CVEs published January 20, 2023
94 CVEs were published on January 20, 2023: 21 critical, 33 high.
- Published
- 94
- Critical
- 21
- High
- 33
- Medium
- 40
- Low
- 0
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 15
Most affected products
- Contec Co. CONPROSYS HMI System
- 4
- byacc
- 2
- IBM Cloud Pak for Security
- 2
- redis
- 2
- SolarWinds Database Performance Analyzer
- 2
- builderio/qwik · @builder.io/qwik
- 1
- Dell PowerVault ME5
- 1
- Easy Digital Downloads WordPress Plugin
- 1
- electerm
- 1
- erohtar Dasherr
- 1
Critical 21
- CVE-2023-0052SAUTER Controls Nova 200–220 Series Missing Authentication for Critical FunctionSAUTER Controls Nova 220 (EYK220F001) DDC with BACnet co… +2
- CVE-2023-23607Unrestricted file upload leads to Remote Code Execution in erohtar/Dasherrerohtar Dasherr
- CVE-2020-21152SQL Injection vulnerability in inxedu 2.0.6 allows attackers to execute arbitrary commands via the functionIds parameter to /saverolefunctio
- CVE-2020-22653In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus
- CVE-2020-22654In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus
- CVE-2020-22657In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus
- CVE-2020-22658In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus
- CVE-2020-23256An issue was discovered in Electerm 1.3.22, allows attackers to execute arbitrary code via unverified request to electerms service.electerm
- CVE-2020-29297Multiple SQL Injection vulnerabilities in tourist5 Online-food-ordering-system 1.0.
- CVE-2022-48120SQL Injection vulnerability in kishan0725 Hospital Management System thru commit 4770d740f2512693ef8fd9aa10a8d17f79fad9bd (on March 13, 2021
- CVE-2022-48121TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/
- CVE-2022-48122TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting
- CVE-2022-48123TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setti
- CVE-2022-48124TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting
- CVE-2022-48125TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting
- CVE-2022-48126TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting
- CVE-2022-48152SQL Injection vulnerability in RemoteClinic 2.0 allows attackers to execute arbitrary commands and gain sensitive information via the id par
- CVE-2023-22964Zoho ManageEngine ServiceDesk Plus MSP before 10611, and 13x before 13004, is vulnerable to authentication bypass when LDAP authentication i
- CVE-2023-23488The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' paraPaid Memberships Pro WordPress Plugin
- CVE-2023-23489The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in thEasy Digital Downloads WordPress Plugin
- CVE-2023-24028In MISP 2.4.167, app/Controller/Component/ACLComponent.php has incorrect access control for the decaying import function.
High 33
- CVE-2023-22726Unrestricted file upload leading to privilege escalation in actnektos act · github.com/nektos/act
- CVE-2023-23691 Dell EMC PV ME5, versions ME5.1.0.0.0 and ME5.1.0.1.0, contains a Client-side desync Vulnerability.Dell PowerVault ME5
- CVE-2020-22655In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus
- CVE-2020-22656In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus
- CVE-2020-22659In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus
- CVE-2020-22660In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus
- CVE-2020-22662In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus
- CVE-2020-25502Cybereason EDR version 19.1.282 and above, 19.2.182 and above, 20.1.343 and above, and 20.2.X and above has a DLL hijacking vulnerability, w
- CVE-2021-26642XpressEngine file upload vulnerabilityXEHub XE3 XpresesEngine · xpressengine/xpressengine
- CVE-2021-26644SQL-Injection vulnerability caused by the lack of verification of input values for the table name of DB used by the Mangboard bulletin boardHometory Mangboard WP BASIC
- CVE-2021-29368Session fixation vulnerability in CuppaCMS thru commit 4c9b742b23b924cf4c1f943f48b278e06a17e297 on November 12, 2019 allows attackers to gai
- CVE-2021-33641When processing files, malloc stores the data of the current line.byacc
- CVE-2021-37500Directory traversal vulnerability in Reprise License Manager (RLM) web interface before 14.2BL4 in the diagnostics function that allows RLM
- CVE-2022-25631Symantec Endpoint Protection, prior to 14.3 RU6 (14.3.9210.6000), may be susceptible to a Elevation of Privilege vulnerability, which is a tSymantec Endpoint Protection
- CVE-2022-38112Sensitive Information Disclosure VulnerabilitySolarWinds Database Performance Analyzer
- CVE-2022-3918A program using FoundationNetworking in swift-corelibs-foundation is potentially vulnerable to CRLF ( ) injection in URLRequest headers.Swift Project Swift Foundation
- CVE-2022-45748An issue was discovered with assimp 5.1.4, a use after free occurred in function ColladaParser::ExtractDataObjectFromChannel in file /code/A
- CVE-2022-47012Use of uninitialized variable in function gen_eth_recv in GNS3 dynamips 0.2.21.
- CVE-2022-47021A null pointer dereference issue was discovered in functions op_get_data and op_open1 in opusfile.c in xiph opusfile 0.9 thru 0.12 allows at
- CVE-2022-47024A null pointer dereference issue was discovered in function gui_x11_create_blank_mouse in gui_x11.c in vim 8.1.2269 thru 9.0.0339 allows att
- CVE-2022-47732In Yeastar N412 and N824 Configuration Panel 42.x and 45.x, an unauthenticated attacker can create backup file and download it, revealing ad
- CVE-2022-47747kraken <= 0.1.4 has an arbitrary file read vulnerability via the component testfs.github.com/uber/kraken
- CVE-2022-48279In ModSecurity before 2.9.6 and 3.x before 3.0.8, HTTP multipart requests were incorrectly parsed and could bypass the Web Application Firew
- CVE-2023-0101A privilege escalation vulnerability was identified in Nessus versions 8.10.1 through 8.15.8 and 10.0.0 through 10.4.1.Nessus
- CVE-2023-22331Use of default credentials vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to altContec Co. CONPROSYS HMI System
- CVE-2023-22339Improper access control vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote unauthenticated attacker to bypassContec Co. CONPROSYS HMI System
- CVE-2023-23143Buffer overflow vulnerability in function avc_parse_slice in file media_tools/av_parsers.c.
- CVE-2023-23145GPAC version 2.2-rev0-gab012bbfb-master was discovered to contain a memory leak in lsr_read_rare_full function.
- CVE-2023-23490The Survey Maker WordPress Plugin, version < 3.1.2, is affected by an authenticated SQL injection vulnerability in the 'surveys_ids' parametSurvey Maker WordPress Plugin
- CVE-2023-23492The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' paramLogin with Phone Number WordPress Plugin
- CVE-2023-23596jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection.
- CVE-2023-24021Incorrect handling of '\0' bytes in file uploads in ModSecurity before 2.9.7 may allow for Web Application Firewall bypasses and buffer over
- CVE-2023-24025CRYSTALS-DILITHIUM (in Post-Quantum Cryptography Selected Algorithms 2022) in PQClean d03da30 may allow universal forgeries of digital signa
Medium, low and unrated 40
- CVE-2023-22742libgit2 fails to verify SSH keys by defaultlibgit2 · libgit2-sys +1
- CVE-2022-1109An incorrect default permissions vulnerability in Lenovo Leyun cloud music application could allow denial of service.Lenovo Leyun
- CVE-2022-41733IBM InfoSphere Information Server denial of serviceIBM InfoSphere Information Server
- CVE-2022-35977Integer overflow in certain command arguments can drive Redis to OOM panicredis
- CVE-2023-22458Integer overflow in multiple Redis commands can lead to denial-of-serviceredis
- CVE-2021-39089IBM Cloud Pak for Security information disclosureIBM Cloud Pak for Security
- CVE-2021-39011IBM Cloud Pak for Security information disclosureIBM Cloud Pak for Security
- CVE-2022-40267Authentication Bypass Vulnerability in Web Server Function on MELSEC SeriesMitsubishi Electric MELSEC iQ-F Series FX5U-32MT/ES · M… +65
- CVE-2020-22661In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus
- CVE-2021-33642When a file is processed, an infinite loop occurs in next_inline() of the more_curly() function.byacc
- CVE-2021-37498An SSRF issue was discovered in Reprise License Manager (RLM) web interface through 14.2BL4 that allows remote attackers to trigger outbound
- CVE-2021-37499CRLF vulnerability in Reprise License Manager (RLM) web interface through 14.2BL4 in the password parameter in View License Result function,
- CVE-2022-38110Reflected Cross-Site Scripting VulnerabilitySolarWinds Database Performance Analyzer
- CVE-2022-39193An issue was discovered in the CheckUser extension for MediaWiki through 1.39.x.
- CVE-2022-41441Multiple cross-site scripting (XSS) vulnerabilities in ReQlogic v11.3 allow attackers to execute arbitrary web scripts or HTML via a crafted
- CVE-2022-43704The Sinilink XY-WFT1 WiFi Remote Thermostat, running firmware 1.3.6, allows an attacker to bypass the intended requirement to communicate us
- CVE-2022-43959Insufficiently Protected Credentials in the AD/LDAP server settings in 1C-Bitrix Bitrix24 through 22.200.200 allow remote administrators to
- CVE-2022-45537EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_LIST_URL".
- CVE-2022-45538EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article publish component in cookie "ENV_GOBACK_URL".
- CVE-2022-45539EyouCMS <= 1.6.0 was discovered a reflected-XSS in FileManager component in GET value "activepath" when creating a new file.
- CVE-2022-45540EyouCMS <= 1.6.0 was discovered a reflected-XSS in article type editor component in POST value "name" if the value contains a malformed UTF-
- CVE-2022-45541EyouCMS <= 1.6.0 was discovered a reflected-XSS in the article attribute editor component in POST value "value" if the value contains a non-
- CVE-2022-45542EyouCMS <= 1.6.0 was discovered a reflected-XSS in the FileManager component in GET parameter "filename" when editing any file.
- CVE-2022-45557Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via file names.
- CVE-2022-45558Cross site scripting (XSS) vulnerability in Hundredrabbits Left 7.1.5 for MacOS allows attackers to execute arbitrary code via the meta tag.
- CVE-2022-47015MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to Denial of Service.
- CVE-2023-0410Cross-site Scripting (XSS) - Generic in builderio/qwikbuilderio/qwik · @builder.io/qwik
- CVE-2023-22334Use of password hash instead of password for authentication vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remotContec Co. CONPROSYS HMI System
- CVE-2023-22373Cross-site scripting vulnerability in CONPROSYS HMI System (CHS) Ver.3.4.5 and earlier allows a remote authenticated attacker to inject an aContec Co. CONPROSYS HMI System
- CVE-2023-22910An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1.
- CVE-2023-22912An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1.
- CVE-2023-23010Cross Site Scripting (XSS) vulnerability in Ecommerce-CodeIgniter-Bootstrap thru commit d5904379ca55014c5df34c67deda982c73dc7fe5 (on Dec 27,
- CVE-2023-23012Cross Site Scripting (XSS) vulnerability in craigrodway classroombookings 2.6.4 allows attackers to execute arbitrary code or other unspecif
- CVE-2023-23014Cross Site Scripting (XSS) vulnerability in InventorySystem thru commit e08fbbe17902146313501ed0b5feba81d58f455c (on Apr 23, 2021) via edit_
- CVE-2023-23015Cross Site Scripting (XSS) vulnerability in Kalkun 0.8.0 via username input in file User_model.php.
- CVE-2023-23024Book Store Management System v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability in /bsms_ci/index.php/book.
- CVE-2023-23144Integer overflow vulnerability in function Q_DecCoordOnUnitSphere file bifs/unquantize.c in GPAC version 2.2-rev0-gab012bbfb-master.
- CVE-2023-23491The Quick Event Manager WordPress Plugin, version < 9.7.5, is affected by a reflected cross-site scripting vulnerability in the 'category' pQuick Event Manager WordPress Plugin
- CVE-2023-24026In MISP 2.4.167, app/webroot/js/event-graph.js has an XSS vulnerability via an event-graph preview payload.
- CVE-2023-24027In MISP 2.4.167, app/webroot/js/action_table.js allows XSS via a network history name.