CVEs published January 18, 2023
89 CVEs were published on January 18, 2023: 7 critical, 37 high. 2 are now in CISA KEV.
- Published
- 89
- Critical
- 7
- High
- 37
- Medium
- 40
- Low
- 5
- Unrated
- 0
- Now in CISA KEV
- 2
- Fix available
- 27
Most affected products
- Adobe Acrobat Reader
- 14
- Sewio RTLS Studio
- 9
- Cisco Identity Services Engine Software
- 4
- Dell BIOS
- 3
- Adobe Dimension
- 2
- Dell CPG BIOS
- 2
- Dell EMC Secure Connect Gateway (SCG) Policy Manager
- 2
- GENI Portal
- 2
- IBM Robotic Process Automation for Cloud Pak
- 2
- Integrated Dell Remote Access Controller
- 2
Critical 7
- CVE-2022-47911CVE-2022-47911Sewio RTLS Studio
- CVE-2022-45444CVE-2022-45444Sewio RTLS Studio
- CVE-2022-43483CVE-2022-43483Sewio RTLS Studio
- CVE-2022-41989CVE-2022-41989Sewio RTLS Studio
- CVE-2020-35326SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0
- CVE-2022-41417BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App_Data/.
- CVE-2022-47966Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache San
High 37
- CVE-2022-3085 Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attackFuji Electric Tellus Lite V-Simulator
- CVE-2022-48191A vulnerability exists in Trend Micro Maximum Security 2022 (17.7) wherein a low-privileged user can write a known malicious executable to aTrend Micro Maxium Security
- CVE-2023-0242Insufficient permission check in the VQL copy() functionRapid7 Velociraptor · www.velocidex.com/golang/velociraptor
- CVE-2022-34457 Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secureDell Command Configure
- CVE-2022-34442 Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability.Dell EMC Secure Connect Gateway (SCG) Policy Manager
- CVE-2022-34462 Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability.Dell EMC Secure Connect Gateway (SCG) Policy Manager
- CVE-2022-32490 Dell BIOS contains an improper input validation vulnerability.Dell BIOS
- CVE-2022-34401 Dell BIOS contains a stack based buffer overflow vulnerability.Dell CPG BIOS
- CVE-2022-34460 Prior Dell BIOS versions contain an improper input validation vulnerability.Dell BIOS
- CVE-2022-34393 Dell BIOS contains an improper input validation vulnerability.Dell BIOS
- CVE-2022-34456 Dell EMC Metro node, Version(s) prior to 7.1, contain a Code Injection Vulnerability.Dell EMC Metro node
- CVE-2022-47395CVE-2022-47395Sewio RTLS Studio
- CVE-2022-45127CVE-2022-45127Sewio RTLS Studio
- CVE-2021-33959Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.
- CVE-2021-36630DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform D
- CVE-2022-45922An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803).
- CVE-2022-45923An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803).
- CVE-2022-45924An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803).
- CVE-2022-45925An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803).
- CVE-2022-45926An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803).
- CVE-2022-45927An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803).
- CVE-2022-45928A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803).
- CVE-2022-46505An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero
- CVE-2023-0040Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection.Swift Project Async HTTP Client
- CVE-2023-0164OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server.OrangeScrum
- CVE-2023-0358Use After Free in gpac/gpacgpac/gpac
- CVE-2023-21579Adobe Acrobat Reader DC Font Parsing Integer Overflow Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-21604Adobe Acrobat Reader Stack-based Buffer Overflow Arbitrary code executionAdobe Acrobat Reader
- CVE-2023-21605Adobe Acrobat Reader DC Font Parsing Heap-based Buffer Overflow Arbitrary code executionAdobe Acrobat Reader
- CVE-2023-21606Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-21607Adobe Acrobat Reader Improper Input Validation Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-21608Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-21609Adobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-21610Adobe Acrobat Reader Stack-based Buffer Overflow Arbitrary code executionAdobe Acrobat Reader
- CVE-2023-21611Adobe Acrobat Reader Creation of Temporary File in Directory with Incorrect Permissions Privilege escalationAdobe Acrobat Reader
- CVE-2023-21612Adobe Acrobat Reader Creation of Temporary File in Directory with Incorrect Permissions Privilege escalation Adobe Acrobat Reader
- CVE-2023-22809In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_ED
Medium, low and unrated 45
- CVE-2023-0290Rapid7 Velociraptor directory traversal in client ID parameter Rapid7 Velociraptor · www.velocidex.com/golang/velociraptor
- CVE-2010-10009frioux ptome sql injectionfrioux ptome
- CVE-2023-22863IBM Robotic Process Automation information disclosureIBM Robotic Process Automation
- CVE-2023-22594IBM Robotic Process Automation for Cloud Pak cross-site scriptingIBM Robotic Process Automation for Cloud Pak
- CVE-2023-22592IBM Robotic Process Automation for Cloud Pak insufficient permission settingsIBM Robotic Process Automation for Cloud Pak
- CVE-2022-47990IBM AIX denial of serviceIBM AIX
- CVE-2022-20967A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conCisco Identity Services Engine Software
- CVE-2022-20964A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to injCisco Identity Services Engine Software
- CVE-2022-20966A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conCisco Identity Services Engine Software
- CVE-2022-20965A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to takCisco Identity Services Engine Software
- CVE-2017-20173AlexRed contentmap contentmap.php Load sql injectionAlexRed contentmap
- CVE-2012-10006ale7714 sigeprosi sql injectionale7714 sigeprosi
- CVE-2011-10001iamdroppy phoenixcf articles.cfm sql injectioniamdroppy phoenixcf
- CVE-2021-4314It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user.Open Mainframe Project Zowe
- CVE-2017-20172ridhoq soundslike songs.py get_song_relations sql injectionridhoq soundslike
- CVE-2022-45103 Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerabiDell Unisphere for PowerMax vApp
- CVE-2023-0385Custom 404 Pro <= 3.7.1 - Cross-Site Request Forgerykunalnagar Custom 404 Pro
- CVE-2022-34399 Dell Alienware m17 R5 BIOS version prior to 1.2.2 contain a buffer access vulnerability.Dell CPG BIOS
- CVE-2022-34436 Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuraIntegrated Dell Remote Access Controller
- CVE-2022-34435 Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configuraIntegrated Dell Remote Access Controller
- CVE-2023-0214XSS in Skyhigh Security SWGSkyhigh Security Secure Web Gateway
- CVE-2020-36654GENI Portal sliceresource.php no_invocation_id_error cross site scriptingGENI Portal
- CVE-2020-36653GENI Portal error-text.php cross site scriptingGENI Portal
- CVE-2015-10068danynab movify-j ReviewServiceImpl.java getByMovieId sql injectiondanynab movify-j
- CVE-2010-10007lierdakil click-reminder BaseAction.php db_query sql injectionlierdakil click-reminder
- CVE-2022-25901Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function,cookiejar · org.webjars.npm:cookiejar
- CVE-2020-36651youngerheart nodeserver nodeserver.js path traversalyoungerheart nodeserver · web-node-server
- CVE-2018-25077melnaron mel-spintax spintax.js redosmelnaron mel-spintax · mel-spintax
- CVE-2015-10067oznetmaster SSharpSmartThreadPool SmartThreadPool.cs race conditionoznetmaster SSharpSmartThreadPool
- CVE-2022-47917CVE-2022-47917Sewio RTLS Studio
- CVE-2022-46733CVE-2022-46733Sewio RTLS Studio
- CVE-2022-43455CVE-2022-43455Sewio RTLS Studio
- CVE-2023-21860Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: Internal Operations).Oracle MySQL Cluster
- CVE-2020-22007OS Command Injection vulnerability in OKER G955V1 v1.03.02.20161128, allows physical attackers to interrupt the boot sequence and execute ar
- CVE-2022-3100A flaw was found in the openstack-barbican component.Red Hat OpenStack Platform
- CVE-2022-4235RushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application.RushBet
- CVE-2022-45613Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book.
- CVE-2022-47881Foxit PDF Reader and PDF Editor 11.2.1.53537 and earlier has an Out-of-Bounds Read vulnerability.
- CVE-2022-47950An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0.swift
- CVE-2023-21581Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-21585Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-21601Adobe Dimension OBJ File Parsing Use-After-Free Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-21603Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Dimension
- CVE-2023-21613Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader
- CVE-2023-21614Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure VulnerabilityAdobe Acrobat Reader