# CVEs published 2023-01-23

94 CVEs were published on January 23, 2023: 6 critical, 25 high. Days are UTC.

- [CVE-2023-22484](https://cve.now/CVE-2023-22484.md): Inefficient Quadratic complexity bug in handle\_pointy\_brace may lead to a denial of service (CVSS 3.5, github cmark-gfm)
- [CVE-2023-22483](https://cve.now/CVE-2023-22483.md): cmark-gfm Quadratic complexity bugs may lead to a denial of service (CVSS 3.5, github cmark-gfm)
- [CVE-2023-23824](https://cve.now/CVE-2023-23824.md): WordPress WP TopBar Plugin \<= 5.36 is vulnerable to SQL Injection (CVSS 6.7, Bob Goetz WP-TopBar)
- [CVE-2023-23687](https://cve.now/CVE-2023-23687.md): WordPress Youtube shortcode Plugin \<= 1.8.5 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Túbal Martín Youtube shortcode)
- [CVE-2023-22721](https://cve.now/CVE-2023-22721.md): WordPress Oi Yandex.Maps for WordPress Plugin \<= 3.2.7 is vulnerable to Cross Site Scripting (XSS) (CVSS 6.5, Alexei Isaenko Oi Yandex.Maps for WordPress)
- [CVE-2022-4816](https://cve.now/CVE-2022-4816.md): A denial-of-service vulnerability has been identified in Lenovo Safecenter that could allow a local user to crash the application. (CVSS 6.2, Lenovo Safecenter)
- [CVE-2023-0447](https://cve.now/CVE-2023-0447.md): My YouTube Channel \<= 3.0.12.1 - Missing Authorization (CVSS 4.3, urkekg My YouTube Channel)
- [CVE-2022-3432](https://cve.now/CVE-2022-3432.md): A potential vulnerability in a driver used during manufacturing process on the Ideapad Y700-14ISK that was mistakenly not deactivated may al (CVSS 6.7, Lenovo BIOS)
- [CVE-2023-0446](https://cve.now/CVE-2023-0446.md): My YouTube Channel \<= 3.0.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5, urkekg My YouTube Channel)
- [CVE-2022-3430](https://cve.now/CVE-2022-3430.md): A potential vulnerability in the WMI Setup driver on some consumer Lenovo Notebook devices may allow an attacker with elevated privileges to (CVSS 6.7, Lenovo BIOS)
- [CVE-2022-1892](https://cve.now/CVE-2022-1892.md): A buffer overflow in the SystemBootManagerDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute (CVSS 6.7, Lenovo BIOS)
- [CVE-2022-1891](https://cve.now/CVE-2022-1891.md): A buffer overflow in the SystemLoadDefaultDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute (CVSS 6.7, Lenovo BIOS)
- [CVE-2022-1890](https://cve.now/CVE-2022-1890.md): A buffer overflow in the ReadyBootDxe driver in some Lenovo Notebook products may allow an attacker with local privileges to execute arbitra (CVSS 6.7, Lenovo BIOS)
- [CVE-2022-0316](https://cve.now/CVE-2022-0316.md): Multiple themes - Unauthenticated Arbitrary File Upload (CVSS 9.8, WeStand · footysquare +8)
- [CVE-2022-4775](https://cve.now/CVE-2022-4775.md): GeoDirectory \< 2.2.22 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, GeoDirectory)
- [CVE-2022-4718](https://cve.now/CVE-2022-4718.md): Landing Page Builder \< 1.4.9.9 - Contributor+ Cross-Site Scripting via Shortcode (CVSS 5.4, Landing Page Builder)
- [CVE-2021-24837](https://cve.now/CVE-2021-24837.md): Passster \< 3.5.5.8 - Contributor+ Stored Cross-Site Scripting (no CVSS, Passster)
- [CVE-2022-4542](https://cve.now/CVE-2022-4542.md): Compact WP Audio Player \< 1.9.8 - Contributor+ Stored XSS (CVSS 5.4, Compact WP Audio Player)
- [CVE-2022-4485](https://cve.now/CVE-2022-4485.md): Page-list \< 5.3 - Contributor+ Stored XSS (CVSS 5.4, Page-list)
- [CVE-2022-4305](https://cve.now/CVE-2022-4305.md): Login as User or Customer \< 3.3 - Unauthenticated Privilege Escalation to Admin (CVSS 9.8, Login as User or Customer)
- [CVE-2022-4715](https://cve.now/CVE-2022-4715.md): Structured Content \< 1.5.1 - Contributor+ Stored XSS in Shortcode (CVSS 5.4, Structured Content (JSON-LD) #wpsc)
- [CVE-2022-4650](https://cve.now/CVE-2022-4650.md): HashBar – WordPress Notification Bar \< 1.3.6 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, HashBar)
- [CVE-2022-4017](https://cve.now/CVE-2022-4017.md): Booster for WooCommerce - Multiple CSRF (CVSS 8.8, Booster for WooCommerce · Booster Plus for WooCommerce +1)
- [CVE-2022-4693](https://cve.now/CVE-2022-4693.md): User Verification \< 1.0.94 - Authentication Bypass (CVSS 9.8, User Verification)
- [CVE-2022-4758](https://cve.now/CVE-2022-4758.md): 10WebMapBuilder \< 1.0.72 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, 10WebMapBuilder)
- [CVE-2022-4467](https://cve.now/CVE-2022-4467.md): Search & Filter \< 1.2.16 - Contributor+ Stored XSS (CVSS 5.4, Search & Filter)
- [CVE-2022-4627](https://cve.now/CVE-2022-4627.md): ShiftNav – Responsive Mobile Menu \< 1.7.2 - Contributor+ Stored XSS in Shortcode (CVSS 5.4, ShiftNav)
- [CVE-2022-4790](https://cve.now/CVE-2022-4790.md): WP Google My Business Auto Publish \< 3.4 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, WP Google My Business Auto Publish)
- [CVE-2022-4303](https://cve.now/CVE-2022-4303.md): WP Limit Login Attempts \<= 2.6.4 - IP Spoofing (CVSS 7.5, WP Limit Login Attempts)
- [CVE-2022-4753](https://cve.now/CVE-2022-4753.md): Print-O-Matic \< 2.1.8 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Print-O-Matic)
- [CVE-2022-4323](https://cve.now/CVE-2022-4323.md): Google Analyticator \< 6.5.6 - Admin+ PHP Object Injection (CVSS 7.2, Analyticator)
- [CVE-2022-4548](https://cve.now/CVE-2022-4548.md): Optimize images ALT Text (alt tag) & names for SEO using AI \< 2.0.8 - Settings Update via CSRF (CVSS 6.5, Optimize images ALT Text (alt tag) & names for SEO using AI)
- [CVE-2022-4509](https://cve.now/CVE-2022-4509.md): Content Control \< 1.1.10 - Contributor+ Stored XSS (CVSS 5.4, Content Control)
- [CVE-2022-3425](https://cve.now/CVE-2022-3425.md): Google Analyticator \< 6.5.6 - Admin+ PHP Object Injection (CVSS 7.2, Analyticator)
- [CVE-2022-4230](https://cve.now/CVE-2022-4230.md): WP Statistics \< 13.2.9 - Authenticated SQLi (CVSS 8.8, WP Statistics)
- [CVE-2022-4545](https://cve.now/CVE-2022-4545.md): Sitemap \< 4.4 - Contributor+ Stored XSS (CVSS 5.4, Sitemap)
- [CVE-2022-4706](https://cve.now/CVE-2022-4706.md): Genesis Columns Advanced \< 2.0.4 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Genesis Columns Advanced)
- [CVE-2022-4751](https://cve.now/CVE-2022-4751.md): Word Balloon \< 4.19.3 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Word Balloon)
- [CVE-2022-4383](https://cve.now/CVE-2022-4383.md): CBX Petition for WordPress \<= 1.0.3 - Unauthenticated SQLi (CVSS 9.8, CBX Petition for WordPress)
- [CVE-2022-3811](https://cve.now/CVE-2022-3811.md): EU Cookie Law \<= 3.1.6 - Admin+ Stored XSS (CVSS 4.8, EU Cookie Law for GDPR/CCPA)
- [CVE-2022-4474](https://cve.now/CVE-2022-4474.md): Easy Social Feed – Social Photos Gallery – Post Feed – Like Box \< 6.4.0 - Contributor+ Stored XSS (CVSS 5.4, Easy Social Feed)
- [CVE-2022-4570](https://cve.now/CVE-2022-4570.md): Top 10 \< 3.2.3 - Contributor+ Stored XSS (CVSS 5.4, Top)
- [CVE-2022-4675](https://cve.now/CVE-2022-4675.md): Mongoose Page Plugin \< 1.9.0 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Mongoose Page Plugin)
- [CVE-2022-4789](https://cve.now/CVE-2022-4789.md): WPZOOM Portfolio \< 1.2.2 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, WPZOOM Portfolio)
- [CVE-2022-4475](https://cve.now/CVE-2022-4475.md): Collapse-O-Matic \< 1.8.3 - Contributor+ Stored XSS (CVSS 5.4, Collapse-O-Matic)
- [CVE-2022-4443](https://cve.now/CVE-2022-4443.md): BruteBank - WP Security & Firewall \< 1.9 - Settings Update via CSRF (CVSS 6.5, BruteBank)
- [CVE-2022-4746](https://cve.now/CVE-2022-4746.md): FluentAuth \< 1.0.2 - Bypass blocks by IP Spoofing (CVSS 7.5, FluentAuth)
- [CVE-2022-4576](https://cve.now/CVE-2022-4576.md): Easy Bootstrap Shortcode \<= 4.5.4 - Contributor+ Stored XSS (CVSS 5.4, Easy Bootstrap Shortcode)
- [CVE-2022-4624](https://cve.now/CVE-2022-4624.md): GS Logo Slider \< 3.3.8 - Contributor+ Stored XSS in Shortcode (CVSS 5.4, GS Logo Slider)
- [CVE-2022-4673](https://cve.now/CVE-2022-4673.md): Rate my Post – WP Rating System \< 3.3.9 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Rate my Post)
- [CVE-2021-24881](https://cve.now/CVE-2021-24881.md): Passster \< 3.5.5.9 - Protection Bypass & Arbitrary Post Access (CVSS 7.5, Passster)
- [CVE-2022-4307](https://cve.now/CVE-2022-4307.md): Pardakht Delkhah \< 2.9.3 - Unauthenticated Stored XSS (CVSS 6.1, پلاگین پرداخت دلخواه)
- [CVE-2022-4346](https://cve.now/CVE-2022-4346.md): All In One WP Security & Firewall \< 5.1.3 - Configuration Leak (CVSS 5.3, All-In-One Security)
- [CVE-2022-4716](https://cve.now/CVE-2022-4716.md): WP Popups \< 2.1.4.8 - Contributor+ Stored XSS (CVSS 5.4, WP Popups)
- [CVE-2022-4668](https://cve.now/CVE-2022-4668.md): Easy Appointments \< 3.11.2 - Contributor+ Stored XSS in Shortcode (CVSS 5.4, Easy Appointments)
- [CVE-2022-4629](https://cve.now/CVE-2022-4629.md): Product Slider for WooCommerce \< 2.6.4 - Contributor+ Stored XSS in Shortcode (CVSS 5.4, Product Slider for WooCommerce)
- [CVE-2022-4672](https://cve.now/CVE-2022-4672.md): WordPress Simple Shopping Cart \< 4.6.2 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, WordPress Simple Shopping Cart)
- [CVE-2022-4760](https://cve.now/CVE-2022-4760.md): OneClick Chat to Order \< 1.0.4.2 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, OneClick Chat to Order)
- [CVE-2022-4625](https://cve.now/CVE-2022-4625.md): Login Logout Menu \< 1.4.0 - Contributor+ Stored XSS in Shortcode (CVSS 5.4, Login Logout Menu)
- [CVE-2022-4832](https://cve.now/CVE-2022-4832.md): Store Locator WordPress \< 1.4.9 - Contributor+ Stored XSS via Shortcode (CVSS 5.4, Store Locator WordPress)
- [CVE-2021-43444](https://cve.now/CVE-2021-43444.md): ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. (CVSS 7.5)
- [CVE-2021-43445](https://cve.now/CVE-2021-43445.md): ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. (CVSS 9.8)
- [CVE-2021-43446](https://cve.now/CVE-2021-43446.md): ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2021-43447](https://cve.now/CVE-2021-43447.md): ONLYOFFICE all versions as of 2021-11-08 is affected by Incorrect Access Control. (CVSS 7.5)
- [CVE-2021-43448](https://cve.now/CVE-2021-43448.md): ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Improper Input Validation. (CVSS 5.3)
- [CVE-2021-43449](https://cve.now/CVE-2021-43449.md): ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery (SSRF). (CVSS 8.1)
- [CVE-2022-23005](https://cve.now/CVE-2022-23005.md): Host Boot ROM Code Vulnerability in Systems Implementing UFS Boot Feature (CVSS 8.7)
- [CVE-2022-37718](https://cve.now/CVE-2022-37718.md): The management portal component of JetNexus/EdgeNexus ADC 4.2.8 was discovered to contain a command injection vulnerability. (CVSS 8.8)
- [CVE-2022-37719](https://cve.now/CVE-2022-37719.md): A Cross-Site Request Forgery (CSRF) in the management portal of JetNexus/EdgeNexus ADC 4.2.8 allows attackers to escalate privileges and exe (CVSS 8.8)
- [CVE-2022-38725](https://cve.now/CVE-2022-38725.md): An integer overflow in the RFC3164 parser in One Identity syslog-ng 3.0 through 3.37 allows remote attackers to cause a Denial of Service vi (CVSS 7.5)
- [CVE-2022-40034](https://cve.now/CVE-2022-40034.md): Cross-Site Scripting (XSS) vulnerability found in Rawchen blog-ssm v1.0 allows attackers to execute arbitrary code via the 'notifyInfo' para (CVSS 5.4)
- [CVE-2022-41505](https://cve.now/CVE-2022-41505.md): An access control issue on TP-LInk Tapo C200 V1 devices allows physically proximate attackers to obtain root access by connecting to the UAR (CVSS 6.4)
- [CVE-2022-46639](https://cve.now/CVE-2022-46639.md): A vulnerability in the descarga\_etiqueta.php component of Correos Prestashop 1.7.x allows attackers to execute a directory traversal. (CVSS 7.5)
- [CVE-2022-46959](https://cve.now/CVE-2022-46959.md): An issue in the component /admin/backups/work-dir of Sonic v1.0.4 allows attackers to execute a directory traversal. (CVSS 4.3, github.com/go-sonic/sonic)
- [CVE-2022-47065](https://cve.now/CVE-2022-47065.md): TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url (CVSS 8.8)
- [CVE-2022-48281](https://cve.now/CVE-2022-48281.md): processCropSelections in tools/tiffcrop.c in LibTIFF through 4.5.0 has a heap-based buffer overflow (e.g., "WRITE of size 307203") via a cra (CVSS 5.5)
- [CVE-2023-0438](https://cve.now/CVE-2023-0438.md): Cross-Site Request Forgery (CSRF) in modoboa/modoboa (CVSS 5.4, modoboa/modoboa · modoboa)
- [CVE-2023-0440](https://cve.now/CVE-2023-0440.md): Observable Discrepancy in healthchecks/healthchecks (CVSS 5.3, healthchecks/healthchecks)
- [CVE-2023-21719](https://cve.now/CVE-2023-21719.md): Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVSS 6.5, Microsoft Edge)
- [CVE-2023-21775](https://cve.now/CVE-2023-21775.md): Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2023-21795](https://cve.now/CVE-2023-21795.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge)
- [CVE-2023-21796](https://cve.now/CVE-2023-21796.md): Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability (CVSS 8.3, Microsoft Edge (Chromium-based) Extended Stable)
- [CVE-2023-22630](https://cve.now/CVE-2023-22630.md): IzyBat Orange casiers before 20221102\_1 allows SQL Injection via a getCasier.php?taille= URI. (CVSS 4.3)
- [CVE-2023-22960](https://cve.now/CVE-2023-22960.md): Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. (CVSS 7.5)
- [CVE-2023-23314](https://cve.now/CVE-2023-23314.md): An arbitrary file upload vulnerability in the /api/upload component of zdir v3.2.0 allows attackers to execute arbitrary code via a crafted (CVSS 8.8)
- [CVE-2023-23560](https://cve.now/CVE-2023-23560.md): In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. (CVSS 9.8)
- [CVE-2023-24068](https://cve.now/CVE-2023-24068.md): Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to modify conversation attachments within the attachments.noinde (CVSS 7.8)
- [CVE-2023-24069](https://cve.now/CVE-2023-24069.md): Signal Desktop before 6.2.0 on Windows, Linux, and macOS allows an attacker to obtain potentially sensitive attachments sent in messages fro (no CVSS)
- [CVE-2023-24070](https://cve.now/CVE-2023-24070.md): app/View/AuthKeys/authkey\_display.ctp in MISP through 2.4.167 has an XSS in authkey add via a Referer field. (no CVSS)
- [CVE-2023-24095](https://cve.now/CVE-2023-24095.md): TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url (no CVSS)
- [CVE-2023-24096](https://cve.now/CVE-2023-24096.md): TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the newpass par (CVSS 8.8)
- [CVE-2023-24097](https://cve.now/CVE-2023-24097.md): TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url (CVSS 8.8)
- [CVE-2023-24098](https://cve.now/CVE-2023-24098.md): TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url (CVSS 8.8)
- [CVE-2023-24099](https://cve.now/CVE-2023-24099.md): TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the username pa (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.