CVEs published January 23, 2023
94 CVEs were published on January 23, 2023: 6 critical, 25 high.
- Published
- 94
- Critical
- 6
- High
- 25
- Medium
- 56
- Low
- 2
- Unrated
- 5
- Now in CISA KEV
- 0
- Fix available
- 52
Most affected products
- Lenovo BIOS
- 5
- Microsoft Edge
- 3
- Analyticator
- 2
- github cmark-gfm
- 2
- Passster
- 2
- urkekg My YouTube Channel
- 2
- 10WebMapBuilder
- 1
- Alexei Isaenko Oi Yandex.Maps for WordPress
- 1
- All-In-One Security
- 1
- Bob Goetz WP-TopBar
- 1
Critical 6
- CVE-2022-0316Multiple themes - Unauthenticated Arbitrary File UploadWeStand · footysquare +8
- CVE-2022-4305Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to AdminLogin as User or Customer
- CVE-2022-4693User Verification < 1.0.94 - Authentication Bypass User Verification
- CVE-2022-4383CBX Petition for WordPress <= 1.0.3 - Unauthenticated SQLiCBX Petition for WordPress
- CVE-2021-43445ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.
- CVE-2023-23560In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.
High 25
- CVE-2022-4017Booster for WooCommerce - Multiple CSRFBooster for WooCommerce · Booster Plus for WooCommerce +1
- CVE-2022-4303WP Limit Login Attempts <= 2.6.4 - IP SpoofingWP Limit Login Attempts
- CVE-2022-4323Google Analyticator < 6.5.6 - Admin+ PHP Object InjectionAnalyticator
- CVE-2022-3425Google Analyticator < 6.5.6 - Admin+ PHP Object InjectionAnalyticator
- CVE-2022-4230WP Statistics < 13.2.9 - Authenticated SQLiWP Statistics
- CVE-2022-4746FluentAuth < 1.0.2 - Bypass blocks by IP SpoofingFluentAuth
- CVE-2021-24881Passster < 3.5.5.9 - Protection Bypass & Arbitrary Post AccessPassster
- CVE-2021-43444ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.
- CVE-2021-43447ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control.
- CVE-2021-43449ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF).
- CVE-2022-23005Host Boot ROM Code Vulnerability in Systems Implementing UFS Boot Feature
- CVE-2022-37718The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability.
- CVE-2022-37719A Cross-Site Request Forgery (CSRF) in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escalate privileges and exe
- CVE-2022-38725An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service vi
- CVE-2022-46639A vulnerability in the descarga_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal.
- CVE-2022-47065TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url
- CVE-2023-21775Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityMicrosoft Edge
- CVE-2023-21795Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge
- CVE-2023-21796Microsoft Edge (Chromium-based) Elevation of Privilege VulnerabilityMicrosoft Edge (Chromium-based) Extended Stable
- CVE-2023-22960Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency.
- CVE-2023-23314An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrary code via a crafted
- CVE-2023-24068Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noinde
- CVE-2023-24096TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the newpass par
- CVE-2023-24097TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url
- CVE-2023-24098TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url
Medium, low and unrated 63
- CVE-2023-22484Inefficient Quadratic complexity bug in handle_pointy_brace may lead to a denial of servicegithub cmark-gfm
- CVE-2023-22483cmark-gfm Quadratic complexity bugs may lead to a denial of servicegithub cmark-gfm
- CVE-2023-23824WordPress WP TopBar Plugin <= 5.36 is vulnerable to SQL InjectionBob Goetz WP-TopBar
- CVE-2023-23687WordPress Youtube shortcode Plugin <= 1.8.5 is vulnerable to Cross Site Scripting (XSS)Túbal Martín Youtube shortcode
- CVE-2023-22721WordPress Oi Yandex.Maps for WordPress Plugin <= 3.2.7 is vulnerable to Cross Site Scripting (XSS)Alexei Isaenko Oi Yandex.Maps for WordPress
- CVE-2022-4816A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application.Lenovo Safecenter
- CVE-2023-0447My YouTube Channel <= 3.0.12.1 - Missing Authorizationurkekg My YouTube Channel
- CVE-2022-3432A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may alLenovo BIOS
- CVE-2023-0446My YouTube Channel <= 3.0.12.1 - Authenticated (Administrator+) Stored Cross-Site Scriptingurkekg My YouTube Channel
- CVE-2022-3430A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges toLenovo BIOS
- CVE-2022-1892A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to executeLenovo BIOS
- CVE-2022-1891A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to executeLenovo BIOS
- CVE-2022-1890A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitraLenovo BIOS
- CVE-2022-4775GeoDirectory < 2.2.22 - Contributor+ Stored XSS via ShortcodeGeoDirectory
- CVE-2022-4718Landing Page Builder < 1.4.9.9 - Contributor+ Cross-Site Scripting via ShortcodeLanding Page Builder
- CVE-2021-24837Passster < 3.5.5.8 - Contributor+ Stored Cross-Site ScriptingPassster
- CVE-2022-4542Compact WP Audio Player < 1.9.8 - Contributor+ Stored XSSCompact WP Audio Player
- CVE-2022-4485Page-list < 5.3 - Contributor+ Stored XSSPage-list
- CVE-2022-4715Structured Content < 1.5.1 - Contributor+ Stored XSS in ShortcodeStructured Content (JSON-LD) #wpsc
- CVE-2022-4650HashBar – WordPress Notification Bar < 1.3.6 - Contributor+ Stored XSS via ShortcodeHashBar
- CVE-2022-475810WebMapBuilder < 1.0.72 - Contributor+ Stored XSS via Shortcode10WebMapBuilder
- CVE-2022-4467Search & Filter < 1.2.16 - Contributor+ Stored XSSSearch & Filter
- CVE-2022-4627ShiftNav – Responsive Mobile Menu < 1.7.2 - Contributor+ Stored XSS in ShortcodeShiftNav
- CVE-2022-4790WP Google My Business Auto Publish < 3.4 - Contributor+ Stored XSS via ShortcodeWP Google My Business Auto Publish
- CVE-2022-4753Print-O-Matic < 2.1.8 - Contributor+ Stored XSS via ShortcodePrint-O-Matic
- CVE-2022-4548Optimize images ALT Text (alt tag) & names for SEO using AI < 2.0.8 - Settings Update via CSRFOptimize images ALT Text (alt tag) & names for SEO using AI
- CVE-2022-4509Content Control < 1.1.10 - Contributor+ Stored XSSContent Control
- CVE-2022-4545Sitemap < 4.4 - Contributor+ Stored XSSSitemap
- CVE-2022-4706Genesis Columns Advanced < 2.0.4 - Contributor+ Stored XSS via ShortcodeGenesis Columns Advanced
- CVE-2022-4751Word Balloon < 4.19.3 - Contributor+ Stored XSS via ShortcodeWord Balloon
- CVE-2022-3811EU Cookie Law <= 3.1.6 - Admin+ Stored XSSEU Cookie Law for GDPR/CCPA
- CVE-2022-4474Easy Social Feed – Social Photos Gallery – Post Feed – Like Box < 6.4.0 - Contributor+ Stored XSSEasy Social Feed
- CVE-2022-4570Top 10 < 3.2.3 - Contributor+ Stored XSSTop
- CVE-2022-4675Mongoose Page Plugin < 1.9.0 - Contributor+ Stored XSS via ShortcodeMongoose Page Plugin
- CVE-2022-4789WPZOOM Portfolio < 1.2.2 - Contributor+ Stored XSS via ShortcodeWPZOOM Portfolio
- CVE-2022-4475Collapse-O-Matic < 1.8.3 - Contributor+ Stored XSSCollapse-O-Matic
- CVE-2022-4443BruteBank - WP Security & Firewall < 1.9 - Settings Update via CSRFBruteBank
- CVE-2022-4576Easy Bootstrap Shortcode <= 4.5.4 - Contributor+ Stored XSSEasy Bootstrap Shortcode
- CVE-2022-4624GS Logo Slider < 3.3.8 - Contributor+ Stored XSS in ShortcodeGS Logo Slider
- CVE-2022-4673Rate my Post – WP Rating System < 3.3.9 - Contributor+ Stored XSS via ShortcodeRate my Post
- CVE-2022-4307Pardakht Delkhah < 2.9.3 - Unauthenticated Stored XSSپلاگین پرداخت دلخواه
- CVE-2022-4346All In One WP Security & Firewall < 5.1.3 - Configuration LeakAll-In-One Security
- CVE-2022-4716WP Popups < 2.1.4.8 - Contributor+ Stored XSSWP Popups
- CVE-2022-4668Easy Appointments < 3.11.2 - Contributor+ Stored XSS in ShortcodeEasy Appointments
- CVE-2022-4629Product Slider for WooCommerce < 2.6.4 - Contributor+ Stored XSS in ShortcodeProduct Slider for WooCommerce
- CVE-2022-4672WordPress Simple Shopping Cart < 4.6.2 - Contributor+ Stored XSS via ShortcodeWordPress Simple Shopping Cart
- CVE-2022-4760OneClick Chat to Order < 1.0.4.2 - Contributor+ Stored XSS via ShortcodeOneClick Chat to Order
- CVE-2022-4625Login Logout Menu < 1.4.0 - Contributor+ Stored XSS in ShortcodeLogin Logout Menu
- CVE-2022-4832Store Locator WordPress < 1.4.9 - Contributor+ Stored XSS via ShortcodeStore Locator WordPress
- CVE-2021-43446ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS).
- CVE-2021-43448ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation.
- CVE-2022-40034Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' para
- CVE-2022-41505An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UAR
- CVE-2022-46959An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal.github.com/go-sonic/sonic
- CVE-2022-48281processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a cra
- CVE-2023-0438Cross-Site Request Forgery (CSRF) in modoboa/modoboamodoboa/modoboa · modoboa
- CVE-2023-0440Observable Discrepancy in healthchecks/healthcheckshealthchecks/healthchecks
- CVE-2023-21719Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityMicrosoft Edge
- CVE-2023-22630IzyBat Orange casiers before 20221102_1 allows SQL Injection via a getCasier.php?taille= URI.
- CVE-2023-24069Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages fro
- CVE-2023-24070app/View/AuthKeys/authkey_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field.
- CVE-2023-24095TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url
- CVE-2023-24099TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the username pa