# CVEs published 2023-01-21

8 CVEs were published on January 21, 2023: 1 critical, 6 high. Days are UTC.

- [CVE-2023-22884](https://cve.now/CVE-2023-22884.md): Apache Airflow, Apache Airflow MySQL Provider: Arbitrary file read via MySQL provider in Apache Airflow (CVSS 9.8, Apache Software Foundation Apache Airflow · apache-airfl… +1)
- [CVE-2020-36655](https://cve.now/CVE-2020-36655.md): Yii Yii2 Gii before 2.2.2 allows remote attackers to execute arbitrary code via the Generator.php messageCategory field. (CVSS 8.8, yiisoft/yii2-gii)
- [CVE-2023-0433](https://cve.now/CVE-2023-0433.md): Heap-based Buffer Overflow in vim/vim (CVSS 7.8, vim/vim)
- [CVE-2023-22617](https://cve.now/CVE-2023-22617.md): A remote attacker might be able to cause infinite recursion in PowerDNS Recursor 4.8.0 via a DNS query that retrieves DS records for a misco (CVSS 7.5)
- [CVE-2023-24038](https://cve.now/CVE-2023-24038.md): The HTML-StripScripts module through 1.06 for Perl allows \_hss\_attval\_style ReDoS because of catastrophic backtracking for HTML content with (CVSS 7.5)
- [CVE-2023-24039](https://cve.now/CVE-2023-24039.md): A stack-based buffer overflow in ParseColors in libXm in Common Desktop Environment 1.6 can be exploited by local low-privileged users via t (CVSS 7.8)
- [CVE-2023-24040](https://cve.now/CVE-2023-24040.md): dtprintinfo in Common Desktop Environment 1.6 has a bug in the parser of lpstat (an invoked external command) during listing of the names of (no CVSS)
- [CVE-2023-24042](https://cve.now/CVE-2023-24042.md): A race condition in LightFTP through 2.2 allows an attacker to achieve path traversal via a malformed FTP request. (CVSS 7.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-21
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.