# CVEs published 2023-01-25

59 CVEs were published on January 25, 2023: 10 critical, 22 high. Days are UTC.

- [CVE-2022-3924](https://cve.now/CVE-2022-3924.md): named configured to answer from stale cache may terminate unexpectedly at recursive-clients soft quota (CVSS 7.5, ISC BIND)
- [CVE-2022-3736](https://cve.now/CVE-2022-3736.md): named configured to answer from stale cache may terminate unexpectedly while processing RRSIG queries (CVSS 7.5, ISC BIND)
- [CVE-2022-3488](https://cve.now/CVE-2022-3488.md): named may terminate unexpectedly when processing ECS options in repeated responses to iterative queries (CVSS 7.5, ISC BIND)
- [CVE-2022-3094](https://cve.now/CVE-2022-3094.md): An UPDATE message flood may cause named to exhaust all available memory (CVSS 7.5, ISC BIND)
- [CVE-2022-22462](https://cve.now/CVE-2022-22462.md): IBM Security Verify Governance, Identity Manager virtual appliance component information disclosure (CVSS 3.7, IBM Security Verify Governance)
- [CVE-2023-22482](https://cve.now/CVE-2023-22482.md): JWT audience claim is not verified (CVSS 9.1, argoproj argo-cd · github.com/argoproj/argo-cd +1)
- [CVE-2022-43864](https://cve.now/CVE-2022-43864.md): IBM Business Automation Workflow information disclosure (CVSS 7.5, IBM Business Monitor)
- [CVE-2022-43917](https://cve.now/CVE-2022-43917.md): IBM WebSphere Application Server information disclosure (CVSS 5.9, IBM WebSphere Application Server)
- [CVE-2022-34405](https://cve.now/CVE-2022-34405.md): An improper access control vulnerability was identified in the Realtek audio driver. (CVSS 7.3, Dell CPG Drivers)
- [CVE-2022-4510](https://cve.now/CVE-2022-4510.md): Path Traversal in binwalk (CVSS 7.8, Refirm Labs binwalk · binwalk)
- [CVE-2023-23609](https://cve.now/CVE-2023-23609.md): contiki-ng BLE-L2CAP contains Improper size validation of L2CAP frames (CVSS 8.2, contiki-ng)
- [CVE-2022-41941](https://cve.now/CVE-2022-41941.md): glpi contains XSS Stored inside Standard Interface Help Link href attribute (CVSS 6.2, glpi-project glpi)
- [CVE-2023-22500](https://cve.now/CVE-2023-22500.md): glpi Unauthorized access to inventory files (CVSS 7.5, glpi-project glpi)
- [CVE-2023-22722](https://cve.now/CVE-2023-22722.md): glpi subject to Cross-site Scripting (XSS) - Reflected (CVSS 6.8, glpi-project glpi)
- [CVE-2023-22724](https://cve.now/CVE-2023-22724.md): glpi contains XSS in RSS Description Link (CVSS 6.2, glpi-project glpi)
- [CVE-2023-22725](https://cve.now/CVE-2023-22725.md): glpi vulnerable to XSS on external links (CVSS 6.2, glpi-project glpi)
- [CVE-2023-23610](https://cve.now/CVE-2023-23610.md): glpi vulnerable to Unauthorized access to data export (CVSS 6.5, glpi-project glpi)
- [CVE-2023-23611](https://cve.now/CVE-2023-23611.md): xblock-lti-consumer contain Missing Authorization in Grade Pass Back Implementation (CVSS 5.4, openedx xblock-lti-consumer · lti-consumer-xblock)
- [CVE-2022-25962](https://cve.now/CVE-2022-25962.md): All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization. (CVSS 7.4, vagrant.js)
- [CVE-2022-21810](https://cve.now/CVE-2022-21810.md): All versions of the package smartctl are vulnerable to Command Injection via the info method due to improper input sanitization. (CVSS 7.4, smartctl)
- [CVE-2022-25894](https://cve.now/CVE-2022-25894.md): All versions of the package com.bstek.uflo:uflo-core are vulnerable to Remote Code Execution (RCE) in the ExpressionContextImpl class via je (CVSS 9.8, com.bstek.uflo:uflo-core)
- [CVE-2022-25882](https://cve.now/CVE-2022-25882.md): Versions of the package onnx before 1.13.0 are vulnerable to Directory Traversal as the external\_data field of the tensor proto can have a p (CVSS 7.5, onnx)
- [CVE-2022-21192](https://cve.now/CVE-2022-21192.md): All versions of the package serve-lite are vulnerable to Directory Traversal due to missing input sanitization or other checks and protectio (CVSS 7.5, serve-lite)
- [CVE-2022-25847](https://cve.now/CVE-2022-25847.md): All versions of the package serve-lite are vulnerable to Cross-site Scripting (XSS) because when it detects a request to a directory, it ren (CVSS 5.4, serve-lite)
- [CVE-2022-25927](https://cve.now/CVE-2022-25927.md): Versions of the package ua-parser-js from 0.7.30 and before 0.7.33, from 0.8.1 and before 1.0.33 are vulnerable to Regular Expression Denial (CVSS 5.3, ua-parser-js)
- [CVE-2018-25078](https://cve.now/CVE-2018-25078.md): man-db before 2.8.5 on Gentoo allows local users (with access to the man user account) to gain root privileges because /usr/bin/mandb is exe (CVSS 7.8)
- [CVE-2020-18329](https://cve.now/CVE-2020-18329.md): An issue was discovered in Rehau devices that use a pCOWeb card BIOS v6.27, BOOT v5.00, web version v2.2, allows attackers to gain full unau (CVSS 7.5)
- [CVE-2020-18330](https://cve.now/CVE-2020-18330.md): An issue was discovered in the default configuration of ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2 (CVSS 9.1)
- [CVE-2020-18331](https://cve.now/CVE-2020-18331.md): Directory traversal vulnerability in ChinaMobile PLC Wireless Router model GPN2.4P21-C-CN running the firmware version W2000EN-01(hardware p (CVSS 9.1)
- [CVE-2020-36657](https://cve.now/CVE-2020-36657.md): uptimed before 0.4.6-r1 on Gentoo allows local users (with access to the uptimed user account) to gain root privileges by creating a hard li (CVSS 7.8)
- [CVE-2022-29843](https://cve.now/CVE-2022-29843.md): Western Digital My Cloud OS 5 devices Command Injection Vulnerability (CVSS 6.2, Western Digital My Cloud)
- [CVE-2022-29844](https://cve.now/CVE-2022-29844.md): Western Digital My Cloud OS 5 arbitrary file read and write vulnerability via ftp (CVSS 6.7, Western Digital My Cloud)
- [CVE-2022-31704](https://cve.now/CVE-2022-31704.md): The vRealize Log Insight contains a broken access control vulnerability. (CVSS 9.8, vRealize Log Insight)
- [CVE-2022-31706](https://cve.now/CVE-2022-31706.md): The vRealize Log Insight contains a Directory Traversal Vulnerability. (CVSS 9.8, vRealize Log Insight)
- [CVE-2022-31710](https://cve.now/CVE-2022-31710.md): vRealize Log Insight contains a deserialization vulnerability. (CVSS 7.5, vRealize Log Insight)
- [CVE-2022-31711](https://cve.now/CVE-2022-31711.md): VMware vRealize Log Insight contains an Information Disclosure Vulnerability. (CVSS 5.3, vRealize Log Insight)
- [CVE-2022-38758](https://cve.now/CVE-2022-38758.md): XSS vulnerabilities in iManager (CVSS 7.2, Micro Focus NetIQ iManager)
- [CVE-2022-40035](https://cve.now/CVE-2022-40035.md): File Upload Vulnerability found in Rawchen Blog-ssm v1.0 allowing attackers to execute arbitrary commands and gain escalated privileges via (CVSS 8.8)
- [CVE-2022-43997](https://cve.now/CVE-2022-43997.md): Incorrect access control in Aternity agent in Riverbed Aternity before 12.1.4.27 allows for local privilege escalation. (CVSS 7.8)
- [CVE-2022-44018](https://cve.now/CVE-2022-44018.md): In Softing uaToolkit Embedded before 1.40.1, a malformed PubSub discovery announcement message can cause a NULL pointer dereference or out-o (CVSS 7.5)
- [CVE-2022-45730](https://cve.now/CVE-2022-45730.md): A cross-site scripting (XSS) vulnerability in Doctor Appointment Management System v1.0.0 allows attackers to execute arbitrary web scripts (CVSS 6.1)
- [CVE-2022-45920](https://cve.now/CVE-2022-45920.md): In Softing uaToolkit Embedded before 1.41, a malformed CreateMonitoredItems request may cause a memory leak. (CVSS 7.5)
- [CVE-2022-46128](https://cve.now/CVE-2022-46128.md): phpgurukul Doctor Appointment Management System V 1.0.0 is vulnerable to Cross Site Scripting (XSS) via searchdata=. (CVSS 6.1)
- [CVE-2022-46624](https://cve.now/CVE-2022-46624.md): A cross-site scripting (XSS) vulnerability in Online Graduate Tracer System v1.0.0 allows attackers to execute arbitrary web scripts or HTML (CVSS 6.1)
- [CVE-2022-46957](https://cve.now/CVE-2022-46957.md): Sourcecodester.com Online Graduate Tracer System V 1.0.0 is vulnerable to Cross Site Scripting (XSS). (CVSS 6.1)
- [CVE-2022-46998](https://cve.now/CVE-2022-46998.md): An issue in the website background of taocms v3.0.2 allows attackers to execute a Server-Side Request Forgery (SSRF). (CVSS 9.8)
- [CVE-2022-46999](https://cve.now/CVE-2022-46999.md): Tuzicms v2.0.6 was discovered to contain a SQL injection vulnerability via the component \\App\\Manage\\Controller\\UserController.class.php. (CVSS 9.8)
- [CVE-2022-47052](https://cve.now/CVE-2022-47052.md): The web interface of the 'Nighthawk R6220 AC1200 Smart Wi-Fi Router' is vulnerable to a CRLF Injection attack that can be leveraged to perfo (CVSS 6.1)
- [CVE-2022-47073](https://cve.now/CVE-2022-47073.md): A cross-site scripting (XSS) vulnerability in the Create Ticket page of Small CRM v3.0 allows attackers to execute arbitrary web scripts or (CVSS 5.4)
- [CVE-2022-47767](https://cve.now/CVE-2022-47767.md): A backdoor in Solar-Log Gateway products allows remote access via web panel gaining super administration privileges to the attacker. (CVSS 9.8)
- [CVE-2023-0229](https://cve.now/CVE-2023-0229.md): A flaw was found in github.com/openshift/apiserver-library-go, used in OpenShift 4.12 and 4.11, that contains an issue that can allow low-pr (CVSS 6.3, github.com/openshift/apiserver-library-go)
- [CVE-2023-0321](https://cve.now/CVE-2023-0321.md): Disclosure of Sensitive Information on Campbell Scientific Products (CVSS 9.1, Campbell Scientific CR6 · Campbell Scientific CR300 +3)
- [CVE-2023-0468](https://cve.now/CVE-2023-0468.md): A use-after-free flaw was found in io\_uring/poll.c in io\_poll\_check\_events in the io\_uring subcomponent in the Linux Kernel due to a race co (CVSS 4.7, Kernel)
- [CVE-2023-0469](https://cve.now/CVE-2023-0469.md): A use-after-free flaw was found in io\_uring/filetable.c in io\_install\_fixed\_file in the io\_uring subcomponent in the Linux Kernel during cal (CVSS 5.5, Kernel)
- [CVE-2023-0476](https://cve.now/CVE-2023-0476.md): A LDAP injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. (CVSS 6.5, Tenable.sc)
- [CVE-2023-23151](https://cve.now/CVE-2023-23151.md): bloofoxCMS v0.5.2.1 was discovered to contain an arbitrary file deletion vulnerability via the component /include/inc\_content\_media.php. (CVSS 6.5)
- [CVE-2023-24493](https://cve.now/CVE-2023-24493.md): A formula injection vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it to users. (CVSS 5.7, Tenable.sc)
- [CVE-2023-24494](https://cve.now/CVE-2023-24494.md): A stored cross-site scripting (XSS) vulnerability exists in Tenable.sc due to improper validation of user-supplied input before returning it (CVSS 5.4, Tenable.sc)
- [CVE-2023-24495](https://cve.now/CVE-2023-24495.md): A Server Side Request Forgery (SSRF) vulnerability exists in Tenable.sc due to improper validation of session & user-accessible input data. (CVSS 6.5, Tenable.sc)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2023-01-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.