# CVEs published 2023-01-18

89 CVEs were published on January 18, 2023: 7 critical, 37 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2022-3085](https://cve.now/CVE-2022-3085.md): Fuji Electric Tellus Lite V-Simulator versions 4.0.12.0 and prior are vulnerable to a stack-based buffer overflow which may allow an attack (CVSS 7.8, Fuji Electric Tellus Lite V-Simulator)
- [CVE-2022-48191](https://cve.now/CVE-2022-48191.md): A vulnerability exists in Trend Micro Maximum Security 2022 (17.7) wherein a low-privileged user can write a known malicious executable to a (CVSS 7.0, Trend Micro Maxium Security)
- [CVE-2023-0290](https://cve.now/CVE-2023-0290.md): Rapid7 Velociraptor directory traversal in client ID parameter (CVSS 4.3, Rapid7 Velociraptor · www.velocidex.com/golang/velociraptor)
- [CVE-2010-10009](https://cve.now/CVE-2010-10009.md): frioux ptome sql injection (CVSS 5.5, frioux ptome)
- [CVE-2023-0242](https://cve.now/CVE-2023-0242.md): Insufficient permission check in the VQL copy() function (CVSS 8.8, Rapid7 Velociraptor · www.velocidex.com/golang/velociraptor)
- [CVE-2023-22863](https://cve.now/CVE-2023-22863.md): IBM Robotic Process Automation information disclosure (CVSS 5.9, IBM Robotic Process Automation)
- [CVE-2023-22594](https://cve.now/CVE-2023-22594.md): IBM Robotic Process Automation for Cloud Pak cross-site scripting (CVSS 4.6, IBM Robotic Process Automation for Cloud Pak)
- [CVE-2023-22592](https://cve.now/CVE-2023-22592.md): IBM Robotic Process Automation for Cloud Pak insufficient permission settings (CVSS 4.0, IBM Robotic Process Automation for Cloud Pak)
- [CVE-2022-47990](https://cve.now/CVE-2022-47990.md): IBM AIX denial of service (CVSS 6.2, IBM AIX)
- [CVE-2022-20967](https://cve.now/CVE-2022-20967.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to con (CVSS 4.8, Cisco Identity Services Engine Software)
- [CVE-2022-20964](https://cve.now/CVE-2022-20964.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inj (CVSS 6.3, Cisco Identity Services Engine Software)
- [CVE-2022-20966](https://cve.now/CVE-2022-20966.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to con (CVSS 5.4, Cisco Identity Services Engine Software)
- [CVE-2022-20965](https://cve.now/CVE-2022-20965.md): A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to tak (CVSS 4.3, Cisco Identity Services Engine Software)
- [CVE-2017-20173](https://cve.now/CVE-2017-20173.md): AlexRed contentmap contentmap.php Load sql injection (CVSS 5.5, AlexRed contentmap)
- [CVE-2012-10006](https://cve.now/CVE-2012-10006.md): ale7714 sigeprosi sql injection (CVSS 5.5, ale7714 sigeprosi)
- [CVE-2011-10001](https://cve.now/CVE-2011-10001.md): iamdroppy phoenixcf articles.cfm sql injection (CVSS 5.5, iamdroppy phoenixcf)
- [CVE-2021-4314](https://cve.now/CVE-2021-4314.md): It is possible to manipulate the JWT token without the knowledge of the JWT secret and authenticate without valid JWT token as any user. (CVSS 5.3, Open Mainframe Project Zowe)
- [CVE-2017-20172](https://cve.now/CVE-2017-20172.md): ridhoq soundslike songs.py get\_song\_relations sql injection (CVSS 5.5, ridhoq soundslike)
- [CVE-2022-45103](https://cve.now/CVE-2022-45103.md): Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain an information disclosure vulnerabi (CVSS 6.5, Dell Unisphere for PowerMax vApp)
- [CVE-2023-0385](https://cve.now/CVE-2023-0385.md): Custom 404 Pro \<= 3.7.1 - Cross-Site Request Forgery (CVSS 4.3, kunalnagar Custom 404 Pro)
- [CVE-2022-34457](https://cve.now/CVE-2022-34457.md): Dell command configuration, version 4.8 and prior, contains improper folder permission when installed not to default path but to non-secure (CVSS 7.3, Dell Command Configure)
- [CVE-2022-34399](https://cve.now/CVE-2022-34399.md): Dell Alienware m17 R5 BIOS version prior to 1.2.2 contain a buffer access vulnerability. (CVSS 5.1, Dell CPG BIOS)
- [CVE-2022-34436](https://cve.now/CVE-2022-34436.md): Dell iDRAC8 version 2.83.83.83 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configura (CVSS 2.7, Integrated Dell Remote Access Controller)
- [CVE-2022-34435](https://cve.now/CVE-2022-34435.md): Dell iDRAC9 version 6.00.02.00 and prior contain an improper input validation vulnerability in Racadm when the firmware lock-down configura (CVSS 2.7, Integrated Dell Remote Access Controller)
- [CVE-2023-0214](https://cve.now/CVE-2023-0214.md): XSS in Skyhigh Security SWG (CVSS 6.1, Skyhigh Security Secure Web Gateway)
- [CVE-2020-36654](https://cve.now/CVE-2020-36654.md): GENI Portal sliceresource.php no\_invocation\_id\_error cross site scripting (CVSS 3.5, GENI Portal)
- [CVE-2020-36653](https://cve.now/CVE-2020-36653.md): GENI Portal error-text.php cross site scripting (CVSS 3.5, GENI Portal)
- [CVE-2015-10068](https://cve.now/CVE-2015-10068.md): danynab movify-j ReviewServiceImpl.java getByMovieId sql injection (CVSS 5.5, danynab movify-j)
- [CVE-2022-34442](https://cve.now/CVE-2022-34442.md): Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a contain a Hard-coded Cryptographic Key vulnerability. (CVSS 8.0, Dell EMC Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2022-34462](https://cve.now/CVE-2022-34462.md): Dell EMC SCG Policy Manager, versions from 5.10 to 5.12, contain(s) a Hard-coded Password Vulnerability. (CVSS 8.4, Dell EMC Secure Connect Gateway (SCG) Policy Manager)
- [CVE-2022-32490](https://cve.now/CVE-2022-32490.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell BIOS)
- [CVE-2010-10007](https://cve.now/CVE-2010-10007.md): lierdakil click-reminder BaseAction.php db\_query sql injection (CVSS 5.5, lierdakil click-reminder)
- [CVE-2022-34401](https://cve.now/CVE-2022-34401.md): Dell BIOS contains a stack based buffer overflow vulnerability. (CVSS 7.5, Dell CPG BIOS)
- [CVE-2022-34460](https://cve.now/CVE-2022-34460.md): Prior Dell BIOS versions contain an improper input validation vulnerability. (CVSS 7.5, Dell BIOS)
- [CVE-2022-34393](https://cve.now/CVE-2022-34393.md): Dell BIOS contains an improper input validation vulnerability. (CVSS 7.5, Dell BIOS)
- [CVE-2022-34456](https://cve.now/CVE-2022-34456.md): Dell EMC Metro node, Version(s) prior to 7.1, contain a Code Injection Vulnerability. (CVSS 8.8, Dell EMC Metro node)
- [CVE-2022-25901](https://cve.now/CVE-2022-25901.md): Versions of the package cookiejar before 2.1.4 are vulnerable to Regular Expression Denial of Service (ReDoS) via the Cookie.parse function, (CVSS 5.3, cookiejar · org.webjars.npm:cookiejar)
- [CVE-2020-36651](https://cve.now/CVE-2020-36651.md): youngerheart nodeserver nodeserver.js path traversal (CVSS 5.5, youngerheart nodeserver · web-node-server)
- [CVE-2018-25077](https://cve.now/CVE-2018-25077.md): melnaron mel-spintax spintax.js redos (CVSS 3.5, melnaron mel-spintax · mel-spintax)
- [CVE-2015-10067](https://cve.now/CVE-2015-10067.md): oznetmaster SSharpSmartThreadPool SmartThreadPool.cs race condition (CVSS 4.6, oznetmaster SSharpSmartThreadPool)
- [CVE-2022-47917](https://cve.now/CVE-2022-47917.md): CVE-2022-47917 (CVSS 6.8, Sewio RTLS Studio)
- [CVE-2022-47911](https://cve.now/CVE-2022-47911.md): CVE-2022-47911 (CVSS 9.1, Sewio RTLS Studio)
- [CVE-2022-47395](https://cve.now/CVE-2022-47395.md): CVE-2022-47395 (CVSS 8.1, Sewio RTLS Studio)
- [CVE-2022-46733](https://cve.now/CVE-2022-46733.md): CVE-2022-46733 (CVSS 6.3, Sewio RTLS Studio)
- [CVE-2022-45444](https://cve.now/CVE-2022-45444.md): CVE-2022-45444 (CVSS 10.0, Sewio RTLS Studio)
- [CVE-2022-45127](https://cve.now/CVE-2022-45127.md): CVE-2022-45127 (CVSS 8.1, Sewio RTLS Studio)
- [CVE-2022-43483](https://cve.now/CVE-2022-43483.md): CVE-2022-43483 (CVSS 9.1, Sewio RTLS Studio)
- [CVE-2022-43455](https://cve.now/CVE-2022-43455.md): CVE-2022-43455 (CVSS 5.5, Sewio RTLS Studio)
- [CVE-2022-41989](https://cve.now/CVE-2022-41989.md): CVE-2022-41989 (CVSS 9.0, Sewio RTLS Studio)
- [CVE-2023-21860](https://cve.now/CVE-2023-21860.md): Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: Internal Operations). (CVSS 6.3, Oracle MySQL Cluster)
- [CVE-2020-22007](https://cve.now/CVE-2020-22007.md): OS Command Injection vulnerability in OKER G955V1 v1.03.02.20161128, allows physical attackers to interrupt the boot sequence and execute ar (CVSS 6.8)
- [CVE-2020-35326](https://cve.now/CVE-2020-35326.md): SQL Injection vulnerability in file /inxedu/demo\_inxedu\_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0 (CVSS 9.8)
- [CVE-2021-33959](https://cve.now/CVE-2021-33959.md): Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. (CVSS 7.5)
- [CVE-2021-36630](https://cve.now/CVE-2021-36630.md): DDOS reflection amplification vulnerability in eAut module of Ruckus Wireless SmartZone controller that allows remote attackers to perform D (CVSS 7.5)
- [CVE-2022-3100](https://cve.now/CVE-2022-3100.md): A flaw was found in the openstack-barbican component. (CVSS 5.9, Red Hat OpenStack Platform)
- [CVE-2022-41417](https://cve.now/CVE-2022-41417.md): BlogEngine.NET v3.3.8.0 allows an attacker to create any folder with "files" prefix under ~/App\_Data/. (CVSS 9.8)
- [CVE-2022-4235](https://cve.now/CVE-2022-4235.md): RushBet version 2022.23.1-b490616d allows a remote attacker to steal customer accounts via use of a malicious application. (CVSS 5.4, RushBet)
- [CVE-2022-45613](https://cve.now/CVE-2022-45613.md): Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms\_ci/index.php/book. (CVSS 5.4)
- [CVE-2022-45922](https://cve.now/CVE-2022-45922.md): An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). (CVSS 8.8)
- [CVE-2022-45923](https://cve.now/CVE-2022-45923.md): An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). (CVSS 8.8)
- [CVE-2022-45924](https://cve.now/CVE-2022-45924.md): An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). (CVSS 8.1)
- [CVE-2022-45925](https://cve.now/CVE-2022-45925.md): An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). (CVSS 7.5)
- [CVE-2022-45926](https://cve.now/CVE-2022-45926.md): An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). (CVSS 8.8)
- [CVE-2022-45927](https://cve.now/CVE-2022-45927.md): An issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). (CVSS 8.8)
- [CVE-2022-45928](https://cve.now/CVE-2022-45928.md): A remote OScript execution issue was discovered in OpenText Content Suite Platform 22.1 (16.2.19.1803). (CVSS 8.8)
- [CVE-2022-46505](https://cve.now/CVE-2022-46505.md): An issue in MatrixSSL 4.5.1-open and earlier leads to failure to securely check the SessionID field, resulting in the misuse of an all-zero (CVSS 7.5)
- [CVE-2022-47881](https://cve.now/CVE-2022-47881.md): Foxit PDF Reader and PDF Editor 11.2.1.53537 and earlier has an Out-of-Bounds Read vulnerability. (CVSS 6.5)
- [CVE-2022-47950](https://cve.now/CVE-2022-47950.md): An issue was discovered in OpenStack Swift before 2.28.1, 2.29.x before 2.29.2, and 2.30.0. (CVSS 6.5, swift)
- [CVE-2022-47966](https://cve.now/CVE-2022-47966.md): Multiple Zoho ManageEngine on-premise products, such as ServiceDesk Plus through 14003, allow remote code execution due to use of Apache San (CVSS 9.8, KEV)
- [CVE-2023-0040](https://cve.now/CVE-2023-0040.md): Versions of Async HTTP Client prior to 1.13.2 are vulnerable to a form of targeted request manipulation called CRLF injection. (CVSS 7.5, Swift Project Async HTTP Client)
- [CVE-2023-0164](https://cve.now/CVE-2023-0164.md): OrangeScrum version 2.0.11 allows an authenticated external attacker to execute arbitrary commands on the server. (CVSS 8.8, OrangeScrum)
- [CVE-2023-0358](https://cve.now/CVE-2023-0358.md): Use After Free in gpac/gpac (CVSS 7.8, gpac/gpac)
- [CVE-2023-21579](https://cve.now/CVE-2023-21579.md): Adobe Acrobat Reader DC Font Parsing Integer Overflow Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-21581](https://cve.now/CVE-2023-21581.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-21585](https://cve.now/CVE-2023-21585.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-21601](https://cve.now/CVE-2023-21601.md): Adobe Dimension OBJ File Parsing Use-After-Free Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-21603](https://cve.now/CVE-2023-21603.md): Adobe Dimension USD File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Dimension)
- [CVE-2023-21604](https://cve.now/CVE-2023-21604.md): Adobe Acrobat Reader Stack-based Buffer Overflow Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-21605](https://cve.now/CVE-2023-21605.md): Adobe Acrobat Reader DC Font Parsing Heap-based Buffer Overflow Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-21606](https://cve.now/CVE-2023-21606.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-21607](https://cve.now/CVE-2023-21607.md): Adobe Acrobat Reader Improper Input Validation Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-21608](https://cve.now/CVE-2023-21608.md): Adobe Acrobat Reader DC resetForm Use-After-Free Remote Code Execution Vulnerability (CVSS 7.8, KEV, Adobe Acrobat Reader)
- [CVE-2023-21609](https://cve.now/CVE-2023-21609.md): Adobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution Vulnerability (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-21610](https://cve.now/CVE-2023-21610.md): Adobe Acrobat Reader Stack-based Buffer Overflow Arbitrary code execution (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-21611](https://cve.now/CVE-2023-21611.md): Adobe Acrobat Reader Creation of Temporary File in Directory with Incorrect Permissions Privilege escalation (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-21612](https://cve.now/CVE-2023-21612.md): Adobe Acrobat Reader Creation of Temporary File in Directory with Incorrect Permissions Privilege escalation (CVSS 7.8, Adobe Acrobat Reader)
- [CVE-2023-21613](https://cve.now/CVE-2023-21613.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-21614](https://cve.now/CVE-2023-21614.md): Adobe Acrobat Reader DC Font Parsing Out-Of-Bounds Read Information Disclosure Vulnerability (CVSS 5.5, Adobe Acrobat Reader)
- [CVE-2023-22809](https://cve.now/CVE-2023-22809.md): In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO\_ED (CVSS 7.8)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.