://cve.now/CVE-2023-21829.md): Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. (CVSS 6.3, Oracle Database - Enterprise Edition)
- [CVE-2023-21828](https://cve.now/CVE-2023-21828.md): Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). (CVSS 8.1, Oracle Hospitality Reporting and Analytics)
- [CVE-2023-21827](https://cve.now/CVE-2023-21827.md): Vulnerability in the Oracle Database Data Redaction component of Oracle Database Server. (CVSS 4.3, Oracle Database - Enterprise Edition)
- [CVE-2023-21826](https://cve.now/CVE-2023-21826.md): Vulnerability in the Oracle Hospitality Reporting and Analytics product of Oracle Food and Beverage Applications (component: Reporting). (CVSS 7.6, Oracle Hospitality Reporting and Analytics)
- [CVE-2023-21825](https://cve.now/CVE-2023-21825.md): Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Supplier Management). (CVSS 5.3, Oracle iSupplier Portal)
- [CVE-2023-21824](https://cve.now/CVE-2023-21824.md): Vulnerability in the Oracle Communications BRM - Elastic Charging Engine product of Oracle Communications Applications (component: Customer, (CVSS 4.4, Oracle Communications BRM - Elastic Charging Engine)
- [CVE-2022-39429](https://cve.now/CVE-2022-39429.md): Vulnerability in the Java VM component of Oracle Database Server. (CVSS 4.3, Oracle Database - Enterprise Edition)
- [CVE-2022-46732](https://cve.now/CVE-2022-46732.md): CVE-2022-46732 (CVSS 9.8, GE Digital Proficy Historian)
- [CVE-2017-20171](https://cve.now/CVE-2017-20171.md): PrivateSky apersistence mysqlUtils.js sql injection (CVSS 5.5, PrivateSky apersistence)
- [CVE-2015-10065](https://cve.now/CVE-2015-10065.md): AenBleidd FiND my\_validator.cpp init\_result buffer overflow (CVSS 5.5, AenBleidd FiND)
- [CVE-2014-125081](https://cve.now/CVE-2014-125081.md): risheesh debutsav sql injection (CVSS 5.5, risheesh debutsav)
- [CVE-2022-23521](https://cve.now/CVE-2022-23521.md): gitattributes parsing integer overflow in git (CVSS 9.8, git)
- [CVE-2022-41903](https://cve.now/CVE-2022-41903.md): Integer overflow in \`git archive\`, \`git log --format\` leading to RCE in git (CVSS 9.8, git)
- [CVE-2023-22733](https://cve.now/CVE-2023-22733.md): Improper Output Neutralization in Log Module in shopware (CVSS 2.7, shopware platform · shopware/platform +1)
- [CVE-2023-22732](https://cve.now/CVE-2023-22732.md): Insufficient Session Expiration in Administration in shopware (CVSS 3.7, shopware platform · shopware/platform +1)
- [CVE-2023-22731](https://cve.now/CVE-2023-22731.md): Improper Control of Generation of Code in Twig rendered views in shopware (CVSS 10.0, shopware platform · shopware/platform +1)
- [CVE-2023-22730](https://cve.now/CVE-2023-22730.md): Improper Input Validation of Clearance sale in cart (CVSS 5.3, shopware platform · shopware/platform +1)
- [CVE-2023-22734](https://cve.now/CVE-2023-22734.md): Improper Input Newsletter subscription option validation in shopware (CVSS 4.3, shopware platform · shopware/platform +1)
- [CVE-2022-41953](https://cve.now/CVE-2022-41953.md): Git clone remote code execution vulnerability in git-for-windows (CVSS 8.6, git-for-windows git)
- [CVE-2023-22727](https://cve.now/CVE-2023-22727.md): Database Query::offset() and limit() vulnerable to SQL injection in cakephp (CVSS 9.8, cakephp · cakephp/cakephp +1)
- [CVE-2023-22499](https://cve.now/CVE-2023-22499.md): Interactive permission prompt spoofing in Deno (CVSS 7.5, denoland deno · deno)
- [CVE-2022-23538](https://cve.now/CVE-2022-23538.md): User credentials leaked to third-party service via HTTP redirect in scs-library-client (CVSS 5.2, sylabs scs-library-client · github.com/sylabs/scs-library-c…)
- [CVE-2022-4891](https://cve.now/CVE-2022-4891.md): Sisimai string.rb to\_plain redos (CVSS 3.5, Sisimai)
- [CVE-2023-23749](https://cve.now/CVE-2023-23749.md): Extension - miniorange - LDAP Integration - LDAP Injection (username) (CVSS 7.5, miniorange LDAP Integration with Active Directory and OpenL…)
- [CVE-2022-37436](https://cve.now/CVE-2022-37436.md): Apache HTTP Server: mod\_proxy prior to 2.4.55 allows a backend to trigger HTTP response splitting (CVSS 5.3, Apache Software Foundation Apache HTTP Server)
- [CVE-2022-36760](https://cve.now/CVE-2022-36760.md): Apache HTTP Server: mod\_proxy\_ajp Possible request smuggling (CVSS 9.0, Apache Software Foundation Apache HTTP Server)
- [CVE-2006-20001](https://cve.now/CVE-2006-20001.md): Apache HTTP Server: mod\_dav out of bounds read, or write of zero byte (no CVSS, Apache Software Foundation Apache HTTP Server)
- [CVE-2015-10064](https://cve.now/CVE-2015-10064.md): VictorFerraresi pokemon-database-php sql injection (CVSS 5.5, VictorFerraresi pokemon-database-php)
- [CVE-2015-10063](https://cve.now/CVE-2015-10063.md): saemorris TheRadSystem \_login.php redirect sql injection (CVSS 7.3, saemorris TheRadSystem)
- [CVE-2015-10062](https://cve.now/CVE-2015-10062.md): galaxy-data-resource Command Line Template injection (CVSS 5.5, galaxy-data-resource)
- [CVE-2023-22875](https://cve.now/CVE-2023-22875.md): IBM Security QRadar SIEM information disclosure (CVSS 8.4, IBM Security QRadar SIEM)
- [CVE-2022-4621](https://cve.now/CVE-2022-4621.md): Panasonic Sanyo CCTV Network Camera (CVSS 7.5, Panasonic Sanyo CCTV Network Camera)
- [CVE-2022-3091](https://cve.now/CVE-2022-3091.md): RONDS EPM version 1.19.5 has a vulnerability in which a function could allow unauthenticated users to leak credentials. (CVSS 7.5, RONDS Equipment Predictive Maintenance Solution)
- [CVE-2022-2893](https://cve.now/CVE-2022-2893.md): RONDS EPM version 1.19.5 does not properly validate the filename parameter, which could allow an unauthorized user to specify file paths a (CVSS 8.2, RONDS Equipment Predictive Maintenance Solution)
- [CVE-2016-15021](https://cve.now/CVE-2016-15021.md): nickzren alsdb sql injection (CVSS 5.5, nickzren alsdb)
- [CVE-2015-10061](https://cve.now/CVE-2015-10061.md): evandro-machado Trabalho-Web2 ClienteDAO.java sql injection (CVSS 5.5, evandro-machado Trabalho-Web2)
- [CVE-2013-10013](https://cve.now/CVE-2013-10013.md): Bricco Authenticator Plugin DBAuthenticator.java compare sql injection (CVSS 5.5, Bricco Authenticator Plugin)
- [CVE-2017-20170](https://cve.now/CVE-2017-20170.md): ollpu parontalli index.php sql injection (CVSS 5.5, ollpu parontalli)
- [CVE-2015-10060](https://cve.now/CVE-2015-10060.md): MNBikeways database views.py sql injection (CVSS 5.5, MNBikeways database)
- [CVE-2015-10059](https://cve.now/CVE-2015-10059.md): s134328 Webapplication-Veganguide apiService.js cross site scripting (CVSS 3.5, s134328 Webapplication-Veganguide)
- [CVE-2015-10058](https://cve.now/CVE-2015-10058.md): Wikisource Category Browser index.php cross site scripting (CVSS 3.5, Wikisource Category Browser)
- [CVE-2010-10008](https://cve.now/CVE-2010-10008.md): simplesamlphp simplesamlphp-module-openidprovider trust.tpl.php cross site scripting (CVSS 3.5, simplesamlphp-module-openidprovider · simplesamlphp/simples…)
- [CVE-2023-0332](https://cve.now/CVE-2023-0332.md): SourceCodester Online Food Ordering System manage\_user.php sql injection (CVSS 7.3, SourceCodester Online Food Ordering System)
- [CVE-2022-43462](https://cve.now/CVE-2022-43462.md): WordPress IP Blacklist Cloud Plugin \<= 5.00 is vulnerable to SQL Injection (SQLi) vulnerability (CVSS 9.1, Adeel Ahmed IP Blacklist Cloud)
- [CVE-2022-42462](https://cve.now/CVE-2022-42462.md): WordPress IP Blacklist Cloud Plugin \<= 5.00 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, Adeel Ahmed IP Blacklist Cloud)
- [CVE-2022-30544](https://cve.now/CVE-2022-30544.md): WordPress OSM – OpenStreetMap Plugin \<= 6.0.1 is vulnerable to Cross Site Request Forgery (CSRF) (CVSS 4.3, MiKa OSM – OpenStreetMap)
- [CVE-2020-36611](https://cve.now/CVE-2020-36611.md): File and Directory Permission Vulnerability in Hitachi Tuning Manager (CVSS 6.6, Hitachi Tuning Manager)
- [CVE-2018-14628](https://cve.now/CVE-2018-14628.md): An information leak vulnerability was discovered in Samba's LDAP server. (no CVSS, Samba)
- [CVE-2021-32837](https://cve.now/CVE-2021-32837.md): mechanize vulnerable to ReDoS (CVSS 7.5, python-mechanize mechanize · mechanize)
- [CVE-2021-36647](https://cve.now/CVE-2021-36647.md): Use of a Broken or Risky Cryptographic Algorithm in the function mbedtls\_mpi\_exp\_mod() in lignum.c in Mbed TLS Mbed TLS all versions before (CVSS 4.7)
- [CVE-2022-2251](https://cve.now/CVE-2022-2251.md): Improper sanitization of branch names in GitLab Runner affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5. (CVSS 4.8, GitLab Runner)
- [CVE-2022-23739](https://cve.now/CVE-2022-23739.md): Incorrect authorization check in GitHub Enterprise Server leading to escalation of privileges in GraphQL API requests from GitHub Apps using scoped user-to-server tokens (CVSS 9.8, GitHub Enterprise Server)
- [CVE-2022-2907](https://cve.now/CVE-2022-2907.md): An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 before 15.1.6, all versions starting from 15.2 before (CVSS 5.7, GitLab)
- [CVE-2022-3650](https://cve.now/CVE-2022-3650.md): A privilege escalation flaw was found in Ceph. (no CVSS, Ceph)
- [CVE-2022-39195](https://cve.now/CVE-2022-39195.md): A cross-site scripting (XSS) vulnerability in the LISTSERV 17 web interface allows remote attackers to inject arbitrary JavaScript or HTML v (CVSS 6.1)
- [CVE-2022-40319](https://cve.now/CVE-2022-40319.md): The LISTSERV 17 web interface allows remote attackers to conduct Insecure Direct Object References (IDOR) attacks via a modified email addre (CVSS 7.5)
- [CVE-2022-40704](https://cve.now/CVE-2022-40704.md): A XSS vulnerability was found in phoromatic\_r\_add\_test\_details.php in phoronix-test-suite. (CVSS 6.1, phoronix-test-suite)
- [CVE-2022-4121](https://cve.now/CVE-2022-4121.md): In libetpan a null pointer dereference in mailimap\_mailbox\_data\_status\_free in low-level/imap/mailimap\_types.c was found that could lead to (CVSS 5.5, libetpan)
- [CVE-2022-41858](https://cve.now/CVE-2022-41858.md): A flaw was found in the Linux kernel. (CVSS 7.1, Linux kernel)
- [CVE-2022-41859](https://cve.now/CVE-2022-41859.md): In freeradius, the EAP-PWD function compute\_password\_element() leaks information about the password which allows an attacker to substantiall (CVSS 7.5, freeradius)
- [CVE-2022-41860](https://cve.now/CVE-2022-41860.md): In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the server will try to look that option up in the internal dictionari (CVSS 7.5, freeradius)
- [CVE-2022-41861](https://cve.now/CVE-2022-41861.md): A flaw was found in freeradius. (CVSS 6.5, freeradius)
- [CVE-2022-43975](https://cve.now/CVE-2022-43975.md): An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0\_3.2.2.17p0\_4.7p0. (CVSS 7.5)
- [CVE-2022-43976](https://cve.now/CVE-2022-43976.md): An issue was discovered in FC46-WebBridge on GE Grid Solutions MS3000 devices before 3.7.6.25p0\_3.2.2.17p0\_4.7p0. (CVSS 9.8)
- [CVE-2022-43977](https://cve.now/CVE-2022-43977.md): An issue was discovered on GE Grid Solutions MS3000 devices before 3.7.6.25p0\_3.2.2.17p0\_4.7p0. (CVSS 9.8)
- [CVE-2022-45439](https://cve.now/CVE-2022-45439.md): A pair of spare WiFi credentials is stored in the configuration file of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0 in cleartext. (CVSS 6.5, Zyxel AX7501-B0 firmware)
- [CVE-2022-45440](https://cve.now/CVE-2022-45440.md): A vulnerability exists in the FTP server of the Zyxel AX7501-B0 firmware prior to V5.17(ABPC.3)C0, which processes symbolic links on externa (CVSS 4.4, Zyxel AX7501-B0 firmware)
- [CVE-2022-46475](https://cve.now/CVE-2022-46475.md): D-Link DIR 645A1 1.06B01\_Beta01 was discovered to contain a stack overflow via the service= variable in the genacgi\_main function. (CVSS 9.8)
- [CVE-2022-46648](https://cve.now/CVE-2022-46648.md): ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repos (CVSS 8.0, ruby-git · git)
- [CVE-2022-46891](https://cve.now/CVE-2022-46891.md): An issue was discovered in the Arm Mali GPU Kernel Driver. (no CVSS)
- [CVE-2022-47318](https://cve.now/CVE-2022-47318.md): ruby-git versions prior to v1.13.0 allows a remote authenticated attacker to execute an arbitrary ruby code by having a user to load a repos (CVSS 8.8, ruby-git · git)
- [CVE-2022-47853](https://cve.now/CVE-2022-47853.md): TOTOlink A7100RU V7.4cu.2313\_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. (CVSS 9.8)
- [CVE-2022-47929](https://cve.now/CVE-2022-47929.md): In the Linux kernel before 6.1.6, a NULL pointer dereference bug in the traffic control subsystem allows an unprivileged user to trigger a d (CVSS 5.5)
- [CVE-2023-0122](https://cve.now/CVE-2023-0122.md): A NULL pointer dereference vulnerability in the Linux kernel NVMe functionality, in nvmet\_setup\_auth(), allows an attacker to perform a Pre- (CVSS 7.5, Kernel)
- [CVE-2023-0158](https://cve.now/CVE-2023-0158.md): Triggered crash on direct RRDP access (CVSS 7.5, NLnet Labs Krill)
- [CVE-2023-0296](https://cve.now/CVE-2023-0296.md): The Birthday attack against 64-bit block ciphers flaw (CVE-2016-2183) was reported for the health checks port (9979) on etcd grpc-proxy comp (CVSS 5.3, Red Hat OpenShift)
- [CVE-2023-0337](https://cve.now/CVE-2023-0337.md): Cross-site Scripting (XSS) - Reflected in lirantal/daloradius (CVSS 5.8, lirantal/daloradius)
- [CVE-2023-0338](https://cve.now/CVE-2023-0338.md): Cross-site Scripting (XSS) - Reflected in lirantal/daloradius (CVSS 5.8, lirantal/daloradius)
- [CVE-2023-22278](https://cve.now/CVE-2023-22278.md): m-FILTER prior to Ver.5.70R01 (Ver.5 Series) and m-FILTER prior to Ver.4.87R04 (Ver.4 Series) allows a remote unauthenticated attacker to by (CVSS 5.3, Digital Arts m-FILTER Ver.5 Series and Ver.4 Series)
- [CVE-2023-22279](https://cve.now/CVE-2023-22279.md): MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevanc (CVSS 9.8, Mahoroba Kobo MAHO-PBX NetDevancer series)
- [CVE-2023-22280](https://cve.now/CVE-2023-22280.md): MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Lite/Uni prior to Ver.1.11.00, and MAHO-PBX NetDevanc (CVSS 7.2, Mahoroba Kobo MAHO-PBX NetDevancer series)
- [CVE-2023-22286](https://cve.now/CVE-2023-22286.md): Cross-site request forgery (CSRF) vulnerability in MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MAHO-PBX NetDevancer VSG Li (CVSS 8.1, Mahoroba Kobo MAHO-PBX NetDevancer series)
- [CVE-2023-22296](https://cve.now/CVE-2023-22296.md): Reflected cross-site scripting vulnerability in MAHO-PBX NetDevancer series MAHO-PBX NetDevancer Lite/Uni/Pro/Cloud prior to Ver.1.11.00, MA (CVSS 6.1, Mahoroba Kobo MAHO-PBX NetDevancer series)
- [CVE-2023-22298](https://cve.now/CVE-2023-22298.md): Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary (CVSS 6.1, pgAdmin Project pgAdmin · pgadmin4)
- [CVE-2023-22303](https://cve.now/CVE-2023-22303.md): TP-Link SG105PE firmware prior to 'TL-SG105PE(UN) 1.0\_1.0.0 Build 20221208' contains an authentication bypass vulnerability. (CVSS 9.8, TP-Link SG105PE)
- [CVE-2023-22304](https://cve.now/CVE-2023-22304.md): OS command injection vulnerability in PIX-RT100 versions RT100\_TEQ\_2.1.1\_EQ101 and RT100\_TEQ\_2.1.2\_EQ101 allows a network-adjacent attacker (CVSS 8.0, PIXELA PIX-RT100)
- [CVE-2023-22316](https://cve.now/CVE-2023-22316.md): Hidden functionality vulnerability in PIX-RT100 versions RT100\_TEQ\_2.1.1\_EQ101 and RT100\_TEQ\_2.1.2\_EQ101 allows a network-adjacent attacker (CVSS 6.5, PIXELA PIX-RT100)
- [CVE-2023-22357](https://cve.now/CVE-2023-22357.md): Active debug code exists in OMRON CP1L-EL20DR-D all versions, which may lead to a command that is not specified in FINS protocol being execu (CVSS 9.8, OMRON CP1L-EL20DR-D)
- [CVE-2023-22366](https://cve.now/CVE-2023-22366.md): CX-Motion-MCH v2.32 and earlier contains an access of uninitialized pointer vulnerability. (CVSS 7.8, OMRON CX-Motion-MCH)
- [CVE-2023-22624](https://cve.now/CVE-2023-22624.md): Zoho ManageEngine Exchange Reporter Plus before 5708 allows attackers to conduct XXE attacks. (CVSS 7.5)
- [CVE-2023-23637](https://cve.now/CVE-2023-23637.md): IMPatienT before 1.5.2 allows stored XSS via onmouseover in certain text fields within a PATCH /modify\_onto request to the ontology builder. (CVSS 7.6)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-17
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.