CVEs published January 25, 2023
59 CVEs were published on January 25, 2023: 10 critical, 22 high.
- Published
- 59
- Critical
- 10
- High
- 22
- Medium
- 26
- Low
- 1
- Unrated
- 0
- Now in CISA KEV
- 0
- Fix available
- 14
Most affected products
- glpi-project glpi
- 6
- ISC BIND
- 4
- Tenable.sc
- 4
- vRealize Log Insight
- 4
- Kernel
- 2
- serve-lite
- 2
- Western Digital My Cloud
- 2
- argoproj argo-cd · github.com/argoproj/argo-cd +1
- 1
- Campbell Scientific CR6 · Campbell Scientific CR300 +3
- 1
- com.bstek.uflo:uflo-core
- 1
Critical 10
- CVE-2023-22482JWT audience claim is not verifiedargoproj argo-cd · github.com/argoproj/argo-cd +1
- CVE-2022-25894All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via jecom.bstek.uflo:uflo-core
- CVE-2020-18330An issue was discovered in the default configuration of ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2
- CVE-2020-18331Directory traversal vulnerability in ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware p
- CVE-2022-31704The vRealize Log Insight contains a broken access control vulnerability.vRealize Log Insight
- CVE-2022-31706The vRealize Log Insight contains a Directory Traversal Vulnerability.vRealize Log Insight
- CVE-2022-46998An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF).
- CVE-2022-46999Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \App\Manage\Controller\UserController.class.php.
- CVE-2022-47767A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker.
- CVE-2023-0321Disclosure of Sensitive Information on Campbell Scientific ProductsCampbell Scientific CR6 · Campbell Scientific CR300 +3
High 22
- CVE-2022-3924named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quotaISC BIND
- CVE-2022-3736named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queriesISC BIND
- CVE-2022-3488named may terminate unexpectedly when processing ECS options in repeated responses to iterative queriesISC BIND
- CVE-2022-3094An UPDATE message flood may cause named to exhaust all available memoryISC BIND
- CVE-2022-43864IBM Business Automation Workflow information disclosureIBM Business Monitor
- CVE-2022-34405An improper access control vulnerability was identified in the Realtek audio driver.Dell CPG Drivers
- CVE-2022-4510Path Traversal in binwalkRefirm Labs binwalk · binwalk
- CVE-2023-23609contiki-ng BLE-L2CAP contains Improper size validation of L2CAP framescontiki-ng
- CVE-2023-22500glpi Unauthorized access to inventory filesglpi-project glpi
- CVE-2022-25962All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.vagrant.js
- CVE-2022-21810All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization.smartctl
- CVE-2022-25882Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external_data field of the tensor proto can have a ponnx
- CVE-2022-21192All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protectioserve-lite
- CVE-2018-25078man-db before 2.8.5 on Gentoo allows local users (with access to the man user account) to gain root privileges because /usr/bin/mandb is exe
- CVE-2020-18329An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unau
- CVE-2020-36657uptimed before 0.4.6-r1 on Gentoo allows local users (with access to the uptimed user account) to gain root privileges by creating a hard li
- CVE-2022-31710vRealize Log Insight contains a deserialization vulnerability.vRealize Log Insight
- CVE-2022-38758XSS vulnerabilities in iManagerMicro Focus NetIQ iManager
- CVE-2022-40035File Upload Vulnerability found in Rawchen Blog-ssm v1.0 allowing attackers to execute arbitrary commands and gain escalated privileges via
- CVE-2022-43997Incorrect access control in Aternity agent in Riverbed Aternity before 12.1.4.27 allows for local privilege escalation.
- CVE-2022-44018In Softing uaToolkit Embedded before 1.40.1, a malformed PubSub discovery announcement message can cause a NULL pointer dereference or out-o
- CVE-2022-45920In Softing uaToolkit Embedded before 1.41, a malformed CreateMonitoredItems request may cause a memory leak.
Medium, low and unrated 27
- CVE-2022-22462IBM Security Verify Governance, Identity Manager virtual appliance component information disclosureIBM Security Verify Governance
- CVE-2022-43917IBM WebSphere Application Server information disclosureIBM WebSphere Application Server
- CVE-2022-41941glpi contains XSS Stored inside Standard Interface Help Link href attributeglpi-project glpi
- CVE-2023-22722glpi subject to Cross-site Scripting (XSS) - Reflected glpi-project glpi
- CVE-2023-22724glpi contains XSS in RSS Description Linkglpi-project glpi
- CVE-2023-22725glpi vulnerable to XSS on external linksglpi-project glpi
- CVE-2023-23610glpi vulnerable to Unauthorized access to data exportglpi-project glpi
- CVE-2023-23611xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementationopenedx xblock-lti-consumer · lti-consumer-xblock
- CVE-2022-25847All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it renserve-lite
- CVE-2022-25927Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denialua-parser-js
- CVE-2022-29843Western Digital My Cloud OS 5 devices Command Injection VulnerabilityWestern Digital My Cloud
- CVE-2022-29844Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftpWestern Digital My Cloud
- CVE-2022-31711VMware vRealize Log Insight contains an Information Disclosure Vulnerability.vRealize Log Insight
- CVE-2022-45730A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts
- CVE-2022-46128phpgurukul Doctor Appointment Management System V 1.0.0 is vulnerable to Cross Site Scripting (XSS) via searchdata=.
- CVE-2022-46624A cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTML
- CVE-2022-46957Sourcecodester.com Online Graduate Tracer System V 1.0.0 is vulnerable to Cross Site Scripting (XSS).
- CVE-2022-47052The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perfo
- CVE-2022-47073A cross-site scripting (XSS) vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbitrary web scripts or
- CVE-2023-0229A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-prgithub.com/openshift/apiserver-library-go
- CVE-2023-0468A use-after-free flaw was found in io_uring/poll.c in io_poll_check_events in the io_uring subcomponent in the Linux Kernel due to a race coKernel
- CVE-2023-0469A use-after-free flaw was found in io_uring/filetable.c in io_install_fixed_file in the io_uring subcomponent in the Linux Kernel during calKernel
- CVE-2023-0476A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users.Tenable.sc
- CVE-2023-23151bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file deletion vulnerability via the component /include/inc_content_media.php.
- CVE-2023-24493A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users.Tenable.sc
- CVE-2023-24494A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning itTenable.sc
- CVE-2023-24495A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data.Tenable.sc