CVEs published January 27, 2023
85 CVEs were published on January 27, 2023: 8 critical, 31 high.
- Published
- 85
- Critical
- 8
- High
- 31
- Medium
- 39
- Low
- 6
- Unrated
- 1
- Now in CISA KEV
- 0
- Fix available
- 21
Most affected products
- SourceCodester Online Tours & Travels Management System
- 7
- OpenMage magento-lts · openmage/magento-lts
- 6
- discourse
- 5
- alejandropascual Quick Restaurant Menu
- 4
- GitLab
- 4
- HP Security Manager
- 4
- Adobe Acrobat Reader
- 3
- Artica PFMS Pandora FMS
- 3
- ContentStudio
- 3
- binutils
- 1
Critical 8
- CVE-2023-0556ContentStudio <= 1.2.5 - Missing AuthorizationContentStudio
- CVE-2022-39811Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader.
- CVE-2022-44298SiteServer CMS 7.1.3 is vulnerable to SQL Injection.
- CVE-2022-48008An arbitrary file upload vulnerability in the plugin manager of LimeSurvey v5.4.15 allows attackers to execute arbitrary code via a crafted
- CVE-2022-48011Opencats v0.9.7 was discovered to contain a SQL injection vulnerability via the importID parameter in the Import viewerrors function.
- CVE-2022-48066An issue in the component global.so of Totolink A830R V4.1.2cu.5182 allows attackers to bypass authentication via a crafted cookie.
- CVE-2022-48107D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress.
- CVE-2022-48108D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask.
High 31
- CVE-2023-23621Discourse vulnerable to ReDoS in user agent parsingdiscourse
- CVE-2022-46356Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andHP Security Manager
- CVE-2022-46357Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andHP Security Manager
- CVE-2022-46358Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andHP Security Manager
- CVE-2022-46359Potential vulnerabilities have been identified in HP Security Manager which may allow escalation of privilege, arbitrary code execution, andHP Security Manager
- CVE-2022-23552Grafana stored XSS in FileUploader component grafana
- CVE-2023-0558ContentStudio <= 1.2.5 - Authorization BypassContentStudio
- CVE-2023-0557ContentStudio <= 1.2.5 - Information ExposureContentStudio
- CVE-2023-0555Quick Restaurant Menu <= 2.0.2 - Missing Authorizationalejandropascual Quick Restaurant Menu
- CVE-2023-0554Quick Restaurant Menu <= 2.0.2 - Cross-Site Request Forgeryalejandropascual Quick Restaurant Menu
- CVE-2023-0550Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Referencealejandropascual Quick Restaurant Menu
- CVE-2021-41231OpenMage LTS DataFlow upload remote code execution vulnerabilityOpenMage magento-lts · openmage/magento-lts
- CVE-2021-41144OpenMage LTS authenticated remote code execution through layout updateOpenMage magento-lts · openmage/magento-lts
- CVE-2021-41143OpenMage LTS arbitrary file deletion in customer media allows for remote code executionOpenMage magento-lts · openmage/magento-lts
- CVE-2021-39217OpenMage LTS arbitrary command execution in custom layout update through blocksOpenMage magento-lts · openmage/magento-lts
- CVE-2019-25053A path traversal vulnerability exists in Sage FRP 1000 before November 2019.
- CVE-2020-36658In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, be
- CVE-2020-36659In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP back
- CVE-2022-39812Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader.
- CVE-2022-4139An incorrect TLB flush issue was found in the Linux kernel’s GPU i915 kernel driver, potentially leading to random memory corruption or datakernel
- CVE-2022-44026An issue was discovered in NetScout nGeniusONE 6.3.2 before P10.
- CVE-2022-44715Improper File Permissions in NetScout nGeniusONE 6.3.2 build 904 allows authenticated remote users to gain permissions via a crafted payload
- CVE-2022-48069Totolink A830R V4.1.2cu.5182 was discovered to contain a command injection vulnerability via the QUERY_STRING parameter.
- CVE-2022-48070Phicomm K2 v22.6.534.263 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade f
- CVE-2022-48071Phicomm K2 v22.6.534.263 was discovered to store the root and admin passwords in plaintext.
- CVE-2022-48072Phicomm K2G v22.6.3.20 was discovered to contain a command injection vulnerability via the autoUpTime parameter in the automatic upgrade fun
- CVE-2022-48073Phicomm K2G v22.6.3.20 was discovered to store the root and admin passwords in plaintext.
- CVE-2022-48116AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php.
- CVE-2023-22240ZDI-CAN-19517: Adobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-22241ZDI-CAN-19516: Adobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
- CVE-2023-22242ZDI-CAN-19515: Adobe Acrobat Reader DC AcroForm Annotation Out-Of-Bounds Write Remote Code Execution VulnerabilityAdobe Acrobat Reader
Medium, low and unrated 46
- CVE-2023-23627Sanitize vulnerable to Cross-site Scripting via Improper neutralization of `noscript` elementrgrove sanitize · sanitize
- CVE-2023-23624Discourse's exclude_tags param could leak which topics had a specific hidden tagdiscourse
- CVE-2023-23617OpenMage LTS has DoS vulnerability in MaliciousCode filterOpenMage magento-lts · openmage/magento-lts
- CVE-2023-22737wire-server vulnerable to unauthorized removal of Bots from Conversationswireapp wire-server
- CVE-2022-39324Grafana vulnerable to spoofing originalUrl of snapshotsgrafana · github.com/grafana/grafana
- CVE-2022-39380wire-webapp contains Improper Handling of Exceptional Conditions leading to a DoS via Markdown Renderingwireapp wire-webapp
- CVE-2023-0553Quick Restaurant Menu <= 2.0.2 - Authenticated (Administrator+) Cross-Site Scriptingalejandropascual Quick Restaurant Menu
- CVE-2023-0549YAFNET Private Message PostPrivateMessage cross site scriptingYAFNET
- CVE-2021-21395Magneto-lts vulnerable to Cross-Site Request ForgeryOpenMage magento-lts · openmage/magento-lts
- CVE-2023-0534SourceCodester Online Tours & Travels Management System expense_report.php sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2023-0533SourceCodester Online Tours & Travels Management System expense_report.php sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2023-0532SourceCodester Online Tours & Travels Management System disapprove_user.php sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2023-0531SourceCodester Online Tours & Travels Management System booking_report.php sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2023-0530SourceCodester Online Tours & Travels Management System approve_user.php sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2023-0529SourceCodester Online Tours & Travels Management System add_payment.php sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2023-0528SourceCodester Online Tours & Travels Management System abc.php sql injectionSourceCodester Online Tours & Travels Management System
- CVE-2023-0527PHPGurukul Online Security Guards Hiring System search-request.php cross site scriptingPHPGurukul Online Security Guards Hiring System
- CVE-2023-22740Discourse vulnerable to Allocation of Resources Without Limits via Chat draftsdiscourse
- CVE-2022-2712In Eclipse GlassFish versions 5.1.0 to 6.2.5, there is a vulnerability in relative path traversal because it does not filter request path stThe Eclipse Foundation Eclipse GlassFish · org.glassfish.ma…
- CVE-2022-39813Italtel NetMatch-S CI 5.2.0-20211008 allows Multiple Reflected/Stored XSS issues under NMSCIWebGui/j_security_check via the j_username param
- CVE-2022-4201A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to cGitLab
- CVE-2022-4205In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.GitLab
- CVE-2022-4255An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 whiGitLab
- CVE-2022-4285An illegal memory access flaw was found in the binutils package.binutils
- CVE-2022-4335A blind SSRF vulnerability was identified in all versions of GitLab EE prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 whichGitLab
- CVE-2022-43978Limited Authentication bypass due to hardcoded secretArtica PFMS Pandora FMS
- CVE-2022-43979Path Traversal leading to Local File InclusionArtica PFMS Pandora FMS
- CVE-2022-43980Cross-site scripting vulnerability in the network maps edit functionalityArtica PFMS Pandora FMS
- CVE-2022-44024An issue was discovered in NetScout nGeniusONE 6.3.2 before P10.
- CVE-2022-44025An issue was discovered in NetScout nGeniusONE 6.3.2 before P10.
- CVE-2022-44027An issue was discovered in NetScout nGeniusONE 6.3.2 before P10.
- CVE-2022-44028An issue was discovered in NetScout nGeniusONE 6.3.2 before P10.
- CVE-2022-44029An issue was discovered in NetScout nGeniusONE 6.3.2 before P10.
- CVE-2022-44717An issue was discovered in NetScout nGeniusONE 6.3.2 build 904.
- CVE-2022-44718An issue was discovered in NetScout nGeniusONE 6.3.2 build 904.
- CVE-2022-46968A stored cross-site scripting (XSS) vulnerability in /index.php?page=help of Revenue Collection System v1.0 allows attackers to execute arbi
- CVE-2022-47632Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and impr
- CVE-2022-48007A stored cross-site scripting (XSS) vulnerability in identification.php of Piwigo v13.4.0 allows attackers to execute arbitrary web scripts
- CVE-2022-48010LimeSurvey v5.4.15 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /index.php/surveyAdministrat
- CVE-2022-48012Opencats v0.9.7 was discovered to contain a reflected cross-site scripting (XSS) vulnerability via the component /opencats/index.php?m=setti
- CVE-2022-48013Opencats v0.9.7 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the component /opencats/index.php?m=calendar.
- CVE-2022-48067An information disclosure vulnerability in Totolink A830R V4.1.2cu.5182 allows attackers to obtain the root password via a brute-force attac
- CVE-2022-48118Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
- CVE-2023-23616Discourse membership requests lack character limitdiscourse
- CVE-2023-23620Discourse restricted tag routes leak topic informationdiscourse
- CVE-2023-24060Haven 5d15944 allows Server-Side Request Forgery (SSRF) via the feed[url]= Feeds functionality.