CVEs published January 24, 2023
122 CVEs were published on January 24, 2023: 14 critical, 47 high.
- Published
- 122
- Critical
- 14
- High
- 47
- Medium
- 57
- Low
- 3
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 46
Most affected products
- Android
- 27
- GitLab
- 8
- Wireshark Foundation Wireshark
- 7
- Google Chrome
- 4
- Jenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…
- 4
- Jenkins Project Jenkins GitHub Pull Request Builder Plugin…
- 3
- Jenkins Project Jenkins OpenID Plugin · org.jenkins-ci.plug…
- 3
- Jenkins Project Jenkins Orka by MacStadium Plugin · io.jenk…
- 3
- Jenkins Project Jenkins TestQuality Updater Plugin · org.je…
- 3
- Symantec Identity Management And Governance
- 3
Critical 14
- CVE-2023-24022Hard Coded Credential Crypt VulnerabilityBaicells Nova
- CVE-2022-45820WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL InjectionThimPress LearnPress – WordPress LMS Plugin
- CVE-2022-45808WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to SQL InjectionThimPress LearnPress – WordPress LMS Plugin
- CVE-2022-47615WordPress LearnPress Plugin <= 4.1.7.3.2 is vulnerable to Local File InclusionThimPress LearnPress – WordPress LMS Plugin
- CVE-2022-3572A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions from 13.5 prior to 15.3.5, 15.4 prior to 15.4.4, andGitLab
- CVE-2022-40037An issue discovered in Rawchen blog-ssm v1.0 allows remote attacker to escalate privileges and execute arbitrary commands via the component
- CVE-2023-23331Amano Xoffice parking solutions 7.1.3879 is vulnerable to SQL Injection.
- CVE-2023-24427Jenkins Bitbucket OAuth Plugin 0.12 and earlier does not invalidate the previous session on login.Jenkins Project Jenkins Bitbucket OAuth Plugin · org.jenkin…
- CVE-2023-24429Jenkins Semantic Versioning Plugin 1.14 and earlier does not restrict execution of an controller/agent message to agents, and implements no Jenkins Project Jenkins Semantic Versioning Plugin · org.je…
- CVE-2023-24430Jenkins Semantic Versioning Plugin 1.14 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins Project Jenkins Semantic Versioning Plugin · org.je…
- CVE-2023-24441Jenkins MSTest Plugin 1.0.0 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins Project Jenkins MSTest Plugin · org.jvnet.hudson.pl…
- CVE-2023-24443Jenkins TestComplete support Plugin 2.8.1 and earlier does not configure its XML parser to prevent XML external entity (XXE) attacks.Jenkins Project Jenkins TestComplete support Plugin · org.j…
- CVE-2023-24444Jenkins OpenID Plugin 2.4 and earlier does not invalidate the previous session on login.Jenkins Project Jenkins OpenID Plugin · org.jenkins-ci.plug…
- CVE-2023-24456Jenkins Keycloak Authentication Plugin 2.3.0 and earlier does not invalidate the previous session on login.Jenkins Project Jenkins Keycloak Authentication Plugin · or…
High 47
- CVE-2023-24508Remote Code Execution in Baicells RTS PlatformBaicells Nova
- CVE-2023-0463The force offline MFA prompt setting is not respected when switching to offline mode in Devolutions Remote Desktop Manager 2022.3.29 to 2022Devolutions Remote Desktop Manager
- CVE-2022-25860Versions of the package simple-git before 3.16.0 are vulnerable to Remote Code Execution (RCE) via the clone(), pull(), push() and listRemotsimple-git
- CVE-2022-25908All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-inputcreate-choo-electron
- CVE-2022-25350All versions of the package puppet-facter are vulnerable to Command Injection via the getFact function due to improper input sanitization.puppet-facter
- CVE-2022-20456In AutomaticZenRule of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20461In pinReplyNative of com_android_bluetooth_btservice_AdapterService.cpp, there is a possible out of bounds read due to type confusion.Android
- CVE-2022-20489In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20490In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20492In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion.Android
- CVE-2022-20493In Condition of Condition.java, there is a possible way to grant notification access due to improper input validation.Android
- CVE-2022-27508Unauthenticated denial of service Citirx Citrix Application Delivery Controller (Citrix ADC)…
- CVE-2022-38774An issue was discovered in the quarantine feature of Elastic Endpoint Security and Elastic Endgame for Windows, which could allow unprivilegElastic Endpoint Security and Elastic Endgame Security
- CVE-2022-38775An issue was discovered in the rollback feature of Elastic Endpoint Security for Windows, which could allow unprivileged users to elevate thElastic Endpoint Security
- CVE-2022-45639OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m
- CVE-2022-47040An issue in ASKEY router RTF3505VW-N1 BR_SV_g000_R3505VMN1001_s32_7 allows attackers to escalate privileges via running the tcpdump command
- CVE-2022-47042MCMS v5.2.10 and below was discovered to contain an arbitrary file write vulnerability via the component ms/template/writeFileContent.do.net.mingsoft:ms-mcms
- CVE-2022-47100A vulnerability in Sengled Smart bulb 0x0000024 allows attackers to arbitrarily perform a factory reset on the device via a crafted IEEE 802
- CVE-2022-48199SoftPerfect NetWorx 7.1.1 on Windows allows an attacker to execute a malicious binary with potentially higher privileges via a low-privilege
- CVE-2023-0444A privilege escalation vulnerability exists in Delta Electronics InfraSuite Device Master 00.00.02a.Delta Electronics InfraSuite Device Master
- CVE-2023-0471Use after free in WebTransport in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption viaGoogle Chrome
- CVE-2023-0472Use after free in WebRTC in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruption via a craGoogle Chrome
- CVE-2023-0473Type Confusion in ServiceWorker API in Google Chrome prior to 109.0.5414.119 allowed a remote attacker to potentially exploit heap corruptioGoogle Chrome
- CVE-2023-0474Use after free in GuestView in Google Chrome prior to 109.0.5414.119 allowed an attacker who convinced a user to install a malicious extensiGoogle Chrome
- CVE-2023-20904In getTrampolineIntent of SettingsActivity.java, there is a possible launch of arbitrary activity due to an Intent mismatch in the code.Android
- CVE-2023-20905In Mfc_Transceive of phNxpExtns_MifareStd.cpp, there is a possible out of bounds write due to a missing bounds check.Android
- CVE-2023-20912In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permissAndroid
- CVE-2023-20913In onCreate of PhoneAccountSettingsActivity.java and related files, there is a possible way to mislead the user into enabling a malicious phAndroid
- CVE-2023-20915In addOrReplacePhoneAccount of PhoneAccountRegistrar.java, there is a possible way to enable a phone account without user interaction due toAndroid
- CVE-2023-20916In getMainActivityLaunchIntent of LauncherAppsService.java, there is a possible way to bypass the restrictions on starting activities from tAndroid
- CVE-2023-20919In getStringsForPrefix of Settings.java, there is a possible prevention of package uninstallation due to a logic error in the code.Android
- CVE-2023-20920In queue of UsbRequest.java, there is a possible way to corrupt memory due to a use after free.Android
- CVE-2023-20921In onPackageRemoved of AccessibilityManagerService.java, there is a possibility to automatically grant accessibility services due to a logicAndroid
- CVE-2023-20925In setUclampMinLocked of PowerSessionManager.cpp, there is a possible way to corrupt memory due to a use after free.Android
- CVE-2023-20928In binder_vma_close of binder.c, there is a possible use after free due to improper locking.Android
- CVE-2023-23949An authenticated user can supply malicious HTML and JavaScript code that will be executed in the client browser.Symantec Identity Management And Governance
- CVE-2023-24057HL7 (Health Level 7) FHIR Core Libraries before 5.6.92 allow attackers to extract files into arbitrary directories via directory traversal forg.hl7.fhir.publisher:org.hl7.fhir.publisher · ca.uhn.h… +5
- CVE-2023-24422A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackerJenkins Project Jenkins Script Security Plugin · org.jenkin…
- CVE-2023-24424Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.Jenkins Project Jenkins OpenId Connect Authentication Plugi…
- CVE-2023-24426Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.Jenkins Project Jenkins Azure AD Plugin · org.jenkins-ci.pl…
- CVE-2023-24432A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an atJenkins Project Jenkins Orka by MacStadium Plugin · io.jenk…
- CVE-2023-24434A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to conneJenkins Project Jenkins GitHub Pull Request Builder Plugin…
- CVE-2023-24437A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers tJenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…
- CVE-2023-24446A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in tJenkins Project Jenkins OpenID Plugin · org.jenkins-ci.plug…
- CVE-2023-24447A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attaJenkins Project Jenkins RabbitMQ Consumer Plugin · org.jenk…
- CVE-2023-24452A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an atJenkins Project Jenkins TestQuality Updater Plugin · org.je…
- CVE-2023-24458A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-sJenkins Project Jenkins BearyChat Plugin · org.jenkins-ci.p…
Medium, low and unrated 61
- CVE-2023-23612Issue with whitespace in JWT roles in OpenSearchopensearch-project security · org.opensearch.plugin:opensea…
- CVE-2023-23613Field-level security issue with .keyword fields in OpenSearchopensearch-project security · org.opensearch.plugin:opensea…
- CVE-2023-0356 SOCOMEC MODULYS GP Netvision versions 7.20 and prior lack strong encryption for credentials on HTTP connections, which could result in threSOCOMEC MODULYS GP
- CVE-2023-0284Improper validation of LDAP user IDsTribe29 Checkmk
- CVE-2023-23608spotipy Path traversal vulnerability that may lead to type confusion in URI handling codespotipy-dev spotipy · spotipy
- CVE-2023-22486cmark-gfm Quadratic complexity bug in handle_close_bracket may lead to a denial of servicegithub cmark-gfm
- CVE-2023-22485cmark-gfm out-of-bounds read in validate_protocolgithub cmark-gfm
- CVE-2021-28510For certain systems running EOS, a Precision Time Protocol (PTP) packet of a management/signaling message with an invalid Type-Length-Value (TLV) causes the PTP agent to restart. Repeated restarts of the service will make the service unavailable.Arista Networks EOS
- CVE-2022-20213In ApplicationsDetailsActivity of AndroidManifest.xml, there is a possible DoS due to a tapjacking/overlay attack.Android
- CVE-2022-20214In Car Settings app, the toggle button in Modify system settings is vulnerable to tapjacking attack.Android
- CVE-2022-20215In onCreate of MasterClearConfirmFragment.java, there is a possible factory reset due to a tapjacking/overlay attack.Android
- CVE-2022-20235The PowerVR GPU kernel driver maintains an "Information Page" used by its cache subsystem.Android
- CVE-2022-20458The logs of sensitive information (PII) or hardware identifier should only be printed in Android "userdebug" or "eng" build.Android
- CVE-2022-20494In AutomaticZenRule of AutomaticZenRule.java, there is a possible persistent DoS due to resource exhaustion.Android
- CVE-2022-26329File existence disclosue vulnerability in IDM pluginMicro Focus NetIQ Identity Manager
- CVE-2022-27507Authenticated denial of service Citirx Citrix Application Delivery Controller (Citrix ADC)…
- CVE-2022-3478An issue has been discovered in GitLab affecting all versions starting from 12.8 before 15.4.6, all versions starting from 15.5 before 15.5.GitLab
- CVE-2022-3482An improper access control issue in GitLab CE/EE affecting all versions from 11.3 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 1GitLab
- CVE-2022-3740An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.9 prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 priorGitLab
- CVE-2022-3820An issue has been discovered in GitLab affecting all versions starting from 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2.GitLab
- CVE-2022-3902An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5GitLab
- CVE-2022-40036An issue was discovered in Rawchen blog-ssm v1.0 allows an attacker to obtain sensitive user information by bypassing permission checks via
- CVE-2022-4054An issue has been discovered in GitLab affecting all versions starting from 9.3 before 15.4.6, all versions starting from 15.5 before 15.5.5GitLab
- CVE-2022-4092An issue has been discovered in GitLab EE affecting all versions starting from 15.6 before 15.6.1.GitLab
- CVE-2022-4554Reflected XSS B2B Dealer Ordering SystemID Software Project and Consultancy Services B2B Customer O…
- CVE-2023-0394A NULL pointer dereference flaw was found in rawv6_push_pending_frames in net/ipv6/raw.c in the network subcomponent in the Linux kernel.Kernel
- CVE-2023-0411Excessive loops in multiple dissectors in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or Wireshark Foundation Wireshark
- CVE-2023-0412TIPC dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture fiWireshark Foundation Wireshark
- CVE-2023-0413Dissection engine bug in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture fWireshark Foundation Wireshark
- CVE-2023-0414Crash in the EAP dissector in Wireshark 4.0.0 to 4.0.2 allows denial of service via packet injection or crafted capture fileWireshark Foundation Wireshark
- CVE-2023-0415iSCSI dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture fWireshark Foundation Wireshark
- CVE-2023-0416GNW dissector crash in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafted capture filWireshark Foundation Wireshark
- CVE-2023-0417Memory leak in the NFS dissector in Wireshark 4.0.0 to 4.0.2 and 3.6.0 to 3.6.10 and allows denial of service via packet injection or crafteWireshark Foundation Wireshark
- CVE-2023-0448The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected croWP Helper Lite Wordpress Plugin
- CVE-2023-20908In several functions of SettingsState.java, there is a possible system crash loop due to resource exhaustion.Android
- CVE-2023-20922In setMimeGroup of PackageManagerService.java, there is a possible crash loop due to resource exhaustion.Android
- CVE-2023-20923In exported content providers of ShannonRcs, there is a possible way to get access to protected content providers due to a permissions bypasAndroid
- CVE-2023-20924In (TBD) of (TBD), there is a possible way to bypass the lockscreen due to Biometric Auth Failure.Android
- CVE-2023-23950User’s supplied input (usually a CRLF sequence) can be used to split a returning response into two responses.Symantec Identity Management And Governance
- CVE-2023-23951Ability to enumerate the Oracle LDAP attributes for the current user by modifying the query used by the applicationSymantec Identity Management And Governance
- CVE-2023-24423A cross-site request forgery (CSRF) vulnerability in Jenkins Gerrit Trigger Plugin 2.38.0 and earlier allows attackers to rebuild previous bJenkins Project Jenkins Gerrit Trigger Plugin · com.sonyeri…
- CVE-2023-24425Jenkins Kubernetes Credentials Provider Plugin 1.208.v128ee9800c04 and earlier does not set the appropriate context for Kubernetes credentiaJenkins Project Jenkins Kubernetes Credentials Provider Plu…
- CVE-2023-24428A cross-site request forgery (CSRF) vulnerability in Jenkins Bitbucket OAuth Plugin 0.12 and earlier allows attackers to trick users into loJenkins Project Jenkins Bitbucket OAuth Plugin · org.jenkin…
- CVE-2023-24431A missing permission check in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers with Overall/Read permission to enumerate Jenkins Project Jenkins Orka by MacStadium Plugin · io.jenk…
- CVE-2023-24433Missing permission checks in Jenkins Orka by MacStadium Plugin 1.31 and earlier allow attackers with Overall/Read permission to connect to aJenkins Project Jenkins Orka by MacStadium Plugin · io.jenk…
- CVE-2023-24435A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission toJenkins Project Jenkins GitHub Pull Request Builder Plugin…
- CVE-2023-24436A missing permission check in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers with Overall/Read permission toJenkins Project Jenkins GitHub Pull Request Builder Plugin…
- CVE-2023-24438A missing permission check in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers with Overall/Read permisJenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…
- CVE-2023-24439Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier stores the private keys unencrypted in its global configuration file onJenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…
- CVE-2023-24440Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier transmits the private key in plain text as part of the global Jenkins cJenkins Project Jenkins JIRA Pipeline Steps Plugin · org.je…
- CVE-2023-24442Jenkins GitHub Pull Request Coverage Status Plugin 2.2.0 and earlier stores the GitHub Personal Access Token, Sonar access token and Sonar pJenkins Project Jenkins GitHub Pull Request Coverage Status…
- CVE-2023-24445Jenkins OpenID Plugin 2.4 and earlier improperly determines that a redirect URL after login is legitimately pointing to Jenkins.Jenkins Project Jenkins OpenID Plugin · org.jenkins-ci.plug…
- CVE-2023-24448A missing permission check in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers with Overall/Read permission to connect to aJenkins Project Jenkins RabbitMQ Consumer Plugin · org.jenk…
- CVE-2023-24449Jenkins PWauth Security Realm Plugin 0.4 and earlier does not restrict the names of files in methods implementing form validation, allowing Jenkins Project Jenkins PWauth Security Realm Plugin · org.…
- CVE-2023-24450Jenkins view-cloner Plugin 1.1 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be Jenkins Project Jenkins view-cloner Plugin · org.jenkins-ci…
- CVE-2023-24451A missing permission check in Jenkins Cisco Spark Notifier Plugin 1.1.1 and earlier allows attackers with Overall/Read permission to enumeraJenkins Project Jenkins Cisco Spark Notifier Plugin · org.j…
- CVE-2023-24453A missing check in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers with Overall/Read permission to connect to an attackeJenkins Project Jenkins TestQuality Updater Plugin · org.je…
- CVE-2023-24454Jenkins TestQuality Updater Plugin 1.3 and earlier stores the TestQuality Updater password unencrypted in its global configuration file on tJenkins Project Jenkins TestQuality Updater Plugin · org.je…
- CVE-2023-24455Jenkins visualexpert Plugin 1.3 and earlier does not restrict the names of files in methods implementing form validation, allowing attackersJenkins Project Jenkins visualexpert Plugin · io.jenkins.pl…
- CVE-2023-24457A cross-site request forgery (CSRF) vulnerability in Jenkins Keycloak Authentication Plugin 2.3.0 and earlier allows attackers to trick userJenkins Project Jenkins Keycloak Authentication Plugin · or…
- CVE-2023-24459A missing permission check in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to connect to an attaJenkins Project Jenkins BearyChat Plugin · org.jenkins-ci.p…