# CVEs published 2023-01-19

56 CVEs were published on January 19, 2023: 12 critical, 9 high. Days are UTC.

- [CVE-2023-22745](https://cve.now/CVE-2023-22745.md): Buffer Overlow in TSS2\_RC\_Decode in tpm2-tss (CVSS 6.4, tpm2-software tpm2-tss)
- [CVE-2023-22741](https://cve.now/CVE-2023-22741.md): heap-over-flow in stun\_parse\_attribute in sofia-sip (CVSS 9.8, freeswitch sofia-sip)
- [CVE-2021-27782](https://cve.now/CVE-2021-27782.md): HCL BigFix Mobile / Modern Client Management Server passwords are susceptible to a brute-force attack (CVSS 5.4, HCL Software BigFix Mobile)
- [CVE-2022-47197](https://cve.now/CVE-2022-47197.md): An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. (CVSS 9.0, Ghost Foundation Ghost)
- [CVE-2022-47196](https://cve.now/CVE-2022-47196.md): An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. (CVSS 9.0, Ghost Foundation Ghost)
- [CVE-2022-47195](https://cve.now/CVE-2022-47195.md): An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. (CVSS 9.0, Ghost Foundation Ghost)
- [CVE-2022-47194](https://cve.now/CVE-2022-47194.md): An insecure default vulnerability exists in the Post Creation functionality of Ghost Foundation Ghost 5.9.4. (CVSS 9.0, Ghost Foundation Ghost)
- [CVE-2022-39167](https://cve.now/CVE-2022-39167.md): IBM Spectrum Virtualize information disclosure (CVSS 5.9, IBM Spectrum Virtualize)
- [CVE-2022-40697](https://cve.now/CVE-2022-40697.md): WordPress 3com – Asesor de Cookies para normativa española Plugin \<= 3.4.3 is vulnerable to Cross Site Scripting (XSS) (CVSS 4.8, 3COM Marketing 3com – Asesor de Cookies para normativa espa…)
- [CVE-2023-0404](https://cve.now/CVE-2023-0404.md): Events Made Easy \<= 2.3.16 - Missing Authorization (CVSS 5.4, liedekef Events Made Easy)
- [CVE-2023-0403](https://cve.now/CVE-2023-0403.md): Social Warfare \<= 4.3.1 - Cross-Site Request Forgery (CVSS 5.4, warfareplugins Social Sharing Plugin – Social Warfare)
- [CVE-2023-0402](https://cve.now/CVE-2023-0402.md): Social Warfare \<= 4.3.0 - Missing Authorization (CVSS 5.4, warfareplugins Social Sharing Plugin – Social Warfare)
- [CVE-2022-3738](https://cve.now/CVE-2022-3738.md): WAGO: Missing authentication for config export functionality in multiple products (CVSS 5.9, Series WAGO PFC100 · Series WAGO PFC200 +5)
- [CVE-2023-23690](https://cve.now/CVE-2023-23690.md): Cloud Mobility for Dell EMC Storage, versions 1.3.0.X and below contains an Improper Check for Certificate Revocation vulnerability. (CVSS 7.0, Cloud Mobility for Dell Storage)
- [CVE-2015-10071](https://cve.now/CVE-2015-10071.md): gitter-badger ezpublish-modern-legacy forgotpassword.php password recovery (CVSS 2.6, gitter-badger ezpublish-modern-legacy)
- [CVE-2014-125083](https://cve.now/CVE-2014-125083.md): Anant Labs google-enterprise-connector-dctm sql injection (CVSS 5.5, Anant Labs google-enterprise-connector-dctm)
- [CVE-2015-10070](https://cve.now/CVE-2015-10070.md): copperwall Twiddit index.php sql injection (CVSS 6.3, copperwall Twiddit)
- [CVE-2013-10014](https://cve.now/CVE-2013-10014.md): oktora24 2moons sql injection (CVSS 5.5, oktora24 2moons)
- [CVE-2022-4892](https://cve.now/CVE-2022-4892.md): MyCMS Visitors Module view.php build\_view cross site scripting (CVSS 3.5, MyCMS)
- [CVE-2017-20174](https://cve.now/CVE-2017-20174.md): bastianallgeier Kirby Webmentions Plugin injection (CVSS 5.6, bastianallgeier Kirby Webmentions Plugin)
- [CVE-2015-10069](https://cve.now/CVE-2015-10069.md): viakondratiuk cash-machine machine.py update\_failed\_attempts sql injection (CVSS 5.5, viakondratiuk cash-machine)
- [CVE-2023-20008](https://cve.now/CVE-2023-20008.md): A vulnerability in the CLI of Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to overwrite arbitrary (CVSS 4.4, Cisco RoomOS Software · Cisco TelePresence Endpoint Software)
- [CVE-2023-20002](https://cve.now/CVE-2023-20002.md): A vulnerability in Cisco TelePresence CE and RoomOS Software could allow an authenticated, local attacker to bypass access controls and cond (CVSS 4.4, Cisco RoomOS Software · Cisco TelePresence Endpoint Software)
- [CVE-2023-20007](https://cve.now/CVE-2023-20007.md): A vulnerability in the web-based management interface of Cisco Small Business RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers (CVSS 4.7, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20045](https://cve.now/CVE-2023-20045.md): A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticate (CVSS 4.9, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20058](https://cve.now/CVE-2023-20058.md): A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an unauthenticated, remote attacker t (CVSS 6.1, Cisco Unified Contact Center Enterprise · Cisco Unified… +2)
- [CVE-2023-20019](https://cve.now/CVE-2023-20019.md): A vulnerability in the web-based management interface of Cisco BroadWorks Application Delivery Platform, Cisco BroadWorks Application Server (CVSS 6.1, Cisco BroadWorks)
- [CVE-2023-20040](https://cve.now/CVE-2023-20040.md): A vulnerability in the NETCONF service of Cisco Network Services Orchestrator (NSO) could allow an authenticated, remote attacker to cause a (CVSS 5.5, Cisco Network Services Orchestrator)
- [CVE-2023-20044](https://cve.now/CVE-2023-20044.md): A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. (CVSS 6.7, Cisco CX Cloud Agent)
- [CVE-2023-20043](https://cve.now/CVE-2023-20043.md): A vulnerability in Cisco CX Cloud Agent of could allow an authenticated, local attacker to elevate their privileges. (CVSS 6.7, Cisco CX Cloud Agent)
- [CVE-2023-20047](https://cve.now/CVE-2023-20047.md): A vulnerability in the Link Layer Discovery Protocol (LLDP) feature of Cisco Webex Room Phone and Cisco Webex Share devices could allow an u (CVSS 6.5, Cisco Webex Room Phone)
- [CVE-2023-20018](https://cve.now/CVE-2023-20018.md): A vulnerability in the web-based management interface of Cisco IP Phone 7800 and 8800 Series Phones could allow an unauthenticated, remote a (CVSS 8.6, Cisco Session Initiation Protocol (SIP) Software)
- [CVE-2023-20020](https://cve.now/CVE-2023-20020.md): A vulnerability in the Device Management Servlet application of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended (CVSS 8.6, Cisco BroadWorks)
- [CVE-2023-20038](https://cve.now/CVE-2023-20038.md): A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a (CVSS 8.8, Cisco Industrial Network Director)
- [CVE-2023-20037](https://cve.now/CVE-2023-20037.md): A vulnerability in Cisco Industrial Network Director could allow an authenticated, remote attacker to conduct stored cross-site scripting (X (CVSS 5.4, Cisco Industrial Network Director)
- [CVE-2023-20025](https://cve.now/CVE-2023-20025.md): A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, and RV082 Routers could allow an unauthe (CVSS 9.0, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20026](https://cve.now/CVE-2023-20026.md): A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers could all (CVSS 6.5, Cisco Small Business RV Series Router Firmware)
- [CVE-2023-20057](https://cve.now/CVE-2023-20057.md): A vulnerability in the URL filtering mechanism of Cisco AsyncOS Software for Cisco Email Security Appliance (ESA) could allow an unauthentic (CVSS 0.0, Cisco Email Security Appliance)
- [CVE-2023-20010](https://cve.now/CVE-2023-20010.md): A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications (CVSS 8.1, Cisco Unified Communications Manager)
- [CVE-2021-37774](https://cve.now/CVE-2021-37774.md): An issue was discovered in function httpProcDataSrv in TL-WDR7660 2.0.30 that allows attackers to execute arbitrary code. (CVSS 8.0)
- [CVE-2022-31901](https://cve.now/CVE-2022-31901.md): Buffer overflow in function Notepad\_plus::addHotSpot in Notepad++ v8.4.3 and earlier allows attackers to crash the application via two craft (CVSS 6.5)
- [CVE-2022-3806](https://cve.now/CVE-2022-3806.md): Bluetooth HCI Error Handling Double Free (CVSS 9.8, zephyrproject-rtos zephyr)
- [CVE-2022-46476](https://cve.now/CVE-2022-46476.md): D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi\_main function. (CVSS 9.8)
- [CVE-2022-46887](https://cve.now/CVE-2022-46887.md): Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser\[\] (CVSS 9.8)
- [CVE-2022-46888](https://cve.now/CVE-2022-46888.md): Multiple reflective cross-site scripting (XSS) vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to inject arbitrary web scri (CVSS 6.1)
- [CVE-2022-46889](https://cve.now/CVE-2022-46889.md): A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject (CVSS 5.4)
- [CVE-2022-46890](https://cve.now/CVE-2022-46890.md): Weak access control in NexusPHP before 1.7.33 allows a remote authenticated user to edit any post in the forum (this is caused by a lack of (CVSS 4.3)
- [CVE-2022-47105](https://cve.now/CVE-2022-47105.md): Jeecg-boot v3.4.4 was discovered to contain a SQL injection vulnerability via the component /sys/dict/queryTableData. (CVSS 9.8, org.jeecgframework.boot:jeecg-boot-base-core · org.jeecgfra…)
- [CVE-2022-47740](https://cve.now/CVE-2022-47740.md): Seltmann GmbH Content Management System 6 is vulnerable to SQL Injection via /index.php. (CVSS 9.8)
- [CVE-2022-47745](https://cve.now/CVE-2022-47745.md): ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. (CVSS 8.8)
- [CVE-2022-47766](https://cve.now/CVE-2022-47766.md): PopojiCMS v2.0.1 backend plugin function has a file upload vulnerability. (CVSS 8.8)
- [CVE-2023-0126](https://cve.now/CVE-2023-0126.md): Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbit (CVSS 7.5, SonicWall SMA1000)
- [CVE-2023-0396](https://cve.now/CVE-2023-0396.md): Buffer Overreads in Bluetooth HCI (CVSS 6.8, zephyrproject-rtos zephyr)
- [CVE-2023-0397](https://cve.now/CVE-2023-0397.md): DoS: Invalid Initialization in le\_read\_buffer\_size\_complete (CVSS 9.6, zephyrproject-rtos zephyr)
- [CVE-2023-0398](https://cve.now/CVE-2023-0398.md): Cross-Site Request Forgery (CSRF) in modoboa/modoboa (CVSS 5.4, modoboa/modoboa · modoboa)
- [CVE-2023-0406](https://cve.now/CVE-2023-0406.md): Cross-Site Request Forgery (CSRF) in modoboa/modoboa (CVSS 5.4, modoboa/modoboa · modoboa)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.