CVEs published January 19, 2023
56 CVEs were published on January 19, 2023: 12 critical, 9 high.
- Published
- 56
- Critical
- 12
- High
- 9
- Medium
- 32
- Low
- 3
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 12
Most affected products
- Cisco Small Business RV Series Router Firmware
- 4
- Ghost Foundation Ghost
- 4
- zephyrproject-rtos zephyr
- 3
- Cisco BroadWorks
- 2
- Cisco CX Cloud Agent
- 2
- Cisco Industrial Network Director
- 2
- Cisco RoomOS Software · Cisco TelePresence Endpoint Software
- 2
- modoboa/modoboa · modoboa
- 2
- warfareplugins Social Sharing Plugin – Social Warfare
- 2
- 3COM Marketing 3com – Asesor de Cookies para normativa espa…
- 1
Critical 12
- CVE-2023-22741heap-over-flow in stun_parse_attribute in sofia-sipfreeswitch sofia-sip
- CVE-2022-47197An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.Ghost Foundation Ghost
- CVE-2022-47196An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.Ghost Foundation Ghost
- CVE-2022-47195An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.Ghost Foundation Ghost
- CVE-2022-47194An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4.Ghost Foundation Ghost
- CVE-2023-20025A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers could allow an unautheCisco Small Business RV Series Router Firmware
- CVE-2022-3806Bluetooth HCI Error Handling Double Freezephyrproject-rtos zephyr
- CVE-2022-46476D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.
- CVE-2022-46887Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[]
- CVE-2022-47105Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData.org.jeecgframework.boot:jeecg-boot-base-core · org.jeecgfra…
- CVE-2022-47740Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php.
- CVE-2023-0397DoS: Invalid Initialization in le_read_buffer_size_completezephyrproject-rtos zephyr
High 9
- CVE-2023-23690 Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability.Cloud Mobility for Dell Storage
- CVE-2023-20018A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote aCisco Session Initiation Protocol (SIP) Software
- CVE-2023-20020A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Cisco BroadWorks
- CVE-2023-20038A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a Cisco Industrial Network Director
- CVE-2023-20010A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Cisco Unified Communications Manager
- CVE-2021-37774An issue was discovered in function httpProcDataSrv in TL-WDR7660 2.0.30 that allows attackers to execute arbitrary code.
- CVE-2022-47745ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection.
- CVE-2022-47766PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability.
- CVE-2023-0126Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitSonicWall SMA1000
Medium, low and unrated 35
- CVE-2023-22745Buffer Overlow in TSS2_RC_Decode in tpm2-tsstpm2-software tpm2-tss
- CVE-2021-27782HCL BigFix Mobile / Modern Client Management Server passwords are susceptible to a brute-force attackHCL Software BigFix Mobile
- CVE-2022-39167IBM Spectrum Virtualize information disclosureIBM Spectrum Virtualize
- CVE-2022-40697WordPress 3com – Asesor de Cookies para normativa española Plugin <= 3.4.3 is vulnerable to Cross Site Scripting (XSS)3COM Marketing 3com – Asesor de Cookies para normativa espa…
- CVE-2023-0404Events Made Easy <= 2.3.16 - Missing Authorizationliedekef Events Made Easy
- CVE-2023-0403Social Warfare <= 4.3.1 - Cross-Site Request Forgerywarfareplugins Social Sharing Plugin – Social Warfare
- CVE-2023-0402Social Warfare <= 4.3.0 - Missing Authorizationwarfareplugins Social Sharing Plugin – Social Warfare
- CVE-2022-3738WAGO: Missing authentication for config export functionality in multiple productsSeries WAGO PFC100 · Series WAGO PFC200 +5
- CVE-2015-10071gitter-badger ezpublish-modern-legacy forgotpassword.php password recoverygitter-badger ezpublish-modern-legacy
- CVE-2014-125083Anant Labs google-enterprise-connector-dctm sql injectionAnant Labs google-enterprise-connector-dctm
- CVE-2015-10070copperwall Twiddit index.php sql injectioncopperwall Twiddit
- CVE-2013-10014oktora24 2moons sql injectionoktora24 2moons
- CVE-2022-4892MyCMS Visitors Module view.php build_view cross site scriptingMyCMS
- CVE-2017-20174bastianallgeier Kirby Webmentions Plugin injectionbastianallgeier Kirby Webmentions Plugin
- CVE-2015-10069viakondratiuk cash-machine machine.py update_failed_attempts sql injectionviakondratiuk cash-machine
- CVE-2023-20008A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary Cisco RoomOS Software · Cisco TelePresence Endpoint Software
- CVE-2023-20002A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass access controls and condCisco RoomOS Software · Cisco TelePresence Endpoint Software
- CVE-2023-20007A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Cisco Small Business RV Series Router Firmware
- CVE-2023-20045A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticateCisco Small Business RV Series Router Firmware
- CVE-2023-20058A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker tCisco Unified Contact Center Enterprise · Cisco Unified… +2
- CVE-2023-20019A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform, Cisco BroadWorks Application ServerCisco BroadWorks
- CVE-2023-20040A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause aCisco Network Services Orchestrator
- CVE-2023-20044A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges.Cisco CX Cloud Agent
- CVE-2023-20043A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges.Cisco CX Cloud Agent
- CVE-2023-20047A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an uCisco Webex Room Phone
- CVE-2023-20037A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (XCisco Industrial Network Director
- CVE-2023-20026A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers could allCisco Small Business RV Series Router Firmware
- CVE-2023-20057A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthenticCisco Email Security Appliance
- CVE-2022-31901Buffer overflow in function Notepad_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two craft
- CVE-2022-46888Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web scri
- CVE-2022-46889A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject
- CVE-2022-46890Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of
- CVE-2023-0396Buffer Overreads in Bluetooth HCIzephyrproject-rtos zephyr
- CVE-2023-0398Cross-Site Request Forgery (CSRF) in modoboa/modoboamodoboa/modoboa · modoboa
- CVE-2023-0406Cross-Site Request Forgery (CSRF) in modoboa/modoboamodoboa/modoboa · modoboa